@cdxgen/cdxgen 13.0.0 → 13.1.0

package/types/lib/inventory/toolRequirements.d.ts

@@ -0,0 +1,216 @@
+/**
+ * Resolve the ecosystem a declared tool belongs to.
+ *
+ * @param {string} tool Declared tool name
+ * @returns {string} cdxgen ecosystem name, or "generic" for unknown tools.
+ */
+export declare function ecosystemForTool(tool: string): string;
+/**
+ * Check whether a version identifier carries a prerelease suffix such as
+ * `-rc-3`, `-M2`, or `-milestone-1`. The marker list is exact so that vendor
+ * suffixes that merely begin with the same letters, such as the `-crac` java
+ * distributions, stay classified as stable.
+ *
+ * @param {string} version Version identifier
+ * @returns {boolean} True for prerelease versions.
+ */
+export declare function isPrereleaseVersion(version: string): boolean;
+/**
+ * Compare two dotted version identifiers. Numeric components are compared
+ * numerically, stable releases rank above prereleases, and prerelease
+ * suffixes are compared token-wise so `rc-9` beats `rc-10` only when
+ * numerically larger. Missing components count as zero, so `21` equals
+ * `21.0.0`.
+ *
+ * @param {string} a First version
+ * @param {string} b Second version
+ * @returns {number} Negative when a < b, positive when a > b, zero on equality.
+ */
+export declare function compareVersions(a: string, b: string): number;
+/**
+ * Extract the JDK major from a `java --version` style description such as
+ * `openjdk 21.0.11 2025-04-15` or a bare sdkman java identifier such as
+ * `25-tem`. General availability releases print an undotted major
+ * (`openjdk 25 2025-09-16`), so the first token starting with a digit is
+ * used rather than requiring a dotted version.
+ *
+ * @param {string} versionDesc Version description string
+ * @returns {number|undefined} JDK major version.
+ */
+export declare function extractJavaMajor(versionDesc: string): number | undefined;
+/**
+ * Extract the first version-looking token from a tool version description,
+ * such as `go version go1.23.1 darwin/arm64` or `rustc 1.82.0 (f6e511eec
+ * 2024-10-08)`. Leading letters (`v20.11.1`, `go1.23.1`) and quoting are
+ * stripped before validation.
+ *
+ * @param {string} versionDesc Raw version description
+ * @returns {string|undefined} The version token, when one is found.
+ */
+export declare function extractVersionToken(versionDesc: string): string | undefined;
+export type RequirementVerdict = "satisfied" | "violated" | "unparseable";
+/**
+ * Verdict of a declared-requirement check. `unparseable` means the wanted or
+ * found value carries no comparable version, which is never evidence of a
+ * defect: an unparseable requirement must not produce a mismatch.
+ *
+ * @typedef {"satisfied"|"violated"|"unparseable"} RequirementVerdict
+ */
+/**
+ * Check whether a found version satisfies a declared requirement. Wanted
+ * forms handled: exact versions (`3.9.9`), major-only and partial pins
+ * (`21`, `20.11`), `.x` ranges (`20.x`), caret and tilde ranges (`^20.11`,
+ * `~4.9`), comparison ranges (`>=18`, `<21`), hyphen ranges (`1.9 - 2.3`),
+ * whitespace-conjoined ranges (`>=18 <=20`), `||` alternatives, and the
+ * unconstrained `*`/`latest`. Anything else is unparseable and never
+ * violates.
+ *
+ * @param {string} found Version actually present, possibly embedded in a
+ *   longer description such as `go version go1.23.1 darwin/arm64`.
+ * @param {string} wanted Declared requirement.
+ * @returns {RequirementVerdict} Verdict of the check.
+ */
+export declare function checkVersionRequirement(found: string, wanted: string): RequirementVerdict;
+/**
+ * Classify the result of a failed tool probe. A probe that was denied the
+ * right to run must be reported as `denied` — the tool may well be present —
+ * while only evidence that the command does not exist counts as `missing`.
+ *
+ * @param {Object|string|undefined} result Result object from spawnSync, or
+ *   undefined when no result shape is known.
+ * @returns {"found"|"denied"|"missing"} Classification of the probe result.
+ */
+export declare function classifyProbeResult(result: Object | string | undefined): "found" | "denied" | "missing";
+/**
+ * Classify the active environment restriction that would stop a command from
+ * running, without the human-readable wording. `describeSpawnRestriction`
+ * derives its message from this classifier, and consumers that need to act on
+ * the cause rather than the prose use it directly.
+ *
+ * @param {string} command Command that would run
+ * @returns {"dry-run"|"secure-mode"|"allowlist"|"deno"|undefined} Restriction cause, or undefined when nothing restricts the command.
+ */
+export declare function classifySpawnRestriction(command: string): "dry-run" | "secure-mode" | "allowlist" | "deno" | undefined;
+/**
+ * Explain why a command probe may not run in the current environment, so a
+ * failed probe can be reported as degraded evidence rather than a missing
+ * tool.
+ *
+ * @param {string} command Command that was probed
+ * @returns {string|undefined} Human-readable restriction, or undefined when
+ *   the environment does not restrict the command.
+ */
+export declare function describeSpawnRestriction(command: string): string | undefined;
