/**
 * License policy over an SBOM's declared licenses (#626). The SBOM already
 * enumerates every component and its license; this evaluates those against an
 * allow/deny list (e.g. block a copyleft license in a proprietary product).
 *
 * **Report-only by default.** License posture is context-dependent — GPL is a
 * problem for a proprietary binary but fine for a GPL project — so the gate
 * (./vuln-gate.ts) does NOT block on license violations unless a project opts
 * in (`failOnLicense: true`). Extraction reads both SPDX
 * (`packages[].licenseConcluded`/`licenseDeclared`) and CycloneDX
 * (`components[].licenses[]`) without a spec dependency.
 */
import type { SbomDocument } from "./sbom-generator.js";
/** A package/component and the license the SBOM declares for it. */
export interface PackageLicense {
    package: string;
    /** SPDX license expression/id as the SBOM reports it, or `"NOASSERTION"`/`""` when none is declared. */
    license: string;
}
export interface LicensePolicy {
    /** If set, ONLY these licenses are permitted — anything else is a violation. */
    allow?: string[];
    /** These licenses are violations (takes precedence; useful without an allowlist). */
    deny?: string[];
}
/** One package whose license violates the policy. */
export interface LicenseViolation {
    package: string;
    license: string;
    /** Which rule it broke. */
    reason: "denied" | "not-allowed";
}
/** Extract each package's declared license from an SBOM, dispatching on media type (SPDX vs CycloneDX). Never throws on shape — a package with no license reads as `"NOASSERTION"`. */
export declare function extractLicenses(sbom: SbomDocument): PackageLicense[];
/**
 * Split an SPDX license expression into its component license atoms, so a
 * deny/allow list matches a license hidden inside an expression like
 * `"GPL-3.0 OR MIT"` or `"(Apache-2.0 AND MIT)"` — an exact-string compare on
 * the whole expression would miss `GPL-3.0` and let it through. Conservative:
 * we only need the *set* of licenses referenced, so we split on `OR`/`AND`,
 * drop parentheses, and strip any `WITH <exception>` suffix. A single license
 * id returns itself unchanged.
 */
export declare function licenseAtoms(expr: string): string[];
/**
 * Evaluate an SBOM's licenses against `policy`. A package violates if ANY atom
 * of its (possibly compound) SPDX license expression is in `deny`, or (when
 * `allow` is set) any atom is not in `allow`. This is conservative on `OR`
 * expressions — `"GPL-3.0 OR MIT"` counts as a `GPL-3.0` deny hit even though a
 * consumer could choose MIT — because a policy gate should surface the presence
 * of a denied license, not silently rely on the consumer picking the permissive
 * branch. Packages with no declared license (`NOASSERTION`/empty) are not
 * flagged — an undeclared license is not asserted to be denied.
 */
export declare function evaluateLicensePolicy(sbom: SbomDocument, policy: LicensePolicy): LicenseViolation[];
//# sourceMappingURL=license-policy.d.ts.map