@cdxgen/cdxgen 13.1.0 → 13.3.0

package/types/lib/inventory/traceRunner.d.ts

@@ -1,3 +1,11 @@
+/**
+ * Whether the @cdxgen/safer-exec tracing runtime could be loaded. When false,
+ * dynamic tracing cannot run at all, and every trace would otherwise exit 0
+ * with a valid but empty BOM, hiding the broken installation (#4378).
+ *
+ * @returns {boolean} True when the tracing runtime is available
+ */
+export declare function isSaferExecAvailable(): boolean;
 /**
  * Parses a command string into command and arguments array.
  * @param {string} cmdStr - Command string to parse
@@ -40,7 +48,19 @@ export declare function resolveSaferExecBinary(): string | undefined;
  * @param {boolean} [options.traceExec] - Log every child process spawned
  * @param {string[]} [options.allowExec] - Executables the command is allowed to run
  * @param {string[]} [options.blockExec] - Executables to block from running
- * @returns {Promise<{libPaths: string[], httpAccessEntries: Object[]}>} Collected libraries and HTTP URLs
+ * @param {boolean} [options.proxyEgress] - Route egress through safer-exec's hostname-pinning proxy (network stays enabled; only allowHosts are reachable)
+ * @param {boolean} [options.allowLoopback] - Allow loopback connections
+ * @param {boolean} [options.dryRun] - Deny every filesystem and network side effect and collect a dry-run report
+ * @param {string} [options.policy] - Named safer-exec ecosystem policy (npm, pypi, maven, ...)
+ * @param {string} [options.policyFile] - Path to a safer-exec JSON policy file
+ * @param {boolean} [options.blockInterpreters] - Block interpreters with sandbox or task-port exemptions (macOS)
+ * @param {boolean} [options.denyPersistenceWrites] - Deny writes to auto-execution and persistence locations
+ * @param {boolean} [options.privateTmp] - Private tmpfs /tmp and /var/tmp (Linux)
+ * @param {string} [options.protectHome] - Home isolation: read-only, tmpfs, or off (Linux)
+ * @returns {Promise<{libPaths: string[], httpAccessEntries: Object[], egressEntries?: Object[], dryRunSummary?: Object}>} Collected libraries, HTTP URLs, proxy egress decisions, and the dry-run summary
+ * @throws {Error} When the @cdxgen/safer-exec tracing runtime is not installed
+ *   (for example after pruning it from a standalone payload), since the traced
+ *   command could never run and the BOM would silently be empty
  */
 export declare function executeAndTrace(commandStr: string, workingDir?: string, options?: {
     readPaths?: string[];
@@ -62,10 +82,36 @@ export declare function executeAndTrace(commandStr: string, workingDir?: string,
     traceExec?: boolean;
     allowExec?: string[];
     blockExec?: string[];
+    proxyEgress?: boolean;
+    allowLoopback?: boolean;
+    dryRun?: boolean;
+    policy?: string;
+    policyFile?: string;
+    blockInterpreters?: boolean;
+    denyPersistenceWrites?: boolean;
+    privateTmp?: boolean;
+    protectHome?: string;
 }): Promise<{
     libPaths: string[];
     httpAccessEntries: Object[];
+    egressEntries?: Object[];
+    dryRunSummary?: Object;
 }>;
+/**
+ * Extracts the egress proxy's decisions from a safer-exec audit log.
+ * "proxy-connect" targets are "host:port"; "proxy-violation" targets are
+ * "CONNECT host:port" or "METHOD http://host[:port]/path". Only the authority
+ * is kept, never a path or query.
+ *
+ * @param {Object[]} auditLog - safer-exec audit entries
+ * @returns {{host: string, port: number, protocol: string, decision: string}[]} Unique egress decisions
+ */
+export declare function parseEgressEntries(auditLog: Object[]): {
+    host: string;
+    port: number;
+    protocol: string;
+    decision: string;
+}[];
 /**
  * Groups HTTP access entries into a CycloneDX services-ready map.
  * Each unique (host, port, protocol) combination becomes a service.

package/types/lib/inventory/traceRunner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"traceRunner.d.ts","sourceRoot":"","sources":["../../../lib/inventory/traceRunner.js"],"names":[],"mappings":"AAyBA;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAHxB,MAGwB,GAFtB;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,CA6BzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAFzB,MAAM,GAAC,SAAS,CAoE5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAxBrC,MAwBqC,EAAE,UAAU,AAvBzD,CACA,EADQ,MAuBiD,EAAE,OAAO,AAtBlE,CAoBA,EAnBA;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;IAA0B,cAAc,AAAxC,CACA,EADQ,OAAO,CACf;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;CAEuE,GAF7D,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CAyOtE;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,iBAAiB,EAHjD,MAAM,EAG2C;eAFlB,GAAG,CAAC,MAAM,CAAC;gBAAc,MAAM,EAAE;GAuC1E"}
+{"version":3,"file":"traceRunner.d.ts","sourceRoot":"","sources":["../../../lib/inventory/traceRunner.js"],"names":[],"mappings":"AAsBA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAFvB,OAAO,CAInB;AAKD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAHxB,MAGwB,GAFtB;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,CA6BzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAFzB,MAAM,GAAC,SAAS,CAsE5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAsB,eAAe,CAAC,UAAU,EApCrC,MAoCqC,EAAE,UAAU,AAnCzD,CACA,EADQ,MAmCiD,EAAE,OAAO,AAlClE,CA6BA,EA5BA;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;IAA0B,cAAc,AAAxC,CACA,EADQ,OAAO,CACf;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAAyB,MAAM,AAA/B,CACA,EADQ,MAAM,CACd;IAAyB,UAAU,AAAnC,CACA,EADQ,MAAM,CACd;IAA0B,iBAAiB,AAA3C,CACA,EADQ,OAAO,CACf;IAA0B,qBAAqB,AAA/C,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;CAKuE,GAL7D,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAC,CAAC,CAwTxH;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAHhC,MAAM,EAG0B,GAF9B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,EAAE,CAkD9E;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,iBAAiB,EAHjD,MAAM,EAG2C;eAFlB,GAAG,CAAC,MAAM,CAAC;gBAAc,MAAM,EAAE;GA+C1E"}