+/**
+ * Parse the content of an asdf/mise `.tool-versions` file into the first
+ * version each tool declares. Comment lines and inline comments are ignored;
+ * a tool line listing several versions keeps the first.
+ *
+ * @param {string} content `.tool-versions` file content
+ * @returns {Object|undefined} Map of tool name to declared version.
+ */
+export declare function parseToolVersionsFile(content: string): Object | undefined;
+/**
+ * Parse the `go` and `toolchain` directives of a `go.mod` file. The
+ * `toolchain` directive wins when both are present because it names the
+ * exact toolchain the module asks for.
+ *
+ * @param {string} content `go.mod` file content
+ * @returns {Object|undefined} `{ tool, version, directive }` with
+ *   `directive` naming the line the version came from.
+ */
+export declare function parseGoModFile(content: string): Object | undefined;
+/**
+ * Parse a `rust-toolchain.toml` or plain `rust-toolchain` file into its
+ * channel. Target-specific subsections are ignored, so only the `[toolchain]`
+ * section's `channel` key is read.
+ *
+ * @param {string} content Toolchain file content
+ * @returns {Object|undefined} `{ channel }` when a channel is declared.
+ */
+export declare function parseRustToolchainFile(content: string): Object | undefined;
+/**
+ * Parse a `package.json` content into the tool requirements it declares
+ * through `engines` and `packageManager`. The `packageManager` pin's
+ * integrity-hash suffix (`pnpm@9.1.0+sha512.…`) is stripped to the bare
+ * version.
+ *
+ * @param {string} content `package.json` content
+ * @returns {Object|undefined} Map of tool name to declared version.
+ */
+export declare function parsePackageJsonToolRequirements(content: string): Object | undefined;
+/**
+ * Parse a `global.json` file into the .NET SDK version it pins.
+ *
+ * @param {string} content `global.json` content
+ * @returns {Object|undefined} Map with the `dotnet` requirement.
+ */
+export declare function parseGlobalJsonToolRequirements(content: string): Object | undefined;
+/**
+ * Parse the `requires-python` declaration of a `pyproject.toml` file.
+ *
+ * @param {string} content `pyproject.toml` content
+ * @returns {Object|undefined} Map with the `python` requirement.
+ */
+export declare function parsePyprojectRequiresPython(content: string): Object | undefined;
+/**
+ * Parse an `.nvmrc` file into the Node.js version it requests.
+ *
+ * @param {string} content `.nvmrc` content
+ * @returns {Object|undefined} Map with the `node` requirement.
+ */
+export declare function parseNvmrc(content: string): Object | undefined;
+/**
+ * Parse a `.python-version` file into the interpreter version it requests.
+ *
+ * @param {string} content `.python-version` content
+ * @returns {Object|undefined} Map with the `python` requirement.
+ */
+export declare function parsePythonVersionFile(content: string): Object | undefined;
+/**
+ * Parse a `.java-version` file into the JDK version it pins. Both the bare
+ * major (`21`) and a full version (`21.0.5`) occur in the wild, and both are
+ * passed through verbatim — an install command needs the exact declaration.
+ *
+ * The legacy `1.N` spelling of a pre-9 release (`1.8`, `1.8.0_302`) is
+ * normalised to its modern major (`8`), because it is the major line that
+ * names a package: the literal declaration yields `Temurin.1.JDK`, which no
+ * provisioner offers.
+ *
+ * Distribution-prefixed values written by version managers (`temurin-21`,
+ * `openjdk64-17.0.1`) name a vendor build rather than a release, so they are
+ * left unparsed rather than turned into an install argument no provisioner
+ * accepts; the run then reports the version as unresolved and the agent asks.
+ *
+ * @param {string} content `.java-version` content
+ * @returns {Object|undefined} Map with the `java` requirement.
+ */
+export declare function parseJavaVersionFile(content: string): Object | undefined;
+/**
+ * Parse the `BUNDLED WITH` section of a `Gemfile.lock` into the bundler
+ * version the lockfile was written with.
+ *
+ * @param {string} content `Gemfile.lock` content
+ * @returns {string|undefined} Bundler version, when declared.
+ */
+export declare function parseGemfileLockBundlerVersion(content: string): string | undefined;
+/**
+ * Read every declared tool requirement a project directory declares through
+ * its well-known tool pin files: `.tool-versions`, `.nvmrc`, `.java-version`,
+ * `.python-version`, `pyproject.toml`, `go.mod`, `rust-toolchain.toml`,
+ * `rust-toolchain`, `package.json`, and `global.json`. Missing files are
+ * skipped; each entry names the file that declared it so the report can
+ * trace every expectation back to its source.
+ *
+ * @param {string} projectPath Project directory to inspect
+ * @returns {Array<{tool: string, wanted: string, source: string, ecosystem: string, path: string}>}
+ *   Declared requirements, empty when the directory declares none.
+ */
+export declare function readDeclaredToolRequirements(projectPath: string): Array<{
+    tool: string;
+    wanted: string;
+    source: string;
+    ecosystem: string;
+    path: string;
+}>;
+//# sourceMappingURL=toolRequirements.d.ts.map

