@cdxgen/cdxgen 13.1.0 → 13.3.0

package/types/lib/ecosystems/npmutils.d.ts

@@ -19,6 +19,48 @@ export declare function setNpmOptionalProperty(pkg: object): void;
  * @returns {void}
  */
 export declare function setNpmPeerProperty(pkg: object): void;
+/**
+ * Marks an npm component as imported only for its TypeScript types.
+ *
+ * @param {object} pkg Component object to annotate
+ * @returns {void}
+ */
+export declare function setNpmTypeOnlyProperty(pkg: object): void;
+/**
+ * Clean an npm version the way `npm publish` does before it records a release.
+ *
+ * Publishing a directory runs the manifest through `npm pkg fix`
+ * (`fixVersionField` in `@npmcli/package-json`, which calls `semver.clean` in
+ * loose mode) and then through libnpmpublish, which calls `semver.clean` again
+ * in strict mode and records the result as the packument version, the
+ * dist-tag, the `_id` and the tarball file name. Semver build metadata
+ * (`1.0.0+build.5`), a leading `v` or `=`, surrounding whitespace and leading
+ * zeros are dropped; a prerelease is kept.
+ *
+ * The `package.json` inside the published tarball keeps the original string,
+ * and so do the lockfiles npm, pnpm, yarn and bun write for a project, a
+ * workspace member or a git, file or link dependency. The cleaned form is the
+ * version the npm registry knows the package by.
+ *
+ * @param {string} version Version as a manifest or lockfile records it
+ * @returns {string|null} The cleaned version, or null when npm would reject `version` as invalid semver
+ */
+export declare function cleanNpmVersion(version: string): string | null;
+/**
+ * Record the version npm would publish when it differs from the recorded one.
+ *
+ * Sets `cdx:npm:cleanedVersion` on an npm component whose version is valid
+ * semver but not in the form {@link cleanNpmVersion} produces, for example
+ * `1.0.0+build.5` (published as `1.0.0`). The component's `version` and `purl`
+ * keep the recorded string: that is what the manifest and lockfile say. A
+ * component whose version is already clean, or not semver at all (a git
+ * commit, a `file:` path), is left without the property, and a stale value from
+ * an earlier pass is replaced.
+ *
+ * @param {object} component Component or package object with `version` and `purl`
+ * @returns {object} The same component, for chaining
+ */
+export declare function setNpmCleanedVersionProperty(component: object): object;
 /**
  * Helper function to create a properly encoded workspace PURL
  *

package/types/lib/ecosystems/npmutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"npmutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/npmutils.js"],"names":[],"mappings":"AA4CA;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAHlC,MAGkC,GAFhC,IAAI,CAgBhB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,MAG+B,GAF7B,IAAI,CAIhB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAH3B,MAG2B,GAFzB,IAAI,CAIhB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAJvC,MAIuC,EAAE,OAAO,EAHhD,MAGgD,GAF9C,MAAM,CA2BlB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,iBAAiB,EAJ/C,MAAM,EAAE,GAAG,SAIoC,EAAE,WAAW,EAH5D,MAG4D,GAF1D,MAAM,GAAG,SAAS,CAe9B;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAHnC,MAAM,GAAG,SAAS,GAAG,IAGc,GAFjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA0CvD;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAHnC,MAGmC,GAFjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,CAqB7C;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,AAHhD,CACA,EADQ,MAG6C,GAF3C;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAmCrG;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,KAAA,EAAE,KAAK,KAAA,EAAE,IAAI,KAAA,WAoC1D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAHjC,MAGiC,GAF/B,MAAM,CAQlB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAJxC,MAIwC,GAHtC,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAHhC,MAGgC,0BAa1C;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAHjC,MAGiC,GAF/B,MAAM,CAOlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAJ7C,MAI6C,EAAE,WAAW,AAHlE,CACA,wBAEuE,GAF7D,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EALrC,MAKqC,EAAE,KAAK,EAJ5C,MAI4C,EAAE,WAAW,wBAAA,GAFvD,yBAAuB,IAAI,CAYvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAN3C,MAM2C,EAAE,KAAK,EALlD,MAKkD,EAAE,IAAI,EAJxD,MAIwD,EAAE,OAAO,EAHjE,MAGiE,GAF/D,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EARI,MAQJ,EACL,IAAI,EARK,MAQL,EACJ,OAAO,EARE,MAQF,EACP,WAAW,wBAAA,GAPA,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,GAAC,SAAS,CA8BxD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAJhC,MAIgC,GAH9B;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAC,GAAC,IAAI,CAsBtG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,wBAAA,EAAE,SAAS,wBAAA,EAAE,WAAW,AAHjE,CACA,wBAEsE,0BAgExE"}
+{"version":3,"file":"npmutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/npmutils.js"],"names":[],"mappings":"AA8CA;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAHlC,MAGkC,GAFhC,IAAI,CAgBhB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,MAG+B,GAF7B,IAAI,CAIhB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAH3B,MAG2B,GAFzB,IAAI,CAIhB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,MAG+B,GAF7B,IAAI,CAIhB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,MAG4B,GAF1B,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,EAH3C,MAG2C,GAFzC,MAAM,CA6BlB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAJvC,MAIuC,EAAE,OAAO,EAHhD,MAGgD,GAF9C,MAAM,CA2BlB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,iBAAiB,EAJ/C,MAAM,EAAE,GAAG,SAIoC,EAAE,WAAW,EAH5D,MAG4D,GAF1D,MAAM,GAAG,SAAS,CAmB9B;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAHnC,MAAM,GAAG,SAAS,GAAG,IAGc,GAFjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA0CvD;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAHnC,MAGmC,GAFjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,CA2B7C;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,AAHhD,CACA,EADQ,MAG6C,GAF3C;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAmCrG;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,KAAA,EAAE,KAAK,KAAA,EAAE,IAAI,KAAA,WAoC1D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAHjC,MAGiC,GAF/B,MAAM,CAQlB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAJxC,MAIwC,GAHtC,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAHhC,MAGgC,0BAa1C;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAHjC,MAGiC,GAF/B,MAAM,CAOlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAJ7C,MAI6C,EAAE,WAAW,AAHlE,CACA,wBAEuE,GAF7D,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EALrC,MAKqC,EAAE,KAAK,EAJ5C,MAI4C,EAAE,WAAW,wBAAA,GAFvD,yBAAuB,IAAI,CAYvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAN3C,MAM2C,EAAE,KAAK,EALlD,MAKkD,EAAE,IAAI,EAJxD,MAIwD,EAAE,OAAO,EAHjE,MAGiE,GAF/D,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EARI,MAQJ,EACL,IAAI,EARK,MAQL,EACJ,OAAO,EARE,MAQF,EACP,WAAW,wBAAA,GAPA,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,GAAC,SAAS,CA8BxD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAJhC,MAIgC,GAH9B;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAC,GAAC,IAAI,CAsBtG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,wBAAA,EAAE,SAAS,wBAAA,EAAE,WAAW,AAHjE,CACA,wBAEsE,0BAsExE"}

