@cdxgen/cdxgen 13.0.1 → 13.2.0

package/types/lib/helpers/agenticToolutils.d.ts

@@ -0,0 +1,87 @@
+/**
+ * The purl type used for installed agentic CLI tools. These tools ship as
+ * self-contained executables rather than as a resolvable source package, so a
+ * `pkg:generic/...` identifier is the honest representation.
+ */
+export declare const AGENTIC_TOOL_PURL_TYPE = "generic";
+/**
+ * Rewrite an absolute path under the user's home directory to a `~`-relative
+ * form so the emitted BOM does not carry the local username.
+ *
+ * @param {string} filePath Absolute path
+ * @returns {string} Home-relative path when applicable, else the input
+ */
+export declare function redactHomePath(filePath: string): string;
+/**
+ * Describe where each supported agentic CLI tool stores its per-user state.
+ *
+ * Each entry lists the tool key, a display name, and the candidate home
+ * directories per platform (mirroring how `getIdeExtensionDirs` models IDE
+ * extension locations). Only the current platform's directories plus
+ * always-present dot-directories are included.
+ *
+ * @returns {Array<{tool: string, name: string, dirs: string[], supportDirs?: string[]}>}
+ *   One entry per known agentic CLI tool.
+ */
+export declare function getAgenticToolDirs(): Array<{
+    tool: string;
+    name: string;
+    dirs: string[];
+    supportDirs?: string[];
+}>;
+/**
+ * Discover which agentic CLI tools are installed for the current user by
+ * checking their known home directories.
+ *
+ * @returns {Array<{tool: string, name: string, dir: string, supportDir?: string}>}
+ *   One entry per discovered tool, using the first existing directory.
+ */
+export declare function discoverAgenticTools(): Array<{
+    tool: string;
+    name: string;
+    dir: string;
+    supportDir?: string;
+}>;
+/**
+ * Compute safe, redacted signal counts for a discovered tool. Only structural
+ * counts and small enumerated values are returned; no credential, transcript,
+ * or telemetry content is read.
+ *
+ * @param {string} tool Tool key
+ * @param {string} dir Discovered tool home directory
+ * @param {string} [supportDir] Optional platform support directory
+ * @returns {Object} Map of signal name to count/boolean/small-string value
+ */
+export declare function collectToolSignals(tool: string, dir: string, supportDir?: string): Object;
+/**
+ * Build a CycloneDX application component for one discovered agentic tool.
+ *
+ * @param {{tool: string, name: string, dir: string, supportDir?: string}} entry
+ *   Discovered tool entry
+ * @returns {Object} CycloneDX component
+ */
+export declare function componentForAgenticTool(entry: {
+    tool: string;
+    name: string;
+    dir: string;
+    supportDir?: string;
+}): Object;
+/**
+ * Discover installed agentic CLI tools on the current host and return CycloneDX
+ * components describing each one, plus the child agents, plugins, and providers
+ * they define and the dependency edges linking children to their tool.
+ *
+ * This host scan is unconditional: it does not consult scan filters such as
+ * `--exclude` or profile/technique options, because it inventories fixed tool
+ * home directories rather than a project tree. The `options` argument is
+ * accepted for signature parity and is intentionally not used to alter results.
+ *
+ * @param {Object} [options={}] Collection options (accepted but not applied)
+ * @returns {{components: Object[], services: Object[], dependencies: Object[]}} Discovered inventory
+ */
+export declare function collectAgenticTools(_options?: {}): {
+    components: Object[];
+    services: Object[];
+    dependencies: Object[];
+};
+//# sourceMappingURL=agenticToolutils.d.ts.map

package/types/lib/helpers/agenticToolutils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agenticToolutils.d.ts","sourceRoot":"","sources":["../../../lib/helpers/agenticToolutils.js"],"names":[],"mappings":"AAYA;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,YAAY,CAAC;AA8BhD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,MAAM,CAgBlB;AAqBD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,IAHrB,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CAyGvF;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAHvB,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAC,CAAC,CAgBjF;AAoUD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAL5B,MAK4B,EAAE,GAAG,EAJjC,MAIiC,EAAE,UAAU,AAHrD,CACA,EADQ,MAG6C,GAF3C,MAAM,CAkClB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAJlC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAI3B,GAFhC,MAAM,CA8ClB;AA0OD;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,KAAK,GAFpC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAoC9E"}

package/types/lib/helpers/remote/dependency-track.d.ts

@@ -1,3 +1,4 @@
+import { Buffer } from "node:buffer";
 /**
  * Returns the Dependency-Track BOM API URL as a sanitized URL object.
  *
@@ -13,11 +14,51 @@ export declare function getDependencyTrackBomApiUrl(serverUrl: string): URL | un
  */
 export declare function getDependencyTrackBomUrl(serverUrl: string): string | undefined;
 /**
- * Build the payload for Dependency-Track BOM submission.
+ * Build the form fields for a Dependency-Track BOM submission.
+ *
+ * Field names follow the `multipart/form-data` variant of `/api/v1/bom`, which differs
+ * from the JSON variant: the JSON body calls the flag `isLatestProjectVersion` and takes
+ * `projectTags` as an array of objects, while the form takes `isLatest` and a
+ * comma-separated tag list.
+ *
+ * @param {Object} args CLI/server arguments
+ * @returns {Object | undefined} field map if the project coordinates are valid
+ */
+export declare function buildDependencyTrackBomPayload(args: Object): Object | undefined;
+/**
+ * Encode text fields and a single file part as a `multipart/form-data` body.
+ *
+ * @param {Object} fields Text fields keyed by field name
+ * @param {Object} file File part
+ * @param {string} file.name Field name of the file part
+ * @param {string} file.filename File name reported to the server
+ * @param {string} file.contentType Content type of the file part
+ * @param {Buffer} file.content File content
+ * @returns {{ body: Buffer, contentType: string }} encoded body and its content type
+ */
+export declare function encodeMultipartFormData(fields: Object, file: {
+    name: string;
+    filename: string;
+    contentType: string;
+    content: Buffer;
+}): {
+    body: Buffer;
+    contentType: string;
+};
+/**
+ * Build the `multipart/form-data` request for Dependency-Track BOM submission.
+ *
+ * The JSON variant of the endpoint carries the BOM as a base64 string, which Jackson
+ * refuses to read beyond 20,000,000 characters - roughly a 15 MB BOM, which container
+ * image scans exceed routinely. The form variant carries the BOM as a file part and has
+ * no such limit, and is what the server recommends for large uploads.
  *
  * @param {Object} args CLI/server arguments
- * @param {Object} bomContents BOM Json
- * @returns {Object | undefined} payload object if project coordinates are valid
+ * @param {Object | string} bomContents BOM Json
+ * @returns {{ body: Buffer, contentType: string } | undefined} request body and content type if the arguments are valid
  */
-export declare function buildDependencyTrackBomPayload(args: Object, bomContents: Object): Object | undefined;
+export declare function buildDependencyTrackBomRequest(args: Object, bomContents: Object | string): {
+    body: Buffer;
+    contentType: string;
+} | undefined;
 //# sourceMappingURL=dependency-track.d.ts.map