package/types/lib/managers/binary.d.ts

@@ -15,13 +15,25 @@ export declare function getPluginToolComponents(toolNames?: string[]): Object[];
  *   is unavailable or produced no output.
  */
 export declare function getCargoAuditableInfo(src: string): string | undefined;
+/**
+ * Check that sourcekitten (bundled plugin or SOURCEKITTEN_CMD) answers a
+ * trivial syntax request.
+ *
+ * @param env {Object} Optional environment overrides merged over process.env
+ * @returns {String} `ok`; `unavailable` when there is no bundled plugin and
+ *   SOURCEKITTEN_CMD is unset; `not-found` when the configured executable does
+ *   not exist; `failed` when it ran but could not answer
+ */
+export declare function probeSourcekitten(env: Object): string;
 /**
  * Execute sourcekitten plugin with the given arguments
  *
  * @param args {Array} Arguments
+ * @param env {Object} Optional environment overrides merged over process.env,
+ *   used to align sourcekitten with a specific Swift toolchain
  * @returns {undefined|Object} Command output
  */
-export declare function executeSourcekitten(args: any[]): undefined | Object;
+export declare function executeSourcekitten(args: any[], env: Object): undefined | Object;
 /**
  * Canonicalise the distro vendor namespace of an OS package component
  * produced by trivy, regardless of whether trivy expressed the vendor via the
@@ -103,6 +115,23 @@ export declare function dropRedundantSourceComponents(pkgList: any[]): any[];
  * @returns {Object} Metadata containing packages, dependencies, etc
  */
 export declare function getOSPackages(src: string, imageConfig: Object, options?: {}): Object;
+/**
+ * Collect the dependency edges trivy recorded for one OS package component.
+ *
+ * Trivy keys its `dependencies` by its own bom-refs, which may leave the `+` of
+ * an rpm or deb version unescaped (`...libstdc%2B%2B6@14.2.0+git10526-...`), so
+ * each ref is read structurally and re-rendered in cdxgen's decoded bom-ref
+ * form with the component's type, namespace and distro qualifiers.
+ *
+ * @param {Object<string, string[]>} tmpDependencies Trivy's refs mapped to the refs they depend on
+ * @param {string} origBomRef The component's bom-ref as trivy wrote it
+ * @param {object} comp The component after cdxgen rewrote its purl and bom-ref
+ * @returns {{ref: string, dependsOn: string[]}|undefined} Dependency entry for the component
+ */
+export declare const retrieveDependencies: (tmpDependencies: Record<string, string[]>, origBomRef: string, comp: object) => {
+    ref: string;
+    dependsOn: string[];
+} | undefined;
 /**
  * Batch-enrich operating-system components with host-path trust data using the
  * `trustinspector` helper on darwin and Windows.

package/types/lib/managers/binary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"binary.d.ts","sourceRoot":"","sources":["../../../lib/managers/binary.js"],"names":[],"mappings":"AA0YA;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,AAH9C,CACA,EADQ,MAAM,EAGqC,GAFzC,MAAM,EAAE,CAgBpB;AA4FD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,GAH5B,MAAM,GAAC,SAAS,CAmB5B;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,OAAA,GAF3B,SAAS,GAAC,MAAM,CAkB5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EARK,MAQL,EACJ,OAAO,EARE,MAQF,EACP,IAAI,EARK,MAQL,EACJ,KAAK,EARI,MAQJ,EACL,QAAQ,AARP,CACA,EADQ,MAQD,GAPG,MAAM,CAgDlB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAJ/B,MAI+B,EAAE,QAAQ,AAHjD,CACA,EADQ,MAGyC,GAFvC,MAAM,CA6BlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,OAAA,SAoBpD;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,GAAG,QAAA,EAAE,WAAW,EAL7B,MAK6B,EAAE,OAAO,KAAK,GAFrD,MAAM,CA4mBlB;AAkwDD;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,AALvD,CACA,EADQ,MAAM,EAK8C,GAJlD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAC,CAmEnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EALzB,MAKyB,GAJvB,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAJxB,MAIwB,EAAE,UAAU,EAHpC,MAGoC,WA6C9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EANrB,MAMqB,EAAE,aAAa,EALpC,MAKoC,EAAE,QAAQ,EAJ9C,OAI8C,GAF7C,OAAO,CAiClB"}
+{"version":3,"file":"binary.d.ts","sourceRoot":"","sources":["../../../lib/managers/binary.js"],"names":[],"mappings":"AA+YA;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,AAH9C,CACA,EADQ,MAAM,EAGqC,GAFzC,MAAM,EAAE,CAgBpB;AA4FD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,GAH5B,MAAM,GAAC,SAAS,CAmB5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EALtB,MAKsB,UA+BpC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,OAAA,EAAE,GAAG,EAJ9B,MAI8B,GAFhC,SAAS,GAAC,MAAM,CAmC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EARK,MAQL,EACJ,OAAO,EARE,MAQF,EACP,IAAI,EARK,MAQL,EACJ,KAAK,EARI,MAQJ,EACL,QAAQ,AARP,CACA,EADQ,MAQD,GAPG,MAAM,CAgDlB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAJ/B,MAI+B,EAAE,QAAQ,AAHjD,CACA,EADQ,MAGyC,GAFvC,MAAM,CA6BlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,OAAA,SAoBpD;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,GAAG,QAAA,EAAE,WAAW,EAL7B,MAK6B,EAAE,OAAO,KAAK,GAFrD,MAAM,CAinBlB;AA4lDD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,0DAJtB,MAAM,QACN,MAAM,KACJ;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAsD/C,CAAC;AAyHF;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,AALvD,CACA,EADQ,MAAM,EAK8C,GAJlD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAC,CAmEnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EALzB,MAKyB,GAJvB,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAJxB,MAIwB,EAAE,UAAU,EAHpC,MAGoC,WA6C9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EANrB,MAMqB,EAAE,aAAa,EALpC,MAKoC,EAAE,QAAQ,EAJ9C,OAI8C,GAF7C,OAAO,CAiClB"}

