@cdxgen/cdxgen 13.0.1 → 13.2.0

package/types/lib/ecosystems/parsers-rust.d.ts

@@ -44,6 +44,205 @@ export declare function parseCargoManifestDependencyData(cargoTomlFile: string,
  * @returns {Object[]} Array of dependency relationship objects with ref and dependsOn fields
  */
 export declare function parseCargoDependencyData(cargoLockData: string): Object[];
+/**
+ * Normalize a cargo dependency kind to the vocabulary used by the cargo
+ * manifest parsers.
+ *
+ * `cargo metadata` encodes a normal dependency as `null` rather than a string,
+ * so a truthiness test would silently leave runtime dependencies unlabelled.
+ *
+ * @param {string|null|undefined} kind Dependency kind as reported by cargo
+ * @returns {string} One of `runtime`, `build` or `dev`
+ */
+export declare function normalizeCargoDepKind(kind: string | null | undefined): string;
+/**
+ * Parse a cargo package id into its name and version.
+ *
+ * cargo 1.77 and later emit the package id spec form
+ * (`registry+https://...#name@1.0.0`, or `path+file:///p/foo#1.0.0` where the
+ * name is carried by the path); earlier releases emit `name 1.0.0 (source)`.
+ *
+ * @param {string} packageId cargo package id
+ * @returns {{name: string, version: string}|undefined} Parsed identity
+ */
+export declare function parseCargoPackageId(packageId: string): {
+    name: string;
+    version: string;
+} | undefined;
+/**
+ * Build the `name@version` key used to correlate cargo components across the
+ * lock file, the manifests and `cargo metadata`.
+ *
+ * @param {{name: string, version: string}} pkg Package identity
+ * @returns {string} Correlation key
+ */
+export declare function cargoComponentKey(pkg: {
+    name: string;
+    version: string;
+}): string;
+/**
+ * Convert a cargo purl or bom-ref into a `name@version` correlation key.
+ *
+ * @param {string} purl cargo purl
+ * @returns {string} Correlation key
+ */
+export declare function cargoPurlToComponentKey(purl: string): string;
+/**
+ * Collect the dependency kinds and platform gates declared by a single
+ * `Cargo.toml`, keyed by the crate name that cargo resolves the entry to.
+ *
+ * Manifests declare version requirements rather than resolved versions, so the
+ * returned map is keyed by name alone and is meant to label the edges leaving a
+ * workspace member in the lock file graph.
+ *
+ * @param {string} cargoTomlFile Cargo.toml path
+ * @param {object} [context] Workspace resolution context
+ * @returns {Map<string, {kinds: Set<string>, targets: Set<string>, optional: boolean}>} Declared edges
+ */
+export declare function parseCargoManifestDependencyKinds(cargoTomlFile: string, context?: object): Map<string, {
+    kinds: Set<string>;
+    targets: Set<string>;
+    optional: boolean;
+}>;
+/**
+ * Roll per-edge cargo dependency kinds up to an effective kind per component.
+ *
+ * A crate is only dev-only when *every* path reaching it from a workspace root
+ * traverses a dev edge, so a crate shared between a dev dependency and a normal
+ * one keeps its runtime kind. Cargo never builds the dev dependencies of a
+ * dependency, so dev edges are followed from the workspace roots alone.
+ *
+ * @param {object} graph Dependency graph
+ * @param {string[]} graph.rootKeys Workspace member component keys
+ * @param {Map<string, Array<{to: string, kind: string, target?: string}>>} graph.edges Adjacency map
+ * @returns {Map<string, {kind: string, kinds: Set<string>, targets: Set<string>, targetGated: boolean}>} Effective kinds
+ */
+export declare function rollupCargoDependencyKinds({ rootKeys, edges }: {
+    rootKeys: string[];
+    edges: Map<string, Array<{
+        to: string;
+        kind: string;
+        target?: string;
+    }>>;
+}): Map<string, {
+    kind: string;
+    kinds: Set<string>;
+    targets: Set<string>;
+    targetGated: boolean;
+}>;
+/**
+ * Build a cargo dependency graph from the `resolve` section of
+ * `cargo metadata --format-version 1`.
+ *
+ * @param {object} metadata Parsed `cargo metadata` output
+ * @returns {{rootKeys: string[], edges: Map<string, Array<object>>, packageInfo: Map<string, object>, resolvedKeys: Set<string>}} Graph
+ */
+export declare function parseCargoMetadataResolve(metadata: object): {
+    rootKeys: string[];
+    edges: Map<string, Array<object>>;
+    packageInfo: Map<string, object>;
+    resolvedKeys: Set<string>;
+};
+/**
+ * Build a cargo dependency graph from the lock file relationships, labelling
+ * the edges that leave a workspace member with the kinds declared by its
+ * manifest.
+ *
+ * The lock file is the union of every dependency kind and every target triple,
+ * so only the manifests can distinguish them. The resulting labels are exact at
+ * depth one and inherited below it, which is enough to identify dev-only and
+ * build-only subtrees without invoking cargo.
+ *
+ * @param {object[]} lockDependencies Relationships from {@link parseCargoDependencyData}
+ * @param {Map<string, Map<string, object>>} declaredEdgesByRoot Declared edges keyed by root component key
+ * @returns {{rootKeys: string[], edges: Map<string, Array<object>>}} Graph
+ */
+export declare function buildCargoLockDependencyGraph(lockDependencies: object[], declaredEdgesByRoot: Map<string, Map<string, object>>): {
+    rootKeys: string[];
+    edges: Map<string, Array<object>>;
+};
+/**
+ * Annotate cargo components with their effective dependency kind, platform
+ * gates and scope.
+ *
+ * Components reachable only through dev edges are scoped `excluded` so
+ * `--required-only` drops them. Build dependencies stay required because a
+ * build script is part of producing the artifact; the kind is recorded as a
+ * property so a consumer can filter on it.
+ *
+ * @param {object[]} pkgList Components to annotate
+ * @param {Map<string, object>} rollup Effective kinds from {@link rollupCargoDependencyKinds}
+ * @param {Map<string, object>} [packageInfo] Extra per-package facts
+ * @param {object} [options] Annotation options
+ * @param {boolean} [options.resolveIsComplete] The rollup covers every workspace in the scan, so a
+ *        component missing from it is an optional dependency no feature activates
+ * @returns {object[]} The annotated components
+ */
+export declare function applyCargoDependencyKindMetadata(pkgList: object[], rollup: Map<string, object>, packageInfo?: Map<string, object>, options?: {
+    resolveIsComplete?: boolean;
+}): object[];
+/**
+ * Recover the upstream version of a native library from the version of the
+ * crate that ships it.
+ *
+ * The `-sys` and `-src` crates carry the upstream version as semver build
+ * metadata, because the crate's own version tracks the binding's releases
+ * rather than the library's: `openssl-src@300.6.1+3.6.3` ships OpenSSL 3.6.3
+ * and `curl-sys@0.4.74+curl-8.9.0` ships curl 8.9.0.
+ *
+ * @param {string} crateVersion Version of the providing crate
+ * @returns {string} Upstream version, or an empty string when it is not encoded
+ */
+export declare function cargoUpstreamVersionFromCrateVersion(crateVersion: string): string;
+/**
+ * Recover the version of a vendored native library from the C source the crate
+ * ships.
+ *
+ * A `-sys` crate that bundles its library carries the upstream version in a
+ * header define - `ZLIB_VERSION`, `SQLITE_VERSION`, `OPENSSL_VERSION_TEXT` -
+ * which is the only statement of the version for the crates that do not encode
+ * it in their own version. A crate often ships more than one variant, so a
+ * candidate sitting in a directory named after a feature this build did not
+ * enable is dropped: `libz-sys` ships both `src/zlib` and `src/zlib-ng`, and
+ * only one of them is compiled.
+ *
+ * @param {object} args Resolution inputs
+ * @param {string} args.crateDir Directory holding the crate's unpacked source
+ * @param {string} args.links The crate's `links` value
+ * @param {string} args.libraryName Normalized library name
+ * @param {string[]} [args.declaredFeatures] Features the crate declares
+ * @param {Set<string>} [args.resolvedFeatures] Features the resolver enabled
+ * @returns {{version: string, evidence: string, candidates: string[]}} Version and where it came from
+ */
+export declare function resolveCargoVendoredLibraryVersion({ crateDir, links, libraryName, declaredFeatures, resolvedFeatures, }: {
+    crateDir: string;
+    links: string;
+    libraryName: string;
+    declaredFeatures?: string[];
+    resolvedFeatures?: Set<string>;
+}): {
+    version: string;
+    evidence: string;
+    candidates: string[];
+};
+/**
+ * Build components for the native libraries that `-sys` crates link.
+ *
+ * A crate declaring `links = "openssl"` puts a C library into the artifact that
+ * the cargo dependency graph cannot describe: its advisories and its license
+ * obligations belong to OpenSSL, not to the Rust binding. When the resolver
+ * enabled a vendoring feature, that library is compiled into the binary, which
+ * makes it a component of the delivered assembly.
+ *
+ * @param {Map<string, object>} packageInfo Per-package facts from {@link parseCargoMetadataResolve}
+ * @param {Map<string, Array<object>>} edges Dependency edges keyed by component key
+ * @param {Map<string, object>} rollup Effective kinds, used to skip crates no build reaches
+ * @returns {{components: object[], dependencies: object[]}} Native library components and their edges
+ */
+export declare function buildCargoNativeLibraryComponents(packageInfo: Map<string, object>, edges: Map<string, Array<object>>, rollup: Map<string, object>): {
+    components: object[];
+    dependencies: object[];
+};
 /**
  * Parses tab-separated cargo-auditable binary metadata output and returns a list
  * of Rust package components. Optionally fetches crates.io metadata when

