@cdxgen/cdxgen 13.0.1 → 13.2.0

package/types/lib/inventory/jvmToolEnv.d.ts

@@ -0,0 +1,190 @@
+import { compareVersions, extractJavaMajor, isPrereleaseVersion } from "./toolRequirements.js";
+/**
+ * The general-purpose version comparator, prerelease classifier, and JDK
+ * major extractor live in `toolRequirements.js` so every ecosystem shares one
+ * comparator; they are re-exported here under the names this module's
+ * consumers already use.
+ */
+export { compareVersions as compareSdkmanVersions, extractJavaMajor, isPrereleaseVersion, };
+/**
+ * Anchored validator for sdkman version identifiers such as `3.9.9`,
+ * `4.0.0-rc-5`, `8.14`, `21.0.7-tem`, or `26.0.2+1.1-tem`. Versions are
+ * interpolated into a shell command by the sdkman installer, so every
+ * identifier must be a single safe token: it must start with a digit and may
+ * only contain digits, ascii letters, dots, hyphens, and plus signs (`+` has
+ * no shell meaning and sdkman uses it in Temurin respin identifiers).
+ *
+ * Every separator must be followed by at least one alphanumeric character, and
+ * a single repeated group covers both the dotted numeric part and the vendor
+ * or prerelease suffix. That leaves each character exactly one role, so the
+ * pattern matches in linear time on untrusted input.
+ *
+ * @param {string} version Candidate version identifier
+ * @returns {boolean} True when the identifier is safe to pass to sdkman
+ */
+export declare function isValidSdkmanVersion(version: string): boolean;
+/**
+ * Parse a versioned JVM build tool project type such as `maven3.9.9`,
+ * `mvn3.9.9`, `gradle8.14`, `sbt1.10`, or `scala3.6.4` into its sdkman
+ * candidate name and version token.
+ *
+ * The returned object distinguishes between a syntactically valid pin and a
+ * rejected one so callers can print a precise CLI error instead of silently
+ * ignoring the type.
+ *
+ * @param {string} projectType Project type argument from the CLI
+ * @returns {Object|undefined} `{ tool, version, valid }` when the type looks
+ *   like a versioned JVM build tool, `undefined` otherwise. `valid` is false
+ *   when the version token fails validation.
+ */
+export declare function parseJvmToolProjectType(projectType: string): Object | undefined;
+/**
+ * Parse a `.sdkmanrc` environment file into the sdkman candidates it pins.
+ * Only the JVM-related candidates cdxgen knows how to provision are kept;
+ * unknown keys are ignored so newer sdkman files remain readable. Malformed
+ * lines are skipped instead of aborting the whole file.
+ *
+ * @param {string} filePath Project directory that may contain a `.sdkmanrc`
+ * @returns {Object|undefined} Map of candidate name to exact version
+ *   identifier, or `undefined` when the file is missing or unreadable.
+ */
+export declare function parseSdkmanrc(filePath: string): Object | undefined;
+/**
+ * Read the version pinned by a Gradle wrapper's `gradle-wrapper.properties`.
+ * The `distributionUrl` value may escape colons as `\:` per the Java
+ * properties format; the escapes are removed before parsing.
+ *
+ * @param {string} rootPath Directory holding the `gradle/wrapper` folder
+ * @returns {Object|undefined} `{ version, distributionUrl, distributionSha256Sum? }`
+ *   or `undefined` when the wrapper is missing or unparsable.
+ */
+export declare function readGradleWrapperVersion(rootPath: string): Object | undefined;
+/**
+ * Read the version pinned by a Maven wrapper's `maven-wrapper.properties`.
+ * Legacy wrappers (pre wrapper-distribution downloads) lack a
+ * `distributionUrl` and are treated as unpinned.
+ *
+ * @param {string} rootPath Directory holding the `.mvn/wrapper` folder
+ * @returns {Object|undefined} `{ version, distributionUrl }` or `undefined`
+ *   when the wrapper is missing or unpinned.
+ */
+export declare function readMavenWrapperVersion(rootPath: string): Object | undefined;
+/**
+ * Read the sbt version declared in `project/build.properties`. Kept here as a
+ * small properties-file read so environment preparation does not depend on
+ * higher layers.
+ *
+ * @param {string} projectPath SBT project directory
+ * @returns {string|undefined} Declared sbt version, when present and valid.
+ */
+export declare function readSbtBuildPropertiesVersion(projectPath: string): string | undefined;
+/**
+ * Minimum JDK major version required to run each build tool, keyed by the
+ * tool's major version line. Versions absent from the table fall back to the
+ * tool's `default` entry.
+ *
+ * Sources: Maven release history (maven.apache.org/docs/history.html), the