package/types/lib/ecosystems/parsers-crystal.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Crystal parser for `shard.yml` and `shard.lock`.
+ *
+ * Shards resolves dependencies declared in `shard.yml` and records the
+ * resolved set in `shard.lock`, which pins each dependency's version and
+ * source repository. Both files are YAML and are read with the standard
+ * parser.
+ *
+ * No `crystal` purl type is registered, so shards are identified as generic
+ * packages carrying a `cdx:purl:proposedType=crystal` property, following
+ * the convention used for nix and zig. This keeps the BOM valid today and
+ * allows a mechanical migration if a type is registered upstream.
+ */
+/**
+ * Parse a Crystal project from `shard.yml` and optional `shard.lock`.
+ *
+ * @param {string} shardYmlFile Path to `shard.yml`
+ * @param {string} [shardLockFile] Path to `shard.lock`, if present
+ * @returns {{ pkgList: object[], dependencies: object[], parentComponent: object, rootInputs?: string[] }}
+ */
+export declare function parseShardsProject(shardYmlFile: string, shardLockFile?: string): {
+    pkgList: object[];
+    dependencies: object[];
+    parentComponent: object;
+    rootInputs?: string[];
+};
+//# sourceMappingURL=parsers-crystal.d.ts.map

package/types/lib/ecosystems/parsers-crystal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers-crystal.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-crystal.js"],"names":[],"mappings":"AAMA;;;;;;;;;;;;GAYG;AAEH;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAJpC,MAIoC,EAAE,aAAa,AAH3D,CACA,EADQ,MAGmD,GAFjD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CA6FzG"}

package/types/lib/ecosystems/parsers-dotnet.d.ts

@@ -1,3 +1,22 @@
+/**
+ * Apply a version to a NuGet component so that the `version` field and the purl
+ * always agree.
+ *
+ * A .NET manifest can state a version that is not a version: an MSBuild property
+ * such as `$(JsonVersion)`, a range such as `[3.13.3,4.0)`, a wildcard such as
+ * `2.0.*`, or nothing at all. Such a declaration cannot go into a purl, so a
+ * component that kept it in `version` while its purl carried none described one
+ * package two ways. A scanner range matching on the versionless purl then reports
+ * every advisory published against the package name.
+ *
+ * The declaration is not lost: callers record it as `cdx:nuget:declared_version_range`.
+ *
+ * @param {Object} pkg Component to update in place. `name` must already be set.
+ * @param {String} [version] Version as stated or resolved, concrete or not
+ *
+ * @returns {Object} The same component
+ */
+export declare function applyNugetVersion(pkg: Object, version?: string): Object;
 /**
  * Method to parse .nupkg files
  *

package/types/lib/ecosystems/parsers-dotnet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsers-dotnet.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-dotnet.js"],"names":[],"mappings":"AAeA;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,SAAS,QAAA,GAF7B,MAAM,CAWlB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,SAAS,QAAA,EAAE,UAAU,QAAA,GAFxC,MAAM,CA4JlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAP3B,MAO2B,EAAE,OAAO,EANpC,MAMoC,EAAE,eAAe,GALrD,MAK0D,GAFxD,MAAM,EAAE,CAsFpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,QAAA,GAHxC,MAAM,CA+ClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,QAAA,EAAE,KAAK,GAN9C,MAMmD,GAHjD,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,QAAA,GAFvC,MAAM,CA2ClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,UAAU,QAAA,EACV,QAAQ,QAAA,EACR,eAAe,GAXN,MAWW,EACpB,gBAAgB,UAAQ,EACxB,yBAAyB,GAXhB,MAWqB,EAC9B,eAAe,GAXN,MAWW,GART,MAAM,CA4dlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAJrC,MAIqC,EAAE,cAAc,EAHrD,MAGqD,GAFnD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAE,CAuP7D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAJlC,MAIkC,EAAE,WAAW,EAH/C,MAG+C,GAF7C;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAkHjF;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAJrC,MAIqC,EAAE,WAAW,EAHlD,MAGkD,GAFhD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAE,CAyH7D"}
+{"version":3,"file":"parsers-dotnet.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-dotnet.js"],"names":[],"mappings":"AAeA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAL1B,MAK0B,EAAE,OAAO,AAJ3C,CAEA,QAE2C,GAFjC,MAAM,CAUlB;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,SAAS,QAAA,GAF7B,MAAM,CAWlB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,SAAS,QAAA,EAAE,UAAU,QAAA,GAFxC,MAAM,CAwKlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAP3B,MAO2B,EAAE,OAAO,EANpC,MAMoC,EAAE,eAAe,GALrD,MAK0D,GAFxD,MAAM,EAAE,CAiFpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,QAAA,GAHxC,MAAM,CA+ClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,QAAA,EAAE,KAAK,GAN9C,MAMmD,GAHjD,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,QAAA,GAFvC,MAAM,CA2ClB;AAiBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,UAAU,QAAA,EACV,QAAQ,QAAA,EACR,eAAe,GAXN,MAWW,EACpB,gBAAgB,UAAQ,EACxB,yBAAyB,GAXhB,MAWqB,EAC9B,eAAe,GAXN,MAWW,GART,MAAM,CAiflB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAJrC,MAIqC,EAAE,cAAc,EAHrD,MAGqD,GAFnD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAE,CAuP7D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAJlC,MAIkC,EAAE,WAAW,EAH/C,MAG+C,GAF7C;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAkHjF;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAJrC,MAIqC,EAAE,WAAW,EAHlD,MAGkD,GAFhD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAE,CAyH7D"}