package/types/lib/inventory/toolRequirements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolRequirements.d.ts","sourceRoot":"","sources":["../../../lib/inventory/toolRequirements.js"],"names":[],"mappings":"AAqEA;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAH1B,MAG0B,GAFxB,MAAM,CAIlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,GAF9B,OAAO,CAanB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAJtB,MAIsB,EAAE,CAAC,EAHzB,MAGyB,GAFvB,MAAM,CA0ClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAHjC,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAHpC,MAGoC,GAFlC,MAAM,GAAC,SAAS,CAgB5B;AAOE,YAAgD,kBAAkB,GAAxD,WAAW,GAAC,UAAU,GAAC,aAAa,CAAoB;AALrE;;;;;;GAMG;AAEH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EALlC,MAKkC,EAAE,MAAM,EAH1C,MAG0C,GAFxC,kBAAkB,CAsB9B;AAyID;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAJ/B,MAAM,GAAC,MAAM,GAAC,SAIiB,GAF7B,OAAO,GAAC,QAAQ,GAAC,SAAS,CAmCtC;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAHrC,MAGqC,GAFnC,SAAS,GAAC,aAAa,GAAC,WAAW,GAAC,MAAM,GAAC,SAAS,CAkChE;AASD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAJrC,MAIqC,GAHnC,MAAM,GAAC,SAAS,CAM5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAHlC,MAGkC,GAFhC,MAAM,GAAC,SAAS,CAuB5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAJ3B,MAI2B,GAHzB,MAAM,GAAC,SAAS,CAiC5B;AAaD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAqC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAH7C,MAG6C,GAF3C,MAAM,GAAC,SAAS,CAgC5B;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAH5C,MAG4C,GAF1C,MAAM,GAAC,SAAS,CAiB5B;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAHzC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAHvB,MAGuB,GAFrB,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAQ5B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAHjC,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAH3C,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAwB5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAAC,WAAW,EAJ7C,MAI6C,GAH3C,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,CAAC,CAwFlG"}