package/types/lib/managers/docker.d.ts

@@ -53,6 +53,27 @@ export declare const getConnection: (_options: Object, forRegistry?: string) =>
  *   requests, raw Buffer for other methods, or `undefined` if no client is available
  */
 export declare const makeRequest: (path: string, method: string, forRegistry?: string) => Promise<Object | Buffer | undefined>;
+/**
+ * Decide whether a CLI path argument is a container image reference in the
+ * styles the container pipeline documents: name, name:tag, namespace/name,
+ * registry/namespace/name:tag, registry:port/..., and any of those with a
+ * @digest. Everything that smells like a filesystem path, a URL or a CLI
+ * option never matches, so strings such as "c:\Users", "c:/tmp" or
+ * "file:///etc" can never reach the container clients: backslashes and
+ * schemes are rejected outright, and a drive-letter prefix fails because a
+ * lone letter is neither a dotted host nor a host:port, and a tag may not
+ * begin with the "/" that follows the colon in "c:/tmp".
+ *
+ * The check mirrors how the distribution reference grammar detects a registry
+ * host: the first component counts as a host only when it carries a dot, a
+ * numeric port, or is exactly localhost. Each piece is validated by a linear
+ * regex or plain string splitting, and the input is length-capped, so hostile
+ * inputs cannot backtrack expensively.
+ *
+ * @param {string} fullImageName Candidate image reference
+ * @returns {boolean} true when the string is a plausible image reference
+ */
+export declare const isImageReference: (fullImageName: string) => boolean;
 /**
  * Parse image name
  *
@@ -70,6 +91,14 @@ export declare const parseImageName: (fullImageName: any) => {
     group: string;
     name: string;
 };
+/**
+ * Prefer cli on windows, nerdctl on mac, or when using tcp/ssh based host.
+ * On Windows, fall back to wslc (WSL Containers) when the docker CLI is not
+ * installed, so OCI image scans work on hosts that only have WSL.
+ *
+ * @returns {string} Container CLI command to invoke
+ */
+export declare const getContainerCliCmd: () => string;
 /**
  * Method to get image to the local registry by pulling from the remote if required
  */

package/types/lib/managers/docker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../lib/managers/docker.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAwCrC,yDAAyD;AACzD,eAAO,MAAM,KAAK,SAA0B,CAAC;AAC7C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAEoC,CAAC;AAsQ/C;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,SAHnB,MAAM,KACJ,MAiBZ,CAAC;AAEF;;GAEG;AACH,wBAAgB,YAAY,QAoB3B;AAED;;GAEG;AACH,wBAAgB,oBAAoB,QA2CnC;AAyTD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,aANf,MAAM,gBAEN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,SAAS,CA6HpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,SANb,MAAM,UACN,MAAM,gBACN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,MAAM,GAAC,SAAS,CAgC3C,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;;;;;;CA2E1B,CAAC;AAkCF;;GAEG;AACH,eAAO,MAAM,QAAQ,sCA2LpB,CAAC;AAGC,YAA4B,gBAAgB,GAAlC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAkB;AAiH/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,kBANZ,MAAM,OACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,OAAO,CAqF3B,CAAC;AAiGF;;;GAGG;AACH,eAAO,MAAM,aAAa,mEAqGzB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,iBATrB,MAAM,aACN,MAAM,WACN,MAAM,wBACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,MAAM,CAgI1B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,oDAkJvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,iDAkJ1B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,kBALb,MAAM,UACN,OAAO,KACL,OAAO,CAAC,MAAM,GAAC,SAAS,CAKpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,cALpB,MAAM,iBACN,MAAM,KACJ,MAAM,GAAC,SA2CnB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,qBAHpB,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,cACnC,KAAK,CAAC,MAAM,CAAC,SA4BvB,CAAC"}
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../lib/managers/docker.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA+CrC,yDAAyD;AACzD,eAAO,MAAM,KAAK,SAA0B,CAAC;AAC7C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAEoC,CAAC;AAkS/C;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,SAHnB,MAAM,KACJ,MAiBZ,CAAC;AAEF;;GAEG;AACH,wBAAgB,YAAY,QAoB3B;AAED;;GAEG;AACH,wBAAgB,oBAAoB,QA2CnC;AAyTD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,aANf,MAAM,gBAEN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,SAAS,CA6HpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,SANb,MAAM,UACN,MAAM,gBACN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,MAAM,GAAC,SAAS,CAgC3C,CAAC;AA8CF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,gBAAgB,kBAHlB,MAAM,KACJ,OAsEZ,CAAC;AAgBF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;;;;;;CA2E1B,CAAC;AAyFF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,QAFlB,MAgCZ,CAAC;AAkBF;;GAEG;AACH,eAAO,MAAM,QAAQ,sCA4MpB,CAAC;AAkBC,YAA4B,gBAAgB,GAAlC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAkB;AAiH/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,kBANZ,MAAM,OACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,OAAO,CAqF3B,CAAC;AAiGF;;;GAGG;AACH,eAAO,MAAM,aAAa,mEAqGzB,CAAC;AAmDF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,iBATrB,MAAM,aACN,MAAM,WACN,MAAM,wBACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,MAAM,CAuK1B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,oDAyJvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,iDAkJ1B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,kBALb,MAAM,UACN,OAAO,KACL,OAAO,CAAC,MAAM,GAAC,SAAS,CAKpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,cALpB,MAAM,iBACN,MAAM,KACJ,MAAM,GAAC,SA2CnB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,qBAHpB,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,cACnC,KAAK,CAAC,MAAM,CAAC,SA4BvB,CAAC"}

package/types/lib/managers/oci.d.ts

@@ -1,3 +1,17 @@
+/**
+ * Check whether a token realm URL belongs to the registry itself.
+ *
+ * A registry's 401 response names the realm, so a hostile registry picks the
+ * URL cdxgen will call. Credentials picked up for the registry must therefore
+ * only be attached when the realm resolves to the same host and port; public
+ * delegating realms (docker.io to auth.docker.io) are still usable, just
+ * anonymously.
+ *
+ * @param {string} registry Registry host, optionally with a port
+ * @param {URL} realmUrl Parsed realm URL from the WWW-Authenticate header
+ * @returns {boolean} true when host and port match the registry
+ */
+export declare function isSameRegistryHost(registry: string, realmUrl: URL): boolean;
 /**
  * Retrieves a CycloneDX BOM attached to an OCI image purely in JavaScript
  * without relying on the `oras` CLI tool.

