@cdxgen/cdxgen 13.0.0 → 13.1.0

package/lib/validator/bomValidator.js

@@ -694,9 +694,18 @@ export const validatePurls = (bomJson) => {
       errorList.push(`Invalid purl ${purl} at ${where}`);
     }
   }
-  if (frameworksCount > 20) {
+  // A flat cap of 20 was a proxy for "the framework heuristic has over-fired", but it
+  // scales with the size of the dependency tree rather than with any defect: a modern
+  // Python or JavaScript application legitimately depends on dozens of components that
+  // `data/frameworks-list.json` and the PyPI `Framework ::` classifiers correctly
+  // identify as frameworks. Comparing against a share of the tree keeps the check
+  // meaningful for small BOMs, where a high framework count really is suspicious, and
+  // stops it firing on large ones purely for being large.
+  const componentsCount = bomJson?.components?.length || 0;
+  const frameworksLimit = Math.max(20, Math.ceil(componentsCount * 0.25));
+  if (frameworksCount > frameworksLimit) {
     warningsList.push(
-      `BOM likey has too many framework components. Count: ${frameworksCount}`,
+      `BOM likely has too many framework components. Count: ${frameworksCount} of ${componentsCount} components.`,
     );
   }
   if (DEBUG_MODE && warningsList.length !== 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cdxgen/cdxgen",
-  "version": "13.0.0",
+  "version": "13.1.0",
   "description": "Creates CycloneDX Software Bill of Materials (SBOM) from source or container image",
   "keywords": [
     "sbom",
@@ -150,7 +150,7 @@
     "yargs": "18.1.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.7",
+    "@biomejs/biome": "2.5.11",
     "esmock": "2.7.6",
     "poku": "4.5.0",
     "sinon": "22.1.0",
@@ -162,17 +162,17 @@
     "@bufbuild/protobuf": "2.13.0",
     "@cdxgen/cdx-hbom": "0.5.1",
     "@cdxgen/cdx-proto": "2.2.0",
-    "@cdxgen/cdxgen-plugins-bin": "3.0.3",
-    "@cdxgen/cdxgen-plugins-bin-darwin-amd64": "3.0.3",
-    "@cdxgen/cdxgen-plugins-bin-darwin-arm64": "3.0.3",
-    "@cdxgen/cdxgen-plugins-bin-linux-amd64": "3.0.3",
-    "@cdxgen/cdxgen-plugins-bin-linux-arm": "3.0.3",
-    "@cdxgen/cdxgen-plugins-bin-linux-arm64": "3.0.3",
-    "@cdxgen/cdxgen-plugins-bin-linux-ppc64": "3.0.3",
-    "@cdxgen/cdxgen-plugins-bin-linuxmusl-amd64": "3.0.3",
-    "@cdxgen/cdxgen-plugins-bin-linuxmusl-arm64": "3.0.3",
-    "@cdxgen/cdxgen-plugins-bin-windows-amd64": "3.0.3",
-    "@cdxgen/cdxgen-plugins-bin-windows-arm64": "3.0.3",
+    "@cdxgen/cdxgen-plugins-bin": "3.1.0",
+    "@cdxgen/cdxgen-plugins-bin-darwin-amd64": "3.1.0",
+    "@cdxgen/cdxgen-plugins-bin-darwin-arm64": "3.1.0",
+    "@cdxgen/cdxgen-plugins-bin-linux-amd64": "3.1.0",
+    "@cdxgen/cdxgen-plugins-bin-linux-arm": "3.1.0",
+    "@cdxgen/cdxgen-plugins-bin-linux-arm64": "3.1.0",
+    "@cdxgen/cdxgen-plugins-bin-linux-ppc64": "3.1.0",
+    "@cdxgen/cdxgen-plugins-bin-linuxmusl-amd64": "3.1.0",
+    "@cdxgen/cdxgen-plugins-bin-linuxmusl-arm64": "3.1.0",
+    "@cdxgen/cdxgen-plugins-bin-windows-amd64": "3.1.0",
+    "@cdxgen/cdxgen-plugins-bin-windows-arm64": "3.1.0",
     "@cdxgen/safer-exec": "0.15.0",
     "body-parser": "2.3.0",
     "compression": "1.8.1",
@@ -197,7 +197,7 @@
       },
       {
         "name": "deno",
-        "version": "2.8.3",
+        "version": "2.9.6",
         "onFail": "ignore"
       }
     ]

package/types/lib/audit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/audit/index.js"],"names":[],"mappings":"AAqEA,yFAAyF;AACzF,eAAO,MAAM,wBAAwB,UAKpC,CAAC;AAuCF;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAHxB,MAGwB,GAFtB,MAAM,CAclB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAHxB,MAGwB,GAFtB,MAAM,EAAE,CAoBpB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAAE,CA0BjD;AA+CD;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAAC,SAAS,EAJ9C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAIW,EAAE,OAAO,AAH/D,CACA,EADQ,MAG4D,GAF1D,OAAO,CAAC,MAAM,CAAC,CAmE3B;AA4bD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAHtC,MAGsC,GAFpC,MAAM,EAAE,CAqdpB;AA0JD;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAJ1C,MAI0C,EAAE,MAAM,EAHlD,MAGkD,GAFhD;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CA0CnD;AAoCD;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAL1C,MAK0C,EAAE,MAAM,EAJlD,MAIkD,EAAE,UAAU,EAH9D,MAG8D,GAF5D;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CASnD;AAmGD;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAJ/C,MAI+C,EAAE,MAAM,EAHvD,MAGuD,GAFrD,MAAM,EAAE,CAkEpB;AAgKD;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAwQ3B;AAoVD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAAM,EAGwB,GAF5B,MAAM,EAAE,CAgDpB;AAoBD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,SAAS,EAJrC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAIE,EAAE,OAAO,EAH9C,MAG8C,GAF5C,OAAO,CAAC,MAAM,CAAC,CAiJ3B;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAH3B,MAG2B,GAFzB,OAAO,CAAC,MAAM,CAAC,CA0B3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EALnC,MAKmC,EAAE,SAAS,EAJ9C,MAAM,EAIwC,EAAE,MAAM,EAHtD,MAAM,GAAC,IAG+C,GAFpD,IAAI,CAwChB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAwChD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,GAF5B,MAAM,GAAG,SAAS,CAU9B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/audit/index.js"],"names":[],"mappings":"AA6EA,yFAAyF;AACzF,eAAO,MAAM,wBAAwB,UAKpC,CAAC;AAuCF;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAHxB,MAGwB,GAFtB,MAAM,CAclB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAHxB,MAGwB,GAFtB,MAAM,EAAE,CAoBpB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAAE,CA0BjD;AA+CD;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAAC,SAAS,EAJ9C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAIW,EAAE,OAAO,AAH/D,CACA,EADQ,MAG4D,GAF1D,OAAO,CAAC,MAAM,CAAC,CAuG3B;AA4bD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAHtC,MAGsC,GAFpC,MAAM,EAAE,CAqdpB;AA0JD;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAJ1C,MAI0C,EAAE,MAAM,EAHlD,MAGkD,GAFhD;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CA0CnD;AAoCD;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAL1C,MAK0C,EAAE,MAAM,EAJlD,MAIkD,EAAE,UAAU,EAH9D,MAG8D,GAF5D;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CASnD;AAmGD;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAJ/C,MAI+C,EAAE,MAAM,EAHvD,MAGuD,GAFrD,MAAM,EAAE,CAkEpB;AAgKD;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAwQ3B;AAoVD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAAM,EAGwB,GAF5B,MAAM,EAAE,CAgDpB;AAoBD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,SAAS,EAJrC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAIE,EAAE,OAAO,EAH9C,MAG8C,GAF5C,OAAO,CAAC,MAAM,CAAC,CAiJ3B;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAH3B,MAG2B,GAFzB,OAAO,CAAC,MAAM,CAAC,CA0B3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EALnC,MAKmC,EAAE,SAAS,EAJ9C,MAAM,EAIwC,EAAE,MAAM,EAHtD,MAAM,GAAC,IAG+C,GAFpD,IAAI,CAwChB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAwChD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,GAF5B,MAAM,GAAG,SAAS,CAU9B"}

