@ploaness/governance 1.7.0 → 1.9.0

package/dist/compliance-report.js

@@ -0,0 +1,240 @@
+// The open source software report on dependencies: the evidence behind the licence and vulnerability
+// gates, assembled into one model a reviewer outside the project can read. Everything here is derived from
+// values already read.
+import { asRecord, readKey } from './json-shapes.js';
+import { LICENSE_POLICY, licenseClassOf } from './license-allowlist.js';
+import { coordinateOf } from './license-inventory.js';
+import { severityRank, } from './vulnerability-policy.js';
+const byText = (left, right) => left.localeCompare(right);
+const byName = (left, right) => left.name.localeCompare(right.name) || left.version.localeCompare(right.version);
+// A directory dependency has no version, so it is identified by its name alone.
+const coordinatesOf = (entry) => entry.versions.length === 0
+    ? [entry.name]
+    : entry.versions.map((version) => coordinateOf(entry.name, version));
+const rowsOf = (entry) => (entry.versions.length === 0 ? [''] : entry.versions).map((version) => ({ version, entry }));
+const reportPackages = (input) => {
+    const production = new Set(input.production.flatMap((entry) => coordinatesOf(entry)));
+    const direct = new Set(input.directNames);
+    return input.packages
+        .flatMap((entry) => rowsOf(entry))
+        .map(({ version, entry }) => ({
+        name: entry.name,
+        version,
+        license: entry.license,
+        licenseClass: licenseClassOf(entry.license),
+        isProduction: production.has(version.length > 0 ? coordinateOf(entry.name, version) : entry.name),
+        isDirect: direct.has(entry.name),
+        homepage: entry.homepage,
+    }))
+        .toSorted(byName);
+};
+const countLicenses = (packages) => [...new Set(packages.map((row) => row.license))]
+    .map((license) => ({
+    license,
+    licenseClass: licenseClassOf(license),
+    count: packages.filter((row) => row.license === license).length,
+}))
+    .toSorted((left, right) => right.count - left.count || left.license.localeCompare(right.license));
+const countClasses = (packages) => ({
+    permissive: packages.filter((row) => row.licenseClass === 'permissive').length,
+    'weak-copyleft': packages.filter((row) => row.licenseClass === 'weak-copyleft').length,
+    refused: packages.filter((row) => row.licenseClass === 'refused').length,
+});
+// Every advisory once, most severe first, so the list reads the way a reviewer triages.
+const reportAdvisories = (classification, packages) => {
+    const production = new Set(packages.filter((row) => row.isProduction).map((row) => row.name));
+    return [
+        ...classification.open.map((advisory) => ({
+            advisory,
+            isProduction: production.has(advisory.packageName),
+            mitigation: undefined,
+            isHarnessMitigation: false,
+        })),
+        ...classification.mitigated.map((entry) => ({
+            advisory: entry.advisory,
+            isProduction: production.has(entry.advisory.packageName),
+            mitigation: entry.exception,
+            isHarnessMitigation: entry.isHarnessException,
+        })),
+    ].toSorted((left, right) => severityRank(right.advisory.severity) - severityRank(left.advisory.severity) ||
+        left.advisory.packageName.localeCompare(right.advisory.packageName) ||
+        left.advisory.id.localeCompare(right.advisory.id));
+};
+// A line that opens a list item or a copyright statement starts a new line of its own, and so does the line
+// after a heading or a ruled separator. Every other line of a paragraph continues the one before it:
+// licence files are wrapped at a fixed width for a terminal, and keeping those breaks in a proportional
+// column leaves every line ragged. A copyright statement names a year, (c) or the sign, so a sentence that
+// merely wraps before "Copyright Holder" continues.
+const LIST_ITEM = /^(?:[-*+\u{2022}]\s|\(?(?:\d{1,3}|[a-z]|[ivx]{2,4})[.)]\s)/iu;
+const COPYRIGHT_LINE = /^(?:copyright\s+(?:\(c\)|\u{A9}|\d{4})|\u{A9})/iu;
+const PARAGRAPH_BREAK = /\n[ \t]*\n/u;
+// Licence files bundled into a Markdown document quote each licence (`> `) and title it with a heading
+// (`## name`), and list the package's facts as `License: MIT` lines. The markers are markup, not words.
+const QUOTE_MARKERS = /^[ \t]*(?:>[ \t]?)+/u;
+const MARKDOWN_HEADING = /^#{1,6}[ \t]+/u;
+const FIELD_LINE = /^[A-Z][A-Za-z]{1,20}(?: [A-Za-z]{1,20})?:[ \t]/u;
+const SEPARATOR = /^[-=_*~]{3,}$/u;
+const HEADING_LENGTH = 40;
+const LOWERCASE = /\p{Ll}/u;
+const LETTER = /\p{L}/u;
+const HYPHENATED_END = /\p{L}-$/u;
+const LOWERCASE_START = /^\p{Ll}/u;
+// A short line with letters and no lowercase one is a heading such as PREAMBLE, not the start of a sentence.
+const isHeading = (line) => line.length < HEADING_LENGTH && LETTER.test(line) && !LOWERCASE.test(line);
+// The line itself announces something new: a list item, a copyright statement, a field, a heading, a rule.
+const opensLine = (line) => LIST_ITEM.test(line) ||
+    COPYRIGHT_LINE.test(line) ||
+    FIELD_LINE.test(line) ||
+    MARKDOWN_HEADING.test(line) ||
+    SEPARATOR.test(line);
+// The line before it stands alone, so nothing continues it: a field, a rule, a heading.
+const endsLine = (previous) => FIELD_LINE.test(previous) || SEPARATOR.test(previous) || MARKDOWN_HEADING.test(previous) || isHeading(previous);
+const startsLine = (previous, line) => opensLine(line) || endsLine(previous);
+const joinLines = (lines, line) => {
+    const previous = lines.at(-1);
+    if (previous === undefined || startsLine(previous, line)) {
+        return [...lines, line];
+    }
+    // A word broken at a hyphen is rejoined without a space, so `non-` and `exclusive` read `non-exclusive`.
+    const separator = HYPHENATED_END.test(previous) && LOWERCASE_START.test(line) ? '' : ' ';
+    return [...lines.slice(0, -1), `${previous}${separator}${line}`];
+};
+/**
+ * Reflow a licence file for a proportional column. Words and their order are unchanged; only the
+ * fixed-width line breaks inside a paragraph are removed, and runs of spaces collapse to one.
+ * @param text the licence file as shipped.