+ * Gradle compatibility table (docs.gradle.org), and the sbt setup notes.
+ *
+ * @type {Object<string, Object<number, number>|number>}
+ */
+export declare const TOOL_JDK_REQUIREMENTS: Record<string, number | Record<number, number>>;
+/**
+ * Minimum Gradle version that supports a given JDK major, for the
+ * combinations where running an older Gradle on a newer JDK is known to fail.
+ * Used to warn instead of guess-installing when the environment contradicts
+ * the project's Gradle pin.
+ *
+ * @type {Object<number, string>}
+ */
+export declare const GRADLE_JAVA_CAPS: Record<number, string>;
+/** JDK major that satisfies every current build tool minimum. */
+export declare const DEFAULT_JAVA_MAJOR = 21;
+/**
+ * Look up the minimum JDK major required to run a tool version.
+ *
+ * @param {string} tool Tool name (maven, gradle, sbt, scala)
+ * @param {string} version Tool version identifier
+ * @returns {number|undefined} Minimum JDK major, when known.
+ */
+export declare function minimumJdkForToolVersion(tool: string, version: string): number | undefined;
+/**
+ * Compute the highest JDK major required across a set of tool pins.
+ *
+ * @param {Array<{tool: string, version: string}>} toolPins Pinned tools
+ * @returns {number|undefined} Highest required JDK major, when any pin maps.
+ */
+export declare function determineRequiredJavaVersion(toolPins: Array<{
+    tool: string;
+    version: string;
+}>): number | undefined;
+/**
+ * Minimum Gradle version that can run on the given JDK major, when such a cap
+ * is known.
+ *
+ * @param {number} javaMajor JDK major version
+ * @returns {string|undefined} Minimum Gradle version, when capped.
+ */
+export declare function minimumGradleVersionForJava(javaMajor: number): string | undefined;
+/**
+ * Collect the version tokens printed by `sdk list <candidate>`. The output is
+ * a fixed-width table whose cells may carry `+`, `*`, or `>` status markers;
+ * every token that passes the sdkman version validator is kept, which
+ * naturally drops banners, legends, and shell noise.
+ *
+ * @param {string} stdout Raw `sdk list` output
+ * @returns {string[]} Version identifiers found in the output.
+ */
+export declare function extractSdkListVersions(stdout: string): string[];
+/**
+ * Resolve a partial version prefix such as `3.9` or `8.14` to the newest
+ * matching version in `sdk list` output. Stable versions are preferred unless
+ * the requested prefix itself is a prerelease.
+ *
+ * @param {string} stdout Raw `sdk list <candidate>` output
+ * @param {string} prefix Partial or exact version prefix; empty matches all
+ * @returns {string|undefined} Best matching version identifier.
+ */
+export declare function resolvePartialVersion(stdout: string, prefix: string): string | undefined;
+/**
+ * Environment variable hints that carry a tool version, used by container
+ * images and CI setups to describe the preinstalled JVM toolchain.
+ *
+ * @type {Object<string, string>}
+ */
+export declare const JVM_TOOL_VERSION_ENV_HINTS: Record<string, string>;
+/**
+ * Environment variable overrides that declare the sdkman version to use for
+ * a tool, mirroring the existing `JAVA<NN>_TOOL` pattern.
+ *
+ * @type {Object<string, string>}
+ */
+export declare const JVM_TOOL_VERSION_OVERRIDES: Record<string, string>;
+/**
+ * Read the `MAVEN_TOOL`/`GRADLE_TOOL`/`SBT_TOOL`/`SCALA_TOOL` override for a
+ * tool, when set to a valid sdkman version identifier.
+ *
+ * @param {string} tool Tool name
+ * @returns {string|undefined} Overridden version identifier.
+ */
+export declare function readToolVersionOverride(tool: string): string | undefined;
+/**
+ * Read the container/CI version hint (`MAVEN_VERSION` etc.) for a tool, when
+ * set to a valid sdkman version identifier.
+ *
+ * @param {string} tool Tool name
+ * @returns {string|undefined} Hinted version identifier.
+ */
+export declare function readToolVersionEnvHint(tool: string): string | undefined;
+/**
+ * Detect the JDK major a project asks for from its build files: Gradle
+ * toolchain declarations (`JavaLanguageVersion.of(N)`) and Maven compiler or
+ * enforcer properties (`maven.compiler.release`, `maven.compiler.source`,
+ * `requireJavaVersion`). The scan is intentionally line-based and
+ * conservative: it only recognises whole-number values.
+ *
+ * @param {string} projectPath Project directory
+ * @returns {number|undefined} JDK major requested by the project.
+ */
+export declare function detectProjectJavaMajor(projectPath: string): number | undefined;
+//# sourceMappingURL=jvmToolEnv.d.ts.map