package/types/lib/ecosystems/parsers-elm.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Parse an Elm project from its 0.19 `elm.json`.
+ *
+ * @param {string} elmJsonFile Path to `elm.json`
+ * @param {object} [cacheReader] Reader returned by {@link createElmCacheReader};
+ *   when omitted, one is derived from the manifest's pinned compiler version
+ * @returns {{ pkgList: object[], dependencies: object[], parentComponent: object, rootInputs: string[] }}
+ */
+export declare function parseElmProject(elmJsonFile: string, cacheReader?: object): {
+    pkgList: object[];
+    dependencies: object[];
+    parentComponent: object;
+    rootInputs: string[];
+};
+/**
+ * Parse a legacy 0.18 Elm project from `elm-package.json` and its optional
+ * `elm-stuff/exact-dependencies.json` lock file.
+ *
+ * @param {string} elmPackageJsonFile Path to `elm-package.json`
+ * @param {string} [exactDepsFile] Path to the lock file, if present
+ * @returns {{ pkgList: object[], dependencies: object[], parentComponent: object, rootInputs: string[] }}
+ */
+export declare function parseLegacyElmProject(elmPackageJsonFile: string, exactDepsFile?: string): {
+    pkgList: object[];
+    dependencies: object[];
+    parentComponent: object;
+    rootInputs: string[];
+};
+/**
+ * Tell whether a candidate `elm.json` really is an Elm manifest. The file
+ * name is distinctive but lives in every Elm project, so detection only
+ * needs a cheap content check before dispatching.
+ *
+ * @param {string} filePath Path to the candidate `elm.json`
+ * @returns {boolean} true when the file declares an Elm project
+ */
+export declare function isElmProjectFile(filePath: string): boolean;
+/**
+ * Create a reader for the local Elm package cache. Reads are memoised and
+ * silently disabled when the cache directory does not exist.
+ *
+ * @param {string} [elmVersionHint] Exact compiler version directory to try
+ *   first, when the project pins one
+ * @returns {{ readMetadata: (name: string, version: string) => object|null, listVersions: (name: string) => string[] }}
+ */
+export declare function createElmCacheReader(elmVersionHint?: string): {
+    readMetadata: (name: string, version: string) => object | null;
+    listVersions: (name: string) => string[];
+};
+/**
+ * Whether the registry's `robots.txt` permits fetching a package's documents.
+ *
+ * @param {string} name Package name, `author/project`
+ * @returns {boolean} true when no `Disallow` rule covers the package
+ */
+export declare function isRegistryCrawlable(name: string): boolean;
+/**
+ * Enrich Elm components from the package registry.
+ *
+ * Only the gaps left by the local cache are fetched, and only for packages
+ * with a resolved version that `robots.txt` permits. Two documents are read
+ * per package, both of which the compiler itself reads when it installs one:
+ *
+ *   - `elm.json` — the published manifest, carrying the summary, the license
+ *     and the package's own dependencies, which close the gaps in the
+ *     dependency graph that an unpopulated cache leaves behind.
+ *   - `endpoint.json` — the source archive URL and the SHA-1 of its bytes,
+ *     which the compiler verifies after downloading. It becomes the
+ *     component's distribution reference and hash.
+ *
+ * Requests carry cdxgen's contact user-agent and pass through the shared
+ * per-host rate policy for `package.elm-lang.org` (see `fetchRate.js`).
+ *
+ * @param {object[]} pkgList Components to enrich, mutated in place
+ * @param {object[]} [dependencies] Dependency edges to complete in place
+ * @returns {Promise<object[]>} The same package list
+ */
+export declare function getElmMetadata(pkgList: object[], dependencies?: object[]): Promise<object[]>;
+//# sourceMappingURL=parsers-elm.d.ts.map

package/types/lib/ecosystems/parsers-elm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers-elm.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-elm.js"],"names":[],"mappings":"AAiEA;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,WAAW,EALhC,MAKgC,EAAE,WAAW,AAJrD,CAEA,EAFQ,MAI6C,GAF3C;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAoGxG;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,kBAAkB,EAJ7C,MAI6C,EAAE,aAAa,AAHpE,CACA,EADQ,MAG4D,GAF1D;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAyFxG;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAH9B,MAG8B,GAF5B,OAAO,CAKnB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,AAJhD,CAEA,EAFQ,MAIwC,GAFtC;IAAE,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,GAAC,IAAI,CAAC;IAAC,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAA;CAAE,CA6FtH;AAmRD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAH7B,MAG6B,GAF3B,OAAO,CAKnB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAJjC,MAAM,EAI2B,EAAE,YAAY,AAHvD,CACA,EADQ,MAAM,EAGyC,GAF7C,OAAO,CAAC,MAAM,EAAE,CAAC,CAyD7B"}

package/types/lib/ecosystems/parsers-go.d.ts

@@ -66,6 +66,16 @@ export declare function parseGoModGraph(rawOutput: string, goModFile: string, go
  * @returns {string|undefined} package name or none
  */
 export declare function parseGoModWhy(rawOutput: string): string | undefined;
+/**
+ * Reports whether `go mod why -m` output says the main module does not need
+ * the module. go prints `(main module does not need module X)`, or
+ * `(main module does not need to vendor module X)` with `-vendor`, and exits
+ * with status 0 either way.
+ *
+ * @param {string} rawOutput Output from go mod why
+ * @returns {boolean} True when go reports the module as not needed
+ */
+export declare function isGoModWhyNotNeeded(rawOutput: string): boolean;
 /**
  * Parse go sum data
  * @param {string} gosumData Content of go.sum

package/types/lib/ecosystems/parsers-go.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsers-go.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-go.js"],"names":[],"mappings":"AA2BA;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EANlC,MAMkC,EAAE,IAAI,EALxC,MAKwC,EAAE,OAAO,EAJjD,MAIiD,EAAE,IAAI,EAHvD,MAGuD,GAFrD,OAAO,CAAC,MAAM,CAAC,CAqD3B;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,SAAS,QAAA,EAAE,QAAQ,EAJ7C,MAI6C,GAF3C,MAAM,CA2ClB;AAkHD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAJpC,MAIoC,EAAE,QAAQ,EAH9C,MAG8C,GAF5C,OAAO,CAAC,MAAM,EAAE,CAAC,CA6B7B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAJnC,MAImC,EAAE,QAAQ,EAH7C,MAG6C;;;GAuHvD;AA4BD;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CACnC,SAAS,EATA,MASA,EACT,SAAS,EATA,MASA,EACT,QAAQ,EATC,MASD,EACR,QAAQ,QAAK,EACb,eAAe,GATN,MASW;;;;;;;;GA0MrB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CAc5B;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAHnC,MAGmC,kBA6B7C;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAHnC,MAGmC,GAFjC,OAAO,CAAC,MAAM,EAAE,CAAC,CAiD7B;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,aAAa,EAH3C,MAG2C,GAFzC,OAAO,CAAC,MAAM,EAAE,CAAC,CAkC7B"}
+{"version":3,"file":"parsers-go.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-go.js"],"names":[],"mappings":"AAgCA;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EANlC,MAMkC,EAAE,IAAI,EALxC,MAKwC,EAAE,OAAO,EAJjD,MAIiD,EAAE,IAAI,EAHvD,MAGuD,GAFrD,OAAO,CAAC,MAAM,CAAC,CAqD3B;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,SAAS,QAAA,EAAE,QAAQ,EAJ7C,MAI6C,GAF3C,MAAM,CA2ClB;AAkHD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAJpC,MAIoC,EAAE,QAAQ,EAH9C,MAG8C,GAF5C,OAAO,CAAC,MAAM,EAAE,CAAC,CA6B7B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAJnC,MAImC,EAAE,QAAQ,EAH7C,MAG6C;;;GAuHvD;AA6CD;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CACnC,SAAS,EATA,MASA,EACT,SAAS,EATA,MASA,EACT,QAAQ,EATC,MASD,EACR,QAAQ,QAAK,EACb,eAAe,GATN,MASW;;;;;;;;GAwMrB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CAc5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAHlC,MAGkC,GAFhC,OAAO,CASnB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAHnC,MAGmC,kBA6B7C;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAHnC,MAGmC,GAFjC,OAAO,CAAC,MAAM,EAAE,CAAC,CAiD7B;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,aAAa,EAH3C,MAG2C,GAFzC,OAAO,CAAC,MAAM,EAAE,CAAC,CAkC7B"}

