@cdxgen/cdxgen 13.2.0 → 13.3.0

package/lib/validator/index.js

@@ -11,7 +11,11 @@
  * wrapper (`bin/validate.js`) is responsible for reading the input BOM.
  */
 
-import { verifyNode } from "../helpers/bomSigner.js";
+import {
+  loadSharedSecret,
+  verifyBom,
+  verifyNode,
+} from "../helpers/bomSigner.js";
 import {
   validateBom,
   validateMetadata,
@@ -109,18 +113,26 @@ export async function validateGeneratedBom(bomJson) {
  * Run schema + deep validation checks from the existing validator helpers and
  * capture their boolean results without letting them blow up the process.
  *
+ * An exception is not a verdict on the BOM, so it is recorded in
+ * `validationErrors` instead of silently counting as a plain failure.
+ *
  * @param {object} bomJson
  * @param {object} opts
- * @returns {Promise<{ schemaValid: boolean, deepValid: boolean }>}
+ * @returns {Promise<{ schemaValid: boolean, deepValid: boolean, validationErrors: Array<{ stage: string, message: string }> }>}
  */
 async function runSchemaAndDeep(bomJson, opts) {
   let schemaValid = true;
   let deepValid = true;
+  const validationErrors = [];
   if (opts.schema !== false) {
     try {
       schemaValid = (await validateBom(bomJson)) !== false;
     } catch (err) {
       schemaValid = false;
+      validationErrors.push({
+        stage: "schema",
+        message: err?.message || String(err),
+      });
       if (opts.onError) opts.onError("schema", err);
     }
   }
@@ -133,10 +145,14 @@ async function runSchemaAndDeep(bomJson, opts) {
         validateProps(bomJson) !== false;
     } catch (err) {
       deepValid = false;
+      validationErrors.push({
+        stage: "deep",
+        message: err?.message || String(err),
+      });
       if (opts.onError) opts.onError("deep", err);
     }
   }
-  return { schemaValid, deepValid };
+  return { schemaValid, deepValid, validationErrors };
 }
 
 /**
@@ -151,10 +167,13 @@ async function runSchemaAndDeep(bomJson, opts) {
  * @param {string} [options.minSeverity]        Minimum severity for returned findings.
  * @param {boolean} [options.includeManual]     Include manual-review findings (default true).
  * @param {boolean} [options.includePass]       Include passing findings (default false).
- * @param {string} [options.publicKey]          If set, verify the BOM signature.
+ * @param {string} [options.publicKey]          If set, verify the BOM signature with this public key.
+ * @param {string|Buffer} [options.secretKey]   If set, verify an HMAC (HS*) BOM signature with this shared secret.
+ * @param {boolean} [options.nestedSignatures]  Also verify component, service, and annotation signatures (default true), as cdx-verify does.
  * @returns {{
  *   schemaValid: boolean,
  *   deepValid: boolean,
+ *   validationErrors: Array<{ stage: string, message: string }>,
  *   signatureVerified: boolean | null,
  *   signatureDetails: object | null,
  *   findings: Array<object>,
@@ -164,7 +183,10 @@ async function runSchemaAndDeep(bomJson, opts) {
  * }}
  */
 export async function validateBomAdvanced(bomJson, options = {}) {
-  const { schemaValid, deepValid } = await runSchemaAndDeep(bomJson, options);
+  const { schemaValid, deepValid, validationErrors } = await runSchemaAndDeep(
+    bomJson,
+    options,
+  );
   const allFindings = evaluateAll(bomJson, {
     categories: options.categories,
     benchmarks: options.benchmarks,
@@ -177,17 +199,32 @@ export async function validateBomAdvanced(bomJson, options = {}) {
   });
   let signatureVerified = null;
   let signatureDetails = null;
-  if (options.publicKey && bomJson?.signature) {
+  const verificationRequested = Boolean(options.publicKey || options.secretKey);
+  if (verificationRequested && bomJson?.signature) {
     try {
-      const match = verifyNode(bomJson, options.publicKey);
+      const key = options.secretKey
+        ? loadSharedSecret(options.secretKey)
+        : options.publicKey;
+      const reasons = [];
+      const verify =
+        options.nestedSignatures === false ? verifyNode : verifyBom;
+      const match = verify(bomJson, key, { reasons });
       signatureVerified = Boolean(match);
-      signatureDetails = match || null;
+      if (match) {
+        signatureDetails = match;
+      } else {
+        signatureDetails = {
+          error: reasons.length
+            ? [...new Set(reasons)].join(" ")
+            : "No signature matched the key.",
+        };
+      }
     } catch (err) {
       signatureVerified = false;
       signatureDetails = { error: err?.message || String(err) };
     }
-  } else if (options.publicKey) {
-    // Public key provided but BOM has no signature.
+  } else if (verificationRequested) {
+    // Verification key provided but BOM has no signature.
     signatureVerified = false;
     signatureDetails = { error: "BOM has no signature block." };
   }
@@ -197,6 +234,7 @@ export async function validateBomAdvanced(bomJson, options = {}) {
   return {
     schemaValid,
     deepValid,
+    validationErrors,
     signatureVerified,
     signatureDetails,
     findings: filtered,

package/lib/validator/reporters/console.js

@@ -128,6 +128,9 @@ export function formatSummary(summary) {
 export function render(report) {
   const pieces = [];
   pieces.push(formatSummary(report.summary));
+  for (const e of report.validationErrors || []) {
+    pieces.push(`Validator error during ${e.stage} validation: ${e.message}`);
+  }
   if (report.benchmarks?.length) {
     pieces.push(formatBenchmarks(report.benchmarks));
   }

package/lib/validator/reporters/json.js

@@ -12,6 +12,7 @@ export function render(report, _options = {}) {
   const payload = {
     schemaValid: report.schemaValid,
     deepValid: report.deepValid,
+    validationErrors: report.validationErrors || [],
     signatureVerified: report.signatureVerified ?? null,
     summary: report.summary,
     benchmarks: report.benchmarks || [],

