lexfold-mcp 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,52 @@
-# Temporary Holding Version
+# lexfold-mcp
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+An [MCP](https://modelcontextprotocol.io) server that lets your AI coding tool draft your privacy and legal policies and send them to [Lexfold](https://lexfold.com) for review.
+
+It runs on your machine. Your AI tool describes what the product does in abstract terms (for example "uses a payment processor" or "collects crash reports"). Source code, secrets and personal data are never sent.
+
+## Tools
+
+| Tool | What it does |
+|---|---|
+| `draft_policy` | Drafts a policy locally from abstracted product facts. Nothing is sent. |
+| `submit_policy` | Sends the draft to your Lexfold workspace as a **draft**. A person on your team reviews and publishes it from the dashboard. |
+| `scan_licenses` | Reads your lockfiles (npm, PyPI, pub, Cargo, Go), rates each dependency's license and flags risky or missing ones. Local preview by default; uploads the dependency list only when you say yes. |
+
+## Setup
+
+1. In Lexfold, open **Developers → API keys** and create a key.
+2. Add the server to your MCP client. For Claude Code:
+
+   ```sh
+   claude mcp add lexfold -e LEXFOLD_API_KEY=your_key -- npx -y lexfold-mcp
+   ```
+
+   Or in any client's JSON config:
+
+   ```json
+   {
+     "mcpServers": {
+       "lexfold": {
+         "command": "npx",
+         "args": ["-y", "lexfold-mcp"],
+         "env": { "LEXFOLD_API_KEY": "your_key" }
+       }
+     }
+   }
+   ```
+
+`draft_policy` and a local `scan_licenses` preview work without a key.
+
+## Configuration
+
+| Variable | Required | Default |
+|---|---|---|
+| `LEXFOLD_API_KEY` | For `submit_policy` and license uploads | – |
+| `LEXFOLD_BASE_URL` | No | `https://lexfold.com` |
+
+The key is never written to logs.
+
+## Notes
+
+- Lexfold is not a law firm, and drafts are not legal advice. Have a lawyer review your policies.
+- Requires Node.js 18 or later.

package/dist/bin.d.ts

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+/**
+ * Lexfold MCP — stdio entrypoint (policy-mcp R1).
+ *
+ * Runs in the developer's own environment. Connects the configured server over
+ * stdio so an MCP client (e.g. the developer's AI tool) can enumerate and call
+ * `draft_policy` and `submit_policy`.
+ *
+ * Diagnostics go to stderr and never include the credential.
+ */
+export {};

package/dist/bin.js

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+/**
+ * Lexfold MCP — stdio entrypoint (policy-mcp R1).
+ *
+ * Runs in the developer's own environment. Connects the configured server over
+ * stdio so an MCP client (e.g. the developer's AI tool) can enumerate and call
+ * `draft_policy` and `submit_policy`.
+ *
+ * Diagnostics go to stderr and never include the credential.
+ */
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { createServer } from "./server/server.js";
+import { loadConfig, describeConfig } from "./server/config.js";
+async function main() {
+    const config = loadConfig();
+    const server = createServer({ config });
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    // Redacted startup diagnostics (never the credential).
+    const redacted = describeConfig(config);
+    process.stderr.write(`lexfold-mcp ready · baseUrl=${redacted.baseUrl} · credential=${redacted.hasApiKey ? "configured" : "not configured"}\n`);
+}
+main().catch((err) => {
+    process.stderr.write(`lexfold-mcp failed to start: ${String(err)}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=bin.js.map