package/types/lib/ecosystems/parsers-rust.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsers-rust.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-rust.js"],"names":[],"mappings":"AA6mBA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,QAAA,EACb,MAAM,GAPG,OAOK,EACd,WAAW,GAPF,MAOO,EAChB,OAAO,KAAK,SAuQb;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,aAAa,QAAA,EACb,MAAM,GAPG,OAOK,EACd,WAAW,GAPF,MAOO,SA8FjB;AAgCD;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,aAAa,EAJnD,MAImD,EAAE,OAAO,AAHpE,CACA,EADQ,MAGiE,GAF/D,MAAM,EAAE,CAsIpB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,aAAa,EAH3C,MAG2C,GAFzC,MAAM,EAAE,CAgEpB;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAAC,SAAS,EAH5C,MAG4C,GAF1C,OAAO,CAAC,MAAM,EAAE,CAAC,CA4B7B"}
+{"version":3,"file":"parsers-rust.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-rust.js"],"names":[],"mappings":"AAisBA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,QAAA,EACb,MAAM,GAPG,OAOK,EACd,WAAW,GAPF,MAOO,EAChB,OAAO,KAAK,SAuQb;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,aAAa,QAAA,EACb,MAAM,GAPG,OAOK,EACd,WAAW,GAPF,MAOO,SAyGjB;AAgCD;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,aAAa,EAJnD,MAImD,EAAE,OAAO,AAHpE,CACA,EADQ,MAGiE,GAF/D,MAAM,EAAE,CAsIpB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,aAAa,EAH3C,MAG2C,GAFzC,MAAM,EAAE,CAwDpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAH/B,MAAM,GAAC,IAAI,GAAC,SAGmB,GAF7B,MAAM,CAOlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAHlC,MAGkC,GAFhC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CA8BrD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAH1B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAGJ,GAFxB,MAAM,CAOlB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAHjC,MAGiC,GAF/B,MAAM,CAUlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iCAAiC,CAAC,aAAa,EAJpD,MAIoD,EAAE,OAAO,AAHrE,CACA,EADQ,MAGkE,GAFhE,GAAG,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAC,CAAC,CA+DtF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAJ3D;IAAwB,QAAQ,EAAxB,MAAM,EAAE,CAChB;IAA+E,KAAK,EAA5E,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC,CACvE;CAE2D,GAFjD,GAAG,CAAC,MAAM,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAC,CAAC,CAsEvG;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAHvC,MAGuC,GAFrC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAC,CAoGhI;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAC3C,gBAAgB,EALP,MAAM,EAKC,EAChB,mBAAmB,EALV,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAKrB,GAJR;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;CAAC,CAmCnE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EATE,MAAM,EASR,EACP,MAAM,EATG,GAAG,CAAC,MAAM,EAAE,MAAM,CASrB,EACN,WAAW,AATV,CACA,EADQ,GAAG,CAAC,MAAM,EAAE,MAAM,CASJ,EACvB,OAAO,AATN,CAGA,EAFA;IAA0B,iBAAiB,AAA3C,CAEA,EAFQ,OAAO,CAEf;CAMW,GAND,MAAM,EAAE,CAsFpB;AAkCD;;;;;;;;;;;GAWG;AACH,wBAAgB,oCAAoC,CAAC,YAAY,EAHtD,MAGsD,GAFpD,MAAM,CAalB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kCAAkC,CAAC,EACjD,QAAQ,EACR,KAAK,EACL,WAAW,EACX,gBAAqB,EACrB,gBAA4B,GAC7B,EAbE;IAAqB,QAAQ,EAArB,MAAM,CACd;IAAqB,KAAK,EAAlB,MAAM,CACd;IAAqB,WAAW,EAAxB,MAAM,CACd;IAAwB,gBAAgB,AAAxC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,gBAAgB,AAA3C,CACA,EADQ,GAAG,CAAC,MAAM,CAAC,CACnB;CAQF,GARY;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAC,CA2FrE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iCAAiC,CAAC,WAAW,EALlD,GAAG,CAAC,MAAM,EAAE,MAAM,CAKgC,EAAE,KAAK,EAJzD,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAIgC,EAAE,MAAM,EAHjE,GAAG,CAAC,MAAM,EAAE,MAAM,CAG+C,GAF/D;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAwJ1D;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAAC,SAAS,EAH5C,MAG4C,GAF1C,OAAO,CAAC,MAAM,EAAE,CAAC,CA4B7B"}