package/lib/validator/reporters/sarif.js

@@ -167,12 +167,19 @@ export function render(report, options = {}) {
           {
             executionSuccessful:
               report.summary?.fail === 0 && report.schemaValid !== false,
+            toolExecutionNotifications: (report.validationErrors || []).map(
+              (e) => ({
+                level: "error",
+                message: { text: `${e.stage} validation error: ${e.message}` },
+              }),
+            ),
           },
         ],
         results: findings.map(toSarifResult),
         properties: {
           schemaValid: report.schemaValid,
           deepValid: report.deepValid,
+          validationErrors: report.validationErrors || [],
           signatureVerified: report.signatureVerified ?? null,
           summary: report.summary,
           benchmarks: report.benchmarks || [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cdxgen/cdxgen",
-  "version": "13.2.0",
+  "version": "13.3.0",
   "description": "Creates CycloneDX Software Bill of Materials (SBOM) from source or container image",
   "keywords": [
     "sbom",
@@ -123,9 +123,9 @@
     "index.cjs"
   ],
   "dependencies": {
-    "@babel/parser": "8.0.5",
-    "@babel/traverse": "8.0.5",
-    "@cdxgen/cdx-purl": "0.0.5",
+    "@babel/parser": "8.0.6",
+    "@babel/traverse": "8.0.6",
+    "@cdxgen/cdx-purl": "0.0.6",
     "@isaacs/string-locale-compare": "1.1.0",
     "@npmcli/fs": "6.0.0",
     "@npmcli/map-workspaces": "6.0.0",
@@ -140,14 +140,14 @@
     "npm-package-arg": "14.0.0",
     "parse-conflict-json": "6.0.0",
     "semver": "7.8.5",
-    "smol-toml": "^1.8.0",
+    "smol-toml": "1.8.0",
     "ssri": "14.0.0",
     "tar": "7.5.22",
     "treeverse": "3.0.0",
-    "undici": "8.10.2",
+    "undici": "8.11.0",
     "walk-up-path": "4.0.0",
     "yaml": "2.9.1",
-    "yargs": "18.1.0"
+    "yargs": "18.2.0"
   },
   "devDependencies": {
     "@biomejs/biome": "2.5.14",
@@ -158,22 +158,22 @@
   },
   "optionalDependencies": {
     "@appthreat/atom": "3.1.1",
-    "@appthreat/atom-parsetools": "1.7.0",
+    "@appthreat/atom-parsetools": "1.8.0",
     "@bufbuild/protobuf": "2.15.0",
     "@cdxgen/cdx-hbom": "0.5.1",
     "@cdxgen/cdx-proto": "2.3.0",
-    "@cdxgen/cdxgen-plugins-bin": "4.0.0",
-    "@cdxgen/cdxgen-plugins-bin-darwin-amd64": "4.0.0",
-    "@cdxgen/cdxgen-plugins-bin-darwin-arm64": "4.0.0",
-    "@cdxgen/cdxgen-plugins-bin-linux-amd64": "4.0.0",
-    "@cdxgen/cdxgen-plugins-bin-linux-arm": "4.0.0",
-    "@cdxgen/cdxgen-plugins-bin-linux-arm64": "4.0.0",
-    "@cdxgen/cdxgen-plugins-bin-linux-ppc64": "4.0.0",
-    "@cdxgen/cdxgen-plugins-bin-linuxmusl-amd64": "4.0.0",
-    "@cdxgen/cdxgen-plugins-bin-linuxmusl-arm64": "4.0.0",
-    "@cdxgen/cdxgen-plugins-bin-windows-amd64": "4.0.0",
-    "@cdxgen/cdxgen-plugins-bin-windows-arm64": "4.0.0",
-    "@cdxgen/safer-exec": "0.16.0",
+    "@cdxgen/cdxgen-plugins-bin": "4.1.0",
+    "@cdxgen/cdxgen-plugins-bin-darwin-amd64": "4.1.0",
+    "@cdxgen/cdxgen-plugins-bin-darwin-arm64": "4.1.0",
+    "@cdxgen/cdxgen-plugins-bin-linux-amd64": "4.1.0",
+    "@cdxgen/cdxgen-plugins-bin-linux-arm": "4.1.0",
+    "@cdxgen/cdxgen-plugins-bin-linux-arm64": "4.1.0",
+    "@cdxgen/cdxgen-plugins-bin-linux-ppc64": "4.1.0",
+    "@cdxgen/cdxgen-plugins-bin-linuxmusl-amd64": "4.1.0",
+    "@cdxgen/cdxgen-plugins-bin-linuxmusl-arm64": "4.1.0",
+    "@cdxgen/cdxgen-plugins-bin-windows-amd64": "4.1.0",
+    "@cdxgen/cdxgen-plugins-bin-windows-arm64": "4.1.0",
+    "@cdxgen/safer-exec": "1.0.1",
     "body-parser": "2.3.0",
     "compression": "1.8.2",
     "connect": "3.7.0",

package/types/lib/cli/bomAssembly.d.ts

@@ -65,7 +65,8 @@ export declare const componentToSimpleFullName: (comp: object) => string;
 /**
  * Strips transient keys (`evidence`, `_integrity`, `license`, `qualifiers`,
  * `repository`, `homepage`) from a parent component while preserving licenses
- * and external references (bug #1519).
+ * and external references (bug #1519). External references whose URL is not a
+ * valid IRI reference are dropped.
  *
  * @param {object} comp Parent component to clean in place
  * @returns {object} The cleaned parent component

package/types/lib/cli/bomAssembly.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bomAssembly.d.ts","sourceRoot":"","sources":["../../../lib/cli/bomAssembly.js"],"names":[],"mappings":"AA8DA;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,aAJ7B,MAAM,qBACN,MAAM,EAAE,KACN,OAsBZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,EAFf,MAG8E,CAAC;AAEzF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,0CAH9B,MAAM;;;;;CAwChB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,YAJ1B,MAAM,KACJ,MAAM,GAAC,SAyBnB,CAAC;AAqFF;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,YALjB,MAAM,YACN,MAAM,KACJ;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CA+CrD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,SAH3B,MAAM,KACJ,MAQZ,CAAC;AAEF;;;;;;;GAOG;AAGH,eAAO,MAAM,oBAAoB,SALtB,MAAM,KACJ,MAwBZ,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,YAHnB,MAAM,KACJ,MAAM,EAgBlB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,YAHtB,MAAM,UAwBhB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,eAAe,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;;;qBAzJhD,MAAM,EAAE;gBAAU,MAAM,EAAE;;;;EA0gBrD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAH/B,QAAQ,MAGuB,SAyCzC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAN3B,MAM2B,EAAE,UAAU,EALvC,MAKuC,EAAE,GAAG,EAJ5C,MAI4C,EAAE,KAAK,GAHnD,MAG2D,GAFzD,MAAM,EAAE,CAcpB;AAED;;;;GAIG;AAEH,eAAO,MAAM,cAAc,EAHjB,MAAM,EAGqD,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAFxB,MAEyC,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAJjC,MAIiC,EAAE,YAAY,EAH/C,MAG+C,GAF7C,MAAM,EAAE,CASpB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAOpB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAHlC,MAGkC,GAFhC,GAAG,CAAC,MAAM,CAAC,CA6BvB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAJxC,MAIwC,EAAE,GAAG,EAH7C,MAG6C,GAF3C,OAAO,CAiBnB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,OAAO,KAAA,EACP,UAAU,KAAA,EACV,GAAG,KAAA,EACH,KAAK,KAAA,EACL,OAAO,KAAA,EACP,SAAS,UAAQ,QA6PlB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,KAAA,OA+EvC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,KAAA,EAAE,SAAS,KAAA,QA6B3C;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,KAAA,EAAE,MAAM,KAAA,EAAE,SAAS,KAAA,QAMtD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAJ7B,MAI6B,EAAE,MAAM,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CAoB5B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,YAPhB,MAAM,WACN,MAAM,SACN,MAAM,WACN,MAAM,KAEJ,MA+FZ,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAI5B;AAiDD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAHzC,MAGyC,GAFvC,MAAM,EAAE,CAMpB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAHxC,MAGwC,GAFtC,MAAM,EAAE,CAMpB;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,wBAAwB,EALf,MAAM,EAKS,EACxB,wBAAwB,EALf,MAAM,EAKS,GAJb,MAAM,EAAE,CASpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAHxC,MAGwC,GAFtC,MAAM,EAAE,CAyBpB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAHpC,MAGoC,GAFlC,MAAM,GAAC,SAAS,CAS5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,wBAAwB,EAHtD,MAAM,EAGgD,GAFpD,OAAO,CAInB;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EALvC,MAAM,EAKiC,EAAE,aAAa,EAJtD,MAIsD,EAAE,OAAO,EAH/D,GAAG,CAAC,MAAM,CAGqD,GAF7D,MAAM,EAAE,CAgBpB;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,QAAQ,EAH9C,MAAM,EAGwC,GAF5C,MAAM,EAAE,CAQpB;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EALvC,MAKuC,EAAE,KAAK,EAJ9C,MAI8C,EAAE,QAAQ,EAHxD,MAAM,EAGkD,GAFtD,MAAM,CAIlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAJvC,MAIuC,EAAE,aAAa,EAHtD,MAGsD,GAFpD,IAAI,CAyDhB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAPtB,MAOsB,EAAE,UAAU,OAAA,EAAE,eAAe,EALnD,MAKmD,EAAE,YAAY,OAAA,GAF/D,MAAM,CA8ClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,YAJjC,MAAM,mBACN,MAAM,KACJ,OAYZ,CAAC"}
+{"version":3,"file":"bomAssembly.d.ts","sourceRoot":"","sources":["../../../lib/cli/bomAssembly.js"],"names":[],"mappings":"AAgEA;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,aAJ7B,MAAM,qBACN,MAAM,EAAE,KACN,OAsBZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,EAFf,MAG8E,CAAC;AAEzF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,0CAH9B,MAAM;;;;;CAwChB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,YAJ1B,MAAM,KACJ,MAAM,GAAC,SAyBnB,CAAC;AA8GF;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,YALjB,MAAM,YACN,MAAM,KACJ;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CA+CrD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,SAH3B,MAAM,KACJ,MAQZ,CAAC;AAEF;;;;;;;;GAQG;AAGH,eAAO,MAAM,oBAAoB,SALtB,MAAM,KACJ,MA6BZ,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,YAHnB,MAAM,KACJ,MAAM,EAgBlB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,YAHtB,MAAM,UAwBhB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,eAAe,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;;;qBA/JhD,MAAM,EAAE;gBAAU,MAAM,EAAE;;;;EAshBrD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAH/B,QAAQ,MAGuB,SA0CzC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAN3B,MAM2B,EAAE,UAAU,EALvC,MAKuC,EAAE,GAAG,EAJ5C,MAI4C,EAAE,KAAK,GAHnD,MAG2D,GAFzD,MAAM,EAAE,CAcpB;AAED;;;;GAIG;AAEH,eAAO,MAAM,cAAc,EAHjB,MAAM,EAGqD,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAFxB,MAEyC,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAJjC,MAIiC,EAAE,YAAY,EAH/C,MAG+C,GAF7C,MAAM,EAAE,CASpB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAOpB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAHlC,MAGkC,GAFhC,GAAG,CAAC,MAAM,CAAC,CA6BvB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAJxC,MAIwC,EAAE,GAAG,EAH7C,MAG6C,GAF3C,OAAO,CAiBnB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,OAAO,KAAA,EACP,UAAU,KAAA,EACV,GAAG,KAAA,EACH,KAAK,KAAA,EACL,OAAO,KAAA,EACP,SAAS,UAAQ,QAqRlB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,KAAA,OAkGvC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,KAAA,EAAE,SAAS,KAAA,QA6B3C;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,KAAA,EAAE,MAAM,KAAA,EAAE,SAAS,KAAA,QAMtD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAJ7B,MAI6B,EAAE,MAAM,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CAoB5B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,YAPhB,MAAM,WACN,MAAM,SACN,MAAM,WACN,MAAM,KAEJ,MAsGZ,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAI5B;AAiDD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAHzC,MAGyC,GAFvC,MAAM,EAAE,CAMpB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAHxC,MAGwC,GAFtC,MAAM,EAAE,CAMpB;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,wBAAwB,EALf,MAAM,EAKS,EACxB,wBAAwB,EALf,MAAM,EAKS,GAJb,MAAM,EAAE,CASpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAHxC,MAGwC,GAFtC,MAAM,EAAE,CAyBpB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAHpC,MAGoC,GAFlC,MAAM,GAAC,SAAS,CAS5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,wBAAwB,EAHtD,MAAM,EAGgD,GAFpD,OAAO,CAInB;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EALvC,MAAM,EAKiC,EAAE,aAAa,EAJtD,MAIsD,EAAE,OAAO,EAH/D,GAAG,CAAC,MAAM,CAGqD,GAF7D,MAAM,EAAE,CAgBpB;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,QAAQ,EAH9C,MAAM,EAGwC,GAF5C,MAAM,EAAE,CAQpB;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EALvC,MAKuC,EAAE,KAAK,EAJ9C,MAI8C,EAAE,QAAQ,EAHxD,MAAM,EAGkD,GAFtD,MAAM,CAIlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAJvC,MAIuC,EAAE,aAAa,EAHtD,MAGsD,GAFpD,IAAI,CAyDhB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAPtB,MAOsB,EAAE,UAAU,OAAA,EAAE,eAAe,EALnD,MAKmD,EAAE,YAAY,OAAA,GAF/D,MAAM,CA8ClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,YAJjC,MAAM,mBACN,MAAM,KACJ,OAYZ,CAAC"}