package/dist/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEhE,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,uDAAuD;IACvD,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+BAA+B,QAAQ,CAAC,OAAO,iBAAiB,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,IAAI,CACzH,CAAC;AACJ,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/licenses/notices.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Collect copyright lines ("Copyright (c) 2014 Jane Doe") from the license
+ * files of installed packages, so the attribution page can reproduce them, as
+ * MIT, BSD and similar licenses require.
+ *
+ * Reads only LICENSE / LICENCE / COPYING / NOTICE files of packages already on
+ * this machine: the project's node_modules and Python virtualenv, and the
+ * standard pub, Cargo and Go caches. Only the matching copyright lines (public
+ * text from public packages) are kept; nothing else from the file is sent.
+ * Best effort: a package whose files aren't installed simply has no notice.
+ */
+import type { Dependency } from "./types.js";
+export declare const MAX_NOTICE_LINES = 5;
+export declare const MAX_NOTICE_CHARS = 200;
+/** Pull real copyright lines out of a license file's text. */
+export declare function extractCopyright(text: string): string[];
+/** Copyright lines from the license files directly inside `dir`. */
+export declare function noticesInDir(dir: string): Promise<string[]>;
+export interface NoticeLocations {
+    readonly home?: string;
+    readonly env?: Readonly<Record<string, string | undefined>>;
+}
+/** Go module cache path escaping: uppercase letters become "!" + lowercase. */
+export declare function goEscape(path: string): string;
+/**
+ * Attach copyright lines to every shipped (non-dev) dependency whose license
+ * files are installed locally. Dev-only packages are skipped: they don't ship,
+ * so the attribution page doesn't list them.
+ */
+export declare function collectNotices(root: string, deps: readonly Dependency[], loc?: NoticeLocations): Promise<Dependency[]>;