package/types/lib/ecosystems/parsers-spack.d.ts

@@ -0,0 +1,33 @@
+/**
+ * HPC Spack parser for `spack.lock`.
+ *
+ * Spack writes a JSON lock file when an environment is concretised:
+ *
+ *   - `roots` — the specs the user asked for, each as `{hash, spec}`.
+ *   - `concrete_specs` — every node of the resolved DAG, keyed by its DAG
+ *     hash. A node carries its `name`, `version`, `namespace`, the compiler
+ *     and architecture it was built for, and a `dependencies` list whose
+ *     entries reference other nodes by hash.
+ *
+ * The DAG hash is the identity Spack itself uses: two builds of the same
+ * version with different variants or compilers are different hashes, so the
+ * graph is keyed by hash throughout and the hash is carried into each
+ * component's bom-ref.
+ *
+ * No `spack` purl type is registered, so nodes are identified as generic
+ * packages carrying a `cdx:purl:proposedType=spack` property, following the
+ * convention used for nix and zig. The DAG hash is kept as a property because
+ * it identifies the concrete build, not the artifact bytes.
+ */
+/**
+ * Parse a `spack.lock` file.
+ *
+ * @param {string} spackLockFile Path to `spack.lock`
+ * @returns {{ pkgList: object[], dependencies: object[], rootInputs: string[] }}
+ */
+export declare function parseSpackLock(spackLockFile: string): {
+    pkgList: object[];
+    dependencies: object[];
+    rootInputs: string[];
+};
+//# sourceMappingURL=parsers-spack.d.ts.map

package/types/lib/ecosystems/parsers-spack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers-spack.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-spack.js"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,aAAa,EAHjC,MAGiC,GAF/B;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAgE/E"}

package/types/lib/ecosystems/parsers-stack.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Haskell Stack parser for `stack.yaml` and its lock file.
+ *
+ * Stack resolves packages from a snapshot plus the `extra-deps` a project
+ * declares, and writes the completed locations to `stack.yaml.lock` (named
+ * after the configuration file, so a custom `foo.yaml` locks to
+ * `foo.yaml.lock`). The lock is YAML with two lists:
+ *
+ *   - `packages` — one entry per extra-dep, each holding the `original`
+ *     incomplete specification and the `completed` location. A Hackage
+ *     location is the string `<name>-<version>@sha256:<hex>,<size>`; a
+ *     repository location carries `url`, `commit` and `subdir`.
+ *   - `snapshots` — the resolved snapshot chain, each with the `original`
+ *     name (`lts-22.28`) and the `completed` url, size and sha256.
+ *
+ * The lock pins only the extra-deps: packages taken from the snapshot are not
+ * listed, because the snapshot url and digest already pin them. The snapshot
+ * is therefore recorded on the parent component rather than expanded.
+ *
+ * Hackage packages are identified with the registered `hackage` purl type
+ * (`pkg:hackage/<name>@<version>`).
+ */
+/**
+ * Parse a Stack project from its lock file, with optional `stack.yaml`.
+ *
+ * @param {string} stackLockFile Path to `stack.yaml.lock` or `stack.lock`
+ * @param {string} [stackYamlFile] Path to `stack.yaml`, if present
+ * @returns {{ pkgList: object[], parentComponent: object, rootInputs: string[] }}
+ */
+export declare function parseStackProject(stackLockFile: string, stackYamlFile?: string): {
+    pkgList: object[];
+    parentComponent: object;
+    rootInputs: string[];
+};
+//# sourceMappingURL=parsers-stack.d.ts.map

