@cdxgen/cdxgen 13.0.1 → 13.2.0

package/types/lib/cli/index.d.ts

@@ -2,8 +2,8 @@ export { summarizeAiInventory } from "../inventory/aiInventory.js";
 export { createAndroidBom, createBinaryBom, dedupeBom, listComponents, } from "./bomAssembly.js";
 export { createAsarBom, createCaxaBom, createChromeExtensionBom, createNodejsBom, createVscodeExtensionBom, } from "./jsBom.js";
 export { createJarBom, createJavaBom } from "./jvmBom.js";
-export { createCloudBuildBom, createCryptoCertsBom, createCsharpBom, createGitHubBom, createHelmBom, createJenkinsBom, createPHPBom, createPixiBom, createPythonBom, createRubyBom, } from "./managedBom.js";
-export { createClojureBom, createCocoaBom, createCppBom, createDartBom, createElixirBom, createGleamBom, createGoBom, createHaskellBom, createNixBom, createRustBom, createSwiftBom, createZigBom, } from "./nativeBom.js";
+export { createCloudBuildBom, createCryptoCertsBom, createCsharpBom, createGitHubBom, createHelmBom, createJenkinsBom, createPerlBom, createPHPBom, createPixiBom, createPythonBom, createRBom, createRubyBom, createTerraformBom, } from "./managedBom.js";
+export { createClojureBom, createCocoaBom, createCppBom, createCrystalBom, createDartBom, createElixirBom, createElmBom, createErlangBom, createGleamBom, createGoBom, createHaskellBom, createJuliaBom, createLuaBom, createNimBom, createNixBom, createOCamlBom, createRustBom, createSpackBom, createSwiftBom, createZigBom, } from "./nativeBom.js";
 /**
  * Function to create obom string for the current OS using osquery
  *
@@ -92,6 +92,14 @@ export declare function createHBom(_path: string, options: Object): Promise<Obje
  * @param {Object} options Parse options from the cli
  * @returns {Promise<Object>} Promise resolving to BOM object
  */
+/**
+ * Generate a BOM for one path, letting a deferred fail-on-error abort return
+ * the empty BOM the flag promises rather than unwinding past the reports.
+ *
+ * @param {string} path Source path.
+ * @param {Object} options CLI options.
+ * @returns {Promise<Object>} BOM NS data.
+ */
 export declare function createBom(path: string, options: Object): Promise<Object>;
 /**
  * Method to submit the generated bom to dependency-track or cyclonedx server

package/types/lib/cli/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/cli/index.js"],"names":[],"mappings":"AAmEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAsCnE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,aAAa,EACb,wBAAwB,EACxB,eAAe,EACf,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA8B1D,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,eAAe,EACf,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,aAAa,EACb,eAAe,EACf,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AAyBxB;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,OAAO,CAAC,MAAM,CAAC,CAwE3B;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,OAAO,EAHnD,MAGmD,GAFjD,OAAO,CAAC,MAAM,CAAC,CAkU3B;AAgCD;;;;;;GAMG;AACH;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAGF,GAF1B,MAAM,CAUlB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAAM,EAG4B,GAFhC,MAAM,CAalB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EALnC,MAAM,GAAC,MAAM,EAKsB,EAAE,OAAO,EAJ5C,MAI4C,GAH1C,OAAO,CAAC,MAAM,CAAC,CA4kC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CAoD3B;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA4YrC;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,CAAC,CAsB3B;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,OAAO,CAAC,MAAM,CAAC,CA4U3B;AAED;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,IAAI,EALzB,MAKyB,EAAE,WAAW,EAJtC,MAIsC,GAHrC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CA+HjD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/cli/index.js"],"names":[],"mappings":"AAyEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAuCnE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,aAAa,EACb,wBAAwB,EACxB,eAAe,EACf,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA0C1D,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,eAAe,EACf,UAAU,EACV,aAAa,EACb,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,YAAY,EACZ,eAAe,EACf,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,aAAa,EACb,cAAc,EACd,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AA8BxB;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,OAAO,CAAC,MAAM,CAAC,CAwE3B;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,OAAO,EAHnD,MAGmD,GAFjD,OAAO,CAAC,MAAM,CAAC,CAkU3B;AAgCD;;;;;;GAMG;AACH;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAGF,GAF1B,MAAM,CAUlB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAAM,EAG4B,GAFhC,MAAM,CAalB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EALnC,MAAM,GAAC,MAAM,EAKsB,EAAE,OAAO,EAJ5C,MAI4C,GAH1C,OAAO,CAAC,MAAM,CAAC,CAqmC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CAoD3B;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA0gBrC;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,CAAC,CAsB3B;AAED;;;;;;GAMG;AACH;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,OAAO,CAAC,MAAM,CAAC,CAa3B;AA0XD;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,IAAI,EALzB,MAKyB,EAAE,WAAW,EAJtC,MAIsC,GAHrC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CA+FjD"}

package/types/lib/cli/jsBom.d.ts

@@ -3,6 +3,13 @@
  * local Modelfile/`.gguf` file input. Returns the explicit selection from
  * `getExactAiInventoryType` when one is present.
  *
+ * Direct HuggingFace interpretation of the source path is opt-in: only
+ * unambiguous references (`pkg:huggingface/...` purls and huggingface.co
+ * URLs) are recognized on their own. Bare `owner/repo`-shaped values are
+ * ordinary relative paths (eg: `repotests/sveltejs-realworld`) unless an AI
+ * inventory type such as `-t ai` is explicitly selected, in which case
+ * `getExactAiInventoryType` already returned it above.
+ *
  * @param {string} path Project or file path
  * @param {object} options CLI options
  * @returns {string|undefined} The detected AI inventory type (`"ai"`) or undefined
@@ -52,6 +59,22 @@ export declare function createCaxaBom(path: string, options: Object): Promise<Ob
  * @returns {Promise<Object>} Promise resolving to BOM object
  */
 export declare function createVscodeExtensionBom(path: string, options: Object): Promise<Object>;
+/**
+ * Create a BOM that catalogs agentic CLI tools installed for the current user
+ * (for example Kiro CLI, zcode, opencode, and Claude Code), along with the
+ * agents, plugins, and providers they define.
+ *
+ * The scan is read-only and value-redacting: it records tool versions where a
+ * declarative source exists, plus structural counts, but never reads
+ * credentials, transcripts, session logs, or telemetry.
+ *
+ * @param {string} path Positional input. A host scan does not read a project
+ *   tree, so an explicit path other than the current directory is rejected
+ *   rather than silently ignored.
+ * @param {Object} options Parse options from the CLI
+ * @returns {Promise<Object>} Promise resolving to BOM data
+ */
+export declare function createAgenticBom(path: string, options: Object): Promise<Object>;
 /**
  * Function to create BOM for Electron ASAR archives.
  *

