@cdxgen/cdxgen 13.0.1 → 13.2.0

package/types/lib/core/env.d.ts

@@ -60,7 +60,11 @@ export declare function getJavaCommand(): string;
 export declare const PYTHON_CMD: string;
 /**
  * Returns the Python executable command to use, resolved in priority order:
- * PYTHON_CMD env var > CONDA_PYTHON_EXE env var > "python".
+ * PYTHON_CMD env var > CONDA_PYTHON_EXE env var > "python" > "python3".
+ *
+ * Distributions that ship only a versioned interpreter leave a bare "python"
+ * unresolvable, which would fail every virtualenv this tool creates, so the
+ * versioned name is used when it is the only one PATH offers.
  *
  * @returns {string} Path or name of the Python executable
  */
@@ -81,6 +85,15 @@ export declare let RUSTC_CMD: string;
 export declare let GO_CMD: string;
 /** Resolved Cargo executable command (CARGO_CMD env var, or "cargo"). */
 export declare let CARGO_CMD: string;
+/**
+ * Target triple the cargo resolve graph is filtered to, so that a
+ * cross-compiled project can be described for the triple it ships on rather
+ * than for the union of every triple its lock file covers.
+ *
+ * `CDXGEN_CARGO_TARGET` is cdxgen's own name for it; `CARGO_BUILD_TARGET` is
+ * cargo's standard variable, which a cross-compiling build already sets.
+ */
+export declare const CARGO_TARGET: string | undefined;
 /** Resolved Clojure CLI executable command (CLJ_CMD env var, or "clj"). */
 export declare let CLJ_CMD: string;
 /** Resolved Leiningen executable command (LEIN_CMD env var, or "lein"). */
@@ -105,6 +118,7 @@ export declare const PROJECT_TYPE_ALIASES: {
     js: string[];
     mcp: string[];
     "ai-skill": string[];
+    agentic: string[];
     py: string[];
     go: string[];
     rust: string[];
@@ -114,6 +128,17 @@ export declare const PROJECT_TYPE_ALIASES: {
     dart: string[];
     haskell: string[];
     elixir: string[];
+    erlang: string[];
+    julia: string[];
+    r: string[];
+    ocaml: string[];
+    elm: string[];
+    crystal: string[];
+    nim: string[];
+    lua: string[];
+    perl: string[];
+    spack: string[];
+    terraform: string[];
     c: string[];
     clojure: string[];
     github: string[];
@@ -143,6 +168,23 @@ export declare const PROJECT_TYPE_ALIASES: {
 export declare const PACKAGE_MANAGER_ALIASES: {
     scala: string[];
 };
+/**
+ * Project-type prefixes that accept a version suffix pinning a JVM build
+ * tool, e.g. `maven3.9.9`, `mvn3.9.9`, `gradle8.14`, `sbt1.10`, or
+ * `scala3.6.4`. Kept alongside the alias map because both describe how CLI
+ * project types map to base types.
+ *
+ * @type {string[]}
+ */
+export declare const JVM_BUILD_TOOL_TYPE_PREFIXES: string[];
+/**
+ * Check whether a project type pins a JVM build tool version, i.e. it starts
+ * with one of the JVM build tool prefixes followed by a digit.
+ *
+ * @param {string} projectType Project type from the CLI
+ * @returns {boolean} True for versioned JVM build tool types.
+ */
+export declare function isVersionedJvmToolProjectType(projectType: string): boolean;
 /**
  * Method to check if a given feature flag is enabled.
  *