package/types/lib/cli/cliOptions.d.ts

@@ -37,6 +37,33 @@ export declare function validateSpecVersion(specVersion: number, commandName?: s
  * @returns {boolean}  True when the user explicitly set this flag
  */
 export declare function isUserProvided(value: any, yaDefault: any): boolean;
+/**
+ * Combine the custom metadata properties of every source (discussion 4391):
+ * the `--metadata-property` flag, the CDXGEN_METADATA_PROPERTY and
+ * CDXGEN_METADATA_PROPERTIES environment variables, and a config file's
+ * `metadata-property` or `metadataProperties` entry.
+ *
+ * yargs would let the highest-precedence source replace the others outright,
+ * so each is read on its own and they are merged instead. A name set by more
+ * than one source takes its values from the one that wins in the usual order
+ * — the command line, then the environment, then the config file — while a
+ * source may repeat a name for a multi-valued property.
+ *
+ * @param {object} args Parsed yargs argv
+ * @param {object} [context]
+ * @param {string[]} [context.argv] Raw command-line arguments, which tell a
+ *   flag on the command line from one yargs filled in from elsewhere
+ * @param {object} [context.projectConfig] The sanitized config file contents.
+ *   Without it, a programmatic caller's `args` are taken as the config.
+ * @returns {{name: string, value: string}[]} The merged properties
+ */
+export declare function resolveMetadataProperties(args: object, { argv, projectConfig }?: {
+    argv?: string[];
+    projectConfig?: object;
+}): {
+    name: string;
+    value: string;
+}[];
 /**
  * Apply command-name-based defaults to the raw parsed args. When cdxgen is
  * invoked via a symlink or alias (e.g. `obom`, `cbom`, `spdxgen`, `aibom`),
@@ -50,10 +77,11 @@ export declare function isUserProvided(value: any, yaDefault: any): boolean;
  * @returns {object} A shallow copy of args with alias-based defaults applied
  */
 export declare function applyCommandNameDefaults(args: object, invokedCommandName: string): object;
-export declare function buildInitialOptions(args: any, { filePath, isRemoteOrPurl, argv }: {
+export declare function buildInitialOptions(args: any, { filePath, isRemoteOrPurl, argv, projectConfig }: {
     argv?: any;
     filePath: any;
     isRemoteOrPurl: any;
+    projectConfig: any;
 }): any;
 export type OptionsWarning = {
     /**
@@ -141,6 +169,9 @@ export declare function applyAdvancedOptions(options: object, context?: {
  *                                             passed `--spec-version`
  * @param {boolean} [context.isDryRun=false]   Dry-run mode
  * @param {boolean} [context.isSecureMode]     Secure mode
+ * @param {object} [context.projectConfig]     Sanitized config file contents,
+ *                                             whose metadata properties merge
+ *                                             with the other sources'
  * @returns {{ options: object, warnings: OptionsWarning[] }}
  */
 export declare function buildOptionsFromArgs(args: object, context: {
@@ -150,6 +181,7 @@ export declare function buildOptionsFromArgs(args: object, context: {
     userSetSpecVersion: boolean;
     isDryRun?: boolean;
     isSecureMode?: boolean;
+    projectConfig?: object;
 }): {
     options: object;
     warnings: OptionsWarning[];