package/dist/licenses/notices.js

@@ -0,0 +1,155 @@
+/**
+ * Collect copyright lines ("Copyright (c) 2014 Jane Doe") from the license
+ * files of installed packages, so the attribution page can reproduce them, as
+ * MIT, BSD and similar licenses require.
+ *
+ * Reads only LICENSE / LICENCE / COPYING / NOTICE files of packages already on
+ * this machine: the project's node_modules and Python virtualenv, and the
+ * standard pub, Cargo and Go caches. Only the matching copyright lines (public
+ * text from public packages) are kept; nothing else from the file is sent.
+ * Best effort: a package whose files aren't installed simply has no notice.
+ */
+import { readdir, readFile, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+export const MAX_NOTICE_LINES = 5;
+export const MAX_NOTICE_CHARS = 200;
+const MAX_LICENSE_FILE_BYTES = 256 * 1024;
+const LICENSE_FILE_RE = /^(licen[cs]e|copying|notice)([-._].*)?$/i;
+/** Lines that are template placeholders or license boilerplate, not a real notice. */
+const BOILERPLATE_RE = /[<>[\]{}]|copyright notice|copyright holders?\b|copyright owner|copyright law|copyright and license|the copyright|this copyright|yyyy/i;
+const NOTICE_RE = /^\s*(?:copyright\b|\(c\)\s|©)/i;
+/** Pull real copyright lines out of a license file's text. */
+export function extractCopyright(text) {
+    const out = [];
+    for (const raw of text.split(/\r?\n/)) {
+        if (!NOTICE_RE.test(raw))
+            continue;
+        const line = raw.replace(/\s+/g, " ").trim();
+        if (BOILERPLATE_RE.test(line) || !/\d{4}|[A-Za-z]{2,}\s+[A-Za-z]{2,}/.test(line.replace(/^copyright\b/i, "")))
+            continue;
+        const clipped = line.slice(0, MAX_NOTICE_CHARS);
+        if (!out.includes(clipped))
+            out.push(clipped);
+        if (out.length >= MAX_NOTICE_LINES)
+            break;
+    }
+    return out;
+}
+async function isDir(path) {
+    try {
+        return (await stat(path)).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+/** Copyright lines from the license files directly inside `dir`. */
+export async function noticesInDir(dir) {
+    let names;
+    try {
+        names = (await readdir(dir)).filter((n) => LICENSE_FILE_RE.test(n)).sort();
+    }
+    catch {
+        return [];
+    }
+    const lines = [];
+    for (const name of names) {
+        try {
+            const path = join(dir, name);
+            const s = await stat(path);
+            if (!s.isFile() || s.size > MAX_LICENSE_FILE_BYTES)
+                continue;
+            for (const l of extractCopyright(await readFile(path, "utf8")))
+                if (!lines.includes(l))
+                    lines.push(l);
+        }
+        catch {
+            // Unreadable license file: skip it, the package just has fewer notices.
+        }
+        if (lines.length >= MAX_NOTICE_LINES)
+            break;
+    }
+    return lines.slice(0, MAX_NOTICE_LINES);
+}
+/** Go module cache path escaping: uppercase letters become "!" + lowercase. */
+export function goEscape(path) {
+    return path.replace(/[A-Z]/g, (c) => `!${c.toLowerCase()}`);
+}
+/** Python normalises dist names: "Foo_Bar" ships as foo_bar-1.0.dist-info. */
+function pyDistName(name) {
+    return name.toLowerCase().replace(/[-.]+/g, "_");
+}
+async function sitePackages(root) {
+    const out = [];
+    for (const venv of [".venv", "venv"]) {
+        const lib = join(root, venv, "lib");
+        let pys = [];
+        try {
+            pys = (await readdir(lib)).filter((n) => n.startsWith("python"));
+        }
+        catch {
+            continue;
+        }
+        for (const py of pys)
+            if (await isDir(join(lib, py, "site-packages")))
+                out.push(join(lib, py, "site-packages"));
+    }
+    return out;
+}
+/** Candidate folders that may hold this package's license files. */
+async function candidateDirs(root, d, loc, site) {
+    const env = loc.env;
+    switch (d.ecosystem) {
+        case "npm":
+            return [join(root, "node_modules", d.name)];
+        case "pub": {
+            const cache = env.PUB_CACHE ?? join(loc.home, ".pub-cache");
+            return [join(cache, "hosted", "pub.dev", `${d.name}-${d.version}`), join(cache, "hosted", "pub.dartlang.org", `${d.name}-${d.version}`)];
+        }
+        case "cargo": {
+            const src = join(env.CARGO_HOME ?? join(loc.home, ".cargo"), "registry", "src");
+            let regs = [];
+            try {
+                regs = await readdir(src);
+            }
+            catch {
+                return [];
+            }
+            return regs.map((r) => join(src, r, `${d.name}-${d.version}`));
+        }
+        case "go": {
+            const cache = env.GOMODCACHE ?? join(env.GOPATH ?? join(loc.home, "go"), "pkg", "mod");
+            return [join(cache, `${goEscape(d.name)}@${goEscape(d.version)}`)];
+        }
+        case "pypi": {
+            const dist = `${pyDistName(d.name)}-${d.version}.dist-info`;
+            return site.flatMap((s) => [join(s, dist), join(s, dist, "licenses")]);
+        }
+    }
+}
+/**
+ * Attach copyright lines to every shipped (non-dev) dependency whose license
+ * files are installed locally. Dev-only packages are skipped: they don't ship,
+ * so the attribution page doesn't list them.
+ */
+export async function collectNotices(root, deps, loc = {}) {
+    const full = { home: loc.home ?? homedir(), env: loc.env ?? process.env };
+    const site = deps.some((d) => d.ecosystem === "pypi") ? await sitePackages(root) : [];
+    const out = [];
+    for (let i = 0; i < deps.length; i += 32) {
+        const batch = deps.slice(i, i + 32);
+        out.push(...(await Promise.all(batch.map(async (d) => {
+            if (d.dev || !d.version)
+                return d;
+            for (const dir of await candidateDirs(root, d, full, site)) {
+                const lines = await noticesInDir(dir);
+                if (lines.length)
+                    return { ...d, copyright: lines };
+            }
+            return d;
+        }))));
+    }
+    return out;
+}
+//# sourceMappingURL=notices.js.map

