@cdxgen/cdxgen 13.1.0 → 13.3.0

package/types/lib/ecosystems/parsers-perl.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Perl parser for `cpanfile` and `cpanfile.snapshot`.
+ *
+ * Carton snapshots the resolved install set as a text document: one entry per
+ * distribution, each carrying the `pathname` it was fetched from (which
+ * encodes the PAUSE author id), the packages it provides, and the
+ * requirements it was resolved against. The declared `cpanfile` lists the
+ * project's own requirements.
+ *
+ * Distributions are identified with the registered `cpan` purl type, whose
+ * rules require the author id as the namespace
+ * (`pkg:cpan/<AUTHOR>/<Distribution>@<version>`).
+ */
+/**
+ * Parse a `cpanfile.snapshot` into distributions with a dependency graph.
+ *
+ * @param {string} snapshotFile Path to `cpanfile.snapshot`
+ * @param {string} [cpanfileFile] Path to `cpanfile`, if present
+ * @returns {{ pkgList: object[], dependencies: object[] }}
+ */
+export declare function parseCpanSnapshot(snapshotFile: string, cpanfileFile?: string): {
+    pkgList: object[];
+    dependencies: object[];
+};
+/**
+ * Collect the requirement names declared in a `cpanfile`.
+ *
+ * Only the `requires` keyword outside phase blocks is read; phases such as
+ * `on 'test'` are ignored so test-only modules do not become direct
+ * dependencies.
+ *
+ * @param {string} cpanfileFile Path to `cpanfile`
+ * @returns {Set<string>} Declared requirement names
+ */
+export declare function directRequirementsFromCpanfile(cpanfileFile: string): Set<string>;
+//# sourceMappingURL=parsers-perl.d.ts.map

package/types/lib/ecosystems/parsers-perl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers-perl.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-perl.js"],"names":[],"mappings":"AAIA;;;;;;;;;;;;GAYG;AAEH;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAJnC,MAImC,EAAE,YAAY,AAHzD,CACA,EADQ,MAGiD,GAF/C;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CAyHzD;AAkFD;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAAC,YAAY,EAHhD,MAGgD,GAF9C,GAAG,CAAC,MAAM,CAAC,CA0CvB"}

package/types/lib/ecosystems/parsers-python.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsers-python.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-python.js"],"names":[],"mappings":"AAiEA;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,QAAA;;;cAqB9C;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAFpC,MAEoC,kBAe9C;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EALnC,MAKmC,EAAE,IAAI,EAJzC,MAIyC,EAAE,KAAK,EAHhD,MAGgD,GAF9C,IAAI,CAkBhB;AAmMD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAHpC,MAGoC,GAFlC,MAAM,CAwSlB;AAqFD;;;;;;;;;;GAUG;AACH,wBAAgB,gCAAgC,CAAC,SAAS,EAH/C,MAG+C,GAF7C,MAAM,GAAG,SAAS,CA2C9B;AAiBD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAJnC,MAImC,EAAE,QAAQ,EAH7C,MAG6C,EAAE,aAAa,EAF5D,MAE4D;;;;;;;;;;;;;;;;;;;;;;GAwnBtE;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,OAAO,QAAA,EAAE,aAAa,UAAQ,OAEhE;AA+RD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,QAAA,GAFhC,KAAK,CAAC,MAAM,CAAC,CAmCzB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EAFvC,MAEuC,qBAqBjD;AA6CD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,gBAAgB,QAAA,EAAE,IAAI,QAAA;;;;;;;;;EAkLvD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,QAAA,MAiCzC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,KAAA,QAkBzC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,eAAe,EAHrC,MAGqC,GAFnC;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CA8C1D"}
+{"version":3,"file":"parsers-python.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-python.js"],"names":[],"mappings":"AAiEA;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,QAAA;;;cAqB9C;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAFpC,MAEoC,kBAiB9C;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EALnC,MAKmC,EAAE,IAAI,EAJzC,MAIyC,EAAE,KAAK,EAHhD,MAGgD,GAF9C,IAAI,CAkBhB;AAmMD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAHpC,MAGoC,GAFlC,MAAM,CAwSlB;AAqFD;;;;;;;;;;GAUG;AACH,wBAAgB,gCAAgC,CAAC,SAAS,EAH/C,MAG+C,GAF7C,MAAM,GAAG,SAAS,CA2C9B;AAiBD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAJnC,MAImC,EAAE,QAAQ,EAH7C,MAG6C,EAAE,aAAa,EAF5D,MAE4D;;;;;;;;;;;;;;;;;;;;;;GAwnBtE;AAYD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,OAAO,QAAA,EAAE,aAAa,UAAQ,OAEhE;AA8RD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,QAAA,GAFhC,KAAK,CAAC,MAAM,CAAC,CAmCzB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EAFvC,MAEuC,qBAqBjD;AA6CD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,gBAAgB,QAAA,EAAE,IAAI,QAAA;;;;;;;;;EAkLvD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,QAAA,MAiCzC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,KAAA,QAkBzC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,eAAe,EAHrC,MAGqC,GAFnC;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CA8C1D"}