package/types/lib/core/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../lib/core/env.js"],"names":[],"mappings":"AAUA,uCAAuC;AACvC,eAAO,MAAM,MAAM,SAAmD,CAAC;AACvE,mCAAmC;AACnC,eAAO,MAAM,KAAK,SAAwC,CAAC;AAC3D,oCAAoC;AACpC,eAAO,MAAM,MAAM,SAA+C,CAAC;AAEnE,yFAAyF;AACzF,eAAO,MAAM,sBAAsB,oBAElC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAIrB,CAAC;AAEX,sJAAsJ;AACtJ,eAAO,MAAM,qBAAqB,SAI/B,CAAC;AAEJ,sIAAsI;AACtI,eAAO,MAAM,sBAAsB,SAElC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAH9B,MAG8B,GAF5B,MAAM,EAAE,CAiDpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAFrB,OAAO,CAOnB;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAF7B,OAAO,CAUnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAFjB,OAAO,CAOnB;AAED,mGAAmG;AACnG,eAAO,MAAM,aAAa,SAAuB,CAAC;AAElD,oJAAoJ;AACpJ,eAAO,MAAM,gBAAgB,SAEwC,CAAC;AAEtE,yFAAyF;AACzF,eAAO,MAAM,QAAQ,QAAmB,CAAC;AAEzC;;;;;GAKG;AACH,wBAAgB,cAAc,IAFjB,MAAM,CAclB;AAED,6FAA6F;AAC7F,eAAO,MAAM,UAAU,QAAqB,CAAC;AAE7C;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,CAUlB;AAED,mEAAmE;AACnE,eAAO,IAAI,UAAU,QAAW,CAAC;AAIjC,yEAAyE;AACzE,eAAO,IAAI,QAAQ,QAAS,CAAC;AAI7B,mEAAmE;AACnE,eAAO,IAAI,OAAO,QAAQ,CAAC;AAI3B,sEAAsE;AACtE,eAAO,IAAI,QAAQ,QAAS,CAAC;AAI7B,mEAAmE;AACnE,eAAO,IAAI,OAAO,QAAQ,CAAC;AAI3B,yEAAyE;AACzE,eAAO,IAAI,SAAS,QAAU,CAAC;AAI/B,gEAAgE;AAChE,eAAO,IAAI,MAAM,QAAO,CAAC;AAIzB,yEAAyE;AACzE,eAAO,IAAI,SAAS,QAAU,CAAC;AAK/B,2EAA2E;AAC3E,eAAO,IAAI,OAAO,QAAQ,CAAC;AAK3B,2EAA2E;AAC3E,eAAO,IAAI,QAAQ,QAAS,CAAC;AAK7B,mFAAmF;AACnF,eAAO,IAAI,eAAe,QAAS,CAAC;AAKpC,yEAAyE;AACzE,eAAO,MAAM,SAAS,QAAkD,CAAC;AAEzE,sEAAsE;AACtE,eAAO,MAAM,QAAQ,QAAgD,CAAC;AAEtE,6EAA6E;AAC7E,eAAO,MAAM,0BAA0B,UAWtC,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB;IAC/B,IAAI;IAwBJ,OAAO;IACP,GAAG;IACH,cAAc;IACd,WAAW;IACX,aAAa;IACb,aAAa;IACb,EAAE;IAiCF,GAAG;IACH,UAAU;IACV,EAAE;IAuBF,EAAE;IACF,IAAI;IACJ,GAAG;IACH,IAAI;IACJ,MAAM;IA4BN,IAAI;IACJ,OAAO;IACP,MAAM;IACN,CAAC;IACD,OAAO;IACP,MAAM;IACN,IAAI;IACJ,EAAE;IACF,OAAO;IACP,IAAI;IACJ,YAAY;IACZ,SAAS;IAcT,UAAU;IACV,KAAK;IAUL,MAAM;IACN,GAAG;IACH,KAAK;IACL,KAAK;IACL,GAAG;IACH,GAAG;IACH,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,kBAAkB;IASlB,kBAAkB;IAMlB,OAAO;IACP,eAAe;CAChB,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB;IAClC,KAAK;CACN,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EALhC,MAKgC,EAAE,OAAO,QAAA,WAiBnD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,OAAA,EAAE,OAAO,EAH5C,MAG4C,EAAE,aAAa,UAAO,OAmG5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAJxC,MAIwC,EAAE,WAAW,AAH7D,CACA,EADQ,MAGqD,GAFnD,OAAO,CAiCnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,QAAA,EAAE,mBAAmB,OAAA,EAAE,OAAO,EAJ/D,MAI+D,WAezE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,KAAA,OA8CvC"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../lib/core/env.js"],"names":[],"mappings":"AAUA,uCAAuC;AACvC,eAAO,MAAM,MAAM,SAAmD,CAAC;AACvE,mCAAmC;AACnC,eAAO,MAAM,KAAK,SAAwC,CAAC;AAC3D,oCAAoC;AACpC,eAAO,MAAM,MAAM,SAA+C,CAAC;AAEnE,yFAAyF;AACzF,eAAO,MAAM,sBAAsB,oBAElC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAIrB,CAAC;AAEX,sJAAsJ;AACtJ,eAAO,MAAM,qBAAqB,SAI/B,CAAC;AAEJ,sIAAsI;AACtI,eAAO,MAAM,sBAAsB,SAElC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAH9B,MAG8B,GAF5B,MAAM,EAAE,CAiDpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAFrB,OAAO,CAOnB;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAF7B,OAAO,CAUnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAFjB,OAAO,CAOnB;AAED,mGAAmG;AACnG,eAAO,MAAM,aAAa,SAAuB,CAAC;AAElD,oJAAoJ;AACpJ,eAAO,MAAM,gBAAgB,SAEwC,CAAC;AAEtE,yFAAyF;AACzF,eAAO,MAAM,QAAQ,QAAmB,CAAC;AAEzC;;;;;GAKG;AACH,wBAAgB,cAAc,IAFjB,MAAM,CAclB;AAED,6FAA6F;AAC7F,eAAO,MAAM,UAAU,QAAqB,CAAC;AAsB7C;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,CAYlB;AAED,mEAAmE;AACnE,eAAO,IAAI,UAAU,QAAW,CAAC;AAIjC,yEAAyE;AACzE,eAAO,IAAI,QAAQ,QAAS,CAAC;AAI7B,mEAAmE;AACnE,eAAO,IAAI,OAAO,QAAQ,CAAC;AAI3B,sEAAsE;AACtE,eAAO,IAAI,QAAQ,QAAS,CAAC;AAI7B,mEAAmE;AACnE,eAAO,IAAI,OAAO,QAAQ,CAAC;AAI3B,yEAAyE;AACzE,eAAO,IAAI,SAAS,QAAU,CAAC;AAI/B,gEAAgE;AAChE,eAAO,IAAI,MAAM,QAAO,CAAC;AAIzB,yEAAyE;AACzE,eAAO,IAAI,SAAS,QAAU,CAAC;AAK/B;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,oBAGd,CAAC;AAEZ,2EAA2E;AAC3E,eAAO,IAAI,OAAO,QAAQ,CAAC;AAK3B,2EAA2E;AAC3E,eAAO,IAAI,QAAQ,QAAS,CAAC;AAK7B,mFAAmF;AACnF,eAAO,IAAI,eAAe,QAAS,CAAC;AAKpC,yEAAyE;AACzE,eAAO,MAAM,SAAS,QAAkD,CAAC;AAEzE,sEAAsE;AACtE,eAAO,MAAM,QAAQ,QAAgD,CAAC;AAEtE,6EAA6E;AAC7E,eAAO,MAAM,0BAA0B,UAWtC,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB;IAC/B,IAAI;IAyBJ,OAAO;IACP,GAAG;IACH,cAAc;IACd,WAAW;IACX,aAAa;IACb,aAAa;IACb,EAAE;IAyCF,GAAG;IACH,UAAU;IACV,OAAO;IACP,EAAE;IAyBF,EAAE;IACF,IAAI;IACJ,GAAG;IACH,IAAI;IACJ,MAAM;IA8BN,IAAI;IACJ,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,CAAC;IACD,KAAK;IACL,GAAG;IACH,OAAO;IACP,GAAG;IACH,GAAG;IACH,IAAI;IACJ,KAAK;IACL,SAAS;IACT,CAAC;IACD,OAAO;IACP,MAAM;IACN,IAAI;IACJ,EAAE;IACF,OAAO;IACP,IAAI;IACJ,YAAY;IACZ,SAAS;IAcT,UAAU;IACV,KAAK;IAUL,MAAM;IACN,GAAG;IACH,KAAK;IACL,KAAK;IACL,GAAG;IACH,GAAG;IACH,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,kBAAkB;IASlB,kBAAkB;IAMlB,OAAO;IACP,eAAe;CAChB,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB;IAClC,KAAK;CACN,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,EAF/B,MAAM,EAQf,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAH9C,MAG8C,GAF5C,OAAO,CAUnB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EALhC,MAKgC,EAAE,OAAO,QAAA,WAiBnD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,OAAA,EAAE,OAAO,EAH5C,MAG4C,EAAE,aAAa,UAAO,OA4G5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAJxC,MAIwC,EAAE,WAAW,AAH7D,CACA,EADQ,MAGqD,GAFnD,OAAO,CAiCnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,QAAA,EAAE,mBAAmB,OAAA,EAAE,OAAO,EAJ/D,MAI+D,WAezE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,KAAA,OA8CvC"}

package/types/lib/core/fs.d.ts

@@ -6,6 +6,15 @@ import { Buffer } from "node:buffer";
  * @Boolean True if the path exists. False otherwise
  */
 export declare function safeExistsSync(filePath: string): any;
+/**
+ * Permission-aware check for whether a path exists and carries the executable
+ * bit for the current user. Answers false instead of throwing when the path
+ * is absent, unreadable, or blocked by secure mode.
+ *
+ * @param {string} filePath File path to check.
+ * @returns {boolean} True when the path exists and is executable.
+ */
+export declare function safeIsExecutableSync(filePath: string): boolean;
 /**
  * Permission- and dry-run-aware wrapper around writeFileSync. Records the
  * activity and returns undefined when blocked.
@@ -16,6 +25,18 @@ export declare function safeExistsSync(filePath: string): any;
  * @returns {void}
  */
 export declare function safeWriteSync(filePath: string, data: string | Buffer, options?: Object): void;
+/**
+ * Permission-aware wrapper around readFileSync that returns undefined instead
+ * of throwing. Reads are allowed in dry-run mode, so unlike the write wrappers
+ * this only guards secure-mode read permission; the read itself is not recorded
+ * in the activity ledger because inspection of classified paths is already
+ * recorded by safeExistsSync and a read has no side effect to audit.
+ *
+ * @param {string} filePath File path to read.
+ * @param {Object|string} [options] readFileSync options; defaults to UTF-8 text.
+ * @returns {string|Buffer|undefined} File content, or undefined when the path cannot be read.
+ */
+export declare function safeReadFileSync(filePath: string, options?: Object | string): string | Buffer | undefined;
 /**
  * Safely create a directory without crashing due to a lack of permissions
  *