package/types/lib/ecosystems/parsers-stack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers-stack.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-stack.js"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAJpC,MAIoC,EAAE,aAAa,AAH3D,CACA,EADQ,MAGmD,GAFjD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CA0ChF"}

package/types/lib/ecosystems/parsers-terraform.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Terraform and OpenTofu parser for `.terraform.lock.hcl`.
+ *
+ * The lock file pins every provider the configuration resolves to, with its
+ * exact version, the version constraints that produced it, and content
+ * hashes. It is written in a small, regular subset of HCL: provider blocks,
+ * `version` and `constraints` attributes, and a `hashes` list of prefixed
+ * digests. A line scanner is sufficient and avoids a general HCL parser.
+ *
+ * Provider addresses look like `registry.terraform.io/hashicorp/aws`; the
+ * registry host and namespace identify the provider upstream, so they are
+ * kept in the component group and a generic purl
+ * (`pkg:generic/<host>/<namespace>/<type>@<version>`), with the intended type
+ * recorded as a `cdx:purl:proposedType` property because no `terraform`
+ * purl type is registered.
+ *
+ * The two hash schemes in the `hashes` list mean different things. A `zh:`
+ * digest is a SHA-256 of the official `.zip` package as the registry indexes
+ * it, so it is the one a consumer can check an artifact against and the one
+ * emitted in the CycloneDX `hashes` array. An `h1:` digest is base64 over a
+ * hash of the package's *contents* rather than the archive, which lets
+ * Terraform verify an unpacked directory but makes it useless as an artifact
+ * checksum; it is kept as a property instead of being mislabelled SHA-256.
+ */
+/**
+ * Parse a `.terraform.lock.hcl` file.
+ *
+ * @param {string} lockFile Path to the lock file
+ * @returns {{ pkgList: object[] }} Provider components
+ */
+export declare function parseTerraformLockFile(lockFile: string): {
+    pkgList: object[];
+};
+//# sourceMappingURL=parsers-terraform.d.ts.map

package/types/lib/ecosystems/parsers-terraform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers-terraform.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-terraform.js"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAHpC,MAGoC,GAFlC;IAAE,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAkEjC"}

package/types/lib/ecosystems/pypiClassifiers.d.ts

@@ -0,0 +1,80 @@
+/**
+ * `Framework ::` values that do not mean "an application is built on this".
+ *
+ * Two groups, both of which would otherwise put a `framework` tag — and therefore
+ * `type: "framework"` — on a large share of an ordinary dependency tree, drowning
+ * the runtime frameworks the tag exists to surface:
+ *
+ *   * Development, build, test and documentation tooling. A pytest plugin
+ *     declaring `Framework :: Pytest` is making a true statement, but it belongs
+ *     to the dev dependencies, not to what the application runs on.
+ *   * Concurrency runtimes. `Framework :: AsyncIO` is declared by a very large
+ *     number of libraries to advertise that they work under asyncio; observed on
+ *     `fastapi`, and `Framework :: AnyIO` likewise on `starlette`. It describes an
+ *     execution model, not a framework the application is written against.
+ *
+ * The declared name is still emitted as a tag in every case, and still recorded in
+ * `cdx:pypi:frameworks`; only the generic `framework` tag is withheld.
+ */
+export declare const PYPI_NON_APPLICATION_FRAMEWORKS: Set<string>;
+/**
+ * Normalize a distribution name per PEP 503.
+ *
+ * @param {string} name Distribution name
+ * @returns {string} Normalized name, or an empty string for unusable input
+ */
+export declare function normalizePypiName(name: string): string;
+/**
+ * Best-known import module names for a PyPI distribution.
+ *
+ * Two sources, in order: the curated alias map (which is where the cases that
+ * cannot be derived from the name live — `pyyaml` installs `yaml`, `absl-py`
+ * installs `absl`, `beautifulsoup4` installs `bs4`), and the name-derived form,
+ * which is correct for the large majority of distributions. Callers that need to
+ * distinguish the two should read the alias map themselves; for tagging purposes
+ * both are usable and a wrong extra candidate simply matches nothing.
+ *
+ * This is deliberately not a guess at *every* module a distribution ships — only
+ * at its top-level import names.
+ *
+ * @param {string} name Distribution name, e.g. "PyYAML"
+ * @returns {string[]} Candidate top-level module names, deduplicated
+ */
+export declare function pypiModulesForPackage(name: string): string[];
+/**
+ * Interpret a PyPI classifier list.
+ *
+ * @param {string[]} classifiers Raw `info.classifiers` from the PyPI JSON API
+ * @returns {{frameworks: string[], tags: string[]}} Declared frameworks (lowercased,
+ *   e.g. `["django"]`) and the tag vocabulary they and the `Topic ::` lines imply
+ */
+export declare function parsePypiClassifiers(classifiers: string[]): {
+    frameworks: string[];
+    tags: string[];
+};
+/**
+ * Attach classifier-derived tags and properties to a package.
+ *
+ * Tags are merged into any the package already carries rather than replacing
+ * them — `lib/managers/binary.js` sets `tags: ["source"]` as an identity marker,
+ * and losing it would change how that package is reconciled later.
+ *
+ * @param {Object} pkg Package object, mutated in place
+ * @param {string[]} classifiers Raw `info.classifiers` from the PyPI JSON API
+ * @returns {Object} The same package object
+ */
+export declare function applyPypiClassifierMetadata(pkg: Object, classifiers: string[]): Object;
+/**
+ * Attach the distribution's top-level import module names as `internal:Namespaces`.
+ *
+ * This is the same property jar, gem, nuget and composer components already carry,
+ * so downstream consumers that map namespaces back to components need no
+ * pypi-specific path. Unlike the jar case the value is name-derived and
+ * alias-curated rather than read out of the artifact, which is why
+ * `cdx:pypi:modulesFrom` records the provenance.
+ *
+ * @param {Object} pkg Package object, mutated in place
+ * @returns {Object} The same package object
+ */
+export declare function applyPypiModuleNames(pkg: Object): Object;
+//# sourceMappingURL=pypiClassifiers.d.ts.map