package/types/lib/cli/jsBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jsBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jsBom.js"],"names":[],"mappings":"AA+FA;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAwB5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CA4zC3B;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAE4C,CAAC;AAEvD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,YAJ9B,KAAK,CAAC,MAAM,CAAC,cACb,MAAM,KACJ,KAAK,CAAC,MAAM,CAwExB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CA6C3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CA+F3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAoN3B;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CAoD3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CA2ChE;AAED;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CACjD,aAAa,EANJ,MAMI,EACb,OAAO,EANE,MAMF,EACP,OAAO,EANE,MAAM,EAMR,EACP,YAAY,EANH,MAAM,EAMH,iBAsBb"}
+{"version":3,"file":"jsBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jsBom.js"],"names":[],"mappings":"AAqGA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAwB5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAy1C3B;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAE4C,CAAC;AAEvD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,YAJ9B,KAAK,CAAC,MAAM,CAAC,cACb,MAAM,KACJ,KAAK,CAAC,MAAM,CAwExB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CA6C3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CA+F3B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EANhC,MAMgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CA6B3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAoN3B;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CAoD3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CA2ChE;AAED;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CACjD,aAAa,EANJ,MAMI,EACb,OAAO,EANE,MAMF,EACP,OAAO,EANE,MAAM,EAMR,EACP,YAAY,EANH,MAAM,EAMH,iBAsBb"}

package/types/lib/cli/jvmBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jvmBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jvmBom.js"],"names":[],"mappings":"AAwFA;;;;;GAKG;AACH,eAAO,IAAI,gBAAgB,EAFjB,MAIsD,CAAC;AAUjE;;;;GAIG;AAEH,eAAO,MAAM,kBAAkB,EAHrB,MAQT,CAAC;AAEF;;;;;GAKG;AAEH,eAAO,MAAM,aAAa,EAHhB,MAIqE,CAAC;AAEhF;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAL5B,MAK4B,EAAE,OAAO,EAJrC,MAIqC,GAFnC,MAAM,CA8ElB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EALxC,MAKwC,EAAE,MAAM,EAJhD,MAIgD,EAAE,GAAG,EAHrD,MAGqD,GAFnD,MAAM,EAAE,CA4CpB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CA0iD3B"}
+{"version":3,"file":"jvmBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jvmBom.js"],"names":[],"mappings":"AAiGA;;;;;GAKG;AACH,eAAO,IAAI,gBAAgB,EAFjB,MAIsD,CAAC;AAUjE;;;;GAIG;AAEH,eAAO,MAAM,kBAAkB,EAHrB,MAQT,CAAC;AAEF;;;;;GAKG;AAEH,eAAO,MAAM,aAAa,EAHhB,MAIqE,CAAC;AAEhF;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAL5B,MAK4B,EAAE,OAAO,EAJrC,MAIqC,GAFnC,MAAM,CA8ElB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EALxC,MAKwC,EAAE,MAAM,EAJhD,MAIgD,EAAE,GAAG,EAHrD,MAGqD,GAFnD,MAAM,EAAE,CA8DpB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAwtD3B"}

package/types/lib/cli/managedBom.d.ts

@@ -102,4 +102,37 @@ export declare function createCsharpBom(path: string, options: Object): Promise<
  * @returns {Promise<Object>} Promise resolving to BOM object
  */
 export declare function createCryptoCertsBom(path: string, options: Object): Promise<Object>;
+/**
+ * Function to create bom string for R projects using renv.
+ *
+ * The `renv.lock` file carries the resolved package set for the project
+ * library, including the R version it was produced under.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Object} BOM object
+ */
+export declare function createRBom(path: string, options: Object): Object;
+/**
+ * Function to create bom string for Perl projects using Carton.
+ *
+ * The `cpanfile.snapshot` carries the resolved install set; the declared
+ * `cpanfile` is consulted to distinguish direct dependencies.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Object} BOM object
+ */
+export declare function createPerlBom(path: string, options: Object): Object;
+/**
+ * Function to create bom string for Terraform and OpenTofu projects.
+ *
+ * The `.terraform.lock.hcl` file pins the providers the configuration
+ * resolves to, with content hashes suitable for the CycloneDX hashes array.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Object} BOM object
+ */
+export declare function createTerraformBom(path: string, options: Object): Object;
 //# sourceMappingURL=managedBom.d.ts.map

package/types/lib/cli/managedBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"managedBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/managedBom.js"],"names":[],"mappings":"AAqHA;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,QAJ5B,MAAM,YACN,MAAM,KACJ,OAMZ,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAJ1B,MAAM,YACN,MAAM,KACJ,OAeZ,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,QAAA,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,GAAG,IAAI,CAsEzB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAkpB3B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CAyBlB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CA2C3B;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CA0BlB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CA8JlB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CA0R3B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAuerC;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAJpC,MAIoC,EAAE,OAAO,EAH7C,MAG6C,GAF3C,OAAO,CAAC,MAAM,CAAC,CAmF3B"}
+{"version":3,"file":"managedBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/managedBom.js"],"names":[],"mappings":"AA4HA;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,QAJ5B,MAAM,YACN,MAAM,KACJ,OAMZ,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAJ1B,MAAM,YACN,MAAM,KACJ,OAeZ,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,QAAA,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,GAAG,IAAI,CAsEzB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CA2pB3B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CAyBlB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CA2C3B;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CA0BlB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CA+LlB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAkS3B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAsfrC;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAJpC,MAIoC,EAAE,OAAO,EAH7C,MAG6C,GAF3C,OAAO,CAAC,MAAM,CAAC,CAmF3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAJpB,MAIoB,EAAE,OAAO,EAH7B,MAG6B,GAF3B,MAAM,CA2DlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CAmClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,MAAM,CAyBlB"}