package/dist/licenses/notices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notices.js","sourceRoot":"","sources":["../../src/licenses/notices.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AACpC,MAAM,sBAAsB,GAAG,GAAG,GAAG,IAAI,CAAC;AAC1C,MAAM,eAAe,GAAG,0CAA0C,CAAC;AAEnE,sFAAsF;AACtF,MAAM,cAAc,GAAG,wIAAwI,CAAC;AAChK,MAAM,SAAS,GAAG,gCAAgC,CAAC;AAEnD,8DAA8D;AAC9D,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;YAAE,SAAS;QACxH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,GAAG,CAAC,MAAM,IAAI,gBAAgB;YAAE,MAAM;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,IAAY;IAC/B,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,GAAG,sBAAsB;gBAAE,SAAS;YAC7D,KAAK,MAAM,CAAC,IAAI,gBAAgB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxG,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,IAAI,gBAAgB;YAAE,MAAM;IAC9C,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;AAC1C,CAAC;AAOD,+EAA+E;AAC/E,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,8EAA8E;AAC9E,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACpC,IAAI,GAAG,GAAa,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,GAAG,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,GAAG;YAAE,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,CAAa,EAAE,GAA8B,EAAE,IAAuB;IAC/G,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;QACpB,KAAK,KAAK;YACR,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC3I,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;YAChF,IAAI,IAAI,GAAa,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YACvF,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,YAAY,CAAC;YAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,IAA2B,EAAE,MAAuB,EAAE;IACvG,MAAM,IAAI,GAA8B,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACrG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;QACpC,GAAG,CAAC,IAAI,CACN,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CACnB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACpB,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,CAAC;YAClC,KAAK,MAAM,GAAG,IAAI,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC3D,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;gBACtC,IAAI,KAAK,CAAC,MAAM;oBAAE,OAAO,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACtD,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC,CAAC,CACH,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/licenses/npm.d.ts

@@ -0,0 +1,14 @@
+/**
+ * npm-family lockfile readers: package-lock.json (v1–v3), pnpm-lock.yaml
+ * (v5–v9) and yarn.lock (classic v1 and Berry). Text parsing only; nothing is
+ * executed or installed. `direct`/`dev` come from package.json when given.
+ */
+import { type Dependency } from "./types.js";
+export interface NpmManifest {
+    readonly dependencies?: Readonly<Record<string, string>>;
+    readonly devDependencies?: Readonly<Record<string, string>>;
+    readonly optionalDependencies?: Readonly<Record<string, string>>;
+}
+export declare function parsePackageLock(text: string, manifest: NpmManifest | null): Dependency[];
+export declare function parsePnpmLock(text: string, manifest: NpmManifest | null): Dependency[];
+export declare function parseYarnLock(text: string, manifest: NpmManifest | null): Dependency[];