+ * @returns the text with paragraphs separated by a blank line and kept line breaks by a newline.
+ */
+export const reflowLicenseText = (text) => text
+    .replaceAll('\r\n', '\n')
+    .split('\n')
+    .map((line) => line.replace(QUOTE_MARKERS, ''))
+    .join('\n')
+    .trim()
+    .split(PARAGRAPH_BREAK)
+    .map((block) => block
+    .split('\n')
+    .map((line) => line.trim().replaceAll(/[ \t]+/gu, ' '))
+    .filter((line) => line.length > 0)
+    .reduce((lines, line) => joinLines(lines, line), [])
+    .join('\n'))
+    .filter((block) => block.length > 0)
+    .join('\n\n');
+// Attribution obligations attach to what is distributed, so the notices cover the production graph.
+// Identical texts are printed once; most permissive licences differ only in their copyright line, so
+// the grouping is by the reflowed text rather than by the licence name.
+const groupNotices = (notices, distributed) => {
+    const entries = notices
+        .filter((notice) => distributed.has(notice.coordinate))
+        .flatMap((notice) => notice.files.map((file) => ({
+        text: reflowLicenseText(file.text),
+        fileName: file.name,
+        coordinate: notice.coordinate,
+    })));
+    return [...new Set(entries.map((entry) => entry.text))]
+        .map((text) => {
+        const sharing = entries.filter((entry) => entry.text === text);
+        return {
+            text,
+            fileNames: [...new Set(sharing.map((entry) => entry.fileName))].toSorted(byText),
+            coordinates: [...new Set(sharing.map((entry) => entry.coordinate))].toSorted(byText),
+        };
+    })
+        .toSorted((left, right) => (left.coordinates[0] ?? '').localeCompare(right.coordinates[0] ?? ''));
+};
+const coordinateOfRow = (row) => row.version.length > 0 ? coordinateOf(row.name, row.version) : row.name;
+const draftReasonsOf = (input, isWithinPolicy) => [
+    ...(input.source.isDirty ? ['The working tree has uncommitted changes, so no commit describes this source.'] : []),
+    ...(isWithinPolicy ? [] : ["The dependencies don't satisfy the policy this report states."]),
+];
+/**
+ * Assemble the compliance report.
+ * @param input the inventory, the vulnerability classification and the provenance already read.
+ * @returns the report model the renderer prints.
+ */
+export const buildComplianceReport = (input) => {
+    const packages = reportPackages(input);
+    const refused = packages.filter((row) => row.licenseClass === 'refused');
+    const isMeetsPolicy = refused.length === 0 && input.vulnerabilities.open.length === 0 && input.vulnerabilities.deadEntries.length === 0;
+    const distributed = new Set(packages
+        .filter((row) => row.isProduction)
+        .map((row) => coordinateOfRow(row)));
+    const shipped = new Set(input.notices
+        .filter((notice) => notice.files.length > 0)
+        .map((notice) => notice.coordinate));
+    return {
+        projectName: input.projectName,
+        projectDescription: input.projectDescription,
+        source: input.source,
+        generatedAt: input.generatedAt,
+        harnessVersion: input.harnessVersion,
+        isWithinPolicy: isMeetsPolicy,
+        draftReasons: draftReasonsOf(input, isMeetsPolicy),
+        packages,
+        productionCount: packages.filter((row) => row.isProduction).length,
+        directCount: packages.filter((row) => row.isDirect).length,
+        licenseCounts: countLicenses(packages),
+        classCounts: countClasses(packages),
+        copyleft: packages.filter((row) => row.licenseClass === 'weak-copyleft'),
+        refused,
+        policy: LICENSE_POLICY,
+        vulnerabilities: input.vulnerabilities,
+        advisories: reportAdvisories(input.vulnerabilities, packages),
+        advisoryRecords: input.advisoryRecords,
+        auditedAt: input.auditedAt,
+        sbom: input.sbom,
+        notices: groupNotices(input.notices, distributed),
+        withoutNotice: [...distributed].filter((coordinate) => !shipped.has(coordinate)).toSorted(byText),
+    };
+};
+/** Where the compliance report is written unless the command names another directory. */
+export const DEFAULT_REPORT_OUTPUT = 'dist/compliance';
+/** The file name every report starts with, which is also how a stale one is recognised. */
+export const REPORT_FILE_PREFIX = 'oss-compliance-report-';
+const SHORT_COMMIT_LENGTH = 12;
+const NOT_A_NAME_CHARACTER = /[^a-z0-9]+/u;
+/**
+ * The report's file name without extension: the project and the commit it describes.
+ * @param projectName the root manifest's name, which may be scoped.
+ * @param commit the source commit.
+ * @returns a name safe on every filesystem.
+ */
+export const reportFileStem = (projectName, commit) => {
+    const name = projectName
+        .toLowerCase()
+        .split(NOT_A_NAME_CHARACTER)
+        .filter((part) => part.length > 0)
+        .join('-');
+    return `${REPORT_FILE_PREFIX}${name.length > 0 ? name : 'project'}-${commit.slice(0, SHORT_COMMIT_LENGTH)}`;
+};
+const OUTPUT_OPTION = '--output';
+/**
+ * Parse the compliance report command grammar: no argument, or one output directory.
+ * @param arguments_ the arguments after the command name.
+ * @returns the output directory, or undefined when the arguments are not that grammar.
+ */
+export const parseComplianceReportArguments = (arguments_) => {
+    if (arguments_.length === 0) {
+        return { output: DEFAULT_REPORT_OUTPUT };
+    }
+    const [option, value = '', ...extra] = arguments_;
+    if (option !== OUTPUT_OPTION || extra.length > 0) {
+        return undefined;
+    }
+    return value.length > 0 && !value.startsWith('-') ? { output: value } : undefined;
+};
+const DECLARING_GROUPS = [
+    'dependencies',
+    'devDependencies',
+    'optionalDependencies',
+    'peerDependencies',
+];
+/**
+ * The packages any workspace manifest declares, which is what makes a dependency direct.
+ * @param manifests every workspace manifest, as parsed JSON.
+ * @returns the declared package names, each once.
+ */
+export const directDependencyNames = (manifests) => [
+    ...new Set(manifests.flatMap((manifest) => DECLARING_GROUPS.flatMap((group) => Object.keys(asRecord(readKey(manifest, group)))))),
+];
+//# sourceMappingURL=compliance-report.js.map

