@cdxgen/cdxgen 0.0.1 → 13.0.0

package/types/lib/ecosystems/sbtutils.d.ts

@@ -0,0 +1,179 @@
+/**
+ * Returns a default location of the plugins file.
+ *
+ * @param {string} projectPath Path to the SBT project
+ */
+export declare function sbtPluginsPath(projectPath: string): any;
+/**
+ * Determine the version of SBT used in compilation of this project.
+ * By default it looks into a standard SBT location i.e.
+ * <path-project>/project/build.properties
+ * Returns `null` if the version cannot be determined.
+ *
+ * @param {string} projectPath Path to the SBT project
+ */
+export declare function determineSbtVersion(projectPath: string): string | null;
+/**
+ * Adds a new plugin to the SBT project by amending its plugins list.
+ * Only recommended for SBT < 1.2.0 or otherwise use `addPluginSbtFile`
+ * parameter.
+ * The change manipulates the existing plugins' file by creating a copy of it
+ * and returning a path where it is moved to.
+ * Once the SBT task is complete one must always call `cleanupPlugin` to remove
+ * the modifications made in place.
+ *
+ * @param {string} projectPath Path to the SBT project
+ * @param {string} plugin Name of the plugin to add
+ */
+export declare function addPlugin(projectPath: string, plugin: string): string | null;
+/**
+ * Cleans up modifications to the project's plugins' file made by the
+ * `addPlugin` function.
+ *
+ * @param {string} projectPath Path to the SBT project
+ * @param {string} originalPluginsFile Location of the original plugins file, if any
+ */
+export declare function cleanupPlugin(projectPath: string, originalPluginsFile: string): boolean;
+/**
+ * Find the repository URL from the local Coursier cache for a given Maven package.
+ *
+ * @param {string} group Maven groupId
+ * @param {string} name Maven artifactId (original name with suffix if applicable)
+ * @param {string} version Package version
+ * @returns {string|null} The repository URL or null if not found
+ */
+export declare function findCoursierRegistryUrl(group: string, name: string, version: string): string | null;
+/**
+ * Test if a given URL exists (returns 2xx/3xx for http/https, or exists on disk for file)
+ *
+ * @param {string} url URL to test
+ * @returns {Promise<boolean>} true if URL exists
+ */
+export declare function testUrlExists(url: string): Promise<boolean>;
+/**
+ * Find the local jar path in Coursier cache if it exists.
+ *
+ * @param {string} group Maven groupId
+ * @param {string} name Maven artifactId (original name with suffix)
+ * @param {string} version Package version
+ * @returns {string|null} local jar path or null
+ */
+export declare function findLocalJarPath(group: string, name: string, version: string): string | null;
+/**
+ * Resolve the repo/jar download URLs and optional hashes for a Maven coordinate.
+ *
+ * Looks up the Coursier registry URL for the coordinate and, when the jar is
+ * present in the local Coursier cache, computes MD5/SHA-1/SHA-256/SHA-512
+ * digests. Results are memoized per coordinate.
+ *
+ * @param {string} group Maven groupId.
+ * @param {string} name Maven artifactId.
+ * @param {string} version Package version.
+ * @returns {Promise<{repoUrl: string, jarUrl: string, hashes?: Array<{alg: string, content: string}>}|null>}
+ *   Resolved URLs with optional hashes, or null when no registry URL is found.
+ */
+export declare function resolveJarDistribution(group: string, name: string, version: string): Promise<{
+    repoUrl: string;
+    jarUrl: string;
+    hashes?: Array<{
+        alg: string;
+        content: string;
+    }>;
+} | null>;
+/**
+ * Parse an sbt dependency tree output file and return the package list and dependency tree.
+ *
+ * Reads a file produced by the sbt `dependencyTree` command and extracts Maven artifact
+ * coordinates, building a hierarchical dependency graph. Evicted packages and ranges are ignored.
+ *
+ * @param {string} sbtTreeFile Path to the sbt dependency tree output file
+ * @returns {{ pkgList: Object[], dependenciesList: Object[] }}
+ */
+export declare function parseSbtTree(sbtTreeFile: string): {
+    pkgList: Object[];
+    dependenciesList: Object[];
+};
+/**
+ * Parse sbt lock file
+ *
+ * @param {string} pkgLockFile build.sbt.lock file
+ */
+export declare function parseSbtLock(pkgLockFile: string): Promise<{
+    group: any;
+    name: any;
+    version: any;
+    _integrity: string;
+    scope: string | undefined;
+    properties: {
+        name: string;
+        value: string;
+    }[];
+    purl: any;
+    "bom-ref": string;
+    evidence: {
+        identity: {
+            field: string;
+            confidence: number;
+            concludedValue: any;
+            methods: {
+                technique: string;
+                confidence: number;
+                value: string;
+            }[];
+        };
+    };
+}[]>;
+/**
+ * Parse the root build.sbt to extract the aggregate project name, organization, and version.
+ *
+ * @param {string} projectPath Directory path of the project
+ * @returns {{ name: string, group: string, version: string }|null}
+ */
+export declare function parseSbtRootProject(projectPath: string): {
+    name: string;
+    group: string;
+    version: string;
+} | null;
+/**
+ * Discover SBT subproject names statically by parsing build.sbt and project files.
+ *
+ * @param {string} projectPath Directory path of the project
+ * @returns {string[]} List of discovered subproject names
+ */
+export declare function discoverSbtProjects(projectPath: string): string[];
+/**
+ * Parse the output of the sbt `projects` command to extract the real project
+ * identifiers as understood by sbt. This is more accurate than scraping the
+ * build files with a regex (see {@link discoverSbtProjects}), since it relies
+ * on sbt's own project resolution and therefore avoids false positives from
+ * commented-out code, examples or values that merely look like project
+ * definitions.