package/types/lib/audit/scoring.d.ts

@@ -1,11 +1,5 @@
-/** Map of severity names to numeric ordering used for threshold comparisons. */
-export declare const SEVERITY_ORDER: {
-    none: number;
-    low: number;
-    medium: number;
-    high: number;
-    critical: number;
-};
+import { SEVERITY_ORDER } from "../core/severity.js";
+export { SEVERITY_ORDER };
 /**
  * Convert a numeric confidence score into a human readable label.
  *

package/types/lib/audit/scoring.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scoring.d.ts","sourceRoot":"","sources":["../../../lib/audit/scoring.js"],"names":[],"mappings":"AAMA,gFAAgF;AAChF,eAAO,MAAM,cAAc;IACzB,IAAI;IACJ,GAAG;IACH,MAAM;IACN,IAAI;IACJ,QAAQ;CACT,CAAC;AAwKF;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAH/B,MAG+B,GAF7B,MAAM,CAUlB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAJpC,MAIoC,EAAE,SAAS,EAH/C,MAG+C,GAF7C,OAAO,CAMnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAL7B,MAAM,EAKuB,EAAE,MAAM,EAJrC,MAIqC,EAAE,OAAO,GAH9C,MAGmD,GAFjD,MAAM,CAoVlB"}
+{"version":3,"file":"scoring.d.ts","sourceRoot":"","sources":["../../../lib/audit/scoring.js"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAMrD,OAAO,EAAE,cAAc,EAAE,CAAC;AAwK1B;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAH/B,MAG+B,GAF7B,MAAM,CAUlB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAJpC,MAIoC,EAAE,SAAS,EAH/C,MAG+C,GAF7C,OAAO,CAMnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAL7B,MAAM,EAKuB,EAAE,MAAM,EAJrC,MAIqC,EAAE,OAAO,GAH9C,MAGmD,GAFjD,MAAM,CAoVlB"}

package/types/lib/cli/bomAssembly.d.ts

@@ -180,8 +180,22 @@ export declare function determinePackageType(pkg: any): any;
 export declare function processHashes(pkg: any, component: any): void;
 /**
  * Adds a hash to component.
+ *
+ * Registries hand out digests in hex or in the base64 form npm uses for
+ * `integrity`, and both are accepted. A digest that is neither, or that decodes
+ * to the wrong length for its algorithm, is dropped rather than copied through:
+ * CycloneDX constrains `hash.content` to a hex digest, so emitting it anyway
+ * fails schema validation for the whole document over one bad package.
  */
 export declare function addComponentHash(alg: any, digest: any, component: any): void;
+/**
+ * Normalize a digest to the lower-case hex form CycloneDX requires.
+ *
+ * @param {string} alg Hash algorithm name
+ * @param {string} digest Digest in hex or base64
+ * @returns {string|undefined} Hex digest, or undefined when it cannot be trusted
+ */
+export declare function normalizeHashContent(alg: string, digest: string): string | undefined;
 /**
  * Return the BOM in json format including any namespace mapping
  *