package/types/lib/managers/oci.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oci.d.ts","sourceRoot":"","sources":["../../../lib/managers/oci.js"],"names":[],"mappings":"AAgXA;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAJ/B,MAI+B,EAAE,SAAS,YAAY,GAFpD,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA4GrC;AAmFD;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,KAAK,EALhC,MAKgC,EAAE,OAAO,EAJzC,MAIyC,GAHvC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAmIrC"}
+{"version":3,"file":"oci.d.ts","sourceRoot":"","sources":["../../../lib/managers/oci.js"],"names":[],"mappings":"AAuOA;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAJhC,MAIgC,EAAE,QAAQ,EAH1C,GAG0C,GAFxC,OAAO,CAgBnB;AAoJD;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAJ/B,MAI+B,EAAE,SAAS,YAAY,GAFpD,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA4GrC;AAmFD;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,KAAK,EALhC,MAKgC,EAAE,OAAO,EAJzC,MAIyC,GAHvC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAmIrC"}

package/types/lib/parsers/cmakeLists.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Pure parser for CMake language files (`CMakeLists.txt`, `*.cmake`).
+ *
+ * `parseCmakeCommands` splits a file into command invocations the way CMake
+ * reads it: command names are case-insensitive, an invocation may span several
+ * lines, and arguments may be quoted, bracketed (`[[...]]`) or interleaved with
+ * comments. `cmakeFetchDependencies` reads the commands that download a
+ * dependency at configure time: `FetchContent_Declare`, `ExternalProject_Add`
+ * and the CPM.cmake `CPMAddPackage` family.
+ *
+ * This module is layer 1 (text in, data out): no filesystem or subprocess
+ * access. `lib/ecosystems/parsers-misc.js` turns the facts into components.
+ */
+/**
+ * Split CMake source into command invocations.
+ *
+ * @param {string} text Contents of a CMake file
+ * @returns {{name: string, args: string[], line: number}[]} Invocations in
+ *   source order. `name` is lower-cased; `args` have their quotes and bracket
+ *   delimiters removed; `line` is the 1-based line of the command name.
+ */
+export declare function parseCmakeCommands(text: string): {
+    name: string;
+    args: string[];
+    line: number;
+}[];
+/**
+ * Replace `${VAR}` references with the values of simple `set()` calls. A
+ * reference to an unknown variable is left in place, so callers can tell a
+ * resolved value from an unresolved one.
+ *
+ * @param {string} value Argument text
+ * @param {Map<string,string>} variables Known variable values
+ * @returns {string} The expanded text
+ */
+export declare function expandCmakeVariables(value: string, variables: Map<string, string>): string;
+/**
+ * The variables a file sets to a single value: `set(FOO_VERSION 1.2.3)` and
+ * `set(FOO_VERSION "1.2.3" CACHE STRING "...")`. Later definitions win.
+ *
+ * @param {{name: string, args: string[]}[]} commands Parsed commands
+ * @returns {Map<string,string>} Variable values
+ */
+export declare function cmakeSetVariables(commands: {
+    name: string;
+    args: string[];
+}[]): Map<string, string>;
+/**
+ * The dependencies a CMake file downloads at configure time.
+ *
+ * `FetchContent_Declare(<name> ...)` and `ExternalProject_Add(<name> ...)` are
+ * read for `GIT_REPOSITORY`/`GIT_TAG` and `URL`/`URL_HASH`/`URL_MD5`.
+ * `CPMAddPackage`, `CPMFindPackage` and `CPMDeclarePackage` are read in both
+ * the shorthand form and the keyword form (`NAME`, `VERSION`,
+ * `GITHUB_REPOSITORY`, `GITLAB_REPOSITORY`, `BITBUCKET_REPOSITORY`,
+ * `GIT_REPOSITORY`, `GIT_TAG`, `URL`, `URL_HASH`). `${VAR}` references are
+ * expanded with the file's simple `set()` values; anything still unresolved
+ * stays as written.
+ *
+ * @param {string} text Contents of a CMake file
+ * @returns {{kind: string, name: string, line: number, gitRepository?: string, gitTag?: string, url?: string, urlHash?: string, version?: string, madeAvailable: boolean}[]}
+ *   `kind` is `fetch`, `external-project` or `cpm`; `madeAvailable` is true
+ *   when a `FetchContent_MakeAvailable` in the same file names the dependency.
+ */
+export declare function cmakeFetchDependencies(text: string): {
+    kind: string;
+    name: string;
+    line: number;
+    gitRepository?: string;
+    gitTag?: string;
+    url?: string;
+    urlHash?: string;
+    version?: string;
+    madeAvailable: boolean;
+}[];
+//# sourceMappingURL=cmakeLists.d.ts.map

package/types/lib/parsers/cmakeLists.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cmakeLists.d.ts","sourceRoot":"","sources":["../../../lib/parsers/cmakeLists.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA8DH;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAL5B,MAK4B,GAJ1B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,EAAE,CA8G1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAJ/B,MAI+B,EAAE,SAAS,EAH1C,GAAG,CAAC,MAAM,EAAC,MAAM,CAGyB,GAFxC,MAAM,CA+BlB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,EAGC,GAF7B,GAAG,CAAC,MAAM,EAAC,MAAM,CAAC,CAkB9B;AAgFD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EALhC,MAKgC,GAJ9B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAC,EAAE,CAyG3K"}

package/types/lib/parsers/huggingfaceUtils.d.ts

@@ -84,9 +84,16 @@ export declare function toHuggingFacePurl(repoId: string, version?: string, repo
  * Normalize a direct Hugging Face URL or purl into a repo reference.
  *
  * @param {string} value direct URL, API URL, or purl
+ * @param {object} [parseOptions] parsing options
+ * @param {boolean} [parseOptions.explicitOnly=false] resolve only unambiguous
+ *   references (`pkg:huggingface/...` purls and huggingface.co URLs) so that
+ *   ambiguous `owner/repo`-shaped values keep their filesystem-path meaning
+ *   until an AI inventory type is explicitly selected
  * @returns {{ assetType: string, repoId: string, version?: string }|undefined} normalized reference
  */
-export declare function normalizeHuggingFaceReference(value: string): {
+export declare function normalizeHuggingFaceReference(value: string, parseOptions?: {
+    explicitOnly?: boolean;
+}): {
     assetType: string;
     repoId: string;
     version?: string;