package/types/lib/inventory/jvmToolEnv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jvmToolEnv.d.ts","sourceRoot":"","sources":["../../../lib/inventory/jvmToolEnv.js"],"names":[],"mappings":"AAMA,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,uBAAuB,CAAC;AAE/B;;;;;GAKG;AACH,OAAO,EACL,eAAe,IAAI,qBAAqB,EACxC,gBAAgB,EAChB,mBAAmB,GACpB,CAAC;AAuBF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAHjC,MAGiC,GAF/B,OAAO,CASnB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EALxC,MAKwC,GAJtC,MAAM,GAAC,SAAS,CAmB5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAJ3B,MAI2B,GAHzB,MAAM,GAAC,SAAS,CA4C5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,GAHpC,MAAM,GAAC,SAAS,CAwC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAJrC,MAIqC,GAHnC,MAAM,GAAC,SAAS,CAgC5B;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAH9C,MAG8C,GAF5C,MAAM,GAAC,SAAS,CAkB5B;AAsDD;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,iDAKjC,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,wBAM5B,CAAC;AAEF,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAH1C,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAGK,GAFxC,MAAM,GAAC,SAAS,CAc5B;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAH1C,MAG0C,GAFxC,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAHlC,MAGkC,GAFhC,MAAM,EAAE,CAgBpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAJjC,MAIiC,EAAE,MAAM,EAHzC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAwB5B;AAED;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,wBAKtC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,wBAKtC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAHjC,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAS5B;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAHhC,MAGgC,GAF9B,MAAM,GAAC,SAAS,CAS5B;AASD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAHvC,MAGuC,GAFrC,MAAM,GAAC,SAAS,CAuB5B"}

package/types/lib/inventory/mcpConfigParser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcpConfigParser.d.ts","sourceRoot":"","sources":["../../../lib/inventory/mcpConfigParser.js"],"names":[],"mappings":"AAknBA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,EAFlB;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAC,CAAA;CA+C9H,CAAC"}
+{"version":3,"file":"mcpConfigParser.d.ts","sourceRoot":"","sources":["../../../lib/inventory/mcpConfigParser.js"],"names":[],"mappings":"AAoxBA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,EAFlB;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAC,CAAA;CAiD9H,CAAC"}

package/types/lib/inventory/mcpDiscovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcpDiscovery.d.ts","sourceRoot":"","sources":["../../../lib/inventory/mcpDiscovery.js"],"names":[],"mappings":"AAkBA;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAH9B,MAG8B,GAF5B,MAAM,CAiBlB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAHzB,MAGyB,GAFvB,OAAO,CA8BnB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B,MAAM,EAAE,CAUpB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAHrC,MAGqC,GAFnC,MAAM,EAAE,CAUpB"}
+{"version":3,"file":"mcpDiscovery.d.ts","sourceRoot":"","sources":["../../../lib/inventory/mcpDiscovery.js"],"names":[],"mappings":"AA6BA;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAH9B,MAG8B,GAF5B,MAAM,CAiBlB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAHzB,MAGyB,GAFvB,OAAO,CA8BnB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B,MAAM,EAAE,CAUpB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAHrC,MAGqC,GAFnC,MAAM,EAAE,CAUpB"}

package/types/lib/inventory/mcpServerManifest.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Parser for MCP Registry server manifests (`server.json`).
+ *
+ * Converts each declared distributable package into a CycloneDX component
+ * (with a purl when the registry type maps to a supported ecosystem) and each
+ * remotely hosted endpoint into a service, alongside a file component that
+ * summarizes the manifest.
+ *
+ * @type {{id: string, patterns: string[], parse(files: string[], options?: Object): {components: Object[], services: Object[]}}}
+ */
+export declare const mcpServerManifestParser: {
+    id: string;
+    patterns: string[];
+    parse(files: string[], options?: Object): {
+        components: Object[];
+        services: Object[];
+    };
+};
+//# sourceMappingURL=mcpServerManifest.d.ts.map

package/types/lib/inventory/mcpServerManifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpServerManifest.d.ts","sourceRoot":"","sources":["../../../lib/inventory/mcpServerManifest.js"],"names":[],"mappings":"AAsTA;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,EAF1B;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAC,CAAA;CAsE9H,CAAC"}

