@cdxgen/cdxgen 0.0.1 → 13.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (722) hide show
  1. package/README.md +921 -87
  2. package/bin/audit.js +239 -0
  3. package/bin/cdxgen.js +2335 -0
  4. package/bin/convert.js +220 -0
  5. package/bin/evinse.js +353 -0
  6. package/bin/hbom.js +504 -0
  7. package/bin/repl.js +2224 -0
  8. package/bin/sign.js +195 -0
  9. package/bin/tracebom.js +303 -0
  10. package/bin/validate.js +268 -0
  11. package/bin/verify.js +189 -0
  12. package/data/README.md +307 -0
  13. package/data/bom-1.4.schema.json +1605 -0
  14. package/data/bom-1.5.schema.json +3660 -0
  15. package/data/bom-1.6.schema.json +5511 -0
  16. package/data/bom-1.7.schema.json +6700 -0
  17. package/data/cbomosdb-queries.json +68 -0
  18. package/data/component-tags.json +339 -0
  19. package/data/container-knowledge-index.json +125 -0
  20. package/data/cosdb-queries.json +17 -0
  21. package/data/crypto-oid.json +1998 -0
  22. package/data/cryptography-defs.json +3793 -0
  23. package/data/cryptography-defs.schema.json +576 -0
  24. package/data/cyclonedx-2.0-bundled.schema.json +7182 -0
  25. package/data/frameworks-list.json +219 -0
  26. package/data/glibc-stdlib.json +117 -0
  27. package/data/gtfobins-index.json +6296 -0
  28. package/data/helpers/init.gradle +71 -0
  29. package/data/jsf-0.82.schema.json +211 -0
  30. package/data/known-licenses.json +82 -0
  31. package/data/lic-mapping.json +338 -0
  32. package/data/license-aliases.json +6624 -0
  33. package/data/license-db.json +39059 -0
  34. package/data/license-deprecations.json +302 -0
  35. package/data/lolbas-index.json +150 -0
  36. package/data/predictive-audit-allowlist.json +11 -0
  37. package/data/pypi-pkg-aliases.json +1199 -0
  38. package/data/python-stdlib.json +308 -0
  39. package/data/queries-darwin.json +193 -0
  40. package/data/queries-win.json +257 -0
  41. package/data/queries.json +268 -0
  42. package/data/ruby-known-modules.json +281 -0
  43. package/data/rules/ai-agent-governance.yaml +323 -0
  44. package/data/rules/ai-bom.yaml +268 -0
  45. package/data/rules/ai-oversight.yaml +186 -0
  46. package/data/rules/ai-provenance.yaml +92 -0
  47. package/data/rules/asar-archives.yaml +150 -0
  48. package/data/rules/cbom-security.yaml +165 -0
  49. package/data/rules/chrome-extensions.yaml +248 -0
  50. package/data/rules/ci-permissions.yaml +802 -0
  51. package/data/rules/container-risk.yaml +353 -0
  52. package/data/rules/dependency-sources.yaml +236 -0
  53. package/data/rules/golem-go.yaml +229 -0
  54. package/data/rules/hbom-compliance.yaml +325 -0
  55. package/data/rules/hbom-performance.yaml +307 -0
  56. package/data/rules/hbom-security.yaml +248 -0
  57. package/data/rules/host-topology.yaml +165 -0
  58. package/data/rules/mcp-servers.yaml +388 -0
  59. package/data/rules/obom-runtime.yaml +1776 -0
  60. package/data/rules/package-integrity.yaml +364 -0
  61. package/data/rules/rootfs-hardening.yaml +179 -0
  62. package/data/rules/vscode-extensions.yaml +237 -0
  63. package/data/spdx-export.schema.json +6794 -0
  64. package/data/spdx-license-list.json +7449 -0
  65. package/data/spdx-licenses.json +759 -0
  66. package/data/spdx.schema.json +819 -0
  67. package/data/templates/README.md +3 -0
  68. package/data/templates/asvs-4.0.3.cdx.json +2943 -0
  69. package/data/templates/asvs-5.0.cdx.json +3046 -0
  70. package/data/templates/bsimm-v13.cdx.json +1008 -0
  71. package/data/templates/masvs-2.0.0.cdx.json +225 -0
  72. package/data/templates/nist-ssdf-1.1.cdx.json +828 -0
  73. package/data/templates/pcissc-secure-slc-1.1.cdx.json +1027 -0
  74. package/data/templates/scvs-1.0.0.cdx.json +813 -0
  75. package/data/templates/ssaf-DRAFT-2023-11.cdx.json +127 -0
  76. package/data/vendor-alias.json +41967 -0
  77. package/data/wrapdb-releases.json +4227 -0
  78. package/index.cjs +15 -0
  79. package/lib/audit/index.js +2800 -0
  80. package/lib/audit/progress.js +114 -0
  81. package/lib/audit/reporters.js +937 -0
  82. package/lib/audit/scoring.js +560 -0
  83. package/lib/audit/targets.js +798 -0
  84. package/lib/cli/bomAssembly.js +1882 -0
  85. package/lib/cli/cliOptions.js +543 -0
  86. package/lib/cli/index.js +2759 -0
  87. package/lib/cli/jsBom.js +2087 -0
  88. package/lib/cli/jvmBom.js +1858 -0
  89. package/lib/cli/managedBom.js +2083 -0
  90. package/lib/cli/nativeBom.js +2125 -0
  91. package/lib/core/activity.js +1087 -0
  92. package/lib/core/env.js +719 -0
  93. package/lib/core/fs.js +1058 -0
  94. package/lib/core/httpClient.js +730 -0
  95. package/lib/core/logger.js +280 -0
  96. package/lib/core/parallel.js +323 -0
  97. package/lib/core/paths.js +70 -0
  98. package/lib/core/projectConfig.js +122 -0
  99. package/lib/core/propertySanitizer.js +174 -0
  100. package/lib/core/spdx.js +5 -0
  101. package/lib/core/state.js +59 -0
  102. package/lib/core/text.js +207 -0
  103. package/lib/core/ui.js +920 -0
  104. package/lib/core/urls.js +84 -0
  105. package/lib/ecosystems/asarutils.js +1636 -0
  106. package/lib/ecosystems/bunutils.js +402 -0
  107. package/lib/ecosystems/caxa.js +77 -0
  108. package/lib/ecosystems/chromextutils.js +1174 -0
  109. package/lib/ecosystems/cmakeResolver.js +587 -0
  110. package/lib/ecosystems/cppEvidence.js +305 -0
  111. package/lib/ecosystems/denoutils.js +1094 -0
  112. package/lib/ecosystems/dotnetutils.js +132 -0
  113. package/lib/ecosystems/ecosystems.js +2772 -0
  114. package/lib/ecosystems/golem.js +1807 -0
  115. package/lib/ecosystems/gradleutils.js +1048 -0
  116. package/lib/ecosystems/jsEvidence.js +317 -0
  117. package/lib/ecosystems/npmutils.js +586 -0
  118. package/lib/ecosystems/parsers-bazel.js +875 -0
  119. package/lib/ecosystems/parsers-dotnet.js +1430 -0
  120. package/lib/ecosystems/parsers-gleam.js +302 -0
  121. package/lib/ecosystems/parsers-go.js +818 -0
  122. package/lib/ecosystems/parsers-js.js +4222 -0
  123. package/lib/ecosystems/parsers-jvm.js +948 -0
  124. package/lib/ecosystems/parsers-misc.js +3191 -0
  125. package/lib/ecosystems/parsers-python.js +2070 -0
  126. package/lib/ecosystems/parsers-rust.js +1294 -0
  127. package/lib/ecosystems/parsers-zig.js +861 -0
  128. package/lib/ecosystems/pep770.js +341 -0
  129. package/lib/ecosystems/pylockutils.js +427 -0
  130. package/lib/ecosystems/pythonutils.js +1281 -0
  131. package/lib/ecosystems/registryProvenance.js +1003 -0
  132. package/lib/ecosystems/remote/huggingface.js +1343 -0
  133. package/lib/ecosystems/rubyutils.js +1629 -0
  134. package/lib/ecosystems/rusi.js +820 -0
  135. package/lib/ecosystems/sbtutils.js +972 -0
  136. package/lib/ecosystems/tea.js +607 -0
  137. package/lib/ecosystems/utils.js +583 -0
  138. package/lib/ecosystems/zigResolver.js +410 -0
  139. package/lib/evinser/db.js +145 -0
  140. package/lib/evinser/evinser.js +2362 -0
  141. package/lib/evinser/scalasem.js +65 -0
  142. package/lib/evinser/swiftsem.js +767 -0
  143. package/lib/helpers/annotationFormatter.js +84 -0
  144. package/lib/helpers/bomSigner.js +312 -0
  145. package/lib/helpers/exportUtils.js +160 -0
  146. package/lib/helpers/remote/dependency-track.js +117 -0
  147. package/lib/helpers/versutils.js +202 -0
  148. package/lib/helpers/vsixutils.js +1069 -0
  149. package/lib/inventory/agentFormulationParser.js +322 -0
  150. package/lib/inventory/aiCollector.js +2140 -0
  151. package/lib/inventory/aiInventory.js +414 -0
  152. package/lib/inventory/aiModelVariants.js +121 -0
  153. package/lib/inventory/aiOversightCollector.js +661 -0
  154. package/lib/inventory/aiProvenanceCollector.js +822 -0
  155. package/lib/inventory/analyzer.js +6089 -0
  156. package/lib/inventory/analyzerScope.js +807 -0
  157. package/lib/inventory/astWorker.js +20 -0
  158. package/lib/inventory/atomUtils.js +1092 -0
  159. package/lib/inventory/auditCategories.js +192 -0
  160. package/lib/inventory/bomUtils.js +369 -0
  161. package/lib/inventory/cacheCommands.js +182 -0
  162. package/lib/inventory/cacheDir.js +104 -0
  163. package/lib/inventory/cbomutils.js +590 -0
  164. package/lib/inventory/cdxrs.js +434 -0
  165. package/lib/inventory/ciParsers/azurePipelines.js +295 -0
  166. package/lib/inventory/ciParsers/circleCi.js +286 -0
  167. package/lib/inventory/ciParsers/common.js +24 -0
  168. package/lib/inventory/ciParsers/githubActions.js +2434 -0
  169. package/lib/inventory/ciParsers/gitlabCi.js +213 -0
  170. package/lib/inventory/ciParsers/jenkins.js +180 -0
  171. package/lib/inventory/citations.js +234 -0
  172. package/lib/inventory/communityAiConfigParser.js +756 -0
  173. package/lib/inventory/containerRisk.js +204 -0
  174. package/lib/inventory/cryptoAlgorithmFamily.js +258 -0
  175. package/lib/inventory/deps.js +807 -0
  176. package/lib/inventory/depsUtils.js +588 -0
  177. package/lib/inventory/display.js +2128 -0
  178. package/lib/inventory/dosai.js +601 -0
  179. package/lib/inventory/dosaiParsers.js +154 -0
  180. package/lib/inventory/dynamic.js +145 -0
  181. package/lib/inventory/envcontext.js +1793 -0
  182. package/lib/inventory/evidenceUtils.js +774 -0
  183. package/lib/inventory/fetchBatch.js +779 -0
  184. package/lib/inventory/fetchRate.js +255 -0
  185. package/lib/inventory/forgeEnricher.js +300 -0
  186. package/lib/inventory/formulationParsers.js +422 -0
  187. package/lib/inventory/gtfobins.js +339 -0
  188. package/lib/inventory/hbom.js +719 -0
  189. package/lib/inventory/hbomAnalysis.js +310 -0
  190. package/lib/inventory/hbomLoader.js +35 -0
  191. package/lib/inventory/hostTopology.js +835 -0
  192. package/lib/inventory/inventoryStats.js +100 -0
  193. package/lib/inventory/jsonLike.js +121 -0
  194. package/lib/inventory/licenseEnhancer.js +918 -0
  195. package/lib/inventory/lolbas.js +285 -0
  196. package/lib/inventory/mcp.js +253 -0
  197. package/lib/inventory/mcpConfigParser.js +683 -0
  198. package/lib/inventory/mcpDiscovery.js +112 -0
  199. package/lib/inventory/mcpPinning.js +209 -0
  200. package/lib/inventory/osPackageResolver.js +493 -0
  201. package/lib/inventory/osinfo.js +383 -0
  202. package/lib/inventory/osqueryTransform.js +274 -0
  203. package/lib/inventory/plugins.js +466 -0
  204. package/lib/inventory/protobom.js +231 -0
  205. package/lib/inventory/protobomLoader.js +43 -0
  206. package/lib/inventory/provenanceUtils.js +224 -0
  207. package/lib/inventory/purl.js +749 -0
  208. package/lib/inventory/rustFormulationParser.js +339 -0
  209. package/lib/inventory/sbomDocument.js +340 -0
  210. package/lib/inventory/source.js +1488 -0
  211. package/lib/inventory/spdx.js +361 -0
  212. package/lib/inventory/spdxExpression.js +512 -0
  213. package/lib/inventory/spdxUtils.js +107 -0
  214. package/lib/inventory/table.js +267 -0
  215. package/lib/inventory/traceRunner.js +439 -0
  216. package/lib/inventory/unicodeScan.js +147 -0
  217. package/lib/managers/binary.js +3459 -0
  218. package/lib/managers/containerutils.js +125 -0
  219. package/lib/managers/docker.js +2145 -0
  220. package/lib/managers/dockerConnection.js +162 -0
  221. package/lib/managers/oci.js +704 -0
  222. package/lib/managers/piptree.js +267 -0
  223. package/lib/parsers/cmakeCache.js +199 -0
  224. package/lib/parsers/gguf.js +492 -0
  225. package/lib/parsers/gitAiNotes.js +233 -0
  226. package/lib/parsers/gitmodules.js +239 -0
  227. package/lib/parsers/htmlExtract.js +610 -0
  228. package/lib/parsers/huggingfaceManifest.js +551 -0
  229. package/lib/parsers/huggingfaceUtils.js +506 -0
  230. package/lib/parsers/iri.js +618 -0