package/types/lib/cli/cliOptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cliOptions.d.ts","sourceRoot":"","sources":["../../../lib/cli/cliOptions.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAoBH;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAJpC,MAIoC,EAAE,WAAW,AAHzD,CACA,EADQ,MAG4D,GAF1D,MAAM,GAAC,IAAI,CAoBvB;AA4CD;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAJzB,GAIyB,EAAE,SAAS,EAHpC,GAGoC,GAFlC,OAAO,CAInB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,kBAAkB,EAHtD,MAGsD,GAFpD,MAAM,CAoBlB;AAqED,wBAAgB,mBAAmB,CACjC,IAAI,KAAA,EACJ,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAmB,EAAE;;;;CAAA,OA8ClD;AAqBE,YAAkB,cAAc,GAChC;;;;IAAkC,KAAK,EAA5B,MAAM,GAAC,MAAM,GAAC,OAAO,CAChC;;;;IAAkC,OAAO,EAA9B,MAAM,CACnB;CAAA,CAAA;AAJD;;;;GAIG;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAR3C,MAQ2C,EAAE,OAAO,EAN5D;IAAwB,kBAAkB,EAAlC,MAAM,CACd;IAAyB,kBAAkB,EAAnC,OAAO,CAEf;IAA0B,QAAQ,AAAlC,CACA,EADQ,OAAO,CACf;CAE4D,GAFlD,cAAc,EAAE,CA6G5B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EALjC,MAKiC,EAAE,OAAO,AAJlD,CAEA,EADA;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;CAEuD,GAF7C,cAAc,EAAE,CAqI5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAX9B,MAW8B,EAAE,OAAO,EAT/C;IAAwB,kBAAkB,EAAlC,MAAM,CACd;IAAwB,QAAQ,EAAxB,MAAM,CACd;IAAyB,cAAc,EAA/B,OAAO,CACf;IAAyB,kBAAkB,EAAnC,OAAO,CAEf;IAA0B,QAAQ,AAAlC,CACA,EADQ,OAAO,CACf;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;CAE+C,GAFrC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;CAAE,CA6B3D"}
+{"version":3,"file":"cliOptions.d.ts","sourceRoot":"","sources":["../../../lib/cli/cliOptions.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAwBH;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAJpC,MAIoC,EAAE,WAAW,AAHzD,CACA,EADQ,MAG4D,GAF1D,MAAM,GAAC,IAAI,CAoBvB;AA4CD;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAJzB,GAIyB,EAAE,SAAS,EAHpC,GAGoC,GAFlC,OAAO,CAInB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EATK,MASL,EACJ,EAAE,IAAmB,EAAE,aAAa,EAAE,AATrC,CAKA,EAJA;IAA2B,IAAI,AAA/B,CAEA,EAFQ,MAAM,EAAE,CAEhB;IAAyB,aAAa,AAAtC,CAEA,EAFQ,MAAM,CAEd;CAI0C,GAJhC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAsD3C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,kBAAkB,EAHtD,MAGsD,GAFpD,MAAM,CAoBlB;AAuED,wBAAgB,mBAAmB,CACjC,IAAI,KAAA,EACJ,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAmB,EAAE,aAAa,EAAE;;;;;CAAA,OAqDjE;AAqBE,YAAkB,cAAc,GAChC;;;;IAAkC,KAAK,EAA5B,MAAM,GAAC,MAAM,GAAC,OAAO,CAChC;;;;IAAkC,OAAO,EAA9B,MAAM,CACnB;CAAA,CAAA;AAJD;;;;GAIG;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAR3C,MAQ2C,EAAE,OAAO,EAN5D;IAAwB,kBAAkB,EAAlC,MAAM,CACd;IAAyB,kBAAkB,EAAnC,OAAO,CAEf;IAA0B,QAAQ,AAAlC,CACA,EADQ,OAAO,CACf;CAE4D,GAFlD,cAAc,EAAE,CA6G5B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EALjC,MAKiC,EAAE,OAAO,AAJlD,CAEA,EADA;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;CAEuD,GAF7C,cAAc,EAAE,CAqI5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAd9B,MAc8B,EAAE,OAAO,EAZ/C;IAAwB,kBAAkB,EAAlC,MAAM,CACd;IAAwB,QAAQ,EAAxB,MAAM,CACd;IAAyB,cAAc,EAA/B,OAAO,CACf;IAAyB,kBAAkB,EAAnC,OAAO,CAEf;IAA0B,QAAQ,AAAlC,CACA,EADQ,OAAO,CACf;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;IAAyB,aAAa,AAAtC,CAGA,EAHQ,MAAM,CAGd;CAE+C,GAFrC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;CAAE,CA+B3D"}

package/types/lib/cli/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/cli/index.js"],"names":[],"mappings":"AAyEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAuCnE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,aAAa,EACb,wBAAwB,EACxB,eAAe,EACf,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA0C1D,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,eAAe,EACf,UAAU,EACV,aAAa,EACb,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,YAAY,EACZ,eAAe,EACf,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,aAAa,EACb,cAAc,EACd,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AA8BxB;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,OAAO,CAAC,MAAM,CAAC,CAwE3B;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,OAAO,EAHnD,MAGmD,GAFjD,OAAO,CAAC,MAAM,CAAC,CAkU3B;AAgCD;;;;;;GAMG;AACH;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAGF,GAF1B,MAAM,CAUlB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAAM,EAG4B,GAFhC,MAAM,CAalB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EALnC,MAAM,GAAC,MAAM,EAKsB,EAAE,OAAO,EAJ5C,MAI4C,GAH1C,OAAO,CAAC,MAAM,CAAC,CAqmC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CAoD3B;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA0gBrC;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,CAAC,CAsB3B;AAED;;;;;;GAMG;AACH;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,OAAO,CAAC,MAAM,CAAC,CAa3B;AA0XD;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,IAAI,EALzB,MAKyB,EAAE,WAAW,EAJtC,MAIsC,GAHrC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CA+FjD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/cli/index.js"],"names":[],"mappings":"AAyEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAwCnE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,aAAa,EACb,wBAAwB,EACxB,eAAe,EACf,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA0C1D,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,eAAe,EACf,UAAU,EACV,aAAa,EACb,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,YAAY,EACZ,eAAe,EACf,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,aAAa,EACb,cAAc,EACd,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AA8BxB;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,OAAO,CAAC,MAAM,CAAC,CAwE3B;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,OAAO,EAHnD,MAGmD,GAFjD,OAAO,CAAC,MAAM,CAAC,CAkU3B;AAgCD;;;;;;GAMG;AACH;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAGF,GAF1B,MAAM,CAUlB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAAM,EAG4B,GAFhC,MAAM,CAalB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EALnC,MAAM,GAAC,MAAM,EAKsB,EAAE,OAAO,EAJ5C,MAI4C,GAH1C,OAAO,CAAC,MAAM,CAAC,CAqmC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CAoF3B;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA0gBrC;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,CAAC,CAsB3B;AAED;;;;;;GAMG;AACH;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,OAAO,CAAC,MAAM,CAAC,CAa3B;AAgYD;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,IAAI,EALzB,MAKyB,EAAE,WAAW,EAJtC,MAIsC,GAHrC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CA+FjD"}

package/types/lib/cli/jsBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jsBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jsBom.js"],"names":[],"mappings":"AAqGA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAwB5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAy1C3B;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAE4C,CAAC;AAEvD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,YAJ9B,KAAK,CAAC,MAAM,CAAC,cACb,MAAM,KACJ,KAAK,CAAC,MAAM,CAwExB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CA6C3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CA+F3B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EANhC,MAMgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CA6B3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAoN3B;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CAoD3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CA2ChE;AAED;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CACjD,aAAa,EANJ,MAMI,EACb,OAAO,EANE,MAMF,EACP,OAAO,EANE,MAAM,EAMR,EACP,YAAY,EANH,MAAM,EAMH,iBAsBb"}
+{"version":3,"file":"jsBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jsBom.js"],"names":[],"mappings":"AAyGA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAwB5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAw2C3B;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAE4C,CAAC;AAEvD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,YAJ9B,KAAK,CAAC,MAAM,CAAC,cACb,MAAM,KACJ,KAAK,CAAC,MAAM,CAwExB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAmD3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CA+F3B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EANhC,MAMgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CA6B3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAoN3B;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CAoD3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CA2ChE;AAED;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CACjD,aAAa,EANJ,MAMI,EACb,OAAO,EANE,MAMF,EACP,OAAO,EANE,MAAM,EAMR,EACP,YAAY,EANH,MAAM,EAMH,iBAsBb"}