package/types/lib/ecosystems/pypiClassifiers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pypiClassifiers.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/pypiClassifiers.js"],"names":[],"mappings":"AAmBA;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,+BAA+B,aAgB1C,CAAC;AAyCH;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAH3B,MAG2B,GAFzB,MAAM,CAoBlB;AAmCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAH/B,MAG+B,GAF7B,MAAM,EAAE,CAcpB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAJrC,MAAM,EAI+B,GAHnC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,CA2ClD;AAiBD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAJpC,MAIoC,EAAE,WAAW,EAHjD,MAAM,EAG2C,GAF/C,MAAM,CA0BlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAH7B,MAG6B,GAF3B,MAAM,CA+BlB"}

package/types/lib/ecosystems/pythonutils.d.ts

@@ -15,6 +15,26 @@ export declare function getVenvMetadata(env?: Object, explicitPath?: string): Ob
  * @returns {string} Path to the Python executable or the fallback command name
  */
 export declare function get_python_command_from_env(env: string): string;
+/**
+ * Is this import satisfied by a module that lives in the project itself?
+ *
+ * `atom parsedeps` reports every non-stdlib import it sees, including imports of the
+ * project's own packages. Attributing those to a distribution invents dependencies:
+ * `data/pypi-pkg-aliases.json` maps the module `app` to `zope2`, `test` to `pytabix`,
+ * `models` to `asposestorage` and `src` to `auto-mix-prep`, so any project with a
+ * local package of that name acquires an obscure component it never depended on -
+ * along with every namespace and tag that component carries downstream. Filtering by
+ * name would need a denylist of every plausible first-party name; asking the
+ * filesystem whether the module is ours answers it exactly.
+ *
+ * Checks the project root and a `src/` layout for a module file, a package directory,
+ * and a PEP 420 namespace package directory.
+ *
+ * @param {string} src Path to the project being analysed
+ * @param {string} name Imported top-level module name
+ * @returns {boolean} `true` if the project supplies this module itself
+ */
+export declare function isFirstPartyModule(src: string, name: string): boolean;
 /**
  * Method to find python modules by parsing the imports and then checking with PyPI to obtain the latest version
  *
@@ -51,9 +71,9 @@ export declare function createUVLock(basePath: string, options: Object): void;
  */
 export declare function getPipFrozenTree(basePath: string, reqOrSetupFile: string, tempVenvDir: string, parentComponent: Object, projectRoot: any, getTreeWithPluginFn: any): Object;
 export declare function getPipTreeForPackages(basePath: any, pkgList: any, tempVenvDir: any, parentComponent: any, getTreeWithPluginFn: any): {
+    failedPkgList?: undefined;
     rootList?: undefined;
     dependenciesList?: undefined;
-    failedPkgList?: undefined;
 } | {
     failedPkgList: any[];
     rootList: {

package/types/lib/ecosystems/pythonutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pythonutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/pythonutils.js"],"names":[],"mappings":"AAiCA;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAJxB,MAIsC,EAAE,YAAY,AAH5D,CACA,EADQ,MAG2D,GAFzD,MAAM,CAyLlB;AAyED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAHpC,MAGoC,GAFlC,MAAM,CA6BlB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAL3B,MAK2B,EAAE,QAAQ,OAAA,EAAE,OAAO,EAH9C,MAG8C;;;;;;;;GAuExD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAH1B,MAG0B,EAAE,OAAO,EAFnC,MAEmC,QAgD7C;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EARC,MAQD,EACR,cAAc,EARL,MAQK,EACd,WAAW,EARF,MAQE,EACX,eAAe,EARN,MAQM,EACf,WAAW,KAAA,EACX,mBAAmB,KAAA,GARR,MAAM,CAmkBlB;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,KAAA,EACR,OAAO,KAAA,EACP,WAAW,KAAA,EACX,eAAe,KAAA,EACf,mBAAmB,KAAA;;;;;;;;;;;;;;;;EAwNpB"}
+{"version":3,"file":"pythonutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/pythonutils.js"],"names":[],"mappings":"AAiCA;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAJxB,MAIsC,EAAE,YAAY,AAH5D,CACA,EADQ,MAG2D,GAFzD,MAAM,CAyLlB;AAyED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAHpC,MAGoC,GAFlC,MAAM,CA6BlB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,IAAI,EAHjC,MAGiC,GAF/B,OAAO,CA4BnB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAL3B,MAK2B,EAAE,QAAQ,OAAA,EAAE,OAAO,EAH9C,MAG8C;;;;;;;;GAwExD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAH1B,MAG0B,EAAE,OAAO,EAFnC,MAEmC,QAgD7C;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EARC,MAQD,EACR,cAAc,EARL,MAQK,EACd,WAAW,EARF,MAQE,EACX,eAAe,EARN,MAQM,EACf,WAAW,KAAA,EACX,mBAAmB,KAAA,GARR,MAAM,CAmkBlB;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,KAAA,EACR,OAAO,KAAA,EACP,WAAW,KAAA,EACX,eAAe,KAAA,EACf,mBAAmB,KAAA;;;;;;;;;;;;;;;;EAwNpB"}