package/dist/compliance-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance-report.js","sourceRoot":"","sources":["../src/compliance-report.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,2GAA2G;AAC3G,uBAAuB;AACvB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAqB,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC1F,OAAO,EAAE,YAAY,EAAyB,MAAM,wBAAwB,CAAA;AAC5E,OAAO,EAGL,YAAY,GAGb,MAAM,2BAA2B,CAAA;AAgHlC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;AAEjF,MAAM,MAAM,GAAG,CAAC,IAAmB,EAAE,KAAoB,EAAU,EAAE,CACnE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;AAElF,gFAAgF;AAChF,MAAM,aAAa,GAAG,CAAC,KAAuB,EAAqB,EAAE,CACnE,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;IACzB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IACd,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAe,EAAU,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;AAExF,MAAM,MAAM,GAAG,CAAC,KAAuB,EAA6E,EAAE,CACpH,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;AAEtG,MAAM,cAAc,GAAG,CAAC,KAA4B,EAA4B,EAAE;IAChF,MAAM,UAAU,GAAwB,IAAI,GAAG,CAC7C,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,KAAuB,EAAqB,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAC/F,CAAA;IACD,MAAM,MAAM,GAAwB,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IAC9D,OAAO,KAAK,CAAC,QAAQ;SAClB,OAAO,CAAC,CAAC,KAAuB,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SACnD,GAAG,CACF,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAiB,EAAE,CAAC,CAAC;QACtC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO;QACP,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC;QAC3C,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACjG,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;QAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CACH;SACA,QAAQ,CAAC,MAAM,CAAC,CAAA;AACrB,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,QAAkC,EAA2B,EAAE,CACpF,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAkB,EAAU,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;KACpE,GAAG,CACF,CAAC,OAAe,EAAgB,EAAE,CAAC,CAAC;IAClC,OAAO;IACP,YAAY,EAAE,cAAc,CAAC,OAAO,CAAC;IACrC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAkB,EAAW,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,MAAM;CACxF,CAAC,CACH;KACA,QAAQ,CACP,CAAC,IAAkB,EAAE,KAAmB,EAAU,EAAE,CAClD,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CACxE,CAAA;AAEL,MAAM,YAAY,GAAG,CAAC,QAAkC,EAA0C,EAAE,CAAC,CAAC;IACpG,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAkB,EAAW,EAAE,CAAC,GAAG,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC,MAAM;IACtG,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAkB,EAAW,EAAE,CAAC,GAAG,CAAC,YAAY,KAAK,eAAe,CAAC,CAAC,MAAM;IAC9G,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAkB,EAAW,EAAE,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,MAAM;CACjG,CAAC,CAAA;AAEF,wFAAwF;AACxF,MAAM,gBAAgB,GAAG,CACvB,cAA2C,EAC3C,QAAkC,EACP,EAAE;IAC7B,MAAM,UAAU,GAAwB,IAAI,GAAG,CAC7C,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAkB,EAAW,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,GAAkB,EAAU,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CACjH,CAAA;IACD,OAAO;QACL,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CACxB,CAAC,QAAkB,EAAkB,EAAE,CAAC,CAAC;YACvC,QAAQ;YACR,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;YAClD,UAAU,EAAE,SAAS;YACrB,mBAAmB,EAAE,KAAK;SAC3B,CAAC,CACH;QACD,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAC7B,CAAC,KAAwB,EAAkB,EAAE,CAAC,CAAC;YAC7C,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;YACxD,UAAU,EAAE,KAAK,CAAC,SAAS;YAC3B,mBAAmB,EAAE,KAAK,CAAC,kBAAkB;SAC9C,CAAC,CACH;KACF,CAAC,QAAQ,CACR,CAAC,IAAoB,EAAE,KAAqB,EAAU,EAAE,CACtD,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC5E,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QACnE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CACpD,CAAA;AACH,CAAC,CAAA;AAED,4GAA4G;AAC5G,qGAAqG;AACrG,wGAAwG;AACxG,2GAA2G;AAC3G,oDAAoD;AACpD,MAAM,SAAS,GAAW,8DAA8D,CAAA;AACxF,MAAM,cAAc,GAAW,kDAAkD,CAAA;AACjF,MAAM,eAAe,GAAW,aAAa,CAAA;AAC7C,uGAAuG;AACvG,wGAAwG;AACxG,MAAM,aAAa,GAAW,sBAAsB,CAAA;AACpD,MAAM,gBAAgB,GAAW,gBAAgB,CAAA;AACjD,MAAM,UAAU,GAAW,iDAAiD,CAAA;AAC5E,MAAM,SAAS,GAAW,gBAAgB,CAAA;AAC1C,MAAM,cAAc,GAAW,EAAE,CAAA;AACjC,MAAM,SAAS,GAAW,SAAS,CAAA;AACnC,MAAM,MAAM,GAAW,QAAQ,CAAA;AAC/B,MAAM,cAAc,GAAW,UAAU,CAAA;AACzC,MAAM,eAAe,GAAW,UAAU,CAAA;AAE1C,6GAA6G;AAC7G,MAAM,SAAS,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEvH,2GAA2G;AAC3G,MAAM,SAAS,GAAG,CAAC,IAAY,EAAW,EAAE,CAC1C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;IACpB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;IACzB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;IACrB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;IAC3B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEtB,wFAAwF;AACxF,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAW,EAAE,CAC7C,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAA;AAEjH,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAErG,MAAM,SAAS,GAAG,CAAC,KAAwB,EAAE,IAAY,EAAqB,EAAE;IAC9E,MAAM,QAAQ,GAAuB,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACjD,IAAI,QAAQ,KAAK,SAAS,IAAI,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;QACzD,OAAO,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,CAAA;IACzB,CAAC;IACD,yGAAyG;IACzG,MAAM,SAAS,GAAW,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;IAChG,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,GAAG,SAAS,GAAG,IAAI,EAAE,CAAC,CAAA;AAClE,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAU,EAAE,CACxD,IAAI;KACD,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC;KACxB,KAAK,CAAC,IAAI,CAAC;KACX,GAAG,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;KAC9D,IAAI,CAAC,IAAI,CAAC;KACV,IAAI,EAAE;KACN,KAAK,CAAC,eAAe,CAAC;KACtB,GAAG,CAAC,CAAC,KAAa,EAAU,EAAE,CAC7B,KAAK;KACF,KAAK,CAAC,IAAI,CAAC;KACX,GAAG,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;KACtE,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;KAClD,MAAM,CAAC,CAAC,KAAwB,EAAE,IAAY,EAAqB,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;KACjG,IAAI,CAAC,IAAI,CAAC,CACd;KACA,MAAM,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;KACpD,IAAI,CAAC,MAAM,CAAC,CAAA;AAQjB,oGAAoG;AACpG,qGAAqG;AACrG,wEAAwE;AACxE,MAAM,YAAY,GAAG,CAAC,OAAkC,EAAE,WAAgC,EAA0B,EAAE;IACpH,MAAM,OAAO,GAA2B,OAAO;SAC5C,MAAM,CAAC,CAAC,MAAsB,EAAW,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;SAC/E,OAAO,CAAC,CAAC,MAAsB,EAA0B,EAAE,CAC1D,MAAM,CAAC,KAAK,CAAC,GAAG,CACd,CAAC,IAAgB,EAAe,EAAE,CAAC,CAAC;QAClC,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAClC,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC,CACH,CACF,CAAA;IACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAkB,EAAU,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;SACzE,GAAG,CAAC,CAAC,IAAY,EAAe,EAAE;QACjC,MAAM,OAAO,GAA2B,OAAO,CAAC,MAAM,CAAC,CAAC,KAAkB,EAAW,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;QAC5G,OAAO;YACL,IAAI;YACJ,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAkB,EAAU,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YACrG,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAkB,EAAU,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;SAC1G,CAAA;IACH,CAAC,CAAC;SACD,QAAQ,CAAC,CAAC,IAAiB,EAAE,KAAkB,EAAU,EAAE,CAC1D,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CACtE,CAAA;AACL,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,GAAkB,EAAU,EAAE,CACrD,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAA;AAEzE,MAAM,cAAc,GAAG,CAAC,KAA4B,EAAE,cAAuB,EAAqB,EAAE,CAAC;IACnG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,+EAA+E,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClH,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC;CAC7F,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,KAA4B,EAAoB,EAAE;IACtF,MAAM,QAAQ,GAA6B,cAAc,CAAC,KAAK,CAAC,CAAA;IAChE,MAAM,OAAO,GAA6B,QAAQ,CAAC,MAAM,CACvD,CAAC,GAAkB,EAAW,EAAE,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,CAChE,CAAA;IACD,MAAM,aAAa,GACjB,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,CAAA;IACnH,MAAM,WAAW,GAAwB,IAAI,GAAG,CAC9C,QAAQ;SACL,MAAM,CAAC,CAAC,GAAkB,EAAW,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC;SACzD,GAAG,CAAC,CAAC,GAAkB,EAAU,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAC7D,CAAA;IACD,MAAM,OAAO,GAAwB,IAAI,GAAG,CAC1C,KAAK,CAAC,OAAO;SACV,MAAM,CAAC,CAAC,MAAsB,EAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;SACpE,GAAG,CAAC,CAAC,MAAsB,EAAU,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAC9D,CAAA;IACD,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc,EAAE,aAAa;QAC7B,YAAY,EAAE,cAAc,CAAC,KAAK,EAAE,aAAa,CAAC;QAClD,QAAQ;QACR,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAkB,EAAW,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM;QAC1F,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAkB,EAAW,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM;QAClF,aAAa,EAAE,aAAa,CAAC,QAAQ,CAAC;QACtC,WAAW,EAAE,YAAY,CAAC,QAAQ,CAAC;QACnC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAkB,EAAW,EAAE,CAAC,GAAG,CAAC,YAAY,KAAK,eAAe,CAAC;QAChG,OAAO;QACP,MAAM,EAAE,cAAc;QACtB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC,eAAe,EAAE,QAAQ,CAAC;QAC7D,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC;QACjD,aAAa,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,UAAkB,EAAW,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;KACnH,CAAA;AACH,CAAC,CAAA;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAW,iBAAiB,CAAA;AAE9D,2FAA2F;AAC3F,MAAM,CAAC,MAAM,kBAAkB,GAAW,wBAAwB,CAAA;AAElE,MAAM,mBAAmB,GAAW,EAAE,CAAA;AACtC,MAAM,oBAAoB,GAAW,aAAa,CAAA;AAElD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,WAAmB,EAAE,MAAc,EAAU,EAAE;IAC5E,MAAM,IAAI,GAAW,WAAW;SAC7B,WAAW,EAAE;SACb,KAAK,CAAC,oBAAoB,CAAC;SAC3B,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SAClD,IAAI,CAAC,GAAG,CAAC,CAAA;IACZ,OAAO,GAAG,kBAAkB,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,EAAE,CAAA;AAC7G,CAAC,CAAA;AAED,MAAM,aAAa,GAAW,UAAU,CAAA;AAExC;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,UAA6B,EACY,EAAE;IAC3C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IAC1C,CAAC;IACD,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,UAAU,CAAA;IACjD,IAAI,MAAM,KAAK,aAAa,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AACnF,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAsB;IAC1C,cAAc;IACd,iBAAiB;IACjB,sBAAsB;IACtB,kBAAkB;CACnB,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,SAA6B,EAAqB,EAAE,CAAC;IACzF,GAAG,IAAI,GAAG,CACR,SAAS,CAAC,OAAO,CAAC,CAAC,QAAiB,EAAqB,EAAE,CACzD,gBAAgB,CAAC,OAAO,CAAC,CAAC,KAAa,EAAqB,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAChH,CACF;CACF,CAAA"}