package/types/lib/inventory/mcpbBundle.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Parser for MCPB / DXT desktop-extension bundles.
+ *
+ * A bundle is a zip archive carrying a local MCP server, its dependencies, and
+ * a `manifest.json`. This parser reads only the manifest to describe the
+ * bundled server, the tools/prompts it exposes, the number of precompiled
+ * platform binaries, and whether it injects secret-typed configuration values
+ * as environment variables.
+ *
+ * @type {{id: string, patterns: string[], parse(files: string[], options?: Object): {components: Object[]}}}
+ */
+export declare const mcpbBundleParser: {
+    id: string;
+    patterns: string[];
+    parse(files: string[], options?: Object): {
+        components: Object[];
+    };
+};
+//# sourceMappingURL=mcpbBundle.d.ts.map

package/types/lib/inventory/mcpbBundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpbBundle.d.ts","sourceRoot":"","sources":["../../../lib/inventory/mcpbBundle.js"],"names":[],"mappings":"AAgYA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,EAFnB;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAC,CAAA;CAyB1G,CAAC"}

package/types/lib/inventory/osinfo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"osinfo.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osinfo.js"],"names":[],"mappings":"AAGA;;;GAGG;AACH,eAAO,MAAM,eAAe;IAC1B,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,WAAW;IACX,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,UAAU;IACV,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,0BAA0B;IAC1B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,6BAA6B;CAC9B,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB;IAC7B,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,EAAE;IACF,eAAe;IACf,qBAAqB;IACrB,IAAI;IACJ,aAAa;CACd,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,yBAAyB;IACpC,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,EAAE;IACF,IAAI;IACJ,aAAa;CACd,CAAC;AASF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAHrC,MAGqC,GAFnC,OAAO,CAInB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,CAYlB;AAQD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAJ/B,CAEA,EAFQ,MAI6B,GAF3B,MAAM,CAqClB;AAGD;;GAEG;AACH,wBAAgB,oBAAoB,SAEnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAH/B,CACA,EADQ,MAG6B,GAF3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAiHzF"}
+{"version":3,"file":"osinfo.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osinfo.js"],"names":[],"mappings":"AAGA;;;GAGG;AACH,eAAO,MAAM,eAAe;IAC1B,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,WAAW;IACX,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,UAAU;IACV,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,0BAA0B;IAC1B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,6BAA6B;CAC9B,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB;IAC7B,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,EAAE;IACF,eAAe;IACf,qBAAqB;IACrB,IAAI;IACJ,aAAa;CACd,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,yBAAyB;IACpC,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,EAAE;IACF,IAAI;IACJ,aAAa;CACd,CAAC;AASF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAHrC,MAGqC,GAFnC,OAAO,CAInB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,CAYlB;AAQD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAJ/B,CAEA,EAFQ,MAI6B,GAF3B,MAAM,CAqClB;AAGD;;GAEG;AACH,wBAAgB,oBAAoB,SAEnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAH/B,CACA,EADQ,MAG6B,GAF3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAkHzF"}

package/types/lib/inventory/plugins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugins.d.ts","sourceRoot":"","sources":["../../../lib/inventory/plugins.js"],"names":[],"mappings":"AA+CA;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAC,CAgCpF;AA8DD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,IAXvB;IACR,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,GAAC,SAAS,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,GAAC,SAAS,CAAC;IACrC,aAAa,EAAE,MAAM,GAAC,SAAS,CAAC;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB,CAqMH;AAYD;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAF1B,UAAU,CAAC,OAAO,oBAAoB,CAAC,CASnD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,AAH5C,CACA,EADQ,UAAU,CAAC,OAAO,oBAAoB,CAGU,GAF9C,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAWnD;AAwDD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAIiC,EAAE,aAAa,AAHxD,CACA,EADQ,UAAU,CAAC,OAAO,oBAAoB,CAGsB,GAF1D,MAAM,GAAC,SAAS,CAS5B"}
+{"version":3,"file":"plugins.d.ts","sourceRoot":"","sources":["../../../lib/inventory/plugins.js"],"names":[],"mappings":"AAiDA;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAC,CAgCpF;AA8DD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,IAXvB;IACR,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,GAAC,SAAS,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,GAAC,SAAS,CAAC;IACrC,aAAa,EAAE,MAAM,GAAC,SAAS,CAAC;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB,CAqMH;AAYD;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAF1B,UAAU,CAAC,OAAO,oBAAoB,CAAC,CASnD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,AAH5C,CACA,EADQ,UAAU,CAAC,OAAO,oBAAoB,CAGU,GAF9C,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAWnD;AAwDD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAIiC,EAAE,aAAa,AAHxD,CACA,EADQ,UAAU,CAAC,OAAO,oBAAoB,CAGsB,GAF1D,MAAM,GAAC,SAAS,CAS5B"}

