@cdxgen/cdxgen 13.1.0 → 13.2.0

package/types/lib/inventory/envcontext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"envcontext.d.ts","sourceRoot":"","sources":["../../../lib/inventory/envcontext.js"],"names":[],"mappings":"AAkDA;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAFd,MAE4D,CAAC;AAuCvE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,wBAUpC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAL3B,MAK2B,EAAE,GAAG,EAJhC,MAIgC,sBAE1C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAJrB,MAIqB,sBAE/B;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,UAAU,KAAA,EAAE,GAAG,EAJ9B,MAI8B,sBAExC;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAJtB,MAIsB,MAkBhC;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAJlB,MAIkB,SA4B5B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EALvB,MAKuB,EAAE,IAAI,OAAA,sBAiBvC;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EALtB,MAKsB,EAAE,QAAQ,GAJhC,MAIqC,GAFnC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAAC,CA+BhD;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EALvB,MAKuB,EAAE,QAAQ,GAJjC,MAIsC,GAFpC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CA8BlD;AAwDD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB;;;;;;;;;cAsBlC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAH1B,MAG0B;;;;;cAgBpC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAH1B,MAG0B;;;;;cAiBpC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB,GAFtB,MAAM,CAkBlB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB;;;;;cAejC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB;;;;;cAelC;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAHtB,MAGsB;;;;cAahC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAHzB,MAGyB;;;;cAanC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB;;;;cAalC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,QAAA,EAAE,IAAI,OAAA,sBAExC;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB,MAAM,EAAE,CAqCpB;AA6CD;;GAEG;AACH,wBAAgB,iBAAiB,YAiBhC;AAED;;GAEG;AACH,wBAAgB,cAAc,YAO7B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,QAAA,EAAE,QAAQ,QAAA,WA0BvD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,QAAA,EAAE,QAAQ,QAAA,WA8GnD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,QAAA,UA8B3C;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,QAAA,UA8B9C;AASD;;;;GAIG;AACH,wBAAgB,gBAAgB,YAgB/B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAH/B,MAG+B,GAF7B,MAAM,CAWlB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,KAAA,EAAE,aAAa,KAAA,EAAE,QAAQ,KAAA,WAuC3E;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,KAAA,EAAE,QAAQ,KAAA;;;;;;EA2HvD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,KAAA,EAAE,cAAc,KAAA,WA2D7D;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,KAAA,EACb,WAAW,KAAA,EACX,aAAa,KAAA,EACb,QAAQ,KAAA,GANG,OAAO,CA+MnB;AAmDD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,EAAE,QAAQ,GAHxC,MAG6C,GAF3C,KAAK,CAAC,MAAM,CAAC,CAmDzB;AAyDD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,EAAE,UAAU,EAH1C,MAG0C,GAFxC,MAAM,CA6FlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,GAAG,EANnB,MAMmB,EAAE,OAAO,AALpC,CAGA,EAFA;IAAyB,GAAG,AAA5B,CACA,EADQ,MAAM,CACd;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;CAEyC,GAF/B,KAAK,CAAC,MAAM,CAAC,CA4CzB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,EAAE,QAAQ,GAHxC,MAG6C,GAF3C,KAAK,CAAC,MAAM,CAAC,CA+BzB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAFxB,MAAM,CA4GlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,WAUpC;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,IAF9B,MAAM,GAAC,SAAS,CAc5B"}
+{"version":3,"file":"envcontext.d.ts","sourceRoot":"","sources":["../../../lib/inventory/envcontext.js"],"names":[],"mappings":"AAkDA;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAFd,MAE4D,CAAC;AAuCvE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,wBAapC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAL3B,MAK2B,EAAE,GAAG,EAJhC,MAIgC,sBAE1C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAJrB,MAIqB,sBAE/B;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,UAAU,KAAA,EAAE,GAAG,EAJ9B,MAI8B,sBAExC;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAJtB,MAIsB,MAkBhC;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAJlB,MAIkB,SA4B5B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EALvB,MAKuB,EAAE,IAAI,OAAA,sBAiBvC;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EALtB,MAKsB,EAAE,QAAQ,GAJhC,MAIqC,GAFnC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAAC,CA+BhD;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EALvB,MAKuB,EAAE,QAAQ,GAJjC,MAIsC,GAFpC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CA8BlD;AAwDD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB;;;;;;;;;cAsBlC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAH1B,MAG0B;;;;;cAgBpC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAH1B,MAG0B;;;;;cAiBpC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB,GAFtB,MAAM,CAkBlB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB;;;;;cAejC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB;;;;;cAelC;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAHtB,MAGsB;;;;cAahC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAHzB,MAGyB;;;;cAanC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB;;;;cAalC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,QAAA,EAAE,IAAI,OAAA,sBAExC;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB,MAAM,EAAE,CAqCpB;AA6CD;;GAEG;AACH,wBAAgB,iBAAiB,YAiBhC;AAED;;GAEG;AACH,wBAAgB,cAAc,YAO7B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,QAAA,EAAE,QAAQ,QAAA,WA0BvD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,QAAA,EAAE,QAAQ,QAAA,WA8GnD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,QAAA,UA8B3C;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,QAAA,UA8B9C;AASD;;;;GAIG;AACH,wBAAgB,gBAAgB,YAgB/B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAH/B,MAG+B,GAF7B,MAAM,CAWlB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,KAAA,EAAE,aAAa,KAAA,EAAE,QAAQ,KAAA,WAuC3E;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,KAAA,EAAE,QAAQ,KAAA;;;;;;EA2HvD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,KAAA,EAAE,cAAc,KAAA,WA2D7D;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,KAAA,EACb,WAAW,KAAA,EACX,aAAa,KAAA,EACb,QAAQ,KAAA,GANG,OAAO,CA+MnB;AAmDD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,EAAE,QAAQ,GAHxC,MAG6C,GAF3C,KAAK,CAAC,MAAM,CAAC,CAmDzB;AAyDD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,EAAE,UAAU,EAH1C,MAG0C,GAFxC,MAAM,CA6FlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,GAAG,EANnB,MAMmB,EAAE,OAAO,AALpC,CAGA,EAFA;IAAyB,GAAG,AAA5B,CACA,EADQ,MAAM,CACd;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;CAEyC,GAF/B,KAAK,CAAC,MAAM,CAAC,CA4CzB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,EAAE,QAAQ,GAHxC,MAG6C,GAF3C,KAAK,CAAC,MAAM,CAAC,CA+BzB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAFxB,MAAM,CA4GlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,WAUpC;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,IAF9B,MAAM,GAAC,SAAS,CAc5B"}

package/types/lib/inventory/evidenceUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evidenceUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/evidenceUtils.js"],"names":[],"mappings":"AA4BA;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,OAAO,AAHvD,CACA,EADQ,MAGoD,GAFlD,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,MAAM,GAAC,SAAS,CA8B5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAHxC,MAGwC,GAFtC,MAAM,CAalB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAJ1B,MAAM,EAAE,GAAC,MAIiB,EAAE,SAAS,UAAA,GAFnC,MAAM,EAAE,CAmDpB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAAM,GAAC,MAAM,EAIoB,EAAE,QAAQ,EAH3C,MAAM,EAGqC,GAFzC,MAAM,GAAC,MAAM,EAAE,CAwB3B;AAsCD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAJjC,MAAM,EAI2B,EAAE,UAAU,EAH7C,MAG6C,GAF3C,MAAM,EAAE,CAsNpB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EANJ,MAMI,EACb,QAAQ,EANC,MAMD,EACR,OAAO,OAAA,EACP,OAAO,UAAQ,EACf,gBAAgB,YAAY;;;;;;;;;IA6H7B"}
+{"version":3,"file":"evidenceUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/evidenceUtils.js"],"names":[],"mappings":"AA6BA;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,OAAO,AAHvD,CACA,EADQ,MAGoD,GAFlD,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,MAAM,GAAC,SAAS,CA8B5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAHxC,MAGwC,GAFtC,MAAM,CAalB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAJ1B,MAAM,EAAE,GAAC,MAIiB,EAAE,SAAS,UAAA,GAFnC,MAAM,EAAE,CAmDpB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAAM,GAAC,MAAM,EAIoB,EAAE,QAAQ,EAH3C,MAAM,EAGqC,GAFzC,MAAM,GAAC,MAAM,EAAE,CAwB3B;AAsCD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAJjC,MAAM,EAI2B,EAAE,UAAU,EAH7C,MAG6C,GAF3C,MAAM,EAAE,CAkOpB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EANJ,MAMI,EACb,QAAQ,EANC,MAMD,EACR,OAAO,OAAA,EACP,OAAO,UAAQ,EACf,gBAAgB,YAAY;;;;;;;;;IA6H7B"}