package/types/lib/helpers/remote/dependency-track.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-track.d.ts","sourceRoot":"","sources":["../../../../lib/helpers/remote/dependency-track.js"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAH1C,MAG0C,GAFxC,GAAG,GAAG,SAAS,CAyB3B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,GAAG,SAAS,CAI9B;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAJxC,MAIwC,EAAE,WAAW,EAHrD,MAGqD,GAFnD,MAAM,GAAG,SAAS,CAkE9B"}
+{"version":3,"file":"dependency-track.d.ts","sourceRoot":"","sources":["../../../../lib/helpers/remote/dependency-track.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAKrC;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAH1C,MAG0C,GAFxC,GAAG,GAAG,SAAS,CAyB3B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,GAAG,SAAS,CAI9B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAHxC,MAGwC,GAFtC,MAAM,GAAG,SAAS,CA6D9B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EARnC,MAQmC,EAAE,IAAI,EANjD;IAAqB,IAAI,EAAjB,MAAM,CACd;IAAqB,QAAQ,EAArB,MAAM,CACd;IAAqB,WAAW,EAAxB,MAAM,CACd;IAAqB,OAAO,EAApB,MAAM,CACd;CAEiD,GAFvC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAyBjD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAJxC,MAIwC,EAAE,WAAW,EAHrD,MAAM,GAAG,MAG4C,GAFnD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAmB7D"}

package/types/lib/inventory/agentFormulationParser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agentFormulationParser.d.ts","sourceRoot":"","sources":["../../../lib/inventory/agentFormulationParser.js"],"names":[],"mappings":"AAuIA;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;CAsLlC,CAAC"}
+{"version":3,"file":"agentFormulationParser.d.ts","sourceRoot":"","sources":["../../../lib/inventory/agentFormulationParser.js"],"names":[],"mappings":"AA4LA;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;CAsLlC,CAAC"}

package/types/lib/inventory/aiCollector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aiCollector.d.ts","sourceRoot":"","sources":["../../../lib/inventory/aiCollector.js"],"names":[],"mappings":"AAotDA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAJvC,MAIuC,EAAE,OAAO,AAHxD,CACA,EADQ,MAGqD,GAFnD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CA6IhF;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAAC,aAAa,EAJpD,MAIoD,EAAE,OAAO,AAHrE,CACA,EADQ,MAGkE,GAFhE;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAiMhF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,aAAa,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,aAAa,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,aAAa,EAJjD,MAIiD,EAAE,OAAO,AAHlE,CACA,EADQ,MAG+D,GAF7D;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF"}
+{"version":3,"file":"aiCollector.d.ts","sourceRoot":"","sources":["../../../lib/inventory/aiCollector.js"],"names":[],"mappings":"AAo8DA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAJvC,MAIuC,EAAE,OAAO,AAHxD,CACA,EADQ,MAGqD,GAFnD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CA2YhF;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAAC,aAAa,EAJpD,MAIoD,EAAE,OAAO,AAHrE,CACA,EADQ,MAGkE,GAFhE;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAiMhF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,aAAa,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,aAAa,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,aAAa,EAJjD,MAIiD,EAAE,OAAO,AAHlE,CACA,EADQ,MAG+D,GAF7D;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF"}

package/types/lib/inventory/aiInventory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aiInventory.d.ts","sourceRoot":"","sources":["../../../lib/inventory/aiInventory.js"],"names":[],"mappings":"AAcA,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,UAA4B,CAAC;AACpE;;;GAGG;AACH,eAAO,MAAM,yBAAyB,aAapC,CAAC;AACH,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,eAAe,CAAC;AAC/C,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,eAAe,CAAC;AA2DjD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAJnC,MAImC,EAAE,IAAI,EAHzC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAI5B;AAYD;;;;;;GAMG;AACH,wBAAgB,oCAAoC,CAAC,WAAW,EAJrD,MAAM,GAAC,MAAM,EAAE,GAAC,SAIqC,EAAE,IAAI,EAH3D,MAG2D,GAFzD,OAAO,CAkBnB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAHrC,MAGqC,GAFnC,MAAM,EAAE,CAiCpB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAJnC,MAImC,EAAE,IAAI,EAHzC,MAGyC,GAFvC,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAJ1C,MAI0C,EAAE,IAAI,EAHhD,MAGgD,GAF9C,OAAO,CAiBnB;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAJ5C,MAAM,EAIsC,EAAE,KAAK,EAHnD,MAAM,EAG6C,GAFjD,MAAM,EAAE,CAYpB;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,YAAY,EANH,MAAM,EAMH,EACZ,UAAU,EAND,MAAM,EAML,EACV,QAAQ,EANC,MAAM,EAMP,GALG,MAAM,EAAE,CAgCpB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EALrC,MAKqC,EAAE,OAAO,EAJ9C,MAI8C,EAAE,KAAK,EAHrD,MAAM,EAG+C,GAFnD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAyFhF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EATnC;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAST,GARjC;IACR,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CA+BH"}
+{"version":3,"file":"aiInventory.d.ts","sourceRoot":"","sources":["../../../lib/inventory/aiInventory.js"],"names":[],"mappings":"AAgBA,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,UAA4B,CAAC;AACpE;;;GAGG;AACH,eAAO,MAAM,yBAAyB,aAapC,CAAC;AACH,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,eAAe,CAAC;AAC/C,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAqEjD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAJnC,MAImC,EAAE,IAAI,EAHzC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAI5B;AAYD;;;;;;GAMG;AACH,wBAAgB,oCAAoC,CAAC,WAAW,EAJrD,MAAM,GAAC,MAAM,EAAE,GAAC,SAIqC,EAAE,IAAI,EAH3D,MAG2D,GAFzD,OAAO,CAkBnB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAHrC,MAGqC,GAFnC,MAAM,EAAE,CAiCpB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAJnC,MAImC,EAAE,IAAI,EAHzC,MAGyC,GAFvC,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAJ1C,MAI0C,EAAE,IAAI,EAHhD,MAGgD,GAF9C,OAAO,CAiBnB;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAJ5C,MAAM,EAIsC,EAAE,KAAK,EAHnD,MAAM,EAG6C,GAFjD,MAAM,EAAE,CAYpB;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,YAAY,EANH,MAAM,EAMH,EACZ,UAAU,EAND,MAAM,EAML,EACV,QAAQ,EANC,MAAM,EAMP,GALG,MAAM,EAAE,CAgCpB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EALrC,MAKqC,EAAE,OAAO,EAJ9C,MAI8C,EAAE,KAAK,EAHrD,MAAM,EAG+C,GAFnD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAyFhF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EATnC;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAST,GARjC;IACR,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CA+BH"}