package/types/lib/ecosystems/parsers-js.d.ts

@@ -62,12 +62,15 @@ export declare function yarnLockToIdentMap(lockData: string): {};
  * @param {Object} parentComponent parent component
  * @param {Array[String]} workspacePackages Workspace packages
  * @param {Object} workspaceSrcFiles Workspace package.json files
- * @param {Object} _workspaceDirectDeps Direct dependencies of each workspace
+ * @param {Object} workspaceDirectDeps Declared dependencies (name to range) of each workspace package
  * @param {Object} depsWorkspaceRefs Workspace references for each dependency
  */
-export declare function parseYarnLock(yarnLockFile: string, parentComponent?: Object, workspacePackages?: any, workspaceSrcFiles?: Object, _workspaceDirectDeps?: Object, depsWorkspaceRefs?: Object): Promise<{
+export declare function parseYarnLock(yarnLockFile: string, parentComponent?: Object, workspacePackages?: any, workspaceSrcFiles?: Object, workspaceDirectDeps?: Object, depsWorkspaceRefs?: Object): Promise<{
     pkgList: any[];
-    dependenciesList: any[];
+    dependenciesList: {
+        ref: string;
+        dependsOn: any[];
+    }[];
 }>;
 /**
  * Parse nodejs shrinkwrap deps file
@@ -103,7 +106,10 @@ export declare function stripPnpmPeerSuffix(version: string): string;
  * {@link stripPnpmPeerSuffix}.
  *
  * @param {string|object} depPkg Dependency version string or package object.
- * @param {string} relativePath Base path for resolving link/file references.
+ * @param {string} relativePath Base path for resolving link/file references:
+ *   the directory of the importer that declares the dependency. Without it the
+ *   path is tried against the working directory, which only works when cdxgen
+ *   runs from the lock file's directory.
  * @returns {Promise<string|undefined>} The resolved published version.
  */
 export declare function getVersionNumPnpm(depPkg: string | object, relativePath: string): Promise<string | undefined>;

package/types/lib/ecosystems/parsers-js.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsers-js.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-js.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA0arC;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAChC,WAAW,EATF,MASE,EACX,MAAM,AATL,CAEA,EAFQ,OASK,EACd,aAAa,AARZ,CAEA,EAFQ,OAQY,GANV,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CA+OlC;AA0CD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAJhC,MAIgC,EAAE,KAAK,EAHvC,MAGuC,GAFrC,MAAM,CASlB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAHpC,MAGoC,GAFlC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAC,GAAC,IAAI,CA6BjF;AA+ED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,WAAW,EAHnC,MAGmC,EAAE,OAAO,GAF5C,MAEiD;;;GAqvB3D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAFhC,MAEgC,MA2E1C;AA0ND;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,YAAY,EARH,MAQG,EACZ,eAAe,GARN,MAQa,EACtB,iBAAiB,MAAK,EACtB,iBAAiB,GARR,MAQa,EACtB,oBAAoB,GARX,MAQgB,EACzB,iBAAiB,GARR,MAQa;;;GAsfvB;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAFrC,MAEqC,kBA+D/C;AA6GD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,QAAA,UAQ1C;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAJnC,MAAM,GAAC,MAI4B,EAAE,YAAY,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAoCrC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,cAAc,CAClC,MAAM,EATG,MAAM,GAAC,MASV,EACN,WAAW,EATF,MASE,EACX,UAAU,EATD,MASC,EACV,YAAY,EATH,MASG,EACZ,gBAAgB,EATP,MASO,EAChB,WAAW,AATV,CACA,EADQ,MASO,GARL,OAAO,CAAC,MAAM,CAAC,CAyD3B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAHrC,MAGqC,GAFnC,MAAM,CAoClB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,eAAe,EAHvC,MAGuC,GAFrC,MAAM,CA2BlB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EALhC,MAKgC,EAAE,WAAW,EAJ7C,MAI6C,EAAE,OAAO,EAHtD,MAGsD,GAFpD,MAAM,GAAC,IAAI,CA4DvB;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,OAAA,EAAE,YAAY,EAH7C,MAG6C,SAqFvD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,QAAA,GAH1B,MAAM,GAAC,SAAS,CAkC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAVC,MAUD,EACR,eAAe,GAVN,MAUa,EACtB,iBAAiB,MAAK,EACtB,iBAAiB,GAVR,MAUa,EACtB,kBAAkB,GAVT,MAUc,EACvB,oBAAoB,GAVX,MAUgB,EACzB,iBAAiB,GAVR,MAUa,EACtB,WAAW,GAVF,MAUc;;;;;;;;;;;;;;;;;;GAq7BxB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,aAAa,EAFvC,MAEuC,kBA6CjD;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,SAAS,EAF/B,MAE+B,kBA2FzC;AAGD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAAM,GAAC,MAGuB,GAF5B;IAAE,KAAK,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,CAoBvG;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,aAAa,QAAA,GAFjC,KAAK,QAAQ,CA4CzB"}
+{"version":3,"file":"parsers-js.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-js.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA0arC;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAChC,WAAW,EATF,MASE,EACX,MAAM,AATL,CAEA,EAFQ,OASK,EACd,aAAa,AARZ,CAEA,EAFQ,OAQY,GANV,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CA+OlC;AA0CD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAJhC,MAIgC,EAAE,KAAK,EAHvC,MAGuC,GAFrC,MAAM,CASlB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAHpC,MAGoC,GAFlC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAC,GAAC,IAAI,CA6BjF;AA+ED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,WAAW,EAHnC,MAGmC,EAAE,OAAO,GAF5C,MAEiD;;;GA0vB3D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAFhC,MAEgC,MA2E1C;AAwND;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,YAAY,EARH,MAQG,EACZ,eAAe,GARN,MAQa,EACtB,iBAAiB,MAAK,EACtB,iBAAiB,GARR,MAQa,EACtB,mBAAmB,GARV,MAQe,EACxB,iBAAiB,GARR,MAQa;;;;;;GAwhBvB;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAFrC,MAEqC,kBA+D/C;AA6GD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,QAAA,UAQ1C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAPnC,MAAM,GAAC,MAO4B,EAAE,YAAY,EANjD,MAMiD,GAF/C,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAoCrC;AAqBD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,cAAc,CAClC,MAAM,EATG,MAAM,GAAC,MASV,EACN,WAAW,EATF,MASE,EACX,UAAU,EATD,MASC,EACV,YAAY,EATH,MASG,EACZ,gBAAgB,EATP,MASO,EAChB,WAAW,AATV,CACA,EADQ,MASO,GARL,OAAO,CAAC,MAAM,CAAC,CA8D3B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAHrC,MAGqC,GAFnC,MAAM,CAoClB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,eAAe,EAHvC,MAGuC,GAFrC,MAAM,CA2BlB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EALhC,MAKgC,EAAE,WAAW,EAJ7C,MAI6C,EAAE,OAAO,EAHtD,MAGsD,GAFpD,MAAM,GAAC,IAAI,CA4DvB;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,OAAA,EAAE,YAAY,EAH7C,MAG6C,SAsFvD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,QAAA,GAH1B,MAAM,GAAC,SAAS,CAkC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAVC,MAUD,EACR,eAAe,GAVN,MAUa,EACtB,iBAAiB,MAAK,EACtB,iBAAiB,GAVR,MAUa,EACtB,kBAAkB,GAVT,MAUc,EACvB,oBAAoB,GAVX,MAUgB,EACzB,iBAAiB,GAVR,MAUa,EACtB,WAAW,GAVF,MAUc;;;;;;;;;;;;;;;;;;GA6+BxB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,aAAa,EAFvC,MAEuC,kBA6CjD;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,SAAS,EAF/B,MAE+B,kBA2FzC;AAGD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAAM,GAAC,MAGuB,GAF5B;IAAE,KAAK,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,CAoBvG;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,aAAa,QAAA,GAFjC,KAAK,QAAQ,CA4CzB"}