package/types/lib/inventory/protobom.d.ts

@@ -1,6 +1,12 @@
+import { isProtoBomFile } from "@cdxgen/cdx-proto/node";
+export { isProtoBomFile };
 /**
  * Determine whether a spec version is supported for protobuf serialization.
  *
+ * Delegates to cdx-proto's `isSupportedSpecVersion`, which accepts the
+ * spellings seen in the wild (`v1.6`, `1.6`, `1.6.0`) in addition to the
+ * canonical strings.
+ *
  * @param {string|undefined} specVersion CycloneDX spec version string
  * @returns {boolean} `true` when supported by `@cdxgen/cdx-proto`, or when no spec version is provided
  */
@@ -16,13 +22,6 @@ export declare const isProtoSupportedSpecVersion: (specVersion: string | undefin
  * @param {string} [operation="protobuf operations"] Operation label used in the error message
  */
 export declare const assertProtoSupportedSpecVersion: (specVersion: string | undefined, operation?: string) => void;
-/**
- * Determine whether a path looks like a CycloneDX protobuf file.
- *
- * @param {string} filePath File path
- * @returns {boolean} true when the path looks like a protobuf BOM file
- */
-export declare const isProtoBomFile: (filePath: string) => boolean;
 /**
  * Method to convert the given bom json to proto binary
  *
@@ -51,13 +50,19 @@ export declare const getBomStats: (bomJson: string | Object, specVersion?: strin
  * Method to cross-convert a BOM between CycloneDX specification versions using
  * the protobuf schemas.
  *
- * Downgrades are lossy: fields that the target version does not define are
- * dropped and reported in `warnings` as field paths.
+ * cdx-proto's conversion is cardinality-safe: fields that change shape between
+ * versions (`metadata.licenses` and `evidence.identity`, singular in 1.5 and an
+ * array since 1.6) are reshaped automatically — wrapped on upgrade, collapsed
+ * to their first entry on downgrade — including `evidence.identity` on nested
+ * components, `metadata.component`, `metadata.tools.components[]`, and
+ * `formulation[].components[]`. Downgrades are otherwise lossy: fields the
+ * target version does not define are dropped and reported in `warnings` as
+ * field paths, alongside collapsed list siblings.
  *
- * This is the raw `@cdxgen/cdx-proto` conversion. It reshapes nothing that the
- * two schemas model with different cardinality, so a BOM crossing the 1.5/1.6
- * `evidence.identity` boundary must be normalized first. Prefer
- * `applySpecVersionCompatibility` from the postgen stage for that.
+ * Only the protobuf-supported versions (1.5–1.7) can be targeted here. For the
+ * full JSON-level normalization across every version cdxgen emits (component
+ * types, license attributes, 1.4/2.0 reshaping), prefer
+ * `applySpecVersionCompatibility` from the postgen stage.
  *
  * @param {string | Object} bomJson BOM Json, BOM Json string, or proto message
  * @param {string | number} targetSpecVersion Target CycloneDX spec version

package/types/lib/inventory/protobom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protobom.d.ts","sourceRoot":"","sources":["../../../lib/inventory/protobom.js"],"names":[],"mappings":"AAiEA;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,gBAH7B,MAAM,GAAC,SAAS,KACd,OAWZ,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,gBAHjC,MAAM,GAAC,SAAS,cAChB,MAAM,SAiBhB,CAAC;AA4BF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,aAHhB,MAAM,KACJ,OAOZ,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAJb,MAAM,GAAG,MAAM,WACf,MAAM,gBACN,MAAM,GAAG,MAAM,SAWzB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,YAJZ,MAAM,UACN,OAAO,gBACP,MAAM,GAAG,MAAM,4FAiBzB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAJb,MAAM,GAAG,MAAM,gBACf,MAAM,GAAG,MAAM,KACb,MAGsC,CAAC;AAEpD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,qBAAqB,YALvB,MAAM,GAAG,MAAM,qBACf,MAAM,GAAG,MAAM,gBACf,MAAM,GAAG,MAAM,KACb;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAehD,CAAC"}
+{"version":3,"file":"protobom.d.ts","sourceRoot":"","sources":["../../../lib/inventory/protobom.js"],"names":[],"mappings":"AAaA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAIxD,OAAO,EAAE,cAAc,EAAE,CAAC;AAsB1B;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,gBAH7B,MAAM,GAAC,SAAS,KACd,OAGgE,CAAC;AAE9E;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,gBAHjC,MAAM,GAAC,SAAS,cAChB,MAAM,SAYhB,CAAC;AAgCF;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAJb,MAAM,GAAG,MAAM,WACf,MAAM,gBACN,MAAM,GAAG,MAAM,SAezB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,YAJZ,MAAM,UACN,OAAO,gBACP,MAAM,GAAG,MAAM,4FAiBzB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAJb,MAAM,GAAG,MAAM,gBACf,MAAM,GAAG,MAAM,KACb,MAKV,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,qBAAqB,YALvB,MAAM,GAAG,MAAM,qBACf,MAAM,GAAG,MAAM,gBACf,MAAM,GAAG,MAAM,KACb;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAahD,CAAC"}