package/types/lib/ecosystems/parsers-r.d.ts

@@ -0,0 +1,35 @@
+/**
+ * R project parser for renv lock files.
+ *
+ * `renv.lock` records the R version, the repositories packages were resolved
+ * from, and every package in the project library with its exact version, an
+ * integrity hash, and the names of the packages it requires. The lock is a
+ * JSON document, which makes it a reliable offline source of both the
+ * resolved dependency set and the graph between packages.
+ *
+ * Packages are identified with the registered `cran` purl type
+ * (`pkg:cran/<Package>@<Version>`). Requirement strings may carry version
+ * constraints (`"R (>= 3.6)"`); only the leading package name is used, and
+ * the R runtime itself is recorded as the parent's version rather than an
+ * edge.
+ */
+/**
+ * Parse an `renv.lock` file.
+ *
+ * @param {string} renvLockFile Path to `renv.lock`
+ * @returns {{
+ *   pkgList: object[],
+ *   dependencies: object[],
+ *   rootInputs: string[],
+ *   parentComponent: object,
+ *   rVersion: string|undefined
+ * }}
+ */
+export declare function parseRenvLock(renvLockFile: string): {
+    pkgList: object[];
+    dependencies: object[];
+    rootInputs: string[];
+    parentComponent: object;
+    rVersion: string | undefined;
+};
+//# sourceMappingURL=parsers-r.d.ts.map

package/types/lib/ecosystems/parsers-r.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers-r.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-r.js"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,YAAY,EAT/B,MAS+B,GAR7B;IACR,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAC,SAAS,CAAA;CAC3B,CAsGH"}

package/types/lib/ecosystems/parsers-rebar.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Erlang rebar3 parser for `rebar.lock`.
+ *
+ * A rebar lock holds one or two Erlang terms, each ended by a period:
+ *
+ *   {"1.2.0", [{<<"cowboy">>,{pkg,<<"cowboy">>,<<"2.10.0">>},0}]}.
+ *   [{pkg_hash, [{<<"cowboy">>, <<"3AFD...">>}]},
+ *    {pkg_hash_ext, [...]}].
+ *
+ * The first term pairs the lock format version with the locked dependency
+ * list; the hashes live in a separate second term, which is absent from locks
+ * that hold no hex packages. Lock format 1.0.0 omitted the version and wrote
+ * the dependency list as the only term.
+ *
+ * Rather than a large regular expression over the surface syntax, a small
+ * recursive reader parses the terms into plain JavaScript values: tuples and
+ * lists become arrays, binaries and strings become strings, atoms become
+ * strings. Only the shapes rebar actually writes are understood; anything
+ * else is skipped.
+ *
+ * Hex dependencies are identified with the registered `hex` purl type, since
+ * rebar resolves Erlang packages through hex.pm. The `pkg_hash` values hex
+ * publishes are SHA-256 digests of the package tarball, so they are emitted
+ * into the CycloneDX `hashes` array where consumers expect content hashes.
+ */
+/**
+ * Parse a `rebar.lock` file.
+ *
+ * @param {string} rebarLockFile Path to `rebar.lock`
+ * @returns {{ pkgList: object[] }} Locked packages
+ */
+export declare function parseRebarLock(rebarLockFile: string): {
+    pkgList: object[];
+};
+/**
+ * Parse every period-terminated Erlang term in a source text.
+ *
+ * @param {string} text Source text
+ * @returns {Array} Parsed terms, in file order
+ */
+export declare function parseErlangTerms(text: string): any[];
+//# sourceMappingURL=parsers-rebar.d.ts.map

package/types/lib/ecosystems/parsers-rebar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers-rebar.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-rebar.js"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,aAAa,EAHjC,MAGiC,GAF/B;IAAE,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAyDjC;AAuHD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAH1B,MAG0B,SA2BpC"}