package/types/lib/managers/binary.d.ts

@@ -22,6 +22,77 @@ export declare function getCargoAuditableInfo(src: string): string | undefined;
  * @returns {undefined|Object} Command output
  */
 export declare function executeSourcekitten(args: any[]): undefined | Object;
+/**
+ * Canonicalise the distro vendor namespace of an OS package component
+ * produced by trivy, regardless of whether trivy expressed the vendor via the
+ * purl namespace or the component group (it is inconsistent between
+ * packages). e.g. pkg:rpm/alma/... -> pkg:rpm/almalinux/... and
+ * pkg:rpm/cbl-mariner/... -> pkg:rpm/azure-linux/... so the purls match the
+ * vulnerability feeds. Also aligns the ``distro`` qualifier vendor prefix
+ * (alma-9.8 -> almalinux-9.8, mariner-2.0 -> azure-linux-2.0), including
+ * spellings that disagree with the namespace, and rebuilds ``group`` and
+ * ``bom-ref`` from the rewritten purl.
+ *
+ * The namespace table is OS_NAMESPACE_ALIAS from lib/inventory/osinfo.js so
+ * the trivy path and the os-release path (getDistroInfo) cannot drift apart.
+ *
+ * A `distro` qualifier that is not purl-safe (trivy emits Amazon Linux as
+ * `amazon-2023.12.20260727+(Amazon Linux)`) is replaced with the os-release
+ * derived value, or dropped when there is none: an unusable qualifier
+ * invalidates the purl and fails validation for the whole BOM.
+ *
+ * @param {Object} comp trivy OS package component (mutated in place)
+ * @param {Object} purlObj parsed PackageURL of comp.purl (mutated in place)
+ * @param {string} name component package name (basename form)
+ * @param {string} group component group derived from the trivy component name
+ * @param {string} [distroId] canonical os-release distro id, e.g. "amazon-2023"
+ * @returns {string} the canonicalised group
+ */
+export declare function canonicaliseOsPackageNamespace(comp: Object, purlObj: Object, name: string, group: string, distroId?: string): string;
+/**
+ * Repair a `distro` qualifier that cannot survive purl parsing, in place.
+ *
+ * trivy stamps Amazon Linux with the full pretty version — the qualifier
+ * arrives as `distro=amazon-2023.12.20260727+%28Amazon+Linux%29`, whose spaces
+ * and parentheses `Purl.parse` rejects outright ("Invalid character in
+ * qualifier distro"). The component then bypasses every canonicalisation below
+ * (they all need a parsed purl) and reaches the BOM verbatim, where schema
+ * validation fails and the *entire* SBOM is discarded — an Amazon Linux scan
+ * produces no output at all today.
+ *
+ * The release is already known from os-release, so the unusable value is
+ * swapped for it; with no usable replacement the qualifier is dropped, since a
+ * missing qualifier costs one matching hint while an invalid one costs the
+ * whole document.
+ *
+ * @param {Object} comp component whose purl may carry an unusable qualifier
+ * @param {string} [distroId] canonical os-release distro id, e.g. "amazon-2023"
+ * @returns {Object} the same component
+ */
+export declare function repairOsComponentPurl(comp: Object, distroId?: string): Object;
+/**
+ * Drop source-package shadow components that duplicate a real installed
+ * package, in place.
+ *
+ * A shadow is emitted whenever an rpm/deb declares a source name different
+ * from its own (bzip2-libs -> bzip2) so that scanners keying on source names
+ * still match. When the source package is *itself* installed at the same
+ * version, the shadow's purl is identical to the real component's and the two
+ * collapse in trimComponents() — which keeps whichever was seen first and
+ * never merges `tags`. Seen-first is trivy's listing order, so the outcome is
+ * arbitrary: when the shadow wins, a genuinely installed package is reported
+ * with `tags: ["source"]` and identity confidence 0, the very marker the
+ * shadow carries so consumers can filter shadows out. That turns a real
+ * package into a filtered-away one.
+ *
+ * Dropping the redundant shadow is loss-free: it duplicates the real
+ * component's purl (so nothing that matches on purl changes) and its bom-ref
+ * is byte-identical, so no dependency reference can dangle.
+ *
+ * @param {Array} pkgList component list, mutated in place
+ * @returns {Array} the same list, for convenience
+ */
+export declare function dropRedundantSourceComponents(pkgList: any[]): any[];
 /**
  * Get the packages installed in the container image filesystem.
  *

package/types/lib/managers/binary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"binary.d.ts","sourceRoot":"","sources":["../../../lib/managers/binary.js"],"names":[],"mappings":"AA0YA;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,AAH9C,CACA,EADQ,MAAM,EAGqC,GAFzC,MAAM,EAAE,CAgBpB;AA4FD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,GAH5B,MAAM,GAAC,SAAS,CAmB5B;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,OAAA,GAF3B,SAAS,GAAC,MAAM,CAkB5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,GAAG,QAAA,EAAE,WAAW,EAL7B,MAK6B,EAAE,OAAO,KAAK,GAFrD,MAAM,CA2mBlB;AAkwDD;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,AALvD,CACA,EADQ,MAAM,EAK8C,GAJlD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAC,CAmEnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EALzB,MAKyB,GAJvB,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAJxB,MAIwB,EAAE,UAAU,EAHpC,MAGoC,WAqC9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EANrB,MAMqB,EAAE,aAAa,EALpC,MAKoC,EAAE,QAAQ,EAJ9C,OAI8C,GAF7C,OAAO,CAiClB"}
+{"version":3,"file":"binary.d.ts","sourceRoot":"","sources":["../../../lib/managers/binary.js"],"names":[],"mappings":"AA0YA;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,AAH9C,CACA,EADQ,MAAM,EAGqC,GAFzC,MAAM,EAAE,CAgBpB;AA4FD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,GAH5B,MAAM,GAAC,SAAS,CAmB5B;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,OAAA,GAF3B,SAAS,GAAC,MAAM,CAkB5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EARK,MAQL,EACJ,OAAO,EARE,MAQF,EACP,IAAI,EARK,MAQL,EACJ,KAAK,EARI,MAQJ,EACL,QAAQ,AARP,CACA,EADQ,MAQD,GAPG,MAAM,CAgDlB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAJ/B,MAI+B,EAAE,QAAQ,AAHjD,CACA,EADQ,MAGyC,GAFvC,MAAM,CA6BlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,OAAA,SAoBpD;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,GAAG,QAAA,EAAE,WAAW,EAL7B,MAK6B,EAAE,OAAO,KAAK,GAFrD,MAAM,CA4mBlB;AAkwDD;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,AALvD,CACA,EADQ,MAAM,EAK8C,GAJlD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAC,CAmEnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EALzB,MAKyB,GAJvB,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAJxB,MAIwB,EAAE,UAAU,EAHpC,MAGoC,WA6C9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EANrB,MAMqB,EAAE,aAAa,EALpC,MAKoC,EAAE,QAAQ,EAJ9C,OAI8C,GAF7C,OAAO,CAiClB"}