package/types/lib/cli/jvmBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jvmBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jvmBom.js"],"names":[],"mappings":"AAiGA;;;;;GAKG;AACH,eAAO,IAAI,gBAAgB,EAFjB,MAIsD,CAAC;AAUjE;;;;GAIG;AAEH,eAAO,MAAM,kBAAkB,EAHrB,MAQT,CAAC;AAEF;;;;;GAKG;AAEH,eAAO,MAAM,aAAa,EAHhB,MAIqE,CAAC;AAEhF;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAL5B,MAK4B,EAAE,OAAO,EAJrC,MAIqC,GAFnC,MAAM,CA8ElB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EALxC,MAKwC,EAAE,MAAM,EAJhD,MAIgD,EAAE,GAAG,EAHrD,MAGqD,GAFnD,MAAM,EAAE,CA8DpB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAwtD3B"}
+{"version":3,"file":"jvmBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jvmBom.js"],"names":[],"mappings":"AAiGA;;;;;GAKG;AACH,eAAO,IAAI,gBAAgB,EAFjB,MAIsD,CAAC;AAUjE;;;;GAIG;AAEH,eAAO,MAAM,kBAAkB,EAHrB,MAQT,CAAC;AAEF;;;;;GAKG;AAEH,eAAO,MAAM,aAAa,EAHhB,MAIqE,CAAC;AAEhF;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAL5B,MAK4B,EAAE,OAAO,EAJrC,MAIqC,GAFnC,MAAM,CA8ElB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EALxC,MAKwC,EAAE,MAAM,EAJhD,MAIgD,EAAE,GAAG,EAHrD,MAGqD,GAFnD,MAAM,EAAE,CAgEpB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAwvD3B"}

package/types/lib/cli/managedBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"managedBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/managedBom.js"],"names":[],"mappings":"AA4HA;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,QAJ5B,MAAM,YACN,MAAM,KACJ,OAMZ,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAJ1B,MAAM,YACN,MAAM,KACJ,OAeZ,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,QAAA,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,GAAG,IAAI,CAsEzB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CA2pB3B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CAyBlB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CA2C3B;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CA0BlB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CA+LlB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAkS3B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAsfrC;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAJpC,MAIoC,EAAE,OAAO,EAH7C,MAG6C,GAF3C,OAAO,CAAC,MAAM,CAAC,CAmF3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAJpB,MAIoB,EAAE,OAAO,EAH7B,MAG6B,GAF3B,MAAM,CA2DlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CAmClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,MAAM,CAyBlB"}
+{"version":3,"file":"managedBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/managedBom.js"],"names":[],"mappings":"AA+HA;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,QAJ5B,MAAM,YACN,MAAM,KACJ,OAMZ,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAJ1B,MAAM,YACN,MAAM,KACJ,OAeZ,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,QAAA,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,GAAG,IAAI,CAsEzB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAoqB3B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CAyBlB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CA2C3B;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CA0BlB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CA+LlB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAuU3B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA4gBrC;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAJpC,MAIoC,EAAE,OAAO,EAH7C,MAG6C,GAF3C,OAAO,CAAC,MAAM,CAAC,CAmF3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAJpB,MAIoB,EAAE,OAAO,EAH7B,MAG6B,GAF3B,MAAM,CA2DlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CAmClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,MAAM,CAyBlB"}

package/types/lib/cli/nativeBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nativeBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/nativeBom.js"],"names":[],"mappings":"AA4KA;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,GAAC,SAAS,CAU5B;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAkdvC;AA2PD,wBAAsB,aAAa,CAAC,IAAI,KAAA,EAAE,OAAO,KAAA,+BAyLhD;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,GAAC,SAAS,CAiC5B;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,SAAS,EAJ9C,MAI8C,EAAE,SAAS,AAHjE,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA8BrC;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAJnC,MAImC,EAAE,OAAO,EAH5C,MAG4C,GAF1C,OAAO,CAAC,MAAM,CAAC,CAwB3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CA0E3B;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CAkZlB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CAmJlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,MAAM,EAAE,CA0BpB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CAiElB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CAiClB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwJ3B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuLvC;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CAkI3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA4D3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwD3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAsE3B;AAqBD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAyB3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA4B3B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CAoE3B;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CAuC3B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA0C3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA2D3B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwD3B"}
+{"version":3,"file":"nativeBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/nativeBom.js"],"names":[],"mappings":"AAgLA;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,GAAC,SAAS,CAU5B;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuevC;AA2PD,wBAAsB,aAAa,CAAC,IAAI,KAAA,EAAE,OAAO,KAAA,+BAyLhD;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,GAAC,SAAS,CAiC5B;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,SAAS,EAJ9C,MAI8C,EAAE,SAAS,AAHjE,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA8BrC;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAJnC,MAImC,EAAE,OAAO,EAH5C,MAG4C,GAF1C,OAAO,CAAC,MAAM,CAAC,CAwB3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CA0E3B;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CAialB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CAmJlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,MAAM,EAAE,CA0BpB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CAiElB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CAiClB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA+N3B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuLvC;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CAkI3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA4D3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwD3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAsE3B;AAqBD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAyB3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA4B3B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CAoE3B;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CAuC3B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA0C3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA2D3B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwD3B"}