package/types/lib/ecosystems/parsers-rust.d.ts

@@ -44,6 +44,205 @@ export declare function parseCargoManifestDependencyData(cargoTomlFile: string,
  * @returns {Object[]} Array of dependency relationship objects with ref and dependsOn fields
  */
 export declare function parseCargoDependencyData(cargoLockData: string): Object[];
+/**
+ * Normalize a cargo dependency kind to the vocabulary used by the cargo
+ * manifest parsers.
+ *
+ * `cargo metadata` encodes a normal dependency as `null` rather than a string,
+ * so a truthiness test would silently leave runtime dependencies unlabelled.
+ *
+ * @param {string|null|undefined} kind Dependency kind as reported by cargo
+ * @returns {string} One of `runtime`, `build` or `dev`
+ */
+export declare function normalizeCargoDepKind(kind: string | null | undefined): string;
+/**
+ * Parse a cargo package id into its name and version.
+ *
+ * cargo 1.77 and later emit the package id spec form
+ * (`registry+https://...#name@1.0.0`, or `path+file:///p/foo#1.0.0` where the
+ * name is carried by the path); earlier releases emit `name 1.0.0 (source)`.
+ *
+ * @param {string} packageId cargo package id
+ * @returns {{name: string, version: string}|undefined} Parsed identity
+ */
+export declare function parseCargoPackageId(packageId: string): {
+    name: string;
+    version: string;
+} | undefined;
+/**
+ * Build the `name@version` key used to correlate cargo components across the
+ * lock file, the manifests and `cargo metadata`.
+ *
+ * @param {{name: string, version: string}} pkg Package identity
+ * @returns {string} Correlation key
+ */
+export declare function cargoComponentKey(pkg: {
+    name: string;
+    version: string;
+}): string;
+/**
+ * Convert a cargo purl or bom-ref into a `name@version` correlation key.
+ *
+ * @param {string} purl cargo purl
+ * @returns {string} Correlation key
+ */
+export declare function cargoPurlToComponentKey(purl: string): string;
+/**
+ * Collect the dependency kinds and platform gates declared by a single
+ * `Cargo.toml`, keyed by the crate name that cargo resolves the entry to.
+ *
+ * Manifests declare version requirements rather than resolved versions, so the
+ * returned map is keyed by name alone and is meant to label the edges leaving a
+ * workspace member in the lock file graph.
+ *
+ * @param {string} cargoTomlFile Cargo.toml path
+ * @param {object} [context] Workspace resolution context
+ * @returns {Map<string, {kinds: Set<string>, targets: Set<string>, optional: boolean}>} Declared edges
+ */
+export declare function parseCargoManifestDependencyKinds(cargoTomlFile: string, context?: object): Map<string, {
+    kinds: Set<string>;
+    targets: Set<string>;
+    optional: boolean;
+}>;
+/**
+ * Roll per-edge cargo dependency kinds up to an effective kind per component.
+ *
+ * A crate is only dev-only when *every* path reaching it from a workspace root
+ * traverses a dev edge, so a crate shared between a dev dependency and a normal
+ * one keeps its runtime kind. Cargo never builds the dev dependencies of a
+ * dependency, so dev edges are followed from the workspace roots alone.
+ *
+ * @param {object} graph Dependency graph
+ * @param {string[]} graph.rootKeys Workspace member component keys
+ * @param {Map<string, Array<{to: string, kind: string, target?: string}>>} graph.edges Adjacency map
+ * @returns {Map<string, {kind: string, kinds: Set<string>, targets: Set<string>, targetGated: boolean}>} Effective kinds
+ */
+export declare function rollupCargoDependencyKinds({ rootKeys, edges }: {
+    rootKeys: string[];
+    edges: Map<string, Array<{
+        to: string;
+        kind: string;
+        target?: string;
+    }>>;
+}): Map<string, {
+    kind: string;
+    kinds: Set<string>;
+    targets: Set<string>;
+    targetGated: boolean;
+}>;
+/**
+ * Build a cargo dependency graph from the `resolve` section of
+ * `cargo metadata --format-version 1`.
+ *
+ * @param {object} metadata Parsed `cargo metadata` output
+ * @returns {{rootKeys: string[], edges: Map<string, Array<object>>, packageInfo: Map<string, object>, resolvedKeys: Set<string>}} Graph
+ */
+export declare function parseCargoMetadataResolve(metadata: object): {
+    rootKeys: string[];
+    edges: Map<string, Array<object>>;
+    packageInfo: Map<string, object>;
+    resolvedKeys: Set<string>;
+};
+/**
+ * Build a cargo dependency graph from the lock file relationships, labelling
+ * the edges that leave a workspace member with the kinds declared by its
+ * manifest.
+ *
+ * The lock file is the union of every dependency kind and every target triple,
+ * so only the manifests can distinguish them. The resulting labels are exact at
+ * depth one and inherited below it, which is enough to identify dev-only and
+ * build-only subtrees without invoking cargo.
+ *
+ * @param {object[]} lockDependencies Relationships from {@link parseCargoDependencyData}