package/types/lib/ecosystems/rubyutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rubyutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/rubyutils.js"],"names":[],"mappings":"AA0DA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAHzB,MAGyB,GAFvB,OAAO,CAOnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAHlC,MAAM,GAAG,SAGyB,GAFhC,MAAM,GAAG,SAAS,CAO9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAHrC,MAAM,GAAG,SAG4B,GAFnC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAAC,QAAQ,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CAAC,CAe3E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CAIlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,IAAI,EALnB,MAKmB,EAAE,OAAO,EAJ5B,MAAM,GAAG,SAImB,EAAE,QAAQ,EAHtC,MAAM,GAAG,SAG6B,GAFpC,MAAM,CAclB;AAsED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAAC,GAAG,SAAS,CAqBjE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,IAF1B,MAAM,CAWlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC,MAAM,CAiClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAHjC,MAGiC,GAF/B,MAAM,CAgClB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,OAAA,EAAE,OAAO,GAJ5D;IAAwB,OAAO,EAAvB,MAAM,CACd;IAAwB,oBAAoB,EAApC,MAAM,CACd;CAEiE,GAFvD,OAAO,OAAO,CA+I1B;AAwID;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,OAAA,kBAkIhD;AA6CD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,KAAA,YAsBpC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,QAAA,EACX,aAAa,QAAA,EACb,OAAO,QAAA,EACP,OAAO,QAAA,EACP,QAAQ,QAAA,GAPG,KAAK,CAAC,MAAM,CAAC,CA4IzB;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EAHvC,MAGuC,EAAE,WAAW,EAFpD,MAEoD,kBA8P9D;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,EAH3C,MAG2C,EAAE,QAAQ,EAFrD,MAEqD;;;;;;;GAgV/D"}
+{"version":3,"file":"rubyutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/rubyutils.js"],"names":[],"mappings":"AA2DA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAHzB,MAGyB,GAFvB,OAAO,CAOnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAHlC,MAAM,GAAG,SAGyB,GAFhC,MAAM,GAAG,SAAS,CAO9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAHrC,MAAM,GAAG,SAG4B,GAFnC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAAC,QAAQ,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CAAC,CAe3E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CAIlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,IAAI,EALnB,MAKmB,EAAE,OAAO,EAJ5B,MAAM,GAAG,SAImB,EAAE,QAAQ,EAHtC,MAAM,GAAG,SAG6B,GAFpC,MAAM,CAclB;AAsED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAAC,GAAG,SAAS,CAqBjE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,IAF1B,MAAM,CAWlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC,MAAM,CAiClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAHjC,MAGiC,GAF/B,MAAM,CAgClB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,OAAA,EAAE,OAAO,GAJ5D;IAAwB,OAAO,EAAvB,MAAM,CACd;IAAwB,oBAAoB,EAApC,MAAM,CACd;CAEiE,GAFvD,OAAO,OAAO,CA+I1B;AAwID;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,OAAA,kBAmIhD;AA8CD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,KAAA,YAsBpC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,QAAA,EACX,aAAa,QAAA,EACb,OAAO,QAAA,EACP,OAAO,QAAA,EACP,QAAQ,QAAA,GAPG,KAAK,CAAC,MAAM,CAAC,CA4IzB;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EAHvC,MAGuC,EAAE,WAAW,EAFpD,MAEoD,kBAwQ9D;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,EAH3C,MAG2C,EAAE,QAAQ,EAFrD,MAEqD;;;;;;;GAgV/D"}

package/types/lib/ecosystems/rusi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rusi.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/rusi.js"],"names":[],"mappings":"AAsnBA;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAHhC,MAGgC,GAF9B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAH9B,MAG8B,GAF5B,MAAM,GAAC,SAAS,CAW5B;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EALxB,MAKwB,EAAE,UAAU,EAJpC,MAIoC,EAAE,OAAO,GAH7C,MAGkD,GAFhD,OAAO,CAuDnB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,GAHpC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CA2B5B;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,GAJnC,MAIwC,EAAE,UAAU,QAAK,GAFvD,MAAM,CA4DlB"}
+{"version":3,"file":"rusi.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/rusi.js"],"names":[],"mappings":"AAqtBA;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAHhC,MAGgC,GAF9B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAH9B,MAG8B,GAF5B,MAAM,GAAC,SAAS,CAW5B;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EALxB,MAKwB,EAAE,UAAU,EAJpC,MAIoC,EAAE,OAAO,GAH7C,MAGkD,GAFhD,OAAO,CAuDnB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,GAHpC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CA2B5B;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,GAJnC,MAIwC,EAAE,UAAU,QAAK,GAFvD,MAAM,CA8DlB"}

