@cdxgen/cdxgen 13.0.0 → 13.1.0

package/types/lib/evinser/evinser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evinser.d.ts","sourceRoot":"","sources":["../../../lib/evinser/evinser.js"],"names":[],"mappings":"AAyFA;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAF5B,MAE4B;;;;;;;eAuDtC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAPE,MAOF,EACP,SAAS,wBAAA,EACT,UAAU,EAPD,MAOC,EACV,OAAO,GAPE,MAOG,GAND,OAAO,CAAC,IAAI,CAAC,CAmDzB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EALpC,MAKoC,EAAE,SAAS,wBAAA,EAAE,UAAU,EAH3D,MAG2D,GAFzD,OAAO,CAAC,IAAI,CAAC,CAoCzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAPK,MAOL,EACJ,SAAS,wBAAA,EACT,MAAM,EAPG,MAOH,EACN,OAAO,GAPE,MAOG,GAND,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAuBrC;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAH9B,MAG8B,GAF5B,MAAM,CAOlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAC/B,eAAe,EAPN,MAAM,GAAC,MAAM,EAOP,EACf,QAAQ,EAPC,MAOD,EACR,SAAS,AAPR,CACA,EADQ,MAOW,EACpB,OAAO,AAPN,CACA,EADQ,MAOG,GAND,OAAO,CAAC,MAAM,CAAC,CAyN3B;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAJxB,MAIwB,EAAE,QAAQ,AAH1C,CACA,EADQ,MAGkC,GAFhC,MAAM,GAAC,SAAS,CA4B5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAJ5B,MAAM,EAIsB,EAAE,QAAQ,EAHtC,MAGsC,GAFpC;IAAE,eAAe,2BAAsB;IAAC,cAAc,2BAA0B;CAAE,CAgC9F;AAcD;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAHlC,MAGkC,EAAE,OAAO,EAF3C,MAE2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiUrD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAVC,MAUD,EACR,UAAU,EAVD,MAUC,EACV,QAAQ,EAVC,MAUD,EACR,WAAW,AAVV,CACA,EADQ,MAUO,EAChB,eAAe,AAVd,CACA,0BASmB,EACpB,cAAc,AAVb,CACA,0BASkB,EACnB,eAAe,AAVd,CACA,EADQ,MAUkB,GAThB,OAAO,CAAC,MAAM,CAAC,CAgE3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EATC,MASD,EACR,mBAAmB,EATV,MASU,EACnB,KAAK,OAAA,EACL,QAAQ,EATC,MASD,EACR,eAAe,EATN,MASM,EACf,cAAc,EATL,MASK,iBA4Nf;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,QAAA,EAAE,UAAU,OAAA,EAAE,cAAc,EAH7D,MAG6D,GAF3D,MAAM,CAiGlB;AAyBD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAL9B,MAK8B,EAAE,mBAAmB,yBAAA,EAAE,YAAY,EAHjE,MAGiE,GAF/D,OAAO,CA2EnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EANA,MAMA,EACT,eAAe,EANN,MAMM,EACf,WAAW,EANF,MAME,GALA,IAAI,CAqChB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,KAAK,OAAA,EAAE,WAAW,GAF1D,MAE+D,uBA2DzE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAJnC,MAImC,EAAE,gBAAgB,OAAA,EAAE,WAAW,EAFlE,MAEkE,QAgD5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAJnC,MAImC,EAAE,KAAK,EAH1C,MAG0C,GAFxC,MAAM,CAalB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAJ9B,MAI8B,EAAE,IAAI,EAHpC,MAGoC,GAFlC,MAAM,EAAE,GAAC,SAAS,CAwF9B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,cAAc,EAJpC,MAIoC,EAAE,OAAO,EAH7C,MAG6C,OAoLvD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EARC,MAQD,EACR,mBAAmB,EARV,MAQU,EACnB,aAAa,EARJ,MAQI,EACb,QAAQ,EARC,MAQD,EACR,gBAAgB,EARP,MAQO,EAChB,cAAc,EARL,MAQK,eA4Gf;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAHrC,MAGqC,EAAE,eAAe,EAFtD,MAEsD;;;;;;;;YAgFzD,SAAS;YACT,GAAG;;;;EASV;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,OAAA,qBA4DnC;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,YAAY,EAH9B,MAG8B,UAExC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAJvC,MAIuC,EAAE,YAAY,EAHrD,MAGqD,GAFnD,MAAM,GAAC,SAAS,CAmD5B"}
+{"version":3,"file":"evinser.d.ts","sourceRoot":"","sources":["../../../lib/evinser/evinser.js"],"names":[],"mappings":"AA4FA;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAF5B,MAE4B;;;;;;;eAuDtC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAPE,MAOF,EACP,SAAS,wBAAA,EACT,UAAU,EAPD,MAOC,EACV,OAAO,GAPE,MAOG,GAND,OAAO,CAAC,IAAI,CAAC,CAmDzB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EALpC,MAKoC,EAAE,SAAS,wBAAA,EAAE,UAAU,EAH3D,MAG2D,GAFzD,OAAO,CAAC,IAAI,CAAC,CAoCzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAPK,MAOL,EACJ,SAAS,wBAAA,EACT,MAAM,EAPG,MAOH,EACN,OAAO,GAPE,MAOG,GAND,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAuBrC;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAH9B,MAG8B,GAF5B,MAAM,CAOlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAC/B,eAAe,EAPN,MAAM,GAAC,MAAM,EAOP,EACf,QAAQ,EAPC,MAOD,EACR,SAAS,AAPR,CACA,EADQ,MAOW,EACpB,OAAO,AAPN,CACA,EADQ,MAOG,GAND,OAAO,CAAC,MAAM,CAAC,CAyN3B;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAJxB,MAIwB,EAAE,QAAQ,AAH1C,CACA,EADQ,MAGkC,GAFhC,MAAM,GAAC,SAAS,CA4B5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAJ5B,MAAM,EAIsB,EAAE,QAAQ,EAHtC,MAGsC,GAFpC;IAAE,eAAe,2BAAsB;IAAC,cAAc,2BAA0B;CAAE,CAgC9F;AAcD;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAHlC,MAGkC,EAAE,OAAO,EAF3C,MAE2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4UrD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAVC,MAUD,EACR,UAAU,EAVD,MAUC,EACV,QAAQ,EAVC,MAUD,EACR,WAAW,AAVV,CACA,EADQ,MAUO,EAChB,eAAe,AAVd,CACA,0BASmB,EACpB,cAAc,AAVb,CACA,0BASkB,EACnB,eAAe,AAVd,CACA,EADQ,MAUkB,GAThB,OAAO,CAAC,MAAM,CAAC,CAgE3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EATC,MASD,EACR,mBAAmB,EATV,MASU,EACnB,KAAK,OAAA,EACL,QAAQ,EATC,MASD,EACR,eAAe,EATN,MASM,EACf,cAAc,EATL,MASK,iBA4Nf;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,QAAA,EAAE,UAAU,OAAA,EAAE,cAAc,EAH7D,MAG6D,GAF3D,MAAM,CAiGlB;AAyBD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAL9B,MAK8B,EAAE,mBAAmB,yBAAA,EAAE,YAAY,EAHjE,MAGiE,GAF/D,OAAO,CA2EnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EANA,MAMA,EACT,eAAe,EANN,MAMM,EACf,WAAW,EANF,MAME,GALA,IAAI,CAqChB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,KAAK,OAAA,EAAE,WAAW,GAF1D,MAE+D,uBA2DzE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAJnC,MAImC,EAAE,gBAAgB,OAAA,EAAE,WAAW,EAFlE,MAEkE,QAgD5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAJnC,MAImC,EAAE,KAAK,EAH1C,MAG0C,GAFxC,MAAM,CAalB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAJ9B,MAI8B,EAAE,IAAI,EAHpC,MAGoC,GAFlC,MAAM,EAAE,GAAC,SAAS,CAwF9B;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,cAAc,EAJ1C,MAI0C,EAAE,OAAO,EAHnD,MAGmD,gBAwL7D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EARC,MAQD,EACR,mBAAmB,EARV,MAQU,EACnB,aAAa,EARJ,MAQI,EACb,QAAQ,EARC,MAQD,EACR,gBAAgB,EARP,MAQO,EAChB,cAAc,EARL,MAQK,eA4Gf;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAHrC,MAGqC,EAAE,eAAe,EAFtD,MAEsD;;;;;;;;YAgFzD,SAAS;YACT,GAAG;;;;EASV;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,OAAA,qBA4DnC;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,YAAY,EAH9B,MAG8B,UAExC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAJvC,MAIuC,EAAE,YAAY,EAHrD,MAGqD,GAFnD,MAAM,GAAC,SAAS,CAmD5B"}