package/dist/index.d.ts

@@ -15,6 +15,10 @@ export * from './bundle-budget.js';
 export * from './checkov-check.js';
 export * from './checkov-policy.js';
 export * from './commit-message.js';
+export * from './compliance-report.js';
+export * from './compliance-report-assets.js';
+export * from './compliance-report-html.js';
+export { contentsPages } from './compliance-report-outline.js';
 export * from './config-references.js';
 export * from './container-failure.js';
 export * from './container-files.js';
@@ -42,6 +46,7 @@ export * from './layout-defects.js';
 export * from './layout-snapshot.js';
 export * from './layout-text.js';
 export * from './license-allowlist.js';
+export * from './license-inventory.js';
 export * from './network-policy.js';
 export * from './oxlint-policy.js';
 export * from './oxlint-report.js';
@@ -55,6 +60,7 @@ export * from './payload-defaults.js';
 export * from './payload-policy.js';
 export * from './payload-security.js';
 export * from './payload-source.js';
+export * from './pdf-outline.js';
 export * from './production-server.js';
 export * from './relationship-cleanup.js';
 export * from './release-age.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,2BAA2B,CAAA;AACzC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,0BAA0B,CAAA;AACxC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,0BAA0B,CAAA;AACxC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,2BAA2B,CAAA;AACzC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,+BAA+B,CAAA;AAC7C,cAAc,6BAA6B,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AAC9D,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,2BAA2B,CAAA;AACzC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,0BAA0B,CAAA;AACxC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,0BAA0B,CAAA;AACxC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,2BAA2B,CAAA;AACzC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA"}

package/dist/index.js

@@ -19,6 +19,10 @@ export * from './bundle-budget.js';
 export * from './checkov-check.js';
 export * from './checkov-policy.js';
 export * from './commit-message.js';
+export * from './compliance-report.js';
+export * from './compliance-report-assets.js';
+export * from './compliance-report-html.js';
+export { contentsPages } from './compliance-report-outline.js';
 export * from './config-references.js';
 export * from './container-failure.js';
 export * from './container-files.js';
@@ -46,6 +50,7 @@ export * from './layout-defects.js';
 export * from './layout-snapshot.js';
 export * from './layout-text.js';
 export * from './license-allowlist.js';
+export * from './license-inventory.js';
 export * from './network-policy.js';
 export * from './oxlint-policy.js';
 export * from './oxlint-report.js';
@@ -59,6 +64,7 @@ export * from './payload-defaults.js';
 export * from './payload-policy.js';
 export * from './payload-security.js';
 export * from './payload-source.js';
+export * from './pdf-outline.js';
 export * from './production-server.js';
 export * from './relationship-cleanup.js';
 export * from './release-age.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,oGAAoG;AACpG,mGAAmG;AACnG,0DAA0D;AAE1D,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,2BAA2B,CAAA;AACzC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,0BAA0B,CAAA;AACxC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,0BAA0B,CAAA;AACxC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,2BAA2B,CAAA;AACzC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,oGAAoG;AACpG,mGAAmG;AACnG,0DAA0D;AAE1D,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,+BAA+B,CAAA;AAC7C,cAAc,6BAA6B,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AAC9D,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,2BAA2B,CAAA;AACzC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,0BAA0B,CAAA;AACxC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,0BAA0B,CAAA;AACxC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,2BAA2B,CAAA;AACzC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA"}