+ * @param {Map<string, Map<string, object>>} declaredEdgesByRoot Declared edges keyed by root component key
+ * @returns {{rootKeys: string[], edges: Map<string, Array<object>>}} Graph
+ */
+export declare function buildCargoLockDependencyGraph(lockDependencies: object[], declaredEdgesByRoot: Map<string, Map<string, object>>): {
+    rootKeys: string[];
+    edges: Map<string, Array<object>>;
+};
+/**
+ * Annotate cargo components with their effective dependency kind, platform
+ * gates and scope.
+ *
+ * Components reachable only through dev edges are scoped `excluded` so
+ * `--required-only` drops them. Build dependencies stay required because a
+ * build script is part of producing the artifact; the kind is recorded as a
+ * property so a consumer can filter on it.
+ *
+ * @param {object[]} pkgList Components to annotate
+ * @param {Map<string, object>} rollup Effective kinds from {@link rollupCargoDependencyKinds}
+ * @param {Map<string, object>} [packageInfo] Extra per-package facts
+ * @param {object} [options] Annotation options
+ * @param {boolean} [options.resolveIsComplete] The rollup covers every workspace in the scan, so a
+ *        component missing from it is an optional dependency no feature activates
+ * @returns {object[]} The annotated components
+ */
+export declare function applyCargoDependencyKindMetadata(pkgList: object[], rollup: Map<string, object>, packageInfo?: Map<string, object>, options?: {
+    resolveIsComplete?: boolean;
+}): object[];
+/**
+ * Recover the upstream version of a native library from the version of the
+ * crate that ships it.
+ *
+ * The `-sys` and `-src` crates carry the upstream version as semver build
+ * metadata, because the crate's own version tracks the binding's releases
+ * rather than the library's: `openssl-src@300.6.1+3.6.3` ships OpenSSL 3.6.3
+ * and `curl-sys@0.4.74+curl-8.9.0` ships curl 8.9.0.
+ *
+ * @param {string} crateVersion Version of the providing crate
+ * @returns {string} Upstream version, or an empty string when it is not encoded
+ */
+export declare function cargoUpstreamVersionFromCrateVersion(crateVersion: string): string;
+/**
+ * Recover the version of a vendored native library from the C source the crate
+ * ships.
+ *
+ * A `-sys` crate that bundles its library carries the upstream version in a
+ * header define - `ZLIB_VERSION`, `SQLITE_VERSION`, `OPENSSL_VERSION_TEXT` -
+ * which is the only statement of the version for the crates that do not encode
+ * it in their own version. A crate often ships more than one variant, so a
+ * candidate sitting in a directory named after a feature this build did not
+ * enable is dropped: `libz-sys` ships both `src/zlib` and `src/zlib-ng`, and
+ * only one of them is compiled.
+ *
+ * @param {object} args Resolution inputs
+ * @param {string} args.crateDir Directory holding the crate's unpacked source
+ * @param {string} args.links The crate's `links` value
+ * @param {string} args.libraryName Normalized library name
+ * @param {string[]} [args.declaredFeatures] Features the crate declares
+ * @param {Set<string>} [args.resolvedFeatures] Features the resolver enabled
+ * @returns {{version: string, evidence: string, candidates: string[]}} Version and where it came from
+ */
+export declare function resolveCargoVendoredLibraryVersion({ crateDir, links, libraryName, declaredFeatures, resolvedFeatures, }: {
+    crateDir: string;
+    links: string;
+    libraryName: string;
+    declaredFeatures?: string[];
+    resolvedFeatures?: Set<string>;
+}): {
+    version: string;
+    evidence: string;
+    candidates: string[];
+};
+/**
+ * Build components for the native libraries that `-sys` crates link.
+ *
+ * A crate declaring `links = "openssl"` puts a C library into the artifact that
+ * the cargo dependency graph cannot describe: its advisories and its license
+ * obligations belong to OpenSSL, not to the Rust binding. When the resolver
+ * enabled a vendoring feature, that library is compiled into the binary, which
+ * makes it a component of the delivered assembly.
+ *
+ * @param {Map<string, object>} packageInfo Per-package facts from {@link parseCargoMetadataResolve}
+ * @param {Map<string, Array<object>>} edges Dependency edges keyed by component key
+ * @param {Map<string, object>} rollup Effective kinds, used to skip crates no build reaches
+ * @returns {{components: object[], dependencies: object[]}} Native library components and their edges
+ */
+export declare function buildCargoNativeLibraryComponents(packageInfo: Map<string, object>, edges: Map<string, Array<object>>, rollup: Map<string, object>): {
+    components: object[];
+    dependencies: object[];
+};
 /**
  * Parses tab-separated cargo-auditable binary metadata output and returns a list
  * of Rust package components. Optionally fetches crates.io metadata when