package/dist/licenses/npm.js

@@ -0,0 +1,126 @@
+/**
+ * npm-family lockfile readers: package-lock.json (v1–v3), pnpm-lock.yaml
+ * (v5–v9) and yarn.lock (classic v1 and Berry). Text parsing only; nothing is
+ * executed or installed. `direct`/`dev` come from package.json when given.
+ */
+import { isValidCoordinate } from "./types.js";
+function directSets(manifest) {
+    return {
+        prod: new Set([...Object.keys(manifest?.dependencies ?? {}), ...Object.keys(manifest?.optionalDependencies ?? {})]),
+        dev: new Set(Object.keys(manifest?.devDependencies ?? {})),
+    };
+}
+function make(name, version, sets, license, devHint) {
+    if (!isValidCoordinate(name, version))
+        return null;
+    const direct = sets.prod.has(name) || sets.dev.has(name);
+    const dev = devHint ?? (sets.dev.has(name) && !sets.prod.has(name));
+    const lic = typeof license === "string" && license.trim() ? license.trim().slice(0, 200) : undefined;
+    return { ecosystem: "npm", name, version, direct, dev, ...(lic ? { license: lic } : {}) };
+}
+function walkV1(deps, sets, out) {
+    if (!deps || typeof deps !== "object")
+        return;
+    for (const [name, raw] of Object.entries(deps)) {
+        if (typeof raw?.version !== "string")
+            continue;
+        const d = make(name, raw.version, sets, undefined, raw.dev === true);
+        if (d)
+            out.push(d);
+        walkV1(raw.dependencies, sets, out);
+    }
+}
+export function parsePackageLock(text, manifest) {
+    const json = JSON.parse(text);
+    const sets = directSets(manifest);
+    const out = [];
+    if (json.packages && typeof json.packages === "object") {
+        for (const [path, entry] of Object.entries(json.packages)) {
+            if (!path || entry.link === true || typeof entry.version !== "string")
+                continue;
+            const idx = path.lastIndexOf("node_modules/");
+            if (idx < 0)
+                continue;
+            const name = path.slice(idx + "node_modules/".length);
+            const d = make(name, entry.version, sets, entry.license, entry.dev === true);
+            if (d)
+                out.push(d);
+        }
+        return out;
+    }
+    walkV1(json.dependencies, sets, out);
+    return out;
+}
+/* ---- pnpm-lock.yaml ---- */
+/** "/@scope/name@1.2.3(peer@1)" | "name@1.2.3" | "/name/1.2.3" → [name, version]. */
+function splitPnpmKey(rawKey) {
+    let key = rawKey.trim().replace(/^['"]|['"]$/g, "").replace(/:$/, "").replace(/^['"]|['"]$/g, "");
+    key = key.replace(/^\//, "").replace(/\(.*$/, "");
+    const at = key.lastIndexOf("@");
+    if (at > 0)
+        return [key.slice(0, at), key.slice(at + 1)];
+    const slash = key.lastIndexOf("/");
+    return slash > 0 ? [key.slice(0, slash), key.slice(slash + 1)] : null;
+}
+export function parsePnpmLock(text, manifest) {
+    const sets = directSets(manifest);
+    const out = [];
+    let inPackages = false;
+    let current = null;
+    const flush = () => {
+        if (!current)
+            return;
+        const d = make(current.name, current.version, sets, undefined, current.dev);
+        if (d)
+            out.push(d);
+        current = null;
+    };
+    for (const line of text.split(/\r?\n/)) {
+        if (/^\S/.test(line)) {
+            flush();
+            inPackages = line.startsWith("packages:");
+            continue;
+        }
+        if (!inPackages)
+            continue;
+        const top = /^ {2}(\S.*):\s*$/.exec(line);
+        if (top?.[1]) {
+            flush();
+            const parts = splitPnpmKey(top[1]);
+            current = parts ? { name: parts[0], version: parts[1] } : null;
+            continue;
+        }
+        const dev = /^ {4}dev:\s*(true|false)/.exec(line);
+        if (dev && current)
+            current = { ...current, dev: dev[1] === "true" };
+    }
+    flush();
+    return out;
+}
+/* ---- yarn.lock (v1 + Berry) ---- */
+function yarnName(spec) {
+    const s = spec.trim().replace(/^"|"$/g, "");
+    const at = s.indexOf("@", 1);
+    return at > 0 ? s.slice(0, at) : null;
+}
+export function parseYarnLock(text, manifest) {
+    const sets = directSets(manifest);
+    const out = [];
+    let name = null;
+    for (const line of text.split(/\r?\n/)) {
+        if (/^\S/.test(line) && line.trimEnd().endsWith(":") && !line.startsWith("#")) {
+            const first = line.slice(0, -1).split(",")[0] ?? "";
+            name = first.includes("@workspace:") || first.startsWith("__metadata") ? null : yarnName(first);
+            continue;
+        }
+        const v = /^ {2}version:?\s+"?([^"\s]+)"?/.exec(line);
+        if (v?.[1] && name) {
+            const d = make(name, v[1], sets);
+            if (d)
+                out.push(d);
+            name = null;
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=npm.js.map