package/types/lib/managers/docker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../lib/managers/docker.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAuCrC,yDAAyD;AACzD,eAAO,MAAM,KAAK,SAA0B,CAAC;AAC7C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAEoC,CAAC;AAsQ/C;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,SAHnB,MAAM,KACJ,MAiBZ,CAAC;AAEF;;GAEG;AACH,wBAAgB,YAAY,QAoB3B;AAED;;GAEG;AACH,wBAAgB,oBAAoB,QA2CnC;AAyTD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,aANf,MAAM,gBAEN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,SAAS,CA6HpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,SANb,MAAM,UACN,MAAM,gBACN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,MAAM,GAAC,SAAS,CAgC3C,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;;;;;;CA2E1B,CAAC;AAkCF;;GAEG;AACH,eAAO,MAAM,QAAQ,sCA2LpB,CAAC;AAGC,YAA4B,gBAAgB,GAAlC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAkB;AAiH/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,kBANZ,MAAM,OACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,OAAO,CAiF3B,CAAC;AAiGF;;;GAGG;AACH,eAAO,MAAM,aAAa,mEA6FzB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,iBATrB,MAAM,aACN,MAAM,WACN,MAAM,wBACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,MAAM,CAwH1B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,oDAkJvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,iDAkJ1B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,kBALb,MAAM,UACN,OAAO,KACL,OAAO,CAAC,MAAM,GAAC,SAAS,CAKpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,cALpB,MAAM,iBACN,MAAM,KACJ,MAAM,GAAC,SA2CnB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,qBAHpB,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,cACnC,KAAK,CAAC,MAAM,CAAC,SA4BvB,CAAC"}
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../lib/managers/docker.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAwCrC,yDAAyD;AACzD,eAAO,MAAM,KAAK,SAA0B,CAAC;AAC7C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAEoC,CAAC;AAsQ/C;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,SAHnB,MAAM,KACJ,MAiBZ,CAAC;AAEF;;GAEG;AACH,wBAAgB,YAAY,QAoB3B;AAED;;GAEG;AACH,wBAAgB,oBAAoB,QA2CnC;AAyTD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,aANf,MAAM,gBAEN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,SAAS,CA6HpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,SANb,MAAM,UACN,MAAM,gBACN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,MAAM,GAAC,SAAS,CAgC3C,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;;;;;;CA2E1B,CAAC;AAkCF;;GAEG;AACH,eAAO,MAAM,QAAQ,sCA2LpB,CAAC;AAGC,YAA4B,gBAAgB,GAAlC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAkB;AAiH/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,kBANZ,MAAM,OACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,OAAO,CAqF3B,CAAC;AAiGF;;;GAGG;AACH,eAAO,MAAM,aAAa,mEAqGzB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,iBATrB,MAAM,aACN,MAAM,WACN,MAAM,wBACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,MAAM,CAgI1B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,oDAkJvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,iDAkJ1B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,kBALb,MAAM,UACN,OAAO,KACL,OAAO,CAAC,MAAM,GAAC,SAAS,CAKpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,cALpB,MAAM,iBACN,MAAM,KACJ,MAAM,GAAC,SA2CnB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,qBAHpB,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,cACnC,KAAK,CAAC,MAAM,CAAC,SA4BvB,CAAC"}

package/types/lib/stages/postgen/annotationBuilder.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Shared assembly of CycloneDX document-level annotations.
+ *
+ * Two postgen features attach findings to the BOM document as annotations
+ * whose `subjects` is the BOM serial number: the BOM audit's rule findings and
+ * the build introspection's remediations. Both describe the document rather
+ * than a component, both are annotated by the cdxgen tool component from
+ * metadata, and both carry the document's own timestamp because an annotation
+ * describes the document it is attached to. The structured facts travel as
+ * `name`/`value` pairs rendered into the annotation text, one `:evidence:<key>`
+ * entry per evidence item.
+ */
+/**
+ * Flatten an evidence object into `:evidence:<key>` property entries. Nested
+ * values are serialized as JSON so every property value stays a string.
+ *
+ * @param {string} propertyNamePrefix Property namespace, e.g. "cdx:audit".
+ * @param {Object} evidence Arbitrary key/value evidence facts.
+ * @returns {{name: string, value: string}[]} Property entries.
+ */
+export declare function evidenceProperties(propertyNamePrefix: string, evidence: Object): {
+    name: string;
+    value: string;
+}[];
+/**
+ * Build one document-level annotation. Returns undefined when the BOM carries
+ * no cdxgen tool component to annotate with; the caller decides whether that
+ * is worth a warning.
+ *
+ * @param {Object} params Annotation inputs.
+ * @param {Object} params.bomJson CycloneDX BOM the annotation describes.
+ * @param {string} params.message Leading annotation sentence.
+ * @param {{name: string, value: string}[]} params.properties Structured facts rendered into the annotation text.
+ * @returns {Object|undefined} CycloneDX annotation, or undefined without an annotator.
+ */
+export declare function buildDocumentAnnotation({ bomJson, message, properties }: {
+    bomJson: Object;
+    message: string;
+    properties: {
+        name: string;
+        value: string;
+    }[];
+}): Object | undefined;
+/**
+ * Warn that a document could not be annotated because it carries no cdxgen
+ * tool component. Suppressed outside debug mode, where the missing annotator
+ * is an expected shape for foreign BOMs.
+ *
+ * @param {string} feature Feature that wanted to annotate.
+ * @returns {void}
+ */
+export declare function warnMissingAnnotator(feature: string): void;
+//# sourceMappingURL=annotationBuilder.d.ts.map