+ *
+ * A typical `sbt projects` output looks like:
+ *
+ * ```
+ * [info] In file:/path/to/build/
+ * [info] 	   * chen
+ * [info] 	     platform
+ * [info] 	     dataflowengineoss
+ * ```
+ *
+ * The project marked with `*` is the currently selected (usually the
+ * aggregating root) project.
+ *
+ * @param {string} stdout Raw stdout captured from `sbt projects`
+ * @returns {{projects: string[], root: string | undefined}} The discovered
+ *  project ids and the currently selected (root) project id, if any.
+ */
+export declare function parseSbtProjects(stdout: string): {
+    projects: string[];
+    root: string | undefined;
+};
+/**
+ * Parse plugins.sbt files to extract sbt plugins as development dependencies.
+ *
+ * @param {string} projectPath Directory path of the project
+ * @returns {Object[]} List of parsed dependency components
+ */
+export declare function parseSbtPlugins(projectPath: string): Object[];
+//# sourceMappingURL=sbtutils.d.ts.map

package/types/lib/ecosystems/sbtutils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbtutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/sbtutils.js"],"names":[],"mappings":"AAmEA;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAF/B,MAE+B,OAEzC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAFpC,MAEoC,iBAa9C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,WAAW,EAH1B,MAG0B,EAAE,MAAM,EAFlC,MAEkC,iBAc5C;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAH9B,MAG8B,EAAE,mBAAmB,EAFnD,MAEmD,WAkB7D;AA0KD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EALlC,MAKkC,EAAE,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,MAAM,GAAC,IAAI,CAIvB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAH5B,MAG4B,GAF1B,OAAO,CAAC,OAAO,CAAC,CAuB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAL3B,MAK2B,EAAE,IAAI,EAJjC,MAIiC,EAAE,OAAO,EAH1C,MAG0C,GAFxC,MAAM,GAAC,IAAI,CA+BvB;AAWD;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EANvC,MAMuC,EAAE,IAAI,EAL7C,MAK6C,EAAE,OAAO,EAJtD,MAIsD,GAHpD,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,KAAK,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAC,CAAC,CAAA;CAAC,GAAC,IAAI,CAAC,CAmC3G;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,WAAW,EAHnC,MAGmC,GAFjC;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAE,CA2M7D;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,WAAW,EAFnC,MAEmC;;;;;;;;;;;;;;;;;;;;;;;;KAoG7C;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAHpC,MAGoC,GAFlC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAC,IAAI,CA2BjE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAHpC,MAGoC,GAFlC,MAAM,EAAE,CA2BpB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAJ5B,MAI4B,GAH1B;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;CAAC,CA6C1D;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAHhC,MAGgC,GAF9B,MAAM,EAAE,CAwDpB"}

package/types/lib/ecosystems/tea.d.ts

@@ -0,0 +1,180 @@
+/**
+ * Parse a Transparency Exchange Identifier (TEI) URN.
+ *
+ * Syntax: `urn:tei:<type>:<domain-name>:<unique-identifier>` where
+ * `<domain-name>` is used for `/.well-known/tea` discovery.
+ *
+ * @param {string} tei TEI URN string
+ * @returns {{type: string, domain: string, id: string}|null} Parsed parts
+ */
+export declare function parseTei(tei: string): {
+    type: string;
+    domain: string;
+    id: string;
+} | null;
+/**
+ * Compare two semver strings (major.minor.patch with optional prerelease).
+ * Returns 1 when a > b, -1 when a < b, 0 when equal.
+ *
+ * @param {string} a Version string
+ * @param {string} b Version string
+ * @returns {number} Comparison result
+ */
+export declare function compareTeaVersions(a: string, b: string): number;
+/**
+ * Pick the endpoint and API version to use, per the discovery spec: the client
+ * MUST pick the endpoint with the highest matching version supported by both
+ * the client and the endpoint (SemVer comparison), preferring the highest
+ * `priority` when several tie. Returns the best-effort selection.
+ *
+ * @param {Object[]} endpoints Endpoints from the `.well-known/tea` document
+ * @param {string[]} [supported] Versions the client supports
+ * @returns {{url: string, version: string}|null} Selected endpoint
+ */
+export declare function selectTeaEndpoint(endpoints: Object[], supported?: string[]): {
+    url: string;
+    version: string;
+} | null;
+/**
+ * Discover TEA endpoints for a domain via `https://<domain>/.well-known/tea`.
+ * The well-known document must conform to the TEA Well-Known schema.
+ *
+ * @param {string} domain Domain name from the TEI
+ * @param {Object} [options] CLI options
+ * @returns {Promise<Object|null>} Parsed well-known document
+ */
+export declare function discoverTeaEndpoints(domain: string, options?: Object): Promise<Object | null>;
+/**
+ * Resolve a TEI to a product release UUID and a selected TEA server.
+ *
+ * @param {string} tei TEI URN string
+ * @param {Object} [options] CLI options
+ * @returns {Promise<{productReleaseUuid: string, server: {url: string, version: string}}|null>}
+ */
+export declare function resolveTei(tei: string, options?: Object): Promise<{
+    productReleaseUuid: string;
+    server: {
+        url: string;
+        version: string;
+    };
+} | null>;
+/**
+ * Fetch the latest TEA Collection for a product (or component) release.