package/dist/licenses/npm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.js","sourceRoot":"","sources":["../../src/licenses/npm.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,iBAAiB,EAAmB,MAAM,YAAY,CAAC;AAahE,SAAS,UAAU,CAAC,QAA4B;IAC9C,OAAO;QACL,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC,CAAC;QACnH,GAAG,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,OAAe,EAAE,IAAgB,EAAE,OAAiB,EAAE,OAAiB;IACjG,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrG,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC5F,CAAC;AAMD,SAAS,MAAM,CAAC,IAAa,EAAE,IAAgB,EAAE,GAAiB;IAChE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO;IAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAiC,CAAC,EAAE,CAAC;QAC5E,IAAI,OAAO,GAAG,EAAE,OAAO,KAAK,QAAQ;YAAE,SAAS;QAC/C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACrE,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,QAA4B;IACzE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqE,CAAC;IAClG,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,IAAI,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;gBAAE,SAAS;YAChF,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;YAC9C,IAAI,GAAG,GAAG,CAAC;gBAAE,SAAS;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACtD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;YAC7E,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8BAA8B;AAE9B,qFAAqF;AACrF,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAClG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,QAA4B;IACtE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,OAAO,GAA4D,IAAI,CAAC;IAC5E,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5E,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,KAAK,EAAE,CAAC;YACR,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACb,KAAK,EAAE,CAAC;YACR,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC/D,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,GAAG,IAAI,OAAO;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;IACvE,CAAC;IACD,KAAK,EAAE,CAAC;IACR,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sCAAsC;AAEtC,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7B,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,QAA4B;IACtE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACpD,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChG,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;YACnB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/licenses/other.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Lockfile/manifest readers for Flutter/Dart (pubspec.lock), Python (uv.lock,
+ * poetry.lock, requirements.txt), Go (go.mod) and Rust (Cargo.lock). Line-based
+ * text parsing of each format's regular shape; nothing is executed.
+ */
+import { type Dependency } from "./types.js";
+export declare function parsePubspecLock(text: string): Dependency[];
+export declare function parseUvLock(text: string, direct: ReadonlySet<string>): Dependency[];
+export declare function parsePoetryLock(text: string, direct: ReadonlySet<string>): Dependency[];
+/** `name==1.2`, `name[extra]==1.2 ; marker`, unpinned `name>=1` (version ""). */
+export declare function parseRequirements(text: string): Dependency[];
+/** Direct dependency names from pyproject.toml ([project] dependencies + Poetry tables). */
+export declare function pyprojectDirect(text: string): Set<string>;
+export declare function parseGoMod(text: string): Dependency[];
+export declare function parseCargoLock(text: string, direct: ReadonlySet<string>): Dependency[];
+/** Direct crate names from Cargo.toml dependency tables. */
+export declare function cargoDirect(text: string): Set<string>;