package/types/lib/core/fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../lib/core/fs.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAsErC;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,QAAA,OAmCtC;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAL3B,MAK2B,EAAE,IAAI,EAJjC,MAAM,GAAC,MAI0B,EAAE,OAAO,AAHlD,CACA,EADQ,MAG0C,GAFxC,IAAI,CA0BhB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,QAAA,EAAE,OAAO,EAH5B,OAG4B,aAwB9C;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAAM,GAAC,MAGyC,GAF9C,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAJxB,MAIwB,EAAE,OAAO,AAHzC,CACA,EADQ,MAG6C,GAF3C,IAAI,CAchB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,IAAI,CAchB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,IAAI,EAJ/B,MAI+B,EAAE,IAAI,AAH7C,CACA,EADQ,MAGiD,GAF/C,IAAI,CAkBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EARD,MAQC,EACV,UAAU,EARD,MAQC,EACV,SAAS,EARA,kBAQA,EACT,IAAI,AARH,CACA,EADQ,MAQK,EACd,OAAO,AARN,CACA,EADQ,MAQU,GAPR,OAAO,CAAC,OAAO,CAAC,CAwD5B;AAED,sFAAsF;AACtF,eAAO,MAAM,cAAc,UAAY,CAAC;AASxC,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,UAAY,CAAC;AAuK1C;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAL1B,MAK0B,EAAE,IAAI,EAJhC,MAAM,EAI0B,EAAE,OAAO,EAHzC,MAGyC,GAFvC,MAAM,CA8OlB;AAED,6FAA6F;AAC7F,eAAO,MAAM,UAAU,QAEP,CAAC;AAEjB,4GAA4G;AAC5G,eAAO,MAAM,UAAU,QAEJ,CAAC;AAEpB;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,OAAO,EANxB,MAMwB,EAAE,OAAO,EALjC,MAKiC,EAAE,OAAO,GAJ1C,MAI+C,OAuCzD;AA0BD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAFhC,MAAM,GAAC,SAEyB,QAK1C;AA4BD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,SAGtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EARE,MAQF,EACP,OAAO,EARE,MAQF,EACP,UAAU,SAAA,EACV,UAAU,OAAA,OAmDX;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAFf,MAAM,CAIlB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,IAFZ,MAAM,CAYlB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAJ1B,MAI0B,EAAE,IAAI,EAHhC,MAGgC,GAF9B,OAAO,QAAQ,CAU3B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,KAAA,EAAE,IAAI,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA8B3B"}
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../lib/core/fs.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAyErC;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,QAAA,OAmCtC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAHlC,MAGkC,GAFhC,OAAO,CAYnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAL3B,MAK2B,EAAE,IAAI,EAJjC,MAAM,GAAC,MAI0B,EAAE,OAAO,AAHlD,CACA,EADQ,MAG0C,GAFxC,IAAI,CA0BhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAJ9B,MAI8B,EAAE,OAAO,AAH/C,CACA,EADQ,MAAM,GAAC,MAG0C,GAF/C,MAAM,GAAC,MAAM,GAAC,SAAS,CA0BnC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,QAAA,EAAE,OAAO,EAH5B,OAG4B,aAwB9C;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAAM,GAAC,MAGyC,GAF9C,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAJxB,MAIwB,EAAE,OAAO,AAHzC,CACA,EADQ,MAG6C,GAF3C,IAAI,CAchB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,IAAI,CAchB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,IAAI,EAJ/B,MAI+B,EAAE,IAAI,AAH7C,CACA,EADQ,MAGiD,GAF/C,IAAI,CAkBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EARD,MAQC,EACV,UAAU,EARD,MAQC,EACV,SAAS,EARA,kBAQA,EACT,IAAI,AARH,CACA,EADQ,MAQK,EACd,OAAO,AARN,CACA,EADQ,MAQU,GAPR,OAAO,CAAC,OAAO,CAAC,CAwD5B;AAED,sFAAsF;AACtF,eAAO,MAAM,cAAc,UAAY,CAAC;AASxC,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,UAAY,CAAC;AAuK1C;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAL1B,MAK0B,EAAE,IAAI,EAJhC,MAAM,EAI0B,EAAE,OAAO,EAHzC,MAGyC,GAFvC,MAAM,CA8OlB;AAED,6FAA6F;AAC7F,eAAO,MAAM,UAAU,QAEP,CAAC;AAEjB,4GAA4G;AAC5G,eAAO,MAAM,UAAU,QAEJ,CAAC;AAEpB;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,OAAO,EANxB,MAMwB,EAAE,OAAO,EALjC,MAKiC,EAAE,OAAO,GAJ1C,MAI+C,OAuCzD;AA0BD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAFhC,MAAM,GAAC,SAEyB,QAK1C;AA4BD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,SAGtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EARE,MAQF,EACP,OAAO,EARE,MAQF,EACP,UAAU,SAAA,EACV,UAAU,OAAA,OAmDX;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAFf,MAAM,CAIlB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,IAFZ,MAAM,CAYlB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAJ1B,MAI0B,EAAE,IAAI,EAHhC,MAGgC,GAF9B,OAAO,QAAQ,CAU3B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,KAAA,EAAE,IAAI,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA8B3B"}

package/types/lib/core/logger.d.ts

@@ -1,14 +1,5 @@
-/**
- * The stream every human-readable diagnostic is written to.
- *
- * Exported so that the live region and the table renderer resolve the same
- * destination as the loggers do. A caller that sets `CDXGEN_LOG_STREAM=stdout`
- * gets the pre-v13 behaviour for all of it, not just for the thought and trace
- * logs.
- *
- * @type {NodeJS.WritableStream}
- */
-export declare const diagnosticStream: NodeJS.WritableStream;
+import { diagnosticStream } from "./syncFileWriter.js";
+export { diagnosticStream };
 /** True when thought/reasoning logging is enabled (CDXGEN_THOUGHT_LOG, CDXGEN_THINK_MODE, or verbose debug mode). */
 export declare const THINK_MODE: any;
 /** True when structured command/HTTP trace logging is enabled (CDXGEN_TRACE_LOG, CDXGEN_TRACE_ID, CDXGEN_TRACE_MODE, or verbose debug mode). */