package/types/lib/inventory/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../../../lib/inventory/analyzer.js"],"names":[],"mappings":"AAspDA;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAJ3B,MAAM,QACN,MAAM,KACJ;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAO7C,CAAC;AA0oBF;;;GAGG;AACH,eAAO,MAAM,wCAAwC,UAQpD,CAAC;AA4JF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,UAQpC,CAAC;AA+JF;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAHrC,MAGqC,GAFnC;IAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAC,CA2J/H;AAsLD;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;EA2FhC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,aAHzB,MAAM,KACJ;IAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,qBAAqB,EAAE,MAAM,EAAE,CAAA;CAe9H,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAHvC,MAGuC,GAFrC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,2BAA0B;CAAC,CAqOnJ;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,aAH3B,MAAM,KACJ;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,2BAA0B;CAAC,GAAC,SAgBpJ,CAAC;AAyQF;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAHjC,MAGiC,GAF/B;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,CA2avD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,aAHrB,MAAM,KACJ;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAUxD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,QAJzB,MAAM,SACN,OAAO,KACL,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,CAiC/D,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,QAN7B,MAAM,SACN,OAAO,KACL;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,2BAA0B;CAuGzE,CAAC;AAs8BF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,QAJ1B,MAAM,SACN,OAAO,KACL;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAiJ7E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,QAJpB,MAAM,SACN,OAAO,KACL;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAqrB7E,CAAC"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../../../lib/inventory/analyzer.js"],"names":[],"mappings":"AA2sDA;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAJ3B,MAAM,QACN,MAAM,KACJ;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAO7C,CAAC;AAoqBF;;;GAGG;AACH,eAAO,MAAM,wCAAwC,UAQpD,CAAC;AA4JF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,UAQpC,CAAC;AA+JF;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAHrC,MAGqC,GAFnC;IAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAC,CA2J/H;AA2hBD;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;EAuGhC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,aAHzB,MAAM,KACJ;IAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,qBAAqB,EAAE,MAAM,EAAE,CAAA;CAe9H,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAHvC,MAGuC,GAFrC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,2BAA0B;CAAC,CAqOnJ;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,aAH3B,MAAM,KACJ;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,2BAA0B;CAAC,GAAC,SAgBpJ,CAAC;AAyQF;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAHjC,MAGiC,GAF/B;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,CA2avD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,aAHrB,MAAM,KACJ;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAUxD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,QAJzB,MAAM,SACN,OAAO,KACL,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,CAiC/D,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,QAN7B,MAAM,SACN,OAAO,KACL;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,2BAA0B;CAuGzE,CAAC;AAg9BF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,QAJ1B,MAAM,SACN,OAAO,KACL;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAiJ7E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,QAJpB,MAAM,SACN,OAAO,KACL;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAqrB7E,CAAC"}

package/types/lib/inventory/auditCategories.d.ts

@@ -6,6 +6,16 @@ export declare const CBOM_AUDIT_CATEGORIES: readonly string[];
 export declare const HOST_TOPOLOGY_AUDIT_CATEGORIES: readonly string[];
 /** Frozen list of Golem (Go Evinse) audit categories. */
 export declare const GOLEM_AUDIT_CATEGORIES: readonly string[];
+/** Frozen list of Cargo (Rust) audit categories. */
+export declare const CARGO_AUDIT_CATEGORIES: readonly string[];
+/**
+ * Frozen list of audit categories that never activate on their own. These
+ * rule packs serve a specific feature (`--introspect` for build-fidelity) and
+ * stay inactive unless the caller explicitly requests the category, so a
+ * default `--bom-audit` run - which evaluates every loaded rule - cannot pick
+ * them up.
+ */
+export declare const OPT_IN_BOM_AUDIT_CATEGORIES: readonly string[];
 /** Frozen list of AI-bill-of-materials audit categories. */
 export declare const AI_BOM_AUDIT_CATEGORIES: readonly string[];
 /** Comma-separated default HBOM category string used when none is specified. */
@@ -20,10 +30,12 @@ export declare const BOM_AUDIT_CATEGORY_ALIASES: Readonly<{
     "ai-bom": string[];
     "ai-provenance": string[];
     "ai-oversight": string[];
+    cargo: string[];
     cbom: string[];
     "crypto-bom": string[];
     golem: string[];
     hbom: string[];
+    rust: string[];
     host: string[];
 }>;
 /**