package/types/lib/ecosystems/parsers-rust.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsers-rust.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-rust.js"],"names":[],"mappings":"AAunBA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,QAAA,EACb,MAAM,GAPG,OAOK,EACd,WAAW,GAPF,MAOO,EAChB,OAAO,KAAK,SAuQb;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,aAAa,QAAA,EACb,MAAM,GAPG,OAOK,EACd,WAAW,GAPF,MAOO,SA8FjB;AAgCD;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,aAAa,EAJnD,MAImD,EAAE,OAAO,AAHpE,CACA,EADQ,MAGiE,GAF/D,MAAM,EAAE,CAsIpB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,aAAa,EAH3C,MAG2C,GAFzC,MAAM,EAAE,CAgEpB;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAAC,SAAS,EAH5C,MAG4C,GAF1C,OAAO,CAAC,MAAM,EAAE,CAAC,CA4B7B"}
+{"version":3,"file":"parsers-rust.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-rust.js"],"names":[],"mappings":"AAisBA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,QAAA,EACb,MAAM,GAPG,OAOK,EACd,WAAW,GAPF,MAOO,EAChB,OAAO,KAAK,SAuQb;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,aAAa,QAAA,EACb,MAAM,GAPG,OAOK,EACd,WAAW,GAPF,MAOO,SAyGjB;AAgCD;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,aAAa,EAJnD,MAImD,EAAE,OAAO,AAHpE,CACA,EADQ,MAGiE,GAF/D,MAAM,EAAE,CAsIpB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,aAAa,EAH3C,MAG2C,GAFzC,MAAM,EAAE,CA8DpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAH/B,MAAM,GAAC,IAAI,GAAC,SAGmB,GAF7B,MAAM,CAOlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAHlC,MAGkC,GAFhC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CA8BrD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAH1B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAGJ,GAFxB,MAAM,CAOlB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAHjC,MAGiC,GAF/B,MAAM,CAUlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iCAAiC,CAAC,aAAa,EAJpD,MAIoD,EAAE,OAAO,AAHrE,CACA,EADQ,MAGkE,GAFhE,GAAG,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAC,CAAC,CA+DtF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAJ3D;IAAwB,QAAQ,EAAxB,MAAM,EAAE,CAChB;IAA+E,KAAK,EAA5E,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC,CACvE;CAE2D,GAFjD,GAAG,CAAC,MAAM,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAC,CAAC,CAsEvG;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAHvC,MAGuC,GAFrC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAC,CAoGhI;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAC3C,gBAAgB,EALP,MAAM,EAKC,EAChB,mBAAmB,EALV,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAKrB,GAJR;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;CAAC,CAmCnE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EATE,MAAM,EASR,EACP,MAAM,EATG,GAAG,CAAC,MAAM,EAAE,MAAM,CASrB,EACN,WAAW,AATV,CACA,EADQ,GAAG,CAAC,MAAM,EAAE,MAAM,CASJ,EACvB,OAAO,AATN,CAGA,EAFA;IAA0B,iBAAiB,AAA3C,CAEA,EAFQ,OAAO,CAEf;CAMW,GAND,MAAM,EAAE,CAsFpB;AAkCD;;;;;;;;;;;GAWG;AACH,wBAAgB,oCAAoC,CAAC,YAAY,EAHtD,MAGsD,GAFpD,MAAM,CAalB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kCAAkC,CAAC,EACjD,QAAQ,EACR,KAAK,EACL,WAAW,EACX,gBAAqB,EACrB,gBAA4B,GAC7B,EAbE;IAAqB,QAAQ,EAArB,MAAM,CACd;IAAqB,KAAK,EAAlB,MAAM,CACd;IAAqB,WAAW,EAAxB,MAAM,CACd;IAAwB,gBAAgB,AAAxC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,gBAAgB,AAA3C,CACA,EADQ,GAAG,CAAC,MAAM,CAAC,CACnB;CAQF,GARY;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAC,CA2FrE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iCAAiC,CAAC,WAAW,EALlD,GAAG,CAAC,MAAM,EAAE,MAAM,CAKgC,EAAE,KAAK,EAJzD,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAIgC,EAAE,MAAM,EAHjE,GAAG,CAAC,MAAM,EAAE,MAAM,CAG+C,GAF/D;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAwJ1D;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAAC,SAAS,EAH5C,MAG4C,GAF1C,OAAO,CAAC,MAAM,EAAE,CAAC,CA4B7B"}