package/types/lib/cli/bomAssembly.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bomAssembly.d.ts","sourceRoot":"","sources":["../../../lib/cli/bomAssembly.js"],"names":[],"mappings":"AA8DA;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,aAJ7B,MAAM,qBACN,MAAM,EAAE,KACN,OAsBZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,EAFf,MAG8E,CAAC;AAEzF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,0CAH9B,MAAM;;;;;CAwChB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,YAJ1B,MAAM,KACJ,MAAM,GAAC,SAyBnB,CAAC;AA+DF;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,YALjB,MAAM,YACN,MAAM,KACJ;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CA+CrD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,SAH3B,MAAM,KACJ,MAQZ,CAAC;AAEF;;;;;;;GAOG;AAGH,eAAO,MAAM,oBAAoB,SALtB,MAAM,KACJ,MAwBZ,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,YAHnB,MAAM,KACJ,MAAM,EAgBlB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,YAHtB,MAAM,UAwBhB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,eAAe,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;;;qBAzJhD,MAAM,EAAE;gBAAU,MAAM,EAAE;;;;EA0gBrD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAH/B,QAAQ,MAGuB,SAyCzC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAN3B,MAM2B,EAAE,UAAU,EALvC,MAKuC,EAAE,GAAG,EAJ5C,MAI4C,EAAE,KAAK,GAHnD,MAG2D,GAFzD,MAAM,EAAE,CAcpB;AAED;;;;GAIG;AAEH,eAAO,MAAM,cAAc,EAHjB,MAAM,EAGqD,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAFxB,MAEyC,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAJjC,MAIiC,EAAE,YAAY,EAH/C,MAG+C,GAF7C,MAAM,EAAE,CASpB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAOpB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAHlC,MAGkC,GAFhC,GAAG,CAAC,MAAM,CAAC,CA6BvB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAJxC,MAIwC,EAAE,GAAG,EAH7C,MAG6C,GAF3C,OAAO,CAiBnB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,OAAO,KAAA,EACP,UAAU,KAAA,EACV,GAAG,KAAA,EACH,KAAK,KAAA,EACL,OAAO,KAAA,EACP,SAAS,UAAQ,QAiPlB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,KAAA,OA+EvC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,KAAA,EAAE,SAAS,KAAA,QA8B3C;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,KAAA,EAAE,MAAM,KAAA,EAAE,SAAS,KAAA,QAetD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,YAPhB,MAAM,WACN,MAAM,SACN,MAAM,WACN,MAAM,KAEJ,MA6FZ,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAI5B;AAiDD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAHzC,MAGyC,GAFvC,MAAM,EAAE,CAMpB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAHxC,MAGwC,GAFtC,MAAM,EAAE,CAMpB;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,wBAAwB,EALf,MAAM,EAKS,EACxB,wBAAwB,EALf,MAAM,EAKS,GAJb,MAAM,EAAE,CASpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAHxC,MAGwC,GAFtC,MAAM,EAAE,CAyBpB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAHpC,MAGoC,GAFlC,MAAM,GAAC,SAAS,CAS5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,wBAAwB,EAHtD,MAAM,EAGgD,GAFpD,OAAO,CAInB;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EALvC,MAAM,EAKiC,EAAE,aAAa,EAJtD,MAIsD,EAAE,OAAO,EAH/D,GAAG,CAAC,MAAM,CAGqD,GAF7D,MAAM,EAAE,CAgBpB;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,QAAQ,EAH9C,MAAM,EAGwC,GAF5C,MAAM,EAAE,CAQpB;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EALvC,MAKuC,EAAE,KAAK,EAJ9C,MAI8C,EAAE,QAAQ,EAHxD,MAAM,EAGkD,GAFtD,MAAM,CAIlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAJvC,MAIuC,EAAE,aAAa,EAHtD,MAGsD,GAFpD,IAAI,CAyDhB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAPtB,MAOsB,EAAE,UAAU,OAAA,EAAE,eAAe,EALnD,MAKmD,EAAE,YAAY,OAAA,GAF/D,MAAM,CA8ClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,YAJjC,MAAM,mBACN,MAAM,KACJ,OAYZ,CAAC"}
+{"version":3,"file":"bomAssembly.d.ts","sourceRoot":"","sources":["../../../lib/cli/bomAssembly.js"],"names":[],"mappings":"AA8DA;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,aAJ7B,MAAM,qBACN,MAAM,EAAE,KACN,OAsBZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,EAFf,MAG8E,CAAC;AAEzF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,0CAH9B,MAAM;;;;;CAwChB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,YAJ1B,MAAM,KACJ,MAAM,GAAC,SAyBnB,CAAC;AAqFF;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,YALjB,MAAM,YACN,MAAM,KACJ;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CA+CrD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,SAH3B,MAAM,KACJ,MAQZ,CAAC;AAEF;;;;;;;GAOG;AAGH,eAAO,MAAM,oBAAoB,SALtB,MAAM,KACJ,MAwBZ,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,YAHnB,MAAM,KACJ,MAAM,EAgBlB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,YAHtB,MAAM,UAwBhB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,eAAe,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;;;qBAzJhD,MAAM,EAAE;gBAAU,MAAM,EAAE;;;;EA0gBrD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAH/B,QAAQ,MAGuB,SAyCzC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAN3B,MAM2B,EAAE,UAAU,EALvC,MAKuC,EAAE,GAAG,EAJ5C,MAI4C,EAAE,KAAK,GAHnD,MAG2D,GAFzD,MAAM,EAAE,CAcpB;AAED;;;;GAIG;AAEH,eAAO,MAAM,cAAc,EAHjB,MAAM,EAGqD,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAFxB,MAEyC,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAJjC,MAIiC,EAAE,YAAY,EAH/C,MAG+C,GAF7C,MAAM,EAAE,CASpB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAOpB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAHlC,MAGkC,GAFhC,GAAG,CAAC,MAAM,CAAC,CA6BvB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAJxC,MAIwC,EAAE,GAAG,EAH7C,MAG6C,GAF3C,OAAO,CAiBnB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,OAAO,KAAA,EACP,UAAU,KAAA,EACV,GAAG,KAAA,EACH,KAAK,KAAA,EACL,OAAO,KAAA,EACP,SAAS,UAAQ,QAiPlB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,KAAA,OA+EvC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,KAAA,EAAE,SAAS,KAAA,QA6B3C;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,KAAA,EAAE,MAAM,KAAA,EAAE,SAAS,KAAA,QAMtD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAJ7B,MAI6B,EAAE,MAAM,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CAoB5B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,YAPhB,MAAM,WACN,MAAM,SACN,MAAM,WACN,MAAM,KAEJ,MA+FZ,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAI5B;AAiDD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAHzC,MAGyC,GAFvC,MAAM,EAAE,CAMpB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAHxC,MAGwC,GAFtC,MAAM,EAAE,CAMpB;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,wBAAwB,EALf,MAAM,EAKS,EACxB,wBAAwB,EALf,MAAM,EAKS,GAJb,MAAM,EAAE,CASpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAHxC,MAGwC,GAFtC,MAAM,EAAE,CAyBpB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAHpC,MAGoC,GAFlC,MAAM,GAAC,SAAS,CAS5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,wBAAwB,EAHtD,MAAM,EAGgD,GAFpD,OAAO,CAInB;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EALvC,MAAM,EAKiC,EAAE,aAAa,EAJtD,MAIsD,EAAE,OAAO,EAH/D,GAAG,CAAC,MAAM,CAGqD,GAF7D,MAAM,EAAE,CAgBpB;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,QAAQ,EAH9C,MAAM,EAGwC,GAF5C,MAAM,EAAE,CAQpB;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EALvC,MAKuC,EAAE,KAAK,EAJ9C,MAI8C,EAAE,QAAQ,EAHxD,MAAM,EAGkD,GAFtD,MAAM,CAIlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAJvC,MAIuC,EAAE,aAAa,EAHtD,MAGsD,GAFpD,IAAI,CAyDhB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAPtB,MAOsB,EAAE,UAAU,OAAA,EAAE,eAAe,EALnD,MAKmD,EAAE,YAAY,OAAA,GAF/D,MAAM,CA8ClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,YAJjC,MAAM,mBACN,MAAM,KACJ,OAYZ,CAAC"}

package/types/lib/cli/cliOptions.d.ts

@@ -50,7 +50,8 @@ export declare function isUserProvided(value: any, yaDefault: any): boolean;
  * @returns {object} A shallow copy of args with alias-based defaults applied
  */
 export declare function applyCommandNameDefaults(args: object, invokedCommandName: string): object;
-export declare function buildInitialOptions(args: any, { filePath, isRemoteOrPurl }: {
+export declare function buildInitialOptions(args: any, { filePath, isRemoteOrPurl, argv }: {
+    argv?: any;
     filePath: any;
     isRemoteOrPurl: any;
 }): any;