package/types/lib/evinser/evinser.d.ts

@@ -115,6 +115,7 @@ export declare function analyzeProject(dbObjMap: Object, options: Object): Promi
     userDefinedTypesMap: {};
     componentPropertiesMap?: undefined;
     metadataProperties?: undefined;
+    workspaceComponent?: undefined;
     atomFile?: undefined;
     usagesSlicesFile?: undefined;
     dataFlowSlicesFile?: undefined;
@@ -123,6 +124,7 @@ export declare function analyzeProject(dbObjMap: Object, options: Object): Promi
     tempDir?: undefined;
     tempDirOwned?: undefined;
     cryptoComponents?: undefined;
+    aiComponents?: undefined;
     cryptoGeneratePurls?: undefined;
     openapiSpecFile?: undefined;
 } | {
@@ -134,6 +136,7 @@ export declare function analyzeProject(dbObjMap: Object, options: Object): Promi
     cryptoGeneratePurls: any;
     servicesMap: {};
     userDefinedTypesMap: {};
+    workspaceComponent?: undefined;
     atomFile?: undefined;
     usagesSlicesFile?: undefined;
     dataFlowSlicesFile?: undefined;
@@ -141,10 +144,37 @@ export declare function analyzeProject(dbObjMap: Object, options: Object): Promi
     semanticsSlicesFile?: undefined;
     tempDir?: undefined;
     tempDirOwned?: undefined;
+    aiComponents?: undefined;
+    openapiSpecFile?: undefined;
+} | {
+    purlLocationMap: {};
+    dataFlowFrames: {};
+    componentPropertiesMap: {};
+    metadataProperties: any[];
+    cryptoComponents: any[];
+    cryptoGeneratePurls: {};
+    servicesMap: {};
+    userDefinedTypesMap: {};
+    workspaceComponent: {
+        type: string;
+        name: any;
+        version: any;
+        purl: any;
+        "bom-ref": any;
+    } | undefined;
+    atomFile?: undefined;
+    usagesSlicesFile?: undefined;
+    dataFlowSlicesFile?: undefined;
+    reachablesSlicesFile?: undefined;
+    semanticsSlicesFile?: undefined;
+    tempDir?: undefined;
+    tempDirOwned?: undefined;
+    aiComponents?: undefined;
     openapiSpecFile?: undefined;
 } | {
     componentPropertiesMap?: undefined;
     metadataProperties?: undefined;
+    workspaceComponent?: undefined;
     usagesSlicesFile: any;
     dataFlowSlicesFile: any;
     semanticsSlicesFile: any;
@@ -155,6 +185,7 @@ export declare function analyzeProject(dbObjMap: Object, options: Object): Promi
     tempDirOwned: any;
     userDefinedTypesMap: {};
     cryptoComponents: any[];
+    aiComponents: any[];
     cryptoGeneratePurls: {};
     atomFile?: undefined;
     reachablesSlicesFile?: undefined;
@@ -162,6 +193,7 @@ export declare function analyzeProject(dbObjMap: Object, options: Object): Promi
 } | {
     componentPropertiesMap?: undefined;
     metadataProperties?: undefined;
+    workspaceComponent?: undefined;
     atomFile: any;
     usagesSlicesFile: any;
     dataFlowSlicesFile: any;
@@ -174,6 +206,7 @@ export declare function analyzeProject(dbObjMap: Object, options: Object): Promi
     tempDirOwned: any;
     userDefinedTypesMap: {};
     cryptoComponents: any[];
+    aiComponents: any;
     cryptoGeneratePurls: {};
     openapiSpecFile: any;
 }>;
@@ -289,7 +322,7 @@ export declare function extractEndpoints(language: string, code: string): string
  * @param {Object} options Command line options
  * @returns
  */
-export declare function createEvinseFile(sliceArtefacts: Object, options: Object): any;
+export declare function createEvinseFile(sliceArtefacts: Object, options: Object): Promise<any>;
 /**
  * Method to convert dataflow slice into usable callstack frames
  * Implemented based on the logic proposed here - https://github.com/AppThreat/atom/blob/main/specification/docs/slices.md#data-flow-slice