package/types/lib/helpers/remote/dependency-track.d.ts

@@ -1,3 +1,4 @@
+import { Buffer } from "node:buffer";
 /**
  * Returns the Dependency-Track BOM API URL as a sanitized URL object.
  *
@@ -13,11 +14,51 @@ export declare function getDependencyTrackBomApiUrl(serverUrl: string): URL | un
  */
 export declare function getDependencyTrackBomUrl(serverUrl: string): string | undefined;
 /**
- * Build the payload for Dependency-Track BOM submission.
+ * Build the form fields for a Dependency-Track BOM submission.
+ *
+ * Field names follow the `multipart/form-data` variant of `/api/v1/bom`, which differs
+ * from the JSON variant: the JSON body calls the flag `isLatestProjectVersion` and takes
+ * `projectTags` as an array of objects, while the form takes `isLatest` and a
+ * comma-separated tag list.
+ *
+ * @param {Object} args CLI/server arguments
+ * @returns {Object | undefined} field map if the project coordinates are valid
+ */
+export declare function buildDependencyTrackBomPayload(args: Object): Object | undefined;
+/**
+ * Encode text fields and a single file part as a `multipart/form-data` body.
+ *
+ * @param {Object} fields Text fields keyed by field name
+ * @param {Object} file File part
+ * @param {string} file.name Field name of the file part
+ * @param {string} file.filename File name reported to the server
+ * @param {string} file.contentType Content type of the file part
+ * @param {Buffer} file.content File content
+ * @returns {{ body: Buffer, contentType: string }} encoded body and its content type
+ */
+export declare function encodeMultipartFormData(fields: Object, file: {
+    name: string;
+    filename: string;
+    contentType: string;
+    content: Buffer;
+}): {
+    body: Buffer;
+    contentType: string;
+};
+/**
+ * Build the `multipart/form-data` request for Dependency-Track BOM submission.
+ *
+ * The JSON variant of the endpoint carries the BOM as a base64 string, which Jackson
+ * refuses to read beyond 20,000,000 characters - roughly a 15 MB BOM, which container
+ * image scans exceed routinely. The form variant carries the BOM as a file part and has
+ * no such limit, and is what the server recommends for large uploads.
  *
  * @param {Object} args CLI/server arguments
- * @param {Object} bomContents BOM Json
- * @returns {Object | undefined} payload object if project coordinates are valid
+ * @param {Object | string} bomContents BOM Json
+ * @returns {{ body: Buffer, contentType: string } | undefined} request body and content type if the arguments are valid
  */
-export declare function buildDependencyTrackBomPayload(args: Object, bomContents: Object): Object | undefined;
+export declare function buildDependencyTrackBomRequest(args: Object, bomContents: Object | string): {
+    body: Buffer;
+    contentType: string;
+} | undefined;
 //# sourceMappingURL=dependency-track.d.ts.map

package/types/lib/helpers/remote/dependency-track.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-track.d.ts","sourceRoot":"","sources":["../../../../lib/helpers/remote/dependency-track.js"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAH1C,MAG0C,GAFxC,GAAG,GAAG,SAAS,CAyB3B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,GAAG,SAAS,CAI9B;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAJxC,MAIwC,EAAE,WAAW,EAHrD,MAGqD,GAFnD,MAAM,GAAG,SAAS,CAkE9B"}
+{"version":3,"file":"dependency-track.d.ts","sourceRoot":"","sources":["../../../../lib/helpers/remote/dependency-track.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAKrC;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAH1C,MAG0C,GAFxC,GAAG,GAAG,SAAS,CAyB3B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,GAAG,SAAS,CAI9B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAHxC,MAGwC,GAFtC,MAAM,GAAG,SAAS,CA6D9B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EARnC,MAQmC,EAAE,IAAI,EANjD;IAAqB,IAAI,EAAjB,MAAM,CACd;IAAqB,QAAQ,EAArB,MAAM,CACd;IAAqB,WAAW,EAAxB,MAAM,CACd;IAAqB,OAAO,EAApB,MAAM,CACd;CAEiD,GAFvC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAyBjD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAJxC,MAIwC,EAAE,WAAW,EAHrD,MAAM,GAAG,MAG4C,GAFnD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAmB7D"}