package/types/lib/inventory/protobomLoader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protobomLoader.d.ts","sourceRoot":"","sources":["../../../lib/inventory/protobomLoader.js"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,OAAO,CAOnB;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,AALV,CACA,EADQ,MAKa,EACtB,kBAAkB,AALjB,CACA,EADQ,MAK8B,GAJ5B,OAAO,CAAC,MAAM,CAAC,CAqB3B"}
+{"version":3,"file":"protobomLoader.d.ts","sourceRoot":"","sources":["../../../lib/inventory/protobomLoader.js"],"names":[],"mappings":"AAMA;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,OAAO,CAOnB;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,AALV,CACA,EADQ,MAKa,EACtB,kBAAkB,AALjB,CACA,EADQ,MAK8B,GAJ5B,OAAO,CAAC,MAAM,CAAC,CAqB3B"}

package/types/lib/inventory/source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../lib/inventory/source.js"],"names":[],"mappings":"AAmCA,6FAA6F;AAC7F,eAAO,MAAM,4BAA4B,wIAC8F,CAAC;AAExI,6DAA6D;AAC7D,eAAO,MAAM,2BAA2B,UAWvC,CAAC;AAuBF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAAM,GAAC,SAGsB,GAF3B,OAAO,CAUnB;AAiBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAL5B,MAAM,EAKsB,EAAE,OAAO,GAH7C;IAAkC,GAAG,EAA7B,MAAM,GAAC,SAAS,CACxB;CAEkD,GAFxC,MAAM,CAuClB;AA+ED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAAM,GAAC,SAI+B,EAAE,OAAO,GAH/C,MAGoD,GAFlD,MAAM,GAAC,SAAS,CA6I5B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,CASlB;AAkBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,OAAO,CAWnB;AAkBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAHvB,MAGuB,GAFrB,OAAO,CA+BnB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAHpB,MAGoB,GAFlB,OAAO,CAyBnB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAHxC,MAGwC,GAFtC,MAAM,GAAC,IAAI,CAgEvB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAJrB,MAIqB,EAAE,MAAM,GAH7B,MAAM,GAAC,MAAM,EAAE,GAAC,IAGoB,GAFlC,MAAM,CAyDlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAAM,GAAC,SAGgC,GAFrC,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAJrC,MAIqC,EAAE,cAAc,EAHrD,MAAM,GAAC,SAG8C,GAFnD,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAJtC,MAIsC,EAAE,cAAc,EAHtD,MAAM,GAAC,SAG+C,GAFpD,MAAM,GAAC,SAAS,CAiF5B;AAoHD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAGkC,GAFhC;IAAC,MAAM,EAAC,MAAM,CAAC;IAAA,KAAK,EAAC,MAAM,CAAC;IAAA,OAAO,EAAC,MAAM,CAAA;CAAC,GAAC,IAAI,CA8D5D;AA6GD;;GAEG;AACH,wBAAgB,yBAAyB,SAExC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,WAAW,EAJ5C,KAAK,CAAC,MAAM,CAIgC,GAF1C,OAAO,CAAC,IAAI,CAAC,CA6BzB;AAyDD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CA4MlI;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAF5B,MAE4B,QAkCtC"}
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../lib/inventory/source.js"],"names":[],"mappings":"AAoCA,6FAA6F;AAC7F,eAAO,MAAM,4BAA4B,wIAC8F,CAAC;AAExI,6DAA6D;AAC7D,eAAO,MAAM,2BAA2B,UAWvC,CAAC;AAuBF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAAM,GAAC,SAGsB,GAF3B,OAAO,CAUnB;AAiBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAL5B,MAAM,EAKsB,EAAE,OAAO,GAH7C;IAAkC,GAAG,EAA7B,MAAM,GAAC,SAAS,CACxB;CAEkD,GAFxC,MAAM,CAuClB;AA+ED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAAM,GAAC,SAI+B,EAAE,OAAO,GAH/C,MAGoD,GAFlD,MAAM,GAAC,SAAS,CA6I5B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,CASlB;AAkBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,OAAO,CAWnB;AAkBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAHvB,MAGuB,GAFrB,OAAO,CA+BnB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAHpB,MAGoB,GAFlB,OAAO,CAyBnB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAHxC,MAGwC,GAFtC,MAAM,GAAC,IAAI,CAgEvB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAJrB,MAIqB,EAAE,MAAM,GAH7B,MAAM,GAAC,MAAM,EAAE,GAAC,IAGoB,GAFlC,MAAM,CAyDlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAAM,GAAC,SAGgC,GAFrC,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAJrC,MAIqC,EAAE,cAAc,EAHrD,MAAM,GAAC,SAG8C,GAFnD,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAJtC,MAIsC,EAAE,cAAc,EAHtD,MAAM,GAAC,SAG+C,GAFpD,MAAM,GAAC,SAAS,CAiF5B;AAoHD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAGkC,GAFhC;IAAC,MAAM,EAAC,MAAM,CAAC;IAAA,KAAK,EAAC,MAAM,CAAC;IAAA,OAAO,EAAC,MAAM,CAAA;CAAC,GAAC,IAAI,CA8D5D;AA6GD;;GAEG;AACH,wBAAgB,yBAAyB,SAExC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,WAAW,EAJ5C,KAAK,CAAC,MAAM,CAIgC,GAF1C,OAAO,CAAC,IAAI,CAAC,CA6BzB;AA8DD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CA4MlI;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAF5B,MAE4B,QAkCtC"}