package/types/lib/inventory/fetchBatch.d.ts

@@ -95,6 +95,21 @@ export declare function prefetchJson(requests: Array<{
 }>, options?: {
     timeoutMs?: number;
 }): Promise<Map<string, BatchEntry>>;
+/**
+ * Whether a hostname belongs to crates.io, including its index and CDN hosts.
+ *
+ * @param {string|null} host Hostname, or null when the URL did not parse.
+ * @returns {boolean}
+ */
+export declare function isCratesHost(host: string | null): boolean;
+/**
+ * Whether a host's rate policy lives in the JS table alone and therefore needs
+ * every request to pass through the one gate the JS pool holds.
+ *
+ * @param {string|null} host Hostname, or null when the URL did not parse.
+ * @returns {boolean}
+ */
+export declare function isSingleGateHost(host: string | null): boolean;
 /**
  * Record the run-level policy or connectivity condition carried by a caught
  * fetch error, if it names one. Shared by the batch retry loop and by the
@@ -104,6 +119,25 @@ export declare function prefetchJson(requests: Array<{
  * @returns {void}
  */
 export declare function recordPolicyDegradationFromError(err: Error): void;
+/**
+ * Run a caller's own request under the same per-host gate the batch pool uses.
+ *
+ * Not every registry lookup goes through the pool: a caller that misses the
+ * prefetch, or runs with prefetching disabled, issues `cdxgenAgent.get`
+ * directly. Those requests reach the same host and count against the same
+ * published budget, so they have to queue behind the same limiter rather than
+ * a second one — crates.io's one-request-per-second policy is not honoured by
+ * two independent gates that each allow one per second.
+ *
+ * The per-host semaphore and limiter are module state, so this shares one gate
+ * per host for the life of the process.
+ *
+ * @template T
+ * @param {string} url The URL about to be requested.
+ * @param {() => Promise<T>} issue Issues the request and resolves its result.
+ * @returns {Promise<T>} Whatever `issue` resolves to.
+ */
+export declare function withHostRateLimit<T>(url: string, issue: () => Promise<T>): Promise<T>;
 /**
  * Read a prefetched response, or signal that the caller should fetch it itself.
  *

package/types/lib/inventory/fetchBatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetchBatch.d.ts","sourceRoot":"","sources":["../../../lib/inventory/fetchBatch.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AA8EH;;;GAGG;AACH,wBAAgB,cAAc,IAHjB,MAAM,GAAC,IAAI,CAKvB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAFtB,OAAO,CASnB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,SAO1C;AAKE,YAAkB,UAAU,GAC5B;;;;IAAoB,EAAE,EAAX,OAAO,CAClB;;;;IAAe,IAAI,AAAnB,CACA,EADW,GAAC,CACZ;;;;IAAoB,MAAM,AAA1B,CACA,EADW,MAAM,CACjB;;;;;IAAqB,QAAQ,AAA7B,CAEF,EAFa,OAAO,CAEpB;CAAA,CAAA;AAoCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EARhC,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,CAAC,MAAM,GAAC,MAAM,GAAC,QAAQ,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAQnF,EAAE,OAAO,AANjD,CAEA,EADA;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;CAIsD,GAJ5C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAgC5C;AA8UD;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAHzC,KAGyC,GAFvC,IAAI,CAuBhB;AA4LD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EARlC,GAAG,CAAC,MAAM,EAAE,UAAU,CAQY,EAAE,GAAG,EAPvC,MAOuC,GANrC;IAAC,IAAI,EAAE,GAAC,CAAA;CAAC,GAAC,SAAS,CAoB/B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,IAFlB,OAAO,CAOnB"}
+{"version":3,"file":"fetchBatch.d.ts","sourceRoot":"","sources":["../../../lib/inventory/fetchBatch.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AA8EH;;;GAGG;AACH,wBAAgB,cAAc,IAHjB,MAAM,GAAC,IAAI,CAKvB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAFtB,OAAO,CASnB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,SAO1C;AAKE,YAAkB,UAAU,GAC5B;;;;IAAoB,EAAE,EAAX,OAAO,CAClB;;;;IAAe,IAAI,AAAnB,CACA,EADW,GAAC,CACZ;;;;IAAoB,MAAM,AAA1B,CACA,EADW,MAAM,CACjB;;;;;IAAqB,QAAQ,AAA7B,CAEF,EAFa,OAAO,CAEpB;CAAA,CAAA;AAoCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EARhC,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,CAAC,MAAM,GAAC,MAAM,GAAC,QAAQ,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAQnF,EAAE,OAAO,AANjD,CAEA,EADA;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;CAIsD,GAJ5C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAgC5C;AAoCD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAHtB,MAAM,GAAC,IAGe,GAFpB,OAAO,CAQnB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAH1B,MAAM,GAAC,IAGmB,GAFxB,OAAO,CAOnB;AAqTD;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAHzC,KAGyC,GAFvC,IAAI,CAuBhB;AAqGD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,iBAAiB,CAL1B,CAAC,EAK0B,GAAG,EAJhC,MAIgC,EAAE,KAAK,EAHvC,MAAM,OAAO,CAAC,CAAC,CAGwB,GAFrC,OAAO,CAAC,CAAC,CAAC,CAiBtB;AAyFD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EARlC,GAAG,CAAC,MAAM,EAAE,UAAU,CAQY,EAAE,GAAG,EAPvC,MAOuC,GANrC;IAAC,IAAI,EAAE,GAAC,CAAA;CAAC,GAAC,SAAS,CAoB/B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,IAFlB,OAAO,CAOnB"}

package/types/lib/inventory/fetchRate.d.ts

@@ -2,18 +2,21 @@
  * Per-host rate policy for batched registry fetches.
  *
  * This is the single source of truth for the JS transport's concurrency and
- * minimum-interval decisions. The numbers are shared with the Rust transport
+ * minimum-interval decisions. Every number is shared with the Rust transport
  * (`cdxgen-plugins-bin/thirdparty/cdxrs/src/fetch/rate.rs`); a change to one
  * side must be reflected in the other, and `fetchRate.poku.js` pins them so a
- * drift is visible.
+ * drift is visible. crates.io and package.elm-lang.org are routed so that their
+ * requests never reach the Rust transport, which makes this table the one that
+ * governs them in practice — their rows are mirrored there regardless, because
+ * two tables that disagree are a bug waiting for the routing to change.
  *
  * Why a per-host table rather than a single global interval: a single-registry
  * project — which is to say, almost every npm project — has exactly one host,
  * so a conservative per-host cap *is* the global cap. Applying crates.io's
- * 250 ms to every host caps an npm run at 4 requests per second, which is
- * slower than the serial JS path once connection reuse is taken into account.
- * Hosts that publish a limit get an interval; hosts that do not are bounded by
- * the per-host concurrency cap alone, and by whatever `Retry-After` they send.
+ * one-per-second policy to every host would cap an npm run at one request a
+ * second, orders of magnitude slower than that registry asks for. Hosts that
+ * publish a limit get an interval; hosts that do not are bounded by the
+ * per-host concurrency cap alone, and by whatever `Retry-After` they send.
  */
 export type Credentials = ("anonymous" | "authenticated");
 export type HostPolicy = {