package/types/lib/cli/nativeBom.d.ts

@@ -13,14 +13,7 @@ export declare function getCargoCacheDir(): string | undefined;
  * @returns {Promise<Object | undefined>} Promise resolving to a BOM object or `undefined`
  */
 export declare function createGoBom(path: string, options: Object): Promise<Object | undefined>;
-/**
- * Function to create bom string for Rust projects
- *
- * @param {string} path to the project
- * @param {Object} options Parse options from the cli
- * @returns {Promise<Object|undefined>} Promise resolving to a BOM object or undefined
- */
-export declare function createRustBom(path: string, options: Object): Promise<Object | undefined>;
+export declare function createRustBom(path: any, options: any): Promise<Object | undefined>;
 /**
  * Parses a `.crate` file name into a CycloneDX component (name, version, purl,
  * bom-ref, and source/cache properties). Returns undefined when the file name
@@ -73,6 +66,19 @@ export declare function createCppBom(path: string, options: Object): Object;
  * @returns {Object} BOM object
  */
 export declare function createClojureBom(path: string, options: Object): Object;
+/**
+ * Locate the Stack lock files under a path.
+ *
+ * Stack names the lock after the configuration file it completes, so the
+ * default `stack.yaml` produces `stack.yaml.lock` and a project with several
+ * configurations produces one lock per configuration. `stack.lock` is also
+ * accepted because tooling and documentation examples have used that name.
+ *
+ * @param {string} path Project path
+ * @param {Object} options Parse options from the cli
+ * @returns {string[]} Lock file paths, deduplicated
+ */
+export declare function findStackLockFiles(path: string, options: Object): string[];
 /**
  * Function to create bom string for Haskell projects
  *
@@ -140,4 +146,78 @@ export declare function createZigBom(path: string, options: Object): Promise<Obj
  * @returns {Promise<Object>} Promise resolving to BOM object
  */
 export declare function createGleamBom(path: string, options: Object): Promise<Object>;
+/**
+ * Function to create bom string for Julia projects.
+ *
+ * The resolved `Manifest.toml` is preferred over the declared `Project.toml`
+ * so the BOM carries pinned versions and the package graph.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export declare function createJuliaBom(path: string, options: Object): Promise<Object>;
+/**
+ * Function to create bom string for Erlang projects using rebar3.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export declare function createErlangBom(path: string, options: Object): Promise<Object>;
+/**
+ * Function to create bom string for OCaml projects using opam.
+ *
+ * Resolved `.opam.locked` files are preferred; a plain `.opam` file is used
+ * as a declared fallback with unpinned versions.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export declare function createOCamlBom(path: string, options: Object): Promise<Object>;
+/**
+ * Function to create bom string for Elm projects.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export declare function createElmBom(path: string, options: Object): Promise<Object>;
+/**
+ * Function to create bom string for Crystal projects using shards.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export declare function createCrystalBom(path: string, options: Object): Promise<Object>;
+/**
+ * Function to create bom string for Nim projects using nimble.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export declare function createNimBom(path: string, options: Object): Promise<Object>;
+/**
+ * Function to create bom string for Lua projects using LuaRocks.
+ *
+ * When a `luarocks.lock` is present next to a rockspec it supplies the
+ * resolved versions; otherwise the rockspec's declared dependencies are
+ * inventoried without versions.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export declare function createLuaBom(path: string, options: Object): Promise<Object>;
+/**
+ * Function to create bom string for Spack environments.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export declare function createSpackBom(path: string, options: Object): Promise<Object>;
 //# sourceMappingURL=nativeBom.d.ts.map

package/types/lib/cli/nativeBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nativeBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/nativeBom.js"],"names":[],"mappings":"AA2IA;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,GAAC,SAAS,CAU5B;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAwavC;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAmJrC;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,GAAC,SAAS,CAiC5B;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,SAAS,EAJ9C,MAI8C,EAAE,SAAS,AAHjE,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA8BrC;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAJnC,MAImC,EAAE,OAAO,EAH5C,MAG4C,GAF1C,OAAO,CAAC,MAAM,CAAC,CAwB3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAiE3B;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CAkZlB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CA+GlB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CA0BlB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CA0BlB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA0I3B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAmLvC;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CAkI3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA4D3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwD3B"}
+{"version":3,"file":"nativeBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/nativeBom.js"],"names":[],"mappings":"AA4KA;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,GAAC,SAAS,CAU5B;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAkdvC;AA2PD,wBAAsB,aAAa,CAAC,IAAI,KAAA,EAAE,OAAO,KAAA,+BAyLhD;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,GAAC,SAAS,CAiC5B;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,SAAS,EAJ9C,MAI8C,EAAE,SAAS,AAHjE,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA8BrC;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAJnC,MAImC,EAAE,OAAO,EAH5C,MAG4C,GAF1C,OAAO,CAAC,MAAM,CAAC,CAwB3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CA0E3B;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CAkZlB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CAmJlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,MAAM,EAAE,CA0BpB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CAiElB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CAiClB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwJ3B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuLvC;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CAkI3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA4D3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwD3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAsE3B;AAqBD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAyB3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA4B3B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CAoE3B;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CAuC3B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA0C3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA2D3B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwD3B"}