package/types/lib/core/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../lib/core/env.js"],"names":[],"mappings":"AAUA,uCAAuC;AACvC,eAAO,MAAM,MAAM,SAAmD,CAAC;AACvE,mCAAmC;AACnC,eAAO,MAAM,KAAK,SAAwC,CAAC;AAC3D,oCAAoC;AACpC,eAAO,MAAM,MAAM,SAA+C,CAAC;AAEnE,yFAAyF;AACzF,eAAO,MAAM,sBAAsB,oBAElC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAIrB,CAAC;AAEX,sJAAsJ;AACtJ,eAAO,MAAM,qBAAqB,SAI/B,CAAC;AAEJ,sIAAsI;AACtI,eAAO,MAAM,sBAAsB,SAElC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAH9B,MAG8B,GAF5B,MAAM,EAAE,CAiDpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAFrB,OAAO,CAOnB;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAF7B,OAAO,CAUnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAFjB,OAAO,CAOnB;AAED,mGAAmG;AACnG,eAAO,MAAM,aAAa,SAAuB,CAAC;AAElD,oJAAoJ;AACpJ,eAAO,MAAM,gBAAgB,SAEwC,CAAC;AAEtE,yFAAyF;AACzF,eAAO,MAAM,QAAQ,QAAmB,CAAC;AAEzC;;;;;GAKG;AACH,wBAAgB,cAAc,IAFjB,MAAM,CAclB;AAED,6FAA6F;AAC7F,eAAO,MAAM,UAAU,QAAqB,CAAC;AAsB7C;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,CAYlB;AAED,mEAAmE;AACnE,eAAO,IAAI,UAAU,QAAW,CAAC;AAIjC,yEAAyE;AACzE,eAAO,IAAI,QAAQ,QAAS,CAAC;AAI7B,mEAAmE;AACnE,eAAO,IAAI,OAAO,QAAQ,CAAC;AAI3B,sEAAsE;AACtE,eAAO,IAAI,QAAQ,QAAS,CAAC;AAI7B,mEAAmE;AACnE,eAAO,IAAI,OAAO,QAAQ,CAAC;AAI3B,yEAAyE;AACzE,eAAO,IAAI,SAAS,QAAU,CAAC;AAI/B,gEAAgE;AAChE,eAAO,IAAI,MAAM,QAAO,CAAC;AAIzB,yEAAyE;AACzE,eAAO,IAAI,SAAS,QAAU,CAAC;AAK/B;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,oBAGd,CAAC;AAEZ,2EAA2E;AAC3E,eAAO,IAAI,OAAO,QAAQ,CAAC;AAK3B,2EAA2E;AAC3E,eAAO,IAAI,QAAQ,QAAS,CAAC;AAK7B,mFAAmF;AACnF,eAAO,IAAI,eAAe,QAAS,CAAC;AAKpC,yEAAyE;AACzE,eAAO,MAAM,SAAS,QAAkD,CAAC;AAEzE,sEAAsE;AACtE,eAAO,MAAM,QAAQ,QAAgD,CAAC;AAEtE,6EAA6E;AAC7E,eAAO,MAAM,0BAA0B,UAWtC,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB;IAC/B,IAAI;IAyBJ,OAAO;IACP,GAAG;IACH,cAAc;IACd,WAAW;IACX,aAAa;IACb,aAAa;IACb,EAAE;IAyCF,GAAG;IACH,UAAU;IACV,OAAO;IACP,EAAE;IAyBF,EAAE;IACF,IAAI;IACJ,GAAG;IACH,IAAI;IACJ,MAAM;IA8BN,IAAI;IACJ,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,CAAC;IACD,KAAK;IACL,GAAG;IACH,OAAO;IACP,GAAG;IACH,GAAG;IACH,IAAI;IACJ,KAAK;IACL,SAAS;IACT,CAAC;IACD,OAAO;IACP,MAAM;IACN,IAAI;IACJ,EAAE;IACF,OAAO;IACP,IAAI;IACJ,YAAY;IACZ,SAAS;IAcT,UAAU;IACV,KAAK;IAUL,MAAM;IACN,GAAG;IACH,KAAK;IACL,KAAK;IACL,GAAG;IACH,GAAG;IACH,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,kBAAkB;IASlB,kBAAkB;IAMlB,OAAO;IACP,eAAe;CAChB,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB;IAClC,KAAK;CACN,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,EAF/B,MAAM,EAQf,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAH9C,MAG8C,GAF5C,OAAO,CAUnB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EALhC,MAKgC,EAAE,OAAO,QAAA,WAiBnD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,OAAA,EAAE,OAAO,EAH5C,MAG4C,EAAE,aAAa,UAAO,OA4G5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAJxC,MAIwC,EAAE,WAAW,AAH7D,CACA,EADQ,MAGqD,GAFnD,OAAO,CAiCnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,QAAA,EAAE,mBAAmB,OAAA,EAAE,OAAO,EAJ/D,MAI+D,WAezE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,KAAA,OA8CvC"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../lib/core/env.js"],"names":[],"mappings":"AAUA,uCAAuC;AACvC,eAAO,MAAM,MAAM,SAAmD,CAAC;AACvE,mCAAmC;AACnC,eAAO,MAAM,KAAK,SAAwC,CAAC;AAC3D,oCAAoC;AACpC,eAAO,MAAM,MAAM,SAA+C,CAAC;AAEnE,yFAAyF;AACzF,eAAO,MAAM,sBAAsB,oBAElC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAIrB,CAAC;AAEX,sJAAsJ;AACtJ,eAAO,MAAM,qBAAqB,SAI/B,CAAC;AAEJ,sIAAsI;AACtI,eAAO,MAAM,sBAAsB,SAElC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAH9B,MAG8B,GAF5B,MAAM,EAAE,CAiDpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAFrB,OAAO,CAOnB;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAF7B,OAAO,CAUnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAFjB,OAAO,CAOnB;AAED,mGAAmG;AACnG,eAAO,MAAM,aAAa,SAAuB,CAAC;AAElD,oJAAoJ;AACpJ,eAAO,MAAM,gBAAgB,SAEwC,CAAC;AAEtE,yFAAyF;AACzF,eAAO,MAAM,QAAQ,QAAmB,CAAC;AAEzC;;;;;GAKG;AACH,wBAAgB,cAAc,IAFjB,MAAM,CAclB;AAED,6FAA6F;AAC7F,eAAO,MAAM,UAAU,QAAqB,CAAC;AAsB7C;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,CAYlB;AAED,mEAAmE;AACnE,eAAO,IAAI,UAAU,QAAW,CAAC;AAIjC,yEAAyE;AACzE,eAAO,IAAI,QAAQ,QAAS,CAAC;AAI7B,mEAAmE;AACnE,eAAO,IAAI,OAAO,QAAQ,CAAC;AAI3B,sEAAsE;AACtE,eAAO,IAAI,QAAQ,QAAS,CAAC;AAI7B,mEAAmE;AACnE,eAAO,IAAI,OAAO,QAAQ,CAAC;AAI3B,yEAAyE;AACzE,eAAO,IAAI,SAAS,QAAU,CAAC;AAI/B,gEAAgE;AAChE,eAAO,IAAI,MAAM,QAAO,CAAC;AAIzB,yEAAyE;AACzE,eAAO,IAAI,SAAS,QAAU,CAAC;AAK/B;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,oBAGd,CAAC;AAEZ,2EAA2E;AAC3E,eAAO,IAAI,OAAO,QAAQ,CAAC;AAK3B,2EAA2E;AAC3E,eAAO,IAAI,QAAQ,QAAS,CAAC;AAK7B,mFAAmF;AACnF,eAAO,IAAI,eAAe,QAAS,CAAC;AAKpC,yEAAyE;AACzE,eAAO,MAAM,SAAS,QAAkD,CAAC;AAEzE,sEAAsE;AACtE,eAAO,MAAM,QAAQ,QAAgD,CAAC;AAEtE,6EAA6E;AAC7E,eAAO,MAAM,0BAA0B,UAWtC,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB;IAC/B,IAAI;IAyBJ,OAAO;IACP,GAAG;IACH,cAAc;IACd,WAAW;IACX,aAAa;IACb,aAAa;IACb,EAAE;IAyCF,GAAG;IACH,UAAU;IACV,OAAO;IACP,EAAE;IAyBF,EAAE;IACF,IAAI;IACJ,GAAG;IACH,IAAI;IACJ,MAAM;IA8BN,IAAI;IACJ,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,CAAC;IACD,KAAK;IACL,GAAG;IACH,OAAO;IACP,GAAG;IACH,GAAG;IACH,IAAI;IACJ,KAAK;IACL,SAAS;IACT,CAAC;IACD,OAAO;IACP,MAAM;IACN,IAAI;IACJ,EAAE;IACF,OAAO;IACP,IAAI;IACJ,YAAY;IACZ,SAAS;IAcT,UAAU;IACV,KAAK;IAUL,MAAM;IACN,GAAG;IACH,KAAK;IACL,KAAK;IACL,GAAG;IACH,GAAG;IACH,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,kBAAkB;IASlB,kBAAkB;IAMlB,OAAO;IACP,eAAe;CAChB,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB;IAClC,KAAK;CACN,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,EAF/B,MAAM,EAQf,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAH9C,MAG8C,GAF5C,OAAO,CAUnB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EALhC,MAKgC,EAAE,OAAO,QAAA,WAiBnD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,OAAA,EAAE,OAAO,EAH5C,MAG4C,EAAE,aAAa,UAAO,OA2G5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAJxC,MAIwC,EAAE,WAAW,AAH7D,CACA,EADQ,MAGqD,GAFnD,OAAO,CAiCnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,QAAA,EAAE,mBAAmB,OAAA,EAAE,OAAO,EAJ/D,MAI+D,WAezE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,KAAA,OA8CvC"}