package/types/lib/core/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../../lib/core/logger.js"],"names":[],"mappings":"AAgBA;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,EAFnB,qBAE+B,CAAC;AAQ1C,qHAAqH;AACrH,eAAO,MAAM,UAAU,KAGsB,CAAC;AAsF9C,gJAAgJ;AAChJ,eAAO,MAAM,UAAU,KAIsB,CAAC;AAiB9C;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAJjB,MAIiB,EAAE,IAAI,AAH/B,CACA,EADQ,MAGuB,GAFrB,IAAI,CAehB;AAGD;;;;;;GAMG;AACH,wBAAgB,UAAU,IAFb,IAAI,CAQhB;AAuCD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,SAAS,QAAA,EAAE,IAAI,EAF7B,MAE6B,QAyBvC;AAID;;;;;;;;GAQG;AACH,wBAAgB,eAAe,IAFlB,IAAI,CAWhB"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../../lib/core/logger.js"],"names":[],"mappings":"AAGA,OAAO,EAEL,gBAAgB,EAEjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAY5B,qHAAqH;AACrH,eAAO,MAAM,UAAU,KAGsB,CAAC;AAc9C,gJAAgJ;AAChJ,eAAO,MAAM,UAAU,KAIsB,CAAC;AAiB9C;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAJjB,MAIiB,EAAE,IAAI,AAH/B,CACA,EADQ,MAGuB,GAFrB,IAAI,CAehB;AAGD;;;;;;GAMG;AACH,wBAAgB,UAAU,IAFb,IAAI,CAQhB;AAuCD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,SAAS,QAAA,EAAE,IAAI,EAF7B,MAE6B,QAyBvC;AAID;;;;;;;;GAQG;AACH,wBAAgB,eAAe,IAFlB,IAAI,CAShB"}

package/types/lib/core/severity.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Shared severity ordering for finding and confidence ladders.
+ *
+ * Lives in the core layer so modules below the audit layer can order labels
+ * such as `low`/`medium`/`high` without importing the audit package; the audit
+ * scoring module re-exports this constant under its historical name.
+ *
+ * @type {Readonly<Record<string, number>>}
+ */
+export declare const SEVERITY_ORDER: Readonly<Record<string, number>>;
+//# sourceMappingURL=severity.d.ts.map

package/types/lib/core/severity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"severity.d.ts","sourceRoot":"","sources":["../../../lib/core/severity.js"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,EAFjB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQvC,CAAC"}

package/types/lib/core/syncFileWriter.d.ts

@@ -0,0 +1,33 @@
+import { Writable } from "node:stream";
+/**
+ * The stream every human-readable diagnostic is written to.
+ *
+ * Also the fallback destination of {@link openSyncFileWriter} when a log path
+ * cannot be opened, so an unwritable path keeps the records visible somewhere
+ * instead of taking the run down.
+ *
+ * @type {NodeJS.WritableStream}
+ */
+export declare const diagnosticStream: NodeJS.WritableStream;
+/**
+ * Open a synchronous writer for a log file path, or return the writer already
+ * open for that path.
+ *
+ * `Console` requires a real stream, so this is a `Writable` whose `_write`
+ * completes synchronously: bytes reach the descriptor as each record is
+ * written, and nothing is left queued for an event loop turn that a process
+ * exit may never take.
+ *
+ * @param {string} filePath Destination path
+ * @param {NodeJS.WritableStream|null} [fallbackStream] Stream returned when the path cannot be opened; defaults to the diagnostic stream. Pass `null` to get `undefined` instead, for callers that must never let data records spill into a diagnostic stream.
+ * @returns {Writable|NodeJS.WritableStream|undefined} Writer for the path, the fallback stream, or `undefined` when the path cannot be opened and no fallback was requested
+ */
+export declare function openSyncFileWriter(filePath: string, fallbackStream?: NodeJS.WritableStream | null): Writable | NodeJS.WritableStream | undefined;
+/**
+ * Close every synchronous file writer opened by {@link openSyncFileWriter}.
+ * Safe to call more than once and after individual writers were closed.
+ *
+ * @returns {void}
+ */
+export declare function closeAllSyncFileWriters(): void;
+//# sourceMappingURL=syncFileWriter.d.ts.map

package/types/lib/core/syncFileWriter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncFileWriter.d.ts","sourceRoot":"","sources":["../../../lib/core/syncFileWriter.js"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAOvC;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,EAFnB,qBAGoE,CAAC;AAS/E;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EALC,MAKD,EACR,cAAc,AALb,CACA,EADQ,qBAAqB,GAAC,IAKE,GAJtB,QAAQ,GAAC,qBAAqB,GAAC,SAAS,CAsDpD;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAF1B,IAAI,CAMhB"}

package/types/lib/core/userAgent.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Outbound `user-agent` construction.
+ *
+ * Package registries police automated traffic through this header, and their
+ * requirements differ. GitHub rejects an absent one with a 403; crates.io
+ * rejects an absent one and additionally blocks a configurable list of exact
+ * strings and prefixes at the CDN edge; Packagist asks for a `mailto=` contact;
+ * PyPI asks for a value that uniquely identifies the consumer, with contact
+ * information; pub.dev documents a `name/version (+url)` shape. The default
+ * built here satisfies all of them at once.
+ *
+ * Two escape hatches exist for operators whose traffic a registry has taken
+ * issue with: `CDXGEN_USER_AGENT` replaces the header everywhere, and
+ * `CDXGEN_USER_AGENT_<REGISTRY>` replaces it for one destination.
+ */
+/**
+ * The registry key covering a host, if any.
+ *
+ * @param {String} hostname Lower-case hostname of the request
+ * @returns {String|undefined} Registry key such as `CRATES`, or undefined
+ */
+export declare function registryKeyForHost(hostname: string): string | undefined;
+/**
+ * The default user-agent: `cdxgen/<version> (+<home url>; mailto=<address>)`.
+ * Setting CDXGEN_CONTACT_EMAIL substitutes a different address, which is what
+ * an operator running cdxgen at scale should do so that a registry contacts
+ * them rather than the project.
+ *
+ * The `@scope/name` npm spelling is deliberately avoided. crates.io blocks
+ * user-agents beginning `@CycloneDX/cdxgen` outright, and a leading `@` is
+ * unusual enough elsewhere to invite the same treatment.
+ *
+ * @returns {String} Default user-agent for outbound requests
+ */
+export declare function defaultUserAgent(): string;
+/**
+ * The user-agent to send to a host. A `CDXGEN_USER_AGENT_<REGISTRY>` override
+ * wins for the hosts of that registry, then the global `CDXGEN_USER_AGENT`,
+ * then the default. Blank overrides are ignored: several registries reject an
+ * empty header outright, so falling back is safer than honouring it.
+ *
+ * @param {String} [hostname] Hostname the request is bound for
+ * @returns {String} User-agent header value
+ */
+export declare function getUserAgent(hostname?: string): string;
+/**
+ * Whether a user-agent carries a substring that crates.io blocks. Useful for
+ * warning an operator whose override would be refused there.
+ *
+ * @param {String} userAgent User-agent value to test
+ * @returns {String|undefined} The offending substring, or undefined
+ */
+export declare function blockedUserAgentSubstring(userAgent: string): string | undefined;
+/** Registry keys that `CDXGEN_USER_AGENT_<REGISTRY>` accepts. */
+export declare const USER_AGENT_REGISTRY_KEYS: readonly string[];
+//# sourceMappingURL=userAgent.d.ts.map