package/types/lib/inventory/auditCategories.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auditCategories.d.ts","sourceRoot":"","sources":["../../../lib/inventory/auditCategories.js"],"names":[],"mappings":"AAEA,yEAAyE;AACzE,eAAO,MAAM,qBAAqB,mBAIhC,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,mBAGhC,CAAC;AAEH,qDAAqD;AACrD,eAAO,MAAM,8BAA8B,mBAAmC,CAAC;AAE/E,yDAAyD;AACzD,eAAO,MAAM,sBAAsB,mBAIjC,CAAC;AAEH,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,mBAIlC,CAAC;AAEH,gFAAgF;AAChF,eAAO,MAAM,6BAA6B,QAAkC,CAAC;AAE7E;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;EAWrC,CAAC;AAMH;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAH3C,MAAM,GAAC,MAAM,EAG8B,GAFzC,MAAM,EAAE,CAiBpB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAHxC,MAAM,GAAC,MAAM,EAG2B,GAFtC,MAAM,EAAE,CAapB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAHtC,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,CAGa,GAFpC,MAAM,EAAE,CAMpB;AAUD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAJ1C,MAAM,GAAC,MAAM,EAI6B,EAAE,KAAK,EAHjD,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,CAGwB,GAF/C;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAC,CAyB3F;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAJzC,MAIyC,EAAE,WAAW,AAH9D,CACA,EADQ,MAGsD,GAFpD,MAAM,GAAG,SAAS,CA8B9B"}
+{"version":3,"file":"auditCategories.d.ts","sourceRoot":"","sources":["../../../lib/inventory/auditCategories.js"],"names":[],"mappings":"AAEA,yEAAyE;AACzE,eAAO,MAAM,qBAAqB,mBAIhC,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,mBAGhC,CAAC;AAEH,qDAAqD;AACrD,eAAO,MAAM,8BAA8B,mBAAmC,CAAC;AAE/E,yDAAyD;AACzD,eAAO,MAAM,sBAAsB,mBAIjC,CAAC;AAEH,oDAAoD;AACpD,eAAO,MAAM,sBAAsB,mBAGjC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,mBAAoC,CAAC;AAE7E,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,mBAIlC,CAAC;AAEH,gFAAgF;AAChF,eAAO,MAAM,6BAA6B,QAAkC,CAAC;AAE7E;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;EAarC,CAAC;AAMH;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAH3C,MAAM,GAAC,MAAM,EAG8B,GAFzC,MAAM,EAAE,CAiBpB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAHxC,MAAM,GAAC,MAAM,EAG2B,GAFtC,MAAM,EAAE,CAapB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAHtC,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,CAGa,GAFpC,MAAM,EAAE,CAMpB;AAUD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAJ1C,MAAM,GAAC,MAAM,EAI6B,EAAE,KAAK,EAHjD,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,CAGwB,GAF/C;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAC,CAyB3F;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAJzC,MAIyC,EAAE,WAAW,AAH9D,CACA,EADQ,MAGsD,GAFpD,MAAM,GAAG,SAAS,CA8B9B"}

package/types/lib/inventory/cbomutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cbomutils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cbomutils.js"],"names":[],"mappings":"AAqBA;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,EAAE,gBAAgB,KAAA,SAiC5D;AAmVD;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CAAC,GAAG,EAL5C,MAK4C,EAAE,OAAO,AAJ7D,CAEA,EADA;IAA0B,IAAI,AAA9B,CACA,EADQ,OAAO,CACf;CAEkE,GAFxD,OAAO,CAAC,MAAM,EAAE,CAAC,CAkD7B;AAED;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,CAAC,GAAG,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC,MAAM,EAAE,CAAC,CAuG7B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAHzB,MAGyB,SAanC"}
+{"version":3,"file":"cbomutils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cbomutils.js"],"names":[],"mappings":"AAqBA;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,EAAE,gBAAgB,KAAA,SAiC5D;AAiXD;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CAAC,GAAG,EAL5C,MAK4C,EAAE,OAAO,AAJ7D,CAEA,EADA;IAA0B,IAAI,AAA9B,CACA,EADQ,OAAO,CACf;CAEkE,GAFxD,OAAO,CAAC,MAAM,EAAE,CAAC,CAkD7B;AAED;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,CAAC,GAAG,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC,MAAM,EAAE,CAAC,CAuG7B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAHzB,MAGyB,SAanC"}

package/types/lib/inventory/communityAiConfigParser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"communityAiConfigParser.d.ts","sourceRoot":"","sources":["../../../lib/inventory/communityAiConfigParser.js"],"names":[],"mappings":"AAwpBA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,EAL1B,MAoFT,CAAC"}
+{"version":3,"file":"communityAiConfigParser.d.ts","sourceRoot":"","sources":["../../../lib/inventory/communityAiConfigParser.js"],"names":[],"mappings":"AA21BA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,EAL1B,MAsGT,CAAC"}

package/types/lib/inventory/depsUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"depsUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/depsUtils.js"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EANH,MAAM,EAMH,EACZ,eAAe,EANN,MAAM,EAMA,EACf,eAAe,GANN,MAMW,GALT,MAAM,EAAE,CAuEpB;AA4CD;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,GAH9C,MAAM,EAG6C,GAFjD,MAAM,EAAE,CAYpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sCAAsC,CACpD,UAAU,GALD,MAAM,EAKA,EACf,YAAY,GALH,MAAM,EAKE,GAJN,MAAM,EAAE,CA8DpB;AAoCD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAJ3B,MAAM,EAAE,GAAC,MAIkB,EAAE,WAAW,EAHxC,MAAM,EAAE,GAAC,MAG+B,GAFtC,MAAM,EAAE,CAmEpB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,UAAU,OAAA,SAoIxC;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAH7C,MAAM,EAAE,GAAG,SAAS,GAAG,IAGsB,GAF3C,MAAM,EAAE,CA0CpB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,YAAY,OAAA,EAAE,eAAe,SAAI,WAsB9D;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,OAAA,EAAE,YAAY,OAAA,SAgCnD"}
+{"version":3,"file":"depsUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/depsUtils.js"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EANH,MAAM,EAMH,EACZ,eAAe,EANN,MAAM,EAMA,EACf,eAAe,GANN,MAMW,GALT,MAAM,EAAE,CAuEpB;AA4CD;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,GAH9C,MAAM,EAG6C,GAFjD,MAAM,EAAE,CAYpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sCAAsC,CACpD,UAAU,GALD,MAAM,EAKA,EACf,YAAY,GALH,MAAM,EAKE,GAJN,MAAM,EAAE,CA8DpB;AA0FD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAJ3B,MAAM,EAAE,GAAC,MAIkB,EAAE,WAAW,EAHxC,MAAM,EAAE,GAAC,MAG+B,GAFtC,MAAM,EAAE,CAqFpB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,UAAU,OAAA,SAoIxC;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAH7C,MAAM,EAAE,GAAG,SAAS,GAAG,IAGsB,GAF3C,MAAM,EAAE,CA0CpB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,YAAY,OAAA,EAAE,eAAe,SAAI,WAsB9D;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,OAAA,EAAE,YAAY,OAAA,SAgCnD"}