  231. package/lib/parsers/npmrc.js +99 -0
  232. package/lib/parsers/ollama.js +101 -0
  233. package/lib/parsers/xml.js +841 -0
  234. package/lib/server/openapi.yaml +433 -0
  235. package/lib/server/server.js +616 -0
  236. package/lib/stages/postgen/annotator.js +977 -0
  237. package/lib/stages/postgen/auditBom.js +468 -0
  238. package/lib/stages/postgen/postgen.js +1239 -0
  239. package/lib/stages/postgen/ruleEngine.js +731 -0
  240. package/lib/stages/postgen/sortBom.js +195 -0
  241. package/lib/stages/postgen/spdxConverter.js +796 -0
  242. package/lib/stages/postgen/specVersionCompat.js +703 -0
  243. package/lib/stages/pregen/envAudit.js +388 -0
  244. package/lib/stages/pregen/pregen.js +637 -0
  245. package/lib/third-party/README.md +9 -0
  246. package/lib/third-party/arborist/CHANGELOG.md +1109 -0
  247. package/lib/third-party/arborist/LICENSE.md +20 -0
  248. package/lib/third-party/arborist/README.md +315 -0
  249. package/lib/third-party/arborist/lib/arborist/index.js +258 -0
  250. package/lib/third-party/arborist/lib/arborist/load-actual.js +605 -0
  251. package/lib/third-party/arborist/lib/arborist/load-virtual.js +300 -0
  252. package/lib/third-party/arborist/lib/bin-links.js +120 -0
  253. package/lib/third-party/arborist/lib/calc-dep-flags.js +130 -0
  254. package/lib/third-party/arborist/lib/case-insensitive-map.js +51 -0
  255. package/lib/third-party/arborist/lib/consistent-resolve.js +42 -0
  256. package/lib/third-party/arborist/lib/debug.js +50 -0
  257. package/lib/third-party/arborist/lib/dep-valid.js +190 -0
  258. package/lib/third-party/arborist/lib/edge.js +417 -0
  259. package/lib/third-party/arborist/lib/from-path.js +36 -0
  260. package/lib/third-party/arborist/lib/gather-dep-set.js +43 -0
  261. package/lib/third-party/arborist/lib/index.js +22 -0
  262. package/lib/third-party/arborist/lib/inventory.js +138 -0
  263. package/lib/third-party/arborist/lib/link.js +169 -0
  264. package/lib/third-party/arborist/lib/node.js +1673 -0
  265. package/lib/third-party/arborist/lib/npm-extension.js +45 -0
  266. package/lib/third-party/arborist/lib/override-resolves.js +11 -0
  267. package/lib/third-party/arborist/lib/override-set.js +319 -0
  268. package/lib/third-party/arborist/lib/package-extensions.js +289 -0
  269. package/lib/third-party/arborist/lib/printable.js +210 -0
  270. package/lib/third-party/arborist/lib/proc-log.js +30 -0
  271. package/lib/third-party/arborist/lib/realpath.js +100 -0
  272. package/lib/third-party/arborist/lib/relpath.js +4 -0
  273. package/lib/third-party/arborist/lib/shrinkwrap.js +1291 -0
  274. package/lib/third-party/arborist/lib/spec-from-lock.js +34 -0
  275. package/lib/third-party/arborist/lib/tree-check.js +165 -0
  276. package/lib/third-party/arborist/lib/validate-npm-package-name.js +107 -0
  277. package/lib/third-party/arborist/lib/version-from-tgz.js +51 -0
  278. package/lib/third-party/arborist/lib/yarn-lock.js +397 -0
  279. package/lib/validator/bomValidator.js +985 -0
  280. package/lib/validator/complianceEngine.js +241 -0
  281. package/lib/validator/complianceRules.js +1680 -0
  282. package/lib/validator/generated/runtime.mjs +17 -0
  283. package/lib/validator/generated/validate-1.6.mjs +21258 -0
  284. package/lib/validator/generated/validate-1.7.mjs +24803 -0
  285. package/lib/validator/generated/validate-2.0.mjs +22931 -0
  286. package/lib/validator/index.js +246 -0
  287. package/lib/validator/reporters/annotations.js +142 -0
  288. package/lib/validator/reporters/console.js +160 -0
  289. package/lib/validator/reporters/index.js +41 -0
  290. package/lib/validator/reporters/json.js +37 -0
  291. package/lib/validator/reporters/sarif.js +184 -0
  292. package/package.json +209 -26
  293. package/types/bin/audit.d.ts +3 -0
  294. package/types/bin/audit.d.ts.map +1 -0
  295. package/types/bin/cdxgen.d.ts +3 -0
  296. package/types/bin/cdxgen.d.ts.map +1 -0
  297. package/types/bin/convert.d.ts +3 -0
  298. package/types/bin/convert.d.ts.map +1 -0
  299. package/types/bin/evinse.d.ts +3 -0
  300. package/types/bin/evinse.d.ts.map +1 -0
  301. package/types/bin/hbom.d.ts +3 -0
  302. package/types/bin/hbom.d.ts.map +1 -0
  303. package/types/bin/repl.d.ts +3 -0
  304. package/types/bin/repl.d.ts.map +1 -0
  305. package/types/bin/sign.d.ts +3 -0
  306. package/types/bin/sign.d.ts.map +1 -0
  307. package/types/bin/tracebom.d.ts +3 -0
  308. package/types/bin/tracebom.d.ts.map +1 -0
  309. package/types/bin/validate.d.ts +14 -0
  310. package/types/bin/validate.d.ts.map +1 -0
  311. package/types/bin/verify.d.ts +3 -0
  312. package/types/bin/verify.d.ts.map +1 -0
  313. package/types/lib/audit/index.d.ts +153 -0
  314. package/types/lib/audit/index.d.ts.map +1 -0
  315. package/types/lib/audit/progress.d.ts +31 -0
  316. package/types/lib/audit/progress.d.ts.map +1 -0
  317. package/types/lib/audit/reporters.d.ts +62 -0
  318. package/types/lib/audit/reporters.d.ts.map +1 -0
  319. package/types/lib/audit/scoring.d.ts +36 -0
  320. package/types/lib/audit/scoring.d.ts.map +1 -0
  321. package/types/lib/audit/targets.d.ts +77 -0
  322. package/types/lib/audit/targets.d.ts.map +1 -0
  323. package/types/lib/cli/bomAssembly.d.ts +329 -0
  324. package/types/lib/cli/bomAssembly.d.ts.map +1 -0
  325. package/types/lib/cli/cliOptions.d.ts +156 -0
  326. package/types/lib/cli/cliOptions.d.ts.map +1 -0
  327. package/types/lib/cli/index.d.ts +107 -0
  328. package/types/lib/cli/index.d.ts.map +1 -0
  329. package/types/lib/cli/jsBom.d.ts +94 -0
  330. package/types/lib/cli/jsBom.d.ts.map +1 -0
  331. package/types/lib/cli/jvmBom.d.ts +54 -0
  332. package/types/lib/cli/jvmBom.d.ts.map +1 -0
  333. package/types/lib/cli/managedBom.d.ts +105 -0
  334. package/types/lib/cli/managedBom.d.ts.map +1 -0
  335. package/types/lib/cli/nativeBom.d.ts +143 -0
  336. package/types/lib/cli/nativeBom.d.ts.map +1 -0
  337. package/types/lib/core/activity.d.ts +178 -0
  338. package/types/lib/core/activity.d.ts.map +1 -0
  339. package/types/lib/core/env.d.ts +192 -0
  340. package/types/lib/core/env.d.ts.map +1 -0
  341. package/types/lib/core/fs.d.ts +158 -0
  342. package/types/lib/core/fs.d.ts.map +1 -0
  343. package/types/lib/core/httpClient.d.ts +149 -0
  344. package/types/lib/core/httpClient.d.ts.map +1 -0
  345. package/types/lib/core/logger.d.ts +50 -0
  346. package/types/lib/core/logger.d.ts.map +1 -0
  347. package/types/lib/core/parallel.d.ts +95 -0
  348. package/types/lib/core/parallel.d.ts.map +1 -0
  349. package/types/lib/core/paths.d.ts +36 -0
  350. package/types/lib/core/paths.d.ts.map +1 -0
  351. package/types/lib/core/projectConfig.d.ts +23 -0
  352. package/types/lib/core/projectConfig.d.ts.map +1 -0
  353. package/types/lib/core/propertySanitizer.d.ts +23 -0
  354. package/types/lib/core/propertySanitizer.d.ts.map +1 -0
  355. package/types/lib/core/spdx.d.ts +5 -0
  356. package/types/lib/core/spdx.d.ts.map +1 -0
  357. package/types/lib/core/state.d.ts +20 -0
  358. package/types/lib/core/state.d.ts.map +1 -0
  359. package/types/lib/core/text.d.ts +78 -0
  360. package/types/lib/core/text.d.ts.map +1 -0
  361. package/types/lib/core/ui.d.ts +87 -0
  362. package/types/lib/core/ui.d.ts.map +1 -0
  363. package/types/lib/core/urls.d.ts +43 -0
  364. package/types/lib/core/urls.d.ts.map +1 -0
  365. package/types/lib/ecosystems/asarutils.d.ts +71 -0
  366. package/types/lib/ecosystems/asarutils.d.ts.map +1 -0
  367. package/types/lib/ecosystems/bunutils.d.ts +38 -0
  368. package/types/lib/ecosystems/bunutils.d.ts.map +1 -0
  369. package/types/lib/ecosystems/caxa.d.ts +8 -0
  370. package/types/lib/ecosystems/caxa.d.ts.map +1 -0
  371. package/types/lib/ecosystems/chromextutils.d.ts +97 -0
  372. package/types/lib/ecosystems/chromextutils.d.ts.map +1 -0
  373. package/types/lib/ecosystems/cmakeResolver.d.ts +176 -0
  374. package/types/lib/ecosystems/cmakeResolver.d.ts.map +1 -0
  375. package/types/lib/ecosystems/cppEvidence.d.ts +35 -0
  376. package/types/lib/ecosystems/cppEvidence.d.ts.map +1 -0
  377. package/types/lib/ecosystems/denoutils.d.ts +76 -0
  378. package/types/lib/ecosystems/denoutils.d.ts.map +1 -0
  379. package/types/lib/ecosystems/dotnetutils.d.ts +45 -0
  380. package/types/lib/ecosystems/dotnetutils.d.ts.map +1 -0
  381. package/types/lib/ecosystems/ecosystems.d.ts +279 -0
  382. package/types/lib/ecosystems/ecosystems.d.ts.map +1 -0
  383. package/types/lib/ecosystems/golem.d.ts +60 -0
  384. package/types/lib/ecosystems/golem.d.ts.map +1 -0
  385. package/types/lib/ecosystems/gradleutils.d.ts +139 -0
  386. package/types/lib/ecosystems/gradleutils.d.ts.map +1 -0
  387. package/types/lib/ecosystems/jsEvidence.d.ts +17 -0
  388. package/types/lib/ecosystems/jsEvidence.d.ts.map +1 -0
  389. package/types/lib/ecosystems/npmutils.d.ts +183 -0
  390. package/types/lib/ecosystems/npmutils.d.ts.map +1 -0
  391. package/types/lib/ecosystems/parsers-bazel.d.ts +36 -0
  392. package/types/lib/ecosystems/parsers-bazel.d.ts.map +1 -0
  393. package/types/lib/ecosystems/parsers-dotnet.d.ts +116 -0
  394. package/types/lib/ecosystems/parsers-dotnet.d.ts.map +1 -0
  395. package/types/lib/ecosystems/parsers-gleam.d.ts +33 -0
  396. package/types/lib/ecosystems/parsers-gleam.d.ts.map +1 -0
  397. package/types/lib/ecosystems/parsers-go.d.ts +92 -0
  398. package/types/lib/ecosystems/parsers-go.d.ts.map +1 -0
  399. package/types/lib/ecosystems/parsers-js.d.ts +242 -0
  400. package/types/lib/ecosystems/parsers-js.d.ts.map +1 -0
  401. package/types/lib/ecosystems/parsers-jvm.d.ts +100 -0
  402. package/types/lib/ecosystems/parsers-jvm.d.ts.map +1 -0
  403. package/types/lib/ecosystems/parsers-misc.d.ts +450 -0
  404. package/types/lib/ecosystems/parsers-misc.d.ts.map +1 -0
  405. package/types/lib/ecosystems/parsers-python.d.ts +145 -0
  406. package/types/lib/ecosystems/parsers-python.d.ts.map +1 -0
  407. package/types/lib/ecosystems/parsers-rust.d.ts +56 -0
  408. package/types/lib/ecosystems/parsers-rust.d.ts.map +1 -0
  409. package/types/lib/ecosystems/parsers-zig.d.ts +83 -0
  410. package/types/lib/ecosystems/parsers-zig.d.ts.map +1 -0
  411. package/types/lib/ecosystems/pep770.d.ts +38 -0
  412. package/types/lib/ecosystems/pep770.d.ts.map +1 -0
  413. package/types/lib/ecosystems/pylockutils.d.ts +68 -0
  414. package/types/lib/ecosystems/pylockutils.d.ts.map +1 -0
  415. package/types/lib/ecosystems/pythonutils.d.ts +70 -0
  416. package/types/lib/ecosystems/pythonutils.d.ts.map +1 -0
  417. package/types/lib/ecosystems/registryProvenance.d.ts +26 -0
  418. package/types/lib/ecosystems/registryProvenance.d.ts.map +1 -0
  419. package/types/lib/ecosystems/remote/huggingface.d.ts +31 -0
  420. package/types/lib/ecosystems/remote/huggingface.d.ts.map +1 -0
  421. package/types/lib/ecosystems/rubyutils.d.ts +182 -0
  422. package/types/lib/ecosystems/rubyutils.d.ts.map +1 -0
  423. package/types/lib/ecosystems/rusi.d.ts +40 -0
  424. package/types/lib/ecosystems/rusi.d.ts.map +1 -0
  425. package/types/lib/ecosystems/sbtutils.d.ts +179 -0
  426. package/types/lib/ecosystems/sbtutils.d.ts.map +1 -0
  427. package/types/lib/ecosystems/tea.d.ts +180 -0
  428. package/types/lib/ecosystems/tea.d.ts.map +1 -0
  429. package/types/lib/ecosystems/utils.d.ts +41 -0
  430. package/types/lib/ecosystems/utils.d.ts.map +1 -0
  431. package/types/lib/ecosystems/zigResolver.d.ts +70 -0
  432. package/types/lib/ecosystems/zigResolver.d.ts.map +1 -0
  433. package/types/lib/evinser/db.d.ts +17 -0