package/types/lib/ecosystems/parsers-julia.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Julia project parser.
+ *
+ * Two files are consulted:
+ *   - `Project.toml` — the manifest holding the project name, UUID, version,
+ *     the names (and UUIDs) of its direct dependencies, and version
+ *     compatibility constraints.
+ *   - `Manifest.toml` — the lock file written by Pkg on resolve, pinning every
+ *     package in the environment with its UUID, version, content hash, and the
+ *     names of the packages it depends on.
+ *
+ * Packages are identified with the registered `julia` purl type, which carries
+ * the package UUID as a required qualifier (`pkg:julia/JSON@0.21.4?uuid=…`).
+ * The UUID is what Julia itself uses to identify packages, so keeping it in
+ * the purl lets consumers match components across differently named mirrors.
+ *
+ * Julia standard libraries ship with the language itself and carry no version
+ * in the manifest; they are emitted without a version and marked as standard
+ * libraries so they can be told apart from registry packages.
+ */
+/**
+ * Parse a Julia environment from its `Project.toml` and optional
+ * `Manifest.toml`.
+ *
+ * @param {string} [projectTomlFile] Path to `Project.toml`, if present
+ * @param {string} [manifestTomlFile] Path to `Manifest.toml`, if present
+ * @returns {{ pkgList: object[], dependencies: object[], parentComponent: object, rootInputs?: string[] }}
+ */
+export declare function parseJuliaProject(projectTomlFile?: string, manifestTomlFile?: string): {
+    pkgList: object[];
+    dependencies: object[];
+    parentComponent: object;
+    rootInputs?: string[];
+};
+/**
+ * Tell whether a `Project.toml` declares a Julia environment.
+ *
+ * Cloud Native Buildpacks and Gleam use the same file names, so the caller
+ * needs a content check before dispatching. A Julia project always carries a
+ * package `uuid`, a `[deps]` table, or a `[compat]` table.
+ *
+ * @param {string} filePath Path to the candidate `Project.toml`
+ * @returns {boolean} true when the file is a Julia project
+ */
+export declare function isJuliaProjectFile(filePath: string): boolean;
+/**
+ * Tell whether a `Manifest.toml` is a Julia lock file.
+ *
+ * Gleam writes a lowercase `manifest.toml` that case-insensitive filesystems
+ * surface under the same glob; a Julia manifest is recognised by its
+ * `manifest_format` marker or its `[[deps.<Name>]]` tables.
+ *
+ * @param {string} filePath Path to the candidate `Manifest.toml`
+ * @returns {boolean} true when the file is a Julia manifest
+ */
+export declare function isJuliaManifestFile(filePath: string): boolean;
+//# sourceMappingURL=parsers-julia.d.ts.map

package/types/lib/ecosystems/parsers-julia.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers-julia.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-julia.js"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,eAAe,AAJ9C,CACA,EADQ,MAIsC,EAAE,gBAAgB,AAHhE,CACA,EADQ,MAGwD,GAFtD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CA+FzG;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAHhC,MAGgC,GAF9B,OAAO,CAUnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,OAAO,CASnB"}

package/types/lib/ecosystems/parsers-lua.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Lua parser for rockspecs and `luarocks.lock`.
+ *
+ * A rockspec is a Lua source file whose top level is a sequence of
+ * assignments describing one package: its name, version, source, and a
+ * `dependencies` table of constraint strings (`"lua >= 5.1"`). LuaRocks 3
+ * can also persist the resolved set to `luarocks.lock`. Both are read with a
+ * small line scanner over the shapes these files actually use, rather than a
+ * Lua interpreter.
+ *
+ * Rocks are identified with the registered `luarocks` purl type
+ * (`pkg:luarocks/<name>@<version>`). Lua versions carry a rock revision
+ * suffix (`5.4.6-1`); the full rock version is kept verbatim because the
+ * revision distinguishes distinct builds.
+ */
+/**
+ * Parse a rockspec manifest.
+ *
+ * @param {string} rockspecFile Path to the `.rockspec` file
+ * @returns {{ pkgList: object[], parentComponent: object }}
+ */
+export declare function parseRockspecFile(rockspecFile: string): {
+    pkgList: object[];
+    parentComponent: object;
+};
+/**
+ * Parse a `luarocks.lock` file.
+ *
+ * @param {string} lockFile Path to `luarocks.lock`
+ * @param {string} [rockspecFile] Path to the rockspec, to mark direct deps
+ * @returns {{ pkgList: object[], parentComponent: object }}
+ */
+export declare function parseLuaRocksLock(lockFile: string, rockspecFile?: string): {
+    pkgList: object[];
+    parentComponent: object;
+};
+/**
+ * Read the top-level assignments of a Lua configuration file.
+ *
+ * The files cdxgen consumes use a constrained surface: `key = value` lines
+ * where the value is a quoted string, a table of strings or
+ * `["key"] = "value"` entries, or a short list expression. Values are
+ * normalised to strings, arrays of `{name, constraint}` records, or arrays
+ * of `{key, value}` records for mixed tables.
+ *
+ * @param {string} filePath File to read
+ * @returns {Map<string, *>} Parsed top-level fields
+ */
+export declare function readLuaAssignments(filePath: string): Map<string, any>;
+//# sourceMappingURL=parsers-lua.d.ts.map