package/types/lib/inventory/fetchRate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetchRate.d.ts","sourceRoot":"","sources":["../../../lib/inventory/fetchRate.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAYA,YAAyC,WAAW,GAA1C,CAAC,WAAW,GAAC,eAAe,CAAC,CAAa;AAOpD,YAAkB,UAAU,GAC5B;;;;IAAmB,WAAW,EAAnB,MAAM,CACjB;;;;IAAmB,cAAc,EAAtB,MAAM,CACnB;CAAA,CAAA;AAsDD;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAHxB,MAGwB,GAFtB,WAAW,CAYvB;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,IAAI,EALnB,MAKmB,EAAE,WAAW,AAJxC,CAEA,EAFQ,WAIgC,GAF9B,UAAU,CAuBtB;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;;GAEjC,CAAC;AAEJ;;;;;;GAMG;AACH,qBAAa,WAAW;IAKf,YAAY;IACZ,cAAc;IACd,eAAe;IANtB;;OAEG;IACH,YAAY,WAAW,EAFZ,MAEY,EAItB;IAED;;;;;;OAMG;IACG,IAAI,IAFG,OAAO,CAAC,IAAI,CAAC,CAYzB;IAED;;;;;;OAMG;IACH,aAAa,CAAC,OAAO,EAFV,MAEU,QAMpB;IAED,wEAAwE;IACxE,IAAI,kBAAkB,IADR,MAAM,CAGnB;CACF;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAJxB,MAIwB,GAHtB;IAAC,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,IAAI,CAAC,CAAA;CAAC,CAwBhD"}
+{"version":3,"file":"fetchRate.d.ts","sourceRoot":"","sources":["../../../lib/inventory/fetchRate.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAYA,YAAyC,WAAW,GAA1C,CAAC,WAAW,GAAC,eAAe,CAAC,CAAa;AAOpD,YAAkB,UAAU,GAC5B;;;;IAAmB,WAAW,EAAnB,MAAM,CACjB;;;;IAAmB,cAAc,EAAtB,MAAM,CACnB;CAAA,CAAA;AAkHD;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAHxB,MAGwB,GAFtB,WAAW,CAYvB;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,IAAI,EALnB,MAKmB,EAAE,WAAW,AAJxC,CAEA,EAFQ,WAIgC,GAF9B,UAAU,CAuBtB;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;;GAEjC,CAAC;AAEJ;;;;;;GAMG;AACH,qBAAa,WAAW;IAKf,YAAY;IACZ,cAAc;IACd,eAAe;IANtB;;OAEG;IACH,YAAY,WAAW,EAFZ,MAEY,EAItB;IAED;;;;;;OAMG;IACG,IAAI,IAFG,OAAO,CAAC,IAAI,CAAC,CAYzB;IAED;;;;;;OAMG;IACH,aAAa,CAAC,OAAO,EAFV,MAEU,QAMpB;IAED,wEAAwE;IACxE,IAAI,kBAAkB,IADR,MAAM,CAGnB;CACF;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAJxB,MAIwB,GAHtB;IAAC,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,IAAI,CAAC,CAAA;CAAC,CAwBhD"}

package/types/lib/inventory/forgeEnricher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forgeEnricher.d.ts","sourceRoot":"","sources":["../../../lib/inventory/forgeEnricher.js"],"names":[],"mappings":"AAiDA;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,IAAI,CAa9C;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAL9B,MAK8B,EAAE,SAAS,EAJzC,KAAK,CAAC,MAAM,CAI6B,EAAE,OAAO,GAHlD,MAGuD,GAFrD,OAAO,CAAC,MAAM,CAAC,CA4M3B"}
+{"version":3,"file":"forgeEnricher.d.ts","sourceRoot":"","sources":["../../../lib/inventory/forgeEnricher.js"],"names":[],"mappings":"AAkDA;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,IAAI,CAa9C;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAL9B,MAK8B,EAAE,SAAS,EAJzC,KAAK,CAAC,MAAM,CAI6B,EAAE,OAAO,GAHlD,MAGuD,GAFrD,OAAO,CAAC,MAAM,CAAC,CA4M3B"}

package/types/lib/inventory/jvmToolEnv.d.ts

@@ -8,10 +8,11 @@ import { compareVersions, extractJavaMajor, isPrereleaseVersion } from "./toolRe
 export { compareVersions as compareSdkmanVersions, extractJavaMajor, isPrereleaseVersion, };
 /**
  * Anchored validator for sdkman version identifiers such as `3.9.9`,
- * `4.0.0-rc-5`, `8.14`, or `21.0.7-tem`. Versions are interpolated into a
- * shell command by the sdkman installer, so every identifier must be a single
- * safe token: it must start with a digit and may only contain digits, ascii
- * letters, dots, and hyphens.
+ * `4.0.0-rc-5`, `8.14`, `21.0.7-tem`, or `26.0.2+1.1-tem`. Versions are
+ * interpolated into a shell command by the sdkman installer, so every
+ * identifier must be a single safe token: it must start with a digit and may
+ * only contain digits, ascii letters, dots, hyphens, and plus signs (`+` has
+ * no shell meaning and sdkman uses it in Temurin respin identifiers).
  *
  * Every separator must be followed by at least one alphanumeric character, and
  * a single repeated group covers both the dotted numeric part and the vendor

package/types/lib/inventory/jvmToolEnv.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jvmToolEnv.d.ts","sourceRoot":"","sources":["../../../lib/inventory/jvmToolEnv.js"],"names":[],"mappings":"AAMA,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,uBAAuB,CAAC;AAE/B;;;;;GAKG;AACH,OAAO,EACL,eAAe,IAAI,qBAAqB,EACxC,gBAAgB,EAChB,mBAAmB,GACpB,CAAC;AAuBF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAHjC,MAGiC,GAF/B,OAAO,CASnB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EALxC,MAKwC,GAJtC,MAAM,GAAC,SAAS,CAmB5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAJ3B,MAI2B,GAHzB,MAAM,GAAC,SAAS,CA4C5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,GAHpC,MAAM,GAAC,SAAS,CAwC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAJrC,MAIqC,GAHnC,MAAM,GAAC,SAAS,CAgC5B;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAH9C,MAG8C,GAF5C,MAAM,GAAC,SAAS,CAkB5B;AAsDD;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,iDAKjC,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,wBAM5B,CAAC;AAEF,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAH1C,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAGK,GAFxC,MAAM,GAAC,SAAS,CAc5B;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAH1C,MAG0C,GAFxC,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAHlC,MAGkC,GAFhC,MAAM,EAAE,CAgBpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAJjC,MAIiC,EAAE,MAAM,EAHzC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAwB5B;AAED;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,wBAKtC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,wBAKtC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAHjC,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAS5B;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAHhC,MAGgC,GAF9B,MAAM,GAAC,SAAS,CAS5B;AASD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAHvC,MAGuC,GAFrC,MAAM,GAAC,SAAS,CAuB5B"}
+{"version":3,"file":"jvmToolEnv.d.ts","sourceRoot":"","sources":["../../../lib/inventory/jvmToolEnv.js"],"names":[],"mappings":"AAMA,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,uBAAuB,CAAC;AAE/B;;;;;GAKG;AACH,OAAO,EACL,eAAe,IAAI,qBAAqB,EACxC,gBAAgB,EAChB,mBAAmB,GACpB,CAAC;AAuBF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAHjC,MAGiC,GAF/B,OAAO,CASnB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EALxC,MAKwC,GAJtC,MAAM,GAAC,SAAS,CAmB5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAJ3B,MAI2B,GAHzB,MAAM,GAAC,SAAS,CA4C5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,GAHpC,MAAM,GAAC,SAAS,CAwC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAJrC,MAIqC,GAHnC,MAAM,GAAC,SAAS,CAgC5B;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAH9C,MAG8C,GAF5C,MAAM,GAAC,SAAS,CAkB5B;AAsDD;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,iDAKjC,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,wBAM5B,CAAC;AAEF,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAH1C,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAGK,GAFxC,MAAM,GAAC,SAAS,CAc5B;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAH1C,MAG0C,GAFxC,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAHlC,MAGkC,GAFhC,MAAM,EAAE,CAgBpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAJjC,MAIiC,EAAE,MAAM,EAHzC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAwB5B;AAED;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,wBAKtC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,wBAKtC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAHjC,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAS5B;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAHhC,MAGgC,GAF9B,MAAM,GAAC,SAAS,CAS5B;AASD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAHvC,MAGuC,GAFrC,MAAM,GAAC,SAAS,CAuB5B"}