  434. package/types/lib/evinser/db.d.ts.map +1 -0
  435. package/types/lib/evinser/evinser.d.ts +354 -0
  436. package/types/lib/evinser/evinser.d.ts.map +1 -0
  437. package/types/lib/evinser/scalasem.d.ts +15 -0
  438. package/types/lib/evinser/scalasem.d.ts.map +1 -0
  439. package/types/lib/evinser/swiftsem.d.ts +103 -0
  440. package/types/lib/evinser/swiftsem.d.ts.map +1 -0
  441. package/types/lib/helpers/annotationFormatter.d.ts +23 -0
  442. package/types/lib/helpers/annotationFormatter.d.ts.map +1 -0
  443. package/types/lib/helpers/bomSigner.d.ts +28 -0
  444. package/types/lib/helpers/bomSigner.d.ts.map +1 -0
  445. package/types/lib/helpers/exportUtils.d.ts +52 -0
  446. package/types/lib/helpers/exportUtils.d.ts.map +1 -0
  447. package/types/lib/helpers/remote/dependency-track.d.ts +23 -0
  448. package/types/lib/helpers/remote/dependency-track.d.ts.map +1 -0
  449. package/types/lib/helpers/versutils.d.ts +8 -0
  450. package/types/lib/helpers/versutils.d.ts.map +1 -0
  451. package/types/lib/helpers/vsixutils.d.ts +130 -0
  452. package/types/lib/helpers/vsixutils.d.ts.map +1 -0
  453. package/types/lib/inventory/agentFormulationParser.d.ts +21 -0
  454. package/types/lib/inventory/agentFormulationParser.d.ts.map +1 -0
  455. package/types/lib/inventory/aiCollector.d.ts +61 -0
  456. package/types/lib/inventory/aiCollector.d.ts.map +1 -0
  457. package/types/lib/inventory/aiInventory.d.ts +103 -0
  458. package/types/lib/inventory/aiInventory.d.ts.map +1 -0
  459. package/types/lib/inventory/aiModelVariants.d.ts +31 -0
  460. package/types/lib/inventory/aiModelVariants.d.ts.map +1 -0
  461. package/types/lib/inventory/aiOversightCollector.d.ts +28 -0
  462. package/types/lib/inventory/aiOversightCollector.d.ts.map +1 -0
  463. package/types/lib/inventory/aiProvenanceCollector.d.ts +13 -0
  464. package/types/lib/inventory/aiProvenanceCollector.d.ts.map +1 -0
  465. package/types/lib/inventory/analyzer.d.ts +157 -0
  466. package/types/lib/inventory/analyzer.d.ts.map +1 -0
  467. package/types/lib/inventory/analyzerScope.d.ts +106 -0
  468. package/types/lib/inventory/analyzerScope.d.ts.map +1 -0
  469. package/types/lib/inventory/astWorker.d.ts +9 -0
  470. package/types/lib/inventory/astWorker.d.ts.map +1 -0
  471. package/types/lib/inventory/atomUtils.d.ts +159 -0
  472. package/types/lib/inventory/atomUtils.d.ts.map +1 -0
  473. package/types/lib/inventory/auditCategories.d.ts +80 -0
  474. package/types/lib/inventory/auditCategories.d.ts.map +1 -0
  475. package/types/lib/inventory/bomUtils.d.ts +145 -0
  476. package/types/lib/inventory/bomUtils.d.ts.map +1 -0
  477. package/types/lib/inventory/cacheCommands.d.ts +28 -0
  478. package/types/lib/inventory/cacheCommands.d.ts.map +1 -0
  479. package/types/lib/inventory/cacheDir.d.ts +55 -0
  480. package/types/lib/inventory/cacheDir.d.ts.map +1 -0
  481. package/types/lib/inventory/cbomutils.d.ts +37 -0
  482. package/types/lib/inventory/cbomutils.d.ts.map +1 -0
  483. package/types/lib/inventory/cdxrs.d.ts +90 -0
  484. package/types/lib/inventory/cdxrs.d.ts.map +1 -0
  485. package/types/lib/inventory/ciParsers/azurePipelines.d.ts +27 -0
  486. package/types/lib/inventory/ciParsers/azurePipelines.d.ts.map +1 -0
  487. package/types/lib/inventory/ciParsers/circleCi.d.ts +27 -0
  488. package/types/lib/inventory/ciParsers/circleCi.d.ts.map +1 -0
  489. package/types/lib/inventory/ciParsers/common.d.ts +11 -0
  490. package/types/lib/inventory/ciParsers/common.d.ts.map +1 -0
  491. package/types/lib/inventory/ciParsers/githubActions.d.ts +38 -0
  492. package/types/lib/inventory/ciParsers/githubActions.d.ts.map +1 -0
  493. package/types/lib/inventory/ciParsers/gitlabCi.d.ts +26 -0
  494. package/types/lib/inventory/ciParsers/gitlabCi.d.ts.map +1 -0
  495. package/types/lib/inventory/ciParsers/jenkins.d.ts +26 -0
  496. package/types/lib/inventory/ciParsers/jenkins.d.ts.map +1 -0
  497. package/types/lib/inventory/citations.d.ts +90 -0
  498. package/types/lib/inventory/citations.d.ts.map +1 -0
  499. package/types/lib/inventory/communityAiConfigParser.d.ts +14 -0
  500. package/types/lib/inventory/communityAiConfigParser.d.ts.map +1 -0
  501. package/types/lib/inventory/containerRisk.d.ts +20 -0
  502. package/types/lib/inventory/containerRisk.d.ts.map +1 -0
  503. package/types/lib/inventory/cryptoAlgorithmFamily.d.ts +37 -0
  504. package/types/lib/inventory/cryptoAlgorithmFamily.d.ts.map +1 -0
  505. package/types/lib/inventory/deps.d.ts +140 -0
  506. package/types/lib/inventory/deps.d.ts.map +1 -0
  507. package/types/lib/inventory/depsUtils.d.ts +74 -0
  508. package/types/lib/inventory/depsUtils.d.ts.map +1 -0
  509. package/types/lib/inventory/display.d.ts +227 -0
  510. package/types/lib/inventory/display.d.ts.map +1 -0
  511. package/types/lib/inventory/dosai.d.ts +130 -0
  512. package/types/lib/inventory/dosai.d.ts.map +1 -0
  513. package/types/lib/inventory/dosaiParsers.d.ts +59 -0
  514. package/types/lib/inventory/dosaiParsers.d.ts.map +1 -0
  515. package/types/lib/inventory/dynamic.d.ts +25 -0
  516. package/types/lib/inventory/dynamic.d.ts.map +1 -0
  517. package/types/lib/inventory/envcontext.d.ts +377 -0
  518. package/types/lib/inventory/envcontext.d.ts.map +1 -0
  519. package/types/lib/inventory/evidenceUtils.d.ts +74 -0
  520. package/types/lib/inventory/evidenceUtils.d.ts.map +1 -0
  521. package/types/lib/inventory/fetchBatch.d.ts +127 -0
  522. package/types/lib/inventory/fetchBatch.d.ts.map +1 -0
  523. package/types/lib/inventory/fetchRate.d.ts +118 -0
  524. package/types/lib/inventory/fetchRate.d.ts.map +1 -0
  525. package/types/lib/inventory/forgeEnricher.d.ts +31 -0
  526. package/types/lib/inventory/forgeEnricher.d.ts.map +1 -0
  527. package/types/lib/inventory/formulationParsers.d.ts +50 -0
  528. package/types/lib/inventory/formulationParsers.d.ts.map +1 -0
  529. package/types/lib/inventory/gtfobins.d.ts +27 -0
  530. package/types/lib/inventory/gtfobins.d.ts.map +1 -0
  531. package/types/lib/inventory/hbom.d.ts +58 -0
  532. package/types/lib/inventory/hbom.d.ts.map +1 -0
  533. package/types/lib/inventory/hbomAnalysis.d.ts +56 -0
  534. package/types/lib/inventory/hbomAnalysis.d.ts.map +1 -0
  535. package/types/lib/inventory/hbomLoader.d.ts +7 -0
  536. package/types/lib/inventory/hbomLoader.d.ts.map +1 -0
  537. package/types/lib/inventory/hostTopology.d.ts +47 -0
  538. package/types/lib/inventory/hostTopology.d.ts.map +1 -0
  539. package/types/lib/inventory/inventoryStats.d.ts +42 -0
  540. package/types/lib/inventory/inventoryStats.d.ts.map +1 -0
  541. package/types/lib/inventory/jsonLike.d.ts +23 -0
  542. package/types/lib/inventory/jsonLike.d.ts.map +1 -0
  543. package/types/lib/inventory/licenseEnhancer.d.ts +70 -0
  544. package/types/lib/inventory/licenseEnhancer.d.ts.map +1 -0
  545. package/types/lib/inventory/lolbas.d.ts +16 -0
  546. package/types/lib/inventory/lolbas.d.ts.map +1 -0
  547. package/types/lib/inventory/mcp.d.ts +29 -0
  548. package/types/lib/inventory/mcp.d.ts.map +1 -0
  549. package/types/lib/inventory/mcpConfigParser.d.ts +20 -0
  550. package/types/lib/inventory/mcpConfigParser.d.ts.map +1 -0
  551. package/types/lib/inventory/mcpDiscovery.d.ts +33 -0
  552. package/types/lib/inventory/mcpDiscovery.d.ts.map +1 -0
  553. package/types/lib/inventory/mcpPinning.d.ts +11 -0
  554. package/types/lib/inventory/mcpPinning.d.ts.map +1 -0
  555. package/types/lib/inventory/osPackageResolver.d.ts +49 -0
  556. package/types/lib/inventory/osPackageResolver.d.ts.map +1 -0
  557. package/types/lib/inventory/osinfo.d.ts +201 -0
  558. package/types/lib/inventory/osinfo.d.ts.map +1 -0
  559. package/types/lib/inventory/osqueryTransform.d.ts +84 -0
  560. package/types/lib/inventory/osqueryTransform.d.ts.map +1 -0
  561. package/types/lib/inventory/plugins.d.ts +58 -0
  562. package/types/lib/inventory/plugins.d.ts.map +1 -0
  563. package/types/lib/inventory/protobom.d.ts +71 -0
  564. package/types/lib/inventory/protobom.d.ts.map +1 -0
  565. package/types/lib/inventory/protobomLoader.d.ts +17 -0
  566. package/types/lib/inventory/protobomLoader.d.ts.map +1 -0
  567. package/types/lib/inventory/provenanceUtils.d.ts +98 -0
  568. package/types/lib/inventory/provenanceUtils.d.ts.map +1 -0
  569. package/types/lib/inventory/purl.d.ts +313 -0
  570. package/types/lib/inventory/purl.d.ts.map +1 -0
  571. package/types/lib/inventory/rustFormulationParser.d.ts +17 -0
  572. package/types/lib/inventory/rustFormulationParser.d.ts.map +1 -0
  573. package/types/lib/inventory/sbomDocument.d.ts +59 -0
  574. package/types/lib/inventory/sbomDocument.d.ts.map +1 -0
  575. package/types/lib/inventory/source.d.ts +163 -0
  576. package/types/lib/inventory/source.d.ts.map +1 -0
  577. package/types/lib/inventory/spdx.d.ts +66 -0
  578. package/types/lib/inventory/spdx.d.ts.map +1 -0
  579. package/types/lib/inventory/spdxExpression.d.ts +58 -0
  580. package/types/lib/inventory/spdxExpression.d.ts.map +1 -0
  581. package/types/lib/inventory/spdxUtils.d.ts +12 -0
  582. package/types/lib/inventory/spdxUtils.d.ts.map +1 -0
  583. package/types/lib/inventory/table.d.ts +22 -0
  584. package/types/lib/inventory/table.d.ts.map +1 -0
  585. package/types/lib/inventory/traceRunner.d.ts +80 -0
  586. package/types/lib/inventory/traceRunner.d.ts.map +1 -0
  587. package/types/lib/inventory/unicodeScan.d.ts +46 -0
  588. package/types/lib/inventory/unicodeScan.d.ts.map +1 -0
  589. package/types/lib/managers/binary.d.ts +147 -0
  590. package/types/lib/managers/binary.d.ts.map +1 -0
  591. package/types/lib/managers/containerutils.d.ts +30 -0
  592. package/types/lib/managers/containerutils.d.ts.map +1 -0
  593. package/types/lib/managers/docker.d.ts +157 -0
  594. package/types/lib/managers/docker.d.ts.map +1 -0
  595. package/types/lib/managers/dockerConnection.d.ts +42 -0
  596. package/types/lib/managers/dockerConnection.d.ts.map +1 -0
  597. package/types/lib/managers/oci.d.ts +21 -0
  598. package/types/lib/managers/oci.d.ts.map +1 -0
  599. package/types/lib/managers/piptree.d.ts +13 -0
  600. package/types/lib/managers/piptree.d.ts.map +1 -0
  601. package/types/lib/parsers/cmakeCache.d.ts +70 -0
  602. package/types/lib/parsers/cmakeCache.d.ts.map +1 -0
  603. package/types/lib/parsers/gguf.d.ts +39 -0
  604. package/types/lib/parsers/gguf.d.ts.map +1 -0
  605. package/types/lib/parsers/gitAiNotes.d.ts +15 -0
  606. package/types/lib/parsers/gitAiNotes.d.ts.map +1 -0
  607. package/types/lib/parsers/gitmodules.d.ts +88 -0
  608. package/types/lib/parsers/gitmodules.d.ts.map +1 -0
  609. package/types/lib/parsers/htmlExtract.d.ts +34 -0
  610. package/types/lib/parsers/htmlExtract.d.ts.map +1 -0
  611. package/types/lib/parsers/huggingfaceManifest.d.ts +153 -0
  612. package/types/lib/parsers/huggingfaceManifest.d.ts.map +1 -0
  613. package/types/lib/parsers/huggingfaceUtils.d.ts +155 -0
  614. package/types/lib/parsers/huggingfaceUtils.d.ts.map +1 -0
  615. package/types/lib/parsers/iri.d.ts +68 -0
  616. package/types/lib/parsers/iri.d.ts.map +1 -0
  617. package/types/lib/parsers/npmrc.d.ts +33 -0
  618. package/types/lib/parsers/npmrc.d.ts.map +1 -0
  619. package/types/lib/parsers/ollama.d.ts +22 -0
  620. package/types/lib/parsers/ollama.d.ts.map +1 -0
  621. package/types/lib/parsers/xml.d.ts +47 -0
  622. package/types/lib/parsers/xml.d.ts.map +1 -0
  623. package/types/lib/server/server.d.ts +51 -0
  624. package/types/lib/server/server.d.ts.map +1 -0
  625. package/types/lib/stages/postgen/annotator.d.ts +36 -0