package/types/lib/core/activity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"activity.d.ts","sourceRoot":"","sources":["../../../lib/core/activity.js"],"names":[],"mappings":"AAOA,oFAAoF;AACpF,eAAO,MAAM,UAAU,SAEkB,CAAC;AAE1C,+GAA+G;AAC/G,eAAO,MAAM,YAAY,KAE4B,CAAC;AAQtD,8IAA8I;AAC9I,eAAO,IAAI,QAAQ,KACkD,CAAC;AAEtE,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,mBAAmB,CAAC;AA0QnD,gJAAgJ;AAChJ,QAAA,MAAM,oBAAoB,UADd,MAAM,KAA4D,MACA,CAAC;AAe/E;;;;;;;GAOG;AACH,iBAAS,oBAAoB,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;GAKG;AACH,iBAAS,wBAAwB,CAAC,OAAO,EAH9B,MAAM,GAAC,MAAM,EAGiB,GAF5B;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAqClD;AA0BD;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAH/C,MAG+C,GAF7C,OAAO,CAInB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EALhC,MAKgC,EAAE,MAAM,EAJxC,MAIwC,EAAE,OAAO,AAHzD,CACA,EADQ,MAGsD,GAFpD,MAAM,GAAC,SAAS,CA4B5B;AAED,0KAA0K;AAC1K,wBAAgB,sBAAsB,CAAC,MAAM,EADjC,MACiC,EAAE,OAAO,AADV,CAAuE,EAA/D,MACO,GADkE,MAAM,GAAC,SAAS,CAG5I;AAED,0KAA0K;AAC1K,wBAAgB,uBAAuB,CAAC,MAAM,EADlC,MACkC,EAAE,OAAO,AADX,CAAuE,EAA/D,MACQ,GADiE,MAAM,GAAC,SAAS,CAG5I;AAED,0KAA0K;AAC1K,wBAAgB,oBAAoB,CAAC,MAAM,EAD/B,MAC+B,EAAE,OAAO,AADR,CAAuE,EAA/D,MACK,GADoE,MAAM,GAAC,SAAS,CAG5I;AA2CD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAND,MAMC,EACV,YAAY,EANH,MAMG,EACZ,OAAO,AANN,CACA,EADQ,MAMG,GALD,MAAM,GAAC,SAAS,CAuC5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAJlC,MAIkC,EAAE,OAAO,AAHnD,CACA,EADQ,MAGgD,GAF9C,MAAM,GAAC,SAAS,CA2B5B;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAJrC,MAIqC,EAAE,OAAO,AAHtD,CACA,EADQ,MAGmD,GAFjD,MAAM,GAAC,SAAS,CAgC5B;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAJpC,MAIoC,EAAE,OAAO,AAHrD,CACA,EADQ,MAGkD,GAFhD,MAAM,GAAC,SAAS,CAK5B;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,OAG0B,GAFxB,IAAI,CAShB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAL7B,MAK6B,EAAE,MAAM,EAJrC,MAIqC,EAAE,MAAM,AAHrD,CACA,EADQ,MAG6C,GAF3C,KAAK,CAYjB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAHxB,KAGwB,GAFtB,OAAO,CAInB;AAED,0HAA0H;AAC1H,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAJlC,MAIkC,EAAE,MAAM,EAH1C,MAG0C,GAFxC,KAAK,CASjB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,AAHvC,CACA,EADQ,MAGoC,GAFlC,IAAI,CAOhB;AAED,0DAA0D;AAC1D,wBAAgB,oBAAoB,IADc,IAAI,CAGrD;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CAgB5B;AAID,wEAAwE;AACxE,wBAAgB,qBAAqB,IADvB,MAAM,EAAE,CAGrB;AAED,oEAAoE;AACpE,wBAAgB,uBAAuB,IADqB,IAAI,CAO/D;AAED;;;;;;;;;GASG;AACH,iBAAS,wBAAwB,CAC/B,IAAI,EARK,MAQL,EACJ,MAAM,EARG,MAQH,EACN,MAAM,EARG,MAQH,EACN,MAAM,AARL,CACA,EADQ,MAQS,EAClB,QAAQ,AARP,CACA,EADQ,MAQI,GAPF,MAAM,GAAC,SAAS,CAgB5B;AAED,0EAA0E;AAC1E,eAAO,MAAM,mBAAmB,UAAY,CAAC;AAE7C;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EALC,MAKD,EACR,eAAe,AALd,CACA,EADQ,MAKwD,GAJtD,OAAO,CA+BnB;AAED;;;;;GAKG;AAEH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,GAH1B,OAAO,CAmBnB;AA4CD,uLAAuL;AACvL,eAAO,MAAM,WAAW,UAsItB,CAAC;AAEH,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,GACzB,CAAC"}
+{"version":3,"file":"activity.d.ts","sourceRoot":"","sources":["../../../lib/core/activity.js"],"names":[],"mappings":"AAOA,oFAAoF;AACpF,eAAO,MAAM,UAAU,SAEkB,CAAC;AAE1C,+GAA+G;AAC/G,eAAO,MAAM,YAAY,KAE4B,CAAC;AAQtD,8IAA8I;AAC9I,eAAO,IAAI,QAAQ,KACkD,CAAC;AAEtE,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,mBAAmB,CAAC;AAsWnD,gJAAgJ;AAChJ,QAAA,MAAM,oBAAoB,UADd,MAAM,KAA4D,MACA,CAAC;AAe/E;;;;;;;GAOG;AACH,iBAAS,oBAAoB,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;GAKG;AACH,iBAAS,wBAAwB,CAAC,OAAO,EAH9B,MAAM,GAAC,MAAM,EAGiB,GAF5B;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAqClD;AA0BD;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAH/C,MAG+C,GAF7C,OAAO,CAInB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EALhC,MAKgC,EAAE,MAAM,EAJxC,MAIwC,EAAE,OAAO,AAHzD,CACA,EADQ,MAGsD,GAFpD,MAAM,GAAC,SAAS,CA4B5B;AAED,0KAA0K;AAC1K,wBAAgB,sBAAsB,CAAC,MAAM,EADjC,MACiC,EAAE,OAAO,AADV,CAAuE,EAA/D,MACO,GADkE,MAAM,GAAC,SAAS,CAG5I;AAED,0KAA0K;AAC1K,wBAAgB,uBAAuB,CAAC,MAAM,EADlC,MACkC,EAAE,OAAO,AADX,CAAuE,EAA/D,MACQ,GADiE,MAAM,GAAC,SAAS,CAG5I;AAED,0KAA0K;AAC1K,wBAAgB,oBAAoB,CAAC,MAAM,EAD/B,MAC+B,EAAE,OAAO,AADR,CAAuE,EAA/D,MACK,GADoE,MAAM,GAAC,SAAS,CAG5I;AA2CD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAND,MAMC,EACV,YAAY,EANH,MAMG,EACZ,OAAO,AANN,CACA,EADQ,MAMG,GALD,MAAM,GAAC,SAAS,CAuC5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAJlC,MAIkC,EAAE,OAAO,AAHnD,CACA,EADQ,MAGgD,GAF9C,MAAM,GAAC,SAAS,CA2B5B;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAJrC,MAIqC,EAAE,OAAO,AAHtD,CACA,EADQ,MAGmD,GAFjD,MAAM,GAAC,SAAS,CAgC5B;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAJpC,MAIoC,EAAE,OAAO,AAHrD,CACA,EADQ,MAGkD,GAFhD,MAAM,GAAC,SAAS,CAK5B;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,OAG0B,GAFxB,IAAI,CAShB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAL7B,MAK6B,EAAE,MAAM,EAJrC,MAIqC,EAAE,MAAM,AAHrD,CACA,EADQ,MAG6C,GAF3C,KAAK,CAYjB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAHxB,KAGwB,GAFtB,OAAO,CAInB;AAED,0HAA0H;AAC1H,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAJlC,MAIkC,EAAE,MAAM,EAH1C,MAG0C,GAFxC,KAAK,CASjB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,AAHvC,CACA,EADQ,MAGoC,GAFlC,IAAI,CAOhB;AAED,0DAA0D;AAC1D,wBAAgB,oBAAoB,IADc,IAAI,CAGrD;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CAgB5B;AAID,wEAAwE;AACxE,wBAAgB,qBAAqB,IADvB,MAAM,EAAE,CAGrB;AAED,oEAAoE;AACpE,wBAAgB,uBAAuB,IADqB,IAAI,CAO/D;AAED;;;;;;;;;GASG;AACH,iBAAS,wBAAwB,CAC/B,IAAI,EARK,MAQL,EACJ,MAAM,EARG,MAQH,EACN,MAAM,EARG,MAQH,EACN,MAAM,AARL,CACA,EADQ,MAQS,EAClB,QAAQ,AARP,CACA,EADQ,MAQI,GAPF,MAAM,GAAC,SAAS,CAgB5B;AAED,0EAA0E;AAC1E,eAAO,MAAM,mBAAmB,UAAY,CAAC;AAE7C;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EALC,MAKD,EACR,eAAe,AALd,CACA,EADQ,MAKwD,GAJtD,OAAO,CA+BnB;AAED;;;;;GAKG;AAEH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,GAH1B,OAAO,CAmBnB;AAmED,uLAAuL;AACvL,eAAO,MAAM,WAAW,UAyItB,CAAC;AAEH,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,GACzB,CAAC"}