package/types/lib/inventory/stylePackageRefs.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Patterns matching a package reference inside CSS/SCSS/Less/Stylus content.
+ * Capture group 1 holds the reference (for example `bulma/sass/utilities`).
+ *
+ * @type {RegExp[]}
+ */
+export declare const STYLE_PACKAGE_REFERENCE_PATTERNS: RegExp[];
+/**
+ * True when a `url()` reference points at a package rather than a local file.
+ * Only the `~package/...` and `node_modules/...` spellings qualify; plain
+ * relative URLs stay local.
+ *
+ * @param {string} reference Value captured from a `url()` rule.
+ * @returns {boolean}
+ */
+export declare const isPackageStyleUrlReference: (reference: string) => boolean;
+//# sourceMappingURL=stylePackageRefs.d.ts.map

package/types/lib/inventory/stylePackageRefs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stylePackageRefs.d.ts","sourceRoot":"","sources":["../../../lib/inventory/stylePackageRefs.js"],"names":[],"mappings":"AAaA;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,EAFnC,MAAM,EAKf,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,cAH5B,MAAM,KACJ,OAUZ,CAAC"}

package/types/lib/inventory/svelteUtils.d.ts

@@ -0,0 +1,124 @@
+/**
+ * Build a same-length masked buffer of a `.svelte` source where every byte
+ * outside the `<script>` / `<script module>` / `<script context="module">`
+ * bodies is replaced by a space (newlines preserved). Because nothing moves,
+ * the Babel parse of the buffer yields statement offsets and `loc.line`
+ * values that are true to the original file.
+ *
+ * Handles multiple script blocks, arbitrary attribute order, self-closing and
+ * unterminated tags, CRLF input, and a script block appearing after the
+ * markup.
+ *
+ * @param {string} source `.svelte` file content.
+ * @returns {string} Same-length buffer containing only the script bodies.
+ */
+export declare const maskSvelteScripts: (source: string) => string;
+/**
+ * The `lang` attribute values of the `<script>` blocks, lowercased.
+ *
+ * @param {string} source `.svelte` file content.
+ * @returns {string[]}
+ */
+export declare const extractSvelteScriptLanguages: (source: string) => string[];
+/**
+ * Collect `<style>` block facts: the block's `lang` and the package
+ * references found in its `@use` / `@import` / `@forward` / `url()` rules.
+ * Reference offsets are absolute indices into the original source so callers
+ * can derive line numbers.
+ *
+ * @param {string} source `.svelte` file content.
+ * @returns {Array<{lang: string|undefined, start: number, references: Array<{reference: string, index: number}>}>}
+ */
+export declare const extractSvelteStyleReferences: (source: string) => Array<{
+    lang: string | undefined;
+    start: number;
+    references: Array<{
+        reference: string;
+        index: number;
+    }>;
+}>;
+/** Rune names that imply the `svelte` package even without an import. */
+export declare const SVELTE_RUNE_NAMES: string[];
+/**
+ * Find Svelte 5 rune usages (`$state`, `$derived`, `$effect`, ...). A
+ * rune-only component may never `import` from `svelte`, yet it cannot compile
+ * without the compiler, so rune usage is `svelte` evidence.
+ *
+ * @param {string} source `.svelte` content (script blocks scanned) or the
+ *   full text of a `.svelte.js` / `.svelte.ts` module (pass
+ *   `scriptBlocksOnly = false`).
+ * @param {boolean} [scriptBlocksOnly=true] Scan only `<script>` block bodies.
+ * @returns {Array<{rune: string, index: number}>} Absolute rune offsets.
+ */
+export declare const findSvelteRunes: (source: string, scriptBlocksOnly?: boolean) => Array<{
+    rune: string;
+    index: number;
+}>;
+/** SvelteKit virtual module prefixes that resolve inside `@sveltejs/kit`. */
+export declare const SVELTE_KIT_VIRTUAL_MODULE_PREFIXES: string[];
+/**
+ * True for import specifiers provided by SvelteKit itself (`$app/stores`,
+ * `$env/static/public`, `$service-worker`, ...).
+ *
+ * @param {string} specifier Import specifier.
+ * @returns {boolean}
+ */
+export declare const isSvelteKitVirtualModuleSpecifier: (specifier: string) => boolean;
