@cdxgen/cdxgen 13.0.1 → 13.1.0

package/types/lib/inventory/fetchBatch.d.ts

@@ -95,6 +95,15 @@ export declare function prefetchJson(requests: Array<{
 }>, options?: {
     timeoutMs?: number;
 }): Promise<Map<string, BatchEntry>>;
+/**
+ * Record the run-level policy or connectivity condition carried by a caught
+ * fetch error, if it names one. Shared by the batch retry loop and by the
+ * serial enrichment paths that catch and swallow the same typed errors.
+ *
+ * @param {Error} err Error caught from a `cdxgenAgent` request.
+ * @returns {void}
+ */
+export declare function recordPolicyDegradationFromError(err: Error): void;
 /**
  * Read a prefetched response, or signal that the caller should fetch it itself.
  *

package/types/lib/inventory/fetchBatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetchBatch.d.ts","sourceRoot":"","sources":["../../../lib/inventory/fetchBatch.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AA2EH;;;GAGG;AACH,wBAAgB,cAAc,IAHjB,MAAM,GAAC,IAAI,CAKvB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAFtB,OAAO,CASnB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,SAO1C;AAKE,YAAkB,UAAU,GAC5B;;;;IAAoB,EAAE,EAAX,OAAO,CAClB;;;;IAAe,IAAI,AAAnB,CACA,EADW,GAAC,CACZ;;;;IAAoB,MAAM,AAA1B,CACA,EADW,MAAM,CACjB;;;;;IAAqB,QAAQ,AAA7B,CAEF,EAFa,OAAO,CAEpB;CAAA,CAAA;AAoCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EARhC,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,CAAC,MAAM,GAAC,MAAM,GAAC,QAAQ,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAQnF,EAAE,OAAO,AANjD,CAEA,EADA;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;CAIsD,GAJ5C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAgC5C;AAifD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EARlC,GAAG,CAAC,MAAM,EAAE,UAAU,CAQY,EAAE,GAAG,EAPvC,MAOuC,GANrC;IAAC,IAAI,EAAE,GAAC,CAAA;CAAC,GAAC,SAAS,CAoB/B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,IAFlB,OAAO,CAOnB"}
+{"version":3,"file":"fetchBatch.d.ts","sourceRoot":"","sources":["../../../lib/inventory/fetchBatch.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AA8EH;;;GAGG;AACH,wBAAgB,cAAc,IAHjB,MAAM,GAAC,IAAI,CAKvB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAFtB,OAAO,CASnB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,SAO1C;AAKE,YAAkB,UAAU,GAC5B;;;;IAAoB,EAAE,EAAX,OAAO,CAClB;;;;IAAe,IAAI,AAAnB,CACA,EADW,GAAC,CACZ;;;;IAAoB,MAAM,AAA1B,CACA,EADW,MAAM,CACjB;;;;;IAAqB,QAAQ,AAA7B,CAEF,EAFa,OAAO,CAEpB;CAAA,CAAA;AAoCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EARhC,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,CAAC,MAAM,GAAC,MAAM,GAAC,QAAQ,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAQnF,EAAE,OAAO,AANjD,CAEA,EADA;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;CAIsD,GAJ5C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAgC5C;AA8UD;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAHzC,KAGyC,GAFvC,IAAI,CAuBhB;AA4LD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EARlC,GAAG,CAAC,MAAM,EAAE,UAAU,CAQY,EAAE,GAAG,EAPvC,MAOuC,GANrC;IAAC,IAAI,EAAE,GAAC,CAAA;CAAC,GAAC,SAAS,CAoB/B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,IAFlB,OAAO,CAOnB"}