package/types/lib/core/buildLedger.d.ts

@@ -0,0 +1,272 @@
+/**
+ * Build ledger: an opt-in, worker-safe recorder of structured build-adequacy
+ * events.
+ *
+ * Producers record what a run did to its build environment — the tool versions
+ * a project expected, the tools that were actually found, the commands that
+ * failed, the fallback code paths that were taken — and the post-generation
+ * reflection turns those events into a fidelity verdict. The recorder follows
+ * the shape of `activity.js` but stays a separate stream: activity records
+ * describe security-relevant side effects consumed by the secure-mode
+ * machinery, while ledger events describe environment adequacy consumed by the
+ * introspection report.
+ *
+ * Two facts about workers shape the design:
+ *
+ * 1. A worker thread gets its own instance of this module, so events recorded
+ *    inside a worker are invisible to the main thread's in-memory buffer.
+ *    When `CDXGEN_INTROSPECT_LEDGER` is set, every instance appends its events
+ *    to the same JSONL sidecar through an `O_APPEND` descriptor (only the main
+ *    thread truncates, at open), which makes the sidecar the only complete
+ *    record of a multi-worker run. Consumers must therefore prefer the sidecar
+ *    when it exists and fall back to `getLedgerEvents()` only when it does not.
+ * 2. Every write reaches the descriptor synchronously at record time, so a
+ *    lost tail is impossible; the descriptor is released when the process
+ *    exits (`closeLogStreams` closes every shared writer) or earlier through
+ *    {@link closeLedger}.
+ *
+ * Values that could carry credentials are scrubbed before they are stored or
+ * written: `command`, `path`, `detail`, `causeDetail` and `outputExcerpt` pass
+ * through sensitive-assignment redaction plus the BOM property sanitizer, so a
+ * leaked token can never reach a report file that agents upload.
+ */
+export type LedgerEvent = {
+    /**
+     * One of LEDGER_EVENT_KINDS.
+     */
+    kind: string;
+    /**
+     * Canonical project type ("java", "npm", "python", …).
+     */
+    ecosystem: string;
+    /**
+     * Tool identity ("maven", "gradle", "swift", "dotnet").
+     */
+    tool?: string;
+    /**
+     * Version or version range the project asked for.
+     */
+    wanted?: string;
+    /**
+     * Version actually resolved, or undefined when absent.
+     */
+    found?: string;
+    /**
+     * How `found` was determined ("PATH", "wrapper", "sdkman", "env").
+     */
+    source?: string;
+    /**
+     * Absolute path of the resolved tool or the file that was read.
+     */
+    path?: string;
+    /**
+     * Command line, already redacted.
+     */
+    command?: string;
+    exitCode?: number;
+    /**
+     * One sentence, present tense, no remediation text.
+     */
+    detail?: string;
+    /**
+     * Short diagnosed cause of a failure ("gradle cannot run on Java 21"), when the producer derived one.
+     */
+    causeDetail?: string;
+    /**
+     * Redacted, at most the last 2000 characters of the failed command's combined stdout and stderr, with interior newlines preserved. Suppressed entirely by `CDXGEN_INTROSPECT_NO_OUTPUT`.
+     */
+    outputExcerpt?: string;
+    /**
+     * Key into the remediation catalog (Deliverable 06).
+     */
+    remediationId?: string;
+    /**
+     * One of LEDGER_EVENT_IMPACTS.
+     */
+    impact?: string;
+    /**
+     * ISO 8601.
+     */
+    timestamp: string;
+};
+/**
+ * A structured build-adequacy event.
+ *
+ * @typedef {Object} LedgerEvent
+ * @property {string}  kind        One of LEDGER_EVENT_KINDS.
+ * @property {string}  ecosystem   Canonical project type ("java", "npm", "python", …).
+ * @property {string}  [tool]      Tool identity ("maven", "gradle", "swift", "dotnet").
+ * @property {string}  [wanted]    Version or version range the project asked for.
+ * @property {string}  [found]     Version actually resolved, or undefined when absent.
+ * @property {string}  [source]    How `found` was determined ("PATH", "wrapper", "sdkman", "env").
+ * @property {string}  [path]      Absolute path of the resolved tool or the file that was read.
+ * @property {string}  [command]   Command line, already redacted.
+ * @property {number}  [exitCode]
+ * @property {string}  [detail]    One sentence, present tense, no remediation text.
+ * @property {string}  [causeDetail] Short diagnosed cause of a failure ("gradle cannot run on Java 21"), when the producer derived one.
+ * @property {string}  [outputExcerpt] Redacted, at most the last 2000 characters of the failed command's combined stdout and stderr, with interior newlines preserved. Suppressed entirely by `CDXGEN_INTROSPECT_NO_OUTPUT`.
+ * @property {string}  [remediationId] Key into the remediation catalog (Deliverable 06).
+ * @property {string}  [impact]    One of LEDGER_EVENT_IMPACTS.
+ * @property {string}  timestamp   ISO 8601.
+ */
+/**
+ * The closed set of event kinds. `kind` is validated against this object: a
+ * kind that is not listed is dropped (with a think-log note) rather than
+ * recorded, so a producer bug can never fail a customer's SBOM run. Adding a
+ * kind here is a schema change; consumers must tolerate unknown kinds by
+ * ignoring them.
+ *
+ * @type {Readonly<Record<string, string>>}
+ */
+export declare const LEDGER_EVENT_KINDS: Readonly<Record<string, string>>;
+/**
+ * The closed set of `impact` values, describing what a degraded outcome costs
+ * the fidelity of the generated BOM.
+ *
+ * @type {Readonly<Record<string, string>>}
+ */
+export declare const LEDGER_EVENT_IMPACTS: Readonly<Record<string, string>>;
+/**
+ * Reserved `ecosystem` value for events that describe the recorder itself
+ * rather than a project ecosystem, such as the truncation marker. Consumers
+ * that group events by ecosystem must treat it as a global observation instead
+ * of creating an ecosystem entry for it.
+ *
+ * @type {string}
+ */
+export declare const LEDGER_TOOL_ECOSYSTEM: string;
+/**
+ * Module-load snapshot of the build-introspection environment: `CDXGEN_INTROSPECT`
+ * is `true`/`1`, or `CDXGEN_INTROSPECT_LEDGER` names a sidecar file. Library
+ * callers that configure introspection before importing this module can read
+ * it directly; the CLI enables introspection after argument parsing, so every
+ * internal gate reads {@link isLedgerEnabled}, which resolves the same
+ * environment on each call.
+ *
+ * @type {boolean}
+ */