package/types/lib/cli/cliOptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cliOptions.d.ts","sourceRoot":"","sources":["../../../lib/cli/cliOptions.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAmBH;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAJpC,MAIoC,EAAE,WAAW,AAHzD,CACA,EADQ,MAG4D,GAF1D,MAAM,GAAC,IAAI,CAoBvB;AA6BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAJzB,GAIyB,EAAE,SAAS,EAHpC,GAGoC,GAFlC,OAAO,CAInB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,kBAAkB,EAHtD,MAGsD,GAFpD,MAAM,CAoBlB;AAwCD,wBAAgB,mBAAmB,CAAC,IAAI,KAAA,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE;;;CAAA,OAyCrE;AAGE,YAAkB,cAAc,GAChC;;;;IAAkC,KAAK,EAA5B,MAAM,GAAC,MAAM,GAAC,OAAO,CAChC;;;;IAAkC,OAAO,EAA9B,MAAM,CACnB;CAAA,CAAA;AAJD;;;;GAIG;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAR3C,MAQ2C,EAAE,OAAO,EAN5D;IAAwB,kBAAkB,EAAlC,MAAM,CACd;IAAyB,kBAAkB,EAAnC,OAAO,CAEf;IAA0B,QAAQ,AAAlC,CACA,EADQ,OAAO,CACf;CAE4D,GAFlD,cAAc,EAAE,CAoF5B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EALjC,MAKiC,EAAE,OAAO,AAJlD,CAEA,EADA;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;CAEuD,GAF7C,cAAc,EAAE,CA+G5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAX9B,MAW8B,EAAE,OAAO,EAT/C;IAAwB,kBAAkB,EAAlC,MAAM,CACd;IAAwB,QAAQ,EAAxB,MAAM,CACd;IAAyB,cAAc,EAA/B,OAAO,CACf;IAAyB,kBAAkB,EAAnC,OAAO,CAEf;IAA0B,QAAQ,AAAlC,CACA,EADQ,OAAO,CACf;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;CAE+C,GAFrC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;CAAE,CA6B3D"}
+{"version":3,"file":"cliOptions.d.ts","sourceRoot":"","sources":["../../../lib/cli/cliOptions.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAoBH;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAJpC,MAIoC,EAAE,WAAW,AAHzD,CACA,EADQ,MAG4D,GAF1D,MAAM,GAAC,IAAI,CAoBvB;AA4CD;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAJzB,GAIyB,EAAE,SAAS,EAHpC,GAGoC,GAFlC,OAAO,CAInB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,kBAAkB,EAHtD,MAGsD,GAFpD,MAAM,CAoBlB;AAqED,wBAAgB,mBAAmB,CACjC,IAAI,KAAA,EACJ,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAmB,EAAE;;;;CAAA,OA8ClD;AAqBE,YAAkB,cAAc,GAChC;;;;IAAkC,KAAK,EAA5B,MAAM,GAAC,MAAM,GAAC,OAAO,CAChC;;;;IAAkC,OAAO,EAA9B,MAAM,CACnB;CAAA,CAAA;AAJD;;;;GAIG;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAR3C,MAQ2C,EAAE,OAAO,EAN5D;IAAwB,kBAAkB,EAAlC,MAAM,CACd;IAAyB,kBAAkB,EAAnC,OAAO,CAEf;IAA0B,QAAQ,AAAlC,CACA,EADQ,OAAO,CACf;CAE4D,GAFlD,cAAc,EAAE,CA6G5B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EALjC,MAKiC,EAAE,OAAO,AAJlD,CAEA,EADA;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;CAEuD,GAF7C,cAAc,EAAE,CAqI5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAX9B,MAW8B,EAAE,OAAO,EAT/C;IAAwB,kBAAkB,EAAlC,MAAM,CACd;IAAwB,QAAQ,EAAxB,MAAM,CACd;IAAyB,cAAc,EAA/B,OAAO,CACf;IAAyB,kBAAkB,EAAnC,OAAO,CAEf;IAA0B,QAAQ,AAAlC,CACA,EADQ,OAAO,CACf;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;CAE+C,GAFrC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;CAAE,CA6B3D"}

package/types/lib/cli/index.d.ts

@@ -92,6 +92,14 @@ export declare function createHBom(_path: string, options: Object): Promise<Obje
  * @param {Object} options Parse options from the cli
  * @returns {Promise<Object>} Promise resolving to BOM object
  */
+/**
+ * Generate a BOM for one path, letting a deferred fail-on-error abort return
+ * the empty BOM the flag promises rather than unwinding past the reports.
+ *
+ * @param {string} path Source path.
+ * @param {Object} options CLI options.
+ * @returns {Promise<Object>} BOM NS data.
+ */
 export declare function createBom(path: string, options: Object): Promise<Object>;
 /**
  * Method to submit the generated bom to dependency-track or cyclonedx server

package/types/lib/cli/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/cli/index.js"],"names":[],"mappings":"AAmEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAsCnE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,aAAa,EACb,wBAAwB,EACxB,eAAe,EACf,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA8B1D,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,eAAe,EACf,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,aAAa,EACb,eAAe,EACf,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AAyBxB;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,OAAO,CAAC,MAAM,CAAC,CAwE3B;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,OAAO,EAHnD,MAGmD,GAFjD,OAAO,CAAC,MAAM,CAAC,CAkU3B;AAgCD;;;;;;GAMG;AACH;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAGF,GAF1B,MAAM,CAUlB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAAM,EAG4B,GAFhC,MAAM,CAalB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EALnC,MAAM,GAAC,MAAM,EAKsB,EAAE,OAAO,EAJ5C,MAI4C,GAH1C,OAAO,CAAC,MAAM,CAAC,CA4kC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CAoD3B;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA4YrC;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,CAAC,CAsB3B;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,OAAO,CAAC,MAAM,CAAC,CA4U3B;AAED;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,IAAI,EALzB,MAKyB,EAAE,WAAW,EAJtC,MAIsC,GAHrC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CA+HjD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/cli/index.js"],"names":[],"mappings":"AAoEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAsCnE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,aAAa,EACb,wBAAwB,EACxB,eAAe,EACf,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA8B1D,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,eAAe,EACf,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,aAAa,EACb,eAAe,EACf,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AA8BxB;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,OAAO,CAAC,MAAM,CAAC,CAwE3B;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,OAAO,EAHnD,MAGmD,GAFjD,OAAO,CAAC,MAAM,CAAC,CAkU3B;AAgCD;;;;;;GAMG;AACH;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAGF,GAF1B,MAAM,CAUlB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAAM,EAG4B,GAFhC,MAAM,CAalB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EALnC,MAAM,GAAC,MAAM,EAKsB,EAAE,OAAO,EAJ5C,MAI4C,GAH1C,OAAO,CAAC,MAAM,CAAC,CAqmC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CAoD3B;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA4YrC;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,CAAC,CAsB3B;AAED;;;;;;GAMG;AACH;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,OAAO,CAAC,MAAM,CAAC,CAa3B;AAsVD;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,IAAI,EALzB,MAKyB,EAAE,WAAW,EAJtC,MAIsC,GAHrC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CA+FjD"}

