@cdxgen/cdxgen 13.1.0 → 13.3.0

package/types/lib/core/metadataProperties.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The spellings under which a config file may list custom metadata
+ * properties: those of the `--metadata-property` flag, and the plural that
+ * the CDXGEN_METADATA_PROPERTIES environment variable maps to.
+ */
+export declare const METADATA_PROPERTY_CONFIG_KEYS: string[];
+/**
+ * Report whether a property name belongs to a namespace cdxgen reserves for
+ * the facts it establishes itself, such as `cdx:bom:componentSrcFiles`.
+ *
+ * @param {string} name Property name
+ * @returns {boolean} true for a reserved name
+ */
+export declare function isReservedMetadataPropertyName(name: string): boolean;
+/**
+ * Normalize user-supplied metadata properties into `[{name, value}]`
+ * (discussion 4391).
+ *
+ * Accepted shapes:
+ * - a `name=value` string, or a JSON document holding any of the shapes below
+ *   — an environment variable
+ * - an array of `name=value` strings or `{name, value}` objects — the
+ *   `--metadata-property` flag and a JSON config file
+ * - a plain object mapping a name to a value, or to a list of values for a
+ *   property that repeats — a JSON document or a YAML config file
+ *
+ * Values must be strings, numbers, or booleans. An entry without a name, a
+ * `name=value` string without a separator, and an empty or structured value
+ * are dropped rather than guessed at: a property with a mangled name or an
+ * `[object Object]` value is worse than none.
+ *
+ * @param {unknown} input Properties in any accepted shape
+ * @returns {{name: string, value: string}[]} Normalized properties
+ */
+export declare function parseMetadataProperties(input: unknown): {
+    name: string;
+    value: string;
+}[];
+//# sourceMappingURL=metadataProperties.d.ts.map

package/types/lib/core/metadataProperties.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadataProperties.d.ts","sourceRoot":"","sources":["../../../lib/core/metadataProperties.js"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,UAKzC,CAAC;AAMF;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAHxC,MAGwC,GAFtC,OAAO,CAMnB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAHlC,OAGkC,GAFhC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAiD3C"}

package/types/lib/core/projectConfig.d.ts

@@ -9,15 +9,19 @@ export declare const PROJECT_CONFIG_FILENAMES: string[];
  * whenever that tree is. Path options are therefore confined to the config's
  * own directory - a scanned project may choose where in itself the BOM lands,
  * but not write outside it - and options that redirect data off the host or
- * widen what cdxgen executes are announced on the console.
+ * widen what cdxgen executes are announced on the console. A project may
+ * describe itself with custom metadata properties, but not in the namespaces
+ * cdxgen reserves for the facts it establishes, so a scanned tree cannot pass
+ * its own claims off as cdxgen's.
  *
  * @param {Object} config parsed config file contents
  * @param {string} configDir directory the config file was read from
- * @returns {{config: Object, rejected: string[], announced: string[]}} sanitized config and what it did
+ * @returns {{config: Object, rejected: string[], announced: string[], reservedProperties: string[]}} sanitized config and what it did
  */
 export declare function sanitizeProjectConfig(config: Object, configDir: string): {
     config: Object;
     rejected: string[];
     announced: string[];
+    reservedProperties: string[];
 };
 //# sourceMappingURL=projectConfig.d.ts.map

package/types/lib/core/projectConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"projectConfig.d.ts","sourceRoot":"","sources":["../../../lib/core/projectConfig.js"],"names":[],"mappings":"AAIA;;GAEG;AACH,eAAO,MAAM,wBAAwB,UAKpC,CAAC;AAsEF;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAJjC,MAIiC,EAAE,SAAS,EAH5C,MAG4C,GAF1C;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,CA4BrE"}
+{"version":3,"file":"projectConfig.d.ts","sourceRoot":"","sources":["../../../lib/core/projectConfig.js"],"names":[],"mappings":"AASA;;GAEG;AACH,eAAO,MAAM,wBAAwB,UAKpC,CAAC;AAsEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAJjC,MAIiC,EAAE,SAAS,EAH5C,MAG4C,GAF1C;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,EAAE,MAAM,EAAE,CAAA;CAAC,CA+CnG"}

package/types/lib/core/userAgent.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Outbound `user-agent` construction.
+ *
+ * Package registries police automated traffic through this header, and their
+ * requirements differ. GitHub rejects an absent one with a 403; crates.io
+ * rejects an absent one and additionally blocks a configurable list of exact
+ * strings and prefixes at the CDN edge; Packagist asks for a `mailto=` contact;
+ * PyPI asks for a value that uniquely identifies the consumer, with contact
+ * information; pub.dev documents a `name/version (+url)` shape. The default
+ * built here satisfies all of them at once.
+ *
+ * Two escape hatches exist for operators whose traffic a registry has taken
+ * issue with: `CDXGEN_USER_AGENT` replaces the header everywhere, and
+ * `CDXGEN_USER_AGENT_<REGISTRY>` replaces it for one destination.
+ */
+/**
+ * The registry key covering a host, if any.
+ *
+ * @param {String} hostname Lower-case hostname of the request
+ * @returns {String|undefined} Registry key such as `CRATES`, or undefined
+ */
+export declare function registryKeyForHost(hostname: string): string | undefined;
+/**
+ * The default user-agent: `cdxgen/<version> (+<home url>; mailto=<address>)`.
+ * Setting CDXGEN_CONTACT_EMAIL substitutes a different address, which is what
+ * an operator running cdxgen at scale should do so that a registry contacts
+ * them rather than the project.
+ *
+ * The `@scope/name` npm spelling is deliberately avoided. crates.io blocks
+ * user-agents beginning `@CycloneDX/cdxgen` outright, and a leading `@` is
+ * unusual enough elsewhere to invite the same treatment.
+ *
+ * @returns {String} Default user-agent for outbound requests
+ */
+export declare function defaultUserAgent(): string;
+/**
+ * The user-agent to send to a host. A `CDXGEN_USER_AGENT_<REGISTRY>` override
+ * wins for the hosts of that registry, then the global `CDXGEN_USER_AGENT`,
+ * then the default. Blank overrides are ignored: several registries reject an
+ * empty header outright, so falling back is safer than honouring it.
+ *
+ * @param {String} [hostname] Hostname the request is bound for
+ * @returns {String} User-agent header value
+ */
+export declare function getUserAgent(hostname?: string): string;
+/**
+ * Whether a user-agent carries a substring that crates.io blocks. Useful for
+ * warning an operator whose override would be refused there.
+ *
+ * @param {String} userAgent User-agent value to test
+ * @returns {String|undefined} The offending substring, or undefined
+ */
+export declare function blockedUserAgentSubstring(userAgent: string): string | undefined;
+/** Registry keys that `CDXGEN_USER_AGENT_<REGISTRY>` accepts. */
+export declare const USER_AGENT_REGISTRY_KEYS: readonly string[];
+//# sourceMappingURL=userAgent.d.ts.map