package/types/lib/ecosystems/parsers-lua.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers-lua.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-lua.js"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;GAcG;AAEH;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAHnC,MAGmC,GAFjC;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CA4B1D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAJ/B,MAI+B,EAAE,YAAY,AAHrD,CACA,EADQ,MAG6C,GAF3C;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CA8B1D;AAuCD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAHhC,MAGgC,GAF9B,GAAG,CAAC,MAAM,EAAE,GAAC,CAAC,CA4D1B"}

package/types/lib/ecosystems/parsers-misc.d.ts

@@ -311,8 +311,6 @@ export declare function parseSwiftResolved(resolvedFile: string): {
     name: any;
     group: any;
     version: any;
-    purl: string;
-    "bom-ref": string;
     properties: {
         name: string;
         value: string;
@@ -329,6 +327,55 @@ export declare function parseSwiftResolved(resolvedFile: string): {
         };
     };
 }[];
+/**
+ * Identify the targets of a Swift package that are part of what it ships.
+ *
+ * Production targets are the non-test targets that are part of a product,
+ * executables, macros, plugins, targets nothing else depends on, and every
+ * target they depend on. The remaining non-test targets only serve tests,
+ * such as snapshot or fixture helper libraries.
+ *
+ * @param {Object} dumpJson `swift package dump-package` document
+ * @returns {Set<string>} Lowercase names of the production targets
+ */
+export declare function collectSwiftProductionTargets(dumpJson: Object): Set<string>;
+/**
+ * Classify the dependencies of a Swift package into the packages its shipped
+ * code needs and the packages only its tests need.
+ *
+ * Production targets are the non-test targets that are part of a product,
+ * executables, macros, plugins, targets nothing else depends on, and every
+ * target they depend on. The remaining non-test targets only serve tests
+ * (test-support libraries). A package is test-only when only test and
+ * test-support targets reference its products or use its plugins. With the dependency graph from
+ * `swift package show-dependencies`, the packages reachable only through
+ * test-only packages are test-only as well; a package reachable from a
+ * production dependency, or from a declared dependency no target references,
+ * stays required.
+ *
+ * Target dependencies reference products either as
+ * `{"product": [name, package]}` or `{"byName": [name]}`; SwiftPM resolves a
+ * `byName` product through the package of the same name. When a production
+ * `byName` reference names neither a local target nor a package, the
+ * classification is abandoned rather than risking a required package being
+ * scoped optional.
+ *
+ * @param {Object|String} dumpJson `swift package dump-package` document, parsed or as text
+ * @param {Object|String} [treeJson] `swift package show-dependencies --format json` document, parsed or as text
+ * @returns {Object} `{ optionalRefs, requiredRefs, optionalNames, requiredNames }`:
+ *   bom-refs from the dependency graph, and lowercase package identities,
+ *   names, and repository names (the only result without a graph)
+ */
+export declare function classifySwiftDependencyScopes(dumpJson: Object | string, treeJson?: Object | string): Object;
+/**
+ * Decide whether a dump-package target is a test target. The `type` field is
+ * usually the string `"test"`, but manifest APIs have also been observed
+ * representing it as an object.
+ *
+ * @param {Object} atarget dump-package target
+ * @returns {boolean} `true` for test targets
+ */
+export declare function isSwiftTestTarget(atarget: Object): boolean;
 /**
  * Parse a CMake-generated dot/graphviz file and extract components and their dependency
  * relationships.
@@ -347,12 +394,29 @@ export declare function parseCmakeDotFile(dotFile: string, pkgType: string, opti
     pkgList: Object[];
     dependenciesList: Object[];
 };
+/**
+ * The component for a dependency a CMake file downloads at configure time
+ * (`FetchContent_Declare`, `ExternalProject_Add`, `CPMAddPackage`).
+ *
+ * A git repository becomes a `github` purl, or a `generic` one with a
+ * `vcs_url`, at its tag or commit. A GitHub archive URL becomes a `github` purl
+ * at the ref it names. Any other URL becomes a `generic` purl with a
+ * `download_url`, and a `URL_HASH` becomes a hash. A version that still holds an
+ * unresolved `${VAR}` is left out rather than published.
+ *
+ * @param {Object} dep Dependency facts from `cmakeFetchDependencies`
+ * @param {string} srcFile The CMake file the dependency was read from
+ * @returns {Object} The component
+ */
+export declare function cmakeFetchDependencyComponent(dep: Object, srcFile: string): Object;
 /**
  * Parse a CMake-like build file (CMakeLists.txt, meson.build, etc.) and extract the
  * parent component and list of dependency packages.
  *
  * Handles `set`, `project`, `find_package`, `find_library`, `find_dependency`,
- * `find_file`, `FetchContent_MakeAvailable`, and `dependency()` directives.
+ * `find_file` and `dependency()` directives (CMake command names in any case),
+ * and, for CMake files, the dependencies downloaded at configure time by
+ * `FetchContent_Declare`, `ExternalProject_Add` and `CPMAddPackage`.
  * Uses the MesonWrapDB to improve name resolution confidence.
  *
  * @param {string} cmakeListFile Path to the CMake-like build file
@@ -447,4 +511,27 @@ export declare function resetCocoaPodspecPrefetch(): void;
  * @returns {Promise<void>}
  */
 export declare function prefetchCocoaPodspecs(dependencies: Array<Object>): Promise<void>;
+/**
+ * Parse an xmake `xmake-requires.lock` file.
+ *
+ * The lock is a Lua table, written when the `package.requires_lock` policy is
+ * enabled. Its top level holds a `__meta__` entry plus one section per build
+ * configuration, keyed `platform|arch`; each section maps a requirement key
+ * (`"zlib#31fecfc4"`, or `"sol2 v3.2.1#72267bd5"` when the requirement
+ * carries a version) to a table with the resolved `version` and the
+ * `repo` revision the package definition came from.
+ *
+ * The same package appears once per configuration, so entries are collapsed
+ * by name and version, and the configurations a package was resolved for are
+ * kept as a property. A requirement key without a `version` field names a
+ * system package xmake did not resolve; it is inventoried without a version.
+ *
+ * No `xmake` purl type is registered, so packages are identified as generic
+ * carrying a `cdx:purl:proposedType=xmake` property, following the
+ * convention used for nix and zig.
+ *
+ * @param {string} lockFile Path to `xmake-requires.lock`
+ * @returns {Object[]} Package records for the pinned requirements
+ */
+export declare function parseXmakeRequiresLock(lockFile: string): Object[];
 //# sourceMappingURL=parsers-misc.d.ts.map