package/types/lib/inventory/dosai.d.ts

@@ -86,6 +86,29 @@ export declare function buildPurlAliasMap(components?: Object[]): Map<string, st
  * @returns {string|undefined} Canonical component purl, the input purl when unaliased, or undefined when empty
  */
 export declare function resolveComponentPurl(purl: string, purlAliasMap: Map<string, string>): string | undefined;
+/**
+ * Copy one dosai PackageReachability fact onto a component as properties.
+ *
+ * The occurrence/location consumers of PackageReachability read SourceLocations, EdgeIds,
+ * and NodeIds only, so dosai's Confidence, EvidenceKinds, ReachabilityKind, and
+ * ConfidenceReasons never reached the BOM: an unbuilt tree (Low confidence, unresolved
+ * evidence) was indistinguishable from a package that really is only imported. These
+ * properties carry that distinction to BOM consumers. They use the consumer-facing
+ * `cdx:dosai:reachability:*` namespace - not `internal:`, which is cdxgen's private
+ * bookkeeping namespace stripped or ignored by downstream tooling.
+ *
+ * @param {Object} component BOM component object (mutated; properties created on demand)
+ * @param {Object} reachability dosai PackageReachability entry
+ */
+export declare function addDosaiReachabilityProperties(component: Object, reachability: Object): void;
+/**
+ * Attach dosai PackageReachability confidence facts to matching BOM components.
+ *
+ * @param {Object} methodsSlice Parsed dosai methods slice JSON
+ * @param {Object[]} [components] BOM components used to resolve purl aliases and mutate
+ * @returns {number} Number of distinct components enriched
+ */
+export declare function applyDosaiReachabilityEvidence(methodsSlice: Object, components?: Object[]): number;
 /**
  * Map a dosai methods slice to per-purl occurrence evidence.
  *
@@ -108,6 +131,26 @@ export declare function collectDosaiPurlEvidence(methodsSlice: Object, component
  * @returns {Object} Map of canonical purl to arrays of call-stack frame objects
  */
 export declare function collectDosaiDataFlowFrames(dataFlowResult: Object, components?: Object[]): Object;
+/**
+ * Consume dosai's AiComponents[] inventory (schema 4.0.0): model identifiers,
+ * on-disk model artifacts with hashes, MCP tools, prompts (redacted), and agents
+ * become CycloneDX machine-learning-model / data components with modelCard data.
+ *
+ * @param {Object} methodsSlice Parsed dosai methods slice JSON
+ * @param {Array} [components] Component list to mutate in place
+ * @returns {Array} The updated component list
+ */
+export declare function collectDosaiAiComponents(methodsSlice: Object, components?: any[]): any[];
+/**
+ * Consume dosai's first-class Services[] inventory (schema 4.0.0) directly: richer
+ * than deriving services from ApiEndpoints alone — stable bom-refs, trust zones,
+ * data classifications, providers, and per-service evidence occurrences.
+ *
+ * @param {Object} methodsSlice Parsed dosai methods slice JSON
+ * @param {Object} [servicesMap] Map of service key to service definition, mutated in place
+ * @returns {Object} The updated services map
+ */
+export declare function collectDosaiServiceComponents(methodsSlice: Object, servicesMap?: Object): Object;
 /**
  * Infer service and endpoint definitions from a dosai methods slice.
  *

package/types/lib/inventory/dosai.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dosai.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dosai.js"],"names":[],"mappings":"AAmJA;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAW5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAN5B,MAM4B,EAAE,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAyDnB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,UAAU,EAJ5C,MAI4C,EAAE,OAAO,AAH7D,CACA,EADQ,MAG0D,GAFxD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EALlC,MAKkC,EAAE,UAAU,EAJ9C,MAI8C,EAAE,OAAO,AAH/D,CACA,EADQ,MAG4D,GAF1D,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAe5B;AAuBD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,KAAA,EACP,YAAY,KAAA,EACZ,aAAa,KAAA,OAiBd;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,AAHzC,CACA,EADQ,MAAM,EAGgC,GAFpC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/B;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAJ9B,MAI8B,EAAE,YAAY,EAH5C,GAAG,CAAC,MAAM,EAAE,MAAM,CAG0B,GAF1C,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAJ1C,MAI0C,EAAE,UAAU,AAH9D,CACA,EADQ,MAAM,EAGqD,GAFzD,MAAM,CAmElB;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,cAAc,EAJ9C,MAI8C,EAAE,UAAU,AAHlE,CACA,EADQ,MAAM,EAGyD,GAF7D,MAAM,CAsClB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC7C,YAAY,EALH,MAKG,EACZ,WAAW,AALV,CACA,EADQ,MAKO,GAJL,MAAM,CA2ElB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,AAHjD,CACA,EADQ,MAG8C,GAF5C,MAAM,EAAE,CAUpB"}
+{"version":3,"file":"dosai.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dosai.js"],"names":[],"mappings":"AA8LA;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAW5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAN5B,MAM4B,EAAE,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAiEnB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,UAAU,EAJ5C,MAI4C,EAAE,OAAO,AAH7D,CACA,EADQ,MAG0D,GAFxD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EALlC,MAKkC,EAAE,UAAU,EAJ9C,MAI8C,EAAE,OAAO,AAH/D,CACA,EADQ,MAG4D,GAF1D,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAe5B;AAuBD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,KAAA,EACP,YAAY,KAAA,EACZ,aAAa,KAAA,OA+Bd;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,AAHzC,CACA,EADQ,MAAM,EAGgC,GAFpC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/B;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAJ9B,MAI8B,EAAE,YAAY,EAH5C,GAAG,CAAC,MAAM,EAAE,MAAM,CAG0B,GAF1C,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAH7C,MAG6C,EAAE,YAAY,EAF3D,MAE2D,QAyBrE;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,YAAY,EAJhD,MAIgD,EAAE,UAAU,AAHpE,CACA,EADQ,MAAM,EAG2D,GAF/D,MAAM,CAoBlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAJ1C,MAI0C,EAAE,UAAU,AAH9D,CACA,EADQ,MAAM,EAGqD,GAFzD,MAAM,CAmElB;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,cAAc,EAJ9C,MAI8C,EAAE,UAAU,AAHlE,CACA,EADQ,MAAM,EAGyD,GAF7D,MAAM,CAsClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAJ1C,MAI0C,EAAE,UAAU,AAH9D,CACA,OAEmE,SA6FrE;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,YAAY,EAJ/C,MAI+C,EAAE,WAAW,AAHpE,CACA,EADQ,MAGiE,GAF/D,MAAM,CAyKlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC7C,YAAY,EALH,MAKG,EACZ,WAAW,AALV,CACA,EADQ,MAKO,GAJL,MAAM,CA+GlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,AAHjD,CACA,EADQ,MAG8C,GAF5C,MAAM,EAAE,CA6CpB"}