package/types/lib/core/userAgent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userAgent.d.ts","sourceRoot":"","sources":["../../../lib/core/userAgent.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAwDH;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,QAAA,GAF9B,SAAO,SAAS,CAe5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,WAI/B;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,QAAQ,AAHlC,CACA,QAEkC,UAUpC;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,QAAA,GAFtC,SAAO,SAAS,CAU5B;AAED,iEAAiE;AACjE,eAAO,MAAM,wBAAwB,mBAEpC,CAAC"}

package/types/lib/ecosystems/bunutils.d.ts

@@ -14,14 +14,21 @@ export declare function parseBunDescriptor(descriptor: string): {
     version: string;
 };
 /**
- * Parse a bun text lockfile (`bun.lock`, lockfileVersion 1).
+ * Parse a bun text lockfile (`bun.lock`, lockfileVersion 1-3; v1 was written
+ * by the Zig implementation in bun 1.2.x-1.3.x and v2/v3 by the Rust one in
+ * bun 1.4+ - the content shape is identical, only parse strictness changed).
  *
  * Bun's text lockfile is JSONC (JSON with trailing commas). It records the
  * workspace roots under `workspaces` and the fully resolved dependency tree
- * under `packages`, where each entry is an array of the form
- * `["name@version", "registry", { dependencies, optionalDependencies, bin,
- * os, cpu, ... }, "sha512-..."]`. Nested duplicate versions are keyed by their
- * dependency path (eg `"parent/child"`).
+ * under `packages`, where nested duplicate versions are keyed by their
+ * dependency path (eg `"parent/child"`). The entry layout after the leading
+ * `"name@version"` descriptor depends on the resolution type (see the
+ * Stringifier in bun's bun.lock.rs):
+ * - npm: `["name@version", tarballUrlOrEmpty, { dependencies, bin, os, ... }, "sha512-..."]`
+ * - git/github: `["name@git+repo", { ... }, ".bun-tag", "sha512-..."]`
+ * - tarball/folder/symlink: `["name@url", { ... }, "sha512-..."]`
+ * - workspace: `["name@workspace:path"]`
+ * so the elements are recognised by shape instead of fixed indices.
  *
  * The binary lockfile (`bun.lockb`) is intentionally not supported - callers
  * should ask users to regenerate it with `bun install --save-text-lockfile`.

package/types/lib/ecosystems/bunutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bunutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/bunutils.js"],"names":[],"mappings":"AAuBA;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EALlC,MAKkC,GAJhC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAwB1D;AAyBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,YAAY,CAAC,WAAW,EALnC,MAKmC,EAAE,OAAO,AAJpD,CACA,EADQ,MAIiD,GAH/C,OAAO,CAAC;IAAC,OAAO,QAAQ;IAAC,gBAAgB,QAAO;CAAC,CAAC,CAoT9D"}
+{"version":3,"file":"bunutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/bunutils.js"],"names":[],"mappings":"AAgCA;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EALlC,MAKkC,GAJhC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAwB1D;AA2ED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,YAAY,CAAC,WAAW,EALnC,MAKmC,EAAE,OAAO,AAJpD,CACA,EADQ,MAIiD,GAH/C,OAAO,CAAC;IAAC,OAAO,QAAQ;IAAC,gBAAgB,QAAO;CAAC,CAAC,CA0Z9D"}

package/types/lib/ecosystems/cargoCache.d.ts

@@ -0,0 +1,75 @@
+export type CargoCacheMetadata = {
+    /**
+     * Crate description.
+     */
+    description?: string;
+    /**
+     * SPDX license expression.
+     */
+    license?: string;
+    /**
+     * Source repository URL.
+     */
+    repository?: string;
+    /**
+     * Homepage URL.
+     */
+    homepage?: string;
+    /**
+     * Minimum supported Rust version.
+     */
+    rustVersion?: string;
+    /**
+     * SHA-256 of the published `.crate` archive.
+     */
+    checksum?: string;
+    /**
+     * Feature table.
+     */
+    features?: Object;
+    /**
+     * Whether this version was yanked.
+     */
+    yanked?: boolean;
+    /**
+     * RFC 3339 publish timestamp.
+     */
+    publishTime?: string;
+    /**
+     * Newest non-yanked version in the index.
+     */
+    latestVersion?: string;
+    /**
+     * Which local files answered, for provenance.
+     */
+    sources: string[];
+};
+/**
+ * Reset memoized state. Tests that point `CARGO_HOME` at a fixture need the
+ * next call to look again rather than reuse the previous run's answer.
+ *
+ * @returns {void}
+ */
+export declare function resetCargoCacheState(): void;
+/**
+ * Whether the local registry should be consulted before crates.io.
+ *
+ * @returns {boolean} false when `CARGO_METADATA_SOURCE=registry` opts out.
+ */
+export declare function localCargoMetadataEnabled(): boolean;
+/**
+ * Resolve the Cargo registry root.
+ *
+ * @returns {string} Absolute path to `$CARGO_HOME/registry`.
+ */
+export declare function getCargoRegistryDir(): string;
+/**
+ * Read everything the local registry knows about one crate version.
+ *
+ * @param {string} name Crate name.
+ * @param {string} version Exact version.
+ * @returns {CargoCacheMetadata|undefined} Metadata, or undefined when neither
+ *   local source has this crate.
+ */
+export declare function readCargoCacheMetadata(name: string, version: string): CargoCacheMetadata | undefined;
+//# sourceMappingURL=cargoCache.d.ts.map