package/types/lib/stages/postgen/annotationBuilder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"annotationBuilder.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/annotationBuilder.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAmBH;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,kBAAkB,EAJ1C,MAI0C,EAAE,QAAQ,EAHpD,MAGoD,GAFlD;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAe3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,EALrE;IAAuB,OAAO,EAAtB,MAAM,CACd;IAAuB,OAAO,EAAtB,MAAM,CACd;IAAgD,UAAU,EAAlD;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,EAAE,CACvC;CAEqE,GAF3D,MAAM,GAAC,SAAS,CAkB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAHjC,MAGiC,GAF/B,IAAI,CAQhB"}

package/types/lib/stages/postgen/auditBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auditBom.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/auditBom.js"],"names":[],"mappings":"AA8DA;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,OAAO,CA4BnB;AAuBD;;;;;GAKG;AACH,wBAAsB,+BAA+B,CAAC,OAAO,AAH1D,CACA,EADQ,MAGuD,GAFrD,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAKrG;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAHvC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAGvC,GAFrC,MAAM,CAOlB;AA+BD;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAHzC,MAGyC,EAAE,OAAO,GAFlD,MAEuD,QAuBjE;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAAC,OAAO,EAH9C,MAG8C,EAAE,OAAO,GAFvD,MAE4D,iBAkCtE;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,OAAO,CAwC1B;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,OAAA,GAFvC,MAAM,CAmClB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,OAAA,GAF/B,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,OAAA,EAAE,OAAO,EAHxC,MAGwC,SAuFlD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,KAAA,EAAE,OAAO,KAAA,OAQpD"}
+{"version":3,"file":"auditBom.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/auditBom.js"],"names":[],"mappings":"AAyEA;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,OAAO,CA4BnB;AAuBD;;;;;GAKG;AACH,wBAAsB,+BAA+B,CAAC,OAAO,AAH1D,CACA,EADQ,MAGuD,GAFrD,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAKrG;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAHvC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAGvC,GAFrC,MAAM,CAOlB;AA+BD;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAHzC,MAGyC,EAAE,OAAO,GAFlD,MAEuD,QAuBjE;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAAC,OAAO,EAH9C,MAG8C,EAAE,OAAO,GAFvD,MAE4D,iBAkCtE;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,OAAO,CAwC1B;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,OAAA,GAFvC,MAAM,CAmClB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,OAAA,GAF/B,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,OAAA,EAAE,OAAO,EAHxC,MAGwC,SAyElD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,KAAA,EAAE,OAAO,KAAA,OAQpD"}