package/types/lib/inventory/mcpConfigParser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcpConfigParser.d.ts","sourceRoot":"","sources":["../../../lib/inventory/mcpConfigParser.js"],"names":[],"mappings":"AAknBA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,EAFlB;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAC,CAAA;CA+C9H,CAAC"}
+{"version":3,"file":"mcpConfigParser.d.ts","sourceRoot":"","sources":["../../../lib/inventory/mcpConfigParser.js"],"names":[],"mappings":"AAoxBA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,EAFlB;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAC,CAAA;CAiD9H,CAAC"}

package/types/lib/inventory/mcpDiscovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcpDiscovery.d.ts","sourceRoot":"","sources":["../../../lib/inventory/mcpDiscovery.js"],"names":[],"mappings":"AAkBA;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAH9B,MAG8B,GAF5B,MAAM,CAiBlB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAHzB,MAGyB,GAFvB,OAAO,CA8BnB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B,MAAM,EAAE,CAUpB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAHrC,MAGqC,GAFnC,MAAM,EAAE,CAUpB"}
+{"version":3,"file":"mcpDiscovery.d.ts","sourceRoot":"","sources":["../../../lib/inventory/mcpDiscovery.js"],"names":[],"mappings":"AA6BA;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAH9B,MAG8B,GAF5B,MAAM,CAiBlB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAHzB,MAGyB,GAFvB,OAAO,CA8BnB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B,MAAM,EAAE,CAUpB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAHrC,MAGqC,GAFnC,MAAM,EAAE,CAUpB"}

package/types/lib/inventory/mcpServerManifest.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Parser for MCP Registry server manifests (`server.json`).
+ *
+ * Converts each declared distributable package into a CycloneDX component
+ * (with a purl when the registry type maps to a supported ecosystem) and each
+ * remotely hosted endpoint into a service, alongside a file component that
+ * summarizes the manifest.
+ *
+ * @type {{id: string, patterns: string[], parse(files: string[], options?: Object): {components: Object[], services: Object[]}}}
+ */
+export declare const mcpServerManifestParser: {
+    id: string;
+    patterns: string[];
+    parse(files: string[], options?: Object): {
+        components: Object[];
+        services: Object[];
+    };
+};
+//# sourceMappingURL=mcpServerManifest.d.ts.map

package/types/lib/inventory/mcpServerManifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpServerManifest.d.ts","sourceRoot":"","sources":["../../../lib/inventory/mcpServerManifest.js"],"names":[],"mappings":"AAsTA;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,EAF1B;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAC,CAAA;CAsE9H,CAAC"}

package/types/lib/inventory/mcpbBundle.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Parser for MCPB / DXT desktop-extension bundles.
+ *
+ * A bundle is a zip archive carrying a local MCP server, its dependencies, and
+ * a `manifest.json`. This parser reads only the manifest to describe the
+ * bundled server, the tools/prompts it exposes, the number of precompiled
+ * platform binaries, and whether it injects secret-typed configuration values
+ * as environment variables.
+ *
+ * @type {{id: string, patterns: string[], parse(files: string[], options?: Object): {components: Object[]}}}
+ */
+export declare const mcpbBundleParser: {
+    id: string;
+    patterns: string[];
+    parse(files: string[], options?: Object): {
+        components: Object[];
+    };
+};
+//# sourceMappingURL=mcpbBundle.d.ts.map

package/types/lib/inventory/mcpbBundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpbBundle.d.ts","sourceRoot":"","sources":["../../../lib/inventory/mcpbBundle.js"],"names":[],"mappings":"AAgYA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,EAFnB;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAC,CAAA;CAyB1G,CAAC"}

package/types/lib/inventory/plugins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugins.d.ts","sourceRoot":"","sources":["../../../lib/inventory/plugins.js"],"names":[],"mappings":"AA+CA;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAC,CAgCpF;AA8DD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,IAXvB;IACR,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,GAAC,SAAS,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,GAAC,SAAS,CAAC;IACrC,aAAa,EAAE,MAAM,GAAC,SAAS,CAAC;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB,CAqMH;AAYD;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAF1B,UAAU,CAAC,OAAO,oBAAoB,CAAC,CASnD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,AAH5C,CACA,EADQ,UAAU,CAAC,OAAO,oBAAoB,CAGU,GAF9C,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAWnD;AAwDD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAIiC,EAAE,aAAa,AAHxD,CACA,EADQ,UAAU,CAAC,OAAO,oBAAoB,CAGsB,GAF1D,MAAM,GAAC,SAAS,CAS5B"}
+{"version":3,"file":"plugins.d.ts","sourceRoot":"","sources":["../../../lib/inventory/plugins.js"],"names":[],"mappings":"AAiDA;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAC,CAgCpF;AA8DD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,IAXvB;IACR,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,GAAC,SAAS,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,GAAC,SAAS,CAAC;IACrC,aAAa,EAAE,MAAM,GAAC,SAAS,CAAC;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB,CAqMH;AAYD;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAF1B,UAAU,CAAC,OAAO,oBAAoB,CAAC,CASnD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,AAH5C,CACA,EADQ,UAAU,CAAC,OAAO,oBAAoB,CAGU,GAF9C,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAWnD;AAwDD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAIiC,EAAE,aAAa,AAHxD,CACA,EADQ,UAAU,CAAC,OAAO,oBAAoB,CAGsB,GAF1D,MAAM,GAAC,SAAS,CAS5B"}

package/types/lib/inventory/protobom.d.ts

@@ -1,6 +1,12 @@
+import { isProtoBomFile } from "@cdxgen/cdx-proto/node";
+export { isProtoBomFile };
 /**
  * Determine whether a spec version is supported for protobuf serialization.
  *
+ * Delegates to cdx-proto's `isSupportedSpecVersion`, which accepts the
+ * spellings seen in the wild (`v1.6`, `1.6`, `1.6.0`) in addition to the
+ * canonical strings.
+ *
  * @param {string|undefined} specVersion CycloneDX spec version string
  * @returns {boolean} `true` when supported by `@cdxgen/cdx-proto`, or when no spec version is provided
  */
@@ -16,13 +22,6 @@ export declare const isProtoSupportedSpecVersion: (specVersion: string | undefin
  * @param {string} [operation="protobuf operations"] Operation label used in the error message
  */
 export declare const assertProtoSupportedSpecVersion: (specVersion: string | undefined, operation?: string) => void;
-/**
- * Determine whether a path looks like a CycloneDX protobuf file.
- *
- * @param {string} filePath File path
- * @returns {boolean} true when the path looks like a protobuf BOM file
- */
-export declare const isProtoBomFile: (filePath: string) => boolean;
 /**
  * Method to convert the given bom json to proto binary
  *
@@ -51,13 +50,19 @@ export declare const getBomStats: (bomJson: string | Object, specVersion?: strin
  * Method to cross-convert a BOM between CycloneDX specification versions using
  * the protobuf schemas.
  *
- * Downgrades are lossy: fields that the target version does not define are
- * dropped and reported in `warnings` as field paths.
+ * cdx-proto's conversion is cardinality-safe: fields that change shape between
+ * versions (`metadata.licenses` and `evidence.identity`, singular in 1.5 and an
+ * array since 1.6) are reshaped automatically — wrapped on upgrade, collapsed
+ * to their first entry on downgrade — including `evidence.identity` on nested
+ * components, `metadata.component`, `metadata.tools.components[]`, and
+ * `formulation[].components[]`. Downgrades are otherwise lossy: fields the
+ * target version does not define are dropped and reported in `warnings` as
+ * field paths, alongside collapsed list siblings.
  *
- * This is the raw `@cdxgen/cdx-proto` conversion. It reshapes nothing that the
- * two schemas model with different cardinality, so a BOM crossing the 1.5/1.6
- * `evidence.identity` boundary must be normalized first. Prefer
- * `applySpecVersionCompatibility` from the postgen stage for that.
+ * Only the protobuf-supported versions (1.5–1.7) can be targeted here. For the
+ * full JSON-level normalization across every version cdxgen emits (component
+ * types, license attributes, 1.4/2.0 reshaping), prefer
+ * `applySpecVersionCompatibility` from the postgen stage.
  *
  * @param {string | Object} bomJson BOM Json, BOM Json string, or proto message
  * @param {string | number} targetSpecVersion Target CycloneDX spec version