package/types/lib/core/userAgent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userAgent.d.ts","sourceRoot":"","sources":["../../../lib/core/userAgent.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAwDH;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,QAAA,GAF9B,SAAO,SAAS,CAe5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,WAI/B;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,QAAQ,AAHlC,CACA,QAEkC,UAUpC;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,QAAA,GAFtC,SAAO,SAAS,CAU5B;AAED,iEAAiE;AACjE,eAAO,MAAM,wBAAwB,mBAEpC,CAAC"}

package/types/lib/ecosystems/cargoCache.d.ts

@@ -0,0 +1,75 @@
+export type CargoCacheMetadata = {
+    /**
+     * Crate description.
+     */
+    description?: string;
+    /**
+     * SPDX license expression.
+     */
+    license?: string;
+    /**
+     * Source repository URL.
+     */
+    repository?: string;
+    /**
+     * Homepage URL.
+     */
+    homepage?: string;
+    /**
+     * Minimum supported Rust version.
+     */
+    rustVersion?: string;
+    /**
+     * SHA-256 of the published `.crate` archive.
+     */
+    checksum?: string;
+    /**
+     * Feature table.
+     */
+    features?: Object;
+    /**
+     * Whether this version was yanked.
+     */
+    yanked?: boolean;
+    /**
+     * RFC 3339 publish timestamp.
+     */
+    publishTime?: string;
+    /**
+     * Newest non-yanked version in the index.
+     */
+    latestVersion?: string;
+    /**
+     * Which local files answered, for provenance.
+     */
+    sources: string[];
+};
+/**
+ * Reset memoized state. Tests that point `CARGO_HOME` at a fixture need the
+ * next call to look again rather than reuse the previous run's answer.
+ *
+ * @returns {void}
+ */
+export declare function resetCargoCacheState(): void;
+/**
+ * Whether the local registry should be consulted before crates.io.
+ *
+ * @returns {boolean} false when `CARGO_METADATA_SOURCE=registry` opts out.
+ */
+export declare function localCargoMetadataEnabled(): boolean;
+/**
+ * Resolve the Cargo registry root.
+ *
+ * @returns {string} Absolute path to `$CARGO_HOME/registry`.
+ */
+export declare function getCargoRegistryDir(): string;
+/**
+ * Read everything the local registry knows about one crate version.
+ *
+ * @param {string} name Crate name.
+ * @param {string} version Exact version.
+ * @returns {CargoCacheMetadata|undefined} Metadata, or undefined when neither
+ *   local source has this crate.
+ */
+export declare function readCargoCacheMetadata(name: string, version: string): CargoCacheMetadata | undefined;
+//# sourceMappingURL=cargoCache.d.ts.map

package/types/lib/ecosystems/cargoCache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cargoCache.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cargoCache.js"],"names":[],"mappings":"AAsCG,YAAkB,kBAAkB,GACpC;;;;IAAoB,WAAW,AAA/B,CACA,EADW,MAAM,CACjB;;;;IAAoB,OAAO,AAA3B,CACA,EADW,MAAM,CACjB;;;;IAAoB,UAAU,AAA9B,CACA,EADW,MAAM,CACjB;;;;IAAoB,QAAQ,AAA5B,CACA,EADW,MAAM,CACjB;;;;IAAoB,WAAW,AAA/B,CACA,EADW,MAAM,CACjB;;;;IAAoB,QAAQ,AAA5B,CACA,EADW,MAAM,CACjB;;;;IAAoB,QAAQ,AAA5B,CACA,EADW,MAAM,CACjB;;;;IAAqB,MAAM,AAA3B,CACA,EADW,OAAO,CAClB;;;;IAAoB,WAAW,AAA/B,CACA,EADW,MAAM,CACjB;;;;IAAoB,aAAa,AAAjC,CACA,EADW,MAAM,CACjB;;;;IAAqB,OAAO,EAAjB,MAAM,EAAE,CACrB;CAAA,CAAA;AAUD;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAFvB,IAAI,CAKhB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAF5B,OAAO,CAOnB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,CAOlB;AAkCD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EALhC,MAKgC,EAAE,OAAO,EAJzC,MAIyC,GAHvC,kBAAkB,GAAC,SAAS,CA0BxC"}

package/types/lib/ecosystems/caxa.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"caxa.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/caxa.js"],"names":[],"mappings":"AAMA;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAHlC,MAGkC,GAFhC,OAAO,CAAC,MAAM,CAAC,CAkE3B"}
+{"version":3,"file":"caxa.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/caxa.js"],"names":[],"mappings":"AAMA;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAHlC,MAGkC,GAFhC,OAAO,CAAC,MAAM,CAAC,CA0E3B"}

package/types/lib/ecosystems/cppEvidence.d.ts

@@ -17,9 +17,9 @@ export declare function getCppModules(src: string, options: object, osPkgsList:
         "bom-ref": string;
         group?: undefined;
     } | {
+        purl?: undefined;
         description?: undefined;
         license?: undefined;
-        purl?: undefined;
         "bom-ref"?: undefined;
         group: any;
         name: any;

package/types/lib/ecosystems/cppEvidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cppEvidence.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cppEvidence.js"],"names":[],"mappings":"AA4BA;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EALtB,MAKsB,EAAE,OAAO,EAJ/B,MAI+B,EAAE,UAAU,EAH3C,KAG2C,EAAE,QAAQ,EAFrD,KAEqD;;;;;;;;;;;;;;;;;;;;;;;;;EA4Q/D"}
+{"version":3,"file":"cppEvidence.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cppEvidence.js"],"names":[],"mappings":"AAgCA;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EALtB,MAKsB,EAAE,OAAO,EAJ/B,MAI+B,EAAE,UAAU,EAH3C,KAG2C,EAAE,QAAQ,EAFrD,KAEqD;;;;;;;;;;;;;;;;;;;;;;;;;EA8S/D"}

package/types/lib/ecosystems/ecosystems.d.ts

@@ -236,9 +236,23 @@ export declare function getGoPkgVCSUrl(group: string, name: string): Promise<any
 /**
  * Method to retrieve metadata for rust packages by querying crates
  *
+ * The local Cargo registry is consulted first, because crates.io's crawler
+ * policy allows one request per second and a populated `~/.cargo` already
+ * holds the license, description, repository, checksum and yanked flag for
+ * every crate the build compiled.
+ *
+ * What it does not hold is publisher identity, so a caller that needs the
+ * publisher-drift and release-cadence signals — the predictive audit does —
+ * passes `preferLocalCache: false` and takes the slower registry path.
+ *
  * @param {Array} pkgList Package list
+ * @param {Object} [options] Options
+ * @param {boolean} [options.preferLocalCache=true] Answer from the local Cargo
+ *   registry where it can, and query crates.io only for the rest.
  */
-export declare function getCratesMetadata(pkgList: any[]): Promise<any[]>;
+export declare function getCratesMetadata(pkgList: any[], options?: {
+    preferLocalCache?: boolean;
+}): Promise<any[]>;
 /**
  * Method to retrieve metadata for dart packages by querying pub.dev
  *