package/types/lib/inventory/envcontext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"envcontext.d.ts","sourceRoot":"","sources":["../../../lib/inventory/envcontext.js"],"names":[],"mappings":"AAqCA;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAFd,MAE4D,CAAC;AAuCvE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,wBAUpC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAL3B,MAK2B,EAAE,GAAG,EAJhC,MAIgC,sBAE1C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAJrB,MAIqB,sBAE/B;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,UAAU,KAAA,EAAE,GAAG,EAJ9B,MAI8B,sBAExC;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAJtB,MAIsB,MAkBhC;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAJlB,MAIkB,SA4B5B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EALvB,MAKuB,EAAE,IAAI,OAAA,sBAYvC;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EALtB,MAKsB,EAAE,QAAQ,GAJhC,MAIqC,GAFnC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAAC,CA+BhD;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EALvB,MAKuB,EAAE,QAAQ,GAJjC,MAIsC,GAFpC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CA8BlD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB;;;;;;;;;cAmBlC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAH1B,MAG0B;;;;;cAapC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAH1B,MAG0B;;;;;cAqBpC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB,GAFtB,MAAM,CAelB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB;;;;;cAYjC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB;;;;;cAYlC;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAHtB,MAGsB;;;;cAUhC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAHzB,MAGyB;;;;cAUnC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB;;;;cAUlC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,QAAA,EAAE,IAAI,OAAA,sBAExC;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB,MAAM,EAAE,CAqCpB;AA6CD;;GAEG;AACH,wBAAgB,iBAAiB,YAiBhC;AAED;;GAEG;AACH,wBAAgB,cAAc,YAO7B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,QAAA,EAAE,QAAQ,QAAA,WA0BvD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,QAAA,EAAE,QAAQ,QAAA,WAmGnD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,QAAA,UA8B3C;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,QAAA,UA8B9C;AASD;;;;GAIG;AACH,wBAAgB,gBAAgB,YAgB/B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAH/B,MAG+B,GAF7B,MAAM,CAWlB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,KAAA,EAAE,aAAa,KAAA,EAAE,QAAQ,KAAA,WAuC3E;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,KAAA,EAAE,QAAQ,KAAA;;;;;;EAqFvD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,KAAA,EAAE,cAAc,KAAA,WA2D7D;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,KAAA,EACb,WAAW,KAAA,EACX,aAAa,KAAA,EACb,QAAQ,KAAA,GANG,OAAO,CA8KnB;AAmDD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,EAAE,QAAQ,GAHxC,MAG6C,GAF3C,KAAK,CAAC,MAAM,CAAC,CAmDzB;AAyDD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,EAAE,UAAU,EAH1C,MAG0C,GAFxC,MAAM,CA6FlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,GAAG,EANnB,MAMmB,EAAE,OAAO,AALpC,CAGA,EAFA;IAAyB,GAAG,AAA5B,CACA,EADQ,MAAM,CACd;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;CAEyC,GAF/B,KAAK,CAAC,MAAM,CAAC,CA4CzB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,EAAE,QAAQ,GAHxC,MAG6C,GAF3C,KAAK,CAAC,MAAM,CAAC,CA+BzB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAFxB,MAAM,CA8FlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,WAUpC;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,IAF9B,MAAM,GAAC,SAAS,CAc5B"}
+{"version":3,"file":"envcontext.d.ts","sourceRoot":"","sources":["../../../lib/inventory/envcontext.js"],"names":[],"mappings":"AAkDA;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAFd,MAE4D,CAAC;AAuCvE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,wBAapC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAL3B,MAK2B,EAAE,GAAG,EAJhC,MAIgC,sBAE1C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAJrB,MAIqB,sBAE/B;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,UAAU,KAAA,EAAE,GAAG,EAJ9B,MAI8B,sBAExC;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAJtB,MAIsB,MAkBhC;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAJlB,MAIkB,SA4B5B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EALvB,MAKuB,EAAE,IAAI,OAAA,sBAiBvC;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EALtB,MAKsB,EAAE,QAAQ,GAJhC,MAIqC,GAFnC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAAC,CA+BhD;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EALvB,MAKuB,EAAE,QAAQ,GAJjC,MAIsC,GAFpC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CA8BlD;AAwDD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB;;;;;;;;;cAsBlC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAH1B,MAG0B;;;;;cAgBpC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAH1B,MAG0B;;;;;cAiBpC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB,GAFtB,MAAM,CAkBlB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB;;;;;cAejC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB;;;;;cAelC;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAHtB,MAGsB;;;;cAahC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAHzB,MAGyB;;;;cAanC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB;;;;cAalC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,QAAA,EAAE,IAAI,OAAA,sBAExC;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB,MAAM,EAAE,CAqCpB;AA6CD;;GAEG;AACH,wBAAgB,iBAAiB,YAiBhC;AAED;;GAEG;AACH,wBAAgB,cAAc,YAO7B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,QAAA,EAAE,QAAQ,QAAA,WA0BvD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,QAAA,EAAE,QAAQ,QAAA,WA8GnD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,QAAA,UA8B3C;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,QAAA,UA8B9C;AASD;;;;GAIG;AACH,wBAAgB,gBAAgB,YAgB/B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAH/B,MAG+B,GAF7B,MAAM,CAWlB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,KAAA,EAAE,aAAa,KAAA,EAAE,QAAQ,KAAA,WAuC3E;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,KAAA,EAAE,QAAQ,KAAA;;;;;;EA2HvD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,KAAA,EAAE,cAAc,KAAA,WA2D7D;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,KAAA,EACb,WAAW,KAAA,EACX,aAAa,KAAA,EACb,QAAQ,KAAA,GANG,OAAO,CA+MnB;AAmDD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,EAAE,QAAQ,GAHxC,MAG6C,GAF3C,KAAK,CAAC,MAAM,CAAC,CAmDzB;AAyDD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,EAAE,UAAU,EAH1C,MAG0C,GAFxC,MAAM,CA6FlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,GAAG,EANnB,MAMmB,EAAE,OAAO,AALpC,CAGA,EAFA;IAAyB,GAAG,AAA5B,CACA,EADQ,MAAM,CACd;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;CAEyC,GAF/B,KAAK,CAAC,MAAM,CAAC,CA4CzB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,EAAE,QAAQ,GAHxC,MAG6C,GAF3C,KAAK,CAAC,MAAM,CAAC,CA+BzB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAFxB,MAAM,CA4GlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,WAUpC;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,IAF9B,MAAM,GAAC,SAAS,CAc5B"}