package/types/lib/core/fs.d.ts

@@ -25,6 +25,18 @@ export declare function safeIsExecutableSync(filePath: string): boolean;
  * @returns {void}
  */
 export declare function safeWriteSync(filePath: string, data: string | Buffer, options?: Object): void;
+/**
+ * Permission- and dry-run-aware write of a sequence of chunks, for content too
+ * large to join into one string first. The chunks go to a temporary file next
+ * to the target, which is renamed into place once complete, so a chunk may be
+ * read from the file being replaced and a failed write leaves the target as it
+ * was.
+ *
+ * @param {string} filePath File path to write.
+ * @param {Iterable<string|Buffer>} chunks Chunks written in order.
+ * @returns {void}
+ */
+export declare function safeWriteChunksSync(filePath: string, chunks: Iterable<string | Buffer>): void;
 /**
  * Permission-aware wrapper around readFileSync that returns undefined instead
  * of throwing. Reads are allowed in dry-run mode, so unlike the write wrappers
@@ -97,6 +109,49 @@ export declare function safeExtractArchive(sourcePath: string, targetPath: strin
 export declare const temporaryFiles: Set<any>;
 /** Set accumulating every executable command spawned via safeSpawnSync. */
 export declare const commandsExecuted: Set<any>;
+/**
+ * Quote one argument of a shell command line that is built as a single
+ * string. The shell flag exists so cmd.exe can resolve bare command names,
+ * `.cmd` shims and scripts, and every argument is data (paths, flags) that
+ * must arrive as one token whatever it contains: joined unquoted, an
+ * argument with spaces splits into several and hands the tool the wrong
+ * tokens.
+ *
+ * Windows follows the quoting rules cmd.exe and the MSVC runtimes share:
+ * wrap in double quotes, doubling the backslashes that precede a quote and
+ * escaping the quote itself. Inside double quotes cmd.exe already treats
+ * `&`, `|`, `<`, `>`, `^` and parentheses as literals, and the
+ * shell-metacharacter block above refuses `%` and the rest before this
+ * runs. A POSIX shell gets single quotes, which no expansion can leave.
+ *
+ * The same quoting is applied to the command itself when it names an
+ * existing file under a path with spaces; a command the shell must parse
+ * (a bare name, `sh -c`) never names a file as a whole and stays verbatim.
+ *
+ * @param {string} arg Argument to quote
+ * @param {boolean} [forWindows] Quote for cmd.exe rather than a POSIX shell; defaults to the current platform
+ * @returns {string} The argument, quoted when the shell needs it
+ */
+export declare function shellQuoteArgument(arg: string, forWindows?: boolean): string;
+/**
+ * Build the single command string a shell spawn runs. Every argument is
+ * quoted for the platform shell, so an argument containing spaces stays one
+ * token and cannot alter the command, and a command that is itself a file
+ * under a path with spaces (`C:\Program Files\...\node.exe`) is quoted too;
+ * a command the shell must parse (`sh -c`, a bare name) never names an
+ * existing file as a whole and is left verbatim.
+ *
+ * The one exception is a caller that composes shell fragments itself (sbt
+ * command lines embed their own quoting for the shell to strip): it passes
+ * `rawShellArgs` and keeps the verbatim join, under the shell-metacharacter
+ * block in safeSpawnSync like every other argument.
+ *
+ * @param {string} command The executable
+ * @param {string[]|undefined} args Arguments, when the caller passed any
+ * @param {boolean} [rawShellArgs] Join the arguments verbatim instead of quoting them
+ * @returns {string} The command line the shell will run
+ */
+export declare function joinShellCommand(command: string, args: string[] | undefined, rawShellArgs?: boolean): string;
 /**
  * Safe wrapper around spawnSync that enforces permission checks, injects default
  * options (maxBuffer, encoding, timeout), warns about unsafe Python and pip/uv

package/types/lib/core/fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../lib/core/fs.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAyErC;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,QAAA,OAmCtC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAHlC,MAGkC,GAFhC,OAAO,CAYnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAL3B,MAK2B,EAAE,IAAI,EAJjC,MAAM,GAAC,MAI0B,EAAE,OAAO,AAHlD,CACA,EADQ,MAG0C,GAFxC,IAAI,CA0BhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAJ9B,MAI8B,EAAE,OAAO,AAH/C,CACA,EADQ,MAAM,GAAC,MAG0C,GAF/C,MAAM,GAAC,MAAM,GAAC,SAAS,CA0BnC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,QAAA,EAAE,OAAO,EAH5B,OAG4B,aAwB9C;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAAM,GAAC,MAGyC,GAF9C,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAJxB,MAIwB,EAAE,OAAO,AAHzC,CACA,EADQ,MAG6C,GAF3C,IAAI,CAchB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,IAAI,CAchB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,IAAI,EAJ/B,MAI+B,EAAE,IAAI,AAH7C,CACA,EADQ,MAGiD,GAF/C,IAAI,CAkBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EARD,MAQC,EACV,UAAU,EARD,MAQC,EACV,SAAS,EARA,kBAQA,EACT,IAAI,AARH,CACA,EADQ,MAQK,EACd,OAAO,AARN,CACA,EADQ,MAQU,GAPR,OAAO,CAAC,OAAO,CAAC,CAwD5B;AAED,sFAAsF;AACtF,eAAO,MAAM,cAAc,UAAY,CAAC;AASxC,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,UAAY,CAAC;AAuK1C;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAL1B,MAK0B,EAAE,IAAI,EAJhC,MAAM,EAI0B,EAAE,OAAO,EAHzC,MAGyC,GAFvC,MAAM,CA8OlB;AAED,6FAA6F;AAC7F,eAAO,MAAM,UAAU,QAEP,CAAC;AAEjB,4GAA4G;AAC5G,eAAO,MAAM,UAAU,QAEJ,CAAC;AAEpB;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,OAAO,EANxB,MAMwB,EAAE,OAAO,EALjC,MAKiC,EAAE,OAAO,GAJ1C,MAI+C,OAuCzD;AA0BD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAFhC,MAAM,GAAC,SAEyB,QAK1C;AA4BD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,SAGtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EARE,MAQF,EACP,OAAO,EARE,MAQF,EACP,UAAU,SAAA,EACV,UAAU,OAAA,OAmDX;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAFf,MAAM,CAIlB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,IAFZ,MAAM,CAYlB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAJ1B,MAI0B,EAAE,IAAI,EAHhC,MAGgC,GAF9B,OAAO,QAAQ,CAU3B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,KAAA,EAAE,IAAI,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA8B3B"}
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../lib/core/fs.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA8ErC;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,QAAA,OAmCtC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAHlC,MAGkC,GAFhC,OAAO,CAYnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAL3B,MAK2B,EAAE,IAAI,EAJjC,MAAM,GAAC,MAI0B,EAAE,OAAO,AAHlD,CACA,EADQ,MAG0C,GAFxC,IAAI,CAQhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAIiC,EAAE,MAAM,EAHzC,QAAQ,CAAC,MAAM,GAAC,MAAM,CAGmB,GAFvC,IAAI,CA4BhB;AA2BD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAJ9B,MAI8B,EAAE,OAAO,AAH/C,CACA,EADQ,MAAM,GAAC,MAG0C,GAF/C,MAAM,GAAC,MAAM,GAAC,SAAS,CA0BnC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,QAAA,EAAE,OAAO,EAH5B,OAG4B,aAwB9C;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAAM,GAAC,MAGyC,GAF9C,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAJxB,MAIwB,EAAE,OAAO,AAHzC,CACA,EADQ,MAG6C,GAF3C,IAAI,CAchB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,IAAI,CAchB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,IAAI,EAJ/B,MAI+B,EAAE,IAAI,AAH7C,CACA,EADQ,MAGiD,GAF/C,IAAI,CAkBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EARD,MAQC,EACV,UAAU,EARD,MAQC,EACV,SAAS,EARA,kBAQA,EACT,IAAI,AARH,CACA,EADQ,MAQK,EACd,OAAO,AARN,CACA,EADQ,MAQU,GAPR,OAAO,CAAC,OAAO,CAAC,CAwD5B;AAED,sFAAsF;AACtF,eAAO,MAAM,cAAc,UAAY,CAAC;AASxC,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,UAAY,CAAC;AA+D1C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,UAAU,AAH/C,CACA,EADQ,OAG+C,GAF7C,MAAM,CAuClB;AAkBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAL7B,MAK6B,EAAE,IAAI,EAJnC,MAAM,EAAE,GAAC,SAI0B,EAAE,YAAY,AAHzD,CACA,EADQ,OAGyD,GAFvD,MAAM,CAclB;AA0GD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAL1B,MAK0B,EAAE,IAAI,EAJhC,MAAM,EAI0B,EAAE,OAAO,EAHzC,MAGyC,GAFvC,MAAM,CAqPlB;AAED,6FAA6F;AAC7F,eAAO,MAAM,UAAU,QAEP,CAAC;AAEjB,4GAA4G;AAC5G,eAAO,MAAM,UAAU,QAEJ,CAAC;AAEpB;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,OAAO,EANxB,MAMwB,EAAE,OAAO,EALjC,MAKiC,EAAE,OAAO,GAJ1C,MAI+C,OAuCzD;AA0BD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAFhC,MAAM,GAAC,SAEyB,QAK1C;AA4BD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,SAGtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EARE,MAQF,EACP,OAAO,EARE,MAQF,EACP,UAAU,SAAA,EACV,UAAU,OAAA,OAmDX;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAFf,MAAM,CAIlB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,IAFZ,MAAM,CAYlB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAJ1B,MAI0B,EAAE,IAAI,EAHhC,MAGgC,GAF9B,OAAO,QAAQ,CAU3B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,KAAA,EAAE,IAAI,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA8B3B"}