package/types/lib/parsers/huggingfaceUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"huggingfaceUtils.d.ts","sourceRoot":"","sources":["../../../lib/parsers/huggingfaceUtils.js"],"names":[],"mappings":"AAiBA;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAFd,MAEyC,CAAC;AACpD;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,EAFlC,GAAG,CAAC,MAAM,CAYlB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,EAFtC,MAEkE,CAAC;AAC7E;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAFpC,MAE8D,CAAC;AAEzE;;;;;;GAMG;AACH,wBAAgB,oCAAoC,CAAC,SAAS,EAJnD,MAImD,GAHjD,MAAM,GAAC,SAAS,CAW5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CAAC,aAAa,EAJxD,MAIwD,GAHtD,MAAM,GAAC,SAAS,CAiB5B;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CAoC5B;AAYD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAHxC,MAGwC,GAFtC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAJrC,MAIqC,EAAE,MAAM,EAH7C,MAG6C,GAF3C,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAJpC,MAIoC,EAAE,MAAM,EAH5C,MAG4C,GAF1C,MAAM,GAAC,SAAS,CAK5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAL7B,MAK6B,EAAE,OAAO,AAJ9C,CACA,EADQ,MAIsC,EAAE,aAAa,AAH7D,CACA,EADQ,MAGqD,GAFnD,MAAM,GAAC,SAAS,CA8B5B;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAHxC,MAGwC,GAFtC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAC,SAAS,CA6G7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAZxC,MAAM,GAAC,MAYiC,EAAE,OAAO,AAXzD,CACA,EADQ;IAAE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAC,SAAS,KAAK,MAAM,GAAC,SAAS,CAAA;CAWN,GAVpD;IACR,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb,GAAC,SAAS,CAqDb;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAJ3C,MAAM,GAAC,MAIoC,EAAE,OAAO,AAH5D,CACA,EADQ;IAAE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAC,SAAS,KAAK,MAAM,GAAC,SAAS,CAAA;CAGH,GAFvD;IAAE,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAC,SAAS,CAyBtG;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,AAHhD,CACA,EADQ,KAAK,CAAC,MAAM,CAGiC,GAF3C,KAAK,CAAC;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAyBlE;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,kBAAkB,EAHnD,MAAM,GAAC,MAG4C,GAFjD,MAAM,GAAC,SAAS,CAoB5B"}
+{"version":3,"file":"huggingfaceUtils.d.ts","sourceRoot":"","sources":["../../../lib/parsers/huggingfaceUtils.js"],"names":[],"mappings":"AAiBA;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAFd,MAEyC,CAAC;AACpD;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,EAFlC,GAAG,CAAC,MAAM,CAYlB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,EAFtC,MAEkE,CAAC;AAC7E;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAFpC,MAE8D,CAAC;AAEzE;;;;;;GAMG;AACH,wBAAgB,oCAAoC,CAAC,SAAS,EAJnD,MAImD,GAHjD,MAAM,GAAC,SAAS,CAW5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CAAC,aAAa,EAJxD,MAIwD,GAHtD,MAAM,GAAC,SAAS,CAiB5B;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CAoC5B;AAYD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAHxC,MAGwC,GAFtC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAJrC,MAIqC,EAAE,MAAM,EAH7C,MAG6C,GAF3C,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAJpC,MAIoC,EAAE,MAAM,EAH5C,MAG4C,GAF1C,MAAM,GAAC,SAAS,CAK5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAL7B,MAK6B,EAAE,OAAO,AAJ9C,CACA,EADQ,MAIsC,EAAE,aAAa,AAH7D,CACA,EADQ,MAGqD,GAFnD,MAAM,GAAC,SAAS,CA8B5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EARxC,MAQwC,EAAE,YAAY,AAP9D,CAKA,EAJA;IAA+B,YAAY,AAA3C,CAIA,EAJQ,OAAO,CAIf;CAEmE,GAFzD;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAC,SAAS,CAgH7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAZxC,MAAM,GAAC,MAYiC,EAAE,OAAO,AAXzD,CACA,EADQ;IAAE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAC,SAAS,KAAK,MAAM,GAAC,SAAS,CAAA;CAWN,GAVpD;IACR,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb,GAAC,SAAS,CAqDb;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAJ3C,MAAM,GAAC,MAIoC,EAAE,OAAO,AAH5D,CACA,EADQ;IAAE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAC,SAAS,KAAK,MAAM,GAAC,SAAS,CAAA;CAGH,GAFvD;IAAE,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAC,SAAS,CAyBtG;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,AAHhD,CACA,EADQ,KAAK,CAAC,MAAM,CAGiC,GAF3C,KAAK,CAAC;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAyBlE;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,kBAAkB,EAHnD,MAAM,GAAC,MAG4C,GAFjD,MAAM,GAAC,SAAS,CAoB5B"}

package/types/lib/parsers/largeJson.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The largest file that `JSON.parse(readFileSync(file, "utf-8"))` can always
+ * decode. V8 caps a string at this many UTF-16 code units, and UTF-8 never
+ * decodes to more code units than it has bytes.
+ */
+export declare const MAX_JSON_TEXT_BYTES: any;
+/**
+ * Locate the value of each member of the top-level object in a JSON file,
+ * without decoding any of them.
+ *
+ * @param {string} filePath JSON file whose top-level value is an object
+ * @param {Object} [options] Chunk size override, for tests
+ * @returns {Map<string, {start: number, end: number}>} Byte range of each member's value, in file order. A repeated key keeps its last value, as JSON.parse does.
+ * @throws {SyntaxError} When the top-level value is not a well-formed object
+ */
+export declare function indexJsonObject(filePath: string, options?: Object): Map<string, {
+    start: number;
+    end: number;
+}>;
+/**
+ * Decode the JSON value stored in a byte range of a file, without ever holding
+ * more than a bounded run of it in one string.
+ *
+ * `spec` narrows what is kept. `{ members: { name: spec } }` keeps only the
+ * named members of an object, each narrowed by its own spec. `{ filter }`
+ * keeps the elements of an array that `filter(element)` accepts. Anything else
+ * keeps the whole value.
+ *
+ * @param {string} filePath JSON file
+ * @param {{start: number, end: number}} range Byte range of the value, such as one returned by indexJsonObject
+ * @param {Object} [spec] What to keep
+ * @param {Object} [options] Batch and chunk size overrides, for tests
+ * @returns {*} The decoded value
+ * @throws {SyntaxError} When the value is malformed
+ */
+export declare function readJsonRange(filePath: string, range: {
+    start: number;
+    end: number;
+}, spec?: Object, options?: Object): any;
+/**
+ * Parse a JSON file of any size. A file that fits in one string is decoded
+ * with JSON.parse, and a larger one is streamed through readJsonRange, so the
+ * result is the same either way.
+ *
+ * @param {string} filePath JSON file
+ * @param {Object} [spec] What to keep, as for readJsonRange
+ * @param {Object} [options] Size overrides, for tests: maxTextBytes, batchBytes, chunkBytes
+ * @returns {*} The decoded value
+ * @throws {SyntaxError} When the file is malformed
+ */
+export declare function readJsonFile(filePath: string, spec?: Object, options?: Object): any;
+//# sourceMappingURL=largeJson.d.ts.map