package/types/lib/inventory/evidenceUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evidenceUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/evidenceUtils.js"],"names":[],"mappings":"AA4BA;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,OAAO,AAHvD,CACA,EADQ,MAGoD,GAFlD,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,MAAM,GAAC,SAAS,CA8B5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAHxC,MAGwC,GAFtC,MAAM,CAalB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAJ1B,MAAM,EAAE,GAAC,MAIiB,EAAE,SAAS,UAAA,GAFnC,MAAM,EAAE,CAmDpB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAAM,GAAC,MAAM,EAIoB,EAAE,QAAQ,EAH3C,MAAM,EAGqC,GAFzC,MAAM,GAAC,MAAM,EAAE,CAwB3B;AAsCD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAJjC,MAAM,EAI2B,EAAE,UAAU,EAH7C,MAG6C,GAF3C,MAAM,EAAE,CAsNpB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EANJ,MAMI,EACb,QAAQ,EANC,MAMD,EACR,OAAO,OAAA,EACP,OAAO,UAAQ,EACf,gBAAgB,YAAY;;;;;;;;;IA6H7B"}
+{"version":3,"file":"evidenceUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/evidenceUtils.js"],"names":[],"mappings":"AA6BA;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,OAAO,AAHvD,CACA,EADQ,MAGoD,GAFlD,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,MAAM,GAAC,SAAS,CA8B5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAHxC,MAGwC,GAFtC,MAAM,CAalB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAJ1B,MAAM,EAAE,GAAC,MAIiB,EAAE,SAAS,UAAA,GAFnC,MAAM,EAAE,CAmDpB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAAM,GAAC,MAAM,EAIoB,EAAE,QAAQ,EAH3C,MAAM,EAGqC,GAFzC,MAAM,GAAC,MAAM,EAAE,CAwB3B;AAsCD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAJjC,MAAM,EAI2B,EAAE,UAAU,EAH7C,MAG6C,GAF3C,MAAM,EAAE,CAkOpB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EANJ,MAMI,EACb,QAAQ,EANC,MAMD,EACR,OAAO,OAAA,EACP,OAAO,UAAQ,EACf,gBAAgB,YAAY;;;;;;;;;IA6H7B"}

package/types/lib/inventory/fetchBatch.d.ts

@@ -95,6 +95,49 @@ export declare function prefetchJson(requests: Array<{
 }>, options?: {
     timeoutMs?: number;
 }): Promise<Map<string, BatchEntry>>;
+/**
+ * Whether a hostname belongs to crates.io, including its index and CDN hosts.
+ *
+ * @param {string|null} host Hostname, or null when the URL did not parse.
+ * @returns {boolean}
+ */
+export declare function isCratesHost(host: string | null): boolean;
+/**
+ * Whether a host's rate policy lives in the JS table alone and therefore needs
+ * every request to pass through the one gate the JS pool holds.
+ *
+ * @param {string|null} host Hostname, or null when the URL did not parse.
+ * @returns {boolean}
+ */
+export declare function isSingleGateHost(host: string | null): boolean;
+/**
+ * Record the run-level policy or connectivity condition carried by a caught
+ * fetch error, if it names one. Shared by the batch retry loop and by the
+ * serial enrichment paths that catch and swallow the same typed errors.
+ *
+ * @param {Error} err Error caught from a `cdxgenAgent` request.
+ * @returns {void}
+ */
+export declare function recordPolicyDegradationFromError(err: Error): void;
+/**
+ * Run a caller's own request under the same per-host gate the batch pool uses.
+ *
+ * Not every registry lookup goes through the pool: a caller that misses the
+ * prefetch, or runs with prefetching disabled, issues `cdxgenAgent.get`
+ * directly. Those requests reach the same host and count against the same
+ * published budget, so they have to queue behind the same limiter rather than
+ * a second one — crates.io's one-request-per-second policy is not honoured by
+ * two independent gates that each allow one per second.
+ *
+ * The per-host semaphore and limiter are module state, so this shares one gate
+ * per host for the life of the process.
+ *
+ * @template T
+ * @param {string} url The URL about to be requested.
+ * @param {() => Promise<T>} issue Issues the request and resolves its result.
+ * @returns {Promise<T>} Whatever `issue` resolves to.
+ */
+export declare function withHostRateLimit<T>(url: string, issue: () => Promise<T>): Promise<T>;
 /**
  * Read a prefetched response, or signal that the caller should fetch it itself.
  *

package/types/lib/inventory/fetchBatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetchBatch.d.ts","sourceRoot":"","sources":["../../../lib/inventory/fetchBatch.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AA2EH;;;GAGG;AACH,wBAAgB,cAAc,IAHjB,MAAM,GAAC,IAAI,CAKvB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAFtB,OAAO,CASnB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,SAO1C;AAKE,YAAkB,UAAU,GAC5B;;;;IAAoB,EAAE,EAAX,OAAO,CAClB;;;;IAAe,IAAI,AAAnB,CACA,EADW,GAAC,CACZ;;;;IAAoB,MAAM,AAA1B,CACA,EADW,MAAM,CACjB;;;;;IAAqB,QAAQ,AAA7B,CAEF,EAFa,OAAO,CAEpB;CAAA,CAAA;AAoCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EARhC,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,CAAC,MAAM,GAAC,MAAM,GAAC,QAAQ,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAQnF,EAAE,OAAO,AANjD,CAEA,EADA;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;CAIsD,GAJ5C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAgC5C;AAifD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EARlC,GAAG,CAAC,MAAM,EAAE,UAAU,CAQY,EAAE,GAAG,EAPvC,MAOuC,GANrC;IAAC,IAAI,EAAE,GAAC,CAAA;CAAC,GAAC,SAAS,CAoB/B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,IAFlB,OAAO,CAOnB"}
+{"version":3,"file":"fetchBatch.d.ts","sourceRoot":"","sources":["../../../lib/inventory/fetchBatch.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AA8EH;;;GAGG;AACH,wBAAgB,cAAc,IAHjB,MAAM,GAAC,IAAI,CAKvB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAFtB,OAAO,CASnB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,SAO1C;AAKE,YAAkB,UAAU,GAC5B;;;;IAAoB,EAAE,EAAX,OAAO,CAClB;;;;IAAe,IAAI,AAAnB,CACA,EADW,GAAC,CACZ;;;;IAAoB,MAAM,AAA1B,CACA,EADW,MAAM,CACjB;;;;;IAAqB,QAAQ,AAA7B,CAEF,EAFa,OAAO,CAEpB;CAAA,CAAA;AAoCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EARhC,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,CAAC,MAAM,GAAC,MAAM,GAAC,QAAQ,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAQnF,EAAE,OAAO,AANjD,CAEA,EADA;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;CAIsD,GAJ5C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAgC5C;AAoCD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAHtB,MAAM,GAAC,IAGe,GAFpB,OAAO,CAQnB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAH1B,MAAM,GAAC,IAGmB,GAFxB,OAAO,CAOnB;AAqTD;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAHzC,KAGyC,GAFvC,IAAI,CAuBhB;AAqGD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,iBAAiB,CAL1B,CAAC,EAK0B,GAAG,EAJhC,MAIgC,EAAE,KAAK,EAHvC,MAAM,OAAO,CAAC,CAAC,CAGwB,GAFrC,OAAO,CAAC,CAAC,CAAC,CAiBtB;AAyFD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EARlC,GAAG,CAAC,MAAM,EAAE,UAAU,CAQY,EAAE,GAAG,EAPvC,MAOuC,GANrC;IAAC,IAAI,EAAE,GAAC,CAAA;CAAC,GAAC,SAAS,CAoB/B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,IAFlB,OAAO,CAOnB"}