  626. package/types/lib/stages/postgen/annotator.d.ts.map +1 -0
  627. package/types/lib/stages/postgen/auditBom.d.ts +92 -0
  628. package/types/lib/stages/postgen/auditBom.d.ts.map +1 -0
  629. package/types/lib/stages/postgen/postgen.d.ts +59 -0
  630. package/types/lib/stages/postgen/postgen.d.ts.map +1 -0
  631. package/types/lib/stages/postgen/ruleEngine.d.ts +18 -0
  632. package/types/lib/stages/postgen/ruleEngine.d.ts.map +1 -0
  633. package/types/lib/stages/postgen/sortBom.d.ts +34 -0
  634. package/types/lib/stages/postgen/sortBom.d.ts.map +1 -0
  635. package/types/lib/stages/postgen/spdxConverter.d.ts +11 -0
  636. package/types/lib/stages/postgen/spdxConverter.d.ts.map +1 -0
  637. package/types/lib/stages/postgen/specVersionCompat.d.ts +71 -0
  638. package/types/lib/stages/postgen/specVersionCompat.d.ts.map +1 -0
  639. package/types/lib/stages/pregen/envAudit.d.ts +14 -0
  640. package/types/lib/stages/pregen/envAudit.d.ts.map +1 -0
  641. package/types/lib/stages/pregen/pregen.d.ts +59 -0
  642. package/types/lib/stages/pregen/pregen.d.ts.map +1 -0
  643. package/types/lib/third-party/arborist/lib/arborist/index.d.ts +47 -0
  644. package/types/lib/third-party/arborist/lib/arborist/index.d.ts.map +1 -0
  645. package/types/lib/third-party/arborist/lib/arborist/load-actual.d.ts +4 -0
  646. package/types/lib/third-party/arborist/lib/arborist/load-actual.d.ts.map +1 -0
  647. package/types/lib/third-party/arborist/lib/arborist/load-virtual.d.ts +4 -0
  648. package/types/lib/third-party/arborist/lib/arborist/load-virtual.d.ts.map +1 -0
  649. package/types/lib/third-party/arborist/lib/bin-links.d.ts +18 -0
  650. package/types/lib/third-party/arborist/lib/bin-links.d.ts.map +1 -0
  651. package/types/lib/third-party/arborist/lib/calc-dep-flags.d.ts +3 -0
  652. package/types/lib/third-party/arborist/lib/calc-dep-flags.d.ts.map +1 -0
  653. package/types/lib/third-party/arborist/lib/case-insensitive-map.d.ts +9 -0
  654. package/types/lib/third-party/arborist/lib/case-insensitive-map.d.ts.map +1 -0
  655. package/types/lib/third-party/arborist/lib/consistent-resolve.d.ts +3 -0
  656. package/types/lib/third-party/arborist/lib/consistent-resolve.d.ts.map +1 -0
  657. package/types/lib/third-party/arborist/lib/debug.d.ts +3 -0
  658. package/types/lib/third-party/arborist/lib/debug.d.ts.map +1 -0
  659. package/types/lib/third-party/arborist/lib/dep-valid.d.ts +3 -0
  660. package/types/lib/third-party/arborist/lib/dep-valid.d.ts.map +1 -0
  661. package/types/lib/third-party/arborist/lib/edge.d.ts +46 -0
  662. package/types/lib/third-party/arborist/lib/edge.d.ts.map +1 -0
  663. package/types/lib/third-party/arborist/lib/from-path.d.ts +3 -0
  664. package/types/lib/third-party/arborist/lib/from-path.d.ts.map +1 -0
  665. package/types/lib/third-party/arborist/lib/gather-dep-set.d.ts +3 -0
  666. package/types/lib/third-party/arborist/lib/gather-dep-set.d.ts.map +1 -0
  667. package/types/lib/third-party/arborist/lib/index.d.ts +3 -0
  668. package/types/lib/third-party/arborist/lib/index.d.ts.map +1 -0
  669. package/types/lib/third-party/arborist/lib/inventory.d.ts +14 -0
  670. package/types/lib/third-party/arborist/lib/inventory.d.ts.map +1 -0
  671. package/types/lib/third-party/arborist/lib/link.d.ts +18 -0
  672. package/types/lib/third-party/arborist/lib/link.d.ts.map +1 -0
  673. package/types/lib/third-party/arborist/lib/node.d.ts +112 -0
  674. package/types/lib/third-party/arborist/lib/node.d.ts.map +1 -0
  675. package/types/lib/third-party/arborist/lib/npm-extension.d.ts +18 -0
  676. package/types/lib/third-party/arborist/lib/npm-extension.d.ts.map +1 -0
  677. package/types/lib/third-party/arborist/lib/override-resolves.d.ts +3 -0
  678. package/types/lib/third-party/arborist/lib/override-resolves.d.ts.map +1 -0
  679. package/types/lib/third-party/arborist/lib/override-set.d.ts +27 -0
  680. package/types/lib/third-party/arborist/lib/override-set.d.ts.map +1 -0
  681. package/types/lib/third-party/arborist/lib/package-extensions.d.ts +36 -0
  682. package/types/lib/third-party/arborist/lib/package-extensions.d.ts.map +1 -0
  683. package/types/lib/third-party/arborist/lib/printable.d.ts +3 -0
  684. package/types/lib/third-party/arborist/lib/printable.d.ts.map +1 -0
  685. package/types/lib/third-party/arborist/lib/proc-log.d.ts +20 -0
  686. package/types/lib/third-party/arborist/lib/proc-log.d.ts.map +1 -0
  687. package/types/lib/third-party/arborist/lib/realpath.d.ts +3 -0
  688. package/types/lib/third-party/arborist/lib/realpath.d.ts.map +1 -0
  689. package/types/lib/third-party/arborist/lib/relpath.d.ts +3 -0
  690. package/types/lib/third-party/arborist/lib/relpath.d.ts.map +1 -0
  691. package/types/lib/third-party/arborist/lib/shrinkwrap.d.ts +54 -0
  692. package/types/lib/third-party/arborist/lib/shrinkwrap.d.ts.map +1 -0
  693. package/types/lib/third-party/arborist/lib/spec-from-lock.d.ts +3 -0
  694. package/types/lib/third-party/arborist/lib/spec-from-lock.d.ts.map +1 -0
  695. package/types/lib/third-party/arborist/lib/tree-check.d.ts +3 -0
  696. package/types/lib/third-party/arborist/lib/tree-check.d.ts.map +1 -0
  697. package/types/lib/third-party/arborist/lib/validate-npm-package-name.d.ts +13 -0
  698. package/types/lib/third-party/arborist/lib/validate-npm-package-name.d.ts.map +1 -0
  699. package/types/lib/third-party/arborist/lib/version-from-tgz.d.ts +6 -0
  700. package/types/lib/third-party/arborist/lib/version-from-tgz.d.ts.map +1 -0
  701. package/types/lib/third-party/arborist/lib/yarn-lock.d.ts +35 -0
  702. package/types/lib/third-party/arborist/lib/yarn-lock.d.ts.map +1 -0
  703. package/types/lib/validator/bomValidator.d.ts +40 -0
  704. package/types/lib/validator/bomValidator.d.ts.map +1 -0
  705. package/types/lib/validator/complianceEngine.d.ts +72 -0
  706. package/types/lib/validator/complianceEngine.d.ts.map +1 -0
  707. package/types/lib/validator/complianceRules.d.ts +61 -0
  708. package/types/lib/validator/complianceRules.d.ts.map +1 -0
  709. package/types/lib/validator/index.d.ts +101 -0
  710. package/types/lib/validator/index.d.ts.map +1 -0
  711. package/types/lib/validator/reporters/annotations.d.ts +37 -0
  712. package/types/lib/validator/reporters/annotations.d.ts.map +1 -0
  713. package/types/lib/validator/reporters/console.d.ts +34 -0
  714. package/types/lib/validator/reporters/console.d.ts.map +1 -0
  715. package/types/lib/validator/reporters/index.d.ts +30 -0
  716. package/types/lib/validator/reporters/index.d.ts.map +1 -0
  717. package/types/lib/validator/reporters/json.d.ts +11 -0
  718. package/types/lib/validator/reporters/json.d.ts.map +1 -0
  719. package/types/lib/validator/reporters/sarif.d.ts +22 -0
  720. package/types/lib/validator/reporters/sarif.d.ts.map +1 -0
  721. package/mod.d.ts +0 -7
  722. package/mod.js +0 -22
@@ -0,0 +1,1673 @@
1
+ import { basename, dirname, relative, resolve } from "node:path";
2
+ import util from "node:util";
3
+
4
+ import nameFromFolder from "@npmcli/name-from-folder";
5
+ import PackageJson from "@npmcli/package-json";
6
+ import npa from "npm-package-arg";
7
+ import semver from "semver";
8
+ import { walkUp } from "walk-up-path";
9
+
10
+ import getBinPaths from "./bin-links.js";
11
+ import CaseInsensitiveMap from "./case-insensitive-map.js";
12
+ import consistentResolve from "./consistent-resolve.js";
13
+ import debug from "./debug.js";
14
+ import Edge from "./edge.js";
15
+ import gatherDepSet from "./gather-dep-set.js";
16
+ import Inventory from "./inventory.js";
17
+ import OverrideSet from "./override-set.js";
18
+ import printableTree from "./printable.js";
19
+ import { log } from "./proc-log.js";
20
+
21
+ const querySelectorAll = () => {
22
+ throw new Error("query-selector-all is not vendored in cdxgen");
23
+ };
24
+
25
+ import relpath from "./relpath.js";
26
+ import treeCheck from "./tree-check.js";
27
+
28
+ // inventory, path, realpath, root, and parent
29
+ //
30
+ // node.root is a reference to the root module in the tree (ie, typically the
31
+ // cwd project folder)
32
+ //
33
+ // node.location is the /-delimited path from the root module to the node. In
34
+ // the case of link targets that may be outside of the root's package tree,
35
+ // this can include some number of /../ path segments. The location of the
36
+ // root module is always '.'. node.location thus never contains drive letters
37
+ // or absolute paths, and is portable within a given project, suitable for
38
+ // inclusion in lockfiles and metadata.
39
+ //
40
+ // node.path is the path to the place where this node lives on disk. It is
41
+ // system-specific and absolute.
42
+ //
43
+ // node.realpath is the path to where the module actually resides on disk. In
44
+ // the case of non-link nodes, node.realpath is equivalent to node.path. In
45
+ // the case of link nodes, it is equivalent to node.target.path.
46
+ //
47
+ // Setting node.parent will set the node's root to the parent's root, as well
48
+ // as updating edgesIn and edgesOut to reload dependency resolutions as needed,
49
+ // and setting node.path to parent.path/node_modules/name.
50
+ //
51
+ // node.inventory is a Map of name to a Set() of all the nodes under a given
52
+ // root by that name. It's empty for non-root nodes, and changing the root
53
+ // reference will remove it from the old root's inventory and add it to the new
54
+ // one. This map is useful for cases like `npm update foo` or `npm ls foo`
55
+ // where we need to quickly find all instances of a given package name within a
56
+ // tree.
57
+
58
+ const _package = Symbol("_package");
59
+ const _parent = Symbol("_parent");
60
+ const _target = Symbol.for("_target");
61
+ const _fsParent = Symbol("_fsParent");
62
+ const _reloadNamedEdges = Symbol("_reloadNamedEdges");
63
+ // overridden by Link class
64
+ const _loadDeps = Symbol.for("Arborist.Node._loadDeps");
65
+ const _refreshLocation = Symbol.for("_refreshLocation");
66
+ const _changePath = Symbol.for("_changePath");
67
+ // used by Link class as well
68
+ const _delistFromMeta = Symbol.for("_delistFromMeta");
69
+ const _explain = Symbol("_explain");
70
+ const _explanation = Symbol("_explanation");
71
+
72
+ class Node {
73
+ #global;
74
+ #meta;
75
+ #root;
76
+ #workspaces;
77
+
78
+ constructor(options) {
79
+ // NB: path can be null if it's a link target
80
+ const {
81
+ children,
82
+ dev = true,
83
+ devOptional = true,
84
+ dummy = false,
85
+ error,
86
+ extraneous = true,
87
+ fsChildren,
88
+ fsParent,
89
+ global = false,
90
+ inert = false,
91
+ installLinks = false,
92
+ integrity,
93
+ isInStore = false,
94
+ legacyPeerDeps = false,
95
+ linksIn,
96
+ loadOverrides = false,
97
+ meta,
98
+ name, // allow setting name explicitly when we haven't set a path yet
99
+ optional = true,
100
+ overrides,
101
+ packageExtensionsApplied = null,
102
+ npmExtensionApplied = null,
103
+ parent,
104
+ patched = null,
105
+ path,
106
+ peer = true,
107
+ realpath,
108
+ resolved,
109
+ root,
110
+ sourceReference = null,
111
+ } = options;
112
+ // this object gives querySelectorAll somewhere to stash context about a node
113
+ // while processing a query
114
+ this.queryContext = {};
115
+
116
+ // true if part of a global install
117
+ this.#global = global;
118
+
119
+ this.#workspaces = null;
120
+
121
+ this.errors = error ? [error] : [];
122
+ this.isInStore = isInStore;
123
+
124
+ // this will usually be null, except when modeling a
125
+ // package's dependencies in a virtual root.