package/types/lib/evinser/evinser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evinser.d.ts","sourceRoot":"","sources":["../../../lib/evinser/evinser.js"],"names":[],"mappings":"AAyFA;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAF5B,MAE4B;;;;;;;eAuDtC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAPE,MAOF,EACP,SAAS,wBAAA,EACT,UAAU,EAPD,MAOC,EACV,OAAO,GAPE,MAOG,GAND,OAAO,CAAC,IAAI,CAAC,CAmDzB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EALpC,MAKoC,EAAE,SAAS,wBAAA,EAAE,UAAU,EAH3D,MAG2D,GAFzD,OAAO,CAAC,IAAI,CAAC,CAoCzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAPK,MAOL,EACJ,SAAS,wBAAA,EACT,MAAM,EAPG,MAOH,EACN,OAAO,GAPE,MAOG,GAND,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAuBrC;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAH9B,MAG8B,GAF5B,MAAM,CAOlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAC/B,eAAe,EAPN,MAAM,GAAC,MAAM,EAOP,EACf,QAAQ,EAPC,MAOD,EACR,SAAS,AAPR,CACA,EADQ,MAOW,EACpB,OAAO,AAPN,CACA,EADQ,MAOG,GAND,OAAO,CAAC,MAAM,CAAC,CAyN3B;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAJxB,MAIwB,EAAE,QAAQ,AAH1C,CACA,EADQ,MAGkC,GAFhC,MAAM,GAAC,SAAS,CA4B5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAJ5B,MAAM,EAIsB,EAAE,QAAQ,EAHtC,MAGsC,GAFpC;IAAE,eAAe,2BAAsB;IAAC,cAAc,2BAA0B;CAAE,CAgC9F;AAcD;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAHlC,MAGkC,EAAE,OAAO,EAF3C,MAE2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiUrD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAVC,MAUD,EACR,UAAU,EAVD,MAUC,EACV,QAAQ,EAVC,MAUD,EACR,WAAW,AAVV,CACA,EADQ,MAUO,EAChB,eAAe,AAVd,CACA,0BASmB,EACpB,cAAc,AAVb,CACA,0BASkB,EACnB,eAAe,AAVd,CACA,EADQ,MAUkB,GAThB,OAAO,CAAC,MAAM,CAAC,CAgE3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EATC,MASD,EACR,mBAAmB,EATV,MASU,EACnB,KAAK,OAAA,EACL,QAAQ,EATC,MASD,EACR,eAAe,EATN,MASM,EACf,cAAc,EATL,MASK,iBA4Nf;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,QAAA,EAAE,UAAU,OAAA,EAAE,cAAc,EAH7D,MAG6D,GAF3D,MAAM,CAiGlB;AAyBD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAL9B,MAK8B,EAAE,mBAAmB,yBAAA,EAAE,YAAY,EAHjE,MAGiE,GAF/D,OAAO,CA2EnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EANA,MAMA,EACT,eAAe,EANN,MAMM,EACf,WAAW,EANF,MAME,GALA,IAAI,CAqChB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,KAAK,OAAA,EAAE,WAAW,GAF1D,MAE+D,uBA2DzE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAJnC,MAImC,EAAE,gBAAgB,OAAA,EAAE,WAAW,EAFlE,MAEkE,QAgD5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAJnC,MAImC,EAAE,KAAK,EAH1C,MAG0C,GAFxC,MAAM,CAalB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAJ9B,MAI8B,EAAE,IAAI,EAHpC,MAGoC,GAFlC,MAAM,EAAE,GAAC,SAAS,CAwF9B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,cAAc,EAJpC,MAIoC,EAAE,OAAO,EAH7C,MAG6C,OAoLvD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EARC,MAQD,EACR,mBAAmB,EARV,MAQU,EACnB,aAAa,EARJ,MAQI,EACb,QAAQ,EARC,MAQD,EACR,gBAAgB,EARP,MAQO,EAChB,cAAc,EARL,MAQK,eA4Gf;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAHrC,MAGqC,EAAE,eAAe,EAFtD,MAEsD;;;;;;;;YAgFzD,SAAS;YACT,GAAG;;;;EASV;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,OAAA,qBA4DnC;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,YAAY,EAH9B,MAG8B,UAExC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAJvC,MAIuC,EAAE,YAAY,EAHrD,MAGqD,GAFnD,MAAM,GAAC,SAAS,CAmD5B"}
+{"version":3,"file":"evinser.d.ts","sourceRoot":"","sources":["../../../lib/evinser/evinser.js"],"names":[],"mappings":"AAqGA;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAF5B,MAE4B;;;;;;;eAuDtC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAPE,MAOF,EACP,SAAS,wBAAA,EACT,UAAU,EAPD,MAOC,EACV,OAAO,GAPE,MAOG,GAND,OAAO,CAAC,IAAI,CAAC,CAmDzB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EALpC,MAKoC,EAAE,SAAS,wBAAA,EAAE,UAAU,EAH3D,MAG2D,GAFzD,OAAO,CAAC,IAAI,CAAC,CAoCzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAPK,MAOL,EACJ,SAAS,wBAAA,EACT,MAAM,EAPG,MAOH,EACN,OAAO,GAPE,MAOG,GAND,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAuBrC;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAH9B,MAG8B,GAF5B,MAAM,CAOlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAC/B,eAAe,EAPN,MAAM,GAAC,MAAM,EAOP,EACf,QAAQ,EAPC,MAOD,EACR,SAAS,AAPR,CACA,EADQ,MAOW,EACpB,OAAO,AAPN,CACA,EADQ,MAOG,GAND,OAAO,CAAC,MAAM,CAAC,CAyN3B;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAJxB,MAIwB,EAAE,QAAQ,AAH1C,CACA,EADQ,MAGkC,GAFhC,MAAM,GAAC,SAAS,CA4B5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAJ5B,MAAM,EAIsB,EAAE,QAAQ,EAHtC,MAGsC,GAFpC;IAAE,eAAe,2BAAsB;IAAC,cAAc,2BAA0B;CAAE,CAqC9F;AAcD;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAHlC,MAGkC,EAAE,OAAO,EAF3C,MAE2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoarD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAVC,MAUD,EACR,UAAU,EAVD,MAUC,EACV,QAAQ,EAVC,MAUD,EACR,WAAW,AAVV,CACA,EADQ,MAUO,EAChB,eAAe,AAVd,CACA,0BASmB,EACpB,cAAc,AAVb,CACA,0BASkB,EACnB,eAAe,AAVd,CACA,EADQ,MAUkB,GAThB,OAAO,CAAC,MAAM,CAAC,CAgE3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EATC,MASD,EACR,mBAAmB,EATV,MASU,EACnB,KAAK,OAAA,EACL,QAAQ,EATC,MASD,EACR,eAAe,EATN,MASM,EACf,cAAc,EATL,MASK,iBA4Nf;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,QAAA,EAAE,UAAU,OAAA,EAAE,cAAc,EAH7D,MAG6D,GAF3D,MAAM,CAiGlB;AAyBD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAL9B,MAK8B,EAAE,mBAAmB,yBAAA,EAAE,YAAY,EAHjE,MAGiE,GAF/D,OAAO,CA2EnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EANA,MAMA,EACT,eAAe,EANN,MAMM,EACf,WAAW,EANF,MAME,GALA,IAAI,CAqChB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,KAAK,OAAA,EAAE,WAAW,GAF1D,MAE+D,uBA2DzE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAJnC,MAImC,EAAE,gBAAgB,OAAA,EAAE,WAAW,EAFlE,MAEkE,QAgD5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAJnC,MAImC,EAAE,KAAK,EAH1C,MAG0C,GAFxC,MAAM,CAalB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAJ9B,MAI8B,EAAE,IAAI,EAHpC,MAGoC,GAFlC,MAAM,EAAE,GAAC,SAAS,CAwF9B;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,cAAc,EAJ1C,MAI0C,EAAE,OAAO,EAHnD,MAGmD,gBAqM7D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EARC,MAQD,EACR,mBAAmB,EARV,MAQU,EACnB,aAAa,EARJ,MAQI,EACb,QAAQ,EARC,MAQD,EACR,gBAAgB,EARP,MAQO,EAChB,cAAc,EARL,MAQK,eA4Gf;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAHrC,MAGqC,EAAE,eAAe,EAFtD,MAEsD;;;;;;;;YAgFzD,SAAS;YACT,GAAG;;;;EASV;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,OAAA,qBA4DnC;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,YAAY,EAH9B,MAG8B,UAExC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAJvC,MAIuC,EAAE,YAAY,EAHrD,MAGqD,GAFnD,MAAM,GAAC,SAAS,CAmD5B"}