package/types/lib/inventory/jvmToolEnv.d.ts

@@ -0,0 +1,189 @@
+import { compareVersions, extractJavaMajor, isPrereleaseVersion } from "./toolRequirements.js";
+/**
+ * The general-purpose version comparator, prerelease classifier, and JDK
+ * major extractor live in `toolRequirements.js` so every ecosystem shares one
+ * comparator; they are re-exported here under the names this module's
+ * consumers already use.
+ */
+export { compareVersions as compareSdkmanVersions, extractJavaMajor, isPrereleaseVersion, };
+/**
+ * Anchored validator for sdkman version identifiers such as `3.9.9`,
+ * `4.0.0-rc-5`, `8.14`, or `21.0.7-tem`. Versions are interpolated into a
+ * shell command by the sdkman installer, so every identifier must be a single
+ * safe token: it must start with a digit and may only contain digits, ascii
+ * letters, dots, and hyphens.
+ *
+ * Every separator must be followed by at least one alphanumeric character, and
+ * a single repeated group covers both the dotted numeric part and the vendor
+ * or prerelease suffix. That leaves each character exactly one role, so the
+ * pattern matches in linear time on untrusted input.
+ *
+ * @param {string} version Candidate version identifier
+ * @returns {boolean} True when the identifier is safe to pass to sdkman
+ */
+export declare function isValidSdkmanVersion(version: string): boolean;
+/**
+ * Parse a versioned JVM build tool project type such as `maven3.9.9`,
+ * `mvn3.9.9`, `gradle8.14`, `sbt1.10`, or `scala3.6.4` into its sdkman
+ * candidate name and version token.
+ *
+ * The returned object distinguishes between a syntactically valid pin and a
+ * rejected one so callers can print a precise CLI error instead of silently
+ * ignoring the type.
+ *
+ * @param {string} projectType Project type argument from the CLI
+ * @returns {Object|undefined} `{ tool, version, valid }` when the type looks
+ *   like a versioned JVM build tool, `undefined` otherwise. `valid` is false
+ *   when the version token fails validation.
+ */
+export declare function parseJvmToolProjectType(projectType: string): Object | undefined;
+/**
+ * Parse a `.sdkmanrc` environment file into the sdkman candidates it pins.
+ * Only the JVM-related candidates cdxgen knows how to provision are kept;
+ * unknown keys are ignored so newer sdkman files remain readable. Malformed
+ * lines are skipped instead of aborting the whole file.
+ *
+ * @param {string} filePath Project directory that may contain a `.sdkmanrc`
+ * @returns {Object|undefined} Map of candidate name to exact version
+ *   identifier, or `undefined` when the file is missing or unreadable.
+ */
+export declare function parseSdkmanrc(filePath: string): Object | undefined;
+/**
+ * Read the version pinned by a Gradle wrapper's `gradle-wrapper.properties`.
+ * The `distributionUrl` value may escape colons as `\:` per the Java
+ * properties format; the escapes are removed before parsing.
+ *
+ * @param {string} rootPath Directory holding the `gradle/wrapper` folder
+ * @returns {Object|undefined} `{ version, distributionUrl, distributionSha256Sum? }`
+ *   or `undefined` when the wrapper is missing or unparsable.
+ */
+export declare function readGradleWrapperVersion(rootPath: string): Object | undefined;
+/**
+ * Read the version pinned by a Maven wrapper's `maven-wrapper.properties`.
+ * Legacy wrappers (pre wrapper-distribution downloads) lack a
+ * `distributionUrl` and are treated as unpinned.
+ *
+ * @param {string} rootPath Directory holding the `.mvn/wrapper` folder
+ * @returns {Object|undefined} `{ version, distributionUrl }` or `undefined`
+ *   when the wrapper is missing or unpinned.
+ */
+export declare function readMavenWrapperVersion(rootPath: string): Object | undefined;
+/**
+ * Read the sbt version declared in `project/build.properties`. Kept here as a
+ * small properties-file read so environment preparation does not depend on
+ * higher layers.
+ *
+ * @param {string} projectPath SBT project directory
+ * @returns {string|undefined} Declared sbt version, when present and valid.
+ */
+export declare function readSbtBuildPropertiesVersion(projectPath: string): string | undefined;
+/**
+ * Minimum JDK major version required to run each build tool, keyed by the
+ * tool's major version line. Versions absent from the table fall back to the
+ * tool's `default` entry.
+ *
+ * Sources: Maven release history (maven.apache.org/docs/history.html), the
+ * Gradle compatibility table (docs.gradle.org), and the sbt setup notes.
+ *
+ * @type {Object<string, Object<number, number>|number>}
+ */
+export declare const TOOL_JDK_REQUIREMENTS: Record<string, number | Record<number, number>>;
+/**
+ * Minimum Gradle version that supports a given JDK major, for the
+ * combinations where running an older Gradle on a newer JDK is known to fail.
+ * Used to warn instead of guess-installing when the environment contradicts
+ * the project's Gradle pin.
+ *
+ * @type {Object<number, string>}
+ */
+export declare const GRADLE_JAVA_CAPS: Record<number, string>;
+/** JDK major that satisfies every current build tool minimum. */
+export declare const DEFAULT_JAVA_MAJOR = 21;
+/**
+ * Look up the minimum JDK major required to run a tool version.
+ *
+ * @param {string} tool Tool name (maven, gradle, sbt, scala)
+ * @param {string} version Tool version identifier
+ * @returns {number|undefined} Minimum JDK major, when known.
+ */
+export declare function minimumJdkForToolVersion(tool: string, version: string): number | undefined;
+/**
+ * Compute the highest JDK major required across a set of tool pins.
+ *
+ * @param {Array<{tool: string, version: string}>} toolPins Pinned tools
+ * @returns {number|undefined} Highest required JDK major, when any pin maps.
+ */
+export declare function determineRequiredJavaVersion(toolPins: Array<{
+    tool: string;
+    version: string;
+}>): number | undefined;
+/**
+ * Minimum Gradle version that can run on the given JDK major, when such a cap
+ * is known.
+ *
+ * @param {number} javaMajor JDK major version
+ * @returns {string|undefined} Minimum Gradle version, when capped.
+ */
+export declare function minimumGradleVersionForJava(javaMajor: number): string | undefined;
+/**
+ * Collect the version tokens printed by `sdk list <candidate>`. The output is
+ * a fixed-width table whose cells may carry `+`, `*`, or `>` status markers;
+ * every token that passes the sdkman version validator is kept, which
+ * naturally drops banners, legends, and shell noise.
+ *
+ * @param {string} stdout Raw `sdk list` output
+ * @returns {string[]} Version identifiers found in the output.
+ */
+export declare function extractSdkListVersions(stdout: string): string[];
+/**
+ * Resolve a partial version prefix such as `3.9` or `8.14` to the newest
+ * matching version in `sdk list` output. Stable versions are preferred unless
+ * the requested prefix itself is a prerelease.
+ *
+ * @param {string} stdout Raw `sdk list <candidate>` output
+ * @param {string} prefix Partial or exact version prefix; empty matches all
+ * @returns {string|undefined} Best matching version identifier.
+ */
+export declare function resolvePartialVersion(stdout: string, prefix: string): string | undefined;
+/**
+ * Environment variable hints that carry a tool version, used by container
+ * images and CI setups to describe the preinstalled JVM toolchain.
+ *
+ * @type {Object<string, string>}
+ */
+export declare const JVM_TOOL_VERSION_ENV_HINTS: Record<string, string>;
+/**
+ * Environment variable overrides that declare the sdkman version to use for
+ * a tool, mirroring the existing `JAVA<NN>_TOOL` pattern.
+ *
+ * @type {Object<string, string>}
+ */
+export declare const JVM_TOOL_VERSION_OVERRIDES: Record<string, string>;
+/**
+ * Read the `MAVEN_TOOL`/`GRADLE_TOOL`/`SBT_TOOL`/`SCALA_TOOL` override for a
+ * tool, when set to a valid sdkman version identifier.
+ *
+ * @param {string} tool Tool name
+ * @returns {string|undefined} Overridden version identifier.
+ */
+export declare function readToolVersionOverride(tool: string): string | undefined;
+/**
+ * Read the container/CI version hint (`MAVEN_VERSION` etc.) for a tool, when
+ * set to a valid sdkman version identifier.
+ *
+ * @param {string} tool Tool name
+ * @returns {string|undefined} Hinted version identifier.
+ */
+export declare function readToolVersionEnvHint(tool: string): string | undefined;
+/**
+ * Detect the JDK major a project asks for from its build files: Gradle
+ * toolchain declarations (`JavaLanguageVersion.of(N)`) and Maven compiler or
+ * enforcer properties (`maven.compiler.release`, `maven.compiler.source`,
+ * `requireJavaVersion`). The scan is intentionally line-based and
+ * conservative: it only recognises whole-number values.
+ *
+ * @param {string} projectPath Project directory
+ * @returns {number|undefined} JDK major requested by the project.
+ */
+export declare function detectProjectJavaMajor(projectPath: string): number | undefined;
+//# sourceMappingURL=jvmToolEnv.d.ts.map