package/types/lib/ecosystems/parsers-spack.d.ts

@@ -0,0 +1,33 @@
+/**
+ * HPC Spack parser for `spack.lock`.
+ *
+ * Spack writes a JSON lock file when an environment is concretised:
+ *
+ *   - `roots` — the specs the user asked for, each as `{hash, spec}`.
+ *   - `concrete_specs` — every node of the resolved DAG, keyed by its DAG
+ *     hash. A node carries its `name`, `version`, `namespace`, the compiler
+ *     and architecture it was built for, and a `dependencies` list whose
+ *     entries reference other nodes by hash.
+ *
+ * The DAG hash is the identity Spack itself uses: two builds of the same
+ * version with different variants or compilers are different hashes, so the
+ * graph is keyed by hash throughout and the hash is carried into each
+ * component's bom-ref.
+ *
+ * No `spack` purl type is registered, so nodes are identified as generic
+ * packages carrying a `cdx:purl:proposedType=spack` property, following the
+ * convention used for nix and zig. The DAG hash is kept as a property because
+ * it identifies the concrete build, not the artifact bytes.
+ */
+/**
+ * Parse a `spack.lock` file.
+ *
+ * @param {string} spackLockFile Path to `spack.lock`
+ * @returns {{ pkgList: object[], dependencies: object[], rootInputs: string[] }}
+ */
+export declare function parseSpackLock(spackLockFile: string): {
+    pkgList: object[];
+    dependencies: object[];
+    rootInputs: string[];
+};
+//# sourceMappingURL=parsers-spack.d.ts.map

package/types/lib/ecosystems/parsers-spack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers-spack.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-spack.js"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,aAAa,EAHjC,MAGiC,GAF/B;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAgE/E"}

package/types/lib/ecosystems/parsers-stack.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Haskell Stack parser for `stack.yaml` and its lock file.
+ *
+ * Stack resolves packages from a snapshot plus the `extra-deps` a project
+ * declares, and writes the completed locations to `stack.yaml.lock` (named
+ * after the configuration file, so a custom `foo.yaml` locks to
+ * `foo.yaml.lock`). The lock is YAML with two lists:
+ *
+ *   - `packages` — one entry per extra-dep, each holding the `original`
+ *     incomplete specification and the `completed` location. A Hackage
+ *     location is the string `<name>-<version>@sha256:<hex>,<size>`; a
+ *     repository location carries `url`, `commit` and `subdir`.
+ *   - `snapshots` — the resolved snapshot chain, each with the `original`
+ *     name (`lts-22.28`) and the `completed` url, size and sha256.
+ *
+ * The lock pins only the extra-deps: packages taken from the snapshot are not
+ * listed, because the snapshot url and digest already pin them. The snapshot
+ * is therefore recorded on the parent component rather than expanded.
+ *
+ * Hackage packages are identified with the registered `hackage` purl type
+ * (`pkg:hackage/<name>@<version>`).
+ */
+/**
+ * Parse a Stack project from its lock file, with optional `stack.yaml`.
+ *
+ * @param {string} stackLockFile Path to `stack.yaml.lock` or `stack.lock`
+ * @param {string} [stackYamlFile] Path to `stack.yaml`, if present
+ * @returns {{ pkgList: object[], parentComponent: object, rootInputs: string[] }}
+ */
+export declare function parseStackProject(stackLockFile: string, stackYamlFile?: string): {
+    pkgList: object[];
+    parentComponent: object;
+    rootInputs: string[];
+};
+//# sourceMappingURL=parsers-stack.d.ts.map

package/types/lib/ecosystems/parsers-stack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers-stack.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-stack.js"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAJpC,MAIoC,EAAE,aAAa,AAH3D,CACA,EADQ,MAGmD,GAFjD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CA0ChF"}

package/types/lib/ecosystems/parsers-terraform.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Terraform and OpenTofu parser for `.terraform.lock.hcl`.
+ *
+ * The lock file pins every provider the configuration resolves to, with its
+ * exact version, the version constraints that produced it, and content
+ * hashes. It is written in a small, regular subset of HCL: provider blocks,
+ * `version` and `constraints` attributes, and a `hashes` list of prefixed
+ * digests. A line scanner is sufficient and avoids a general HCL parser.
+ *
+ * Provider addresses look like `registry.terraform.io/hashicorp/aws`; the
+ * registry host and namespace identify the provider upstream, so they are
+ * kept in the component group and a generic purl
+ * (`pkg:generic/<host>/<namespace>/<type>@<version>`), with the intended type
+ * recorded as a `cdx:purl:proposedType` property because no `terraform`
+ * purl type is registered.
+ *
+ * The two hash schemes in the `hashes` list mean different things. A `zh:`
+ * digest is a SHA-256 of the official `.zip` package as the registry indexes
+ * it, so it is the one a consumer can check an artifact against and the one
+ * emitted in the CycloneDX `hashes` array. An `h1:` digest is base64 over a
+ * hash of the package's *contents* rather than the archive, which lets
+ * Terraform verify an unpacked directory but makes it useless as an artifact
+ * checksum; it is kept as a property instead of being mislabelled SHA-256.
+ */
+/**
+ * Parse a `.terraform.lock.hcl` file.
+ *
+ * @param {string} lockFile Path to the lock file
+ * @returns {{ pkgList: object[] }} Provider components
+ */
+export declare function parseTerraformLockFile(lockFile: string): {
+    pkgList: object[];
+};
+//# sourceMappingURL=parsers-terraform.d.ts.map