package/types/lib/stages/postgen/introspection/annotate.d.ts

@@ -0,0 +1,81 @@
+/**
+ * BOM mutations that carry the introspection verdict inside the document:
+ * eight metadata properties and a block of document-level annotations.
+ *
+ * Sidecar report files get lost; the BOM travels. A consumer who receives
+ * only the BOM still learns how much to trust it from the metadata properties,
+ * and the annotations carry one entry per remediation the loop should act on.
+ * No component or dependency is touched.
+ *
+ * Both mutations are replace-by-name: a document that was already introspected
+ * (a BOM enriched again after an evidence pass) loses its previous
+ * introspection state and gains a fresh one, so the verdict always describes
+ * the final document.
+ */
+/**
+ * Version of the introspection BOM surface. Matches the JSON report's
+ * schemaVersion so the two stay comparable.
+ *
+ * @type {string}
+ */
+export declare const INTROSPECTION_SCHEMA_VERSION: string;
+/**
+ * Namespace of every property and annotation entry this module emits.
+ *
+ * @type {string}
+ */
+export declare const INTROSPECTION_PROPERTY_PREFIX: string;
+/**
+ * The metadata properties that summarize the verdict, in emission order. The
+ * overall tier and confidence are omitted when the run produced no scored row
+ * (nothing was graded, so no verdict is claimed); per-ecosystem rows cover the
+ * scored ecosystems only, since unsupported ones have neither a tier nor a
+ * score.
+ *
+ * @param {Object} reflection Reflection document from reflectOnRun.
+ * @param {Object} scored Scoring document from scoreReflection.
+ * @returns {{name: string, value: string}[]} Metadata property entries.
+ */
+export declare function introspectionMetadataProperties(reflection: Object, scored: Object): {
+    name: string;
+    value: string;
+}[];
+/**
+ * Attach the introspection verdict to the document: metadata properties plus
+ * the summary and remediation annotations. Any introspection state left on the
+ * document by a previous pass is removed first, so enrichment flows that run
+ * post-processing twice leave exactly one verdict.
+ *
+ * @param {Object} bomJson CycloneDX BOM, mutated in place.
+ * @param {Object} reflection Reflection document from reflectOnRun.
+ * @param {Object} scored Scoring document from scoreReflection.
+ * @param {Object} [guards] Emission guards.
+ * @param {boolean} [guards.annotations] False skips the annotations, for documents at a spec version that predates them.
+ * @returns {Object} The mutated BOM.
+ */
+export declare function applyIntrospectionToBom(bomJson: Object, reflection: Object, scored: Object, guards?: {
+    annotations?: boolean;
+}): Object;
+/**
+ * Stamp every formulation workflow with the id of the run that reflected over
+ * the document, so a later consumer of the BOM can tell a formulation record
+ * this run generated from one that arrived with a foreign BOM. The stamp is
+ * replace-by-name, matching how the rest of the verdict mutates the
+ * document: a BOM enriched twice keeps only the latest run's id.
+ *
+ * @param {Object} bomJson CycloneDX BOM, mutated in place.
+ * @param {string} runId Run id of the introspection pass.
+ * @returns {Object} The mutated BOM.
+ */
+export declare function applyFormulationRunIdMarker(bomJson: Object, runId: string): Object;
+/**
+ * Whether a BOM already carries an introspection verdict.
+ *
+ * Evidence collection re-processes a finished BOM through a fresh wrapper, so
+ * the document itself is the only marker that survives between passes.
+ *
+ * @param {Object} bomJson CycloneDX BOM.
+ * @returns {boolean} True when the BOM was already introspected.
+ */
+export declare function hasIntrospectionVerdict(bomJson: Object): boolean;
+//# sourceMappingURL=annotate.d.ts.map

package/types/lib/stages/postgen/introspection/annotate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"annotate.d.ts","sourceRoot":"","sources":["../../../../../lib/stages/postgen/introspection/annotate.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,EAF/B,MAEuC,CAAC;AAElD;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAFhC,MAEsD,CAAC;AAEjE;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,EAJ/C,MAI+C,EAAE,MAAM,EAHvD,MAGuD,GAFrD;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CA6C3C;AAoHD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EARE,MAQF,EACP,UAAU,EARD,MAQC,EACV,MAAM,EARG,MAQH,EACN,MAAM,AARL,CAEA,EADA;IAAyB,WAAW,AAApC,CACA,EADQ,OAAO,CACf;CAMU,GANA,MAAM,CAsClB;AAgBD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAJxC,MAIwC,EAAE,KAAK,EAH/C,MAG+C,GAF7C,MAAM,CAsBlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAOnB"}

package/types/lib/stages/postgen/introspection/commandFacts.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Command-facts collector for command shaping.
+ *
+ * Gathers, once per run and cached, the project facts the command resolver
+ * consumes: which maven and gradle wrapper scripts the project root carries,
+ * which Python manager owns its lock files, and which npm client the project
+ * names or locks. Detection is filesystem reads only — existence and, for
+ * the platform's own shell scripts, the executable bit. Nothing here spawns
+ * a process: whether a wrapper actually runs is a question the run itself
+ * answers elsewhere, and shaping that cannot know says so through the
+ * resolver's fallbacks.
+ */
+/**
+ * Gather the command-shaping facts for a project root. The result is cached
+ * per root, so repeated scoring passes over the same project read the
+ * filesystem once.
+ *
+ * @param {string} projectRoot Directory that was scanned.
+ * @param {Object} [options] Test hooks.
+ * @param {"posix"|"windows"} [options.platform] Platform override; defaults to the runtime platform.
+ * @returns {import("./shapeCommand.js").CommandFacts} Facts for the resolver.
+ */
+export declare function collectCommandFacts(projectRoot: string, options?: {
+    platform?: "posix" | "windows";
+}): import("./shapeCommand.js").CommandFacts;
+/**
+ * Forget the gathered facts. Test hook; a production run gathers once.
+ *
+ * @returns {void}
+ */
+export declare function clearCommandFactsCache(): void;
+//# sourceMappingURL=commandFacts.d.ts.map