package/types/lib/inventory/jvmToolEnv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jvmToolEnv.d.ts","sourceRoot":"","sources":["../../../lib/inventory/jvmToolEnv.js"],"names":[],"mappings":"AAMA,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,uBAAuB,CAAC;AAE/B;;;;;GAKG;AACH,OAAO,EACL,eAAe,IAAI,qBAAqB,EACxC,gBAAgB,EAChB,mBAAmB,GACpB,CAAC;AAuBF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAHjC,MAGiC,GAF/B,OAAO,CASnB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EALxC,MAKwC,GAJtC,MAAM,GAAC,SAAS,CAmB5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAJ3B,MAI2B,GAHzB,MAAM,GAAC,SAAS,CA4C5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,GAHpC,MAAM,GAAC,SAAS,CAwC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAJrC,MAIqC,GAHnC,MAAM,GAAC,SAAS,CAgC5B;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAH9C,MAG8C,GAF5C,MAAM,GAAC,SAAS,CAkB5B;AAsDD;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,iDAKjC,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,wBAM5B,CAAC;AAEF,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAH1C,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAGK,GAFxC,MAAM,GAAC,SAAS,CAc5B;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAH1C,MAG0C,GAFxC,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAHlC,MAGkC,GAFhC,MAAM,EAAE,CAgBpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAJjC,MAIiC,EAAE,MAAM,EAHzC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAwB5B;AAED;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,wBAKtC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,wBAKtC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAHjC,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAS5B;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAHhC,MAGgC,GAF9B,MAAM,GAAC,SAAS,CAS5B;AASD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAHvC,MAGuC,GAFrC,MAAM,GAAC,SAAS,CAuB5B"}

package/types/lib/inventory/osinfo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"osinfo.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osinfo.js"],"names":[],"mappings":"AAGA;;;GAGG;AACH,eAAO,MAAM,eAAe;IAC1B,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,WAAW;IACX,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,UAAU;IACV,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,0BAA0B;IAC1B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,6BAA6B;CAC9B,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB;IAC7B,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,EAAE;IACF,eAAe;IACf,qBAAqB;IACrB,IAAI;IACJ,aAAa;CACd,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,yBAAyB;IACpC,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,EAAE;IACF,IAAI;IACJ,aAAa;CACd,CAAC;AASF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAHrC,MAGqC,GAFnC,OAAO,CAInB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,CAYlB;AAQD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAJ/B,CAEA,EAFQ,MAI6B,GAF3B,MAAM,CAqClB;AAGD;;GAEG;AACH,wBAAgB,oBAAoB,SAEnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAH/B,CACA,EADQ,MAG6B,GAF3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAiHzF"}
+{"version":3,"file":"osinfo.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osinfo.js"],"names":[],"mappings":"AAGA;;;GAGG;AACH,eAAO,MAAM,eAAe;IAC1B,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,WAAW;IACX,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,UAAU;IACV,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,0BAA0B;IAC1B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,6BAA6B;CAC9B,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB;IAC7B,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,EAAE;IACF,eAAe;IACf,qBAAqB;IACrB,IAAI;IACJ,aAAa;CACd,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,yBAAyB;IACpC,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,EAAE;IACF,IAAI;IACJ,aAAa;CACd,CAAC;AASF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAHrC,MAGqC,GAFnC,OAAO,CAInB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,CAYlB;AAQD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAJ/B,CAEA,EAFQ,MAI6B,GAF3B,MAAM,CAqClB;AAGD;;GAEG;AACH,wBAAgB,oBAAoB,SAEnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAH/B,CACA,EADQ,MAG6B,GAF3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAkHzF"}