package/types/lib/ecosystems/ecosystems.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ecosystems.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/ecosystems.js"],"names":[],"mappings":"AAyFA,eAAO,IAAI,cAAc,IAAK,CAAC;AAY/B;;;;GAIG;AACH,wBAAgB,mBAAmB,SAElC;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAH1C,MAAM,EAGoC,GAFxC,OAAO,CAAC,MAAM,EAAE,CAAC,CAmC7B;AAyBD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,OAAO,OAAA,EAAE,WAAW,KAAA,kBAiGxD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAL/B,MAK+B,EAAE,IAAI,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,MAAM,GAAC,IAAI,CAmIvB;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,OAAA,EACP,YAAY,GAPH,MAOQ,EACjB,KAAK,UAAQ,SA+Ed;AA4ND;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,UAGnE;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,GAF/D,MAAM,GAAC,SAAS,CA6B3B;AAgBD;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,GAFzD,OAAO,QAAQ,CAgB1B;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAF/C,MAAM,QAEyC,qBAUzD;AAED;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CAAC,EACpD,SAAS,EACT,KAAK,EACL,IAAI,EACJ,OAAO,GACR,QAAA,GAPW,OAAO,QAAQ,CAc1B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,OAAA,EAAE,iBAAiB,EAF7D,GAE6D,OAwBvE;AA6BD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,OAAA,EAAE,aAAa,SAAA,kBAyPzD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAJjC,MAIiC,EAAE,WAAW,GAH9C,MAG0D;;;;;;;;IAiIpE;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAHzC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAGH,GAFvC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAJtC,MAIsC,EAAE,UAAU,EAHlD,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAGD,GAFhD,IAAI,CAuBhB;AAiBD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,YAAY,EAH5C,MAG4C,GAF3C,SAAO,SAAS,CAqB3B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,QAAA,GAF7B,QAAQ,CAQnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,QAAA,EAAE,YAAY,EAHzC,MAGyC,GAFxC,SAAO,SAAS,CAc3B;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAJxC,KAAK,CAAC,MAAM,GAAC,SAAS,CAIkB,GAFtC,OAAO,CAAC,IAAI,CAAC,CAqCzB;AAED;;GAEG;AACH,wBAAgB,wBAAwB,SAEvC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,OAAO,EALjC,MAKiC,EAAE,YAAY,AAJvD,CACA,EADQ,MAI+C,GAH7C,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CAkExE;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAJxC,KAAK,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,CAIG,GAFtC,OAAO,CAAC,IAAI,CAAC,CAwCzB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,SAEjC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,YAAY,EAFvC,MAEuC,gBA2CjD;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,KAAK,QAAA,EAAE,IAAI,QAAA,gBAsB/C;AA2CD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,OAAA,kBA4G9C;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,OAAO,OAAA,kBAiE5C;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAHtC,MAGsC,GAFpC,MAAM,GAAC,SAAS,CA6B5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EANpC,MAMoC,EAAE,OAAO,EAL7C,MAK6C,EAAE,YAAY,GAJ3D,MAIgE,kBAmY1E;AA6MD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,OAAA,EAAE,YAAY,QAAY;;;GA4JvE"}
+{"version":3,"file":"ecosystems.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/ecosystems.js"],"names":[],"mappings":"AAmGA,eAAO,IAAI,cAAc,IAAK,CAAC;AAY/B;;;;GAIG;AACH,wBAAgB,mBAAmB,SAElC;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAH1C,MAAM,EAGoC,GAFxC,OAAO,CAAC,MAAM,EAAE,CAAC,CAmC7B;AAyBD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,OAAO,OAAA,EAAE,WAAW,KAAA,kBAiGxD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAL/B,MAK+B,EAAE,IAAI,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,MAAM,GAAC,IAAI,CAmIvB;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,OAAA,EACP,YAAY,GAPH,MAOQ,EACjB,KAAK,UAAQ,SA+Ed;AA4ND;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,UAGnE;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,GAF/D,MAAM,GAAC,SAAS,CA6B3B;AAgBD;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,GAFzD,OAAO,QAAQ,CAkB1B;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAF/C,MAAM,QAEyC,qBAUzD;AAED;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CAAC,EACpD,SAAS,EACT,KAAK,EACL,IAAI,EACJ,OAAO,GACR,QAAA,GAPW,OAAO,QAAQ,CAc1B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,OAAA,EAAE,iBAAiB,EAF7D,GAE6D,OAwBvE;AA6BD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,OAAA,EAAE,aAAa,SAAA,kBA8PzD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAJjC,MAIiC,EAAE,WAAW,GAH9C,MAG0D;;;;;;;;IAiIpE;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAHzC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAGH,GAFvC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAJtC,MAIsC,EAAE,UAAU,EAHlD,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAGD,GAFhD,IAAI,CAuBhB;AAiBD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,YAAY,EAH5C,MAG4C,GAF3C,SAAO,SAAS,CAqB3B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,QAAA,GAF7B,QAAQ,CAQnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,QAAA,EAAE,YAAY,EAHzC,MAGyC,GAFxC,SAAO,SAAS,CAc3B;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAJxC,KAAK,CAAC,MAAM,GAAC,SAAS,CAIkB,GAFtC,OAAO,CAAC,IAAI,CAAC,CAqCzB;AAED;;GAEG;AACH,wBAAgB,wBAAwB,SAEvC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,OAAO,EALjC,MAKiC,EAAE,YAAY,AAJvD,CACA,EADQ,MAI+C,GAH7C,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CAkExE;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAJxC,KAAK,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,CAIG,GAFtC,OAAO,CAAC,IAAI,CAAC,CAwCzB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,SAEjC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,YAAY,EAFvC,MAEuC,gBA2CjD;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,KAAK,QAAA,EAAE,IAAI,QAAA,gBAsB/C;AA2CD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,OAAA,EAAE,OAAO,AAJrD,CAGF,EAFE;IAA0B,gBAAgB,AAA1C,CAEF,EAFU,OAAO,CAEjB;CAC4D,kBAiJ5D;AAkFD;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,OAAO,OAAA,kBAiE5C;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAHtC,MAGsC,GAFpC,MAAM,GAAC,SAAS,CA6B5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EANpC,MAMoC,EAAE,OAAO,EAL7C,MAK6C,EAAE,YAAY,GAJ3D,MAIgE,kBAyY1E;AAqMD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,OAAA,EAAE,YAAY,QAAY;;;GA2KvE"}