126
+ this.sourceReference = sourceReference;
127
+
128
+ // have to set the internal package ref before assigning the parent, because this.package is read when adding to inventory
129
+ if (sourceReference) {
130
+ this[_package] = sourceReference.package;
131
+ } else {
132
+ // TODO if this came from pacote.manifest we don't have to do this, we can be told to skip this step
133
+ const pkg = new PackageJson();
134
+ let content = {};
135
+ // TODO this is overly guarded. If pkg is not an object we should not allow it at all.
136
+ if (options.pkg && typeof options.pkg === "object") {
137
+ content = options.pkg;
138
+ }
139
+ pkg.fromContent(content);
140
+ pkg.syncNormalize();
141
+ this[_package] = pkg.content;
142
+ }
143
+
144
+ this.name =
145
+ name ||
146
+ nameFromFolder(path || this.package.name || realpath) ||
147
+ this.package.name ||
148
+ null;
149
+
150
+ // should be equal if not a link
151
+ this.path = path ? resolve(path) : null;
152
+
153
+ if (!this.name && (!this.path || this.path !== dirname(this.path))) {
154
+ throw new TypeError("could not detect node name from path or package");
155
+ }
156
+
157
+ this.realpath = !this.isLink ? this.path : resolve(realpath);
158
+
159
+ this.resolved = resolved || null;
160
+ if (!this.resolved) {
161
+ // note: this *only* works for non-file: deps, so we avoid even
162
+ // trying here.
163
+ // file: deps are tracked in package.json will _resolved set to the
164
+ // full path to the tarball or link target. However, if the package
165
+ // is checked into git or moved to another location, that's 100% not
166
+ // portable at all! The _where and _location don't provide much help,
167
+ // since _location is just where the module ended up in the tree,
168
+ // and _where can be different than the actual root if it's a
169
+ // meta-dep deeper in the dependency graph.
170
+ //
171
+ // If we don't have the other oldest indicators of legacy npm, then it's
172
+ // probably what we're getting from pacote, which IS trustworthy.
173
+ //
174
+ // Otherwise, hopefully a shrinkwrap will help us out.
175
+ const resolved = consistentResolve(this.package._resolved);
176
+ if (resolved && !(/^file:/.test(resolved) && this.package._where)) {
177
+ this.resolved = resolved;
178
+ }
179
+ }
180
+ this.integrity = integrity || this.package._integrity || null;
181
+ // Patch record { path, integrity } or null, set from patchedDependencies or the lockfile.
182
+ this.patched = patched || null;
183
+ // Provenance for a root packageExtensions repair applied to this node's manifest, or null.
184
+ // Shape: { selector, dependencies?, optionalDependencies?, peerDependencies?, peerDependenciesMeta? }.
185
+ this.packageExtensionsApplied = packageExtensionsApplied;
186
+ // Provenance for a root .npm-extension transformManifest repair applied to this node's manifest, or null.
187
+ // Shape: { extensionPoint, dependencies?, optionalDependencies?, peerDependencies?, peerDependenciesMeta? }.
188
+ this.npmExtensionApplied = npmExtensionApplied;
189
+ this.installLinks = installLinks;
190
+ this.legacyPeerDeps = legacyPeerDeps;
191
+
192
+ this.children = new CaseInsensitiveMap();
193
+ this.fsChildren = new Set();
194
+ this.inventory = new Inventory();
195
+ this.tops = new Set();
196
+ this.linksIn = new Set(linksIn || []);
197
+
198
+ // these three are set by an Arborist taking a catalog
199
+ // after the tree is built. We don't get this along the way,
200
+ // because they have a tendency to change as new children are
201
+ // added, especially when they're deduped. Eg, a dev dep may be
202
+ // a 3-levels-deep dependency of a non-dev dep. If we calc the
203
+ // flags along the way, then they'll tend to be invalid by the
204
+ // time we need to look at them.
205
+ if (!dummy) {
206
+ this.dev = dev;
207
+ this.optional = optional;
208
+ this.devOptional = devOptional;
209
+ this.peer = peer;
210
+ this.extraneous = extraneous;
211
+ this.dummy = false;
212
+ } else {
213
+ // true if this is a placeholder for the purpose of serving as a
214
+ // fsParent to link targets that get their deps resolved outside
215
+ // the root tree folder.
216
+ this.dummy = true;
217
+ this.dev = false;
218
+ this.optional = false;
219
+ this.devOptional = false;
220
+ this.peer = false;
221
+ this.extraneous = false;
222
+ }
223
+
224
+ this.inert = inert;
225
+
226
+ this.edgesIn = new Set();
227
+ this.edgesOut = new CaseInsensitiveMap();
228
+
229
+ if (overrides) {
230
+ this.overrides = overrides;
231
+ } else if (loadOverrides) {
232
+ const overrides = this.package.overrides || {};
233
+ if (Object.keys(overrides).length > 0) {
234
+ this.overrides = new OverrideSet({
235
+ overrides: this.package.overrides,
236
+ });
237
+ }
238
+ }
239
+
240
+ // only relevant for the root and top nodes
241
+ this.meta = meta;
242
+
243
+ // Note: this is _slightly_ less efficient for the initial tree
244
+ // building than it could be, but in exchange, it's a much simpler
245
+ // algorithm.
246
+ // If this node has a bunch of children, and those children satisfy
247
+ // its various deps, then we're going to _first_ create all the
248
+ // edges, and _then_ assign the children into place, re-resolving
249
+ // them all in _reloadNamedEdges.
250
+ // A more efficient, but more complicated, approach would be to
251
+ // flag this node as being a part of a tree build, so it could
252
+ // hold off on resolving its deps until its children are in place.
253
+
254
+ // call the parent setter
255
+ // Must be set prior to calling _loadDeps, because top-ness is relevant
256
+
257
+ // will also assign root if present on the parent
258
+ this[_parent] = null;
259
+ this.parent = parent || null;
260
+
261
+ this[_fsParent] = null;
262
+ this.fsParent = fsParent || null;
263
+
264
+ // see parent/root setters below.
265
+ // root is set to parent's root if we have a parent; otherwise, if it's
266
+ // null, then it's set to the node itself.
267
+ if (!parent && !fsParent) {
268
+ this.root = root || null;
269
+ }
270
+
271
+ // mostly a convenience for testing, but also a way to create
272
+ // trees in a more declarative way than setting parent on each
273
+ if (children) {
274
+ for (const c of children) {
275
+ new Node({ ...c, parent: this });
276
+ }
277
+ }
278
+ if (fsChildren) {
279
+ for (const c of fsChildren) {
280
+ new Node({ ...c, fsParent: this });
281
+ }
282
+ }
283
+
284
+ // now load all the dep edges
285
+ this[_loadDeps]();
286
+ }
287
+
288
+ get meta() {
289
+ return this.#meta;
290
+ }
291
+
292
+ set meta(meta) {
293
+ this.#meta = meta;
294
+ if (meta) {
295
+ meta.add(this);
296
+ }
297
+ }
298
+
299
+ get global() {
300
+ if (this.#root === this) {
301
+ return this.#global;
302
+ }
303
+ return this.#root.global;
304
+ }
305
+
306
+ // true for packages installed directly in the global node_modules folder
307
+ get globalTop() {
308
+ return this.global && this.parent && this.parent.isProjectRoot;
309
+ }
310
+
311
+ get workspaces() {
312
+ return this.#workspaces;
313
+ }
314
+
315
+ set workspaces(workspaces) {
316
+ // deletes edges if they already exists
317
+ if (this.#workspaces) {
318
+ for (const name of this.#workspaces.keys()) {
319
+ if (!workspaces.has(name)) {
320
+ this.edgesOut.get(name).detach();
321
+ }
322
+ }
323
+ }
324
+
325
+ this.#workspaces = workspaces;
326
+ this.#loadWorkspaces();
327
+ this[_loadDeps]();
328
+ }
329
+
330
+ get binPaths() {
331
+ if (!this.parent) {
332
+ return [];
333
+ }
334
+
335
+ return getBinPaths({
336
+ pkg: this.package,
337
+ path: this.path,
338
+ global: this.global,
339
+ top: this.globalTop,
340
+ });
341
+ }
342
+
343
+ get hasInstallScript() {
344
+ const { hasInstallScript, scripts } = this.package;
345
+ const { install, preinstall, postinstall } = scripts || {};
346
+ return !!(hasInstallScript || install || preinstall || postinstall);
347
+ }
348
+
349
+ get version() {
350
+ return this.package.version || "";
351
+ }
352
+
353
+ get packageName() {
354
+ return this.package.name || null;
355
+ }
356
+
357
+ get pkgid() {
358
+ const { name = "", version = "" } = this.package;
359
+ // root package will prefer package name over folder name,
360
+ // and never be called an alias.
361
+ const { isProjectRoot } = this;
362
+ const myname = isProjectRoot ? name || this.name : this.name;
363
+ const alias =
364
+ !isProjectRoot && name && myname !== name ? `npm:${name}@` : "";
365
+ return `${myname}@${alias}${version}`;
366
+ }
367
+
368
+ get overridden() {
369
+ if (!this.overrides) {
370
+ return false;
371
+ }
372
+ if (!this.overrides.value) {
373
+ return false;
374
+ }
375
+ if (this.overrides.name !== this.name) {
376
+ return false;
377
+ }
378
+
379
+ // The overrides rule is for a package with this name, but some override rules only apply to specific
380
+ // versions. To make sure this package was actually overridden, we check whether any edge going in
381
+ // had the rule applied to it, in which case its overrides set is different than its source node.
382
+ for (const edge of this.edgesIn) {
383
+ if (
384
+ edge.overrides &&
385
+ edge.overrides.name === this.name &&
386
+ edge.overrides.value === this.version
387
+ ) {
388
+ if (!edge.overrides.isEqual(edge.from.overrides)) {
389
+ return true;
390
+ }
391
+ }
392
+ }
393
+
394
+ return false;
395
+ }
396
+
397
+ get package() {
398
+ return this[_package];
399
+ }
400
+
401
+ set package(pkg) {
402
+ // just detach them all. we could make this _slightly_ more efficient
403
+ // by only detaching the ones that changed, but we'd still have to walk
404
+ // them all, and the comparison logic gets a bit tricky. we generally
405
+ // only do this more than once at the root level, so the resolve() calls
406
+ // are only one level deep, and there's not much to be saved, anyway.
407
+ // simpler to just toss them all out.
408
+ for (const edge of this.edgesOut.values()) {
409
+ edge.detach();
410
+ }
411
+
412
+ this[_explanation] = null;
413
+ /* istanbul ignore next - should be impossible */
414
+ if (!pkg || typeof pkg !== "object") {
415
+ debug(() => {
416
+ throw new Error("setting Node.package to non-object");
417
+ });
418
+ pkg = {};
419
+ }
420
+ this[_package] = pkg;
421
+ this.#loadWorkspaces();
422
+ this[_loadDeps]();
423
+ // do a hard reload, since the dependents may now be valid or invalid
424
+ // as a result of the package change.
425
+ this.edgesIn.forEach((edge) => {
426
+ edge.reload(true);
427
+ });
428
+ }
429
+
430
+ // node.explain(nodes seen already, edge we're trying to satisfy
431
+ // if edge is not specified, it lists every edge into the node.
432
+ explain(edge = null, seen = []) {
433
+ if (this[_explanation]) {
434
+ return this[_explanation];
435
+ }
436
+
437
+ return (this[_explanation] = this[_explain](edge, seen));
438
+ }
439
+
440
+ [_explain](edge, seen) {
441
+ if (this.isProjectRoot && !this.sourceReference) {
442
+ return {
443
+ location: this.path,
444
+ };
445
+ }
446
+
447
+ const why = {
448
+ name: this.isProjectRoot || this.isTop ? this.packageName : this.name,
449
+ version: this.package.version,
450
+ };
451
+ if (this.errors.length || !this.packageName || !this.package.version) {
452
+ why.errors = this.errors.length
453
+ ? this.errors
454
+ : [new Error("invalid package: lacks name and/or version")];
455
+ why.package = this.package;
456
+ }
457
+
458
+ if (this.root.sourceReference) {
459
+ const { name, version } = this.root.package;
460
+ why.whileInstalling = {
461
+ name,
462
+ version,
463
+ path: this.root.sourceReference.path,
464
+ };
465
+ }
466
+
467
+ if (this.sourceReference) {
468
+ return this.sourceReference.explain(edge, seen);
469
+ }
470
+
471
+ if (seen.includes(this)) {
472
+ return why;
473
+ }
474
+
475
+ why.location = this.location;
476
+ why.isWorkspace = this.isWorkspace;
477
+
478
+ // make a new list each time. we can revisit, but not loop.
479
+ seen = seen.concat(this);
480
+
481
+ why.dependents = [];
482
+ if (edge) {
483
+ why.dependents.push(edge.explain(seen));
484
+ } else {
485
+ // ignore invalid edges, since those aren't satisfied by this thing,
486
+ // and are not keeping it held in this spot anyway.