package/types/lib/inventory/toolRequirements.d.ts

@@ -0,0 +1,216 @@
+/**
+ * Resolve the ecosystem a declared tool belongs to.
+ *
+ * @param {string} tool Declared tool name
+ * @returns {string} cdxgen ecosystem name, or "generic" for unknown tools.
+ */
+export declare function ecosystemForTool(tool: string): string;
+/**
+ * Check whether a version identifier carries a prerelease suffix such as
+ * `-rc-3`, `-M2`, or `-milestone-1`. The marker list is exact so that vendor
+ * suffixes that merely begin with the same letters, such as the `-crac` java
+ * distributions, stay classified as stable.
+ *
+ * @param {string} version Version identifier
+ * @returns {boolean} True for prerelease versions.
+ */
+export declare function isPrereleaseVersion(version: string): boolean;
+/**
+ * Compare two dotted version identifiers. Numeric components are compared
+ * numerically, stable releases rank above prereleases, and prerelease
+ * suffixes are compared token-wise so `rc-9` beats `rc-10` only when
+ * numerically larger. Missing components count as zero, so `21` equals
+ * `21.0.0`.
+ *
+ * @param {string} a First version
+ * @param {string} b Second version
+ * @returns {number} Negative when a < b, positive when a > b, zero on equality.
+ */
+export declare function compareVersions(a: string, b: string): number;
+/**
+ * Extract the JDK major from a `java --version` style description such as
+ * `openjdk 21.0.11 2025-04-15` or a bare sdkman java identifier such as
+ * `25-tem`. General availability releases print an undotted major
+ * (`openjdk 25 2025-09-16`), so the first token starting with a digit is
+ * used rather than requiring a dotted version.
+ *
+ * @param {string} versionDesc Version description string
+ * @returns {number|undefined} JDK major version.
+ */
+export declare function extractJavaMajor(versionDesc: string): number | undefined;
+/**
+ * Extract the first version-looking token from a tool version description,
+ * such as `go version go1.23.1 darwin/arm64` or `rustc 1.82.0 (f6e511eec
+ * 2024-10-08)`. Leading letters (`v20.11.1`, `go1.23.1`) and quoting are
+ * stripped before validation.
+ *
+ * @param {string} versionDesc Raw version description
+ * @returns {string|undefined} The version token, when one is found.
+ */
+export declare function extractVersionToken(versionDesc: string): string | undefined;
+export type RequirementVerdict = "satisfied" | "violated" | "unparseable";
+/**
+ * Verdict of a declared-requirement check. `unparseable` means the wanted or
+ * found value carries no comparable version, which is never evidence of a
+ * defect: an unparseable requirement must not produce a mismatch.
+ *
+ * @typedef {"satisfied"|"violated"|"unparseable"} RequirementVerdict
+ */
+/**
+ * Check whether a found version satisfies a declared requirement. Wanted
+ * forms handled: exact versions (`3.9.9`), major-only and partial pins
+ * (`21`, `20.11`), `.x` ranges (`20.x`), caret and tilde ranges (`^20.11`,
+ * `~4.9`), comparison ranges (`>=18`, `<21`), hyphen ranges (`1.9 - 2.3`),
+ * whitespace-conjoined ranges (`>=18 <=20`), `||` alternatives, and the
+ * unconstrained `*`/`latest`. Anything else is unparseable and never
+ * violates.
+ *
+ * @param {string} found Version actually present, possibly embedded in a
+ *   longer description such as `go version go1.23.1 darwin/arm64`.
+ * @param {string} wanted Declared requirement.
+ * @returns {RequirementVerdict} Verdict of the check.
+ */
+export declare function checkVersionRequirement(found: string, wanted: string): RequirementVerdict;
+/**
+ * Classify the result of a failed tool probe. A probe that was denied the
+ * right to run must be reported as `denied` — the tool may well be present —
+ * while only evidence that the command does not exist counts as `missing`.
+ *
+ * @param {Object|string|undefined} result Result object from spawnSync, or
+ *   undefined when no result shape is known.
+ * @returns {"found"|"denied"|"missing"} Classification of the probe result.
+ */
+export declare function classifyProbeResult(result: Object | string | undefined): "found" | "denied" | "missing";
+/**
+ * Classify the active environment restriction that would stop a command from
+ * running, without the human-readable wording. `describeSpawnRestriction`
+ * derives its message from this classifier, and consumers that need to act on
+ * the cause rather than the prose use it directly.
+ *
+ * @param {string} command Command that would run
+ * @returns {"dry-run"|"secure-mode"|"allowlist"|"deno"|undefined} Restriction cause, or undefined when nothing restricts the command.
+ */
+export declare function classifySpawnRestriction(command: string): "dry-run" | "secure-mode" | "allowlist" | "deno" | undefined;
+/**
+ * Explain why a command probe may not run in the current environment, so a
+ * failed probe can be reported as degraded evidence rather than a missing
+ * tool.
+ *
+ * @param {string} command Command that was probed
+ * @returns {string|undefined} Human-readable restriction, or undefined when
+ *   the environment does not restrict the command.
+ */
+export declare function describeSpawnRestriction(command: string): string | undefined;
+/**
+ * Parse the content of an asdf/mise `.tool-versions` file into the first
+ * version each tool declares. Comment lines and inline comments are ignored;
+ * a tool line listing several versions keeps the first.
+ *
+ * @param {string} content `.tool-versions` file content
+ * @returns {Object|undefined} Map of tool name to declared version.
+ */
+export declare function parseToolVersionsFile(content: string): Object | undefined;
+/**
+ * Parse the `go` and `toolchain` directives of a `go.mod` file. The
+ * `toolchain` directive wins when both are present because it names the
+ * exact toolchain the module asks for.
+ *
+ * @param {string} content `go.mod` file content
+ * @returns {Object|undefined} `{ tool, version, directive }` with
+ *   `directive` naming the line the version came from.
+ */
+export declare function parseGoModFile(content: string): Object | undefined;
+/**
+ * Parse a `rust-toolchain.toml` or plain `rust-toolchain` file into its
+ * channel. Target-specific subsections are ignored, so only the `[toolchain]`
+ * section's `channel` key is read.
+ *
+ * @param {string} content Toolchain file content
+ * @returns {Object|undefined} `{ channel }` when a channel is declared.
+ */
+export declare function parseRustToolchainFile(content: string): Object | undefined;
+/**
+ * Parse a `package.json` content into the tool requirements it declares
+ * through `engines` and `packageManager`. The `packageManager` pin's
+ * integrity-hash suffix (`pnpm@9.1.0+sha512.…`) is stripped to the bare
+ * version.
+ *
+ * @param {string} content `package.json` content
+ * @returns {Object|undefined} Map of tool name to declared version.
+ */
+export declare function parsePackageJsonToolRequirements(content: string): Object | undefined;
+/**
+ * Parse a `global.json` file into the .NET SDK version it pins.
+ *
+ * @param {string} content `global.json` content
+ * @returns {Object|undefined} Map with the `dotnet` requirement.
+ */
+export declare function parseGlobalJsonToolRequirements(content: string): Object | undefined;
+/**
+ * Parse the `requires-python` declaration of a `pyproject.toml` file.
+ *
+ * @param {string} content `pyproject.toml` content
+ * @returns {Object|undefined} Map with the `python` requirement.
+ */
+export declare function parsePyprojectRequiresPython(content: string): Object | undefined;
+/**
+ * Parse an `.nvmrc` file into the Node.js version it requests.
+ *
+ * @param {string} content `.nvmrc` content
+ * @returns {Object|undefined} Map with the `node` requirement.
+ */
+export declare function parseNvmrc(content: string): Object | undefined;
+/**
+ * Parse a `.python-version` file into the interpreter version it requests.
+ *
+ * @param {string} content `.python-version` content
+ * @returns {Object|undefined} Map with the `python` requirement.
+ */
+export declare function parsePythonVersionFile(content: string): Object | undefined;
+/**
+ * Parse a `.java-version` file into the JDK version it pins. Both the bare
+ * major (`21`) and a full version (`21.0.5`) occur in the wild, and both are
+ * passed through verbatim — an install command needs the exact declaration.
+ *
+ * The legacy `1.N` spelling of a pre-9 release (`1.8`, `1.8.0_302`) is
+ * normalised to its modern major (`8`), because it is the major line that
+ * names a package: the literal declaration yields `Temurin.1.JDK`, which no
+ * provisioner offers.
+ *
+ * Distribution-prefixed values written by version managers (`temurin-21`,
+ * `openjdk64-17.0.1`) name a vendor build rather than a release, so they are
+ * left unparsed rather than turned into an install argument no provisioner
+ * accepts; the run then reports the version as unresolved and the agent asks.
+ *
+ * @param {string} content `.java-version` content
+ * @returns {Object|undefined} Map with the `java` requirement.
+ */
+export declare function parseJavaVersionFile(content: string): Object | undefined;
+/**
+ * Parse the `BUNDLED WITH` section of a `Gemfile.lock` into the bundler
+ * version the lockfile was written with.
+ *
+ * @param {string} content `Gemfile.lock` content
+ * @returns {string|undefined} Bundler version, when declared.
+ */
+export declare function parseGemfileLockBundlerVersion(content: string): string | undefined;
+/**
+ * Read every declared tool requirement a project directory declares through
+ * its well-known tool pin files: `.tool-versions`, `.nvmrc`, `.java-version`,
+ * `.python-version`, `pyproject.toml`, `go.mod`, `rust-toolchain.toml`,
+ * `rust-toolchain`, `package.json`, and `global.json`. Missing files are
+ * skipped; each entry names the file that declared it so the report can
+ * trace every expectation back to its source.
+ *
+ * @param {string} projectPath Project directory to inspect
+ * @returns {Array<{tool: string, wanted: string, source: string, ecosystem: string, path: string}>}
+ *   Declared requirements, empty when the directory declares none.
+ */
+export declare function readDeclaredToolRequirements(projectPath: string): Array<{
+    tool: string;
+    wanted: string;
+    source: string;
+    ecosystem: string;
+    path: string;
+}>;
+//# sourceMappingURL=toolRequirements.d.ts.map