package/types/lib/ecosystems/cargoCache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cargoCache.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cargoCache.js"],"names":[],"mappings":"AAsCG,YAAkB,kBAAkB,GACpC;;;;IAAoB,WAAW,AAA/B,CACA,EADW,MAAM,CACjB;;;;IAAoB,OAAO,AAA3B,CACA,EADW,MAAM,CACjB;;;;IAAoB,UAAU,AAA9B,CACA,EADW,MAAM,CACjB;;;;IAAoB,QAAQ,AAA5B,CACA,EADW,MAAM,CACjB;;;;IAAoB,WAAW,AAA/B,CACA,EADW,MAAM,CACjB;;;;IAAoB,QAAQ,AAA5B,CACA,EADW,MAAM,CACjB;;;;IAAoB,QAAQ,AAA5B,CACA,EADW,MAAM,CACjB;;;;IAAqB,MAAM,AAA3B,CACA,EADW,OAAO,CAClB;;;;IAAoB,WAAW,AAA/B,CACA,EADW,MAAM,CACjB;;;;IAAoB,aAAa,AAAjC,CACA,EADW,MAAM,CACjB;;;;IAAqB,OAAO,EAAjB,MAAM,EAAE,CACrB;CAAA,CAAA;AAUD;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAFvB,IAAI,CAKhB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAF5B,OAAO,CAOnB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,CAOlB;AAkCD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EALhC,MAKgC,EAAE,OAAO,EAJzC,MAIyC,GAHvC,kBAAkB,GAAC,SAAS,CA0BxC"}

package/types/lib/ecosystems/caxa.d.ts

@@ -5,4 +5,18 @@
  * @returns {Promise<Object>} Parsed metadata object.
  */
 export declare function parseCaxaMetadata(mfile: string): Promise<Object>;
+/**
+ * Complete caxa metadata from the application the binary extracts (or was
+ * built from): npm integrity from the lockfile pnpm or npm leaves in
+ * node_modules, the native tools a cdxgen plugins manifest describes, with
+ * their own dependencies, and the PHP, Ruby and Java packages vendored inside
+ * npm packages. Everything found is linked from the npm package whose
+ * directory contains it; npm packages that are not in the metadata are
+ * ignored.
+ *
+ * @param {Object} mdata Parsed caxa metadata (see parseCaxaMetadata)
+ * @param {string} appDir Directory of the extracted app
+ * @returns {Promise<Object>} The metadata, with components and dependencies added
+ */
+export declare function enrichCaxaMetadataFromApp(mdata: Object, appDir: string): Promise<Object>;
 //# sourceMappingURL=caxa.d.ts.map

package/types/lib/ecosystems/caxa.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"caxa.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/caxa.js"],"names":[],"mappings":"AAMA;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAHlC,MAGkC,GAFhC,OAAO,CAAC,MAAM,CAAC,CAkE3B"}
+{"version":3,"file":"caxa.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/caxa.js"],"names":[],"mappings":"AAiBA;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAHlC,MAGkC,GAFhC,OAAO,CAAC,MAAM,CAAC,CA0E3B;AAiXD;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAJ1C,MAI0C,EAAE,MAAM,EAHlD,MAGkD,GAFhD,OAAO,CAAC,MAAM,CAAC,CAyC3B"}

package/types/lib/ecosystems/cmakeResolver.d.ts

@@ -172,5 +172,28 @@ export declare function buildDependentPurl(resolvedUrl: string, version?: string
  * @returns {Object[]} Components with one entry per package name, in first-seen order
  */
 export declare function collapseCmakeVersions(pkgList: Object[]): Object[];
+/**
+ * Keep one component per dependency downloaded at configure time.
+ *
+ * The same `FetchContent_Declare` may be read from several files, and a
+ * `find_package(<name>)` names the package a `FetchContent_Declare(<name>)` or
+ * `CPMAddPackage` fetches. Within the components scraped from CMake files, the
+ * first fetched component of each name stands for all of them, and a plain
+ * `find_package` entry of that name is dropped.
+ *
+ * @param {Object[]} pkgList Components scraped from CMake-like files
+ * @returns {Object[]} The components, in first-seen order
+ */
+export declare function preferFetchedCmakeDependencies(pkgList: Object[]): Object[];
+/**
+ * Drop the components scraped from CMake files for a dependency the build tree
+ * has resolved: the gitclone script names the repository and tag that were
+ * really checked out, so its component replaces the declared one.
+ *
+ * @param {Object[]} pkgList Components collected so far
+ * @param {string} name Name of the resolved dependency
+ * @returns {Object[]} The components without the scraped entries for `name`
+ */
+export declare function withoutScrapedFetchDependency(pkgList: Object[], name: string): Object[];
 export { GIT_COMMAND, toRepoRelative };
 //# sourceMappingURL=cmakeResolver.d.ts.map