package/dist/license-allowlist.d.ts

@@ -7,6 +7,20 @@
  * @returns whether the policy permits it.
  */
 export declare const isLicenseAllowed: (expression: string) => boolean;
+/** How the policy admits a declared licence. */
+export type LicenseClass = 'permissive' | 'weak-copyleft' | 'refused';
+/**
+ * Classify a declared licence by the least restrictive way the policy admits it. An expression that a
+ * permissive choice satisfies is permissive, even when a copyleft alternative is also offered.
+ * @param expression the declared licence.
+ * @returns the class the policy places it in.
+ */
+export declare const licenseClassOf: (expression: string) => LicenseClass;
+/** The license identifiers the policy admits, by group, for a reader of the policy. */
+export declare const LICENSE_POLICY: {
+    readonly permissive: readonly string[];
+    readonly weakCopyleft: readonly string[];
+};
 export interface LicensedPackage {
     readonly name: string;
     readonly license: string;

package/dist/license-allowlist.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"license-allowlist.d.ts","sourceRoot":"","sources":["../src/license-allowlist.ts"],"names":[],"mappings":"AAmKA;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAAI,YAAY,MAAM,KAAG,OAQrD,CAAA;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAGD,eAAO,MAAM,qBAAqB,GAAI,UAAU,SAAS,eAAe,EAAE,KAAG,SAAS,eAAe,EACP,CAAA"}
+{"version":3,"file":"license-allowlist.d.ts","sourceRoot":"","sources":["../src/license-allowlist.ts"],"names":[],"mappings":"AAoLA;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAAI,YAAY,MAAM,KAAG,OAAiE,CAAA;AAEvH,gDAAgD;AAChD,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,eAAe,GAAG,SAAS,CAAA;AAErE;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,YAAY,MAAM,KAAG,YAKnD,CAAA;AAED,uFAAuF;AACvF,eAAO,MAAM,cAAc,EAAE;IAC3B,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CACiB,CAAA;AAE3D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAGD,eAAO,MAAM,qBAAqB,GAAI,UAAU,SAAS,eAAe,EAAE,KAAG,SAAS,eAAe,EACP,CAAA"}

package/dist/license-allowlist.js

@@ -73,12 +73,14 @@ const ALLOWED = new Set([...PERMISSIVE, ...WEAK_COPYLEFT]);
 // least three ways. The allowlist is matched on a folded id so a casing difference is not a licence
 // decision. A `WITH` exception (`GPL-2.0 WITH Classpath-exception-2.0`) names the same licence plus a
 // grant, so the licence half decides; a `+` suffix means "or later", which is the same licence too.
-const ALLOWED_FOLDED = new Set([...ALLOWED].map((id) => id.toLowerCase()));
+const folded = (ids) => new Set(ids.map((id) => id.toLowerCase()));
+const ALLOWED_FOLDED = folded([...ALLOWED]);
+const PERMISSIVE_FOLDED = folded(PERMISSIVE);
 // Anchored on a single space run rather than a nested quantifier: `\s+WITH\s+(?:\S.*)?$` backtracks
 // super-linearly on a long id, and an expression comes from a registry rather than from this repository.
 const WITH_EXCEPTION = /\sWITH\s[\s\S]*$/i;
 const OR_LATER = /\+$/;
-const isAllowedId = (id) => ALLOWED_FOLDED.has(id.trim().replace(WITH_EXCEPTION, '').replace(OR_LATER, '').toLowerCase());
+const acceptsIdIn = (accepted) => (id) => accepted.has(id.trim().replace(WITH_EXCEPTION, '').replace(OR_LATER, '').toLowerCase());
 // The operators, lowest precedence first. SPDX binds AND more tightly than OR, so a correct evaluator
 // splits on OR before AND - and the ONLY correct order is that one. Splitting on AND first, after
 // stripping the parentheses, turned `(MIT OR Apache-2.0) AND ISC` into the operands
@@ -132,6 +134,17 @@ const unwrap = (expression) => {
         ? unwrap(trimmed.slice(1, -1))
         : trimmed;
 };
+const matchesPolicy = (expression, isAccepted) => {
+    const clean = unwrap(expression);
+    const alternatives = splitOutside(clean, OR);
+    if (alternatives.length > 1) {
+        return alternatives.some((part) => matchesPolicy(part, isAccepted));
+    }
+    const conjuncts = splitOutside(clean, AND);
+    return conjuncts.length > 1
+        ? conjuncts.every((part) => matchesPolicy(part, isAccepted))
+        : isAccepted(clean);
+};
 /**
  * Evaluate an SPDX licence expression against the policy.
  *
@@ -140,15 +153,21 @@ const unwrap = (expression) => {
  * @param expression the declared licence, which may be a compound SPDX expression.
  * @returns whether the policy permits it.
  */
-export const isLicenseAllowed = (expression) => {
-    const clean = unwrap(expression);
-    const alternatives = splitOutside(clean, OR);
-    if (alternatives.length > 1) {
-        return alternatives.some((part) => isLicenseAllowed(part));
+export const isLicenseAllowed = (expression) => matchesPolicy(expression, acceptsIdIn(ALLOWED_FOLDED));
+/**
+ * Classify a declared licence by the least restrictive way the policy admits it. An expression that a
+ * permissive choice satisfies is permissive, even when a copyleft alternative is also offered.
+ * @param expression the declared licence.
+ * @returns the class the policy places it in.
+ */
+export const licenseClassOf = (expression) => {
+    if (matchesPolicy(expression, acceptsIdIn(PERMISSIVE_FOLDED))) {
+        return 'permissive';
     }
-    const conjuncts = splitOutside(clean, AND);
-    return conjuncts.length > 1 ? conjuncts.every((part) => isLicenseAllowed(part)) : isAllowedId(clean);
+    return isLicenseAllowed(expression) ? 'weak-copyleft' : 'refused';
 };
+/** The license identifiers the policy admits, by group, for a reader of the policy. */
+export const LICENSE_POLICY = { permissive: PERMISSIVE, weakCopyleft: WEAK_COPYLEFT };
 // Return the packages whose license is not permitted by policy; an empty array means a clean tree.
 export const findLicenseViolations = (packages) => packages.filter((package_) => !isLicenseAllowed(package_.license));
 //# sourceMappingURL=license-allowlist.js.map