package/types/lib/parsers/largeJson.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"largeJson.d.ts","sourceRoot":"","sources":["../../../lib/parsers/largeJson.js"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,KAA8B,CAAC;AAiY/D;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAL7B,MAK6B,EAAE,OAAO,AAJ9C,CACA,EADQ,MAI2C,GAHzC,GAAG,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,CAarD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAP3B,MAO2B,EAAE,KAAK,EANlC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAMO,EAAE,IAAI,AALhD,CACA,EADQ,MAKoD,EAAE,OAAO,AAJrE,CACA,EADQ,MAIkE,GAHhE,GAAC,CAOb;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAN1B,MAM0B,EAAE,IAAI,AALxC,CACA,EADQ,MAK4C,EAAE,OAAO,AAJ7D,CACA,EADQ,MAI0D,GAHxD,GAAC,CASb"}

package/types/lib/parsers/npmrc.d.ts

@@ -9,6 +9,11 @@ export declare const DEFAULT_NPMRC_BLOCKLIST: Set<string>;
 /**
  * Parse .npmrc content into a plain key-value object.
  *
+ * Keys that collide with JavaScript object internals are skipped: assigning
+ * them on a plain object either silently mutates Object.prototype semantics or,
+ * for the array syntax, crashed the parser with a TypeError because
+ * `result.__proto__` resolves to Object.prototype instead of an own property.
+ *
  * @param {string} content - Raw .npmrc file content
  * @returns {Object} Parsed key-value pairs
  */

package/types/lib/parsers/npmrc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"npmrc.d.ts","sourceRoot":"","sources":["../../../lib/parsers/npmrc.js"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,EAF1B,GAAG,CAAC,MAAM,CAkBlB,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAHvB,MAGuB,GAFrB,MAAM,CAiClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAH1B,MAGwC,GAFtC,MAAM,CAoBlB"}
+{"version":3,"file":"npmrc.d.ts","sourceRoot":"","sources":["../../../lib/parsers/npmrc.js"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,EAF1B,GAAG,CAAC,MAAM,CAkBlB,CAAC;AAYH;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAHvB,MAGuB,GAFrB,MAAM,CAoClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAH1B,MAGwC,GAFtC,MAAM,CAoBlB"}

package/types/lib/parsers/onnx.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Read the identifying header fields of an ONNX model file.
+ *
+ * Only `ir_version`, `producer_name`, `producer_version`, `model_version`,
+ * and the `opset_import` entries are extracted. The graph and every other
+ * payload are skipped by offset without being read, so no tensor data is
+ * ever loaded and no model code is executed.
+ *
+ * @param {string} filePath Path to the `.onnx` file
+ * @returns {{
+ *   irVersion: number,
+ *   producerName: string,
+ *   producerVersion: string,
+ *   modelVersion: number,
+ *   opsets: Array<{domain: string, version: number}>,
+ * } | undefined} Header summary, or undefined when it cannot be read
+ */
+export declare function readOnnxHeader(filePath: string): {
+    irVersion: number;
+    producerName: string;
+    producerVersion: string;
+    modelVersion: number;
+    opsets: Array<{
+        domain: string;
+        version: number;
+    }>;
+} | undefined;
+//# sourceMappingURL=onnx.d.ts.map

package/types/lib/parsers/onnx.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onnx.d.ts","sourceRoot":"","sources":["../../../lib/parsers/onnx.js"],"names":[],"mappings":"AAoBA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAT5B,MAS4B,GAR1B;IACR,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;CAClD,GAAG,SAAS,CAwGf"}

package/types/lib/parsers/safetensors.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Read and parse the JSON header of a safetensors model file.
+ *
+ * Only the leading header is read; tensor payloads are ignored. The returned
+ * object separates the optional `__metadata__` map from the per-tensor
+ * descriptors.
+ *
+ * @param {string} filePath Path to a `.safetensors` file
+ * @returns {{
+ *   metadata: Object,
+ *   tensorCount: number,
+ *   dtypes: string[],
+ *   totalParameters: number,
+ * } | undefined} Parsed header summary, or undefined when it cannot be read
+ */
+export declare function readSafetensorsHeader(filePath: string): {
+    metadata: Object;
+    tensorCount: number;
+    dtypes: string[];
+    totalParameters: number;
+} | undefined;
+//# sourceMappingURL=safetensors.d.ts.map

package/types/lib/parsers/safetensors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safetensors.d.ts","sourceRoot":"","sources":["../../../lib/parsers/safetensors.js"],"names":[],"mappings":"AAWA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EARnC,MAQmC,GAPjC;IACR,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,SAAS,CAuCf"}

package/types/lib/stages/postgen/introspection/markers.d.ts

@@ -19,8 +19,9 @@
  * Marker table: ecosystem → manifest and lockfile names that indicate the
  * ecosystem is part of the project. Entries are either exact file names or
  * `{ suffix }` matchers for extension-driven ecosystems. Ecosystems cdxgen
- * cannot parse (elm, crystal, nim, perl, r) are included so the reflection
- * can report them as coverage gaps instead of silently ignoring them.
+ * cannot parse (currently only dub, the D package manager) are included so
+ * the reflection can report them as coverage gaps instead of silently
+ * ignoring them.
  *
  * @type {Readonly<Record<string, {names: string[], suffixes: string[]}>>}
  */

package/types/lib/stages/postgen/introspection/markers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"markers.d.ts","sourceRoot":"","sources":["../../../../../lib/stages/postgen/introspection/markers.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAUH;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,EAFpB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CAoFtE,CAAC;AAEH;;;gCAGgC;AAChC,eAAO,MAAM,eAAe,eAAY,CAAC;AAyDzC;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EALvC,MAKuC,EAAE,KAAK,AAJtD,CAEA,EADA;IAA0E,OAAO,AAAjF,CACA,EADQ,CAAC,OAAO,EAAE,MAAM,KAAK;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAC,EAAE,CACjE;CAE2D,GAFjD;IAAC,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAC,CAoCnF"}
+{"version":3,"file":"markers.d.ts","sourceRoot":"","sources":["../../../../../lib/stages/postgen/introspection/markers.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAUH;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,EAFpB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CA0GtE,CAAC;AAEH;;;gCAGgC;AAChC,eAAO,MAAM,eAAe,eAAY,CAAC;AAyDzC;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EALvC,MAKuC,EAAE,KAAK,AAJtD,CAEA,EADA;IAA0E,OAAO,AAAjF,CACA,EADQ,CAAC,OAAO,EAAE,MAAM,KAAK;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAC,EAAE,CACjE;CAE2D,GAFjD;IAAC,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAC,CAoCnF"}