package/types/lib/core/metadataProperties.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The spellings under which a config file may list custom metadata
+ * properties: those of the `--metadata-property` flag, and the plural that
+ * the CDXGEN_METADATA_PROPERTIES environment variable maps to.
+ */
+export declare const METADATA_PROPERTY_CONFIG_KEYS: string[];
+/**
+ * Report whether a property name belongs to a namespace cdxgen reserves for
+ * the facts it establishes itself, such as `cdx:bom:componentSrcFiles`.
+ *
+ * @param {string} name Property name
+ * @returns {boolean} true for a reserved name
+ */
+export declare function isReservedMetadataPropertyName(name: string): boolean;
+/**
+ * Normalize user-supplied metadata properties into `[{name, value}]`
+ * (discussion 4391).
+ *
+ * Accepted shapes:
+ * - a `name=value` string, or a JSON document holding any of the shapes below
+ *   — an environment variable
+ * - an array of `name=value` strings or `{name, value}` objects — the
+ *   `--metadata-property` flag and a JSON config file
+ * - a plain object mapping a name to a value, or to a list of values for a
+ *   property that repeats — a JSON document or a YAML config file
+ *
+ * Values must be strings, numbers, or booleans. An entry without a name, a
+ * `name=value` string without a separator, and an empty or structured value
+ * are dropped rather than guessed at: a property with a mangled name or an
+ * `[object Object]` value is worse than none.
+ *
+ * @param {unknown} input Properties in any accepted shape
+ * @returns {{name: string, value: string}[]} Normalized properties
+ */
+export declare function parseMetadataProperties(input: unknown): {
+    name: string;
+    value: string;
+}[];
+//# sourceMappingURL=metadataProperties.d.ts.map

package/types/lib/core/metadataProperties.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadataProperties.d.ts","sourceRoot":"","sources":["../../../lib/core/metadataProperties.js"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,UAKzC,CAAC;AAMF;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAHxC,MAGwC,GAFtC,OAAO,CAMnB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAHlC,OAGkC,GAFhC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAiD3C"}

package/types/lib/core/projectConfig.d.ts

@@ -9,15 +9,19 @@ export declare const PROJECT_CONFIG_FILENAMES: string[];
  * whenever that tree is. Path options are therefore confined to the config's
  * own directory - a scanned project may choose where in itself the BOM lands,
  * but not write outside it - and options that redirect data off the host or
- * widen what cdxgen executes are announced on the console.
+ * widen what cdxgen executes are announced on the console. A project may
+ * describe itself with custom metadata properties, but not in the namespaces
+ * cdxgen reserves for the facts it establishes, so a scanned tree cannot pass
+ * its own claims off as cdxgen's.
  *
  * @param {Object} config parsed config file contents
  * @param {string} configDir directory the config file was read from
- * @returns {{config: Object, rejected: string[], announced: string[]}} sanitized config and what it did
+ * @returns {{config: Object, rejected: string[], announced: string[], reservedProperties: string[]}} sanitized config and what it did
  */
 export declare function sanitizeProjectConfig(config: Object, configDir: string): {
     config: Object;
     rejected: string[];
     announced: string[];
+    reservedProperties: string[];
 };
 //# sourceMappingURL=projectConfig.d.ts.map

package/types/lib/core/projectConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"projectConfig.d.ts","sourceRoot":"","sources":["../../../lib/core/projectConfig.js"],"names":[],"mappings":"AAIA;;GAEG;AACH,eAAO,MAAM,wBAAwB,UAKpC,CAAC;AAsEF;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAJjC,MAIiC,EAAE,SAAS,EAH5C,MAG4C,GAF1C;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,CA4BrE"}
+{"version":3,"file":"projectConfig.d.ts","sourceRoot":"","sources":["../../../lib/core/projectConfig.js"],"names":[],"mappings":"AASA;;GAEG;AACH,eAAO,MAAM,wBAAwB,UAKpC,CAAC;AAsEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAJjC,MAIiC,EAAE,SAAS,EAH5C,MAG4C,GAF1C;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,EAAE,MAAM,EAAE,CAAA;CAAC,CA+CnG"}

package/types/lib/ecosystems/bunutils.d.ts

@@ -14,14 +14,21 @@ export declare function parseBunDescriptor(descriptor: string): {
     version: string;
 };
 /**
- * Parse a bun text lockfile (`bun.lock`, lockfileVersion 1).
+ * Parse a bun text lockfile (`bun.lock`, lockfileVersion 1-3; v1 was written
+ * by the Zig implementation in bun 1.2.x-1.3.x and v2/v3 by the Rust one in
+ * bun 1.4+ - the content shape is identical, only parse strictness changed).
  *
  * Bun's text lockfile is JSONC (JSON with trailing commas). It records the
  * workspace roots under `workspaces` and the fully resolved dependency tree
- * under `packages`, where each entry is an array of the form
- * `["name@version", "registry", { dependencies, optionalDependencies, bin,
- * os, cpu, ... }, "sha512-..."]`. Nested duplicate versions are keyed by their
- * dependency path (eg `"parent/child"`).
+ * under `packages`, where nested duplicate versions are keyed by their
+ * dependency path (eg `"parent/child"`). The entry layout after the leading
+ * `"name@version"` descriptor depends on the resolution type (see the
+ * Stringifier in bun's bun.lock.rs):
+ * - npm: `["name@version", tarballUrlOrEmpty, { dependencies, bin, os, ... }, "sha512-..."]`
+ * - git/github: `["name@git+repo", { ... }, ".bun-tag", "sha512-..."]`
+ * - tarball/folder/symlink: `["name@url", { ... }, "sha512-..."]`
+ * - workspace: `["name@workspace:path"]`
+ * so the elements are recognised by shape instead of fixed indices.
  *
  * The binary lockfile (`bun.lockb`) is intentionally not supported - callers
  * should ask users to regenerate it with `bun install --save-text-lockfile`.

package/types/lib/ecosystems/bunutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bunutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/bunutils.js"],"names":[],"mappings":"AAuBA;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EALlC,MAKkC,GAJhC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAwB1D;AAyBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,YAAY,CAAC,WAAW,EALnC,MAKmC,EAAE,OAAO,AAJpD,CACA,EADQ,MAIiD,GAH/C,OAAO,CAAC;IAAC,OAAO,QAAQ;IAAC,gBAAgB,QAAO;CAAC,CAAC,CAoT9D"}
+{"version":3,"file":"bunutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/bunutils.js"],"names":[],"mappings":"AAgCA;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EALlC,MAKkC,GAJhC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAwB1D;AA2ED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,YAAY,CAAC,WAAW,EALnC,MAKmC,EAAE,OAAO,AAJpD,CACA,EADQ,MAIiD,GAH/C,OAAO,CAAC;IAAC,OAAO,QAAQ;IAAC,gBAAgB,QAAO;CAAC,CAAC,CA0Z9D"}