package/types/lib/cli/jsBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jsBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jsBom.js"],"names":[],"mappings":"AA+FA;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAwB5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CA4zC3B;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAE4C,CAAC;AAEvD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,YAJ9B,KAAK,CAAC,MAAM,CAAC,cACb,MAAM,KACJ,KAAK,CAAC,MAAM,CAwExB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CA6C3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CA+F3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAoN3B;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CAoD3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CA2ChE;AAED;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CACjD,aAAa,EANJ,MAMI,EACb,OAAO,EANE,MAMF,EACP,OAAO,EANE,MAAM,EAMR,EACP,YAAY,EANH,MAAM,EAMH,iBAsBb"}
+{"version":3,"file":"jsBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jsBom.js"],"names":[],"mappings":"AAiGA;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAwB5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAu1C3B;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAE4C,CAAC;AAEvD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,YAJ9B,KAAK,CAAC,MAAM,CAAC,cACb,MAAM,KACJ,KAAK,CAAC,MAAM,CAwExB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CA6C3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CA+F3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAoN3B;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CAoD3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CA2ChE;AAED;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CACjD,aAAa,EANJ,MAMI,EACb,OAAO,EANE,MAMF,EACP,OAAO,EANE,MAAM,EAMR,EACP,YAAY,EANH,MAAM,EAMH,iBAsBb"}

package/types/lib/cli/jvmBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jvmBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jvmBom.js"],"names":[],"mappings":"AAwFA;;;;;GAKG;AACH,eAAO,IAAI,gBAAgB,EAFjB,MAIsD,CAAC;AAUjE;;;;GAIG;AAEH,eAAO,MAAM,kBAAkB,EAHrB,MAQT,CAAC;AAEF;;;;;GAKG;AAEH,eAAO,MAAM,aAAa,EAHhB,MAIqE,CAAC;AAEhF;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAL5B,MAK4B,EAAE,OAAO,EAJrC,MAIqC,GAFnC,MAAM,CA8ElB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EALxC,MAKwC,EAAE,MAAM,EAJhD,MAIgD,EAAE,GAAG,EAHrD,MAGqD,GAFnD,MAAM,EAAE,CA4CpB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CA0iD3B"}
+{"version":3,"file":"jvmBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jvmBom.js"],"names":[],"mappings":"AAgGA;;;;;GAKG;AACH,eAAO,IAAI,gBAAgB,EAFjB,MAIsD,CAAC;AAUjE;;;;GAIG;AAEH,eAAO,MAAM,kBAAkB,EAHrB,MAQT,CAAC;AAEF;;;;;GAKG;AAEH,eAAO,MAAM,aAAa,EAHhB,MAIqE,CAAC;AAEhF;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAL5B,MAK4B,EAAE,OAAO,EAJrC,MAIqC,GAFnC,MAAM,CA8ElB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EALxC,MAKwC,EAAE,MAAM,EAJhD,MAIgD,EAAE,GAAG,EAHrD,MAGqD,GAFnD,MAAM,EAAE,CA8DpB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAmsD3B"}

package/types/lib/cli/managedBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"managedBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/managedBom.js"],"names":[],"mappings":"AAqHA;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,QAJ5B,MAAM,YACN,MAAM,KACJ,OAMZ,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAJ1B,MAAM,YACN,MAAM,KACJ,OAeZ,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,QAAA,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,GAAG,IAAI,CAsEzB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAkpB3B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CAyBlB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CA2C3B;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CA0BlB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CA8JlB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CA0R3B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAuerC;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAJpC,MAIoC,EAAE,OAAO,EAH7C,MAG6C,GAF3C,OAAO,CAAC,MAAM,CAAC,CAmF3B"}
+{"version":3,"file":"managedBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/managedBom.js"],"names":[],"mappings":"AAyHA;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,QAJ5B,MAAM,YACN,MAAM,KACJ,OAMZ,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAJ1B,MAAM,YACN,MAAM,KACJ,OAeZ,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,QAAA,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,GAAG,IAAI,CAsEzB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CA2pB3B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CAyBlB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CA2C3B;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CA0BlB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CA+LlB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAkS3B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAsfrC;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAJpC,MAIoC,EAAE,OAAO,EAH7C,MAG6C,GAF3C,OAAO,CAAC,MAAM,CAAC,CAmF3B"}

package/types/lib/cli/nativeBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nativeBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/nativeBom.js"],"names":[],"mappings":"AA2IA;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,GAAC,SAAS,CAU5B;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAwavC;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAmJrC;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,GAAC,SAAS,CAiC5B;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,SAAS,EAJ9C,MAI8C,EAAE,SAAS,AAHjE,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA8BrC;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAJnC,MAImC,EAAE,OAAO,EAH5C,MAG4C,GAF1C,OAAO,CAAC,MAAM,CAAC,CAwB3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAiE3B;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CAkZlB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CA+GlB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CA0BlB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CA0BlB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA0I3B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAmLvC;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CAkI3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA4D3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwD3B"}
+{"version":3,"file":"nativeBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/nativeBom.js"],"names":[],"mappings":"AAiJA;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,GAAC,SAAS,CAU5B;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAkdvC;AA2BD;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAgLrC;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,GAAC,SAAS,CAiC5B;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,SAAS,EAJ9C,MAI8C,EAAE,SAAS,AAHjE,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA8BrC;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAJnC,MAImC,EAAE,OAAO,EAH5C,MAG4C,GAF1C,OAAO,CAAC,MAAM,CAAC,CAwB3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CA0E3B;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CAkZlB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CAmJlB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CAiClB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CAiClB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwJ3B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuLvC;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CAkI3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA4D3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwD3B"}