487
+ const edges = [];
488
+ for (const edge of this.edgesIn) {
489
+ if (!edge.valid && !edge.from.isProjectRoot) {
490
+ continue;
491
+ }
492
+
493
+ edges.push(edge);
494
+ }
495
+ for (const edge of edges) {
496
+ why.dependents.push(edge.explain(seen));
497
+ }
498
+ }
499
+
500
+ if (this.linksIn.size) {
501
+ why.linksIn = [...this.linksIn].map((link) => link[_explain](edge, seen));
502
+ }
503
+
504
+ return why;
505
+ }
506
+
507
+ isDescendantOf(node) {
508
+ for (let p = this; p; p = p.resolveParent) {
509
+ if (p === node) {
510
+ return true;
511
+ }
512
+ }
513
+ return false;
514
+ }
515
+
516
+ shouldOmit(omitSet) {
517
+ if (!omitSet.size) {
518
+ return false;
519
+ }
520
+
521
+ const { top } = this;
522
+
523
+ // if the top is not the root or workspace then we do not want to omit it
524
+ if (!top.isProjectRoot && !top.isWorkspace) {
525
+ return false;
526
+ }
527
+
528
+ // omit node if the dep type matches any omit flags that were set
529
+ return (
530
+ (this.peer && omitSet.has("peer")) ||
531
+ (this.dev && omitSet.has("dev")) ||
532
+ (this.optional && omitSet.has("optional")) ||
533
+ (this.devOptional && omitSet.has("optional") && omitSet.has("dev"))
534
+ );
535
+ }
536
+
537
+ getBundler(path = []) {
538
+ // made a cycle, definitely not bundled!
539
+ if (path.includes(this)) {
540
+ return null;
541
+ }
542
+
543
+ path.push(this);
544
+
545
+ const parent = this[_parent];
546
+ if (!parent) {
547
+ return null;
548
+ }
549
+
550
+ const pBundler = parent.getBundler(path);
551
+ if (pBundler) {
552
+ return pBundler;
553
+ }
554
+
555
+ const ppkg = parent.package;
556
+ const bd = ppkg && ppkg.bundleDependencies;
557
+ // explicit bundling
558
+ if (Array.isArray(bd) && bd.includes(this.name)) {
559
+ return parent;
560
+ }
561
+
562
+ // deps that are deduped up to the bundling level are bundled.
563
+ // however, if they get their dep met further up than that,
564
+ // then they are not bundled. Ie, installing a package with
565
+ // unmet bundled deps will not cause your deps to be bundled.
566
+ for (const edge of this.edgesIn) {
567
+ const eBundler = edge.from.getBundler(path);
568
+ if (!eBundler) {
569
+ continue;
570
+ }
571
+
572
+ if (eBundler === parent) {
573
+ return eBundler;
574
+ }
575
+ }
576
+
577
+ return null;
578
+ }
579
+
580
+ get inBundle() {
581
+ return !!this.getBundler();
582
+ }
583
+
584
+ // when reifying, if a package is technically in a bundleDependencies list,
585
+ // but that list is the root project, we still have to install it. This
586
+ // getter returns true if it's in a dependency's bundle list, not the root's.
587
+ get inDepBundle() {
588
+ const bundler = this.getBundler();
589
+ return !!bundler && bundler !== this.root;
590
+ }
591
+
592
+ get isWorkspace() {
593
+ if (this.isProjectRoot) {
594
+ return false;
595
+ }
596
+ const { root } = this;
597
+ const { type, to } = root.edgesOut.get(this.packageName) || {};
598
+ return type === "workspace" && to && (to.target === this || to === this);
599
+ }
600
+
601
+ get isRoot() {
602
+ return this === this.root;
603
+ }
604
+
605
+ get isProjectRoot() {
606
+ // only treat as project root if it's the actual link that is the root, or the target of the root link, but NOT if it's another link to the same root that happens to be somewhere else.
607
+ return this === this.root || this === this.root.target;
608
+ }
609
+
610
+ get isRegistryDependency() {
611
+ if (this.edgesIn.size === 0) {
612
+ return false;
613
+ }
614
+ for (const edge of this.edgesIn) {
615
+ if (!npa(edge.spec).registry) {
616
+ return false;
617
+ }
618
+ }
619
+ return true;
620
+ }
621
+
622
+ *ancestry() {
623
+ for (let anc = this; anc; anc = anc.resolveParent) {
624
+ yield anc;
625
+ }
626
+ }
627
+
628
+ set root(root) {
629
+ // setting to null means this is the new root
630
+ // should only ever be one step
631
+ while (root && root.root !== root) {
632
+ root = root.root;
633
+ }
634
+
635
+ root = root || this;
636
+
637
+ // delete from current root inventory
638
+ this[_delistFromMeta]();
639
+
640
+ // can't set the root (yet) if there's no way to determine location
641
+ // this allows us to do new Node({...}) and then set the root later.
642
+ // just make the assignment so we don't lose it, and move on.
643
+ if (!this.path || !root.realpath || !root.path) {
644
+ this.#root = root;
645
+ return;
646
+ }
647
+
648
+ // temporarily become a root node
649
+ this.#root = this;
650
+
651
+ // break all linksIn, we're going to re-set them if needed later
652
+ for (const link of this.linksIn) {
653
+ link[_target] = null;
654
+ this.linksIn.delete(link);
655
+ }
656
+
657
+ // temporarily break this link as well, we'll re-set if possible later
658
+ const { target } = this;
659
+ if (this.isLink) {
660
+ if (target) {
661
+ target.linksIn.delete(this);
662
+ if (target.root === this) {
663
+ target[_delistFromMeta]();
664
+ }
665
+ }
666
+ this[_target] = null;
667
+ }
668
+
669
+ // if this is part of a cascading root set, then don't do this bit
670
+ // but if the parent/fsParent is in a different set, we have to break
671
+ // that reference before proceeding
672
+ if (this.parent && this.parent.root !== root) {
673
+ this.parent.children.delete(this.name);
674
+ this[_parent] = null;
675
+ }
676
+ if (this.fsParent && this.fsParent.root !== root) {
677
+ this.fsParent.fsChildren.delete(this);
678
+ this[_fsParent] = null;
679
+ }
680
+
681
+ if (root === this) {
682
+ this[_refreshLocation]();
683
+ } else {
684
+ // setting to some different node.
685
+ const loc = relpath(root.realpath, this.path);
686
+ const current = root.inventory.get(loc);
687
+
688
+ // clobber whatever is there now
689
+ if (current) {
690
+ current.root = null;
691
+ }
692
+
693
+ this.#root = root;
694
+ // set this.location and add to inventory
695
+ this[_refreshLocation]();
696
+
697
+ // try to find our parent/fsParent in the new root inventory
698
+ for (const p of walkUp(dirname(this.path))) {
699
+ if (p === this.path) {
700
+ continue;
701
+ }
702
+ const ploc = relpath(root.realpath, p);
703
+ const parent = root.inventory.get(ploc);
704
+ if (parent) {
705
+ /* istanbul ignore next - impossible */
706
+ if (parent.isLink) {
707
+ debug(() => {
708
+ throw Object.assign(new Error("assigning parentage to link"), {
709
+ path: this.path,
710
+ parent: parent.path,
711
+ parentReal: parent.realpath,
712
+ });
713
+ });
714
+ continue;
715
+ }
716
+ const childLoc = `${ploc}${ploc ? "/" : ""}node_modules/${this.name}`;
717
+ const isParent = this.location === childLoc;
718
+ if (isParent) {
719
+ const oldChild = parent.children.get(this.name);
720
+ if (oldChild && oldChild !== this) {
721
+ oldChild.root = null;
722
+ }
723
+ if (this.parent) {
724
+ this.parent.children.delete(this.name);
725
+ this.parent[_reloadNamedEdges](this.name);
726
+ }
727
+ parent.children.set(this.name, this);
728
+ this[_parent] = parent;
729
+ // don't do it for links, because they don't have a target yet
730
+ // we'll hit them up a bit later on.
731
+ if (!this.isLink) {
732
+ parent[_reloadNamedEdges](this.name);
733
+ }
734
+ } else {
735
+ /* istanbul ignore if - should be impossible, since we break
736
+ * all fsParent/child relationships when moving? */
737
+ if (this.fsParent) {
738
+ this.fsParent.fsChildren.delete(this);
739
+ }
740
+ parent.fsChildren.add(this);
741
+ this[_fsParent] = parent;
742
+ }
743
+ break;
744
+ }
745
+ }
746
+
747
+ // if it doesn't have a parent, it's a top node
748
+ if (!this.parent) {
749
+ root.tops.add(this);
750
+ } else {
751
+ root.tops.delete(this);
752
+ }
753
+
754
+ // assign parentage for any nodes that need to have this as a parent
755
+ // this can happen when we have a node at nm/a/nm/b added *before*
756
+ // the node at nm/a, which might have the root node as a fsParent.
757
+ // we can't rely on the public setter here, because it calls into
758
+ // this function to set up these references!
759
+ // check dirname so that /foo isn't treated as the fsparent of /foo-bar
760
+ const nmloc = `${this.location}${this.location ? "/" : ""}node_modules/`;
761
+ // only walk top nodes, since anything else already has a parent.
762
+ for (const child of root.tops) {
763
+ const isChild = child.location === nmloc + child.name;
764
+ const isFsChild =
765
+ dirname(child.path).startsWith(this.path) &&
766
+ child !== this &&
767
+ !child.parent &&
768
+ (!child.fsParent ||
769
+ child.fsParent === this ||
770
+ dirname(this.path).startsWith(child.fsParent.path));
771
+
772
+ if (!isChild && !isFsChild) {
773
+ continue;
774
+ }
775
+
776
+ // set up the internal parentage links
777
+ if (this.isLink) {
778
+ child.root = null;
779
+ } else {
780
+ // can't possibly have a parent, because it's in tops
781
+ if (child.fsParent) {
782
+ child.fsParent.fsChildren.delete(child);
783
+ }
784
+ child[_fsParent] = null;
785
+ if (isChild) {
786
+ this.children.set(child.name, child);
787
+ child[_parent] = this;
788
+ root.tops.delete(child);
789
+ } else {
790
+ this.fsChildren.add(child);
791
+ child[_fsParent] = this;
792
+ }
793
+ }
794
+ }
795
+
796
+ // look for any nodes with the same realpath. either they're links
797
+ // to that realpath, or a thing at that realpath if we're adding a link
798
+ // (if we're adding a regular node, we already deleted the old one)
799
+ for (const node of root.inventory.query("realpath", this.realpath)) {
800
+ if (node === this) {
801
+ continue;
802
+ }
803
+
804
+ /* istanbul ignore next - should be impossible */
805
+ debug(() => {
806
+ if (node.root !== root) {
807
+ throw new Error("inventory contains node from other root");
808
+ }
809
+ });
810
+
811
+ if (this.isLink) {
812
+ const target = node.target;
813
+ this[_target] = target;
814
+ this[_package] = target.package;
815
+ target.linksIn.add(this);
816
+ // reload edges here, because now we have a target
817
+ if (this.parent) {
818
+ this.parent[_reloadNamedEdges](this.name);
819
+ }
820
+ break;
821
+ } else {
822
+ /* istanbul ignore else - should be impossible */
823
+ if (node.isLink) {
824
+ node[_target] = this;
825
+ node[_package] = this.package;
826
+ this.linksIn.add(node);
827
+ if (node.parent) {
828
+ node.parent[_reloadNamedEdges](node.name);
829
+ }
830
+ } else {
831
+ debug(() => {
832
+ throw Object.assign(new Error("duplicate node in root setter"), {
833
+ path: this.path,
834
+ realpath: this.realpath,
835
+ root: root.realpath,
836
+ });
837
+ });
838
+ }
839
+ }
840
+ }
841
+ }
842
+
843
+ // reload all edgesIn where the root doesn't match, so we don't have
844
+ // cross-tree dependency graphs
845
+ for (const edge of this.edgesIn) {
846
+ if (edge.from.root !== root) {
847
+ edge.reload();
848
+ }
849
+ }
850
+ // reload all edgesOut where root doesn't match, or is missing, since
851
+ // it might not be missing in the new tree
852
+ for (const edge of this.edgesOut.values()) {
853
+ if (!edge.to || edge.to.root !== root) {
854
+ edge.reload();
855
+ }
856
+ }
857
+
858
+ // now make sure our family comes along for the ride!
859
+ const family = new Set(
860
+ [
861
+ ...this.fsChildren,
862
+ ...this.children.values(),
863
+ ...this.inventory.values(),
864
+ ].filter((n) => n !== this),
865
+ );
866
+
867
+ for (const child of family) {
868
+ if (child.root !== root) {
869
+ child[_delistFromMeta]();
870
+ child[_parent] = null;
871
+ this.children.delete(child.name);
872
+ child[_fsParent] = null;
873
+ this.fsChildren.delete(child);
874
+ for (const l of child.linksIn) {
875
+ l[_target] = null;
876
+ child.linksIn.delete(l);
877
+ }
878
+ }
879
+ }
880
+ for (const child of family) {
881
+ if (child.root !== root) {
882
+ child.root = root;
883
+ }
884
+ }
885
+
886
+ // if we had a target, and didn't find one in the new root, then bring
887
+ // it over as well, but only if we're setting the link into a new root,
888
+ // as we don't want to lose the target any time we remove a link.
889
+ if (this.isLink && target && !this.target && root !== this) {
890
+ target.root = root;
891
+ }
892
+
893
+ // tree should always be valid upon root setter completion.
894
+ treeCheck(this);
895
+ if (this !== root) {
896
+ treeCheck(root);
897
+ }
898
+ }
899
+
900
+ get root() {
901
+ return this.#root || this;
902
+ }
903
+
904
+ #loadWorkspaces() {
905
+ if (!this.#workspaces) {
906
+ return;
907
+ }
908
+
909
+ for (const [name, path] of this.#workspaces.entries()) {
910
+ new Edge({ from: this, name, spec: `file:${path}`, type: "workspace" });
911
+ }
912
+ }
913
+
914
+ [_loadDeps]() {
915
+ // Caveat! Order is relevant!
916
+ // Packages in optionalDependencies are optional.
917
+ // Packages in both deps and devDeps are required.
918
+ // Note the subtle breaking change from v6: it is no longer possible
919
+ // to have a different spec for a devDep than production dep.