package/types/lib/ecosystems/parsers-terraform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers-terraform.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-terraform.js"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAHpC,MAGoC,GAFlC;IAAE,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAkEjC"}

package/types/lib/ecosystems/pythonutils.d.ts

@@ -71,9 +71,9 @@ export declare function createUVLock(basePath: string, options: Object): void;
  */
 export declare function getPipFrozenTree(basePath: string, reqOrSetupFile: string, tempVenvDir: string, parentComponent: Object, projectRoot: any, getTreeWithPluginFn: any): Object;
 export declare function getPipTreeForPackages(basePath: any, pkgList: any, tempVenvDir: any, parentComponent: any, getTreeWithPluginFn: any): {
-    rootList?: undefined;
     dependenciesList?: undefined;
     failedPkgList?: undefined;
+    rootList?: undefined;
 } | {
     failedPkgList: any[];
     rootList: {

package/types/lib/ecosystems/rubyutils.d.ts

@@ -61,6 +61,39 @@ export declare function simplifyRubyVersion(version: string): string;
  * @returns {string} purl string
  */
 export declare function toGemPurl(name: string, version: string | undefined, platform: string | undefined): string;
+/**
+ * Read the Ruby string literal at the start of `text`: a double or single
+ * quoted string, or a `%q`/`%Q`/`%` percent literal. Escaped delimiters and
+ * backslashes are unescaped; every other escape sequence is kept as written.
+ * An interpolation such as `#{spec.name}` is kept verbatim, including any
+ * quotes inside it.
+ *
+ * @param {string} text Source starting with the literal
+ * @returns {{value: string, interpolated: boolean, complete: boolean, rest: string} | undefined}
+ *   The literal's value, whether it holds an interpolation, whether it was
+ *   closed within `text`, and the source after it. Undefined when `text` does
+ *   not start with a string literal.
+ */
+export declare function readRubyStringLiteral(text: string): {
+    value: string;
+    interpolated: boolean;
+    complete: boolean;
+    rest: string;
+} | undefined;
+/**
+ * Read a Ruby list of strings as written for `authors`, `email`, or `licenses`:
+ * an array of string literals, a `%w[]` word array, or a single string. Array
+ * elements that are not string literals, such as constants, are skipped.
+ *
+ * @param {string} text Source of the value
+ * @returns {{values: string[], complete: boolean} | undefined} The strings,
+ *   and whether the array was closed within `text`. Undefined when the value
+ *   is an expression that cannot be read statically.
+ */
+export declare function readRubyStringList(text: string): {
+    values: string[];
+    complete: boolean;
+} | undefined;
 /**
  * Parse a single line from the `CHECKSUMS` section of a Gemfile.lock. Bundler
  * 2.5 onwards writes `name (version[-platform]) algo=digest[,algo=digest]`,
@@ -159,15 +192,35 @@ export declare function toGemModuleNames(name: any): string[];
  */
 export declare function collectGemModuleNames(rubyCommand: string, bundleCommand: string, gemHome: string, gemName: string, filePath: string): Array<string>;
 /**
- * Method to parse Gemspec file contents
+ * Method to parse Gemspec file contents.
+ *
+ * A source gemspec is Ruby code. The values that can be read without running
+ * it are string literals, lists of them, heredocs, and a version constant
+ * defined in the version file the gemspec requires. Anything else is left
+ * unresolved instead of being guessed.
+ *
+ * Bundler evaluates the gemspec of a project that uses the Gemfile `gemspec`
+ * directive, and locks the gem under `PATH remote: .`. Such a locked version
+ * can be supplied through `options.lockedVersions` and is used when the
+ * gemspec computes its version in a way that cannot be read statically.
  *
  * @param {string} gemspecData Gemspec data
  * @param {string} gemspecFile File name for evidence.
+ * @param {Object} [options] Parse options
+ * @param {Object<string, string>} [options.lockedVersions] Locked versions of
+ *   the gems the project directory serves, by gem name
  */
-export declare function parseGemspecData(gemspecData: string, gemspecFile: string): Promise<any[]>;
+export declare function parseGemspecData(gemspecData: string, gemspecFile: string, options?: {
+    lockedVersions?: Record<string, string>;
+}): Promise<any[]>;
 /**
  * Method to parse Gemfile.lock
  *
+ * Besides the components and the dependency tree, the result lists as
+ * `projectGemRefs` the bom-refs of the gems served from the lockfile's own
+ * directory (`PATH` with `remote: .`), which is how Bundler records the gem a
+ * project builds when its Gemfile uses the `gemspec` directive.
+ *
  * @param {object} gemLockData Gemfile.lock data
  * @param {string} lockFile Lock file
  */