+ *
+ * @param {Object} input Fetch inputs
+ * @param {string} input.rootUrl TEA server root URL
+ * @param {string} input.version TEA API version
+ * @param {string} input.releaseUuid Product or component release UUID
+ * @param {string} [input.scope] `productRelease` (default) or `componentRelease`
+ * @param {Object} [input.options] CLI options
+ * @returns {Promise<Object|null>} TEA Collection object
+ */
+export declare function fetchLatestCollection({ rootUrl, version, releaseUuid, scope, options, }?: {
+    rootUrl: string;
+    version: string;
+    releaseUuid: string;
+    scope?: string;
+    options?: Object;
+}): Promise<Object | null>;
+/**
+ * Download the BOM artifacts of a TEA Collection and verify their checksums.
+ * Only artifacts whose format is a CycloneDX or SPDX JSON media type are
+ * downloaded; other formats (XML, signatures) are skipped. A checksum mismatch
+ * rejects the artifact rather than merging untrusted content.
+ *
+ * @param {Object} collection TEA Collection object
+ * @param {Object} [options] CLI options
+ * @returns {Promise<Array<{name: string, url: string, content: string, format: Object}>>}
+ */
+export declare function fetchBomArtifacts(collection: Object, options?: Object): Promise<Array<{
+    name: string;
+    url: string;
+    content: string;
+    format: Object;
+}>>;
+/**
+ * Build the POST /collection payload per the draft TEA publisher API.
+ *
+ * Collection versioning is owned by the server: the client publishes with a
+ * reason (INITIAL_RELEASE for the first collection, ARTIFACT_UPDATED /
+ * ARTIFACT_ADDED / VEX_UPDATED for updates) and the server increments the
+ * collection `version` counter.
+ *
+ * @param {Object} input Payload inputs
+ * @param {string} input.leafIdentifier UUID of the release/leaf this collection belongs to
+ * @param {string} input.productName Product name
+ * @param {string} input.productVersion Product version
+ * @param {string} input.authorName Author name
+ * @param {string} [input.authorEmail] Author email
+ * @param {string} [input.reasonType] Collection update reason enum value
+ * @param {string} [input.reasonComment] Free-text reason comment
+ * @param {string} input.artifactName Artifact name
+ * @param {string} input.artifactUrl Hosted URL of the BOM artifact
+ * @param {string} input.artifactContent BOM content used for checksum/size
+ * @param {string} [input.artifactMediaType] Media type of the BOM
+ * @param {string} [input.artifactDescription] Description of the artifact
+ * @returns {Object} Publish payload
+ */
+export declare function buildPublishCollectionPayload({ leafIdentifier, productName, productVersion, authorName, authorEmail, reasonType, reasonComment, artifactName, artifactUrl, artifactContent, artifactMediaType, artifactDescription, }: {
+    leafIdentifier: string;
+    productName: string;
+    productVersion: string;
+    authorName: string;
+    authorEmail?: string;
+    reasonType?: string;
+    reasonComment?: string;
+    artifactName: string;
+    artifactUrl: string;
+    artifactContent: string;
+    artifactMediaType?: string;
+    artifactDescription?: string;
+}): Object;
+/**
+ * Publish a TEA Collection via the draft publisher API's POST /collection.
+ *
+ * A publish failure is reported as an error to the caller; it never deletes or
+ * rewrites the locally written BOM. The caller decides the exit status.
+ *
+ * @param {string} serverUrl TEA server base URL (e.g. https://tea.example.com)
+ * @param {Object} payload POST /collection payload
+ * @param {Object} [options] CLI options
+ * @returns {Promise<{status: number, body: Object}>} Server response
+ */
+export declare function publishTeaCollection(serverUrl: string, payload: Object, options?: Object): Promise<{
+    status: number;
+    body: Object;
+}>;
+/**
+ * Merge fetched TEA SBOM documents into the generated BOM with the same rule
+ * PEP 770 embedded SBOMs follow: an upstream document is a stronger assertion
+ * than cdxgen's inference, so its components win on conflict and the conflict
+ * is recorded by the property union rather than discarded. Returns the
+ * components, dependencies, and citations; the caller merges them.
+ *
+ * @param {Object[]} artifacts Fetched artifacts (`{name, url, content}`)
+ * @param {Object} [context] Merge context
+ * @param {string} [context.collectionUuid] UUID of the TEA collection
+ * @param {string} [context.attributedTo] bom-ref to attribute the fetched data to
+ * @returns {{components: Object[], dependencies: Object[], citations: Object[]}}
+ */
+export declare function mergeTeaBom(artifacts: Object[], context?: {
+    collectionUuid?: string;
+    attributedTo?: string;
+}): {
+    components: Object[];
+    dependencies: Object[];
+    citations: Object[];
+};
+/**
+ * Resolve a TEI, retrieve the latest Collection's BOM artifacts, and merge them
+ * into a generated BOM in place.
+ *
+ * Retrieval is an enrichment, never a precondition: any failure is reported and
+ * the locally generated BOM is left as it stands.