920
+
921
+ // Linked targets that are disconnected from the tree are tops,
922
+ // but don't have a 'path' field, only a 'realpath', because we
923
+ // don't know their canonical location. We don't need their devDeps.
924
+ const pd = this.package.peerDependencies;
925
+ const ad = this.package.acceptDependencies || {};
926
+ if (pd && typeof pd === "object" && !this.legacyPeerDeps) {
927
+ const pm = this.package.peerDependenciesMeta || {};
928
+ const peerDependencies = {};
929
+ const peerOptional = {};
930
+ for (const [name, dep] of Object.entries(pd)) {
931
+ if (pm[name]?.optional) {
932
+ peerOptional[name] = dep;
933
+ } else {
934
+ peerDependencies[name] = dep;
935
+ }
936
+ }
937
+ this.#loadDepType(peerDependencies, "peer", ad);
938
+ this.#loadDepType(peerOptional, "peerOptional", ad);
939
+ }
940
+
941
+ this.#loadDepType(this.package.dependencies, "prod", ad);
942
+ this.#loadDepType(this.package.optionalDependencies, "optional", ad);
943
+
944
+ const { globalTop, isTop, path, sourceReference } = this;
945
+ const {
946
+ globalTop: srcGlobalTop,
947
+ isTop: srcTop,
948
+ path: srcPath,
949
+ } = sourceReference || {};
950
+ // A package in the linked strategy's .store is a transitive dependency that is structurally a tree top, but its devDependencies are never installed or required, so they must not be loaded.
951
+ const thisDev = isTop && !globalTop && path && !this.isInStore;
952
+ const srcDev = !sourceReference || (srcTop && !srcGlobalTop && srcPath);
953
+ if (thisDev && srcDev) {
954
+ this.#loadDepType(this.package.devDependencies, "dev", ad);
955
+ }
956
+ }
957
+
958
+ #loadDepType(deps, type, ad) {
959
+ // Because of the order in which _loadDeps runs, we always want to
960
+ // prioritize a new edge over an existing one
961
+ for (const [name, spec] of Object.entries(deps || {})) {
962
+ const current = this.edgesOut.get(name);
963
+ if (!current || current.type !== "workspace") {
964
+ new Edge({ from: this, name, spec, accept: ad[name], type });
965
+ }
966
+ }
967
+ }
968
+
969
+ get fsParent() {
970
+ // in debug setter prevents fsParent from being this
971
+ return this[_fsParent];
972
+ }
973
+
974
+ set fsParent(fsParent) {
975
+ if (!fsParent) {
976
+ if (this[_fsParent]) {
977
+ this.root = null;
978
+ }
979
+ return;
980
+ }
981
+
982
+ debug(() => {
983
+ if (fsParent === this) {
984
+ throw new Error("setting node to its own fsParent");
985
+ }
986
+
987
+ if (fsParent.realpath === this.realpath) {
988
+ throw new Error("setting fsParent to same path");
989
+ }
990
+
991
+ // the initial set MUST be an actual walk-up from the realpath
992
+ // subsequent sets will re-root on the new fsParent's path.
993
+ if (!this[_fsParent] && this.realpath.indexOf(fsParent.realpath) !== 0) {
994
+ throw Object.assign(new Error("setting fsParent improperly"), {
995
+ path: this.path,
996
+ realpath: this.realpath,
997
+ fsParent: {
998
+ path: fsParent.path,
999
+ realpath: fsParent.realpath,
1000
+ },
1001
+ });
1002
+ }
1003
+ });
1004
+
1005
+ if (fsParent.isLink) {
1006
+ fsParent = fsParent.target;
1007
+ }
1008
+
1009
+ // setting a thing to its own fsParent is not normal, but no-op for safety
1010
+ if (this === fsParent || fsParent.realpath === this.realpath) {
1011
+ return;
1012
+ }
1013
+
1014
+ // nothing to do
1015
+ if (this[_fsParent] === fsParent) {
1016
+ return;
1017
+ }
1018
+
1019
+ const oldFsParent = this[_fsParent];
1020
+ const newPath = !oldFsParent
1021
+ ? this.path
1022
+ : resolve(fsParent.path, relative(oldFsParent.path, this.path));
1023
+ const nmPath = resolve(fsParent.path, "node_modules", this.name);
1024
+
1025
+ // this is actually the parent, set that instead
1026
+ if (newPath === nmPath) {
1027
+ this.parent = fsParent;
1028
+ return;
1029
+ }
1030
+
1031
+ const pathChange = newPath !== this.path;
1032
+
1033
+ // remove from old parent/fsParent
1034
+ const oldParent = this.parent;
1035
+ const oldName = this.name;
1036
+ if (this.parent) {
1037
+ this.parent.children.delete(this.name);
1038
+ this[_parent] = null;
1039
+ }
1040
+ if (this.fsParent) {
1041
+ this.fsParent.fsChildren.delete(this);
1042
+ this[_fsParent] = null;
1043
+ }
1044
+
1045
+ // update this.path/realpath for this and all children/fsChildren
1046
+ if (pathChange) {
1047
+ this[_changePath](newPath);
1048
+ }
1049
+
1050
+ if (oldParent) {
1051
+ oldParent[_reloadNamedEdges](oldName);
1052
+ }
1053
+
1054
+ // clobbers anything at that path, resets all appropriate references
1055
+ this.root = fsParent.root;
1056
+ }
1057
+
1058
+ // is it safe to replace one node with another? check the edges to
1059
+ // make sure no one will get upset. Note that the node might end up
1060
+ // having its own unmet dependencies, if the new node has new deps.
1061
+ // Note that there are cases where Arborist will opt to insert a node
1062
+ // into the tree even though this function returns false! This is
1063
+ // necessary when a root dependency is added or updated, or when a
1064
+ // root dependency brings peer deps along with it. In that case, we
1065
+ // will go ahead and create the invalid state, and then try to resolve
1066
+ // it with more tree construction, because it's a user request.
1067
+ canReplaceWith(node, ignorePeers) {
1068
+ if (node.name !== this.name) {
1069
+ return false;
1070
+ }
1071
+
1072
+ if (node.packageName !== this.packageName) {
1073
+ return false;
1074
+ }
1075
+
1076
+ // If this node has no dependencies, then it's irrelevant to check the override
1077
+ // rules of the replacement node.
1078
+ if (this.edgesOut.size) {
1079
+ // XXX need to check for two root nodes?
1080
+ if (node.overrides) {
1081
+ if (!node.overrides.isEqual(this.overrides)) {
1082
+ return false;
1083
+ }
1084
+ } else {
1085
+ if (this.overrides) {
1086
+ return false;
1087
+ }
1088
+ }
1089
+ }
1090
+
1091
+ ignorePeers = new Set(ignorePeers);
1092
+
1093
+ // gather up all the deps of this node and that are only depended
1094
+ // upon by deps of this node. those ones don't count, since
1095
+ // they'll be replaced if this node is replaced anyway.
1096
+ const depSet = gatherDepSet([this], (e) => e.to !== this && e.valid);
1097
+
1098
+ for (const edge of this.edgesIn) {
1099
+ // when replacing peer sets, we need to be able to replace the entire
1100
+ // peer group, which means we ignore incoming edges from other peers
1101
+ // within the replacement set.
1102
+ if (
1103
+ !this.isTop &&
1104
+ edge.from.parent === this.parent &&
1105
+ edge.peer &&
1106
+ ignorePeers.has(edge.from.name)
1107
+ ) {
1108
+ continue;
1109
+ }
1110
+
1111
+ // only care about edges that don't originate from this node
1112
+ if (!depSet.has(edge.from) && !edge.satisfiedBy(node)) {
1113
+ return false;
1114
+ }
1115
+ }
1116
+
1117
+ return true;
1118
+ }
1119
+
1120
+ canReplace(node, ignorePeers) {
1121
+ return node.canReplaceWith(this, ignorePeers);
1122
+ }
1123
+
1124
+ // return true if it's safe to remove this node, because anything that
1125
+ // is depending on it would be fine with the thing that they would resolve
1126
+ // to if it was removed, or nothing is depending on it in the first place.
1127
+ canDedupe(preferDedupe = false, explicitRequest = false) {
1128
+ // not allowed to mess with bundles
1129
+ if (this.inDepBundle) {
1130
+ return false;
1131
+ }
1132
+
1133
+ // it's a top level pkg, or a dep of one
1134
+ if (!this.resolveParent || !this.resolveParent.resolveParent) {
1135
+ return false;
1136
+ }
1137
+
1138
+ // no one wants it, remove it
1139
+ if (this.edgesIn.size === 0) {
1140
+ return true;
1141
+ }
1142
+
1143
+ const other = this.resolveParent.resolveParent.resolve(this.name);
1144
+
1145
+ // nothing else, need this one
1146
+ if (!other) {
1147
+ return false;
1148
+ }
1149
+
1150
+ // if it's the same thing, then always fine to remove
1151
+ if (other.matches(this)) {
1152
+ return true;
1153
+ }
1154
+
1155
+ // if the other thing can't replace this, then skip it
1156
+ if (!other.canReplace(this)) {
1157
+ return false;
1158
+ }
1159
+
1160
+ // if we prefer dedupe, or if the version is equal, take the other
1161
+ if (preferDedupe || semver.eq(other.version, this.version)) {
1162
+ return true;
1163
+ }
1164
+
1165
+ // if our current version isn't the result of an override, then prefer to take the greater version
1166
+ if (!this.overridden && semver.gt(other.version, this.version)) {
1167
+ return true;
1168
+ }
1169
+
1170
+ // if the other version was an explicit request, then prefer to take the other version
1171
+ if (explicitRequest) {
1172
+ return true;
1173
+ }
1174
+
1175
+ return false;
1176
+ }
1177
+
1178
+ satisfies(requested) {
1179
+ if (requested instanceof Edge) {
1180
+ return this.name === requested.name && requested.satisfiedBy(this);
1181
+ }
1182
+
1183
+ const parsed = npa(requested);
1184
+ const { name = this.name, rawSpec: spec } = parsed;
1185
+ return (
1186
+ this.name === name &&
1187
+ this.satisfies(
1188
+ new Edge({
1189
+ from: new Node({ path: this.root.realpath }),
1190
+ type: "prod",
1191
+ name,
1192
+ spec,
1193
+ }),
1194
+ )
1195
+ );
1196
+ }
1197
+
1198
+ matches(node) {
1199
+ // if the nodes are literally the same object, obviously a match.
1200
+ if (node === this) {
1201
+ return true;
1202
+ }
1203
+
1204
+ // if the names don't match, they're different things, even if
1205
+ // the package contents are identical.
1206
+ if (node.name !== this.name) {
1207
+ return false;
1208
+ }
1209
+
1210
+ // if they're links, they match if the targets match
1211
+ if (this.isLink) {
1212
+ return node.isLink && this.target.matches(node.target);
1213
+ }
1214
+
1215
+ // if they're two project root nodes, they're different if the paths differ
1216
+ if (this.isProjectRoot && node.isProjectRoot) {
1217
+ return this.path === node.path;
1218
+ }
1219
+
1220
+ // if the integrity matches, then they're the same.
1221
+ if (this.integrity && node.integrity) {
1222
+ return this.integrity === node.integrity;
1223
+ }
1224
+
1225
+ // if no integrity, check resolved
1226
+ if (this.resolved && node.resolved) {
1227
+ return this.resolved === node.resolved;
1228
+ }
1229
+
1230
+ // if no resolved, check both package name and version
1231
+ // otherwise, conclude that they are different things
1232
+ return (
1233
+ this.packageName &&
1234
+ node.packageName &&
1235
+ this.packageName === node.packageName &&
1236
+ this.version &&
1237
+ node.version &&
1238
+ this.version === node.version
1239
+ );
1240
+ }
1241
+
1242
+ // replace this node with the supplied argument
1243
+ // Useful when mutating an ideal tree, so we can avoid having to call
1244
+ // the parent/root setters more than necessary.
1245
+ replaceWith(node) {
1246
+ node.replace(this);
1247
+ }
1248
+
1249
+ replace(node) {
1250
+ this[_delistFromMeta]();
1251
+
1252
+ // if the name matches, but is not identical, we are intending to clobber
1253
+ // something case-insensitively, so merely setting name and path won't
1254
+ // have the desired effect. just set the path so it'll collide in the
1255
+ // parent's children map, and leave it at that.
1256
+ if (node.parent?.children.get(this.name) === node) {
1257
+ this.path = resolve(node.parent.path, "node_modules", this.name);
1258
+ } else {
1259
+ this.path = node.path;
1260
+ this.name = node.name;
1261
+ }
1262
+
1263
+ if (!this.isLink) {
1264
+ this.realpath = this.path;
1265
+ }
1266
+ this[_refreshLocation]();
1267
+
1268
+ // keep children when a node replaces another
1269
+ if (!this.isLink) {
1270
+ for (const kid of node.children.values()) {
1271
+ kid.parent = this;
1272
+ }
1273
+ if (node.isLink && node.target) {
1274
+ node.target.root = null;
1275
+ }
1276
+ }
1277
+
1278
+ if (!node.isRoot) {
1279
+ this.root = node.root;
1280
+ }
1281
+
1282
+ treeCheck(this);
1283
+ }
1284
+
1285
+ get parent() {
1286
+ // setter prevents _parent from being this
1287
+ return this[_parent];
1288
+ }
1289
+
1290
+ // This setter keeps everything in order when we move a node from
1291
+ // one point in a logical tree to another. Edges get reloaded,
1292
+ // metadata updated, etc. It's also called when we *replace* a node
1293
+ // with another by the same name (eg, to update or dedupe).
1294
+ // This does a couple of walks out on the node_modules tree, recursing
1295
+ // into child nodes. However, as setting the parent is typically done
1296
+ // with nodes that don't have many children, and (deduped) package
1297
+ // trees tend to be broad rather than deep, it's not that bad.
1298
+ // The only walk that starts from the parent rather than this node is
1299
+ // limited by edge name.