package/dist/license-allowlist.js.map

@@ -1 +1 @@
-{"version":3,"file":"license-allowlist.js","sourceRoot":"","sources":["../src/license-allowlist.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAElD,oGAAoG;AACpG,sEAAsE;AACtE,0EAA0E;AAE1E,6FAA6F;AAC7F,wGAAwG;AACxG,qFAAqF;AAErF,mFAAmF;AACnF,uGAAuG;AACvG,qGAAqG;AACrG,sGAAsG;AACtG,iGAAiG;AACjG,iGAAiG;AACjG,4FAA4F;AAC5F,MAAM,UAAU,GAAsB;IACpC,MAAM;IACN,SAAS;IACT,SAAS;IACT,YAAY;IACZ,cAAc;IACd,cAAc;IACd,cAAc;IACd,SAAS;IACT,eAAe;IACf,WAAW;IACX,WAAW;IACX,SAAS;IACT,SAAS;IACT,KAAK;IACL,KAAK;IACL,OAAO;IACP,cAAc;IACd,MAAM;IACN,SAAS;IACT,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,aAAa;IACb,kBAAkB;IAClB,WAAW;IACX,KAAK;IACL,OAAO;IACP,KAAK;IACL,MAAM;CACP,CAAA;AAED,gGAAgG;AAChG,8FAA8F;AAC9F,sGAAsG;AACtG,uGAAuG;AACvG,mGAAmG;AACnG,EAAE;AACF,iGAAiG;AACjG,qGAAqG;AACrG,kGAAkG;AAClG,oFAAoF;AACpF,MAAM,aAAa,GAAsB;IACvC,UAAU;IACV,UAAU;IACV,SAAS;IACT,SAAS;IACT,UAAU;IACV,eAAe;IACf,mBAAmB;IACnB,UAAU;IACV,eAAe;IACf,mBAAmB;IACnB,SAAS;IACT,SAAS;CACV,CAAA;AAED,MAAM,OAAO,GAAwB,IAAI,GAAG,CAAS,CAAC,GAAG,UAAU,EAAE,GAAG,aAAa,CAAC,CAAC,CAAA;AAEvF,sGAAsG;AACtG,oGAAoG;AACpG,sGAAsG;AACtG,oGAAoG;AACpG,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAU,EAAU,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;AAC/G,oGAAoG;AACpG,yGAAyG;AACzG,MAAM,cAAc,GAAW,mBAAmB,CAAA;AAClD,MAAM,QAAQ,GAAW,KAAK,CAAA;AAE9B,MAAM,WAAW,GAAG,CAAC,EAAU,EAAW,EAAE,CAC1C,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;AAE/F,sGAAsG;AACtG,kGAAkG;AAClG,oFAAoF;AACpF,kGAAkG;AAClG,kFAAkF;AAClF,MAAM,EAAE,GAAW,MAAM,CAAA;AACzB,MAAM,GAAG,GAAW,OAAO,CAAA;AAQ3B,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,SAAiB,EAAU,EAAE;IAC7D,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;QACtB,OAAO,KAAK,GAAG,CAAC,CAAA;IAClB,CAAC;IACD,OAAO,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AAC9C,CAAC,CAAA;AAED,sGAAsG;AACtG,oGAAoG;AACpG,MAAM,eAAe,GAAG,CAAC,IAAY,EAAoB,EAAE;AACzD,wEAAwE;AACxE,sFAAsF;AACtF,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CACd,CAAC,KAAuB,EAAE,SAAiB,EAAoB,EAAE;IAC/D,MAAM,KAAK,GAAW,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACvD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAA;AACzD,CAAC,EACD,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CACxB,CAAA;AAEH,iGAAiG;AACjG,MAAM,SAAS,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAA;AAEvE,sGAAsG;AACtG,qGAAqG;AACrG,kFAAkF;AAClF,MAAM,WAAW,GAAG,CAAC,UAAkB,EAAE,QAAgB,EAAqB,EAAE,CAC9E,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;KAChE,GAAG,CAAC,CAAC,KAAsB,EAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;KACpD,MAAM,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;AAEpF,MAAM,YAAY,GAAG,CAAC,UAAkB,EAAE,QAAgB,EAAqB,EAAE;IAC/E,MAAM,MAAM,GAAsB,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;IACnE,MAAM,IAAI,GAAsB,CAAC,GAAG,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;IAC9D,OAAO,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAC/E,CAAC,KAAa,EAAE,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CACpG,CAAA;AACH,CAAC,CAAA;AAED,wGAAwG;AACxG,sGAAsG;AACtG,+FAA+F;AAC/F,qGAAqG;AACrG,8FAA8F;AAC9F,+FAA+F;AAC/F,uGAAuG;AACvG,2BAA2B;AAC3B,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAW,EAAE;IAClD,MAAM,IAAI,GAAqB,eAAe,CAAC,KAAK,CAAC,CAAA;IACrD,OAAO,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAA;AAC9C,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,UAAkB,EAAU,EAAE;IAC5C,MAAM,OAAO,GAAW,UAAU,CAAC,IAAI,EAAE,CAAA;IACzC,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/F,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC,CAAC,OAAO,CAAA;AACb,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,UAAkB,EAAW,EAAE;IAC9D,MAAM,KAAK,GAAW,MAAM,CAAC,UAAU,CAAC,CAAA;IACxC,MAAM,YAAY,GAAsB,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC/D,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,SAAS,GAAsB,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC7D,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;AACvH,CAAC,CAAA;AAOD,mGAAmG;AACnG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAoC,EAA8B,EAAE,CACxG,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAyB,EAAW,EAAE,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA"}
+{"version":3,"file":"license-allowlist.js","sourceRoot":"","sources":["../src/license-allowlist.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAElD,oGAAoG;AACpG,sEAAsE;AACtE,0EAA0E;AAE1E,6FAA6F;AAC7F,wGAAwG;AACxG,qFAAqF;AAErF,mFAAmF;AACnF,uGAAuG;AACvG,qGAAqG;AACrG,sGAAsG;AACtG,iGAAiG;AACjG,iGAAiG;AACjG,4FAA4F;AAC5F,MAAM,UAAU,GAAsB;IACpC,MAAM;IACN,SAAS;IACT,SAAS;IACT,YAAY;IACZ,cAAc;IACd,cAAc;IACd,cAAc;IACd,SAAS;IACT,eAAe;IACf,WAAW;IACX,WAAW;IACX,SAAS;IACT,SAAS;IACT,KAAK;IACL,KAAK;IACL,OAAO;IACP,cAAc;IACd,MAAM;IACN,SAAS;IACT,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,aAAa;IACb,kBAAkB;IAClB,WAAW;IACX,KAAK;IACL,OAAO;IACP,KAAK;IACL,MAAM;CACP,CAAA;AAED,gGAAgG;AAChG,8FAA8F;AAC9F,sGAAsG;AACtG,uGAAuG;AACvG,mGAAmG;AACnG,EAAE;AACF,iGAAiG;AACjG,qGAAqG;AACrG,kGAAkG;AAClG,oFAAoF;AACpF,MAAM,aAAa,GAAsB;IACvC,UAAU;IACV,UAAU;IACV,SAAS;IACT,SAAS;IACT,UAAU;IACV,eAAe;IACf,mBAAmB;IACnB,UAAU;IACV,eAAe;IACf,mBAAmB;IACnB,SAAS;IACT,SAAS;CACV,CAAA;AAED,MAAM,OAAO,GAAwB,IAAI,GAAG,CAAS,CAAC,GAAG,UAAU,EAAE,GAAG,aAAa,CAAC,CAAC,CAAA;AAEvF,sGAAsG;AACtG,oGAAoG;AACpG,sGAAsG;AACtG,oGAAoG;AACpG,MAAM,MAAM,GAAG,CAAC,GAAsB,EAAuB,EAAE,CAC7D,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAU,EAAU,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;AAC5D,MAAM,cAAc,GAAwB,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAA;AAChE,MAAM,iBAAiB,GAAwB,MAAM,CAAC,UAAU,CAAC,CAAA;AACjE,oGAAoG;AACpG,yGAAyG;AACzG,MAAM,cAAc,GAAW,mBAAmB,CAAA;AAClD,MAAM,QAAQ,GAAW,KAAK,CAAA;AAE9B,MAAM,WAAW,GACf,CAAC,QAA6B,EAAE,EAAE,CAClC,CAAC,EAAU,EAAW,EAAE,CACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;AAE3F,sGAAsG;AACtG,kGAAkG;AAClG,oFAAoF;AACpF,kGAAkG;AAClG,kFAAkF;AAClF,MAAM,EAAE,GAAW,MAAM,CAAA;AACzB,MAAM,GAAG,GAAW,OAAO,CAAA;AAQ3B,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,SAAiB,EAAU,EAAE;IAC7D,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;QACtB,OAAO,KAAK,GAAG,CAAC,CAAA;IAClB,CAAC;IACD,OAAO,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AAC9C,CAAC,CAAA;AAED,sGAAsG;AACtG,oGAAoG;AACpG,MAAM,eAAe,GAAG,CAAC,IAAY,EAAoB,EAAE;AACzD,wEAAwE;AACxE,sFAAsF;AACtF,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CACd,CAAC,KAAuB,EAAE,SAAiB,EAAoB,EAAE;IAC/D,MAAM,KAAK,GAAW,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACvD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAA;AACzD,CAAC,EACD,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CACxB,CAAA;AAEH,iGAAiG;AACjG,MAAM,SAAS,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAA;AAEvE,sGAAsG;AACtG,qGAAqG;AACrG,kFAAkF;AAClF,MAAM,WAAW,GAAG,CAAC,UAAkB,EAAE,QAAgB,EAAqB,EAAE,CAC9E,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;KAChE,GAAG,CAAC,CAAC,KAAsB,EAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;KACpD,MAAM,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;AAEpF,MAAM,YAAY,GAAG,CAAC,UAAkB,EAAE,QAAgB,EAAqB,EAAE;IAC/E,MAAM,MAAM,GAAsB,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;IACnE,MAAM,IAAI,GAAsB,CAAC,GAAG,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;IAC9D,OAAO,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAC/E,CAAC,KAAa,EAAE,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CACpG,CAAA;AACH,CAAC,CAAA;AAED,wGAAwG;AACxG,sGAAsG;AACtG,+FAA+F;AAC/F,qGAAqG;AACrG,8FAA8F;AAC9F,+FAA+F;AAC/F,uGAAuG;AACvG,2BAA2B;AAC3B,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAW,EAAE;IAClD,MAAM,IAAI,GAAqB,eAAe,CAAC,KAAK,CAAC,CAAA;IACrD,OAAO,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAA;AAC9C,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,UAAkB,EAAU,EAAE;IAC5C,MAAM,OAAO,GAAW,UAAU,CAAC,IAAI,EAAE,CAAA;IACzC,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/F,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC,CAAC,OAAO,CAAA;AACb,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,UAAkB,EAAE,UAAmC,EAAW,EAAE;IACzF,MAAM,KAAK,GAAW,MAAM,CAAC,UAAU,CAAC,CAAA;IACxC,MAAM,YAAY,GAAsB,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC/D,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;IACtF,CAAC;IACD,MAAM,SAAS,GAAsB,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC7D,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC;QACzB,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC7E,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;AACvB,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,UAAkB,EAAW,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC,CAAA;AAKvH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,UAAkB,EAAgB,EAAE;IACjE,IAAI,aAAa,CAAC,UAAU,EAAE,WAAW,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,YAAY,CAAA;IACrB,CAAC;IACD,OAAO,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;AACnE,CAAC,CAAA;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,cAAc,GAGvB,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,CAAA;AAO3D,mGAAmG;AACnG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAoC,EAA8B,EAAE,CACxG,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAyB,EAAW,EAAE,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA"}