package/types/lib/core/buildLedger.d.ts

@@ -0,0 +1,272 @@
+/**
+ * Build ledger: an opt-in, worker-safe recorder of structured build-adequacy
+ * events.
+ *
+ * Producers record what a run did to its build environment — the tool versions
+ * a project expected, the tools that were actually found, the commands that
+ * failed, the fallback code paths that were taken — and the post-generation
+ * reflection turns those events into a fidelity verdict. The recorder follows
+ * the shape of `activity.js` but stays a separate stream: activity records
+ * describe security-relevant side effects consumed by the secure-mode
+ * machinery, while ledger events describe environment adequacy consumed by the
+ * introspection report.
+ *
+ * Two facts about workers shape the design:
+ *
+ * 1. A worker thread gets its own instance of this module, so events recorded
+ *    inside a worker are invisible to the main thread's in-memory buffer.
+ *    When `CDXGEN_INTROSPECT_LEDGER` is set, every instance appends its events
+ *    to the same JSONL sidecar through an `O_APPEND` descriptor (only the main
+ *    thread truncates, at open), which makes the sidecar the only complete
+ *    record of a multi-worker run. Consumers must therefore prefer the sidecar
+ *    when it exists and fall back to `getLedgerEvents()` only when it does not.
+ * 2. Every write reaches the descriptor synchronously at record time, so a
+ *    lost tail is impossible; the descriptor is released when the process
+ *    exits (`closeLogStreams` closes every shared writer) or earlier through
+ *    {@link closeLedger}.
+ *
+ * Values that could carry credentials are scrubbed before they are stored or
+ * written: `command`, `path`, `detail`, `causeDetail` and `outputExcerpt` pass
+ * through sensitive-assignment redaction plus the BOM property sanitizer, so a
+ * leaked token can never reach a report file that agents upload.
+ */
+export type LedgerEvent = {
+    /**
+     * One of LEDGER_EVENT_KINDS.
+     */
+    kind: string;
+    /**
+     * Canonical project type ("java", "npm", "python", …).
+     */
+    ecosystem: string;
+    /**
+     * Tool identity ("maven", "gradle", "swift", "dotnet").
+     */
+    tool?: string;
+    /**
+     * Version or version range the project asked for.
+     */
+    wanted?: string;
+    /**
+     * Version actually resolved, or undefined when absent.
+     */
+    found?: string;
+    /**
+     * How `found` was determined ("PATH", "wrapper", "sdkman", "env").
+     */
+    source?: string;
+    /**
+     * Absolute path of the resolved tool or the file that was read.
+     */
+    path?: string;
+    /**
+     * Command line, already redacted.
+     */
+    command?: string;
+    exitCode?: number;
+    /**
+     * One sentence, present tense, no remediation text.
+     */
+    detail?: string;
+    /**
+     * Short diagnosed cause of a failure ("gradle cannot run on Java 21"), when the producer derived one.
+     */
+    causeDetail?: string;
+    /**
+     * Redacted, at most the last 2000 characters of the failed command's combined stdout and stderr, with interior newlines preserved. Suppressed entirely by `CDXGEN_INTROSPECT_NO_OUTPUT`.
+     */
+    outputExcerpt?: string;
+    /**
+     * Key into the remediation catalog (Deliverable 06).
+     */
+    remediationId?: string;
+    /**
+     * One of LEDGER_EVENT_IMPACTS.
+     */
+    impact?: string;
+    /**
+     * ISO 8601.
+     */
+    timestamp: string;
+};
+/**
+ * A structured build-adequacy event.
+ *
+ * @typedef {Object} LedgerEvent
+ * @property {string}  kind        One of LEDGER_EVENT_KINDS.
+ * @property {string}  ecosystem   Canonical project type ("java", "npm", "python", …).
+ * @property {string}  [tool]      Tool identity ("maven", "gradle", "swift", "dotnet").
+ * @property {string}  [wanted]    Version or version range the project asked for.
+ * @property {string}  [found]     Version actually resolved, or undefined when absent.
+ * @property {string}  [source]    How `found` was determined ("PATH", "wrapper", "sdkman", "env").
+ * @property {string}  [path]      Absolute path of the resolved tool or the file that was read.
+ * @property {string}  [command]   Command line, already redacted.
+ * @property {number}  [exitCode]
+ * @property {string}  [detail]    One sentence, present tense, no remediation text.
+ * @property {string}  [causeDetail] Short diagnosed cause of a failure ("gradle cannot run on Java 21"), when the producer derived one.
+ * @property {string}  [outputExcerpt] Redacted, at most the last 2000 characters of the failed command's combined stdout and stderr, with interior newlines preserved. Suppressed entirely by `CDXGEN_INTROSPECT_NO_OUTPUT`.
+ * @property {string}  [remediationId] Key into the remediation catalog (Deliverable 06).
+ * @property {string}  [impact]    One of LEDGER_EVENT_IMPACTS.
+ * @property {string}  timestamp   ISO 8601.
+ */
+/**
+ * The closed set of event kinds. `kind` is validated against this object: a
+ * kind that is not listed is dropped (with a think-log note) rather than
+ * recorded, so a producer bug can never fail a customer's SBOM run. Adding a
+ * kind here is a schema change; consumers must tolerate unknown kinds by
+ * ignoring them.
+ *
+ * @type {Readonly<Record<string, string>>}
+ */
+export declare const LEDGER_EVENT_KINDS: Readonly<Record<string, string>>;
+/**
+ * The closed set of `impact` values, describing what a degraded outcome costs
+ * the fidelity of the generated BOM.
+ *
+ * @type {Readonly<Record<string, string>>}
+ */
+export declare const LEDGER_EVENT_IMPACTS: Readonly<Record<string, string>>;
+/**
+ * Reserved `ecosystem` value for events that describe the recorder itself
+ * rather than a project ecosystem, such as the truncation marker. Consumers
+ * that group events by ecosystem must treat it as a global observation instead
+ * of creating an ecosystem entry for it.
+ *
+ * @type {string}
+ */
+export declare const LEDGER_TOOL_ECOSYSTEM: string;
+/**
+ * Module-load snapshot of the build-introspection environment: `CDXGEN_INTROSPECT`
+ * is `true`/`1`, or `CDXGEN_INTROSPECT_LEDGER` names a sidecar file. Library
+ * callers that configure introspection before importing this module can read
+ * it directly; the CLI enables introspection after argument parsing, so every
+ * internal gate reads {@link isLedgerEnabled}, which resolves the same
+ * environment on each call.
+ *
+ * @type {boolean}
+ */
+export declare const LEDGER_ENABLED: boolean;
+/**
+ * True when build-introspection recording is enabled for this run: the same
+ * environment as {@link LEDGER_ENABLED}, read live. The CLI turns
+ * introspection on after argument parsing by setting `CDXGEN_INTROSPECT`, so
+ * a module-load snapshot would miss every event recorded after that point;
+ * the environment only ever flips in that one direction during a run.
+ *
+ * @returns {boolean} True when events should be recorded.
+ */
+/**
+ * Whether build introspection is enabled for this run. The flag decides when
+ * it was given; otherwise the environment speaks, which is how a run that
+ * enabled introspection through a profile reaches the recorders.
+ *
+ * @param {Object} [options] CLI options.
+ * @returns {boolean} True when the run records and reports a verdict.
+ */
+export declare function isIntrospectionEnabled(options?: Object): boolean;
+export declare function isLedgerEnabled(): boolean;
+/**
+ * Redact a free-text introspection value with the ledger's own redactor. Both
+ * report renderers run their free text through this function so a field can
+ * never be redacted differently in the ledger, the JSON report and the
+ * markdown report.
+ *
+ * @param {string|undefined} value Free text of untrusted origin.
+ * @returns {string|undefined} Redacted text.
+ */
+export declare function redactIntrospectionText(value: string | undefined): string | undefined;
+/**
+ * Combined stdout and stderr of a spawned command, as the raw material of an
+ * output excerpt. Producers that already hold a spawn result call this so the
+ * recorder, not the producer, owns truncation and redaction.
+ *
+ * @param {Object|undefined} spawnResult A spawnSync-style result.
+ * @returns {string|undefined} The combined output, or undefined when the command produced none.
+ */
+export declare function commandOutputText(spawnResult: Object | undefined): string | undefined;
+/**
+ * Record one build-adequacy event. Returns immediately after a single boolean
+ * test when introspection is disabled, so producers may pass plain values
+ * without gating the call themselves.
+ *
+ * Events with a kind outside LEDGER_EVENT_KINDS, or without a non-empty
+ * `ecosystem`, are dropped with a think-log note instead of throwing: the
+ * ledger is instrumentation, and a producer bug must never fail an SBOM run.
+ *
+ * @param {string} kind Event kind; one of LEDGER_EVENT_KINDS.
+ * @param {Partial<LedgerEvent>} [fields] Event fields; `command`, `path`, `detail`, `causeDetail` and `outputExcerpt` are redacted before storage, and `outputExcerpt` is additionally bounded to its tail.
+ * @returns {LedgerEvent|undefined} The stored event, or undefined when recording is disabled or the event was dropped.
+ */
+export declare function recordLedgerEvent(kind: string, fields?: Partial<LedgerEvent>): LedgerEvent | undefined;
+/**
+ * Resolve the event kind for a remediation id from the catalog.
+ *
+ * @param {string} remediationId Remediation id to look up.
+ * @returns {string|undefined} Default event kind, or undefined when the id is unknown or the catalog is unavailable.
+ */
+export declare function remediationKindFor(remediationId: string): string | undefined;
+/**
+ * The full remediation catalog, for consumers that need the extended entry
+ * fields (target tier, actions, verify clause) rather than a single resolved
+ * kind. Returns the cached parsed catalog; null when the data file is
+ * missing or unreadable.
+ *
+ * @returns {Record<string, Object>|null} Catalog keyed by remediation id, or null when unavailable.
+ */
+export declare function getRemediationCatalog(): Record<string, Object> | null;
+/**
+ * Record a degraded outcome together with the remediation that would restore
+ * the lost evidence. The kind and the remediationId come from the catalog
+ * entry for `remediationId`, so a site only supplies the facts it observed;
+ * `ecosystem` and `impact` are required from the caller because only the site
+ * knows which scanned ecosystem paid the cost and how much. A site whose
+ * degradation differs in kind from the catalog default (a command that threw
+ * rather than a fallback that engaged) may pass an explicit `kind` in fields.
+ *
+ * Events for unknown ids are dropped with a think-log note: an id outside the
+ * catalog is a producer bug and the catalog is the contract.
+ *
+ * @param {string} remediationId Key into data/remediations.json.
+ * @param {Partial<LedgerEvent> & {kind?: string}} fields Event fields; `ecosystem` and `impact` are required, `kind` overrides the catalog default.
+ * @returns {LedgerEvent|undefined} The stored event, or undefined when recording is disabled or the event was dropped.
+ */
+export declare function recordDegradation(remediationId: string, fields?: Partial<LedgerEvent> & {
+    kind?: string;
+}): LedgerEvent | undefined;
+/**
+ * Snapshot of the events recorded by this thread. Each event and the array
+ * itself are frozen, so a consumer cannot mutate the recorder's state.
+ * In a multi-worker run this buffer is this thread's view only; the JSONL
+ * sidecar is the complete record.
+ *
+ * @returns {LedgerEvent[]} Frozen array of frozen events.
+ */
+export declare function getLedgerEvents(): LedgerEvent[];
+/**
+ * Clear the in-memory buffer and the truncation state. Intended for tests; a
+ * production run never resets its own ledger. The sidecar file is append-only
+ * and is not touched.
+ *
+ * @returns {void}
+ */
+export declare function resetLedgerEvents(): void;
+/**
+ * Parse a JSONL sidecar produced by `CDXGEN_INTROSPECT_LEDGER` back into
+ * events. Blank lines and lines that fail to parse — a torn final line from an
+ * interrupted run is expected — are skipped. Prefer this over the in-memory
+ * buffer whenever the sidecar exists: worker threads append to the same file,
+ * so it is the only complete record of a multi-worker run.
+ *
+ * @param {string} ledgerPath Path to the JSONL sidecar.
+ * @returns {LedgerEvent[]} Frozen array of frozen events, empty when the file is missing or unreadable.
+ */
+export declare function loadLedgerFile(ledgerPath: string): LedgerEvent[];
+/**
+ * Close the sidecar descriptor held by this thread. Idempotent; further
+ * events stay in memory only. The descriptor is also released when the
+ * process exits through `closeLogStreams`.
+ *
+ * @returns {void}
+ */
+export declare function closeLedger(): void;
+//# sourceMappingURL=buildLedger.d.ts.map