package/types/lib/ecosystems/parsers-misc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsers-misc.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-misc.js"],"names":[],"mappings":"AAgDA;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,KAAA,EAAE,QAAQ,KAAA,GAF/C,MAAM,CAuElB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAHjC,MAGiC,GAF/B,MAAM,EAAE,CA+BpB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,EAAE,CAiEpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EALvC,MAAM,WAAO,MAK0B,EAAE,OAAO,EAJhD,MAAM,EAI0C,EAAE,OAAO,EAHzD,MAAM,EAGmD,GAFvD,MAAM,EAAE,CAoEpB;AAmBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAHpC,MAGoC,GAFlC,MAAM,EAAE,CAmEpB;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,YAAY,EAH7C,MAG6C,GAF3C,MAAM,EAAE,CA6DpB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAHlC,MAGkC,GAFhC,MAAM,EAAE,CAmEpB;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,aAAa,EAH/B,MAG+B,GAF7B,MAAM,CAelB;AAaD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAHvB,MAGuB,GAFrB,MAAM,EAAE,CAiFpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAHhC,MAGgC,GAF9B,MAAM,EAAE,CAoDpB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAH7B,MAG6B,GAF3B,MAAM,EAAE,CA4BpB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,MAAM,EAAE,CA2BpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,EAH9B,MAG8B,GAF5B,MAAM,EAAE,CAapB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,GAF9B,MAAM,EAAE,CAqCpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAHrC,MAGqC,GAFnC;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,2BAA2B,EAAE,MAAM,EAAE,CAAA;CAAE,CAmF9F;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAH7B,MAG6B,GAF3B,MAAM,EAAE,CAmCpB;AA2HD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,gBAAgB,EAJ3C,MAI2C,EAAE,QAAQ,EAHrD,MAGqD,GAFnD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,2BAA2B,EAAE,MAAM,EAAE,CAAA;CAAE,CAmD9F;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,YAAY,QAAA,GAF7B,MAAM,CAqFlB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,aAAa,QAAA,GAF/B,MAAM,CAqIlB;AA2CD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,gBAAgB,EAJvC,MAIuC,GAFrC,MAAM,CAqClB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAHlC,MAGkC,EAAE,YAAY,EAFhD,KAEgD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsK1D;AAmBD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,MAG4B,OAGtC;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,OAOrC;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,OAGrC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,MAG4B,OAGtC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,OAGxC;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,OAAA,EACP,gBAAgB,OAAA,EAChB,UAAU,EAND,MAMC,EACV,OAAO,EANE,MAMF,OA4ER;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAHjC,MAGiC,EAAE,OAAO,EAF1C,MAE0C;;;;;;;;EAqBpD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAFpC,MAEoC;;;;;;;;;;;;;;;;;;;;;IAsD9C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAL9B,MAK8B,EAAE,OAAO,EAJvC,MAIuC,EAAE,OAAO,GAHhD,MAGqD,GAFnD;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAE,CA2GtF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EALrC,MAKqC,EAAE,OAAO,EAJ9C,MAI8C,EAAE,OAAO,GAHvD,MAG4D,GAF1D;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAkR1D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAJ/B,MAI+B,GAH7B,8BAA4B,SAAS,CA6CjD;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,QAAA,GAFvB,MAAM,CAoBlB;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EAJvC,MAIuC,EAAE,WAAW,QAAA,iBA6I9D;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EALG,MAKH,EACN,eAAe,eAAA,EACf,MAAM,AALL,CACF,QAImB,QA0BnB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,QAAA,EAAE,YAAY,AAH9D,CACA,EADQ,OAG6D,GAF3D,MAAM,CAYlB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EALjC,QAKiC,EAAE,IAAI,QAAA,EAAE,OAAO,EAHhD,MAGgD,GAF9C,MAAM,CAyDlB;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAND,MAMC,EACV,OAAO,EANE,MAMF,EACP,IAAI,AANH,CACA,QAKe,GALL,MAAM,CA0FlB;AA+BD;;GAEG;AACH,wBAAgB,yBAAyB,SAExC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,qBAAqB,CAAC,YAAY,EAJ7C,KAAK,CAAC,MAAM,CAIiC,GAF3C,OAAO,CAAC,IAAI,CAAC,CA4CzB"}
+{"version":3,"file":"parsers-misc.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-misc.js"],"names":[],"mappings":"AA6DA;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,KAAA,EAAE,QAAQ,KAAA,GAF/C,MAAM,CAuElB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAHjC,MAGiC,GAF/B,MAAM,EAAE,CA+BpB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,EAAE,CAiEpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EALvC,MAAM,WAAO,MAK0B,EAAE,OAAO,EAJhD,MAAM,EAI0C,EAAE,OAAO,EAHzD,MAAM,EAGmD,GAFvD,MAAM,EAAE,CAoEpB;AAmBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAHpC,MAGoC,GAFlC,MAAM,EAAE,CAmEpB;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,YAAY,EAH7C,MAG6C,GAF3C,MAAM,EAAE,CA6DpB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAHlC,MAGkC,GAFhC,MAAM,EAAE,CAmEpB;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,aAAa,EAH/B,MAG+B,GAF7B,MAAM,CAelB;AAaD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAHvB,MAGuB,GAFrB,MAAM,EAAE,CAiFpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAHhC,MAGgC,GAF9B,MAAM,EAAE,CAoDpB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAH7B,MAG6B,GAF3B,MAAM,EAAE,CA4BpB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,MAAM,EAAE,CA2BpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,EAH9B,MAG8B,GAF5B,MAAM,EAAE,CAapB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,GAF9B,MAAM,EAAE,CAqCpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAHrC,MAGqC,GAFnC;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,2BAA2B,EAAE,MAAM,EAAE,CAAA;CAAE,CAmF9F;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAH7B,MAG6B,GAF3B,MAAM,EAAE,CAmCpB;AA2HD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,gBAAgB,EAJ3C,MAI2C,EAAE,QAAQ,EAHrD,MAGqD,GAFnD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,2BAA2B,EAAE,MAAM,EAAE,CAAA;CAAE,CAmD9F;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,YAAY,QAAA,GAF7B,MAAM,CA2GlB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,aAAa,QAAA,GAF/B,MAAM,CAqIlB;AA2CD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,gBAAgB,EAJvC,MAIuC,GAFrC,MAAM,CAqClB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAHlC,MAGkC,EAAE,YAAY,EAFhD,KAEgD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsK1D;AAmBD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,MAG4B,OAGtC;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,OAOrC;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,OAGrC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,MAG4B,OAGtC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,OAGxC;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,OAAA,EACP,gBAAgB,OAAA,EAChB,UAAU,EAND,MAMC,EACV,OAAO,EANE,MAMF,OA4ER;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAHjC,MAGiC,EAAE,OAAO,EAF1C,MAE0C;;;;;;;;EAqBpD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAFpC,MAEoC;;;;;;;;;;;;;;;;;;;IA+D9C;AAsCD;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAH3C,MAG2C,GAFzC,GAAG,CAAC,MAAM,CAAC,CA0CvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAN3C,MAAM,SAMqC,EAAE,QAAQ,AAL7D,CACA,EADQ,MAAM,SAK+C,GAJnD,MAAM,CAqJlB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,GAF5B,OAAO,CAInB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAL9B,MAK8B,EAAE,OAAO,EAJvC,MAIuC,EAAE,OAAO,GAHhD,MAGqD,GAFnD;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAE,CA2GtF;AAmKD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAJtC,MAIsC,EAAE,OAAO,EAH/C,MAG+C,GAF7C,MAAM,CAmElB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EALrC,MAKqC,EAAE,OAAO,EAJ9C,MAI8C,EAAE,OAAO,GAHvD,MAG4D,GAF1D;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAmS1D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAJ/B,MAI+B,GAH7B,8BAA4B,SAAS,CAoDjD;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,QAAA,GAFvB,MAAM,CAoBlB;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EAJvC,MAIuC,EAAE,WAAW,QAAA,iBA6I9D;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EALG,MAKH,EACN,eAAe,eAAA,EACf,MAAM,AALL,CACF,QAImB,QA0BnB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,QAAA,EAAE,YAAY,AAH9D,CACA,EADQ,OAG6D,GAF3D,MAAM,CAYlB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EALjC,QAKiC,EAAE,IAAI,QAAA,EAAE,OAAO,EAHhD,MAGgD,GAF9C,MAAM,CAyDlB;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAND,MAMC,EACV,OAAO,EANE,MAMF,EACP,IAAI,AANH,CACA,QAKe,GALL,MAAM,CA0FlB;AA+BD;;GAEG;AACH,wBAAgB,yBAAyB,SAExC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,qBAAqB,CAAC,YAAY,EAJ7C,KAAK,CAAC,MAAM,CAIiC,GAF3C,OAAO,CAAC,IAAI,CAAC,CA4CzB;AAqUD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAHpC,MAGoC,GAFlC,MAAM,EAAE,CAoHpB"}

