()
| 233 | // No resolved URL means no trusted version. A version-pinned deny must |
| 234 | // still block (fail closed); a matching allow stays refused. |
| 235 | const omitted = () => ({ |
| 236 | name: 'evilpkg', |
| 237 | packageName: 'evilpkg', |
| 238 | version: '1.0.0', |
| 239 | resolved: undefined, |
| 240 | location: 'node_modules/evilpkg', |
| 241 | edgesIn: new Set([{ name: 'evilpkg', spec: '^1.0.0' }]), |
| 242 | }) |
| 243 | |
| 244 | // Exact-version deny: blocked. |
| 245 | t.equal(isScriptAllowed(omitted(), { 'evilpkg@1.0.0': false }), false, |