package/types/lib/core/buildLedger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildLedger.d.ts","sourceRoot":"","sources":["../../../lib/core/buildLedger.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AA0BA,YAAkB,WAAW,GAC7B;;;;IAAoB,IAAI,EAAb,MAAM,CACjB;;;;IAAoB,SAAS,EAAlB,MAAM,CACjB;;;;IAAqB,IAAI,AAAzB,CACA,EADW,MAAM,CACjB;;;;IAAqB,MAAM,AAA3B,CACA,EADW,MAAM,CACjB;;;;IAAqB,KAAK,AAA1B,CACA,EADW,MAAM,CACjB;;;;IAAqB,MAAM,AAA3B,CACA,EADW,MAAM,CACjB;;;;IAAqB,IAAI,AAAzB,CACA,EADW,MAAM,CACjB;;;;IAAqB,OAAO,AAA5B,CACA,EADW,MAAM,CACjB;IAAqB,QAAQ,AAA7B,CACA,EADW,MAAM,CACjB;;;;IAAqB,MAAM,AAA3B,CACA,EADW,MAAM,CACjB;;;;IAAqB,WAAW,AAAhC,CACA,EADW,MAAM,CACjB;;;;IAAqB,aAAa,AAAlC,CACA,EADW,MAAM,CACjB;;;;IAAqB,aAAa,AAAlC,CACA,EADW,MAAM,CACjB;;;;IAAqB,MAAM,AAA3B,CACA,EADW,MAAM,CACjB;;;;IAAoB,SAAS,EAAlB,MAAM,CACnB;CAAA,CAAA;AAnBD;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,EAFrB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYvC,CAAC;AAIH;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAFvB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASvC,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,EAFxB,MAEmC,CAAC;AAS9C;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,EAFjB,OAIoD,CAAC;AAE/D;;;;;;;;GAQG;AACH;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,AAH3C,CACA,EADQ,MAGmC,GAFjC,OAAO,CAOnB;AAED,wBAAgB,eAAe,YAK9B;AA8OD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAHlC,MAAM,GAAC,SAG2B,GAFhC,MAAM,GAAC,SAAS,CAO5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAHlC,MAAM,GAAC,SAG2B,GAFhC,MAAM,GAAC,SAAS,CAU5B;AA0JD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAJ3B,MAI2B,EAAE,MAAM,AAH3C,CACA,EADQ,OAAO,CAAC,WAAW,CAGqB,GAFtC,WAAW,GAAC,SAAS,CAmBjC;AAsCD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAFxB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAC,IAAI,CAIvC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAJpC,MAIoC,EAAE,MAAM,GAH5C,OAAO,CAAC,WAAW,CAAC,GAAG;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAGY,GAF/C,WAAW,GAAC,SAAS,CAkBjC;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,IAFlB,WAAW,EAAE,CAMzB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAFpB,IAAI,CAKhB;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAH9B,MAG8B,GAF5B,WAAW,EAAE,CAwBzB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,IAFd,IAAI,CAYhB"}