package/types/lib/ecosystems/cmakeResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cmakeResolver.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cmakeResolver.js"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH,OAAO,EAEL,WAAW,EAEZ,MAAM,4BAA4B,CAAC;AAgBpC;;;;;;;;GAQG;AACH,iBAAS,cAAc,CAAC,OAAO,EAJpB,MAIoB,EAAE,QAAQ,EAH9B,MAG8B,GAF5B,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAkC1D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC;IAAE,WAAW,EAAE;QAAC,IAAI,CAAC,EAAC,MAAM,CAAC;QAAC,OAAO,CAAC,EAAC,MAAM,CAAA;KAAC,GAAC,IAAI,CAAC;IAAC,QAAQ,gBAAM;IAAC,YAAY,gBAAM;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAuBxJ;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,OAAO,EAH/C,MAG+C,GAF7C;IAAE,GAAG,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,CAmClD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAH7B,MAG6B,GAF3B;IAAE,GAAG,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,CA6BlD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAHhC,MAGgC,GAF9B,GAAG,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAiB/E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAHlC,MAGkC,GAFhC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA4BvF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC;IAAE,WAAW,EAAE;QAAC,IAAI,CAAC,EAAC,MAAM,CAAC;QAAC,OAAO,CAAC,EAAC,MAAM,CAAA;KAAC,GAAC,IAAI,CAAC;IAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAC,MAAM,CAAC,CAAC;IAAC,UAAU,QAAQ;IAAC,SAAS,QAAQ;IAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAC;QAAC,IAAI,EAAC,MAAM,CAAC;QAAA,OAAO,CAAC,EAAC,MAAM,CAAC;QAAA,GAAG,CAAC,EAAC,MAAM,CAAC;QAAA,IAAI,EAAC,MAAM,CAAA;KAAC,CAAC,CAAA;CAAE,CAqGvN;AAgBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAJnC,MAImC,EAAE,OAAO,AAHpD,CACA,EADQ,MAG4C,GAF1C,MAAM,GAAC,IAAI,CAcvB;AAuED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAHlC,MAAM,EAG4B,GAFhC,MAAM,EAAE,CA2DpB;AAED,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"cmakeResolver.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cmakeResolver.js"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH,OAAO,EAEL,WAAW,EAEZ,MAAM,4BAA4B,CAAC;AAgBpC;;;;;;;;GAQG;AACH,iBAAS,cAAc,CAAC,OAAO,EAJpB,MAIoB,EAAE,QAAQ,EAH9B,MAG8B,GAF5B,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAkC1D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC;IAAE,WAAW,EAAE;QAAC,IAAI,CAAC,EAAC,MAAM,CAAC;QAAC,OAAO,CAAC,EAAC,MAAM,CAAA;KAAC,GAAC,IAAI,CAAC;IAAC,QAAQ,gBAAM;IAAC,YAAY,gBAAM;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAuBxJ;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,OAAO,EAH/C,MAG+C,GAF7C;IAAE,GAAG,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,CAmClD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAH7B,MAG6B,GAF3B;IAAE,GAAG,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,CA6BlD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAHhC,MAGgC,GAF9B,GAAG,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAiB/E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAHlC,MAGkC,GAFhC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA4BvF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC;IAAE,WAAW,EAAE;QAAC,IAAI,CAAC,EAAC,MAAM,CAAC;QAAC,OAAO,CAAC,EAAC,MAAM,CAAA;KAAC,GAAC,IAAI,CAAC;IAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAC,MAAM,CAAC,CAAC;IAAC,UAAU,QAAQ;IAAC,SAAS,QAAQ;IAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAC;QAAC,IAAI,EAAC,MAAM,CAAC;QAAA,OAAO,CAAC,EAAC,MAAM,CAAC;QAAA,GAAG,CAAC,EAAC,MAAM,CAAC;QAAA,IAAI,EAAC,MAAM,CAAA;KAAC,CAAC,CAAA;CAAE,CAqGvN;AAgBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAJnC,MAImC,EAAE,OAAO,AAHpD,CACA,EADQ,MAG4C,GAF1C,MAAM,GAAC,IAAI,CAcvB;AAuED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAHlC,MAAM,EAG4B,GAFhC,MAAM,EAAE,CA2DpB;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAH3C,MAAM,EAGqC,GAFzC,MAAM,EAAE,CAyBpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAJ1C,MAAM,EAIoC,EAAE,IAAI,EAHhD,MAGgD,GAF9C,MAAM,EAAE,CAapB;AAED,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC"}

package/types/lib/ecosystems/cppEvidence.d.ts

@@ -17,16 +17,16 @@ export declare function getCppModules(src: string, options: object, osPkgsList:
         "bom-ref": string;
         group?: undefined;
     } | {
+        purl?: undefined;
         description?: undefined;
         license?: undefined;
-        purl?: undefined;
         "bom-ref"?: undefined;
         group: any;
         name: any;
         version: string;
         type: string;
     } | undefined;
-    pkgList: any[];
+    pkgList: object[];
     dependenciesList: {
         ref: any;
         dependsOn: any[];

package/types/lib/ecosystems/cppEvidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cppEvidence.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cppEvidence.js"],"names":[],"mappings":"AA4BA;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EALtB,MAKsB,EAAE,OAAO,EAJ/B,MAI+B,EAAE,UAAU,EAH3C,KAG2C,EAAE,QAAQ,EAFrD,KAEqD;;;;;;;;;;;;;;;;;;;;;;;;;EA4Q/D"}
+{"version":3,"file":"cppEvidence.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cppEvidence.js"],"names":[],"mappings":"AAwDA;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EALtB,MAKsB,EAAE,OAAO,EAJ/B,MAI+B,EAAE,UAAU,EAH3C,KAG2C,EAAE,QAAQ,EAFrD,KAEqD;;;;;;;;;;;;;;;;;;;;;;;;;EAuT/D"}

package/types/lib/ecosystems/ecosystems.d.ts

@@ -236,9 +236,23 @@ export declare function getGoPkgVCSUrl(group: string, name: string): Promise<any
 /**
  * Method to retrieve metadata for rust packages by querying crates
  *
+ * The local Cargo registry is consulted first, because crates.io's crawler
+ * policy allows one request per second and a populated `~/.cargo` already
+ * holds the license, description, repository, checksum and yanked flag for
+ * every crate the build compiled.
+ *
+ * What it does not hold is publisher identity, so a caller that needs the
+ * publisher-drift and release-cadence signals — the predictive audit does —
+ * passes `preferLocalCache: false` and takes the slower registry path.
+ *
  * @param {Array} pkgList Package list
+ * @param {Object} [options] Options
+ * @param {boolean} [options.preferLocalCache=true] Answer from the local Cargo
+ *   registry where it can, and query crates.io only for the rest.
  */
-export declare function getCratesMetadata(pkgList: any[]): Promise<any[]>;
+export declare function getCratesMetadata(pkgList: any[], options?: {
+    preferLocalCache?: boolean;
+}): Promise<any[]>;
 /**
  * Method to retrieve metadata for dart packages by querying pub.dev
  *