package/types/lib/inventory/toolRequirements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolRequirements.d.ts","sourceRoot":"","sources":["../../../lib/inventory/toolRequirements.js"],"names":[],"mappings":"AAqEA;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAH1B,MAG0B,GAFxB,MAAM,CAIlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,GAF9B,OAAO,CAanB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAJtB,MAIsB,EAAE,CAAC,EAHzB,MAGyB,GAFvB,MAAM,CA0ClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAHjC,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAHpC,MAGoC,GAFlC,MAAM,GAAC,SAAS,CAgB5B;AAOE,YAAgD,kBAAkB,GAAxD,WAAW,GAAC,UAAU,GAAC,aAAa,CAAoB;AALrE;;;;;;GAMG;AAEH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EALlC,MAKkC,EAAE,MAAM,EAH1C,MAG0C,GAFxC,kBAAkB,CAsB9B;AAyID;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAJ/B,MAAM,GAAC,MAAM,GAAC,SAIiB,GAF7B,OAAO,GAAC,QAAQ,GAAC,SAAS,CAmCtC;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAHrC,MAGqC,GAFnC,SAAS,GAAC,aAAa,GAAC,WAAW,GAAC,MAAM,GAAC,SAAS,CAkChE;AASD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAJrC,MAIqC,GAHnC,MAAM,GAAC,SAAS,CAM5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAHlC,MAGkC,GAFhC,MAAM,GAAC,SAAS,CAuB5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAJ3B,MAI2B,GAHzB,MAAM,GAAC,SAAS,CAiC5B;AAaD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAqC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAH7C,MAG6C,GAF3C,MAAM,GAAC,SAAS,CAgC5B;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAH5C,MAG4C,GAF1C,MAAM,GAAC,SAAS,CAiB5B;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAHzC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAHvB,MAGuB,GAFrB,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAQ5B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAHjC,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAH3C,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAwB5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAAC,WAAW,EAJ7C,MAI6C,GAH3C,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,CAAC,CAwFlG"}