package/types/lib/ecosystems/gradleutils.d.ts

@@ -58,6 +58,39 @@ export declare function parseGradleProperties(rawOutput: string, gradleModuleNam
  * @returns {string} The combined output for all subprojects of the Gradle properties task
  */
 export declare function executeParallelGradleProperties(dir: string, allProjectsStr: array, extraArgs?: array): string;
+/**
+ * Forget the causes diagnosed so far, so a process that generates more than
+ * one BOM diagnoses each run on its own.
+ *
+ * @returns {void}
+ */
+export declare function resetGradleFailureCauses(): void;
+/**
+ * Whether a gradle invocation has already failed outright this run, so a
+ * caller can skip reporting a consequence of that failure as its own
+ * degradation.
+ *
+ * @returns {boolean} True once an invocation failure has been recorded.
+ */
+export declare function hasGradleInvocationFailure(): boolean;
+/**
+ * Record why a gradle invocation failed. Every failure also records the
+ * `jvm.gradle.invocation-failed` degradation so the reflection can rank the
+ * repair; version-incompatibility causes additionally record a
+ * `tool.mismatch` event naming the versions, which is the fact the report
+ * cannot derive from an empty BOM alone. Diagnosis events are recorded once
+ * per cause per run; the degradation dedupes in the reflection by id.
+ *
+ * @param {Object} result The spawnSync result of the failed invocation.
+ * @param {Object} context Call-site facts.
+ * @param {string} [context.command] The redacted command that was attempted.
+ * @param {string} [context.gradleVersion] The gradle version in play, when the caller knows it.
+ * @returns {void}
+ */
+export declare function recordGradleInvocationFailure(result: Object, context?: {
+    command?: string;
+    gradleVersion?: string;
+}): void;
 /**
  * Method to resolve dependencies from a gradle output
  *
@@ -136,4 +169,24 @@ export declare function getMillCommand(srcPath: string): string;
  * @param {string} rootPath Root directory to look for maven wrapper
  */
 export declare function getMavenCommand(srcPath: string, rootPath: string): string;
+/**
+ * Parse a Gradle version catalog (`gradle/libs.versions.toml`).
+ *
+ * A catalog declares coordinates the build scripts then reference by alias.
+ * It is a declaration, not a resolution: entries may go unused, and their
+ * versions may be references into the `[versions]` table. Because of that,
+ * catalog components are emitted only as a fallback when Gradle itself
+ * produced no dependency information, and every component carries a
+ * `cdx:gradle:catalog=true` property so consumers can tell declared catalog
+ * entries from a resolved graph.
+ *
+ * Only libraries whose version resolves to a literal (inline or via
+ * `version.ref`) are emitted; rich or unresolved versions would produce purls
+ * that identify no artifact. Plugins are skipped because they are build-time
+ * only.
+ *
+ * @param {string} catalogFile Path to `libs.versions.toml`
+ * @returns {Object[]} Package records for resolvable library entries
+ */
+export declare function parseGradleVersionCatalog(catalogFile: string): Object[];
 //# sourceMappingURL=gradleutils.d.ts.map

package/types/lib/ecosystems/gradleutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gradleutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/gradleutils.js"],"names":[],"mappings":"AAmBA;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,EAAE,QAAQ,EAFvC,MAAM,GAAC,IAEgC,UAwEjD;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,eAAe,EARN,MAAM,EAQA,EACf,iBAAiB,EARR,MAAM,EAQE,EACjB,yBAAyB,EARhB,MAAM,EAQU,EACzB,mBAAmB,EARV,GAQU,GANR,MAAM,EAAE,CA2CpB;AAcD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAJ1C,MAI0C,EAAE,aAAa,EAHzD,MAAM,EAGmD,GAFvD,GAAG,CAqCf;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAFlC,MAEkC;;;EAsD5C;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAHpC,MAGoC,EAAE,gBAAgB,GAFtD,MAE6D;;;;;;;;EAoDvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAPM,MAON,EACH,cAAc,EAPL,KAOK,EACd,SAAS,GAPA,KAOK,GALH,MAAM,CAoFlB;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,SAAS,EANA,MAMA,EACT,eAAe,GANN,MAMe,EACxB,aAAa,GANJ,GAMgB,EACzB,cAAc,GANL,MAMU;;;;;;;;;GAgPpB;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,QAAQ,EAHpD,MAGoD,GAFlD,MAAM,CAiDlB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,gBAAgB,EAHjD,MAGiD,GAF/C,MAAM,CAkBlB;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAH5C,MAG4C,GAF1C,MAAM,CAuBlB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAHtC,MAGsC,GAFpC,MAAM,CA8ClB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAPD,MAOC,EACV,SAAS,EAPA,MAOA,EACT,QAAQ,GAPC,OAOM,EAAE,qCAAqC;AACtD,gBAAgB,GAPP,OAOe,GANb,OAAO,CAAC,MAAM,CAAC,CAgC3B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAF3B,MAE2B,UAarC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,MAG4B,EAAE,QAAQ,EAFtC,MAEsC,UAwIhD"}
+{"version":3,"file":"gradleutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/gradleutils.js"],"names":[],"mappings":"AAwCA;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,EAAE,QAAQ,EAFvC,MAAM,GAAC,IAEgC,UA2FjD;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,eAAe,EARN,MAAM,EAQA,EACf,iBAAiB,EARR,MAAM,EAQE,EACjB,yBAAyB,EARhB,MAAM,EAQU,EACzB,mBAAmB,EARV,GAQU,GANR,MAAM,EAAE,CA2CpB;AAcD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAJ1C,MAI0C,EAAE,aAAa,EAHzD,MAAM,EAGmD,GAFvD,GAAG,CAqCf;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAFlC,MAEkC;;;EAsD5C;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAHpC,MAGoC,EAAE,gBAAgB,GAFtD,MAE6D;;;;;;;;EAoDvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAPM,MAON,EACH,cAAc,EAPL,KAOK,EACd,SAAS,GAPA,KAOK,GALH,MAAM,CAuFlB;AAiBD;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAF3B,IAAI,CAKhB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAF7B,OAAO,CAInB;AAiGD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EANzC,MAMyC,EAAE,OAAO,GAJ1D;IAAyB,OAAO,AAAhC,CACA,EADQ,MAAM,CACd;IAAyB,aAAa,AAAtC,CACA,EADQ,MAAM,CACd;CAE+D,GAFrD,IAAI,CA+HhB;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,SAAS,EANA,MAMA,EACT,eAAe,GANN,MAMe,EACxB,aAAa,GANJ,GAMgB,EACzB,cAAc,GANL,MAMU;;;;;;;;;GAkPpB;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,QAAQ,EAHpD,MAGoD,GAFlD,MAAM,CAkDlB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,gBAAgB,EAHjD,MAGiD,GAF/C,MAAM,CAkBlB;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAH5C,MAG4C,GAF1C,MAAM,CAuBlB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAHtC,MAGsC,GAFpC,MAAM,CA8ClB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAPD,MAOC,EACV,SAAS,EAPA,MAOA,EACT,QAAQ,GAPC,OAOM,EAAE,qCAAqC;AACtD,gBAAgB,GAPP,OAOe,GANb,OAAO,CAAC,MAAM,CAAC,CAgC3B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAF3B,MAE2B,UAcrC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,MAG4B,EAAE,QAAQ,EAFtC,MAEsC,UA6JhD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAH1C,MAG0C,GAFxC,MAAM,EAAE,CAoEpB"}