package/types/lib/ecosystems/ecosystems.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ecosystems.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/ecosystems.js"],"names":[],"mappings":"AA6FA,eAAO,IAAI,cAAc,IAAK,CAAC;AAY/B;;;;GAIG;AACH,wBAAgB,mBAAmB,SAElC;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAH1C,MAAM,EAGoC,GAFxC,OAAO,CAAC,MAAM,EAAE,CAAC,CAmC7B;AAyBD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,OAAO,OAAA,EAAE,WAAW,KAAA,kBAiGxD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAL/B,MAK+B,EAAE,IAAI,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,MAAM,GAAC,IAAI,CAmIvB;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,OAAA,EACP,YAAY,GAPH,MAOQ,EACjB,KAAK,UAAQ,SA+Ed;AA4ND;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,UAGnE;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,GAF/D,MAAM,GAAC,SAAS,CA6B3B;AAgBD;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,GAFzD,OAAO,QAAQ,CAgB1B;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAF/C,MAAM,QAEyC,qBAUzD;AAED;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CAAC,EACpD,SAAS,EACT,KAAK,EACL,IAAI,EACJ,OAAO,GACR,QAAA,GAPW,OAAO,QAAQ,CAc1B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,OAAA,EAAE,iBAAiB,EAF7D,GAE6D,OAwBvE;AA6BD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,OAAA,EAAE,aAAa,SAAA,kBA8PzD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAJjC,MAIiC,EAAE,WAAW,GAH9C,MAG0D;;;;;;;;IAiIpE;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAHzC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAGH,GAFvC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAJtC,MAIsC,EAAE,UAAU,EAHlD,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAGD,GAFhD,IAAI,CAuBhB;AAiBD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,YAAY,EAH5C,MAG4C,GAF3C,SAAO,SAAS,CAqB3B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,QAAA,GAF7B,QAAQ,CAQnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,QAAA,EAAE,YAAY,EAHzC,MAGyC,GAFxC,SAAO,SAAS,CAc3B;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAJxC,KAAK,CAAC,MAAM,GAAC,SAAS,CAIkB,GAFtC,OAAO,CAAC,IAAI,CAAC,CAqCzB;AAED;;GAEG;AACH,wBAAgB,wBAAwB,SAEvC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,OAAO,EALjC,MAKiC,EAAE,YAAY,AAJvD,CACA,EADQ,MAI+C,GAH7C,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CAkExE;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAJxC,KAAK,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,CAIG,GAFtC,OAAO,CAAC,IAAI,CAAC,CAwCzB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,SAEjC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,YAAY,EAFvC,MAEuC,gBA2CjD;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,KAAK,QAAA,EAAE,IAAI,QAAA,gBAsB/C;AA2CD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,OAAA,kBA4G9C;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,OAAO,OAAA,kBAiE5C;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAHtC,MAGsC,GAFpC,MAAM,GAAC,SAAS,CA6B5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EANpC,MAMoC,EAAE,OAAO,EAL7C,MAK6C,EAAE,YAAY,GAJ3D,MAIgE,kBAmY1E;AA6MD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,OAAA,EAAE,YAAY,QAAY;;;GA4JvE"}
+{"version":3,"file":"ecosystems.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/ecosystems.js"],"names":[],"mappings":"AAkGA,eAAO,IAAI,cAAc,IAAK,CAAC;AAY/B;;;;GAIG;AACH,wBAAgB,mBAAmB,SAElC;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAH1C,MAAM,EAGoC,GAFxC,OAAO,CAAC,MAAM,EAAE,CAAC,CAmC7B;AAyBD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,OAAO,OAAA,EAAE,WAAW,KAAA,kBAiGxD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAL/B,MAK+B,EAAE,IAAI,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,MAAM,GAAC,IAAI,CAmIvB;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,OAAA,EACP,YAAY,GAPH,MAOQ,EACjB,KAAK,UAAQ,SA+Ed;AA4ND;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,UAGnE;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,GAF/D,MAAM,GAAC,SAAS,CA6B3B;AAgBD;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,GAFzD,OAAO,QAAQ,CAkB1B;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAF/C,MAAM,QAEyC,qBAUzD;AAED;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CAAC,EACpD,SAAS,EACT,KAAK,EACL,IAAI,EACJ,OAAO,GACR,QAAA,GAPW,OAAO,QAAQ,CAc1B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,OAAA,EAAE,iBAAiB,EAF7D,GAE6D,OAwBvE;AA6BD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,OAAA,EAAE,aAAa,SAAA,kBA8PzD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAJjC,MAIiC,EAAE,WAAW,GAH9C,MAG0D;;;;;;;;IAiIpE;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAHzC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAGH,GAFvC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAJtC,MAIsC,EAAE,UAAU,EAHlD,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAGD,GAFhD,IAAI,CAuBhB;AAiBD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,YAAY,EAH5C,MAG4C,GAF3C,SAAO,SAAS,CAqB3B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,QAAA,GAF7B,QAAQ,CAQnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,QAAA,EAAE,YAAY,EAHzC,MAGyC,GAFxC,SAAO,SAAS,CAc3B;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAJxC,KAAK,CAAC,MAAM,GAAC,SAAS,CAIkB,GAFtC,OAAO,CAAC,IAAI,CAAC,CAqCzB;AAED;;GAEG;AACH,wBAAgB,wBAAwB,SAEvC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,OAAO,EALjC,MAKiC,EAAE,YAAY,AAJvD,CACA,EADQ,MAI+C,GAH7C,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CAkExE;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAJxC,KAAK,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,CAIG,GAFtC,OAAO,CAAC,IAAI,CAAC,CAwCzB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,SAEjC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,YAAY,EAFvC,MAEuC,gBA2CjD;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,KAAK,QAAA,EAAE,IAAI,QAAA,gBAsB/C;AA2CD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,OAAA,EAAE,OAAO,AAJrD,CAGF,EAFE;IAA0B,gBAAgB,AAA1C,CAEF,EAFU,OAAO,CAEjB;CAC4D,kBAiJ5D;AAkFD;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,OAAO,OAAA,kBAiE5C;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAHtC,MAGsC,GAFpC,MAAM,GAAC,SAAS,CA6B5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EANpC,MAMoC,EAAE,OAAO,EAL7C,MAK6C,EAAE,YAAY,GAJ3D,MAIgE,kBAyY1E;AAiND;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,OAAA,EAAE,YAAY,QAAY;;;GA2KvE"}