package/types/lib/inventory/auditCategories.d.ts

@@ -6,6 +6,14 @@ export declare const CBOM_AUDIT_CATEGORIES: readonly string[];
 export declare const HOST_TOPOLOGY_AUDIT_CATEGORIES: readonly string[];
 /** Frozen list of Golem (Go Evinse) audit categories. */
 export declare const GOLEM_AUDIT_CATEGORIES: readonly string[];
+/**
+ * Frozen list of audit categories that never activate on their own. These
+ * rule packs serve a specific feature (`--introspect` for build-fidelity) and
+ * stay inactive unless the caller explicitly requests the category, so a
+ * default `--bom-audit` run - which evaluates every loaded rule - cannot pick
+ * them up.
+ */
+export declare const OPT_IN_BOM_AUDIT_CATEGORIES: readonly string[];
 /** Frozen list of AI-bill-of-materials audit categories. */
 export declare const AI_BOM_AUDIT_CATEGORIES: readonly string[];
 /** Comma-separated default HBOM category string used when none is specified. */

package/types/lib/inventory/auditCategories.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auditCategories.d.ts","sourceRoot":"","sources":["../../../lib/inventory/auditCategories.js"],"names":[],"mappings":"AAEA,yEAAyE;AACzE,eAAO,MAAM,qBAAqB,mBAIhC,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,mBAGhC,CAAC;AAEH,qDAAqD;AACrD,eAAO,MAAM,8BAA8B,mBAAmC,CAAC;AAE/E,yDAAyD;AACzD,eAAO,MAAM,sBAAsB,mBAIjC,CAAC;AAEH,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,mBAIlC,CAAC;AAEH,gFAAgF;AAChF,eAAO,MAAM,6BAA6B,QAAkC,CAAC;AAE7E;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;EAWrC,CAAC;AAMH;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAH3C,MAAM,GAAC,MAAM,EAG8B,GAFzC,MAAM,EAAE,CAiBpB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAHxC,MAAM,GAAC,MAAM,EAG2B,GAFtC,MAAM,EAAE,CAapB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAHtC,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,CAGa,GAFpC,MAAM,EAAE,CAMpB;AAUD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAJ1C,MAAM,GAAC,MAAM,EAI6B,EAAE,KAAK,EAHjD,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,CAGwB,GAF/C;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAC,CAyB3F;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAJzC,MAIyC,EAAE,WAAW,AAH9D,CACA,EADQ,MAGsD,GAFpD,MAAM,GAAG,SAAS,CA8B9B"}
+{"version":3,"file":"auditCategories.d.ts","sourceRoot":"","sources":["../../../lib/inventory/auditCategories.js"],"names":[],"mappings":"AAEA,yEAAyE;AACzE,eAAO,MAAM,qBAAqB,mBAIhC,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,mBAGhC,CAAC;AAEH,qDAAqD;AACrD,eAAO,MAAM,8BAA8B,mBAAmC,CAAC;AAE/E,yDAAyD;AACzD,eAAO,MAAM,sBAAsB,mBAIjC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,mBAAoC,CAAC;AAE7E,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,mBAIlC,CAAC;AAEH,gFAAgF;AAChF,eAAO,MAAM,6BAA6B,QAAkC,CAAC;AAE7E;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;EAWrC,CAAC;AAMH;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAH3C,MAAM,GAAC,MAAM,EAG8B,GAFzC,MAAM,EAAE,CAiBpB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAHxC,MAAM,GAAC,MAAM,EAG2B,GAFtC,MAAM,EAAE,CAapB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAHtC,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,CAGa,GAFpC,MAAM,EAAE,CAMpB;AAUD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAJ1C,MAAM,GAAC,MAAM,EAI6B,EAAE,KAAK,EAHjD,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,CAGwB,GAF/C;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAC,CAyB3F;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAJzC,MAIyC,EAAE,WAAW,AAH9D,CACA,EADQ,MAGsD,GAFpD,MAAM,GAAG,SAAS,CA8B9B"}

package/types/lib/inventory/depsUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"depsUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/depsUtils.js"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EANH,MAAM,EAMH,EACZ,eAAe,EANN,MAAM,EAMA,EACf,eAAe,GANN,MAMW,GALT,MAAM,EAAE,CAuEpB;AA4CD;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,GAH9C,MAAM,EAG6C,GAFjD,MAAM,EAAE,CAYpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sCAAsC,CACpD,UAAU,GALD,MAAM,EAKA,EACf,YAAY,GALH,MAAM,EAKE,GAJN,MAAM,EAAE,CA8DpB;AAoCD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAJ3B,MAAM,EAAE,GAAC,MAIkB,EAAE,WAAW,EAHxC,MAAM,EAAE,GAAC,MAG+B,GAFtC,MAAM,EAAE,CAmEpB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,UAAU,OAAA,SAoIxC;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAH7C,MAAM,EAAE,GAAG,SAAS,GAAG,IAGsB,GAF3C,MAAM,EAAE,CA0CpB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,YAAY,OAAA,EAAE,eAAe,SAAI,WAsB9D;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,OAAA,EAAE,YAAY,OAAA,SAgCnD"}
+{"version":3,"file":"depsUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/depsUtils.js"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EANH,MAAM,EAMH,EACZ,eAAe,EANN,MAAM,EAMA,EACf,eAAe,GANN,MAMW,GALT,MAAM,EAAE,CAuEpB;AA4CD;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,GAH9C,MAAM,EAG6C,GAFjD,MAAM,EAAE,CAYpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sCAAsC,CACpD,UAAU,GALD,MAAM,EAKA,EACf,YAAY,GALH,MAAM,EAKE,GAJN,MAAM,EAAE,CA8DpB;AA0FD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAJ3B,MAAM,EAAE,GAAC,MAIkB,EAAE,WAAW,EAHxC,MAAM,EAAE,GAAC,MAG+B,GAFtC,MAAM,EAAE,CAqFpB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,UAAU,OAAA,SAoIxC;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAH7C,MAAM,EAAE,GAAG,SAAS,GAAG,IAGsB,GAF3C,MAAM,EAAE,CA0CpB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,YAAY,OAAA,EAAE,eAAe,SAAI,WAsB9D;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,OAAA,EAAE,YAAY,OAAA,SAgCnD"}

package/types/lib/inventory/dosai.d.ts

@@ -108,6 +108,26 @@ export declare function collectDosaiPurlEvidence(methodsSlice: Object, component
  * @returns {Object} Map of canonical purl to arrays of call-stack frame objects
  */
 export declare function collectDosaiDataFlowFrames(dataFlowResult: Object, components?: Object[]): Object;
+/**
+ * Consume dosai's AiComponents[] inventory (schema 4.0.0): model identifiers,
+ * on-disk model artifacts with hashes, MCP tools, prompts (redacted), and agents
+ * become CycloneDX machine-learning-model / data components with modelCard data.
+ *
+ * @param {Object} methodsSlice Parsed dosai methods slice JSON
+ * @param {Array} [components] Component list to mutate in place
+ * @returns {Array} The updated component list
+ */
+export declare function collectDosaiAiComponents(methodsSlice: Object, components?: any[]): any[];
+/**
+ * Consume dosai's first-class Services[] inventory (schema 4.0.0) directly: richer
+ * than deriving services from ApiEndpoints alone — stable bom-refs, trust zones,
+ * data classifications, providers, and per-service evidence occurrences.
+ *
+ * @param {Object} methodsSlice Parsed dosai methods slice JSON
+ * @param {Object} [servicesMap] Map of service key to service definition, mutated in place
+ * @returns {Object} The updated services map
+ */
+export declare function collectDosaiServiceComponents(methodsSlice: Object, servicesMap?: Object): Object;
 /**
  * Infer service and endpoint definitions from a dosai methods slice.
  *