+export declare const LEDGER_ENABLED: boolean;
+/**
+ * True when build-introspection recording is enabled for this run: the same
+ * environment as {@link LEDGER_ENABLED}, read live. The CLI turns
+ * introspection on after argument parsing by setting `CDXGEN_INTROSPECT`, so
+ * a module-load snapshot would miss every event recorded after that point;
+ * the environment only ever flips in that one direction during a run.
+ *
+ * @returns {boolean} True when events should be recorded.
+ */
+/**
+ * Whether build introspection is enabled for this run. The flag decides when
+ * it was given; otherwise the environment speaks, which is how a run that
+ * enabled introspection through a profile reaches the recorders.
+ *
+ * @param {Object} [options] CLI options.
+ * @returns {boolean} True when the run records and reports a verdict.
+ */
+export declare function isIntrospectionEnabled(options?: Object): boolean;
+export declare function isLedgerEnabled(): boolean;
+/**
+ * Redact a free-text introspection value with the ledger's own redactor. Both
+ * report renderers run their free text through this function so a field can
+ * never be redacted differently in the ledger, the JSON report and the
+ * markdown report.
+ *
+ * @param {string|undefined} value Free text of untrusted origin.
+ * @returns {string|undefined} Redacted text.
+ */
+export declare function redactIntrospectionText(value: string | undefined): string | undefined;
+/**
+ * Combined stdout and stderr of a spawned command, as the raw material of an
+ * output excerpt. Producers that already hold a spawn result call this so the
+ * recorder, not the producer, owns truncation and redaction.
+ *
+ * @param {Object|undefined} spawnResult A spawnSync-style result.
+ * @returns {string|undefined} The combined output, or undefined when the command produced none.
+ */
+export declare function commandOutputText(spawnResult: Object | undefined): string | undefined;
+/**
+ * Record one build-adequacy event. Returns immediately after a single boolean
+ * test when introspection is disabled, so producers may pass plain values
+ * without gating the call themselves.
+ *
+ * Events with a kind outside LEDGER_EVENT_KINDS, or without a non-empty
+ * `ecosystem`, are dropped with a think-log note instead of throwing: the
+ * ledger is instrumentation, and a producer bug must never fail an SBOM run.
+ *
+ * @param {string} kind Event kind; one of LEDGER_EVENT_KINDS.
+ * @param {Partial<LedgerEvent>} [fields] Event fields; `command`, `path`, `detail`, `causeDetail` and `outputExcerpt` are redacted before storage, and `outputExcerpt` is additionally bounded to its tail.
+ * @returns {LedgerEvent|undefined} The stored event, or undefined when recording is disabled or the event was dropped.
+ */
+export declare function recordLedgerEvent(kind: string, fields?: Partial<LedgerEvent>): LedgerEvent | undefined;
+/**
+ * Resolve the event kind for a remediation id from the catalog.
+ *
+ * @param {string} remediationId Remediation id to look up.
+ * @returns {string|undefined} Default event kind, or undefined when the id is unknown or the catalog is unavailable.
+ */
+export declare function remediationKindFor(remediationId: string): string | undefined;
+/**
+ * The full remediation catalog, for consumers that need the extended entry
+ * fields (target tier, actions, verify clause) rather than a single resolved
+ * kind. Returns the cached parsed catalog; null when the data file is
+ * missing or unreadable.
+ *
+ * @returns {Record<string, Object>|null} Catalog keyed by remediation id, or null when unavailable.
+ */
+export declare function getRemediationCatalog(): Record<string, Object> | null;
+/**
+ * Record a degraded outcome together with the remediation that would restore
+ * the lost evidence. The kind and the remediationId come from the catalog
+ * entry for `remediationId`, so a site only supplies the facts it observed;
+ * `ecosystem` and `impact` are required from the caller because only the site
+ * knows which scanned ecosystem paid the cost and how much. A site whose
+ * degradation differs in kind from the catalog default (a command that threw
+ * rather than a fallback that engaged) may pass an explicit `kind` in fields.
+ *
+ * Events for unknown ids are dropped with a think-log note: an id outside the
+ * catalog is a producer bug and the catalog is the contract.
+ *
+ * @param {string} remediationId Key into data/remediations.json.
+ * @param {Partial<LedgerEvent> & {kind?: string}} fields Event fields; `ecosystem` and `impact` are required, `kind` overrides the catalog default.
+ * @returns {LedgerEvent|undefined} The stored event, or undefined when recording is disabled or the event was dropped.
+ */
+export declare function recordDegradation(remediationId: string, fields?: Partial<LedgerEvent> & {
+    kind?: string;
+}): LedgerEvent | undefined;
+/**
+ * Snapshot of the events recorded by this thread. Each event and the array
+ * itself are frozen, so a consumer cannot mutate the recorder's state.
+ * In a multi-worker run this buffer is this thread's view only; the JSONL
+ * sidecar is the complete record.
+ *
+ * @returns {LedgerEvent[]} Frozen array of frozen events.
+ */
+export declare function getLedgerEvents(): LedgerEvent[];
+/**
+ * Clear the in-memory buffer and the truncation state. Intended for tests; a
+ * production run never resets its own ledger. The sidecar file is append-only
+ * and is not touched.
+ *
+ * @returns {void}
+ */
+export declare function resetLedgerEvents(): void;
+/**
+ * Parse a JSONL sidecar produced by `CDXGEN_INTROSPECT_LEDGER` back into
+ * events. Blank lines and lines that fail to parse — a torn final line from an
+ * interrupted run is expected — are skipped. Prefer this over the in-memory
+ * buffer whenever the sidecar exists: worker threads append to the same file,
+ * so it is the only complete record of a multi-worker run.
+ *
+ * @param {string} ledgerPath Path to the JSONL sidecar.
+ * @returns {LedgerEvent[]} Frozen array of frozen events, empty when the file is missing or unreadable.
+ */
+export declare function loadLedgerFile(ledgerPath: string): LedgerEvent[];
+/**
+ * Close the sidecar descriptor held by this thread. Idempotent; further
+ * events stay in memory only. The descriptor is also released when the
+ * process exits through `closeLogStreams`.
+ *
+ * @returns {void}
+ */
+export declare function closeLedger(): void;
+//# sourceMappingURL=buildLedger.d.ts.map