package/types/lib/ecosystems/golem.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"golem.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/golem.js"],"names":[],"mappings":"AA+iDA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAJ/B,MAI+B,GAH7B,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,UAAU,EAJrC,MAIqC,EAAE,OAAO,AAHtD,CACA,EADQ,MAGmD,GAFjD,OAAO,CAmDnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,EAAE,OAAO,AAH7C,CACA,EADQ,MAG0C,GAFxC,MAAM,GAAC,SAAS,CA2B5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,AAL7C,CACA,EADQ,MAK0C,EAAE,UAAU,AAJ9D,CACA,EADQ,KAAK,CAAC,MAAM,CAI+C,GAHzD;IAAC,sBAAsB,2BAAgC;IAAC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,mBAAmB,0BAA0B;IAAC,cAAc,wBAAwB;IAAC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,eAAe,wBAAuB;CAAC,CAsFpQ"}
+{"version":3,"file":"golem.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/golem.js"],"names":[],"mappings":"AAyjDA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAJ/B,MAI+B,GAH7B,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,UAAU,EAJrC,MAIqC,EAAE,OAAO,AAHtD,CACA,EADQ,MAGmD,GAFjD,OAAO,CAmDnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,EAAE,OAAO,AAH7C,CACA,EADQ,MAG0C,GAFxC,MAAM,GAAC,SAAS,CA2B5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,AAL7C,CACA,EADQ,MAK0C,EAAE,UAAU,AAJ9D,CACA,EADQ,KAAK,CAAC,MAAM,CAI+C,GAHzD;IAAC,sBAAsB,2BAAgC;IAAC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,mBAAmB,0BAA0B;IAAC,cAAc,wBAAwB;IAAC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,eAAe,wBAAuB;CAAC,CAsFpQ"}

package/types/lib/ecosystems/gradleutils.d.ts

@@ -1,10 +1,16 @@
 /**
  * Method to return the gradle command to use.
  *
+ * Project-local wrapper scripts (`gradlew`) are attacker-controlled files in
+ * the scanned project, so they are only used when dependency tooling is
+ * allowed (`options.installDeps !== false`); otherwise the system Gradle is
+ * used.
+ *
  * @param {string} srcPath Path to look for gradlew wrapper
  * @param {string|null} rootPath Root directory to look for gradlew wrapper
+ * @param {Object} [options] CLI options (`installDeps` gates wrapper use)
  */
-export declare function getGradleCommand(srcPath: string, rootPath: string | null): string;
+export declare function getGradleCommand(srcPath: string, rootPath: string | null, options?: Object): string;
 /**
  * Method to combine the general gradle arguments, the sub-commands and the sub-commands' arguments in the correct way
  *
@@ -57,7 +63,7 @@ export declare function parseGradleProperties(rawOutput: string, gradleModuleNam
  *
  * @returns {string} The combined output for all subprojects of the Gradle properties task
  */
-export declare function executeParallelGradleProperties(dir: string, allProjectsStr: array, extraArgs?: array): string;
+export declare function executeParallelGradleProperties(dir: string, allProjectsStr: array, extraArgs?: array, options?: {}): string;
 /**
  * Forget the causes diagnosed so far, so a process that generates more than
  * one BOM diagnoses each run on its own.
@@ -159,14 +165,44 @@ _includeCacheDir?: boolean): Promise<Object>;
 /**
  * Method to return the mill command to use.
  *
+ * The project-local `mill` script is an attacker-controlled file in the
+ * scanned project, so it is only used when dependency tooling is allowed
+ * (`options.installDeps !== false`).
+ *
  * @param {string} srcPath Path to look for mill wrapper
+ * @param {Object} [options] CLI options (`installDeps` gates wrapper use)
  */
-export declare function getMillCommand(srcPath: string): string;
+export declare function getMillCommand(srcPath: string, options?: Object): string;
 /**
  * Method to return the maven command to use.
  *
+ * Project-local wrapper scripts (`mvnw`) are attacker-controlled files in the
+ * scanned project, so they are only used when dependency tooling is allowed
+ * (`options.installDeps !== false`); otherwise the installed Maven is used.
+ *
  * @param {string} srcPath Path to look for maven wrapper
  * @param {string} rootPath Root directory to look for maven wrapper
+ * @param {Object} [options] CLI options (`installDeps` gates wrapper use)
+ */
+export declare function getMavenCommand(srcPath: string, rootPath: string, options?: Object): string;
+/**
+ * Parse a Gradle version catalog (`gradle/libs.versions.toml`).
+ *
+ * A catalog declares coordinates the build scripts then reference by alias.
+ * It is a declaration, not a resolution: entries may go unused, and their
+ * versions may be references into the `[versions]` table. Because of that,
+ * catalog components are emitted only as a fallback when Gradle itself
+ * produced no dependency information, and every component carries a
+ * `cdx:gradle:catalog=true` property so consumers can tell declared catalog
+ * entries from a resolved graph.
+ *
+ * Only libraries whose version resolves to a literal (inline or via
+ * `version.ref`) are emitted; rich or unresolved versions would produce purls
+ * that identify no artifact. Plugins are skipped because they are build-time
+ * only.
+ *
+ * @param {string} catalogFile Path to `libs.versions.toml`
+ * @returns {Object[]} Package records for resolvable library entries
  */
-export declare function getMavenCommand(srcPath: string, rootPath: string): string;
+export declare function parseGradleVersionCatalog(catalogFile: string): Object[];
 //# sourceMappingURL=gradleutils.d.ts.map