package/types/lib/inventory/protobom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protobom.d.ts","sourceRoot":"","sources":["../../../lib/inventory/protobom.js"],"names":[],"mappings":"AAiEA;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,gBAH7B,MAAM,GAAC,SAAS,KACd,OAWZ,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,gBAHjC,MAAM,GAAC,SAAS,cAChB,MAAM,SAiBhB,CAAC;AA4BF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,aAHhB,MAAM,KACJ,OAOZ,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAJb,MAAM,GAAG,MAAM,WACf,MAAM,gBACN,MAAM,GAAG,MAAM,SAWzB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,YAJZ,MAAM,UACN,OAAO,gBACP,MAAM,GAAG,MAAM,4FAiBzB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAJb,MAAM,GAAG,MAAM,gBACf,MAAM,GAAG,MAAM,KACb,MAGsC,CAAC;AAEpD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,qBAAqB,YALvB,MAAM,GAAG,MAAM,qBACf,MAAM,GAAG,MAAM,gBACf,MAAM,GAAG,MAAM,KACb;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAehD,CAAC"}
+{"version":3,"file":"protobom.d.ts","sourceRoot":"","sources":["../../../lib/inventory/protobom.js"],"names":[],"mappings":"AAaA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAIxD,OAAO,EAAE,cAAc,EAAE,CAAC;AAsB1B;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,gBAH7B,MAAM,GAAC,SAAS,KACd,OAGgE,CAAC;AAE9E;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,gBAHjC,MAAM,GAAC,SAAS,cAChB,MAAM,SAYhB,CAAC;AAgCF;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAJb,MAAM,GAAG,MAAM,WACf,MAAM,gBACN,MAAM,GAAG,MAAM,SAezB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,YAJZ,MAAM,UACN,OAAO,gBACP,MAAM,GAAG,MAAM,4FAiBzB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAJb,MAAM,GAAG,MAAM,gBACf,MAAM,GAAG,MAAM,KACb,MAKV,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,qBAAqB,YALvB,MAAM,GAAG,MAAM,qBACf,MAAM,GAAG,MAAM,gBACf,MAAM,GAAG,MAAM,KACb;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAahD,CAAC"}

package/types/lib/inventory/protobomLoader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protobomLoader.d.ts","sourceRoot":"","sources":["../../../lib/inventory/protobomLoader.js"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,OAAO,CAOnB;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,AALV,CACA,EADQ,MAKa,EACtB,kBAAkB,AALjB,CACA,EADQ,MAK8B,GAJ5B,OAAO,CAAC,MAAM,CAAC,CAqB3B"}
+{"version":3,"file":"protobomLoader.d.ts","sourceRoot":"","sources":["../../../lib/inventory/protobomLoader.js"],"names":[],"mappings":"AAMA;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,OAAO,CAOnB;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,AALV,CACA,EADQ,MAKa,EACtB,kBAAkB,AALjB,CACA,EADQ,MAK8B,GAJ5B,OAAO,CAAC,MAAM,CAAC,CAqB3B"}

package/types/lib/inventory/source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../lib/inventory/source.js"],"names":[],"mappings":"AAmCA,6FAA6F;AAC7F,eAAO,MAAM,4BAA4B,wIAC8F,CAAC;AAExI,6DAA6D;AAC7D,eAAO,MAAM,2BAA2B,UAWvC,CAAC;AAuBF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAAM,GAAC,SAGsB,GAF3B,OAAO,CAUnB;AAiBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAL5B,MAAM,EAKsB,EAAE,OAAO,GAH7C;IAAkC,GAAG,EAA7B,MAAM,GAAC,SAAS,CACxB;CAEkD,GAFxC,MAAM,CAuClB;AA+ED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAAM,GAAC,SAI+B,EAAE,OAAO,GAH/C,MAGoD,GAFlD,MAAM,GAAC,SAAS,CA6I5B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,CASlB;AAkBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,OAAO,CAWnB;AAkBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAHvB,MAGuB,GAFrB,OAAO,CA+BnB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAHpB,MAGoB,GAFlB,OAAO,CAyBnB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAHxC,MAGwC,GAFtC,MAAM,GAAC,IAAI,CAgEvB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAJrB,MAIqB,EAAE,MAAM,GAH7B,MAAM,GAAC,MAAM,EAAE,GAAC,IAGoB,GAFlC,MAAM,CAyDlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAAM,GAAC,SAGgC,GAFrC,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAJrC,MAIqC,EAAE,cAAc,EAHrD,MAAM,GAAC,SAG8C,GAFnD,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAJtC,MAIsC,EAAE,cAAc,EAHtD,MAAM,GAAC,SAG+C,GAFpD,MAAM,GAAC,SAAS,CAiF5B;AAoHD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAGkC,GAFhC;IAAC,MAAM,EAAC,MAAM,CAAC;IAAA,KAAK,EAAC,MAAM,CAAC;IAAA,OAAO,EAAC,MAAM,CAAA;CAAC,GAAC,IAAI,CA8D5D;AA6GD;;GAEG;AACH,wBAAgB,yBAAyB,SAExC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,WAAW,EAJ5C,KAAK,CAAC,MAAM,CAIgC,GAF1C,OAAO,CAAC,IAAI,CAAC,CA6BzB;AAyDD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CA4MlI;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAF5B,MAE4B,QAkCtC"}
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../lib/inventory/source.js"],"names":[],"mappings":"AAoCA,6FAA6F;AAC7F,eAAO,MAAM,4BAA4B,wIAC8F,CAAC;AAExI,6DAA6D;AAC7D,eAAO,MAAM,2BAA2B,UAWvC,CAAC;AAuBF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAAM,GAAC,SAGsB,GAF3B,OAAO,CAUnB;AAiBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAL5B,MAAM,EAKsB,EAAE,OAAO,GAH7C;IAAkC,GAAG,EAA7B,MAAM,GAAC,SAAS,CACxB;CAEkD,GAFxC,MAAM,CAuClB;AA+ED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAAM,GAAC,SAI+B,EAAE,OAAO,GAH/C,MAGoD,GAFlD,MAAM,GAAC,SAAS,CA6I5B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,CASlB;AAkBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,OAAO,CAWnB;AAkBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAHvB,MAGuB,GAFrB,OAAO,CA+BnB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAHpB,MAGoB,GAFlB,OAAO,CAyBnB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAHxC,MAGwC,GAFtC,MAAM,GAAC,IAAI,CAgEvB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAJrB,MAIqB,EAAE,MAAM,GAH7B,MAAM,GAAC,MAAM,EAAE,GAAC,IAGoB,GAFlC,MAAM,CAyDlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAAM,GAAC,SAGgC,GAFrC,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAJrC,MAIqC,EAAE,cAAc,EAHrD,MAAM,GAAC,SAG8C,GAFnD,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAJtC,MAIsC,EAAE,cAAc,EAHtD,MAAM,GAAC,SAG+C,GAFpD,MAAM,GAAC,SAAS,CAiF5B;AAoHD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAGkC,GAFhC;IAAC,MAAM,EAAC,MAAM,CAAC;IAAA,KAAK,EAAC,MAAM,CAAC;IAAA,OAAO,EAAC,MAAM,CAAA;CAAC,GAAC,IAAI,CA8D5D;AA6GD;;GAEG;AACH,wBAAgB,yBAAyB,SAExC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,WAAW,EAJ5C,KAAK,CAAC,MAAM,CAIgC,GAF1C,OAAO,CAAC,IAAI,CAAC,CA6BzB;AA8DD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CA4MlI;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAF5B,MAE4B,QAkCtC"}