package/types/lib/inventory/fetchRate.d.ts

@@ -2,18 +2,21 @@
  * Per-host rate policy for batched registry fetches.
  *
  * This is the single source of truth for the JS transport's concurrency and
- * minimum-interval decisions. The numbers are shared with the Rust transport
+ * minimum-interval decisions. Every number is shared with the Rust transport
  * (`cdxgen-plugins-bin/thirdparty/cdxrs/src/fetch/rate.rs`); a change to one
  * side must be reflected in the other, and `fetchRate.poku.js` pins them so a
- * drift is visible.
+ * drift is visible. crates.io and package.elm-lang.org are routed so that their
+ * requests never reach the Rust transport, which makes this table the one that
+ * governs them in practice — their rows are mirrored there regardless, because
+ * two tables that disagree are a bug waiting for the routing to change.
  *
  * Why a per-host table rather than a single global interval: a single-registry
  * project — which is to say, almost every npm project — has exactly one host,
  * so a conservative per-host cap *is* the global cap. Applying crates.io's
- * 250 ms to every host caps an npm run at 4 requests per second, which is
- * slower than the serial JS path once connection reuse is taken into account.
- * Hosts that publish a limit get an interval; hosts that do not are bounded by
- * the per-host concurrency cap alone, and by whatever `Retry-After` they send.
+ * one-per-second policy to every host would cap an npm run at one request a
+ * second, orders of magnitude slower than that registry asks for. Hosts that
+ * publish a limit get an interval; hosts that do not are bounded by the
+ * per-host concurrency cap alone, and by whatever `Retry-After` they send.
  */
 export type Credentials = ("anonymous" | "authenticated");
 export type HostPolicy = {

package/types/lib/inventory/fetchRate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetchRate.d.ts","sourceRoot":"","sources":["../../../lib/inventory/fetchRate.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAYA,YAAyC,WAAW,GAA1C,CAAC,WAAW,GAAC,eAAe,CAAC,CAAa;AAOpD,YAAkB,UAAU,GAC5B;;;;IAAmB,WAAW,EAAnB,MAAM,CACjB;;;;IAAmB,cAAc,EAAtB,MAAM,CACnB;CAAA,CAAA;AAsDD;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAHxB,MAGwB,GAFtB,WAAW,CAYvB;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,IAAI,EALnB,MAKmB,EAAE,WAAW,AAJxC,CAEA,EAFQ,WAIgC,GAF9B,UAAU,CAuBtB;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;;GAEjC,CAAC;AAEJ;;;;;;GAMG;AACH,qBAAa,WAAW;IAKf,YAAY;IACZ,cAAc;IACd,eAAe;IANtB;;OAEG;IACH,YAAY,WAAW,EAFZ,MAEY,EAItB;IAED;;;;;;OAMG;IACG,IAAI,IAFG,OAAO,CAAC,IAAI,CAAC,CAYzB;IAED;;;;;;OAMG;IACH,aAAa,CAAC,OAAO,EAFV,MAEU,QAMpB;IAED,wEAAwE;IACxE,IAAI,kBAAkB,IADR,MAAM,CAGnB;CACF;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAJxB,MAIwB,GAHtB;IAAC,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,IAAI,CAAC,CAAA;CAAC,CAwBhD"}
+{"version":3,"file":"fetchRate.d.ts","sourceRoot":"","sources":["../../../lib/inventory/fetchRate.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAYA,YAAyC,WAAW,GAA1C,CAAC,WAAW,GAAC,eAAe,CAAC,CAAa;AAOpD,YAAkB,UAAU,GAC5B;;;;IAAmB,WAAW,EAAnB,MAAM,CACjB;;;;IAAmB,cAAc,EAAtB,MAAM,CACnB;CAAA,CAAA;AAkHD;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAHxB,MAGwB,GAFtB,WAAW,CAYvB;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,IAAI,EALnB,MAKmB,EAAE,WAAW,AAJxC,CAEA,EAFQ,WAIgC,GAF9B,UAAU,CAuBtB;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;;GAEjC,CAAC;AAEJ;;;;;;GAMG;AACH,qBAAa,WAAW;IAKf,YAAY;IACZ,cAAc;IACd,eAAe;IANtB;;OAEG;IACH,YAAY,WAAW,EAFZ,MAEY,EAItB;IAED;;;;;;OAMG;IACG,IAAI,IAFG,OAAO,CAAC,IAAI,CAAC,CAYzB;IAED;;;;;;OAMG;IACH,aAAa,CAAC,OAAO,EAFV,MAEU,QAMpB;IAED,wEAAwE;IACxE,IAAI,kBAAkB,IADR,MAAM,CAGnB;CACF;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAJxB,MAIwB,GAHtB;IAAC,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,IAAI,CAAC,CAAA;CAAC,CAwBhD"}

package/types/lib/inventory/forgeEnricher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forgeEnricher.d.ts","sourceRoot":"","sources":["../../../lib/inventory/forgeEnricher.js"],"names":[],"mappings":"AAiDA;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,IAAI,CAa9C;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAL9B,MAK8B,EAAE,SAAS,EAJzC,KAAK,CAAC,MAAM,CAI6B,EAAE,OAAO,GAHlD,MAGuD,GAFrD,OAAO,CAAC,MAAM,CAAC,CA4M3B"}
+{"version":3,"file":"forgeEnricher.d.ts","sourceRoot":"","sources":["../../../lib/inventory/forgeEnricher.js"],"names":[],"mappings":"AAkDA;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,IAAI,CAa9C;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAL9B,MAK8B,EAAE,SAAS,EAJzC,KAAK,CAAC,MAAM,CAI6B,EAAE,OAAO,GAHlD,MAGuD,GAFrD,OAAO,CAAC,MAAM,CAAC,CA4M3B"}