package/types/lib/ecosystems/gradleutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gradleutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/gradleutils.js"],"names":[],"mappings":"AAuCA;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,EAAE,QAAQ,EAFvC,MAAM,GAAC,IAEgC,UA2FjD;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,eAAe,EARN,MAAM,EAQA,EACf,iBAAiB,EARR,MAAM,EAQE,EACjB,yBAAyB,EARhB,MAAM,EAQU,EACzB,mBAAmB,EARV,GAQU,GANR,MAAM,EAAE,CA2CpB;AAcD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAJ1C,MAI0C,EAAE,aAAa,EAHzD,MAAM,EAGmD,GAFvD,GAAG,CAqCf;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAFlC,MAEkC;;;EAsD5C;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAHpC,MAGoC,EAAE,gBAAgB,GAFtD,MAE6D;;;;;;;;EAoDvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAPM,MAON,EACH,cAAc,EAPL,KAOK,EACd,SAAS,GAPA,KAOK,GALH,MAAM,CAuFlB;AAiBD;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAF3B,IAAI,CAKhB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAF7B,OAAO,CAInB;AAiGD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EANzC,MAMyC,EAAE,OAAO,GAJ1D;IAAyB,OAAO,AAAhC,CACA,EADQ,MAAM,CACd;IAAyB,aAAa,AAAtC,CACA,EADQ,MAAM,CACd;CAE+D,GAFrD,IAAI,CA+HhB;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,SAAS,EANA,MAMA,EACT,eAAe,GANN,MAMe,EACxB,aAAa,GANJ,GAMgB,EACzB,cAAc,GANL,MAMU;;;;;;;;;GAkPpB;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,QAAQ,EAHpD,MAGoD,GAFlD,MAAM,CAkDlB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,gBAAgB,EAHjD,MAGiD,GAF/C,MAAM,CAkBlB;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAH5C,MAG4C,GAF1C,MAAM,CAuBlB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAHtC,MAGsC,GAFpC,MAAM,CA8ClB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAPD,MAOC,EACV,SAAS,EAPA,MAOA,EACT,QAAQ,GAPC,OAOM,EAAE,qCAAqC;AACtD,gBAAgB,GAPP,OAOe,GANb,OAAO,CAAC,MAAM,CAAC,CAgC3B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAF3B,MAE2B,UAcrC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,MAG4B,EAAE,QAAQ,EAFtC,MAEsC,UA6JhD"}
+{"version":3,"file":"gradleutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/gradleutils.js"],"names":[],"mappings":"AAwCA;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAJ7B,MAI6B,EAAE,QAAQ,EAHvC,MAAM,GAAC,IAGgC,EAAE,OAAO,AAFxD,CACF,EADU,MAEqD,UAoG/D;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,eAAe,EARN,MAAM,EAQA,EACf,iBAAiB,EARR,MAAM,EAQE,EACjB,yBAAyB,EARhB,MAAM,EAQU,EACzB,mBAAmB,EARV,GAQU,GANR,MAAM,EAAE,CA2CpB;AAcD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAJ1C,MAI0C,EAAE,aAAa,EAHzD,MAAM,EAGmD,GAFvD,GAAG,CAqCf;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAFlC,MAEkC;;;EAsD5C;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAHpC,MAGoC,EAAE,gBAAgB,GAFtD,MAE6D;;;;;;;;EAoDvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAPM,MAON,EACH,cAAc,EAPL,KAOK,EACd,SAAS,GAPA,KAOK,EACd,OAAO,KAAK,GAND,MAAM,CAwFlB;AAiBD;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAF3B,IAAI,CAKhB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAF7B,OAAO,CAInB;AAiGD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EANzC,MAMyC,EAAE,OAAO,GAJ1D;IAAyB,OAAO,AAAhC,CACA,EADQ,MAAM,CACd;IAAyB,aAAa,AAAtC,CACA,EADQ,MAAM,CACd;CAE+D,GAFrD,IAAI,CA+HhB;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,SAAS,EANA,MAMA,EACT,eAAe,GANN,MAMe,EACxB,aAAa,GANJ,GAMgB,EACzB,cAAc,GANL,MAMU;;;;;;;;;GAkPpB;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,QAAQ,EAHpD,MAGoD,GAFlD,MAAM,CAkDlB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,gBAAgB,EAHjD,MAGiD,GAF/C,MAAM,CAkBlB;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAH5C,MAG4C,GAF1C,MAAM,CAuBlB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAHtC,MAGsC,GAFpC,MAAM,CA8ClB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAPD,MAOC,EACV,SAAS,EAPA,MAOA,EACT,QAAQ,GAPC,OAOM,EAAE,qCAAqC;AACtD,gBAAgB,GAPP,OAOe,GANb,OAAO,CAAC,MAAM,CAAC,CAgC3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,EAAE,OAAO,AAF5C,CACF,EADU,MAEyC,UAcnD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAJ5B,MAI4B,EAAE,QAAQ,EAHtC,MAGsC,EAAE,OAAO,AAFvD,CACF,EADU,MAEoD,UAsK9D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAH1C,MAG0C,GAFxC,MAAM,EAAE,CAoEpB"}

package/types/lib/ecosystems/jsEvidence.d.ts

@@ -3,8 +3,11 @@
  *
  * For each component, resolves its module aliases (including the deno jsr
  * specifier), records imported/exported modules as properties, attaches
- * occurrence evidence, and adjusts the component scope to "required" when the
- * package is used or "optional" when it is not.
+ * occurrence evidence, and promotes the component scope to "required" when the
+ * package is used. A package with no observed usage keeps the scope its
+ * manifest parser assigned: static import analysis cannot see packages loaded
+ * from configuration, bundler entrypoints, stylesheets, or plugins, so a
+ * missing import is not evidence that a package is optional.
  *
  * @param {Array<object>} pkgList Package components to enrich.
  * @param {object} allImports Map of import specifier to usage evidence objects.