package/dist/licenses/other.js

@@ -0,0 +1,172 @@
+/**
+ * Lockfile/manifest readers for Flutter/Dart (pubspec.lock), Python (uv.lock,
+ * poetry.lock, requirements.txt), Go (go.mod) and Rust (Cargo.lock). Line-based
+ * text parsing of each format's regular shape; nothing is executed.
+ */
+import { isValidCoordinate } from "./types.js";
+function make(ecosystem, name, version, direct, dev) {
+    return isValidCoordinate(name, version) ? { ecosystem, name, version, direct, dev } : null;
+}
+const unquote = (v) => v.trim().replace(/^["']|["']$/g, "");
+/* ---- pubspec.lock ---- */
+export function parsePubspecLock(text) {
+    const out = [];
+    let inPackages = false;
+    let cur = null;
+    const flush = () => {
+        if (cur?.version && cur.source !== "sdk") {
+            const kind = cur.dependency ?? "transitive";
+            const d = make("pub", cur.name, cur.version, kind.startsWith("direct"), kind.includes("dev"));
+            if (d)
+                out.push(d);
+        }
+        cur = null;
+    };
+    for (const line of text.split(/\r?\n/)) {
+        if (/^\S/.test(line)) {
+            flush();
+            inPackages = line.startsWith("packages:");
+            continue;
+        }
+        if (!inPackages)
+            continue;
+        const pkg = /^ {2}([A-Za-z0-9_]+):\s*$/.exec(line);
+        if (pkg?.[1]) {
+            flush();
+            cur = { name: pkg[1] };
+            continue;
+        }
+        const field = /^ {4}(dependency|source|version):\s*(.+)$/.exec(line);
+        if (field?.[1] && field[2] !== undefined && cur) {
+            cur = { ...cur, [field[1]]: unquote(field[2]) };
+        }
+    }
+    flush();
+    return out;
+}
+function tomlPackages(text) {
+    const pkgs = [];
+    let cur = null;
+    for (const line of text.split(/\r?\n/)) {
+        if (/^\[\[package\]\]\s*$/.test(line)) {
+            if (cur)
+                pkgs.push(cur);
+            cur = {};
+            continue;
+        }
+        if (/^\[/.test(line)) {
+            if (cur)
+                pkgs.push(cur);
+            cur = null;
+            continue;
+        }
+        const kv = /^(name|version|source|category)\s*=\s*(.+)$/.exec(line);
+        if (cur && kv?.[1] && kv[2] !== undefined)
+            cur[kv[1]] = kv[2].trim().startsWith("{") ? kv[2].trim() : unquote(kv[2]);
+    }
+    if (cur)
+        pkgs.push(cur);
+    return pkgs;
+}
+/** Lower-case + PEP 503 normalisation so names match the registry. */
+const pep503 = (name) => name.toLowerCase().replace(/[-_.]+/g, "-");
+export function parseUvLock(text, direct) {
+    return tomlPackages(text)
+        .filter((p) => p.name && p.version && !/editable|virtual|directory/.test(p.source ?? ""))
+        .map((p) => make("pypi", pep503(p.name), p.version, direct.has(pep503(p.name)), false))
+        .filter((d) => d !== null);
+}
+export function parsePoetryLock(text, direct) {
+    return tomlPackages(text)
+        .filter((p) => p.name && p.version)
+        .map((p) => {
+        const name = pep503(p.name);
+        return make("pypi", name, p.version, direct.has(name), p.category === "dev");
+    })
+        .filter((d) => d !== null);
+}
+/** `name==1.2`, `name[extra]==1.2 ; marker`, unpinned `name>=1` (version ""). */
+export function parseRequirements(text) {
+    const out = [];
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.replace(/\s+#.*$/, "").split(";")[0]?.trim() ?? "";
+        if (!line || line.startsWith("#") || line.startsWith("-") || line.includes("://"))
+            continue;
+        const m = /^([A-Za-z0-9][A-Za-z0-9._-]*)(\[[^\]]*\])?\s*(==\s*([A-Za-z0-9.+!*-]+))?/.exec(line);
+        if (!m?.[1])
+            continue;
+        const d = make("pypi", pep503(m[1]), m[4] ?? "", true, false);
+        if (d)
+            out.push(d);
+    }
+    return out;
+}
+/** Direct dependency names from pyproject.toml ([project] dependencies + Poetry tables). */
+export function pyprojectDirect(text) {
+    const names = new Set();
+    const arr = /dependencies\s*=\s*\[([\s\S]*?)\]/g;
+    for (const m of text.matchAll(arr)) {
+        for (const s of (m[1] ?? "").matchAll(/["']([A-Za-z0-9][A-Za-z0-9._-]*)/g))
+            if (s[1])
+                names.add(pep503(s[1]));
+    }
+    let inPoetryDeps = false;
+    for (const line of text.split(/\r?\n/)) {
+        if (/^\[/.test(line)) {
+            inPoetryDeps = /^\[tool\.poetry\.(dev-)?dependencies\]|^\[tool\.poetry\.group\.[^.]+\.dependencies\]/.test(line);
+            continue;
+        }
+        const k = inPoetryDeps ? /^([A-Za-z0-9][A-Za-z0-9._-]*)\s*=/.exec(line) : null;
+        if (k?.[1] && k[1] !== "python")
+            names.add(pep503(k[1]));
+    }
+    return names;
+}
+/* ---- go.mod ---- */
+export function parseGoMod(text) {
+    const out = [];
+    let inBlock = false;
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (/^require\s*\($/.test(line)) {
+            inBlock = true;
+            continue;
+        }
+        if (inBlock && line === ")") {
+            inBlock = false;
+            continue;
+        }
+        const body = inBlock ? line : (/^require\s+(.+)$/.exec(line)?.[1] ?? "");
+        const m = /^(\S+)\s+(v\S+)(.*)$/.exec(body);
+        if (!m?.[1] || !m[2])
+            continue;
+        const d = make("go", m[1], m[2], !/\/\/\s*indirect/.test(m[3] ?? ""), false);
+        if (d)
+            out.push(d);
+    }
+    return out;
+}
+/* ---- Cargo.lock ---- */
+export function parseCargoLock(text, direct) {
+    return tomlPackages(text)
+        // Packages without a `source` are the project's own workspace crates.
+        .filter((p) => p.name && p.version && p.source)
+        .map((p) => make("cargo", p.name, p.version, direct.has(p.name), false))
+        .filter((d) => d !== null);
+}
+/** Direct crate names from Cargo.toml dependency tables. */
+export function cargoDirect(text) {
+    const names = new Set();
+    let inDeps = false;
+    for (const line of text.split(/\r?\n/)) {
+        if (/^\[/.test(line)) {
+            inDeps = /^\[(dev-|build-)?dependencies\]|^\[target\..+\.(dev-|build-)?dependencies\]|^\[workspace\.dependencies\]/.test(line);
+            continue;
+        }
+        const k = inDeps ? /^([A-Za-z0-9_-]+)\s*=/.exec(line) : null;
+        if (k?.[1])
+            names.add(k[1]);
+    }
+    return names;
+}
+//# sourceMappingURL=other.js.map