package/types/lib/inventory/dosai.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dosai.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dosai.js"],"names":[],"mappings":"AAmJA;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAW5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAN5B,MAM4B,EAAE,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAyDnB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,UAAU,EAJ5C,MAI4C,EAAE,OAAO,AAH7D,CACA,EADQ,MAG0D,GAFxD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EALlC,MAKkC,EAAE,UAAU,EAJ9C,MAI8C,EAAE,OAAO,AAH/D,CACA,EADQ,MAG4D,GAF1D,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAe5B;AAuBD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,KAAA,EACP,YAAY,KAAA,EACZ,aAAa,KAAA,OAiBd;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,AAHzC,CACA,EADQ,MAAM,EAGgC,GAFpC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/B;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAJ9B,MAI8B,EAAE,YAAY,EAH5C,GAAG,CAAC,MAAM,EAAE,MAAM,CAG0B,GAF1C,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAJ1C,MAI0C,EAAE,UAAU,AAH9D,CACA,EADQ,MAAM,EAGqD,GAFzD,MAAM,CAmElB;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,cAAc,EAJ9C,MAI8C,EAAE,UAAU,AAHlE,CACA,EADQ,MAAM,EAGyD,GAF7D,MAAM,CAsClB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC7C,YAAY,EALH,MAKG,EACZ,WAAW,AALV,CACA,EADQ,MAKO,GAJL,MAAM,CA2ElB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,AAHjD,CACA,EADQ,MAG8C,GAF5C,MAAM,EAAE,CAUpB"}
+{"version":3,"file":"dosai.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dosai.js"],"names":[],"mappings":"AAqLA;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAW5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAN5B,MAM4B,EAAE,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAiEnB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,UAAU,EAJ5C,MAI4C,EAAE,OAAO,AAH7D,CACA,EADQ,MAG0D,GAFxD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EALlC,MAKkC,EAAE,UAAU,EAJ9C,MAI8C,EAAE,OAAO,AAH/D,CACA,EADQ,MAG4D,GAF1D,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAe5B;AAuBD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,KAAA,EACP,YAAY,KAAA,EACZ,aAAa,KAAA,OA+Bd;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,AAHzC,CACA,EADQ,MAAM,EAGgC,GAFpC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/B;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAJ9B,MAI8B,EAAE,YAAY,EAH5C,GAAG,CAAC,MAAM,EAAE,MAAM,CAG0B,GAF1C,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAJ1C,MAI0C,EAAE,UAAU,AAH9D,CACA,EADQ,MAAM,EAGqD,GAFzD,MAAM,CAmElB;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,cAAc,EAJ9C,MAI8C,EAAE,UAAU,AAHlE,CACA,EADQ,MAAM,EAGyD,GAF7D,MAAM,CAsClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAJ1C,MAI0C,EAAE,UAAU,AAH9D,CACA,OAEmE,SA6FrE;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,YAAY,EAJ/C,MAI+C,EAAE,WAAW,AAHpE,CACA,EADQ,MAGiE,GAF/D,MAAM,CAyKlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC7C,YAAY,EALH,MAKG,EACZ,WAAW,AALV,CACA,EADQ,MAKO,GAJL,MAAM,CA+GlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,AAHjD,CACA,EADQ,MAG8C,GAF5C,MAAM,EAAE,CA6CpB"}