package/types/lib/inventory/stylePackageRefs.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Patterns matching a package reference inside CSS/SCSS/Less/Stylus content.
+ * Capture group 1 holds the reference (for example `bulma/sass/utilities`).
+ *
+ * @type {RegExp[]}
+ */
+export declare const STYLE_PACKAGE_REFERENCE_PATTERNS: RegExp[];
+/**
+ * True when a `url()` reference points at a package rather than a local file.
+ * Only the `~package/...` and `node_modules/...` spellings qualify; plain
+ * relative URLs stay local.
+ *
+ * @param {string} reference Value captured from a `url()` rule.
+ * @returns {boolean}
+ */
+export declare const isPackageStyleUrlReference: (reference: string) => boolean;
+//# sourceMappingURL=stylePackageRefs.d.ts.map

package/types/lib/inventory/stylePackageRefs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stylePackageRefs.d.ts","sourceRoot":"","sources":["../../../lib/inventory/stylePackageRefs.js"],"names":[],"mappings":"AAaA;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,EAFnC,MAAM,EAKf,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,cAH5B,MAAM,KACJ,OAUZ,CAAC"}

package/types/lib/inventory/svelteUtils.d.ts

@@ -0,0 +1,124 @@
+/**
+ * Build a same-length masked buffer of a `.svelte` source where every byte
+ * outside the `<script>` / `<script module>` / `<script context="module">`
+ * bodies is replaced by a space (newlines preserved). Because nothing moves,
+ * the Babel parse of the buffer yields statement offsets and `loc.line`
+ * values that are true to the original file.
+ *
+ * Handles multiple script blocks, arbitrary attribute order, self-closing and
+ * unterminated tags, CRLF input, and a script block appearing after the
+ * markup.
+ *
+ * @param {string} source `.svelte` file content.
+ * @returns {string} Same-length buffer containing only the script bodies.
+ */
+export declare const maskSvelteScripts: (source: string) => string;
+/**
+ * The `lang` attribute values of the `<script>` blocks, lowercased.
+ *
+ * @param {string} source `.svelte` file content.
+ * @returns {string[]}
+ */
+export declare const extractSvelteScriptLanguages: (source: string) => string[];
+/**
+ * Collect `<style>` block facts: the block's `lang` and the package
+ * references found in its `@use` / `@import` / `@forward` / `url()` rules.
+ * Reference offsets are absolute indices into the original source so callers
+ * can derive line numbers.
+ *
+ * @param {string} source `.svelte` file content.
+ * @returns {Array<{lang: string|undefined, start: number, references: Array<{reference: string, index: number}>}>}
+ */
+export declare const extractSvelteStyleReferences: (source: string) => Array<{
+    lang: string | undefined;
+    start: number;
+    references: Array<{
+        reference: string;
+        index: number;
+    }>;
+}>;
+/** Rune names that imply the `svelte` package even without an import. */
+export declare const SVELTE_RUNE_NAMES: string[];
+/**
+ * Find Svelte 5 rune usages (`$state`, `$derived`, `$effect`, ...). A
+ * rune-only component may never `import` from `svelte`, yet it cannot compile
+ * without the compiler, so rune usage is `svelte` evidence.
+ *
+ * @param {string} source `.svelte` content (script blocks scanned) or the
+ *   full text of a `.svelte.js` / `.svelte.ts` module (pass
+ *   `scriptBlocksOnly = false`).
+ * @param {boolean} [scriptBlocksOnly=true] Scan only `<script>` block bodies.
+ * @returns {Array<{rune: string, index: number}>} Absolute rune offsets.
+ */
+export declare const findSvelteRunes: (source: string, scriptBlocksOnly?: boolean) => Array<{
+    rune: string;
+    index: number;
+}>;
+/** SvelteKit virtual module prefixes that resolve inside `@sveltejs/kit`. */
+export declare const SVELTE_KIT_VIRTUAL_MODULE_PREFIXES: string[];
+/**
+ * True for import specifiers provided by SvelteKit itself (`$app/stores`,
+ * `$env/static/public`, `$service-worker`, ...).
+ *
+ * @param {string} specifier Import specifier.
+ * @returns {boolean}
+ */
+export declare const isSvelteKitVirtualModuleSpecifier: (specifier: string) => boolean;
+/** The default SvelteKit `$lib` alias target. */
+export declare const SVELTE_DEFAULT_LIB_ALIAS = "src/lib";
+/**
+ * Extract framework facts from a `svelte.config.*` source: the adapter named
+ * in string form (`adapter: "netlify"`), the `kit.alias` entries, and the
+ * `extensions` list. Adapter and preprocessor *imports* are collected by the
+ * regular config-file parse once `svelte.config.*` stops being ignored; the
+ * string adapter form has no import to recover, so it is extracted here.
+ *
+ * @param {string} source `svelte.config.*` file content.
+ * @returns {{adapterName: string|undefined, aliases: Object<string, string>, extensions: string[]}}
+ */
+export declare const parseSvelteConfigSource: (source: string) => {
+    adapterName: string | undefined;
+    aliases: Record<string, string>;
+    extensions: string[];
+};
+/** `<style lang>` values that require a CSS preprocessor package. */
+export declare const SVELTE_STYLE_LANG_PACKAGES: {
+    less: string;
+    postcss: string;
+    sass: string;
+    scss: string;
+    stylus: string;
+};
+/**
+ * Executable names appearing in Svelte project npm scripts and the npm
+ * packages that provide them. Used by the shared script-evidence walk so a
+ * `svelte-kit sync` script marks `@sveltejs/kit` required on its own
+ * evidence.
+ */
+export declare const SVELTE_SCRIPT_EXECUTABLE_PACKAGE_MAP: {
+    "svelte-kit": string;
+    "svelte-check": string;
+    "svelte-package": string;
+    vite: string;
+    vitest: string;
+    playwright: string;
+};
+/**
+ * Prime the module-scoped template-parser handle with a dynamic import,
+ * which works on every supported runtime. Called before the parse fan-out so
+ * the inline (small-project) path can use tier 2 on the main thread. Any
+ * failure is silent at default verbosity: the optional package is absent
+ * from the plain cdxgen binaries, and tier 1 already recovers all scope
+ * evidence.
+ *
+ * @returns {Promise<Object|null>} The module namespace, or null when unavailable.
+ */
+export declare const primeSvelteParser: () => Promise<Object | null>;
+/**
+ * Synchronous accessor for the parse path: returns the primed handle, lazily
+ * resolving it once when called before `primeSvelteParser`.
+ *
+ * @returns {Object|null} The module namespace, or null when unavailable.
+ */
+export declare const getSvelteTemplateParser: () => Object | null;
+//# sourceMappingURL=svelteUtils.d.ts.map