+ *
+ * @param {Object} bomNSData BOM namespace data (`bomJson`, `parentComponent`, `citations`)
+ * @param {Object} options CLI options carrying `teaFetch` and credentials
+ * @returns {Promise<Object>} The same `bomNSData`, enriched where possible
+ */
+export declare function applyTeaFetch(bomNSData: Object, options?: Object): Promise<Object>;
+//# sourceMappingURL=tea.d.ts.map

package/types/lib/ecosystems/tea.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tea.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/tea.js"],"names":[],"mappings":"AAiCA;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAHjB,MAGiB,GAFf;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAC,GAAC,IAAI,CAQ3D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAJzB,MAIyB,EAAE,CAAC,EAH5B,MAG4B,GAF1B,MAAM,CA4BlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EALA,MAAM,EAKN,EACT,SAAS,AALR,CACA,EADQ,MAAM,EAKmB,GAJvB;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAAC,IAAI,CAgD/C;AA6BD;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAJtC,MAIsC,EAAE,OAAO,AAHvD,CACA,EADQ,MAGoD,GAFlD,OAAO,CAAC,MAAM,GAAC,IAAI,CAAC,CAShC;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAJzB,MAIyB,EAAE,OAAO,AAH1C,CACA,EADQ,MAGuC,GAFrC,OAAO,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAC,CAAA;CAAC,GAAC,IAAI,CAAC,CAyC9F;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,OAAO,EACP,OAAO,EACP,WAAW,EACX,KAAwB,EACxB,OAAY,GACb,GAbE;IAAsB,OAAO,EAArB,MAAM,CACd;IAAsB,OAAO,EAArB,MAAM,CACd;IAAsB,WAAW,EAAzB,MAAM,CACd;IAAuB,KAAK,AAA5B,CACA,EADQ,MAAM,CACd;IAAuB,OAAO,AAA9B,CACA,EADQ,MAAM,CACd;CAQG,GARO,OAAO,CAAC,MAAM,GAAC,IAAI,CAAC,CAWhC;AA8ED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,EAJvC,MAIuC,EAAE,OAAO,AAHxD,CACA,EADQ,MAGqD,GAFnD,OAAO,CAAC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,CAAC,CAAC,CA8CxF;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,WAAW,EACX,UAA8B,EAC9B,aAAa,EACb,YAAY,EACZ,WAAW,EACX,eAAe,EACf,iBAAoD,EACpD,mBAAmB,GACpB,EA3BE;IAAsB,cAAc,EAA5B,MAAM,CACd;IAAsB,WAAW,EAAzB,MAAM,CACd;IAAsB,cAAc,EAA5B,MAAM,CACd;IAAsB,UAAU,EAAxB,MAAM,CACd;IAAuB,WAAW,AAAlC,CACA,EADQ,MAAM,CACd;IAAuB,UAAU,AAAjC,CACA,EADQ,MAAM,CACd;IAAuB,aAAa,AAApC,CACA,EADQ,MAAM,CACd;IAAsB,YAAY,EAA1B,MAAM,CACd;IAAsB,WAAW,EAAzB,MAAM,CACd;IAAsB,eAAe,EAA7B,MAAM,CACd;IAAuB,iBAAiB,AAAxC,CACA,EADQ,MAAM,CACd;IAAuB,mBAAmB,AAA1C,CACA,EADQ,MAAM,CACd;CAeF,GAfY,MAAM,CAgDlB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CAAC,SAAS,EALzC,MAKyC,EAAE,OAAO,EAJlD,MAIkD,EAAE,OAAO,AAHnE,CACA,EADQ,MAGgE,GAF9D,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,CAAC,CAsBnD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAN1B,MAAM,EAMoB,EAAE,OAAO,AAL3C,CAGA,EAFA;IAAyB,cAAc,AAAvC,CACA,EADQ,MAAM,CACd;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;CAEgD,GAFtC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,CAkC/E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAJlC,MAIkC,EAAE,OAAO,GAH3C,MAGgD,GAF9C,OAAO,CAAC,MAAM,CAAC,CAwD3B"}

package/types/lib/ecosystems/utils.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Deprecated re-export barrel.
+ *
+ * `utils.js` declares nothing of its own. It re-exports the 261 public names that
+ * used to live here so existing imports keep working for one major version. Each
+ * implementation, and its JSDoc, now lives in the leaf module it was moved to
+ * (`purl.js`, `spdx.js`, `deps.js`, `ecosystems.js`, `parsers-*.js`, `core-*.js`,
+ * `state.js`, `paths.js`).
+ *
+ * New code should import from the specific module instead. See MIGRATING-TO-V13.md.
+ */
+import { BLOCKED_HOST_ERROR_CODE, cdxgenAgent, createBlockedHostError, createDryRunError, DEBUG_MODE, DRY_RUN_ERROR_CODE, getRecordedActivities, hasDangerousUnicode, isAllowedHttpHost, isDryRun, isDryRunError, isSecureMode, isSensitiveEnvironmentVariableName, readEnvironmentVariable, recordActivity, recordDecisionActivity, recordDiscoveryActivity, recordEnvironmentRead, recordObservedActivity, recordPolicyActivity, recordSensitiveFileRead, recordSymlinkResolution, remoteHostsAccessed, resetActivityContext, resetRecordedActivities, setActivityContext, setDryRunMode } from "../core/activity.js";
+import { CARGO_CMD, CDXGEN_SPDX_CREATED_BY, CDXGEN_TEMP_DIR, CLJ_CMD, DOTNET_CMD, extractPathEnv, FETCH_LICENSE, GCC_CMD, GO_CMD, getJavaCommand, getPythonCommand, hasAnyProjectType, includeMavenTestScope, isBun, isDeno, isFeatureEnabled, isNode, isPackageManagerAllowed, JAVA_CMD, LEIN_CMD, NODE_CMD, NPM_CMD, PACKAGE_MANAGER_ALIASES, PREFER_MAVEN_DEPS_TREE, PROJECT_TYPE_ALIASES, PYTHON_CMD, PYTHON_EXCLUDED_COMPONENTS, parseMavenArgs, RUBY_CMD, RUSTC_CMD, SEARCH_MAVEN_ORG, SWIFT_CMD, shouldFetchLicense, shouldFetchPackageMetadata, shouldFetchVCS, shouldRunPredictiveBomAudit, TABLE_BORDER_STYLE, YARN_CMD } from "../core/env.js";