package/types/lib/managers/binary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"binary.d.ts","sourceRoot":"","sources":["../../../lib/managers/binary.js"],"names":[],"mappings":"AAyYA;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,AAH9C,CACA,EADQ,MAAM,EAGqC,GAFzC,MAAM,EAAE,CAgBpB;AA4FD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,GAH5B,MAAM,GAAC,SAAS,CAmB5B;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,OAAA,GAF3B,SAAS,GAAC,MAAM,CAkB5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EARK,MAQL,EACJ,OAAO,EARE,MAQF,EACP,IAAI,EARK,MAQL,EACJ,KAAK,EARI,MAQJ,EACL,QAAQ,AARP,CACA,EADQ,MAQD,GAPG,MAAM,CAgDlB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAJ/B,MAI+B,EAAE,QAAQ,AAHjD,CACA,EADQ,MAGyC,GAFvC,MAAM,CA6BlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,OAAA,SAoBpD;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,GAAG,QAAA,EAAE,WAAW,EAL7B,MAK6B,EAAE,OAAO,KAAK,GAFrD,MAAM,CA6lBlB;AAkwDD;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,AALvD,CACA,EADQ,MAAM,EAK8C,GAJlD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAC,CAmEnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EALzB,MAKyB,GAJvB,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAJxB,MAIwB,EAAE,UAAU,EAHpC,MAGoC,WAqC9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EANrB,MAMqB,EAAE,aAAa,EALpC,MAKoC,EAAE,QAAQ,EAJ9C,OAI8C,GAF7C,OAAO,CAiClB"}
+{"version":3,"file":"binary.d.ts","sourceRoot":"","sources":["../../../lib/managers/binary.js"],"names":[],"mappings":"AA0YA;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,AAH9C,CACA,EADQ,MAAM,EAGqC,GAFzC,MAAM,EAAE,CAgBpB;AA4FD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,GAH5B,MAAM,GAAC,SAAS,CAmB5B;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,OAAA,GAF3B,SAAS,GAAC,MAAM,CAkB5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EARK,MAQL,EACJ,OAAO,EARE,MAQF,EACP,IAAI,EARK,MAQL,EACJ,KAAK,EARI,MAQJ,EACL,QAAQ,AARP,CACA,EADQ,MAQD,GAPG,MAAM,CAgDlB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAJ/B,MAI+B,EAAE,QAAQ,AAHjD,CACA,EADQ,MAGyC,GAFvC,MAAM,CA6BlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,OAAA,SAoBpD;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,GAAG,QAAA,EAAE,WAAW,EAL7B,MAK6B,EAAE,OAAO,KAAK,GAFrD,MAAM,CA4mBlB;AAkwDD;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,AALvD,CACA,EADQ,MAAM,EAK8C,GAJlD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAC,CAmEnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EALzB,MAKyB,GAJvB,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAJxB,MAIwB,EAAE,UAAU,EAHpC,MAGoC,WA6C9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EANrB,MAMqB,EAAE,aAAa,EALpC,MAKoC,EAAE,QAAQ,EAJ9C,OAI8C,GAF7C,OAAO,CAiClB"}