package/types/lib/core/buildLedger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildLedger.d.ts","sourceRoot":"","sources":["../../../lib/core/buildLedger.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AA0BA,YAAkB,WAAW,GAC7B;;;;IAAoB,IAAI,EAAb,MAAM,CACjB;;;;IAAoB,SAAS,EAAlB,MAAM,CACjB;;;;IAAqB,IAAI,AAAzB,CACA,EADW,MAAM,CACjB;;;;IAAqB,MAAM,AAA3B,CACA,EADW,MAAM,CACjB;;;;IAAqB,KAAK,AAA1B,CACA,EADW,MAAM,CACjB;;;;IAAqB,MAAM,AAA3B,CACA,EADW,MAAM,CACjB;;;;IAAqB,IAAI,AAAzB,CACA,EADW,MAAM,CACjB;;;;IAAqB,OAAO,AAA5B,CACA,EADW,MAAM,CACjB;IAAqB,QAAQ,AAA7B,CACA,EADW,MAAM,CACjB;;;;IAAqB,MAAM,AAA3B,CACA,EADW,MAAM,CACjB;;;;IAAqB,WAAW,AAAhC,CACA,EADW,MAAM,CACjB;;;;IAAqB,aAAa,AAAlC,CACA,EADW,MAAM,CACjB;;;;IAAqB,aAAa,AAAlC,CACA,EADW,MAAM,CACjB;;;;IAAqB,MAAM,AAA3B,CACA,EADW,MAAM,CACjB;;;;IAAoB,SAAS,EAAlB,MAAM,CACnB;CAAA,CAAA;AAnBD;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,EAFrB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYvC,CAAC;AAIH;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAFvB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASvC,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,EAFxB,MAEmC,CAAC;AAS9C;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,EAFjB,OAIoD,CAAC;AAE/D;;;;;;;;GAQG;AACH;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,AAH3C,CACA,EADQ,MAGmC,GAFjC,OAAO,CAOnB;AAED,wBAAgB,eAAe,YAK9B;AA8OD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAHlC,MAAM,GAAC,SAG2B,GAFhC,MAAM,GAAC,SAAS,CAO5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAHlC,MAAM,GAAC,SAG2B,GAFhC,MAAM,GAAC,SAAS,CAU5B;AA0JD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAJ3B,MAI2B,EAAE,MAAM,AAH3C,CACA,EADQ,OAAO,CAAC,WAAW,CAGqB,GAFtC,WAAW,GAAC,SAAS,CAmBjC;AAsCD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAFxB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAC,IAAI,CAIvC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAJpC,MAIoC,EAAE,MAAM,GAH5C,OAAO,CAAC,WAAW,CAAC,GAAG;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAGY,GAF/C,WAAW,GAAC,SAAS,CAkBjC;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,IAFlB,WAAW,EAAE,CAMzB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAFpB,IAAI,CAKhB;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAH9B,MAG8B,GAF5B,WAAW,EAAE,CAwBzB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,IAFd,IAAI,CAYhB"}