+import { checksumFile, commandsExecuted, getAllFiles, getAllFilesWithIgnore, getTimestamp, getTmpDir, MAX_BUFFER, multiChecksumFile, safeCopyFileSync, safeExistsSync, safeExtractArchive, safeMkdirSync, safeMkdtempSync, safeRmSync, safeSpawnSync, safeUnlinkSync, safeWriteSync, TIMEOUT_MS } from "../core/fs.js";
+import { dirNameStr, isMac, isValidDriveRoot, isWin, toCamel } from "../core/paths.js";
+import { CDXGEN_VERSION, frameworksList } from "../core/state.js";
+import { executeAtom, findAppModules, getAtomCommand } from "../inventory/atomUtils.js";
+import { getDefaultBomAuditCategories } from "../inventory/auditCategories.js";
+import { collectJarNS, collectMvnDependencies, componentSorter, convertJarNSToPackages, getJarClasses, getPomPropertiesFromMavenDir, inferJarGroupFromManifest, parseJarManifest, parsePomProperties, parsePomXml, readZipEntry, trimJarGroupSuffix } from "../inventory/deps.js";
+import { isPartialTree, recomputeScope } from "../inventory/depsUtils.js";
+import { getRuntimeInformation, retrieveCdxgenPluginVersion, retrieveCdxgenVersion } from "../inventory/envcontext.js";
+import { addEvidenceForDotnet, attachIdentityTools, convertOSQueryResults, extractToolRefs } from "../inventory/evidenceUtils.js";
+export { getCppModules } from "./cppEvidence.js";
+export { addEvidenceForImports } from "./jsEvidence.js";
+import { collectExecutables, collectSharedLibs, getOSPackageForFile } from "../inventory/osPackageResolver.js";
+import { encodeForPurl, locateGenericPackage, mapConanPkgRefToPurlStringAndNameAndVersion, purlFromUrlString } from "../inventory/purl.js";
+import { addLicenseText, adjustLicenseInformation, findLicenseId, getKnownLicense, getLicenses, guessLicenseId, isSpdxLicenseExpression, readLicenseText } from "../inventory/spdx.js";
+import { isValidIriReference } from "../parsers/iri.js";
+import { composePomXmlUrl, extractJarArchive, extractLicenseCommentFromPomXml, fetchPomXml, fetchPomXmlAsJson, findLocalMvnArtifact, getCratesMetadata, getDartMetadata, getGithubUrlParts, getGoPkgLicense, getMvnMetadata, getNpmMetadata, getNugetMetadata, getPyMetadata, getRepoLicense, getSwiftPackageMetadata, guessPypiMatchingVersion, metadata_cache, parseBdistMetadata, parseLicenseEntryOrArrayFromPomXml, repoMetadataToGitHubApiUrl, toGitHubApiUrl } from "./ecosystems.js";
+import { getMavenCommand, getMillCommand } from "./gradleutils.js";
+import { createNpmWorkspacePurl } from "./npmutils.js";
+import { getPropertyGroupTextNodes, parseCsPkgData, parseCsPkgLockData, parseCsProjAssetsData, parseCsProjData, parseNupkg, parseNuspecData, parsePaketLockData } from "./parsers-dotnet.js";
+import { getGoPkgComponent, parseGoListDep, parseGoModData, parseGoModGraph, parseGoModulesTxt, parseGoModWhy, parseGopkgData, parseGosumData, parseGoVersionData } from "./parsers-go.js";
+import { findPnpmPackagePath, getVersionNumPnpm, parseBowerJson, parseMinJs, parseNodeShrinkwrap, parsePackageJsonName, parsePkgJson, parsePkgLock, parsePnpmLock, parsePnpmWorkspace, parseYarnLock, parseYarnWorkspace, pnpmMetadata, splitCommandArgs, yarnLockToIdentMap } from "./parsers-js.js";
+import { parseBazelActionGraph, parseBazelBuild, parseBazelSkyframe, parseCljDep, parseEdnData, parseKVDep, parseLeinDep, parseLeiningenData, parseLeinMap, parseMavenTree, parseMavenTreeJson, parseMillDependency, parsePom } from "./parsers-jvm.js";
+import { buildObjectForCocoaPod, executeAlpmList, executeApkList, executeDpkgList, executeEqueryList, executePodCommand, executeRpmList, identifyFlow, parseBitbucketPipelinesFile, parseCabalData, parseCloudBuildData, parseCmakeDotFile, parseCmakeLikeFile, parseCocoaDependency, parseColliderLockData, parseComposerJson, parseComposerLock, parseConanData, parseConanLockData, parseContainerFile, parseContainerSpecData, parseCUsageSlice, parseFlakeLock, parseFlakeNix, parseGitHubWorkflowData, parseHelmYamlData, parseMakeDFile, parseMixLockData, parseOpenapiSpecData, parsePodfileLock, parsePodfileTargets, parsePrivadoFile, parsePubLockData, parsePubYamlData, parseSwiftJsonTree, parseSwiftJsonTreeObject, parseSwiftResolved, recurseImageNameLookup } from "./parsers-misc.js";
+import { derivePythonLockMetadataFileName, generatePixiLockFile, parseMojoProject, parsePiplockData, parsePixiLockFile, parsePixiTomlFile, parsePyLockData, parsePyProjectTomlFile, parsePyRequiresDist, parseReqEnvMarkers, parseReqFile, parseSetupPyFile } from "./parsers-python.js";
+import { parseCargoAuditableData, parseCargoData, parseCargoDependencyData, parseCargoManifestDependencyData, parseCargoTomlData } from "./parsers-rust.js";
+import { createUVLock, getPipFrozenTree, getPipTreeForPackages, getPyModules } from "./pythonutils.js";