package/dist/licenses/other.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"other.js","sourceRoot":"","sources":["../../src/licenses/other.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,iBAAiB,EAAmC,MAAM,YAAY,CAAC;AAEhF,SAAS,IAAI,CAAC,SAAoB,EAAE,IAAY,EAAE,OAAe,EAAE,MAAe,EAAE,GAAY;IAC9F,OAAO,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7F,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;AAE5E,4BAA4B;AAE5B,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,GAAG,GAAoF,IAAI,CAAC;IAChG,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,IAAI,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,IAAI,YAAY,CAAC;YAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9F,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,GAAG,GAAG,IAAI,CAAC;IACb,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,KAAK,EAAE,CAAC;YACR,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,GAAG,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACb,KAAK,EAAE,CAAC;YACR,GAAG,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,GAAG,EAAE,CAAC;YAChD,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IACD,KAAK,EAAE,CAAC;IACR,OAAO,GAAG,CAAC;AACb,CAAC;AAYD,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,IAAI,GAAG,GAAkC,IAAI,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,IAAI,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,GAAG,GAAG,EAAE,CAAC;YACT,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,IAAI,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,GAAG,GAAG,IAAI,CAAC;YACX,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,6CAA6C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACvH,CAAC;IACD,IAAI,GAAG;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sEAAsE;AACtE,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAEpF,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,MAA2B;IACnE,OAAO,YAAY,CAAC,IAAI,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;SACxF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAc,CAAC,EAAE,CAAC,CAAC,OAAiB,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;SACpH,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,MAA2B;IACvE,OAAO,YAAY,CAAC,IAAI,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC;SAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAiB,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC;IACzF,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACpE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QAC5F,MAAM,CAAC,GAAG,0EAA0E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChG,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAAE,SAAS;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,GAAG,GAAG,oCAAoC,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,mCAAmC,CAAC;YAAE,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,YAAY,GAAG,sFAAsF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjH,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/E,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ;YAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sBAAsB;AAEtB,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,OAAO,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7E,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0BAA0B;AAE1B,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,MAA2B;IACtE,OAAO,YAAY,CAAC,IAAI,CAAC;QACvB,sEAAsE;SACrE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC;SAC9C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,IAAc,EAAE,CAAC,CAAC,OAAiB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAc,CAAC,EAAE,KAAK,CAAC,CAAC;SACrG,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,GAAG,0GAA0G,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/H,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7D,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}