@@ -178,5 +231,93 @@ export declare function parseGemfileLockData(gemLockData: object, lockFile: stri
         dependsOn: any[];
     }[];
     rootList: any[];
+    projectGemRefs: any[];
 }>;
+/**
+ * Describe the gem a project builds in its parent component.
+ *
+ * A gem project sees its own gem more than once: in its gemspec, in the `PATH`
+ * entry the Gemfile `gemspec` directive adds to its lockfile, and possibly as
+ * an installed copy. Each of them describes the project itself, so all are
+ * folded into the parent (discussion 4388). The parent takes the gem's
+ * identity, its descriptive metadata, and its `cdx:gem:*` properties; the
+ * dependency edges of the sightings move to the parent; and the sightings
+ * leave the component list, so the gem is never a dependency of itself.
+ *
+ * An explicit `--project-version` names the version of the parent. Otherwise
+ * the version of the gemspec, which may have come from the lockfile, is used.
+ *
+ * @param {object} parentComponent Parent component, updated in place
+ * @param {object} projectGem Component parsed from the root gemspec
+ * @param {object[]} pkgList Components
+ * @param {object[]} dependencies Dependency edges
+ * @param {string[]} rootList bom-refs of the direct dependencies
+ * @param {string[]} projectGemRefs bom-refs of the gems the lockfiles serve from the project directory
+ * @param {object} options CLI options
+ * @returns {{pkgList: object[], dependencies: object[], rootList: string[]}}
+ *   The components, edges, and direct dependencies with the gem folded in
+ */
+export declare function describeProjectGem(parentComponent: object, projectGem: object, pkgList: object[], dependencies: object[], rootList: string[], projectGemRefs: string[], options?: object): {
+    pkgList: object[];
+    dependencies: object[];
+    rootList: string[];
+};
+/**
+ * Point each gem resolved from the public RubyGems registry at its `.gem`
+ * tarball with a `distribution` external reference (discussion 4406).
+ *
+ * The registry API supplies `gem_uri` when it is reachable, but an offline
+ * scan — a dry run, an air-gapped host, or one that only consulted Bundler's
+ * local caches — has no way to learn it. For the public registry the URL is
+ * deterministic, so it is derived from the recorded `cdx:gem:remote` and the
+ * release identity instead. Gems from any other remote are left alone: a
+ * private mirror's layout is its own business.
+ *
+ * @param {Array} pkgList Gem components, enriched in place
+ * @returns {Array} The package list
+ */
+export declare function addRubyGemsDistributionUrls(pkgList: any[]): any[];
+/**
+ * Intersect Gem::Requirement strings into one `vers` range with the RubyGems
+ * versioning scheme, as the CycloneDX `versionRange` requires. `>= 2.3` and
+ * `>= 3.3` intersect to `vers:gem/>=3.3`, and `~> 3.1` becomes
+ * `vers:gem/>=3.1|<4`, since vers has no pessimistic operator.
+ *
+ * @param {string[]} requirements Requirement strings, each possibly holding
+ *   several comma separated constraints
+ * @returns {string|null|undefined} The range, `null` when the requirements
+ *   exclude each other, or undefined when none of them could be read
+ */
+export declare function rubyRequirementToVers(requirements: string[]): string | null | undefined;
+/**
+ * Describe the Ruby runtime the gems require as one external `platform`
+ * component, and make the components that declare a `required_ruby_version`
+ * depend on it (discussion 4409).
+ *
+ * The component stands for the Ruby the bundle as a whole runs on, so its
+ * `versionRange` is the intersection of every requirement that could be read,
+ * in the `vers` syntax CycloneDX mandates for the field. Each component's own
+ * requirement stays in its `cdx:gem:rubyVersionSpecifiers` property. One
+ * runtime component per distinct requirement would describe the same
+ * interpreter many times over: a modest bundle spells `>= 2.x` a dozen ways.
+ *
+ * The type is `platform`, the CycloneDX type for a runtime environment that
+ * interprets software, and the one cdxgen gives the Ruby it finds in the
+ * build environment. The purl names no version, since a range is not one.
+ *
+ * `isExternal` and `versionRange` are CycloneDX 1.7 fields, and without them
+ * the component would claim the product bundles its interpreter, so the caller
+ * decides whether the BOM should carry it at all.
+ *
+ * @param {Array} pkgList Components
+ * @param {object} parentComponent The metadata.component, when the project is
+ *   itself a gem
+ * @param {Array} dependencies Dependency edges
+ * @returns {{pkgList: Array, dependencies: Array}} Components and edges with
+ *   the runtime component added
+ */
+export declare function addRubyRuntimeComponent(pkgList: any[], parentComponent: object, dependencies: any[]): {
+    pkgList: any[];
+    dependencies: any[];
+};
 //# sourceMappingURL=rubyutils.d.ts.map