+export { addEvidenceForDotnet, addLicenseText, adjustLicenseInformation, attachIdentityTools, BLOCKED_HOST_ERROR_CODE, buildObjectForCocoaPod, CARGO_CMD, CDXGEN_SPDX_CREATED_BY, CDXGEN_TEMP_DIR, CDXGEN_VERSION, CLJ_CMD, cdxgenAgent, checksumFile, collectExecutables, collectJarNS, collectMvnDependencies, collectSharedLibs, commandsExecuted, componentSorter, composePomXmlUrl, convertJarNSToPackages, convertOSQueryResults, createBlockedHostError, createDryRunError, createNpmWorkspacePurl, createUVLock, DEBUG_MODE, DOTNET_CMD, DRY_RUN_ERROR_CODE, derivePythonLockMetadataFileName, dirNameStr, encodeForPurl, executeAlpmList, executeApkList, executeAtom, executeDpkgList, executeEqueryList, executePodCommand, executeRpmList, extractJarArchive, extractLicenseCommentFromPomXml, extractPathEnv, extractToolRefs, FETCH_LICENSE, fetchPomXml, fetchPomXmlAsJson, findAppModules, findLicenseId, findLocalMvnArtifact, findPnpmPackagePath, frameworksList, GCC_CMD, GO_CMD, generatePixiLockFile, getAllFiles, getAllFilesWithIgnore, getAtomCommand, getCratesMetadata, getDartMetadata, getDefaultBomAuditCategories, getGithubUrlParts, getGoPkgComponent, getGoPkgLicense, getJarClasses, getJavaCommand, getKnownLicense, getLicenses, getMavenCommand, getMillCommand, getMvnMetadata, getNpmMetadata, getNugetMetadata, getOSPackageForFile, getPipFrozenTree, getPipTreeForPackages, getPomPropertiesFromMavenDir, getPropertyGroupTextNodes, getPyMetadata, getPyModules, getPythonCommand, getRecordedActivities, getRepoLicense, getRuntimeInformation, getSwiftPackageMetadata, getTimestamp, getTmpDir, getVersionNumPnpm, guessLicenseId, guessPypiMatchingVersion, hasAnyProjectType, hasDangerousUnicode, identifyFlow, includeMavenTestScope, inferJarGroupFromManifest, isAllowedHttpHost, isBun, isDeno, isDryRun, isDryRunError, isFeatureEnabled, isMac, isNode, isPackageManagerAllowed, isPartialTree, isSecureMode, isSensitiveEnvironmentVariableName, isSpdxLicenseExpression, isValidDriveRoot, isValidIriReference, isWin, JAVA_CMD, LEIN_CMD, locateGenericPackage, MAX_BUFFER, mapConanPkgRefToPurlStringAndNameAndVersion, metadata_cache, multiChecksumFile, NODE_CMD, NPM_CMD, PACKAGE_MANAGER_ALIASES, PREFER_MAVEN_DEPS_TREE, PROJECT_TYPE_ALIASES, PYTHON_CMD, PYTHON_EXCLUDED_COMPONENTS, parseBazelActionGraph, parseBazelBuild, parseBazelSkyframe, parseBdistMetadata, parseBitbucketPipelinesFile, parseBowerJson, parseCabalData, parseCargoAuditableData, parseCargoData, parseCargoDependencyData, parseCargoManifestDependencyData, parseCargoTomlData, parseCljDep, parseCloudBuildData, parseCmakeDotFile, parseCmakeLikeFile, parseCocoaDependency, parseColliderLockData, parseComposerJson, parseComposerLock, parseConanData, parseConanLockData, parseContainerFile, parseContainerSpecData, parseCsPkgData, parseCsPkgLockData, parseCsProjAssetsData, parseCsProjData, parseCUsageSlice, parseEdnData, parseFlakeLock, parseFlakeNix, parseGitHubWorkflowData, parseGoListDep, parseGoModData, parseGoModGraph, parseGoModulesTxt, parseGoModWhy, parseGopkgData, parseGosumData, parseGoVersionData, parseHelmYamlData, parseJarManifest, parseKVDep, parseLeinDep, parseLeiningenData, parseLeinMap, parseLicenseEntryOrArrayFromPomXml, parseMakeDFile, parseMavenArgs, parseMavenTree, parseMavenTreeJson, parseMillDependency, parseMinJs, parseMixLockData, parseMojoProject, parseNodeShrinkwrap, parseNupkg, parseNuspecData, parseOpenapiSpecData, parsePackageJsonName, parsePaketLockData, parsePiplockData, parsePixiLockFile, parsePixiTomlFile, parsePkgJson, parsePkgLock, parsePnpmLock, parsePnpmWorkspace, parsePodfileLock, parsePodfileTargets, parsePom, parsePomProperties, parsePomXml, parsePrivadoFile, parsePubLockData, parsePubYamlData, parsePyLockData, parsePyProjectTomlFile, parsePyRequiresDist, parseReqEnvMarkers, parseReqFile, parseSetupPyFile, parseSwiftJsonTree, parseSwiftJsonTreeObject, parseSwiftResolved, parseYarnLock, parseYarnWorkspace, pnpmMetadata, purlFromUrlString, RUBY_CMD, RUSTC_CMD, readEnvironmentVariable, readLicenseText, readZipEntry, recomputeScope, recordActivity, recordDecisionActivity, recordDiscoveryActivity, recordEnvironmentRead, recordObservedActivity, recordPolicyActivity, recordSensitiveFileRead, recordSymlinkResolution, recurseImageNameLookup, remoteHostsAccessed, repoMetadataToGitHubApiUrl, resetActivityContext, resetRecordedActivities, retrieveCdxgenPluginVersion, retrieveCdxgenVersion, SEARCH_MAVEN_ORG, SWIFT_CMD, safeCopyFileSync, safeExistsSync, safeExtractArchive, safeMkdirSync, safeMkdtempSync, safeRmSync, safeSpawnSync, safeUnlinkSync, safeWriteSync, setActivityContext, setDryRunMode, shouldFetchLicense, shouldFetchPackageMetadata, shouldFetchVCS, shouldRunPredictiveBomAudit, splitCommandArgs, TABLE_BORDER_STYLE, TIMEOUT_MS, toCamel, toGitHubApiUrl, trimJarGroupSuffix, YARN_CMD, yarnLockToIdentMap, };
+//# sourceMappingURL=utils.d.ts.map