package/types/lib/managers/docker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../lib/managers/docker.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAuCrC,yDAAyD;AACzD,eAAO,MAAM,KAAK,SAA0B,CAAC;AAC7C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAEoC,CAAC;AAsQ/C;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,SAHnB,MAAM,KACJ,MAiBZ,CAAC;AAEF;;GAEG;AACH,wBAAgB,YAAY,QAoB3B;AAED;;GAEG;AACH,wBAAgB,oBAAoB,QA2CnC;AAyTD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,aANf,MAAM,gBAEN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,SAAS,CA6HpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,SANb,MAAM,UACN,MAAM,gBACN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,MAAM,GAAC,SAAS,CAgC3C,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;;;;;;CA2E1B,CAAC;AAkCF;;GAEG;AACH,eAAO,MAAM,QAAQ,sCA2LpB,CAAC;AAGC,YAA4B,gBAAgB,GAAlC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAkB;AAiH/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,kBANZ,MAAM,OACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,OAAO,CAiF3B,CAAC;AAiGF;;;GAGG;AACH,eAAO,MAAM,aAAa,mEA6FzB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,iBATrB,MAAM,aACN,MAAM,WACN,MAAM,wBACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,MAAM,CAwH1B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,oDAkJvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,iDAkJ1B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,kBALb,MAAM,UACN,OAAO,KACL,OAAO,CAAC,MAAM,GAAC,SAAS,CAKpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,cALpB,MAAM,iBACN,MAAM,KACJ,MAAM,GAAC,SA2CnB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,qBAHpB,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,cACnC,KAAK,CAAC,MAAM,CAAC,SA4BvB,CAAC"}
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../lib/managers/docker.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAwCrC,yDAAyD;AACzD,eAAO,MAAM,KAAK,SAA0B,CAAC;AAC7C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAEoC,CAAC;AAsQ/C;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,SAHnB,MAAM,KACJ,MAiBZ,CAAC;AAEF;;GAEG;AACH,wBAAgB,YAAY,QAoB3B;AAED;;GAEG;AACH,wBAAgB,oBAAoB,QA2CnC;AAyTD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,aANf,MAAM,gBAEN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,SAAS,CA6HpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,SANb,MAAM,UACN,MAAM,gBACN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,MAAM,GAAC,SAAS,CAgC3C,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;;;;;;CA2E1B,CAAC;AAkCF;;GAEG;AACH,eAAO,MAAM,QAAQ,sCA2LpB,CAAC;AAGC,YAA4B,gBAAgB,GAAlC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAkB;AAiH/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,kBANZ,MAAM,OACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,OAAO,CAqF3B,CAAC;AAiGF;;;GAGG;AACH,eAAO,MAAM,aAAa,mEAqGzB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,iBATrB,MAAM,aACN,MAAM,WACN,MAAM,wBACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,MAAM,CAgI1B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,oDAkJvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,iDAkJ1B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,kBALb,MAAM,UACN,OAAO,KACL,OAAO,CAAC,MAAM,GAAC,SAAS,CAKpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,cALpB,MAAM,iBACN,MAAM,KACJ,MAAM,GAAC,SA2CnB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,qBAHpB,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,cACnC,KAAK,CAAC,MAAM,CAAC,SA4BvB,CAAC"}

package/types/lib/stages/postgen/annotationBuilder.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Shared assembly of CycloneDX document-level annotations.
+ *
+ * Two postgen features attach findings to the BOM document as annotations
+ * whose `subjects` is the BOM serial number: the BOM audit's rule findings and
+ * the build introspection's remediations. Both describe the document rather
+ * than a component, both are annotated by the cdxgen tool component from
+ * metadata, and both carry the document's own timestamp because an annotation
+ * describes the document it is attached to. The structured facts travel as
+ * `name`/`value` pairs rendered into the annotation text, one `:evidence:<key>`
+ * entry per evidence item.
+ */
+/**
+ * Flatten an evidence object into `:evidence:<key>` property entries. Nested
+ * values are serialized as JSON so every property value stays a string.
+ *
+ * @param {string} propertyNamePrefix Property namespace, e.g. "cdx:audit".
+ * @param {Object} evidence Arbitrary key/value evidence facts.
+ * @returns {{name: string, value: string}[]} Property entries.
+ */
+export declare function evidenceProperties(propertyNamePrefix: string, evidence: Object): {
+    name: string;
+    value: string;
+}[];
+/**
+ * Build one document-level annotation. Returns undefined when the BOM carries
+ * no cdxgen tool component to annotate with; the caller decides whether that
+ * is worth a warning.
+ *
+ * @param {Object} params Annotation inputs.
+ * @param {Object} params.bomJson CycloneDX BOM the annotation describes.
+ * @param {string} params.message Leading annotation sentence.
+ * @param {{name: string, value: string}[]} params.properties Structured facts rendered into the annotation text.
+ * @returns {Object|undefined} CycloneDX annotation, or undefined without an annotator.
+ */
+export declare function buildDocumentAnnotation({ bomJson, message, properties }: {
+    bomJson: Object;
+    message: string;
+    properties: {
+        name: string;
+        value: string;
+    }[];
+}): Object | undefined;
+/**
+ * Warn that a document could not be annotated because it carries no cdxgen
+ * tool component. Suppressed outside debug mode, where the missing annotator
+ * is an expected shape for foreign BOMs.
+ *
+ * @param {string} feature Feature that wanted to annotate.
+ * @returns {void}
+ */
+export declare function warnMissingAnnotator(feature: string): void;
+//# sourceMappingURL=annotationBuilder.d.ts.map

package/types/lib/stages/postgen/annotationBuilder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"annotationBuilder.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/annotationBuilder.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAmBH;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,kBAAkB,EAJ1C,MAI0C,EAAE,QAAQ,EAHpD,MAGoD,GAFlD;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAe3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,EALrE;IAAuB,OAAO,EAAtB,MAAM,CACd;IAAuB,OAAO,EAAtB,MAAM,CACd;IAAgD,UAAU,EAAlD;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,EAAE,CACvC;CAEqE,GAF3D,MAAM,GAAC,SAAS,CAkB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAHjC,MAGiC,GAF/B,IAAI,CAQhB"}