package/dist/license-inventory.d.ts

@@ -0,0 +1,25 @@
+/** One package of the resolved set as the licence inventory reports it. */
+export interface InventoryPackage {
+    readonly name: string;
+    /** Every installed version. A directory dependency has none, because pnpm reports its version as null. */
+    readonly versions: readonly string[];
+    readonly license: string;
+    /** The installed package directories, where the licence files the package ships are found. */
+    readonly paths: readonly string[];
+    readonly homepage: string | undefined;
+}
+/**
+ * Read the stdout of `pnpm licenses list --json`: packages grouped by their declared licence.
+ * @param json the command's stdout.
+ * @returns every reported package, or undefined when the text is not that inventory.
+ */
+export declare const parseLicenseInventory: (json: string) => readonly InventoryPackage[] | undefined;
+/** The coordinate a package version is identified by across the inventory, the SBOM and the report. */
+export declare const coordinateOf: (name: string, version: string) => string;
+/**
+ * Index the declared licence of every installed package version.
+ * @param packages the parsed inventory.
+ * @returns the licence by `name@version`; a directory dependency without a version is absent.
+ */
+export declare const licensesByCoordinate: (packages: readonly InventoryPackage[]) => ReadonlyMap<string, string>;
+//# sourceMappingURL=license-inventory.d.ts.map

package/dist/license-inventory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-inventory.d.ts","sourceRoot":"","sources":["../src/license-inventory.ts"],"names":[],"mappings":"AAGA,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,0GAA0G;IAC1G,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;CACtC;AAoBD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,MAAM,MAAM,KAAG,SAAS,gBAAgB,EAAE,GAAG,SASlF,CAAA;AAED,uGAAuG;AACvG,eAAO,MAAM,YAAY,GAAI,MAAM,MAAM,EAAE,SAAS,MAAM,KAAG,MAA8B,CAAA;AAE3F;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAAI,UAAU,SAAS,gBAAgB,EAAE,KAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAQpG,CAAA"}

package/dist/license-inventory.js

@@ -0,0 +1,41 @@
+// The licence inventory pnpm reports for the resolved set, read into one shape every consumer shares.
+import { asRecord, asText, isArray, isRecord, parseJsonc } from './json-shapes.js';
+const strings = (raw) => isArray(raw) ? raw.filter((entry) => typeof entry === 'string') : [];
+const asInventoryPackage = (raw, group) => {
+    const entry = asRecord(raw);
+    const homepage = asText(entry['homepage']);
+    // The group key is the licence pnpm grouped the entry under; the entry repeats it, and the entry wins
+    // when both are present because it is the value read from the package itself.
+    const license = asText(entry['license']);
+    return {
+        name: asText(entry['name']),
+        versions: strings(entry['versions']),
+        license: license.length > 0 ? license : group,
+        paths: strings(entry['paths']),
+        homepage: homepage.length > 0 ? homepage : undefined,
+    };
+};
+/**
+ * Read the stdout of `pnpm licenses list --json`: packages grouped by their declared licence.
+ * @param json the command's stdout.
+ * @returns every reported package, or undefined when the text is not that inventory.
+ */
+export const parseLicenseInventory = (json) => {
+    const inventory = parseJsonc(json).value;
+    if (!isRecord(inventory) || isArray(inventory)) {
+        return undefined;
+    }
+    return Object.entries(inventory).flatMap(([group, entries]) => (isArray(entries) ? entries : []).map((entry) => asInventoryPackage(entry, group)));
+};
+/** The coordinate a package version is identified by across the inventory, the SBOM and the report. */
+export const coordinateOf = (name, version) => `${name}@${version}`;
+/**
+ * Index the declared licence of every installed package version.
+ * @param packages the parsed inventory.
+ * @returns the licence by `name@version`; a directory dependency without a version is absent.
+ */
+export const licensesByCoordinate = (packages) => new Map(packages.flatMap((entry) => entry.versions.map((version) => [
+    coordinateOf(entry.name, version),
+    entry.license,
+])));
+//# sourceMappingURL=license-inventory.js.map