package/types/lib/inventory/envcontext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"envcontext.d.ts","sourceRoot":"","sources":["../../../lib/inventory/envcontext.js"],"names":[],"mappings":"AAoCA;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAFd,MAE4D,CAAC;AAuCvE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,wBAUpC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAL3B,MAK2B,EAAE,GAAG,EAJhC,MAIgC,sBAE1C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAJrB,MAIqB,sBAE/B;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,UAAU,KAAA,EAAE,GAAG,EAJ9B,MAI8B,sBAExC;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAJtB,MAIsB,MAkBhC;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAJlB,MAIkB,SA4B5B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EALvB,MAKuB,EAAE,IAAI,OAAA,sBAYvC;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EALtB,MAKsB,EAAE,QAAQ,GAJhC,MAIqC,GAFnC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAAC,CA+BhD;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EALvB,MAKuB,EAAE,QAAQ,GAJjC,MAIsC,GAFpC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CA8BlD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB;;;;;;;;;cAmBlC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAH1B,MAG0B;;;;;cAapC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAH1B,MAG0B;;;;;cAqBpC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB,GAFtB,MAAM,CAelB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB;;;;;cAYjC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB;;;;;cAYlC;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAHtB,MAGsB;;;;cAUhC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAHzB,MAGyB;;;;cAUnC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB;;;;cAUlC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,QAAA,EAAE,IAAI,OAAA,sBAExC;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB,MAAM,EAAE,CAqCpB;AA6CD;;GAEG;AACH,wBAAgB,iBAAiB,YAiBhC;AAED;;GAEG;AACH,wBAAgB,cAAc,YAO7B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,QAAA,EAAE,QAAQ,QAAA,WA0BvD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,QAAA,EAAE,QAAQ,QAAA,WAmGnD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,QAAA,UA8B3C;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,QAAA,UA8B9C;AASD;;;;GAIG;AACH,wBAAgB,gBAAgB,YAgB/B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAH/B,MAG+B,GAF7B,MAAM,CAWlB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,KAAA,EAAE,aAAa,KAAA,EAAE,QAAQ,KAAA,WAoC3E;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,KAAA,EAAE,QAAQ,KAAA;;;;;;EAqFvD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,KAAA,EAAE,cAAc,KAAA,WA2D7D;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,KAAA,EACb,WAAW,KAAA,EACX,aAAa,KAAA,EACb,QAAQ,KAAA,GANG,OAAO,CA8KnB;AAmDD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,EAAE,QAAQ,GAHxC,MAG6C,GAF3C,KAAK,CAAC,MAAM,CAAC,CAmDzB;AAyDD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,EAAE,UAAU,EAH1C,MAG0C,GAFxC,MAAM,CA6FlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,GAAG,EANnB,MAMmB,EAAE,OAAO,AALpC,CAGA,EAFA;IAAyB,GAAG,AAA5B,CACA,EADQ,MAAM,CACd;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;CAEyC,GAF/B,KAAK,CAAC,MAAM,CAAC,CA4CzB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,EAAE,QAAQ,GAHxC,MAG6C,GAF3C,KAAK,CAAC,MAAM,CAAC,CA+BzB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAFxB,MAAM,CA8FlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,WAUpC;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,IAF9B,MAAM,GAAC,SAAS,CAc5B"}
+{"version":3,"file":"envcontext.d.ts","sourceRoot":"","sources":["../../../lib/inventory/envcontext.js"],"names":[],"mappings":"AAkDA;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAFd,MAE4D,CAAC;AAuCvE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,wBAUpC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAL3B,MAK2B,EAAE,GAAG,EAJhC,MAIgC,sBAE1C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAJrB,MAIqB,sBAE/B;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,UAAU,KAAA,EAAE,GAAG,EAJ9B,MAI8B,sBAExC;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAJtB,MAIsB,MAkBhC;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAJlB,MAIkB,SA4B5B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EALvB,MAKuB,EAAE,IAAI,OAAA,sBAiBvC;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EALtB,MAKsB,EAAE,QAAQ,GAJhC,MAIqC,GAFnC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAAC,CA+BhD;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EALvB,MAKuB,EAAE,QAAQ,GAJjC,MAIsC,GAFpC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CA8BlD;AAwDD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB;;;;;;;;;cAsBlC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAH1B,MAG0B;;;;;cAgBpC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAH1B,MAG0B;;;;;cAiBpC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB,GAFtB,MAAM,CAkBlB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB;;;;;cAejC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB;;;;;cAelC;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAHtB,MAGsB;;;;cAahC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAHzB,MAGyB;;;;cAanC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB;;;;cAalC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,QAAA,EAAE,IAAI,OAAA,sBAExC;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB,MAAM,EAAE,CAqCpB;AA6CD;;GAEG;AACH,wBAAgB,iBAAiB,YAiBhC;AAED;;GAEG;AACH,wBAAgB,cAAc,YAO7B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,QAAA,EAAE,QAAQ,QAAA,WA0BvD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,QAAA,EAAE,QAAQ,QAAA,WA8GnD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,QAAA,UA8B3C;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,QAAA,UA8B9C;AASD;;;;GAIG;AACH,wBAAgB,gBAAgB,YAgB/B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAH/B,MAG+B,GAF7B,MAAM,CAWlB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,KAAA,EAAE,aAAa,KAAA,EAAE,QAAQ,KAAA,WAuC3E;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,KAAA,EAAE,QAAQ,KAAA;;;;;;EA2HvD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,KAAA,EAAE,cAAc,KAAA,WA2D7D;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,KAAA,EACb,WAAW,KAAA,EACX,aAAa,KAAA,EACb,QAAQ,KAAA,GANG,OAAO,CA+MnB;AAmDD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,EAAE,QAAQ,GAHxC,MAG6C,GAF3C,KAAK,CAAC,MAAM,CAAC,CAmDzB;AAyDD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,EAAE,UAAU,EAH1C,MAG0C,GAFxC,MAAM,CA6FlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,GAAG,EANnB,MAMmB,EAAE,OAAO,AALpC,CAGA,EAFA;IAAyB,GAAG,AAA5B,CACA,EADQ,MAAM,CACd;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;CAEyC,GAF/B,KAAK,CAAC,MAAM,CAAC,CA4CzB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,EAAE,QAAQ,GAHxC,MAG6C,GAF3C,KAAK,CAAC,MAAM,CAAC,CA+BzB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAFxB,MAAM,CA4GlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,WAUpC;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,IAF9B,MAAM,GAAC,SAAS,CAc5B"}

package/types/lib/inventory/fetchBatch.d.ts

@@ -95,6 +95,15 @@ export declare function prefetchJson(requests: Array<{
 }>, options?: {
     timeoutMs?: number;
 }): Promise<Map<string, BatchEntry>>;
+/**
+ * Record the run-level policy or connectivity condition carried by a caught
+ * fetch error, if it names one. Shared by the batch retry loop and by the
+ * serial enrichment paths that catch and swallow the same typed errors.
+ *
+ * @param {Error} err Error caught from a `cdxgenAgent` request.
+ * @returns {void}
+ */
+export declare function recordPolicyDegradationFromError(err: Error): void;
 /**
  * Read a prefetched response, or signal that the caller should fetch it itself.
  *

package/types/lib/inventory/fetchBatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetchBatch.d.ts","sourceRoot":"","sources":["../../../lib/inventory/fetchBatch.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AA2EH;;;GAGG;AACH,wBAAgB,cAAc,IAHjB,MAAM,GAAC,IAAI,CAKvB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAFtB,OAAO,CASnB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,SAO1C;AAKE,YAAkB,UAAU,GAC5B;;;;IAAoB,EAAE,EAAX,OAAO,CAClB;;;;IAAe,IAAI,AAAnB,CACA,EADW,GAAC,CACZ;;;;IAAoB,MAAM,AAA1B,CACA,EADW,MAAM,CACjB;;;;;IAAqB,QAAQ,AAA7B,CAEF,EAFa,OAAO,CAEpB;CAAA,CAAA;AAoCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EARhC,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,CAAC,MAAM,GAAC,MAAM,GAAC,QAAQ,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAQnF,EAAE,OAAO,AANjD,CAEA,EADA;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;CAIsD,GAJ5C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAgC5C;AAifD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EARlC,GAAG,CAAC,MAAM,EAAE,UAAU,CAQY,EAAE,GAAG,EAPvC,MAOuC,GANrC;IAAC,IAAI,EAAE,GAAC,CAAA;CAAC,GAAC,SAAS,CAoB/B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,IAFlB,OAAO,CAOnB"}
+{"version":3,"file":"fetchBatch.d.ts","sourceRoot":"","sources":["../../../lib/inventory/fetchBatch.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AA8EH;;;GAGG;AACH,wBAAgB,cAAc,IAHjB,MAAM,GAAC,IAAI,CAKvB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAFtB,OAAO,CASnB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,SAO1C;AAKE,YAAkB,UAAU,GAC5B;;;;IAAoB,EAAE,EAAX,OAAO,CAClB;;;;IAAe,IAAI,AAAnB,CACA,EADW,GAAC,CACZ;;;;IAAoB,MAAM,AAA1B,CACA,EADW,MAAM,CACjB;;;;;IAAqB,QAAQ,AAA7B,CAEF,EAFa,OAAO,CAEpB;CAAA,CAAA;AAoCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EARhC,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,CAAC,MAAM,GAAC,MAAM,GAAC,QAAQ,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAQnF,EAAE,OAAO,AANjD,CAEA,EADA;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;CAIsD,GAJ5C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAgC5C;AA8UD;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAHzC,KAGyC,GAFvC,IAAI,CAuBhB;AA4LD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EARlC,GAAG,CAAC,MAAM,EAAE,UAAU,CAQY,EAAE,GAAG,EAPvC,MAOuC,GANrC;IAAC,IAAI,EAAE,GAAC,CAAA;CAAC,GAAC,SAAS,CAoB/B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,IAFlB,OAAO,CAOnB"}