1300
+ set parent(parent) {
1301
+ // when setting to null, just remove it from the tree entirely
1302
+ if (!parent) {
1303
+ // but only delete it if we actually had a parent in the first place
1304
+ // otherwise it's just setting to null when it's already null
1305
+ if (this[_parent]) {
1306
+ this.root = null;
1307
+ }
1308
+ return;
1309
+ }
1310
+
1311
+ if (parent.isLink) {
1312
+ parent = parent.target;
1313
+ }
1314
+
1315
+ // setting a thing to its own parent is not normal, but no-op for safety
1316
+ if (this === parent) {
1317
+ return;
1318
+ }
1319
+
1320
+ const oldParent = this[_parent];
1321
+
1322
+ // nothing to do
1323
+ if (oldParent === parent) {
1324
+ return;
1325
+ }
1326
+
1327
+ // ok now we know something is actually changing, and parent is not a link
1328
+ const newPath = resolve(parent.path, "node_modules", this.name);
1329
+ const pathChange = newPath !== this.path;
1330
+
1331
+ // remove from old parent/fsParent
1332
+ if (oldParent) {
1333
+ oldParent.children.delete(this.name);
1334
+ this[_parent] = null;
1335
+ }
1336
+ if (this.fsParent) {
1337
+ this.fsParent.fsChildren.delete(this);
1338
+ this[_fsParent] = null;
1339
+ }
1340
+
1341
+ // update this.path/realpath for this and all children/fsChildren
1342
+ if (pathChange) {
1343
+ this[_changePath](newPath);
1344
+ }
1345
+
1346
+ // clobbers anything at that path, resets all appropriate references
1347
+ this.root = parent.root;
1348
+ }
1349
+
1350
+ // Call this before changing path or updating the _root reference.
1351
+ // Removes the node from its root the metadata and inventory.
1352
+ [_delistFromMeta]() {
1353
+ const root = this.root;
1354
+ if (!root.realpath || !this.path) {
1355
+ return;
1356
+ }
1357
+ root.inventory.delete(this);
1358
+ root.tops.delete(this);
1359
+ if (root.meta) {
1360
+ root.meta.delete(this.path);
1361
+ }
1362
+ /* istanbul ignore next - should be impossible */
1363
+ debug(() => {
1364
+ if ([...root.inventory.values()].includes(this)) {
1365
+ throw new Error("failed to delist");
1366
+ }
1367
+ });
1368
+ }
1369
+
1370
+ // update this.path/realpath and the paths of all children/fsChildren
1371
+ [_changePath](newPath) {
1372
+ // have to de-list before changing paths
1373
+ this[_delistFromMeta]();
1374
+ const oldPath = this.path;
1375
+ this.path = newPath;
1376
+ const namePattern =
1377
+ /(?:^|\/|\\)node_modules[\\/](@[^/\\]+[\\/][^\\/]+|[^\\/]+)$/;
1378
+ const nameChange = newPath.match(namePattern);
1379
+ if (nameChange && this.name !== nameChange[1]) {
1380
+ this.name = nameChange[1].replace(/\\/g, "/");
1381
+ }
1382
+
1383
+ // if we move a link target, update link realpaths
1384
+ if (!this.isLink) {
1385
+ this.realpath = newPath;
1386
+ for (const link of this.linksIn) {
1387
+ link[_delistFromMeta]();
1388
+ link.realpath = newPath;
1389
+ link[_refreshLocation]();
1390
+ }
1391
+ }
1392
+ // if we move /x to /y, then a module at /x/a/b becomes /y/a/b
1393
+ for (const child of this.fsChildren) {
1394
+ child[_changePath](resolve(newPath, relative(oldPath, child.path)));
1395
+ }
1396
+ for (const [name, child] of this.children.entries()) {
1397
+ child[_changePath](resolve(newPath, "node_modules", name));
1398
+ }
1399
+
1400
+ this[_refreshLocation]();
1401
+ }
1402
+
1403
+ // Called whenever the root/parent is changed.
1404
+ // NB: need to remove from former root's meta/inventory and then update
1405
+ // this.path BEFORE calling this method!
1406
+ [_refreshLocation]() {
1407
+ const root = this.root;
1408
+ const loc = relpath(root.realpath, this.path);
1409
+
1410
+ this.location = loc;
1411
+
1412
+ root.inventory.add(this);
1413
+ if (root.meta) {
1414
+ root.meta.add(this);
1415
+ }
1416
+ }
1417
+
1418
+ assertRootOverrides() {
1419
+ if (!this.isProjectRoot || !this.overrides) {
1420
+ return;
1421
+ }
1422
+
1423
+ for (const edge of this.edgesOut.values()) {
1424
+ // if these differ an override has been applied, those are not allowed
1425
+ // for top level dependencies so throw an error
1426
+ if (edge.spec !== edge.rawSpec && !edge.spec.startsWith("$")) {
1427
+ throw Object.assign(
1428
+ new Error(
1429
+ `Override for ${edge.name}@${edge.rawSpec} conflicts with direct dependency`,
1430
+ ),
1431
+ { code: "EOVERRIDE" },
1432
+ );
1433
+ }
1434
+ }
1435
+ }
1436
+
1437
+ addEdgeOut(edge) {
1438
+ if (this.overrides) {
1439
+ edge.overrides = this.overrides.getEdgeRule(edge);
1440
+ }
1441
+
1442
+ this.edgesOut.set(edge.name, edge);
1443
+ }
1444
+
1445
+ recalculateOutEdgesOverrides() {
1446
+ // For each edge out propagate the new overrides through.
1447
+ for (const edge of this.edgesOut.values()) {
1448
+ edge.reload(true);
1449
+ if (edge.to) {
1450
+ edge.to.updateOverridesEdgeInAdded(edge.overrides);
1451
+ }
1452
+ }
1453
+ }
1454
+
1455
+ updateOverridesEdgeInRemoved(otherOverrideSet) {
1456
+ // If this edge's overrides isn't equal to this node's overrides, then removing it won't change newOverrideSet later.
1457
+ if (!this.overrides || !this.overrides.isEqual(otherOverrideSet)) {
1458
+ return false;
1459
+ }
1460
+ let newOverrideSet;
1461
+ for (const edge of this.edgesIn) {
1462
+ if (newOverrideSet && edge.overrides) {
1463
+ newOverrideSet = OverrideSet.findSpecificOverrideSet(
1464
+ edge.overrides,
1465
+ newOverrideSet,
1466
+ );
1467
+ } else {
1468
+ newOverrideSet = edge.overrides;
1469
+ }
1470
+ }
1471
+ if (this.overrides.isEqual(newOverrideSet)) {
1472
+ return false;
1473
+ }
1474
+ this.overrides = newOverrideSet;
1475
+ if (this.overrides) {
1476
+ // Optimization: if there's any override set at all, then no non-extraneous node has an empty override set. So if we temporarily have no
1477
+ // override set (for example, we removed all the edges in), there's no use updating all the edges out right now. Let's just wait until
1478
+ // we have an actual override set later.
1479
+ this.recalculateOutEdgesOverrides();
1480
+ }
1481
+ return true;
1482
+ }
1483
+
1484
+ // This logic isn't perfect either. When we have two edges in that have different override sets, then we have to decide which set is correct.
1485
+ // This function assumes the more specific override set is applicable, so if we have dependencies A->B->C and A->C
1486
+ // and an override set that specifies what happens for C under A->B, this will work even if the new A->C edge comes along and tries to change
1487
+ // the override set.
1488
+ // The strictly correct logic is not to allow two edges with different overrides to point to the same node, because even if this node can satisfy
1489
+ // both, one of its dependencies might need to be different depending on the edge leading to it.
1490
+ // However, this might cause a lot of duplication, because the conflict in the dependencies might never actually happen.
1491
+ updateOverridesEdgeInAdded(otherOverrideSet) {
1492
+ if (!otherOverrideSet) {
1493
+ // Assuming there are any overrides at all, the overrides field is never undefined for any node at the end state of the tree.
1494
+ // So if the new edge's overrides is undefined it will be updated later. So we can wait with updating the node's overrides field.
1495
+ return false;
1496
+ }
1497
+ if (!this.overrides) {
1498
+ this.overrides = otherOverrideSet;
1499
+ this.recalculateOutEdgesOverrides();
1500
+ return true;
1501
+ }
1502
+ if (this.overrides.isEqual(otherOverrideSet)) {
1503
+ return false;
1504
+ }
1505
+ const newOverrideSet = OverrideSet.findSpecificOverrideSet(
1506
+ this.overrides,
1507
+ otherOverrideSet,
1508
+ );
1509
+ if (newOverrideSet) {
1510
+ if (!this.overrides.isEqual(newOverrideSet)) {
1511
+ this.overrides = newOverrideSet;
1512
+ this.recalculateOutEdgesOverrides();
1513
+ return true;
1514
+ }
1515
+ return false;
1516
+ }
1517
+ // This is an error condition. We can only get here if the new override set is in conflict with the existing.
1518
+ log.silly("Conflicting override sets", this.name);
1519
+ }
1520
+
1521
+ deleteEdgeIn(edge) {
1522
+ this.edgesIn.delete(edge);
1523
+ if (edge.overrides) {
1524
+ this.updateOverridesEdgeInRemoved(edge.overrides);
1525
+ }
1526
+ }
1527
+
1528
+ addEdgeIn(edge) {
1529
+ // We need to handle the case where the new edge in has an overrides field which is different from the current value.
1530
+ if (!this.overrides || !this.overrides.isEqual(edge.overrides)) {
1531
+ this.updateOverridesEdgeInAdded(edge.overrides);
1532
+ }
1533
+
1534
+ this.edgesIn.add(edge);
1535
+
1536
+ // try to get metadata from the yarn.lock file
1537
+ if (this.root.meta) {
1538
+ this.root.meta.addEdge(edge);
1539
+ }
1540
+ }
1541
+
1542
+ [_reloadNamedEdges](name, rootLoc = this.location) {
1543
+ const edge = this.edgesOut.get(name);
1544
+ // if we don't have an edge, do nothing, but keep descending
1545
+ const rootLocResolved =
1546
+ edge &&
1547
+ edge.to &&
1548
+ edge.to.location === `${rootLoc}/node_modules/${edge.name}`;
1549
+ const sameResolved = edge && this.resolve(name) === edge.to;
1550
+ const recheck = rootLocResolved || !sameResolved;
1551
+ if (edge && recheck) {
1552
+ edge.reload(true);
1553
+ }
1554
+ for (const c of this.children.values()) {
1555
+ c[_reloadNamedEdges](name, rootLoc);
1556
+ }
1557
+
1558
+ for (const c of this.fsChildren) {
1559
+ c[_reloadNamedEdges](name, rootLoc);
1560
+ }
1561
+ }
1562
+
1563
+ get isLink() {
1564
+ return false;
1565
+ }
1566
+
1567
+ get target() {
1568
+ return this;
1569
+ }
1570
+
1571
+ set target(n) {
1572
+ debug(() => {
1573
+ throw Object.assign(new Error("cannot set target on non-Link Nodes"), {
1574
+ path: this.path,
1575
+ });
1576
+ });
1577
+ }
1578
+
1579
+ get depth() {
1580
+ if (this.isTop) {
1581
+ return 0;
1582
+ }
1583
+ return this.parent.depth + 1;
1584
+ }
1585
+
1586
+ get isTop() {
1587
+ return !this.parent || this.globalTop;
1588
+ }
1589
+
1590
+ get top() {
1591
+ if (this.isTop) {
1592
+ return this;
1593
+ }
1594
+ return this.parent.top;
1595
+ }
1596
+
1597
+ get isFsTop() {
1598
+ return !this.fsParent;
1599
+ }
1600
+
1601
+ get fsTop() {
1602
+ if (this.isFsTop) {
1603
+ return this;
1604
+ }
1605
+ return this.fsParent.fsTop;
1606
+ }
1607
+
1608
+ get resolveParent() {
1609
+ return this.parent || this.fsParent;
1610
+ }
1611
+
1612
+ resolve(name) {
1613
+ /* istanbul ignore next - should be impossible,
1614
+ * but I keep doing this mistake in tests */
1615
+ debug(() => {
1616
+ if (typeof name !== "string" || !name) {
1617
+ throw new Error("non-string passed to Node.resolve");
1618
+ }
1619
+ });
1620
+ const mine = this.children.get(name);
1621
+ if (mine) {
1622
+ return mine;
1623
+ }
1624
+ const resolveParent = this.resolveParent;
1625
+ if (resolveParent) {
1626
+ return resolveParent.resolve(name);
1627
+ }
1628
+ return null;
1629
+ }
1630
+
1631
+ inNodeModules() {
1632
+ const rp = this.realpath;
1633
+ const name = this.name;
1634
+ const scoped = name.charAt(0) === "@";
1635
+ const d = dirname(rp);
1636
+ const nm = scoped ? dirname(d) : d;
1637
+ const dir = dirname(nm);
1638
+ const base = scoped ? `${basename(d)}/${basename(rp)}` : basename(rp);
1639
+ return base === name && basename(nm) === "node_modules" ? dir : false;
1640
+ }
1641
+
1642
+ // maybe accept both string value or array of strings
1643
+ // seems to be what dom API does
1644
+ querySelectorAll(query, opts) {
1645
+ return querySelectorAll(this, query, opts);
1646
+ }
1647
+
1648
+ toJSON() {
1649
+ return printableTree(this);
1650
+ }
1651
+
1652
+ [util.inspect.custom]() {
1653
+ return this.toJSON();
1654
+ }
1655
+
1656
+ resetDepFlags() {
1657
+ this.extraneous = true;
1658
+ this.dev = true;
1659
+ this.optional = true;
1660
+ this.devOptional = true;
1661
+ this.peer = true;
1662
+ }
1663
+
1664
+ unsetDepFlags() {
1665
+ this.extraneous = false;
1666
+ this.dev = false;
1667
+ this.optional = false;
1668
+ this.devOptional = false;
1669
+ this.peer = false;
1670
+ }
1671
+ }
1672
+
1673
+ export default Node;