package/types/lib/inventory/svelteUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"svelteUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/svelteUtils.js"],"names":[],"mappings":"AAgNA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,WAHnB,MAAM,KACJ,MAkBZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,WAH9B,MAAM,KACJ,MAAM,EAMmB,CAAC;AAevC;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,WAH9B,MAAM,KACJ,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,GAAC,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,KAAK,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,CAAC,CAAA;CAAC,CAoChH,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,UAQ7B,CAAC;AASF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,WANjB,MAAM,qBAGN,OAAO,KACL,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAqB/C,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,kCAAkC,UAI9C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,cAHnC,MAAM,KACJ,OAKV,CAAC;AAEJ,iDAAiD;AACjD,eAAO,MAAM,wBAAwB,YAAY,CAAC;AAElD;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,WAHzB,MAAM,KACJ;IAAC,WAAW,EAAE,MAAM,GAAC,SAAS,CAAC;IAAC,OAAO,yBAAyB;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CA+BjG,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,0BAA0B;IACrC,IAAI;IACJ,OAAO;IACP,IAAI;IACJ,IAAI;IACJ,MAAM;CACP,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC;IAC/C,YAAY;IACZ,cAAc;IACd,gBAAgB;IAChB,IAAI;IACJ,MAAM;IACN,UAAU;CACX,CAAC;AAqCF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,QAFjB,OAAO,CAAC,MAAM,GAAC,IAAI,CAoB/B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,QAFvB,MAAM,GAAC,IAOnB,CAAC"}

package/types/lib/parsers/huggingfaceUtils.d.ts

@@ -84,9 +84,16 @@ export declare function toHuggingFacePurl(repoId: string, version?: string, repo
  * Normalize a direct Hugging Face URL or purl into a repo reference.
  *
  * @param {string} value direct URL, API URL, or purl
+ * @param {object} [parseOptions] parsing options
+ * @param {boolean} [parseOptions.explicitOnly=false] resolve only unambiguous
+ *   references (`pkg:huggingface/...` purls and huggingface.co URLs) so that
+ *   ambiguous `owner/repo`-shaped values keep their filesystem-path meaning
+ *   until an AI inventory type is explicitly selected
  * @returns {{ assetType: string, repoId: string, version?: string }|undefined} normalized reference
  */
-export declare function normalizeHuggingFaceReference(value: string): {
+export declare function normalizeHuggingFaceReference(value: string, parseOptions?: {
+    explicitOnly?: boolean;
+}): {
     assetType: string;
     repoId: string;
     version?: string;

package/types/lib/parsers/huggingfaceUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"huggingfaceUtils.d.ts","sourceRoot":"","sources":["../../../lib/parsers/huggingfaceUtils.js"],"names":[],"mappings":"AAiBA;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAFd,MAEyC,CAAC;AACpD;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,EAFlC,GAAG,CAAC,MAAM,CAYlB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,EAFtC,MAEkE,CAAC;AAC7E;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAFpC,MAE8D,CAAC;AAEzE;;;;;;GAMG;AACH,wBAAgB,oCAAoC,CAAC,SAAS,EAJnD,MAImD,GAHjD,MAAM,GAAC,SAAS,CAW5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CAAC,aAAa,EAJxD,MAIwD,GAHtD,MAAM,GAAC,SAAS,CAiB5B;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CAoC5B;AAYD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAHxC,MAGwC,GAFtC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAJrC,MAIqC,EAAE,MAAM,EAH7C,MAG6C,GAF3C,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAJpC,MAIoC,EAAE,MAAM,EAH5C,MAG4C,GAF1C,MAAM,GAAC,SAAS,CAK5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAL7B,MAK6B,EAAE,OAAO,AAJ9C,CACA,EADQ,MAIsC,EAAE,aAAa,AAH7D,CACA,EADQ,MAGqD,GAFnD,MAAM,GAAC,SAAS,CA8B5B;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAHxC,MAGwC,GAFtC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAC,SAAS,CA6G7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAZxC,MAAM,GAAC,MAYiC,EAAE,OAAO,AAXzD,CACA,EADQ;IAAE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAC,SAAS,KAAK,MAAM,GAAC,SAAS,CAAA;CAWN,GAVpD;IACR,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb,GAAC,SAAS,CAqDb;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAJ3C,MAAM,GAAC,MAIoC,EAAE,OAAO,AAH5D,CACA,EADQ;IAAE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAC,SAAS,KAAK,MAAM,GAAC,SAAS,CAAA;CAGH,GAFvD;IAAE,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAC,SAAS,CAyBtG;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,AAHhD,CACA,EADQ,KAAK,CAAC,MAAM,CAGiC,GAF3C,KAAK,CAAC;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAyBlE;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,kBAAkB,EAHnD,MAAM,GAAC,MAG4C,GAFjD,MAAM,GAAC,SAAS,CAoB5B"}
+{"version":3,"file":"huggingfaceUtils.d.ts","sourceRoot":"","sources":["../../../lib/parsers/huggingfaceUtils.js"],"names":[],"mappings":"AAiBA;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAFd,MAEyC,CAAC;AACpD;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,EAFlC,GAAG,CAAC,MAAM,CAYlB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,EAFtC,MAEkE,CAAC;AAC7E;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAFpC,MAE8D,CAAC;AAEzE;;;;;;GAMG;AACH,wBAAgB,oCAAoC,CAAC,SAAS,EAJnD,MAImD,GAHjD,MAAM,GAAC,SAAS,CAW5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CAAC,aAAa,EAJxD,MAIwD,GAHtD,MAAM,GAAC,SAAS,CAiB5B;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CAoC5B;AAYD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAHxC,MAGwC,GAFtC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAJrC,MAIqC,EAAE,MAAM,EAH7C,MAG6C,GAF3C,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAJpC,MAIoC,EAAE,MAAM,EAH5C,MAG4C,GAF1C,MAAM,GAAC,SAAS,CAK5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAL7B,MAK6B,EAAE,OAAO,AAJ9C,CACA,EADQ,MAIsC,EAAE,aAAa,AAH7D,CACA,EADQ,MAGqD,GAFnD,MAAM,GAAC,SAAS,CA8B5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EARxC,MAQwC,EAAE,YAAY,AAP9D,CAKA,EAJA;IAA+B,YAAY,AAA3C,CAIA,EAJQ,OAAO,CAIf;CAEmE,GAFzD;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAC,SAAS,CAgH7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAZxC,MAAM,GAAC,MAYiC,EAAE,OAAO,AAXzD,CACA,EADQ;IAAE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAC,SAAS,KAAK,MAAM,GAAC,SAAS,CAAA;CAWN,GAVpD;IACR,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb,GAAC,SAAS,CAqDb;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAJ3C,MAAM,GAAC,MAIoC,EAAE,OAAO,AAH5D,CACA,EADQ;IAAE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAC,SAAS,KAAK,MAAM,GAAC,SAAS,CAAA;CAGH,GAFvD;IAAE,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAC,SAAS,CAyBtG;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,AAHhD,CACA,EADQ,KAAK,CAAC,MAAM,CAGiC,GAF3C,KAAK,CAAC;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAyBlE;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,kBAAkB,EAHnD,MAAM,GAAC,MAG4C,GAFjD,MAAM,GAAC,SAAS,CAoB5B"}

package/types/lib/parsers/onnx.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Read the identifying header fields of an ONNX model file.
+ *
+ * Only `ir_version`, `producer_name`, `producer_version`, `model_version`,
+ * and the `opset_import` entries are extracted. The graph and every other
+ * payload are skipped by offset without being read, so no tensor data is
+ * ever loaded and no model code is executed.
+ *
+ * @param {string} filePath Path to the `.onnx` file
+ * @returns {{
+ *   irVersion: number,
+ *   producerName: string,
+ *   producerVersion: string,
+ *   modelVersion: number,
+ *   opsets: Array<{domain: string, version: number}>,
+ * } | undefined} Header summary, or undefined when it cannot be read
+ */
+export declare function readOnnxHeader(filePath: string): {
+    irVersion: number;
+    producerName: string;
+    producerVersion: string;
+    modelVersion: number;
+    opsets: Array<{
+        domain: string;
+        version: number;
+    }>;
+} | undefined;
+//# sourceMappingURL=onnx.d.ts.map