package/types/lib/stages/postgen/auditBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auditBom.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/auditBom.js"],"names":[],"mappings":"AA8DA;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,OAAO,CA4BnB;AAuBD;;;;;GAKG;AACH,wBAAsB,+BAA+B,CAAC,OAAO,AAH1D,CACA,EADQ,MAGuD,GAFrD,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAKrG;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAHvC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAGvC,GAFrC,MAAM,CAOlB;AA+BD;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAHzC,MAGyC,EAAE,OAAO,GAFlD,MAEuD,QAuBjE;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAAC,OAAO,EAH9C,MAG8C,EAAE,OAAO,GAFvD,MAE4D,iBAkCtE;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,OAAO,CAwC1B;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,OAAA,GAFvC,MAAM,CAmClB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,OAAA,GAF/B,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,OAAA,EAAE,OAAO,EAHxC,MAGwC,SAuFlD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,KAAA,EAAE,OAAO,KAAA,OAQpD"}
+{"version":3,"file":"auditBom.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/auditBom.js"],"names":[],"mappings":"AAyEA;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,OAAO,CA4BnB;AAuBD;;;;;GAKG;AACH,wBAAsB,+BAA+B,CAAC,OAAO,AAH1D,CACA,EADQ,MAGuD,GAFrD,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAKrG;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAHvC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAGvC,GAFrC,MAAM,CAOlB;AA+BD;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAHzC,MAGyC,EAAE,OAAO,GAFlD,MAEuD,QAuBjE;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAAC,OAAO,EAH9C,MAG8C,EAAE,OAAO,GAFvD,MAE4D,iBAkCtE;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,OAAO,CAwC1B;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,OAAA,GAFvC,MAAM,CAmClB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,OAAA,GAF/B,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,OAAA,EAAE,OAAO,EAHxC,MAGwC,SAyElD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,KAAA,EAAE,OAAO,KAAA,OAQpD"}

package/types/lib/stages/postgen/introspection/annotate.d.ts

@@ -0,0 +1,81 @@
+/**
+ * BOM mutations that carry the introspection verdict inside the document:
+ * eight metadata properties and a block of document-level annotations.
+ *
+ * Sidecar report files get lost; the BOM travels. A consumer who receives
+ * only the BOM still learns how much to trust it from the metadata properties,
+ * and the annotations carry one entry per remediation the loop should act on.
+ * No component or dependency is touched.
+ *
+ * Both mutations are replace-by-name: a document that was already introspected
+ * (a BOM enriched again after an evidence pass) loses its previous
+ * introspection state and gains a fresh one, so the verdict always describes
+ * the final document.
+ */
+/**
+ * Version of the introspection BOM surface. Matches the JSON report's
+ * schemaVersion so the two stay comparable.
+ *
+ * @type {string}
+ */
+export declare const INTROSPECTION_SCHEMA_VERSION: string;
+/**
+ * Namespace of every property and annotation entry this module emits.
+ *
+ * @type {string}
+ */
+export declare const INTROSPECTION_PROPERTY_PREFIX: string;
+/**
+ * The metadata properties that summarize the verdict, in emission order. The
+ * overall tier and confidence are omitted when the run produced no scored row
+ * (nothing was graded, so no verdict is claimed); per-ecosystem rows cover the
+ * scored ecosystems only, since unsupported ones have neither a tier nor a
+ * score.
+ *
+ * @param {Object} reflection Reflection document from reflectOnRun.
+ * @param {Object} scored Scoring document from scoreReflection.
+ * @returns {{name: string, value: string}[]} Metadata property entries.
+ */
+export declare function introspectionMetadataProperties(reflection: Object, scored: Object): {
+    name: string;
+    value: string;
+}[];
+/**
+ * Attach the introspection verdict to the document: metadata properties plus
+ * the summary and remediation annotations. Any introspection state left on the
+ * document by a previous pass is removed first, so enrichment flows that run
+ * post-processing twice leave exactly one verdict.
+ *
+ * @param {Object} bomJson CycloneDX BOM, mutated in place.
+ * @param {Object} reflection Reflection document from reflectOnRun.
+ * @param {Object} scored Scoring document from scoreReflection.
+ * @param {Object} [guards] Emission guards.
+ * @param {boolean} [guards.annotations] False skips the annotations, for documents at a spec version that predates them.
+ * @returns {Object} The mutated BOM.
+ */
+export declare function applyIntrospectionToBom(bomJson: Object, reflection: Object, scored: Object, guards?: {
+    annotations?: boolean;
+}): Object;
+/**
+ * Stamp every formulation workflow with the id of the run that reflected over
+ * the document, so a later consumer of the BOM can tell a formulation record
+ * this run generated from one that arrived with a foreign BOM. The stamp is
+ * replace-by-name, matching how the rest of the verdict mutates the
+ * document: a BOM enriched twice keeps only the latest run's id.
+ *
+ * @param {Object} bomJson CycloneDX BOM, mutated in place.
+ * @param {string} runId Run id of the introspection pass.
+ * @returns {Object} The mutated BOM.
+ */
+export declare function applyFormulationRunIdMarker(bomJson: Object, runId: string): Object;
+/**
+ * Whether a BOM already carries an introspection verdict.
+ *
+ * Evidence collection re-processes a finished BOM through a fresh wrapper, so
+ * the document itself is the only marker that survives between passes.
+ *
+ * @param {Object} bomJson CycloneDX BOM.
+ * @returns {boolean} True when the BOM was already introspected.
+ */
+export declare function hasIntrospectionVerdict(bomJson: Object): boolean;
+//# sourceMappingURL=annotate.d.ts.map

package/types/lib/stages/postgen/introspection/annotate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"annotate.d.ts","sourceRoot":"","sources":["../../../../../lib/stages/postgen/introspection/annotate.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,EAF/B,MAEuC,CAAC;AAElD;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAFhC,MAEsD,CAAC;AAEjE;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,EAJ/C,MAI+C,EAAE,MAAM,EAHvD,MAGuD,GAFrD;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CA6C3C;AAoHD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EARE,MAQF,EACP,UAAU,EARD,MAQC,EACV,MAAM,EARG,MAQH,EACN,MAAM,AARL,CAEA,EADA;IAAyB,WAAW,AAApC,CACA,EADQ,OAAO,CACf;CAMU,GANA,MAAM,CAsClB;AAgBD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAJxC,MAIwC,EAAE,KAAK,EAH/C,MAG+C,GAF7C,MAAM,CAsBlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAOnB"}