package/types/lib/stages/postgen/postgen.d.ts

@@ -26,6 +26,39 @@ export declare function applyMetadata(bomJson: Object, options: Object): Object;
  * @returns {Object} Filtered BOM JSON
  */
 export declare function applyStandards(bomJson: Object, options: Object): Object;
+/**
+ * Move the build-time-only components out of `components[]`, which describes
+ * the delivered assembly, and hand them to the formulation section, which is
+ * where CycloneDX describes how the assembly was produced.
+ *
+ * Their bom-refs stay valid because the formulation components live in the same
+ * document, so the dependency graph is left intact. `formulation` exists from
+ * CycloneDX 1.5, so an older document keeps them in `components[]` with their
+ * `cdx:cargo:hostOnly` marker rather than losing them.
+ *
+ * @param {Object} bomJson BOM JSON object
+ * @param {Object} options CLI options
+ *
+ * @returns {Object[]} The components removed from `components[]`
+ */
+export declare function extractBuildOnlyComponents(bomJson: Object, options: Object): Object[];
+/**
+ * Re-apply the `--required-only` filter once the evidence stage has attached
+ * occurrence and callstack data.
+ *
+ * A manifest can only say that a dependency is optional; the evidence says
+ * whether it is reached. A component the analyzers observed in the sources is
+ * promoted to `required` so it survives the filter, while an optional component
+ * with no observed usage is dropped as before. A component scoped `excluded` -
+ * a dev or test dependency - keeps that scope: an occurrence inside the test
+ * sources is not evidence that it ships.
+ *
+ * @param {Object} bomJson BOM JSON object carrying evidence
+ * @param {Object} options CLI options
+ *
+ * @returns {Object} Filtered BOM JSON
+ */
+export declare function applyEvidenceBasedFilter(bomJson: Object, options: Object): Object;
 /**
  * Filter BOM based on options
  *

package/types/lib/stages/postgen/postgen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postgen.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/postgen.js"],"names":[],"mappings":"AAgiBA;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,SAAS,EANhC,MAMgC,EAAE,OAAO,EALzC,MAKyC,EAAE,QAAQ,AAJ3D,CAEA,EAFQ,MAImD,GAFjD,OAAO,CAAC,MAAM,CAAC,CA4D3B;AAgHD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAL1B,MAK0B,EAAE,OAAO,EAJnC,MAImC,GAFjC,MAAM,CA8HlB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAL3B,MAK2B,EAAE,OAAO,EAJpC,MAIoC,GAFlC,MAAM,CAqClB;AAkED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,EALtB,MAKsB,EAAE,OAAO,EAJ/B,MAI+B,GAF7B,MAAM,CA0MlB;AAUD;;GAEG;AACH,wBAAgB,UAAU,CAAC,QAAQ,KAAA,QAUlC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,IAFhB,IAAI,CAYhB;AAMD;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EALrB,MAKqB,EAAE,OAAO,EAJ9B,MAI8B,GAF5B,MAAM,CA2HlB"}
+{"version":3,"file":"postgen.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/postgen.js"],"names":[],"mappings":"AAiiBA;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,SAAS,EANhC,MAMgC,EAAE,OAAO,EALzC,MAKyC,EAAE,QAAQ,AAJ3D,CAEA,EAFQ,MAImD,GAFjD,OAAO,CAAC,MAAM,CAAC,CAsE3B;AAgHD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAL1B,MAK0B,EAAE,OAAO,EAJnC,MAImC,GAFjC,MAAM,CA6IlB;AAuCD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAL3B,MAK2B,EAAE,OAAO,EAJpC,MAIoC,GAFlC,MAAM,CAqClB;AAqHD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EALvC,MAKuC,EAAE,OAAO,EAJhD,MAIgD,GAF9C,MAAM,EAAE,CAmBpB;AAgBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EALrC,MAKqC,EAAE,OAAO,EAJ9C,MAI8C,GAF5C,MAAM,CAiClB;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,EALtB,MAKsB,EAAE,OAAO,EAJ/B,MAI+B,GAF7B,MAAM,CAoNlB;AAUD;;GAEG;AACH,wBAAgB,UAAU,CAAC,QAAQ,KAAA,QAUlC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,IAFhB,IAAI,CAYhB;AAMD;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EALrB,MAKqB,EAAE,OAAO,EAJ9B,MAI8B,GAF5B,MAAM,CA2HlB"}

package/types/lib/validator/bomValidator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bomValidator.d.ts","sourceRoot":"","sources":["../../../lib/validator/bomValidator.js"],"names":[],"mappings":"AAqPA;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAJb,MAAM,KAEJ,OAAO,SAmCnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,aAHd,MAAM,GAAC,MAAM,KACX,OAyLZ,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,YAFlB,MAAM,YAmEhB,CAAC;AA4CF;;;;GAIG;AACH,eAAO,MAAM,aAAa,YAFf,MAAM,YA+HhB,CAAC;AA2CF;;;;GAIG;AACH,eAAO,MAAM,YAAY,YAFd,MAAM,YAwFhB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAF1B,MAE0B,WAkIpC"}
+{"version":3,"file":"bomValidator.d.ts","sourceRoot":"","sources":["../../../lib/validator/bomValidator.js"],"names":[],"mappings":"AAqPA;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAJb,MAAM,KAEJ,OAAO,SAmCnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,aAHd,MAAM,GAAC,MAAM,KACX,OAyLZ,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,YAFlB,MAAM,YAmEhB,CAAC;AA4CF;;;;GAIG;AACH,eAAO,MAAM,aAAa,YAFf,MAAM,YA+HhB,CAAC;AA2CF;;;;GAIG;AACH,eAAO,MAAM,YAAY,YAFd,MAAM,YA8EhB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAF1B,MAE0B,WAkIpC"}