package/types/lib/ecosystems/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/utils.js"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,uBAAuB,EACvB,WAAW,EACX,sBAAsB,EACtB,iBAAiB,EACjB,UAAU,EACV,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,QAAQ,EACR,aAAa,EACb,YAAY,EACZ,kCAAkC,EAClC,uBAAuB,EACvB,cAAc,EACd,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,aAAa,EACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,SAAS,EACT,sBAAsB,EACtB,eAAe,EACf,OAAO,EACP,UAAU,EACV,cAAc,EACd,aAAa,EACb,OAAO,EACP,MAAM,EACN,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,KAAK,EACL,MAAM,EACN,gBAAgB,EAChB,MAAM,EACN,uBAAuB,EACvB,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,OAAO,EACP,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,UAAU,EACV,0BAA0B,EAC1B,cAAc,EACd,QAAQ,EACR,SAAS,EACT,gBAAgB,EAChB,SAAS,EACT,kBAAkB,EAClB,0BAA0B,EAC1B,cAAc,EACd,2BAA2B,EAC3B,kBAAkB,EAClB,QAAQ,EACT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,qBAAqB,EACrB,YAAY,EACZ,SAAS,EACT,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,eAAe,EACf,UAAU,EACV,aAAa,EACb,cAAc,EACd,aAAa,EACb,UAAU,EACX,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,UAAU,EACV,KAAK,EACL,gBAAgB,EAChB,KAAK,EACL,OAAO,EACR,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EACL,WAAW,EACX,cAAc,EACd,cAAc,EACf,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,eAAe,EACf,sBAAsB,EACtB,aAAa,EACb,4BAA4B,EAC5B,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,EAClB,WAAW,EACX,YAAY,EACZ,kBAAkB,EACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,EACtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,2CAA2C,EAC3C,iBAAiB,EAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,aAAa,EACb,eAAe,EACf,WAAW,EACX,cAAc,EACd,uBAAuB,EACvB,eAAe,EAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,+BAA+B,EAC/B,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,uBAAuB,EACvB,wBAAwB,EACxB,cAAc,EACd,kBAAkB,EAClB,kCAAkC,EAClC,0BAA0B,EAC1B,cAAc,EACf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EACL,yBAAyB,EACzB,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,eAAe,EACf,kBAAkB,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,cAAc,EACd,kBAAkB,EACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,QAAQ,EACT,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,2BAA2B,EAC3B,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,gCAAgC,EAChC,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,wBAAwB,EACxB,gCAAgC,EAChC,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,YAAY,EACb,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,SAAS,EACT,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,OAAO,EACP,WAAW,EACX,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,sBAAsB,EACtB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,kBAAkB,EAClB,gCAAgC,EAChC,UAAU,EACV,aAAa,EACb,eAAe,EACf,cAAc,EACd,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,+BAA+B,EAC/B,cAAc,EACd,eAAe,EACf,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,mBAAmB,EACnB,cAAc,EACd,OAAO,EACP,MAAM,EACN,oBAAoB,EACpB,WAAW,EACX,qBAAqB,EACrB,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,4BAA4B,EAC5B,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,cAAc,EACd,eAAe,EACf,WAAW,EACX,eAAe,EACf,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,qBAAqB,EACrB,4BAA4B,EAC5B,yBAAyB,EACzB,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,qBAAqB,EACrB,uBAAuB,EACvB,YAAY,EACZ,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,EACZ,qBAAqB,EACrB,yBAAyB,EACzB,iBAAiB,EACjB,KAAK,EACL,MAAM,EACN,QAAQ,EACR,aAAa,EACb,gBAAgB,EAChB,KAAK,EACL,MAAM,EACN,uBAAuB,EACvB,aAAa,EACb,YAAY,EACZ,kCAAkC,EAClC,uBAAuB,EACvB,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,EACL,QAAQ,EACR,QAAQ,EACR,oBAAoB,EACpB,UAAU,EACV,2CAA2C,EAC3C,cAAc,EACd,iBAAiB,EACjB,QAAQ,EACR,OAAO,EACP,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,UAAU,EACV,0BAA0B,EAC1B,qBAAqB,EACrB,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,2BAA2B,EAC3B,cAAc,EACd,cAAc,EACd,uBAAuB,EACvB,cAAc,EACd,wBAAwB,EACxB,gCAAgC,EAChC,kBAAkB,EAClB,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EACtB,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,uBAAuB,EACvB,cAAc,EACd,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,kCAAkC,EAClC,cAAc,EACd,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,UAAU,EACV,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,QAAQ,EACR,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACxB,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,QAAQ,EACR,SAAS,EACT,uBAAuB,EACvB,eAAe,EACf,YAAY,EACZ,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACnB,0BAA0B,EAC1B,oBAAoB,EACpB,uBAAuB,EACvB,2BAA2B,EAC3B,qBAAqB,EACrB,gBAAgB,EAChB,SAAS,EACT,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,eAAe,EACf,UAAU,EACV,aAAa,EACb,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,0BAA0B,EAC1B,cAAc,EACd,2BAA2B,EAC3B,gBAAgB,EAChB,kBAAkB,EAClB,UAAU,EACV,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,QAAQ,EACR,kBAAkB,GACnB,CAAC"}

package/types/lib/ecosystems/zigResolver.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Zig transitive dependency resolver.