package/types/lib/core/deferredExit.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Deferred `fail-on-error` exits for introspected runs.
+ *
+ * `--fail-on-error` promises an operator that a failing dependency extractor
+ * never produces a plausible-but-incomplete BOM, so the extractors exit the
+ * process the moment a build tool fails. Under `--introspect` that exit
+ * destroys the very evidence the run exists to produce: the ledger events
+ * recorded a statement earlier die with the process, `postProcess` never
+ * runs, and neither the BOM nor the fidelity report is written.
+ *
+ * On an introspected run the extractor instead records the failure here and
+ * throws {@link DeferredFailOnError}, which the extractor catches at its
+ * completion point so it still returns everything it collected before the
+ * failure — the incomplete-result fallbacks stay skipped, exactly as
+ * `fail-on-error` demands. The CLI then writes the BOM and both reports and
+ * exits with the dedicated {@link INTROSPECTION_FAILURE_EXIT_CODE} status, so
+ * the exit code still claims "an extractor failed", distinct from the
+ * fidelity gate's 4.
+ *
+ * Without introspection this module is a pass-through to `process.exit(1)`;
+ * the default contract of the flag is unchanged.
+ */
+/**
+ * Exit status used when an introspected run completes its outputs despite a
+ * `--fail-on-error` extractor failure. Distinct from 1 (generic failure),
+ * 3 (TEA publish failure) and 4 (the introspection fidelity gate).
+ *
+ * @type {number}
+ */
+export declare const INTROSPECTION_FAILURE_EXIT_CODE: number;
+/**
+ * Control-flow signal thrown by {@link deferFailOnError} on an introspected
+ * run. The extractor that called it must let it unwind to its completion
+ * point, keep everything it collected until then, and rethrow anything else.
+ */
+export declare class DeferredFailOnError extends Error {
+    /**
+     * @param {string} message Human-readable failure summary.
+     */
+    constructor(message: string);
+}
+/**
+ * Test whether an error is the fail-on-error deferral signal.
+ *
+ * @param {unknown} err The caught error.
+ * @returns {boolean} True when the error unwinds a deferred fail-on-error abort.
+ */
+export declare function isDeferredFailOnError(err: unknown): boolean;
+/**
+ * Snapshot of the deferred failures recorded by this run.
+ *
+ * @returns {Array<Object>} Frozen copies of the recorded failures.
+ */
+export declare function getDeferredFailures(): Array<Object>;
+/**
+ * Handle a failing extractor on behalf of a `options.failOnError &&
+ * process.exit(1)` site. Without `fail-on-error` the run continues exactly
+ * as it would have. With the flag and no introspection the process exits 1,
+ * unchanged. On an introspected run the failure is recorded — including one
+ * ledger observation on the ecosystem row the failure cost evidence — and
+ * the deferral signal is thrown so the extractor stops where it is without
+ * taking any incomplete-result fallback.
+ *
+ * @param {Object} options CLI options.
+ * @param {Object} failure What failed, for the operator message and the report.
+ * @param {string} failure.tool The build tool that failed.
+ * @param {string} [failure.ecosystem] The ecosystem the tool serves, so the
+ *   observation lands on the row whose evidence the failure cost.
+ * @param {string} failure.detail One sentence, present tense.
+ * @param {number} [failure.exitCode] The tool's exit status, when known.
+ * @param {string} [failure.command] The redacted command that was attempted.
+ * @param {string} [failure.outputExcerpt] The failed command's combined output,
+ *   when the caller already holds it; the recorder bounds and redacts it.
+ * @returns {void} Never returns on an introspected run; it throws.
+ */
+export declare function deferFailOnError(options: Object, failure: {
+    tool: string;
+    ecosystem?: string;
+    detail: string;
+    exitCode?: number;
+    command?: string;
+    outputExcerpt?: string;
+}): void;
+//# sourceMappingURL=deferredExit.d.ts.map

package/types/lib/core/deferredExit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deferredExit.d.ts","sourceRoot":"","sources":["../../../lib/core/deferredExit.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AASH;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,EAFlC,MAEsC,CAAC;AAEjD;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C;;OAEG;IACH,YAAY,OAAO,EAFR,MAEQ,EAGlB;CACF;AAWD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAH9B,OAG8B,GAF5B,OAAO,CAInB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,KAAK,CAAC,MAAM,CAAC,CAIzB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAZ7B,MAY6B,EAAE,OAAO,EAV9C;IAAwB,IAAI,EAApB,MAAM,CACd;IAAyB,SAAS,AAAlC,CAEA,EAFQ,MAAM,CAEd;IAAwB,MAAM,EAAtB,MAAM,CACd;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;IAAyB,OAAO,AAAhC,CACA,EADQ,MAAM,CACd;IAAyB,aAAa,AAAtC,CAEA,EAFQ,MAAM,CAEd;CAE8C,GAFpC,IAAI,CAuChB"}