package/types/lib/validator/index.d.ts

@@ -47,10 +47,13 @@ export declare function validateGeneratedBom(bomJson: object): Promise<{
  * @param {string} [options.minSeverity]        Minimum severity for returned findings.
  * @param {boolean} [options.includeManual]     Include manual-review findings (default true).
  * @param {boolean} [options.includePass]       Include passing findings (default false).
- * @param {string} [options.publicKey]          If set, verify the BOM signature.
+ * @param {string} [options.publicKey]          If set, verify the BOM signature with this public key.
+ * @param {string|Buffer} [options.secretKey]   If set, verify an HMAC (HS*) BOM signature with this shared secret.
+ * @param {boolean} [options.nestedSignatures]  Also verify component, service, and annotation signatures (default true), as cdx-verify does.
  * @returns {{
  *   schemaValid: boolean,
  *   deepValid: boolean,
+ *   validationErrors: Array<{ stage: string, message: string }>,
  *   signatureVerified: boolean | null,
  *   signatureDetails: object | null,
  *   findings: Array<object>,
@@ -68,9 +71,15 @@ export declare function validateBomAdvanced(bomJson: object, options?: {
     includeManual?: boolean;
     includePass?: boolean;
     publicKey?: string;
+    secretKey?: string | Buffer;
+    nestedSignatures?: boolean;
 }): {
     schemaValid: boolean;
     deepValid: boolean;
+    validationErrors: Array<{
+        stage: string;
+        message: string;
+    }>;
     signatureVerified: boolean | null;
     signatureDetails: object | null;
     findings: Array<object>;

package/types/lib/validator/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/validator/index.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAYH;;;;;GAKG;AACH,QAAA,MAAM,cAAc,wBAAuD,CAAC;AA4D5E;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,CAAC,CAKrE;AAoCD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EArBtC,MAqBsC,EAAE,OAAO,AApBvD,CASA,EARA;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAA0B,IAAI,AAA9B,CACA,EADQ,OAAO,CACf;IAAgC,UAAU,AAA1C,CACA,EADQ,KAAK,CAAC,MAAM,CAAC,CACrB;IAAgC,UAAU,AAA1C,CACA,EADQ,KAAK,CAAC,MAAM,CAAC,CACrB;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;CAW4D,GAXlD;IACR,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAA;CAChB,CA2CH;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAPtB,MAOsB,EAAE,IAAI,GALpC;IAAsB,YAAY,AAAlC,CACA,EADQ,MAAM,CACd;IAAuB,MAAM,AAA7B,CACA,EADQ,OAAO,CACf;IAAuB,gBAAgB,AAAvC,CACA,EADQ,OAAO,CACf;CAEyC,GAF/B;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CA0B1D;AAED,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/validator/index.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAgBH;;;;;GAKG;AACH,QAAA,MAAM,cAAc,wBAAuD,CAAC;AA4D5E;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,CAAC,CAKrE;AAgDD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAxBtC,MAwBsC,EAAE,OAAO,AAvBvD,CAWA,EAVA;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAA0B,IAAI,AAA9B,CACA,EADQ,OAAO,CACf;IAAgC,UAAU,AAA1C,CACA,EADQ,KAAK,CAAC,MAAM,CAAC,CACrB;IAAgC,UAAU,AAA1C,CACA,EADQ,KAAK,CAAC,MAAM,CAAC,CACrB;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;IAAgC,SAAS,AAAzC,CACA,EADQ,MAAM,GAAC,MAAM,CACrB;IAA0B,gBAAgB,AAA1C,CACA,EADQ,OAAO,CACf;CAY4D,GAZlD;IACR,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,gBAAgB,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAA;CAChB,CA8DH;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAPtB,MAOsB,EAAE,IAAI,GALpC;IAAsB,YAAY,AAAlC,CACA,EADQ,MAAM,CACd;IAAuB,MAAM,AAA7B,CACA,EADQ,OAAO,CACf;IAAuB,gBAAgB,AAAvC,CACA,EADQ,OAAO,CACf;CAEyC,GAF/B;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CA0B1D;AAED,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,CAAC"}

package/types/lib/validator/reporters/console.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"console.d.ts","sourceRoot":"","sources":["../../../../lib/validator/reporters/console.js"],"names":[],"mappings":"AAAA;;;GAGG;AAoBH;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAJ5B,KAAK,CAAC,MAAM,CAIgB,EAAE,OAAO,AAH7C,CACA,EADQ,MAG0C,GAFxC,MAAM,CAiClB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,KAAK,CAAC,MAAM,CAGiB,GAF3B,MAAM,CAmClB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,MAAM,CAWlB;AAED;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAHlB,MAGkB,GAFhB,MAAM,CAkClB"}
+{"version":3,"file":"console.d.ts","sourceRoot":"","sources":["../../../../lib/validator/reporters/console.js"],"names":[],"mappings":"AAAA;;;GAGG;AAoBH;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAJ5B,KAAK,CAAC,MAAM,CAIgB,EAAE,OAAO,AAH7C,CACA,EADQ,MAG0C,GAFxC,MAAM,CAiClB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,KAAK,CAAC,MAAM,CAGiB,GAF3B,MAAM,CAmClB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,MAAM,CAWlB;AAED;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAHlB,MAGkB,GAFhB,MAAM,CAqClB"}

package/types/lib/validator/reporters/json.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../../../lib/validator/reporters/json.js"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAJlB,MAIkB,EAAE,QAAQ,AAHpC,CACA,EADQ,MAGiC,GAF/B,MAAM,CA4BlB"}
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../../../lib/validator/reporters/json.js"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAJlB,MAIkB,EAAE,QAAQ,AAHpC,CACA,EADQ,MAGiC,GAF/B,MAAM,CA6BlB"}

package/types/lib/validator/reporters/sarif.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sarif.d.ts","sourceRoot":"","sources":["../../../../lib/validator/reporters/sarif.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AAgIH;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAPlB,MAOkB,EAAE,OAAO,AANnC,CAIA,EAHA;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;CAEwC,GAF9B,MAAM,CA0ClB"}
+{"version":3,"file":"sarif.d.ts","sourceRoot":"","sources":["../../../../lib/validator/reporters/sarif.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AAgIH;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAPlB,MAOkB,EAAE,OAAO,AANnC,CAIA,EAHA;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;CAEwC,GAF9B,MAAM,CAiDlB"}