+ *
+ * Zig has no central registry. A dependency is a content-addressed archive
+ * whose identity is its `.hash`. The same hash string is used as a filesystem
+ * lookup key across every Zig version — only the container differs (in-tree
+ * `zig-pkg/` directory, extracted cache directory, or cache `.tar.gz`
+ * archive). This module walks the full dependency graph by locating each
+ * dependency's `build.zig.zon` through those containers, then emits a flat
+ * component list plus a CycloneDX `dependencies[]` edge list.
+ *
+ * Resolution is a pure filesystem walk keyed on hashes already present in the
+ * manifests. No subprocess, no network, no toolchain. Populating the cache
+ * (`zig build --fetch`) is the user's job.
+ */
+/**
+ * Validate a Zig `.hash` string against the two known encodings before it is
+ * used to build a filesystem path.
+ *
+ * A `.hash` is attacker-controlled data from a manifest. Joining it blindly
+ * into `<cache>/p/<hash>/build.zig.zon` would let a `../` in the hash escape
+ * the cache directory. The two legal encodings never contain path separators
+ * or `..` segments, so any hash that does not match one of them is refused
+ * before the filesystem is touched.
+ *
+ * The two forms are:
+ *   1. 0.14+ — `<name>-<version>-<base64url digest>` where the digest uses
+ *      `[A-Za-z0-9_-]`.
+ *   2. Pre-0.14 — hex multihash, all hex digits (at least 4 characters).
+ *
+ * @param {string|undefined} hash Hash field value from the manifest
+ * @returns {boolean} `true` only when the hash matches a known Zig encoding
+ */
+export declare function isValidZigHash(hash: string | undefined): boolean;
+/**
+ * Resolve the Zig global package cache directory.
+ *
+ * Order: `ZIG_GLOBAL_CACHE_DIR`, then `$XDG_CACHE_HOME/zig`, then
+ * `~/.cache/zig` on Linux **and macOS** (macOS uses `~/.cache/zig`, *not*
+ * `Library/Caches` — confirmed empirically), then `%LOCALAPPDATA%\zig` on
+ * Windows.
+ *
+ * @returns {string|null} Absolute cache directory path, or null when it cannot
+ *   be determined
+ */
+export declare function getZigGlobalCacheDir(): string | null;
+/**
+ * Walk the full Zig dependency graph starting from a root `build.zig.zon`,
+ * returning a flat component list and a CycloneDX `dependencies[]` edge list.
+ *
+ * For each dependency carrying a `.hash`, the resolver locates the
+ * dependency's own `build.zig.zon` and recurses. Hashes are memoised so
+ * diamond dependencies do not re-read manifests.
+ *
+ * Unresolvable hashes (cache not populated) degrade gracefully: the component
+ * still appears with no outgoing edges, and the count is returned so callers
+ * can report a partial graph.
+ *
+ * @param {string} rootZonFile Absolute path to the root `build.zig.zon`
+ * @param {string} projectRoot The project scan root
+ * @param {object} [_options] CLI options (reserved for future use)
+ * @returns {Promise<{ pkgList: object[], dependencies: object[], parentComponent: object, unresolvedCount: number }>}
+ */
+export declare function resolveZigGraph(rootZonFile: string, projectRoot: string, _options?: object): Promise<{
+    pkgList: object[];
+    dependencies: object[];
+    parentComponent: object;
+    unresolvedCount: number;
+}>;
+//# sourceMappingURL=zigResolver.d.ts.map

package/types/lib/ecosystems/zigResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zigResolver.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/zigResolver.js"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;;GAcG;AAMH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAHxB,MAAM,GAAC,SAGiB,GAFtB,OAAO,CAoBnB;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,IAHvB,MAAM,GAAC,IAAI,CAwBvB;AA4LD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CAAC,WAAW,EALtC,MAKsC,EAAE,WAAW,EAJnD,MAImD,EAAE,QAAQ,AAHrE,CACA,EADQ,MAGkE,GAFhE,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC,CAsGpH"}

package/types/lib/evinser/db.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Create or load the in-memory Namespaces, Usages, and DataFlows models.
+ *
+ * Initialises each model and returns a sequelize-like handle along with the
+ * model references used by evinse for persisting slice evidence.
+ *
+ * @returns {Promise<{ sequelize: { close: () => boolean }, Namespaces: Object, Usages: Object, DataFlows: Object }>}
+ */
+export declare const createOrLoad: () => Promise<{
+    sequelize: {
+        close: () => boolean;
+    };
+    Namespaces: Object;
+    Usages: Object;
+    DataFlows: Object;
+}>;
+//# sourceMappingURL=db.d.ts.map

package/types/lib/evinser/db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../../lib/evinser/db.js"],"names":[],"mappings":"AAmHA;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,QAFZ,OAAO,CAAC;IAAE,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,OAAO,CAAA;KAAE,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAuBlH,CAAC"}