package/types/lib/inventory/jvmToolEnv.d.ts

@@ -0,0 +1,189 @@
+import { compareVersions, extractJavaMajor, isPrereleaseVersion } from "./toolRequirements.js";
+/**
+ * The general-purpose version comparator, prerelease classifier, and JDK
+ * major extractor live in `toolRequirements.js` so every ecosystem shares one
+ * comparator; they are re-exported here under the names this module's
+ * consumers already use.
+ */
+export { compareVersions as compareSdkmanVersions, extractJavaMajor, isPrereleaseVersion, };
+/**
+ * Anchored validator for sdkman version identifiers such as `3.9.9`,
+ * `4.0.0-rc-5`, `8.14`, or `21.0.7-tem`. Versions are interpolated into a
+ * shell command by the sdkman installer, so every identifier must be a single
+ * safe token: it must start with a digit and may only contain digits, ascii
+ * letters, dots, and hyphens.
+ *
+ * Every separator must be followed by at least one alphanumeric character, and
+ * a single repeated group covers both the dotted numeric part and the vendor
+ * or prerelease suffix. That leaves each character exactly one role, so the
+ * pattern matches in linear time on untrusted input.
+ *
+ * @param {string} version Candidate version identifier
+ * @returns {boolean} True when the identifier is safe to pass to sdkman
+ */
+export declare function isValidSdkmanVersion(version: string): boolean;
+/**
+ * Parse a versioned JVM build tool project type such as `maven3.9.9`,
+ * `mvn3.9.9`, `gradle8.14`, `sbt1.10`, or `scala3.6.4` into its sdkman
+ * candidate name and version token.
+ *
+ * The returned object distinguishes between a syntactically valid pin and a
+ * rejected one so callers can print a precise CLI error instead of silently
+ * ignoring the type.
+ *
+ * @param {string} projectType Project type argument from the CLI
+ * @returns {Object|undefined} `{ tool, version, valid }` when the type looks
+ *   like a versioned JVM build tool, `undefined` otherwise. `valid` is false
+ *   when the version token fails validation.
+ */
+export declare function parseJvmToolProjectType(projectType: string): Object | undefined;
+/**
+ * Parse a `.sdkmanrc` environment file into the sdkman candidates it pins.
+ * Only the JVM-related candidates cdxgen knows how to provision are kept;
+ * unknown keys are ignored so newer sdkman files remain readable. Malformed
+ * lines are skipped instead of aborting the whole file.
+ *
+ * @param {string} filePath Project directory that may contain a `.sdkmanrc`
+ * @returns {Object|undefined} Map of candidate name to exact version
+ *   identifier, or `undefined` when the file is missing or unreadable.
+ */
+export declare function parseSdkmanrc(filePath: string): Object | undefined;
+/**
+ * Read the version pinned by a Gradle wrapper's `gradle-wrapper.properties`.
+ * The `distributionUrl` value may escape colons as `\:` per the Java
+ * properties format; the escapes are removed before parsing.
+ *
+ * @param {string} rootPath Directory holding the `gradle/wrapper` folder
+ * @returns {Object|undefined} `{ version, distributionUrl, distributionSha256Sum? }`
+ *   or `undefined` when the wrapper is missing or unparsable.
+ */
+export declare function readGradleWrapperVersion(rootPath: string): Object | undefined;
+/**
+ * Read the version pinned by a Maven wrapper's `maven-wrapper.properties`.
+ * Legacy wrappers (pre wrapper-distribution downloads) lack a
+ * `distributionUrl` and are treated as unpinned.
+ *
+ * @param {string} rootPath Directory holding the `.mvn/wrapper` folder
+ * @returns {Object|undefined} `{ version, distributionUrl }` or `undefined`
+ *   when the wrapper is missing or unpinned.
+ */
+export declare function readMavenWrapperVersion(rootPath: string): Object | undefined;
+/**
+ * Read the sbt version declared in `project/build.properties`. Kept here as a
+ * small properties-file read so environment preparation does not depend on
+ * higher layers.
+ *
+ * @param {string} projectPath SBT project directory
+ * @returns {string|undefined} Declared sbt version, when present and valid.
+ */
+export declare function readSbtBuildPropertiesVersion(projectPath: string): string | undefined;
+/**
+ * Minimum JDK major version required to run each build tool, keyed by the
+ * tool's major version line. Versions absent from the table fall back to the
+ * tool's `default` entry.
+ *
+ * Sources: Maven release history (maven.apache.org/docs/history.html), the
+ * Gradle compatibility table (docs.gradle.org), and the sbt setup notes.
+ *
+ * @type {Object<string, Object<number, number>|number>}
+ */
+export declare const TOOL_JDK_REQUIREMENTS: Record<string, number | Record<number, number>>;
+/**
+ * Minimum Gradle version that supports a given JDK major, for the
+ * combinations where running an older Gradle on a newer JDK is known to fail.
+ * Used to warn instead of guess-installing when the environment contradicts
+ * the project's Gradle pin.
+ *
+ * @type {Object<number, string>}
+ */
+export declare const GRADLE_JAVA_CAPS: Record<number, string>;
+/** JDK major that satisfies every current build tool minimum. */
+export declare const DEFAULT_JAVA_MAJOR = 21;
+/**
+ * Look up the minimum JDK major required to run a tool version.
+ *
+ * @param {string} tool Tool name (maven, gradle, sbt, scala)
+ * @param {string} version Tool version identifier
+ * @returns {number|undefined} Minimum JDK major, when known.
+ */
+export declare function minimumJdkForToolVersion(tool: string, version: string): number | undefined;
+/**
+ * Compute the highest JDK major required across a set of tool pins.
+ *
+ * @param {Array<{tool: string, version: string}>} toolPins Pinned tools
+ * @returns {number|undefined} Highest required JDK major, when any pin maps.
+ */
+export declare function determineRequiredJavaVersion(toolPins: Array<{
+    tool: string;
+    version: string;
+}>): number | undefined;
+/**
+ * Minimum Gradle version that can run on the given JDK major, when such a cap
+ * is known.
+ *
+ * @param {number} javaMajor JDK major version
+ * @returns {string|undefined} Minimum Gradle version, when capped.
+ */
+export declare function minimumGradleVersionForJava(javaMajor: number): string | undefined;
+/**
+ * Collect the version tokens printed by `sdk list <candidate>`. The output is
+ * a fixed-width table whose cells may carry `+`, `*`, or `>` status markers;
+ * every token that passes the sdkman version validator is kept, which
+ * naturally drops banners, legends, and shell noise.
+ *
+ * @param {string} stdout Raw `sdk list` output
+ * @returns {string[]} Version identifiers found in the output.
+ */
+export declare function extractSdkListVersions(stdout: string): string[];
+/**
+ * Resolve a partial version prefix such as `3.9` or `8.14` to the newest
+ * matching version in `sdk list` output. Stable versions are preferred unless
+ * the requested prefix itself is a prerelease.
+ *
+ * @param {string} stdout Raw `sdk list <candidate>` output
+ * @param {string} prefix Partial or exact version prefix; empty matches all
+ * @returns {string|undefined} Best matching version identifier.
+ */
+export declare function resolvePartialVersion(stdout: string, prefix: string): string | undefined;
+/**
+ * Environment variable hints that carry a tool version, used by container
+ * images and CI setups to describe the preinstalled JVM toolchain.
+ *
+ * @type {Object<string, string>}
+ */
+export declare const JVM_TOOL_VERSION_ENV_HINTS: Record<string, string>;
+/**
+ * Environment variable overrides that declare the sdkman version to use for
+ * a tool, mirroring the existing `JAVA<NN>_TOOL` pattern.
+ *
+ * @type {Object<string, string>}
+ */
+export declare const JVM_TOOL_VERSION_OVERRIDES: Record<string, string>;
+/**
+ * Read the `MAVEN_TOOL`/`GRADLE_TOOL`/`SBT_TOOL`/`SCALA_TOOL` override for a
+ * tool, when set to a valid sdkman version identifier.
+ *
+ * @param {string} tool Tool name
+ * @returns {string|undefined} Overridden version identifier.
+ */
+export declare function readToolVersionOverride(tool: string): string | undefined;
+/**
+ * Read the container/CI version hint (`MAVEN_VERSION` etc.) for a tool, when
+ * set to a valid sdkman version identifier.
+ *
+ * @param {string} tool Tool name
+ * @returns {string|undefined} Hinted version identifier.
+ */
+export declare function readToolVersionEnvHint(tool: string): string | undefined;
+/**
+ * Detect the JDK major a project asks for from its build files: Gradle
+ * toolchain declarations (`JavaLanguageVersion.of(N)`) and Maven compiler or
+ * enforcer properties (`maven.compiler.release`, `maven.compiler.source`,
+ * `requireJavaVersion`). The scan is intentionally line-based and
+ * conservative: it only recognises whole-number values.
+ *
+ * @param {string} projectPath Project directory
+ * @returns {number|undefined} JDK major requested by the project.
+ */
+export declare function detectProjectJavaMajor(projectPath: string): number | undefined;
+//# sourceMappingURL=jvmToolEnv.d.ts.map