package/dist/license-inventory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-inventory.js","sourceRoot":"","sources":["../src/license-inventory.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAalF,MAAM,OAAO,GAAG,CAAC,GAAY,EAAqB,EAAE,CAClD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAEhG,MAAM,kBAAkB,GAAG,CAAC,GAAY,EAAE,KAAa,EAAoB,EAAE;IAC3E,MAAM,KAAK,GAA4B,QAAQ,CAAC,GAAG,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAW,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAA;IAClD,sGAAsG;IACtG,8EAA8E;IAC9E,MAAM,OAAO,GAAW,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;IAChD,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3B,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACpC,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK;QAC7C,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KACrD,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAA2C,EAAE;IAC7F,MAAM,SAAS,GAAY,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAA;IACjD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CACtC,CAAC,CAAC,KAAK,EAAE,OAAO,CAA6B,EAA+B,EAAE,CAC5E,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAc,EAAoB,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAChH,CAAA;AACH,CAAC,CAAA;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,OAAe,EAAU,EAAE,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAA;AAE3F;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,QAAqC,EAA+B,EAAE,CACzG,IAAI,GAAG,CACL,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAuB,EAA0C,EAAE,CACnF,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAe,EAA6B,EAAE,CAAC;IACjE,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC;IACjC,KAAK,CAAC,OAAO;CACd,CAAC,CACH,CACF,CAAA"}

package/dist/pdf-outline.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Map each bookmark title of a PDF to the page it points at.
+ * @param pdf the PDF bytes, read as Latin-1 text.
+ * @returns the 1-based page number by bookmark title; empty when the structure is not recognised.
+ */
+export declare const outlinePages: (pdf: string) => ReadonlyMap<string, number>;
+//# sourceMappingURL=pdf-outline.d.ts.map

package/dist/pdf-outline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdf-outline.d.ts","sourceRoot":"","sources":["../src/pdf-outline.ts"],"names":[],"mappings":"AAmEA;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAI,KAAK,MAAM,KAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAqBpE,CAAA"}

package/dist/pdf-outline.js

@@ -0,0 +1,69 @@
+// Read the page each bookmark of a Chromium-printed PDF points at. The browser cannot number a table of
+// contents while it paginates, so the report is printed once, its bookmarks are read here, and the
+// numbers are written into the contents before the final print. Only the uncompressed object syntax
+// Chromium writes is read; anything else yields no numbers rather than wrong ones.
+const OBJECT_HEADER = /(\d{1,10}) 0 obj\b/u;
+const KIDS = /\/Kids\s*\[([^\]]*)\]/u;
+const REFERENCE = /(\d{1,10}) 0 R\b/gu;
+const CATALOG = /\/Type\s{0,4}\/Catalog\b/u;
+const PAGES_ROOT = /\/Pages\s{1,4}(\d{1,10}) 0 R/u;
+const TITLE = /\/Title\s*(\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>)/u;
+const DESTINATION = /\/Dest\s{0,4}\[\s{0,4}(\d{1,10}) 0 R/u;
+const OCTAL = /^[0-7]{1,3}/u;
+const ESCAPES = { n: '\n', r: '\r', t: '\t', b: '\b', f: '\f' };
+const HEX_RADIX = 16;
+const OCTAL_RADIX = 8;
+const UTF16_UNIT = 4;
+const BOM = 'FEFF';
+// Each object runs to its `endobj`. Its dictionary is what precedes any stream, which keeps the binary
+// stream data out of every pattern below.
+const objectsOf = (pdf) => new Map(pdf.split('endobj').flatMap((chunk) => {
+    const header = OBJECT_HEADER.exec(chunk);
+    if (header === null) {
+        return [];
+    }
+    const body = chunk.slice(header.index + header[0].length);
+    const stream = body.indexOf('stream');
+    return [[header[1] ?? '', stream === -1 ? body : body.slice(0, stream)]];
+}));
+const referencesIn = (text) => [...text.matchAll(REFERENCE)].map((match) => match[1] ?? '');
+// A page-tree node lists its kids; a kid without kids of its own is a page. Depth-first order is page order.
+const pagesUnder = (node, objects, seen) => {
+    const kids = KIDS.exec(objects.get(node) ?? '')?.[1];
+    if (kids === undefined || seen.has(node)) {
+        return [node];
+    }
+    const visited = new Set([...seen, node]);
+    return referencesIn(kids).flatMap((kid) => pagesUnder(kid, objects, visited));
+};
+const literalString = (body) => body.replaceAll(/\\([0-7]{1,3}|[\s\S])/gu, (_whole, escaped) => OCTAL.test(escaped) ? String.fromCodePoint(Number.parseInt(escaped, OCTAL_RADIX)) : (ESCAPES[escaped] ?? escaped));
+const hexString = (body) => {
+    const hex = body.replaceAll(/\s/gu, '').toUpperCase();
+    const units = hex.startsWith(BOM) ? hex.slice(BOM.length) : hex;
+    return Array.from({ length: Math.floor(units.length / UTF16_UNIT) }, (_unused, index) => String.fromCodePoint(Number.parseInt(units.slice(index * UTF16_UNIT, (index + 1) * UTF16_UNIT), HEX_RADIX))).join('');
+};
+const decodeTitle = (raw) => raw.startsWith('(') ? literalString(raw.slice(1, -1)) : hexString(raw.slice(1, -1));
+/**
+ * Map each bookmark title of a PDF to the page it points at.
+ * @param pdf the PDF bytes, read as Latin-1 text.
+ * @returns the 1-based page number by bookmark title; empty when the structure is not recognised.
+ */
+export const outlinePages = (pdf) => {
+    const objects = objectsOf(pdf);
+    const root = [...objects.values()]
+        .map((body) => (CATALOG.test(body) ? PAGES_ROOT.exec(body)?.[1] : undefined))
+        .find((found) => found !== undefined);
+    if (root === undefined) {
+        return new Map();
+    }
+    const order = new Map(pagesUnder(root, objects, new Set()).map((page, index) => [
+        page,
+        index + 1,
+    ]));
+    return new Map([...objects.values()].flatMap((body) => {
+        const title = TITLE.exec(body)?.[1];
+        const page = order.get(DESTINATION.exec(body)?.[1] ?? '');
+        return title === undefined || page === undefined ? [] : [[decodeTitle(title), page]];
+    }));
+};
+//# sourceMappingURL=pdf-outline.js.map