package/types/lib/ecosystems/jsEvidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jsEvidence.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/jsEvidence.js"],"names":[],"mappings":"AA0GA;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EARE,KAAK,CAAC,MAAM,CAQd,EACP,UAAU,EARD,MAQC,EACV,UAAU,EARD,MAQC,EACV,IAAI,EARK,OAQL,GANO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAqMlC"}
+{"version":3,"file":"jsEvidence.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/jsEvidence.js"],"names":[],"mappings":"AA0GA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EARE,KAAK,CAAC,MAAM,CAQd,EACP,UAAU,EARD,MAQC,EACV,UAAU,EARD,MAQC,EACV,IAAI,EARK,OAQL,GANO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAiMlC"}

package/types/lib/ecosystems/kosi.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Builds the workspace component candidate for one kosi module.
+ *
+ * kosi derives module names from Gradle settings files, so a quoted literal
+ * (rootProject.name = 'KotlinGoat') rides into the reported purl. A purl
+ * cdx-purl rejects anchors nothing and must not reach the BOM: keep the
+ * reported purl when it parses, rebuild one from the cleaned coordinates
+ * when it does not, and return undefined when neither works.
+ *
+ * @param {Object|undefined} workspaceModule One entry of kosi's modules[].
+ * @returns {Object|undefined} Component candidate with a valid purl, or undefined.
+ */
+export declare function kosiWorkspaceComponent(workspaceModule: Object | undefined): Object | undefined;
+export declare function isKosiKotlinLanguage(language: any): boolean;
+/**
+ * True when kosi is disabled by CDXGEN_KOSI_DISABLE (1/all/true) or --no-kosi.
+ * The check happens before any binary resolution so a disabled run never
+ * even looks for the plugin.
+ */
+export declare function kosiDisabled(): any;
+/**
+ * Orchestrates the kosi runs over src and returns the parsed reports: one
+ * `all` pass (every slice kind, dependency tier) and one `reachable` pass
+ * (call-graph reachability from the roots). The analysis is read-only and
+ * offline: kosi never executes the project's build. A classpath.txt beside
+ * the sources (the documented build-tool report) is passed through when
+ * present.
+ *
+ * @param {string} src Directory to analyze.
+ * @param {Object} options Configuration options.
+ * @returns {Object|undefined} { report, reachableReport } or undefined.
+ */
+export declare function analyzeKosiProject(src: string, options?: Object): Object | undefined;
+/**
+ * Merges the reachable pass's evidence into the all pass's maps, mutating
+ * the first argument.
+ *
+ * The reachable pass's slices are the all pass's INTERSECTED with call-graph
+ * reachability from the roots, so every key it produces is a key the all pass
+ * already has, and the unions below cannot add one. That made the second full
+ * `--backend resolved --deps` analysis — the most expensive thing this arm
+ * runs, and it runs it twice — contribute exactly nothing: the one fact it
+ * computes, reachability, was discarded at the merge (the P23 review's R144).
+ * It is recorded now, on the components whose evidence survived the
+ * intersection, which is the signal an SBOM consumer prioritises with. kosi's
+ * own schema deliberately stopped carrying `reachableFromRoots` per slice in
+ * P22 because there it was a mode-level fact wearing a per-slice field's
+ * clothes; here it is neither, it is the measured difference between two runs.
+ */
+export declare function mergeKosiEvidence(all: any, reachable: any): any;
+/**
+ * Services evidence: kosi's outbound services[] rows are already
+ * CycloneDX-shaped.
+ */
+export declare function collectKosiServices(kosiReport?: {}, servicesMap?: {}): {};
+/**
+ * INBOUND endpoints: kosi's apiEndpoints[] rows are the routes the analysed
+ * application itself serves, which `services[]` (kosi's OUTBOUND calls)
+ * does not carry. Without this the whole inbound surface — the path
+ * template, the framework that declared it, and above all whether anything
+ * authenticates it — stopped at the kosi report and never reached the
+ * SaaSBOM.
+ *
+ * One service per endpoint, named the way detectServicesFromOpenAPI names
+ * its own (`service-<path>-<method>`), so an OpenAPI spec and a kosi run
+ * over the same route converge on one entry instead of two.
+ *
+ * `authenticated` is left UNDEFINED when the endpoint declares no
+ * authentication: kosi's empty list means "nothing was declared here",
+ * which is not the same claim as "this route is unauthenticated", and
+ * cdxgen's own detectors use undefined for exactly that unknown.
+ *
+ * @param {Object} kosiReport The parsed JSON generated by kosi.
+ * @param {Object} servicesMap Map populated with detected service definitions
+ * @returns {Object} The mutated services map
+ */
+export declare function collectKosiApiEndpoints(kosiReport?: Object, servicesMap?: Object): Object;
+export declare function collectKosiEvidence(kosiReport?: {}, components?: any[]): {
+    componentPropertiesMap: {};
+    cryptoComponents: any[];
+    cryptoGeneratePurls: {};
+    dataFlowFrames: {};
+    metadataProperties: any[];
+    purlLocationMap: {};
+};
+//# sourceMappingURL=kosi.d.ts.map

package/types/lib/ecosystems/kosi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kosi.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/kosi.js"],"names":[],"mappings":"AAoCA;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,eAAe,EAH3C,MAAM,GAAC,SAGoC,GAFzC,MAAM,GAAC,SAAS,CAwB5B;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,KAAA,WAE5C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,QAQ3B;AA6DD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,GAHpC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAkD5B;AA0BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,KAAA,EAAE,SAAS,KAAA,OA4B/C;AAusBD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,KAAK,EAAE,WAAW,KAAK,MAsEpE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,GAJvC,MAI4C,EAAE,WAAW,GAHzD,MAG8D,GAF5D,MAAM,CAoFlB;AAiCD,wBAAgB,mBAAmB,CAAC,UAAU,KAAK,EAAE,UAAU,QAAK;;;;;;;EA2DnE"}