package/types/lib/inventory/jvmToolEnv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jvmToolEnv.d.ts","sourceRoot":"","sources":["../../../lib/inventory/jvmToolEnv.js"],"names":[],"mappings":"AAMA,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,uBAAuB,CAAC;AAE/B;;;;;GAKG;AACH,OAAO,EACL,eAAe,IAAI,qBAAqB,EACxC,gBAAgB,EAChB,mBAAmB,GACpB,CAAC;AAuBF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAHjC,MAGiC,GAF/B,OAAO,CASnB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EALxC,MAKwC,GAJtC,MAAM,GAAC,SAAS,CAmB5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAJ3B,MAI2B,GAHzB,MAAM,GAAC,SAAS,CA4C5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,GAHpC,MAAM,GAAC,SAAS,CAwC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAJrC,MAIqC,GAHnC,MAAM,GAAC,SAAS,CAgC5B;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAH9C,MAG8C,GAF5C,MAAM,GAAC,SAAS,CAkB5B;AAsDD;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,iDAKjC,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,wBAM5B,CAAC;AAEF,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAH1C,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAGK,GAFxC,MAAM,GAAC,SAAS,CAc5B;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAH1C,MAG0C,GAFxC,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAHlC,MAGkC,GAFhC,MAAM,EAAE,CAgBpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAJjC,MAIiC,EAAE,MAAM,EAHzC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAwB5B;AAED;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,wBAKtC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,wBAKtC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAHjC,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAS5B;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAHhC,MAGgC,GAF9B,MAAM,GAAC,SAAS,CAS5B;AASD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAHvC,MAGuC,GAFrC,MAAM,GAAC,SAAS,CAuB5B"}