+/** The default SvelteKit `$lib` alias target. */
+export declare const SVELTE_DEFAULT_LIB_ALIAS = "src/lib";
+/**
+ * Extract framework facts from a `svelte.config.*` source: the adapter named
+ * in string form (`adapter: "netlify"`), the `kit.alias` entries, and the
+ * `extensions` list. Adapter and preprocessor *imports* are collected by the
+ * regular config-file parse once `svelte.config.*` stops being ignored; the
+ * string adapter form has no import to recover, so it is extracted here.
+ *
+ * @param {string} source `svelte.config.*` file content.
+ * @returns {{adapterName: string|undefined, aliases: Object<string, string>, extensions: string[]}}
+ */
+export declare const parseSvelteConfigSource: (source: string) => {
+    adapterName: string | undefined;
+    aliases: Record<string, string>;
+    extensions: string[];
+};
+/** `<style lang>` values that require a CSS preprocessor package. */
+export declare const SVELTE_STYLE_LANG_PACKAGES: {
+    less: string;
+    postcss: string;
+    sass: string;
+    scss: string;
+    stylus: string;
+};
+/**
+ * Executable names appearing in Svelte project npm scripts and the npm
+ * packages that provide them. Used by the shared script-evidence walk so a
+ * `svelte-kit sync` script marks `@sveltejs/kit` required on its own
+ * evidence.
+ */
+export declare const SVELTE_SCRIPT_EXECUTABLE_PACKAGE_MAP: {
+    "svelte-kit": string;
+    "svelte-check": string;
+    "svelte-package": string;
+    vite: string;
+    vitest: string;
+    playwright: string;
+};
+/**
+ * Prime the module-scoped template-parser handle with a dynamic import,
+ * which works on every supported runtime. Called before the parse fan-out so
+ * the inline (small-project) path can use tier 2 on the main thread. Any
+ * failure is silent at default verbosity: the optional package is absent
+ * from the plain cdxgen binaries, and tier 1 already recovers all scope
+ * evidence.
+ *
+ * @returns {Promise<Object|null>} The module namespace, or null when unavailable.
+ */
+export declare const primeSvelteParser: () => Promise<Object | null>;
+/**
+ * Synchronous accessor for the parse path: returns the primed handle, lazily
+ * resolving it once when called before `primeSvelteParser`.
+ *
+ * @returns {Object|null} The module namespace, or null when unavailable.
+ */
+export declare const getSvelteTemplateParser: () => Object | null;
+//# sourceMappingURL=svelteUtils.d.ts.map

package/types/lib/inventory/svelteUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"svelteUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/svelteUtils.js"],"names":[],"mappings":"AAgNA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,WAHnB,MAAM,KACJ,MAkBZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,WAH9B,MAAM,KACJ,MAAM,EAMmB,CAAC;AAevC;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,WAH9B,MAAM,KACJ,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,GAAC,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,KAAK,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,CAAC,CAAA;CAAC,CAoChH,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,UAQ7B,CAAC;AASF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,WANjB,MAAM,qBAGN,OAAO,KACL,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAqB/C,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,kCAAkC,UAI9C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,cAHnC,MAAM,KACJ,OAKV,CAAC;AAEJ,iDAAiD;AACjD,eAAO,MAAM,wBAAwB,YAAY,CAAC;AAElD;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,WAHzB,MAAM,KACJ;IAAC,WAAW,EAAE,MAAM,GAAC,SAAS,CAAC;IAAC,OAAO,yBAAyB;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CA+BjG,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,0BAA0B;IACrC,IAAI;IACJ,OAAO;IACP,IAAI;IACJ,IAAI;IACJ,MAAM;CACP,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC;IAC/C,YAAY;IACZ,cAAc;IACd,gBAAgB;IAChB,IAAI;IACJ,MAAM;IACN,UAAU;CACX,CAAC;AAqCF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,QAFjB,OAAO,CAAC,MAAM,GAAC,IAAI,CAoB/B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,QAFvB,MAAM,GAAC,IAOnB,CAAC"}