package/types/lib/parsers/onnx.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onnx.d.ts","sourceRoot":"","sources":["../../../lib/parsers/onnx.js"],"names":[],"mappings":"AAoBA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAT5B,MAS4B,GAR1B;IACR,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;CAClD,GAAG,SAAS,CAwGf"}

package/types/lib/parsers/safetensors.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Read and parse the JSON header of a safetensors model file.
+ *
+ * Only the leading header is read; tensor payloads are ignored. The returned
+ * object separates the optional `__metadata__` map from the per-tensor
+ * descriptors.
+ *
+ * @param {string} filePath Path to a `.safetensors` file
+ * @returns {{
+ *   metadata: Object,
+ *   tensorCount: number,
+ *   dtypes: string[],
+ *   totalParameters: number,
+ * } | undefined} Parsed header summary, or undefined when it cannot be read
+ */
+export declare function readSafetensorsHeader(filePath: string): {
+    metadata: Object;
+    tensorCount: number;
+    dtypes: string[];
+    totalParameters: number;
+} | undefined;
+//# sourceMappingURL=safetensors.d.ts.map

package/types/lib/parsers/safetensors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safetensors.d.ts","sourceRoot":"","sources":["../../../lib/parsers/safetensors.js"],"names":[],"mappings":"AAWA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EARnC,MAQmC,GAPjC;IACR,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,SAAS,CAuCf"}

package/types/lib/stages/postgen/introspection/markers.d.ts

@@ -19,8 +19,9 @@
  * Marker table: ecosystem → manifest and lockfile names that indicate the
  * ecosystem is part of the project. Entries are either exact file names or
  * `{ suffix }` matchers for extension-driven ecosystems. Ecosystems cdxgen
- * cannot parse (elm, crystal, nim, perl, r) are included so the reflection
- * can report them as coverage gaps instead of silently ignoring them.
+ * cannot parse (currently only dub, the D package manager) are included so
+ * the reflection can report them as coverage gaps instead of silently
+ * ignoring them.
  *
  * @type {Readonly<Record<string, {names: string[], suffixes: string[]}>>}
  */

package/types/lib/stages/postgen/introspection/markers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"markers.d.ts","sourceRoot":"","sources":["../../../../../lib/stages/postgen/introspection/markers.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAUH;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,EAFpB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CAoFtE,CAAC;AAEH;;;gCAGgC;AAChC,eAAO,MAAM,eAAe,eAAY,CAAC;AAyDzC;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EALvC,MAKuC,EAAE,KAAK,AAJtD,CAEA,EADA;IAA0E,OAAO,AAAjF,CACA,EADQ,CAAC,OAAO,EAAE,MAAM,KAAK;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAC,EAAE,CACjE;CAE2D,GAFjD;IAAC,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAC,CAoCnF"}
+{"version":3,"file":"markers.d.ts","sourceRoot":"","sources":["../../../../../lib/stages/postgen/introspection/markers.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAUH;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,EAFpB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CA0GtE,CAAC;AAEH;;;gCAGgC;AAChC,eAAO,MAAM,eAAe,eAAY,CAAC;AAyDzC;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EALvC,MAKuC,EAAE,KAAK,AAJtD,CAEA,EADA;IAA0E,OAAO,AAAjF,CACA,EADQ,CAAC,OAAO,EAAE,MAAM,KAAK;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAC,EAAE,CACjE;CAE2D,GAFjD;IAAC,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAC,CAoCnF"}

package/types/lib/stages/postgen/postgen.d.ts

@@ -26,6 +26,39 @@ export declare function applyMetadata(bomJson: Object, options: Object): Object;
  * @returns {Object} Filtered BOM JSON
  */
 export declare function applyStandards(bomJson: Object, options: Object): Object;
+/**
+ * Move the build-time-only components out of `components[]`, which describes
+ * the delivered assembly, and hand them to the formulation section, which is
+ * where CycloneDX describes how the assembly was produced.
+ *
+ * Their bom-refs stay valid because the formulation components live in the same
+ * document, so the dependency graph is left intact. `formulation` exists from
+ * CycloneDX 1.5, so an older document keeps them in `components[]` with their
+ * `cdx:cargo:hostOnly` marker rather than losing them.
+ *
+ * @param {Object} bomJson BOM JSON object
+ * @param {Object} options CLI options
+ *
+ * @returns {Object[]} The components removed from `components[]`
+ */
+export declare function extractBuildOnlyComponents(bomJson: Object, options: Object): Object[];
+/**
+ * Re-apply the `--required-only` filter once the evidence stage has attached
+ * occurrence and callstack data.
+ *
+ * A manifest can only say that a dependency is optional; the evidence says
+ * whether it is reached. A component the analyzers observed in the sources is
+ * promoted to `required` so it survives the filter, while an optional component
+ * with no observed usage is dropped as before. A component scoped `excluded` -
+ * a dev or test dependency - keeps that scope: an occurrence inside the test
+ * sources is not evidence that it ships.
+ *
+ * @param {Object} bomJson BOM JSON object carrying evidence
+ * @param {Object} options CLI options
+ *
+ * @returns {Object} Filtered BOM JSON
+ */
+export declare function applyEvidenceBasedFilter(bomJson: Object, options: Object): Object;
 /**
  * Filter BOM based on options
  *

package/types/lib/stages/postgen/postgen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postgen.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/postgen.js"],"names":[],"mappings":"AAgiBA;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,SAAS,EANhC,MAMgC,EAAE,OAAO,EALzC,MAKyC,EAAE,QAAQ,AAJ3D,CAEA,EAFQ,MAImD,GAFjD,OAAO,CAAC,MAAM,CAAC,CA4D3B;AAgHD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAL1B,MAK0B,EAAE,OAAO,EAJnC,MAImC,GAFjC,MAAM,CA8HlB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAL3B,MAK2B,EAAE,OAAO,EAJpC,MAIoC,GAFlC,MAAM,CAqClB;AAkED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,EALtB,MAKsB,EAAE,OAAO,EAJ/B,MAI+B,GAF7B,MAAM,CA0MlB;AAUD;;GAEG;AACH,wBAAgB,UAAU,CAAC,QAAQ,KAAA,QAUlC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,IAFhB,IAAI,CAYhB;AAMD;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EALrB,MAKqB,EAAE,OAAO,EAJ9B,MAI8B,GAF5B,MAAM,CA2HlB"}
+{"version":3,"file":"postgen.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/postgen.js"],"names":[],"mappings":"AAgiBA;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,SAAS,EANhC,MAMgC,EAAE,OAAO,EALzC,MAKyC,EAAE,QAAQ,AAJ3D,CAEA,EAFQ,MAImD,GAFjD,OAAO,CAAC,MAAM,CAAC,CAsE3B;AAgHD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAL1B,MAK0B,EAAE,OAAO,EAJnC,MAImC,GAFjC,MAAM,CA8HlB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAL3B,MAK2B,EAAE,OAAO,EAJpC,MAIoC,GAFlC,MAAM,CAqClB;AAqHD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EALvC,MAKuC,EAAE,OAAO,EAJhD,MAIgD,GAF9C,MAAM,EAAE,CAmBpB;AAgBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EALrC,MAKqC,EAAE,OAAO,EAJ9C,MAI8C,GAF5C,MAAM,CAiClB;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,EALtB,MAKsB,EAAE,OAAO,EAJ/B,MAI+B,GAF7B,MAAM,CAoNlB;AAUD;;GAEG;AACH,wBAAgB,UAAU,CAAC,QAAQ,KAAA,QAUlC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,IAFhB,IAAI,CAYhB;AAMD;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EALrB,MAKqB,EAAE,OAAO,EAJ9B,MAI8B,GAF5B,MAAM,CA2HlB"}