package/types/lib/inventory/osinfo.d.ts

@@ -82,6 +82,85 @@ export declare const OS_DISTRO_ALIAS: {
     "red hat enterprise linux 9": string;
     "red hat enterprise linux 10": string;
 };
+/**
+ * Canonical purl namespace for distro vendors that are published under more
+ * than one spelling. Both the os-release path (`getDistroInfo`) and the trivy
+ * passthrough in `lib/managers/binary.js` route through this single map so the
+ * two paths cannot drift apart again.
+ *
+ * Azure Linux 2.0 is CBL-Mariner 2.0 — Microsoft renamed the product — and the
+ * OSV feed publishes `pkg:rpm/azure-linux/<name>` for every generation
+ * (ecosystems "Azure Linux:2" and "Azure Linux:3"), so the historical
+ * spellings azurelinux, cbl-mariner and mariner all canonicalise to
+ * "azure-linux". rhel/ol/amzn/opensuse-* are the cases previously inlined in
+ * getDistroInfo(); alma/rocky-linux were previously inlined in binary.js.
+ *
+ * Amazon Linux canonicalises to "amazon", the spelling the vulnerability feeds
+ * publish (AppThreat vuln-list `amazon`): the os-release ID is `amzn` and
+ * trivy emits `amazon`, and the previous `amazonlinux` mapping here matched
+ * neither, so live-host Amazon Linux purls matched nothing at all.
+ */
+export declare const OS_NAMESPACE_ALIAS: {
+    alma: string;
+    amazonlinux: string;
+    amzn: string;
+    azurelinux: string;
+    "cbl-mariner": string;
+    mariner: string;
+    ol: string;
+    "opensuse-leap": string;
+    "opensuse-tumbleweed": string;
+    rhel: string;
+    "rocky-linux": string;
+};
+/**
+ * Vendor prefixes that `distro` qualifier values are canonicalised for, so one
+ * release has exactly one qualifier value no matter which side produced it.
+ *
+ * trivy stamps the qualifier from its own distro table while cdxgen stamps it
+ * from os-release, and the two disagree: an Oracle Linux 9.8 image came out
+ * with `oracle-9.8` on 99 components and `ol-9.8` on 43, and a RHEL 9.8 image
+ * with namespace `redhat` but qualifier `rhel-9.8`. Canonicalising both sides
+ * through this map collapses each release onto the vendor its purl namespace
+ * already uses.
+ *
+ * SUSE is deliberately absent. `sles-15.6`, `opensuse-leap-15.6` and
+ * `opensuse-tumbleweed-<snapshot>` are the values consumers derive the release
+ * channel from (vulnerability-db maps them to per-release channels), and both
+ * sides already agree on them; folding Leap and Tumbleweed onto a bare
+ * `opensuse-` vendor would destroy exactly the distinction that matters.
+ *
+ * Keys are matched longest-first so `cbl-mariner-2.0` resolves against the
+ * full vendor segment rather than a shorter prefix.
+ */
+export declare const OS_DISTRO_QUALIFIER_ALIAS: {
+    alma: string;
+    amazonlinux: string;
+    amzn: string;
+    azurelinux: string;
+    "cbl-mariner": string;
+    mariner: string;
+    ol: string;
+    rhel: string;
+    "rocky-linux": string;
+};
+/**
+ * Whether a `distro` qualifier value is safe to place in a purl unencoded.
+ *
+ * @param {string} qualifier - distro qualifier value
+ * @returns {boolean} true when the value contains only purl-safe characters
+ */
+export declare function isCleanDistroQualifier(qualifier: string): boolean;
+/**
+ * Canonicalise the vendor prefix of a `distro` qualifier value
+ * (e.g. "cbl-mariner-2.0" or "mariner-2.0" -> "azure-linux-2.0") so a release
+ * has exactly one qualifier spelling regardless of which tool emitted it.
+ * Values without a known vendor prefix are returned unchanged.
+ *
+ * @param {string} qualifier - distro qualifier value such as "azurelinux-3.0"
+ * @returns {string} canonical qualifier value
+ */
+export declare function canonicalDistroQualifier(qualifier: string): string;
 /**
  * Parse an os-release file from an arbitrary root path and return a plain
  * key→value object.  Results are cached per root path so the file is read
@@ -101,8 +180,10 @@ export declare function _resetOsReleaseCache(): void;
  *
  * Returns an object with:
  *   - purlType    {string}  "deb" | "apk" | "rpm"
- *   - namespace   {string}  purl namespace (e.g. "ubuntu", "alpine", "fedora")
- *   - distroId    {string}  ID + "-" + VERSION_ID  (e.g. "ubuntu-22.04")
+ *   - namespace   {string}  canonical purl namespace (e.g. "ubuntu", "alpine",
+ *                           "azure-linux" for both Azure Linux and CBL-Mariner)
+ *   - distroId    {string}  ID + "-" + VERSION_ID with a canonical vendor
+ *                           prefix (e.g. "ubuntu-22.04", "azure-linux-3.0")
  *   - distroName  {string}  codename/alias          (e.g. "jammy")
  *
  * Mirrors the logic in lib/managers/binary.js getOSPackages() so that both

package/types/lib/inventory/osinfo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"osinfo.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osinfo.js"],"names":[],"mappings":"AAGA;;;GAGG;AACH,eAAO,MAAM,eAAe;IAC1B,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,WAAW;IACX,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,UAAU;IACV,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,0BAA0B;IAC1B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,6BAA6B;CAC9B,CAAC;AAQF;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAJ/B,CAEA,EAFQ,MAI6B,GAF3B,MAAM,CAqClB;AAGD;;GAEG;AACH,wBAAgB,oBAAoB,SAEnC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAH/B,CACA,EADQ,MAG6B,GAF3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAmHzF"}
+{"version":3,"file":"osinfo.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osinfo.js"],"names":[],"mappings":"AAGA;;;GAGG;AACH,eAAO,MAAM,eAAe;IAC1B,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,WAAW;IACX,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,UAAU;IACV,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,0BAA0B;IAC1B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,6BAA6B;CAC9B,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB;IAC7B,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,EAAE;IACF,eAAe;IACf,qBAAqB;IACrB,IAAI;IACJ,aAAa;CACd,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,yBAAyB;IACpC,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,EAAE;IACF,IAAI;IACJ,aAAa;CACd,CAAC;AASF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAHrC,MAGqC,GAFnC,OAAO,CAInB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,CAYlB;AAQD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAJ/B,CAEA,EAFQ,MAI6B,GAF3B,MAAM,CAqClB;AAGD;;GAEG;AACH,wBAAgB,oBAAoB,SAEnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAH/B,CACA,EADQ,MAG6B,GAF3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAkHzF"}

package/types/lib/inventory/table.d.ts

@@ -7,7 +7,10 @@
  */
 export declare function table(rows: any[][], config?: Object): string;
 /**
- * Create a streaming table writer that renders rows to stdout incrementally.
+ * Create a streaming table writer that renders rows incrementally.
+ *
+ * Rows go to the diagnostic stream: a rendered table is human-readable output,
+ * and writing it to stdout corrupted the BOM document under `-o -`.
  *
  * @param {Object} [config={}] Table configuration (header, columns, border style)
  * @returns {{write(row: *): void, end(): void}} Writer whose `end()` emits the bottom border

package/types/lib/inventory/table.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"table.d.ts","sourceRoot":"","sources":["../../../lib/inventory/table.js"],"names":[],"mappings":"AAgNA;;;;;;GAMG;AACH,wBAAgB,KAAK,CAAC,IAAI,EAJf,OAIe,EAAE,MAAM,AAH/B,CACA,EADQ,MAG4B,GAF1B,MAAM,CAIlB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,AAHhC,CACA,EADQ,MAG6B,GAF3B;IAAC,KAAK,CAAC,GAAG,EAAE,GAAC,GAAG,IAAI,CAAC;IAAC,GAAG,IAAI,IAAI,CAAA;CAAC,CAuC9C"}
+{"version":3,"file":"table.d.ts","sourceRoot":"","sources":["../../../lib/inventory/table.js"],"names":[],"mappings":"AAiNA;;;;;;GAMG;AACH,wBAAgB,KAAK,CAAC,IAAI,EAJf,OAIe,EAAE,MAAM,AAH/B,CACA,EADQ,MAG4B,GAF1B,MAAM,CAIlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,MAAM,AAHhC,CACA,EADQ,MAG6B,GAF3B;IAAC,KAAK,CAAC,GAAG,EAAE,GAAC,GAAG,IAAI,CAAC;IAAC,GAAG,IAAI,IAAI,CAAA;CAAC,CAuC9C"}