package/types/lib/stages/postgen/introspection/commandFacts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commandFacts.d.ts","sourceRoot":"","sources":["../../../../../lib/stages/postgen/introspection/commandFacts.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA+NH;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EALpC,MAKoC,EAAE,OAAO,AAJrD,CAEA,EADA;IAAoC,QAAQ,AAA5C,CACA,EADQ,OAAO,GAAC,SAAS,CACzB;CAE0D,GAFhD,OAAO,mBAAmB,EAAE,YAAY,CAyCpD;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAFzB,IAAI,CAIhB"}

package/types/lib/stages/postgen/introspection/emit.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Report emission for build introspection: resolving report destinations,
+ * writing the markdown and JSON reports, and printing the console summary.
+ *
+ * This module is the only place in the introspection chain that touches the
+ * filesystem or prints, which keeps every renderer above it pure and
+ * testable against committed fixtures. All writes go through the safe
+ * wrappers, and dry-run mode produces the report without writing anything.
+ */
+/**
+ * Report destination meaning "write this report to the diagnostic stream".
+ *
+ * @type {string}
+ */
+export declare const INTROSPECTION_STDERR_TARGET: string;
+/**
+ * Resolve the report destinations for a run. A user-provided path wins; the
+ * defaults are derived from the BOM output path so the reports travel with
+ * the BOM, falling back to the working directory when the BOM goes to stdout.
+ *
+ * @param {Object} [options] CLI options.
+ * @param {string} [options.output] Path the BOM is written to, or "-" for stdout.
+ * @param {string} [options.introspectReport] Requested markdown report path.
+ * @param {string} [options.introspectJson] Requested JSON report path.
+ * @returns {{reportPath: string, jsonPath: string}} Resolved destinations; "-" means the diagnostic stream.
+ */
+export declare function resolveIntrospectionReportPaths(options?: {
+    output?: string;
+    introspectReport?: string;
+    introspectJson?: string;
+}): {
+    reportPath: string;
+    jsonPath: string;
+};
+/**
+ * Mark every remediation in a scoring document blocked because a dry-run
+ * records intent without executing anything: no fix the report proposes can
+ * be applied by this run, so the loop must not try.
+ *
+ * @param {Object} scored Scoring document from scoreReflection, mutated in place.
+ * @returns {void}
+ */
+export declare function blockRemediationsForDryRun(scored: Object): void;
+/**
+ * Write the markdown and JSON reports for a completed reflection and return
+ * the destinations they reached. Dry-run mode prints the markdown report to
+ * the diagnostic stream instead of creating files, matching the read-only
+ * contract of the mode.
+ *
+ * @param {Object} reflection Reflection document from reflectOnRun.
+ * @param {Object} scored Scoring document from scoreReflection.
+ * @param {Object} [options] CLI options naming the report destinations.
+ * @returns {{reportTarget: string|undefined, jsonTarget: string|undefined, dryRun: boolean}} Destinations reached; undefined means the report was not produced as a file.
+ */
+export declare function emitIntrospectionReports(reflection: Object, scored: Object, options?: Object): {
+    reportTarget: string | undefined;
+    jsonTarget: string | undefined;
+    dryRun: boolean;
+};
+/**
+ * Print the console summary for a completed introspection. Called after the
+ * reports are delivered, so every path it names exists (or is the explicit
+ * stream marker). Diagnostics go to the diagnostic stream so a piped stdout
+ * never carries anything but the BOM payload.
+ *
+ * @param {Object} scored Scoring document from scoreReflection.
+ * @param {Object} [delivery] Destinations returned by emitIntrospectionReports.
+ * @returns {void}
+ */
+export declare function printIntrospectionSummary(scored: Object, delivery?: Object): void;
+//# sourceMappingURL=emit.d.ts.map

package/types/lib/stages/postgen/introspection/emit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../../../../lib/stages/postgen/introspection/emit.js"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAiBH;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAF9B,MAEoC,CAAC;AAO/C;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,AANpD,CAIA,EAHA;IAAyB,MAAM,AAA/B,CACA,EADQ,MAAM,CACd;IAAyB,gBAAgB,AAAzC,CACA,EADQ,MAAM,CACd;IAAyB,cAAc,AAAvC,CACA,EADQ,MAAM,CACd;CAEyD,GAF/C;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,CAgBlD;AAiDD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAHtC,MAGsC,GAFpC,IAAI,CAchB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EALxC,MAKwC,EAAE,MAAM,EAJhD,MAIgD,EAAE,OAAO,AAHjE,CACA,EADQ,MAG8D,GAF5D;IAAC,YAAY,EAAE,MAAM,GAAC,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,GAAC,SAAS,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAC,CAe3F;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAJrC,MAIqC,EAAE,QAAQ,AAHvD,CACA,EADQ,MAGoD,GAFlD,IAAI,CAwBhB"}