package/types/lib/ecosystems/parsers-nim.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Nim parser for `.nimble` manifests and `nimble.lock`.
+ *
+ * A `.nimble` file is a Nim script whose practical surface is a set of
+ * `key = "value"` assignments plus `requires "dep >= 1.0"` lines; it is read
+ * with a line scanner over those shapes rather than a Nim interpreter.
+ * Nimble persists the resolved dependency set to `nimble.lock` (JSON), which
+ * is the source of truth for versions.
+ *
+ * No `nim` purl type is registered, so packages are identified as generic
+ * carrying a `cdx:purl:proposedType=nim` property, following the convention
+ * used for nix and zig.
+ */
+/**
+ * Parse a Nim project from a `.nimble` manifest and optional `nimble.lock`.
+ *
+ * @param {string} nimbleFile Path to the `.nimble` file
+ * @param {string} [nimbleLockFile] Path to `nimble.lock`, if present
+ * @returns {{ pkgList: object[], dependencies: object[], parentComponent: object, rootInputs?: string[] }}
+ */
+export declare function parseNimProject(nimbleFile: string, nimbleLockFile?: string): {
+    pkgList: object[];
+    dependencies: object[];
+    parentComponent: object;
+    rootInputs?: string[];
+};
+/**
+ * Read the assignments and requirements of a `.nimble` file.
+ *
+ * @param {string} filePath File to read
+ * @returns {{name?: string, version?: string, description?: string, license?: string, requires: Array<{name: string, constraint?: string}>}}
+ */
+export declare function readNimbleFile(filePath: string): {
+    name?: string;
+    version?: string;
+    description?: string;
+    license?: string;
+    requires: Array<{
+        name: string;
+        constraint?: string;
+    }>;
+};
+//# sourceMappingURL=parsers-nim.d.ts.map

package/types/lib/ecosystems/parsers-nim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers-nim.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-nim.js"],"names":[],"mappings":"AAKA;;;;;;;;;;;;GAYG;AAEH;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAJ/B,MAI+B,EAAE,cAAc,AAHvD,CACA,EADQ,MAG+C,GAF7C;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAqGzG;AA2CD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAC,CAAC,CAAA;CAAC,CAgD3I"}

package/types/lib/ecosystems/parsers-opam.d.ts

@@ -0,0 +1,31 @@
+/**
+ * OCaml opam parser for `.opam.locked` files.
+ *
+ * `opam lock` writes a `<name>.opam.locked` file that pins the full resolved
+ * dependency set of a project: a `depends:` field listing every package with
+ * an equality constraint on its version, and a `pin-depends:` field for
+ * packages pinned to a URL. The file is opam's own syntax, a small
+ * line-oriented field language, which is read here with a line scanner rather
+ * than a monolithic expression.
+ *
+ * A locked file holds the closure only: it does not record which packages are
+ * direct dependencies of the project, so every entry is reported with the
+ * same standing and the project root links to all of them.
+ *
+ * Packages are identified with the registered `opam` purl type
+ * (`pkg:opam/<name>@<version>`).
+ */
+/**
+ * Parse an `.opam.locked` (or plain `.opam`) file.
+ *
+ * @param {string} opamLockedFile Path to the opam file
+ * @returns {{ pkgList: object[], pins: Array<{name: string, url: string}> }}
+ */
+export declare function parseOpamLockedFile(opamLockedFile: string): {
+    pkgList: object[];
+    pins: Array<{
+        name: string;
+        url: string;
+    }>;
+};
+//# sourceMappingURL=parsers-opam.d.ts.map

package/types/lib/ecosystems/parsers-opam.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers-opam.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-opam.js"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,cAAc,EAHvC,MAGuC,GAFrC;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAC,CAAC,CAAA;CAAE,CAoD3E"}