package/types/lib/core/deferredExit.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Deferred `fail-on-error` exits for introspected runs.
+ *
+ * `--fail-on-error` promises an operator that a failing dependency extractor
+ * never produces a plausible-but-incomplete BOM, so the extractors exit the
+ * process the moment a build tool fails. Under `--introspect` that exit
+ * destroys the very evidence the run exists to produce: the ledger events
+ * recorded a statement earlier die with the process, `postProcess` never
+ * runs, and neither the BOM nor the fidelity report is written.
+ *
+ * On an introspected run the extractor instead records the failure here and
+ * throws {@link DeferredFailOnError}, which the extractor catches at its
+ * completion point so it still returns everything it collected before the
+ * failure — the incomplete-result fallbacks stay skipped, exactly as
+ * `fail-on-error` demands. The CLI then writes the BOM and both reports and
+ * exits with the dedicated {@link INTROSPECTION_FAILURE_EXIT_CODE} status, so
+ * the exit code still claims "an extractor failed", distinct from the
+ * fidelity gate's 4.
+ *
+ * Without introspection this module is a pass-through to `process.exit(1)`;
+ * the default contract of the flag is unchanged.
+ */
+/**
+ * Exit status used when an introspected run completes its outputs despite a
+ * `--fail-on-error` extractor failure. Distinct from 1 (generic failure),
+ * 3 (TEA publish failure) and 4 (the introspection fidelity gate).
+ *
+ * @type {number}
+ */
+export declare const INTROSPECTION_FAILURE_EXIT_CODE: number;
+/**
+ * Control-flow signal thrown by {@link deferFailOnError} on an introspected
+ * run. The extractor that called it must let it unwind to its completion
+ * point, keep everything it collected until then, and rethrow anything else.
+ */
+export declare class DeferredFailOnError extends Error {
+    /**
+     * @param {string} message Human-readable failure summary.
+     */
+    constructor(message: string);
+}
+/**
+ * Test whether an error is the fail-on-error deferral signal.
+ *
+ * @param {unknown} err The caught error.
+ * @returns {boolean} True when the error unwinds a deferred fail-on-error abort.
+ */
+export declare function isDeferredFailOnError(err: unknown): boolean;
+/**
+ * Snapshot of the deferred failures recorded by this run.
+ *
+ * @returns {Array<Object>} Frozen copies of the recorded failures.
+ */
+export declare function getDeferredFailures(): Array<Object>;
+/**
+ * Handle a failing extractor on behalf of a `options.failOnError &&
+ * process.exit(1)` site. Without `fail-on-error` the run continues exactly
+ * as it would have. With the flag and no introspection the process exits 1,
+ * unchanged. On an introspected run the failure is recorded — including one
+ * ledger observation on the ecosystem row the failure cost evidence — and
+ * the deferral signal is thrown so the extractor stops where it is without
+ * taking any incomplete-result fallback.
+ *
+ * @param {Object} options CLI options.
+ * @param {Object} failure What failed, for the operator message and the report.
+ * @param {string} failure.tool The build tool that failed.
+ * @param {string} [failure.ecosystem] The ecosystem the tool serves, so the
+ *   observation lands on the row whose evidence the failure cost.
+ * @param {string} failure.detail One sentence, present tense.
+ * @param {number} [failure.exitCode] The tool's exit status, when known.
+ * @param {string} [failure.command] The redacted command that was attempted.
+ * @param {string} [failure.outputExcerpt] The failed command's combined output,
+ *   when the caller already holds it; the recorder bounds and redacts it.
+ * @returns {void} Never returns on an introspected run; it throws.
+ */
+export declare function deferFailOnError(options: Object, failure: {
+    tool: string;
+    ecosystem?: string;
+    detail: string;
+    exitCode?: number;
+    command?: string;
+    outputExcerpt?: string;
+}): void;
+//# sourceMappingURL=deferredExit.d.ts.map

package/types/lib/core/deferredExit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deferredExit.d.ts","sourceRoot":"","sources":["../../../lib/core/deferredExit.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AASH;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,EAFlC,MAEsC,CAAC;AAEjD;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C;;OAEG;IACH,YAAY,OAAO,EAFR,MAEQ,EAGlB;CACF;AAWD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAH9B,OAG8B,GAF5B,OAAO,CAInB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,KAAK,CAAC,MAAM,CAAC,CAIzB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAZ7B,MAY6B,EAAE,OAAO,EAV9C;IAAwB,IAAI,EAApB,MAAM,CACd;IAAyB,SAAS,AAAlC,CAEA,EAFQ,MAAM,CAEd;IAAwB,MAAM,EAAtB,MAAM,CACd;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;IAAyB,OAAO,AAAhC,CACA,EADQ,MAAM,CACd;IAAyB,aAAa,AAAtC,CAEA,EAFQ,MAAM,CAEd;CAE8C,GAFpC,IAAI,CAuChB"}