package/types/lib/ecosystems/kosi.d.ts

@@ -0,0 +1,73 @@
+export declare function isKosiKotlinLanguage(language: any): boolean;
+/**
+ * True when kosi is disabled by CDXGEN_KOSI_DISABLE (1/all/true) or --no-kosi.
+ * The check happens before any binary resolution so a disabled run never
+ * even looks for the plugin.
+ */
+export declare function kosiDisabled(): any;
+/**
+ * Orchestrates the kosi runs over src and returns the parsed reports: one
+ * `all` pass (every slice kind, dependency tier) and one `reachable` pass
+ * (call-graph reachability from the roots). The analysis is read-only and
+ * offline: kosi never executes the project's build. A classpath.txt beside
+ * the sources (the documented build-tool report) is passed through when
+ * present.
+ *
+ * @param {string} src Directory to analyze.
+ * @param {Object} options Configuration options.
+ * @returns {Object|undefined} { report, reachableReport } or undefined.
+ */
+export declare function analyzeKosiProject(src: string, options?: Object): Object | undefined;
+/**
+ * Merges the reachable pass's evidence into the all pass's maps, mutating
+ * the first argument.
+ *
+ * The reachable pass's slices are the all pass's INTERSECTED with call-graph
+ * reachability from the roots, so every key it produces is a key the all pass
+ * already has, and the unions below cannot add one. That made the second full
+ * `--backend resolved --deps` analysis — the most expensive thing this arm
+ * runs, and it runs it twice — contribute exactly nothing: the one fact it
+ * computes, reachability, was discarded at the merge (the P23 review's R144).
+ * It is recorded now, on the components whose evidence survived the
+ * intersection, which is the signal an SBOM consumer prioritises with. kosi's
+ * own schema deliberately stopped carrying `reachableFromRoots` per slice in
+ * P22 because there it was a mode-level fact wearing a per-slice field's
+ * clothes; here it is neither, it is the measured difference between two runs.
+ */
+export declare function mergeKosiEvidence(all: any, reachable: any): any;
+/**
+ * Services evidence: kosi's outbound services[] rows are already
+ * CycloneDX-shaped.
+ */
+export declare function collectKosiServices(kosiReport?: {}, servicesMap?: {}): {};
+/**
+ * INBOUND endpoints: kosi's apiEndpoints[] rows are the routes the analysed
+ * application itself serves, which `services[]` (kosi's OUTBOUND calls)
+ * does not carry. Without this the whole inbound surface — the path
+ * template, the framework that declared it, and above all whether anything
+ * authenticates it — stopped at the kosi report and never reached the
+ * SaaSBOM.
+ *
+ * One service per endpoint, named the way detectServicesFromOpenAPI names
+ * its own (`service-<path>-<method>`), so an OpenAPI spec and a kosi run
+ * over the same route converge on one entry instead of two.
+ *
+ * `authenticated` is left UNDEFINED when the endpoint declares no
+ * authentication: kosi's empty list means "nothing was declared here",
+ * which is not the same claim as "this route is unauthenticated", and
+ * cdxgen's own detectors use undefined for exactly that unknown.
+ *
+ * @param {Object} kosiReport The parsed JSON generated by kosi.
+ * @param {Object} servicesMap Map populated with detected service definitions
+ * @returns {Object} The mutated services map
+ */
+export declare function collectKosiApiEndpoints(kosiReport?: Object, servicesMap?: Object): Object;
+export declare function collectKosiEvidence(kosiReport?: {}, components?: any[]): {
+    componentPropertiesMap: {};
+    cryptoComponents: any[];
+    cryptoGeneratePurls: {};
+    dataFlowFrames: {};
+    metadataProperties: any[];
+    purlLocationMap: {};
+};
+//# sourceMappingURL=kosi.d.ts.map

package/types/lib/ecosystems/kosi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kosi.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/kosi.js"],"names":[],"mappings":"AA+BA,wBAAgB,oBAAoB,CAAC,QAAQ,KAAA,WAE5C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,QAQ3B;AA6DD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,GAHpC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAkD5B;AA0BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,KAAA,EAAE,SAAS,KAAA,OA4B/C;AAusBD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,KAAK,EAAE,WAAW,KAAK,MAsEpE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,GAJvC,MAI4C,EAAE,WAAW,GAHzD,MAG8D,GAF5D,MAAM,CAoFlB;AAiCD,wBAAgB,mBAAmB,CAAC,UAAU,KAAK,EAAE,UAAU,QAAK;;;;;;;EA2DnE"}

package/types/lib/ecosystems/parsers-crystal.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Crystal parser for `shard.yml` and `shard.lock`.
+ *
+ * Shards resolves dependencies declared in `shard.yml` and records the
+ * resolved set in `shard.lock`, which pins each dependency's version and
+ * source repository. Both files are YAML and are read with the standard
+ * parser.
+ *
+ * No `crystal` purl type is registered, so shards are identified as generic
+ * packages carrying a `cdx:purl:proposedType=crystal` property, following
+ * the convention used for nix and zig. This keeps the BOM valid today and
+ * allows a mechanical migration if a type is registered upstream.
+ */
+/**
+ * Parse a Crystal project from `shard.yml` and optional `shard.lock`.
+ *
+ * @param {string} shardYmlFile Path to `shard.yml`
+ * @param {string} [shardLockFile] Path to `shard.lock`, if present
+ * @returns {{ pkgList: object[], dependencies: object[], parentComponent: object, rootInputs?: string[] }}
+ */
+export declare function parseShardsProject(shardYmlFile: string, shardLockFile?: string): {
+    pkgList: object[];
+    dependencies: object[];
+    parentComponent: object;
+    rootInputs?: string[];
+};
+//# sourceMappingURL=parsers-crystal.d.ts.map

package/types/lib/ecosystems/parsers-crystal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers-crystal.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-crystal.js"],"names":[],"mappings":"AAMA;;;;;;;;;;;;GAYG;AAEH;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAJpC,MAIoC,EAAE,aAAa,AAH3D,CACA,EADQ,MAGmD,GAFjD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CA6FzG"}

package/types/lib/ecosystems/parsers-dotnet.d.ts

@@ -1,3 +1,22 @@
+/**
+ * Apply a version to a NuGet component so that the `version` field and the purl
+ * always agree.
+ *
+ * A .NET manifest can state a version that is not a version: an MSBuild property
+ * such as `$(JsonVersion)`, a range such as `[3.13.3,4.0)`, a wildcard such as
+ * `2.0.*`, or nothing at all. Such a declaration cannot go into a purl, so a
+ * component that kept it in `version` while its purl carried none described one
+ * package two ways. A scanner range matching on the versionless purl then reports
+ * every advisory published against the package name.
+ *
+ * The declaration is not lost: callers record it as `cdx:nuget:declared_version_range`.
+ *
+ * @param {Object} pkg Component to update in place. `name` must already be set.
+ * @param {String} [version] Version as stated or resolved, concrete or not
+ *
+ * @returns {Object} The same component
+ */
+export declare function applyNugetVersion(pkg: Object, version?: string): Object;
 /**
  * Method to parse .nupkg files
  *