@cdxgen/cdxgen 13.2.0 → 13.3.0

package/types/lib/ecosystems/rubyutils.d.ts

@@ -61,6 +61,39 @@ export declare function simplifyRubyVersion(version: string): string;
  * @returns {string} purl string
  */
 export declare function toGemPurl(name: string, version: string | undefined, platform: string | undefined): string;
+/**
+ * Read the Ruby string literal at the start of `text`: a double or single
+ * quoted string, or a `%q`/`%Q`/`%` percent literal. Escaped delimiters and
+ * backslashes are unescaped; every other escape sequence is kept as written.
+ * An interpolation such as `#{spec.name}` is kept verbatim, including any
+ * quotes inside it.
+ *
+ * @param {string} text Source starting with the literal
+ * @returns {{value: string, interpolated: boolean, complete: boolean, rest: string} | undefined}
+ *   The literal's value, whether it holds an interpolation, whether it was
+ *   closed within `text`, and the source after it. Undefined when `text` does
+ *   not start with a string literal.
+ */
+export declare function readRubyStringLiteral(text: string): {
+    value: string;
+    interpolated: boolean;
+    complete: boolean;
+    rest: string;
+} | undefined;
+/**
+ * Read a Ruby list of strings as written for `authors`, `email`, or `licenses`:
+ * an array of string literals, a `%w[]` word array, or a single string. Array
+ * elements that are not string literals, such as constants, are skipped.
+ *
+ * @param {string} text Source of the value
+ * @returns {{values: string[], complete: boolean} | undefined} The strings,
+ *   and whether the array was closed within `text`. Undefined when the value
+ *   is an expression that cannot be read statically.
+ */
+export declare function readRubyStringList(text: string): {
+    values: string[];
+    complete: boolean;
+} | undefined;
 /**
  * Parse a single line from the `CHECKSUMS` section of a Gemfile.lock. Bundler
  * 2.5 onwards writes `name (version[-platform]) algo=digest[,algo=digest]`,
@@ -159,15 +192,35 @@ export declare function toGemModuleNames(name: any): string[];
  */
 export declare function collectGemModuleNames(rubyCommand: string, bundleCommand: string, gemHome: string, gemName: string, filePath: string): Array<string>;
 /**
- * Method to parse Gemspec file contents
+ * Method to parse Gemspec file contents.
+ *
+ * A source gemspec is Ruby code. The values that can be read without running
+ * it are string literals, lists of them, heredocs, and a version constant
+ * defined in the version file the gemspec requires. Anything else is left
+ * unresolved instead of being guessed.
+ *
+ * Bundler evaluates the gemspec of a project that uses the Gemfile `gemspec`
+ * directive, and locks the gem under `PATH remote: .`. Such a locked version
+ * can be supplied through `options.lockedVersions` and is used when the
+ * gemspec computes its version in a way that cannot be read statically.
  *
  * @param {string} gemspecData Gemspec data
  * @param {string} gemspecFile File name for evidence.
+ * @param {Object} [options] Parse options
+ * @param {Object<string, string>} [options.lockedVersions] Locked versions of
+ *   the gems the project directory serves, by gem name
  */
-export declare function parseGemspecData(gemspecData: string, gemspecFile: string): Promise<any[]>;
+export declare function parseGemspecData(gemspecData: string, gemspecFile: string, options?: {
+    lockedVersions?: Record<string, string>;
+}): Promise<any[]>;
 /**
  * Method to parse Gemfile.lock
  *
+ * Besides the components and the dependency tree, the result lists as
+ * `projectGemRefs` the bom-refs of the gems served from the lockfile's own
+ * directory (`PATH` with `remote: .`), which is how Bundler records the gem a
+ * project builds when its Gemfile uses the `gemspec` directive.
+ *
  * @param {object} gemLockData Gemfile.lock data
  * @param {string} lockFile Lock file
  */
@@ -178,5 +231,93 @@ export declare function parseGemfileLockData(gemLockData: object, lockFile: stri
         dependsOn: any[];
     }[];
     rootList: any[];
+    projectGemRefs: any[];
 }>;
+/**
+ * Describe the gem a project builds in its parent component.
+ *
+ * A gem project sees its own gem more than once: in its gemspec, in the `PATH`
+ * entry the Gemfile `gemspec` directive adds to its lockfile, and possibly as
+ * an installed copy. Each of them describes the project itself, so all are
+ * folded into the parent (discussion 4388). The parent takes the gem's
+ * identity, its descriptive metadata, and its `cdx:gem:*` properties; the
+ * dependency edges of the sightings move to the parent; and the sightings
+ * leave the component list, so the gem is never a dependency of itself.
+ *
+ * An explicit `--project-version` names the version of the parent. Otherwise
+ * the version of the gemspec, which may have come from the lockfile, is used.
+ *
+ * @param {object} parentComponent Parent component, updated in place
+ * @param {object} projectGem Component parsed from the root gemspec
+ * @param {object[]} pkgList Components
+ * @param {object[]} dependencies Dependency edges
+ * @param {string[]} rootList bom-refs of the direct dependencies
+ * @param {string[]} projectGemRefs bom-refs of the gems the lockfiles serve from the project directory
+ * @param {object} options CLI options
+ * @returns {{pkgList: object[], dependencies: object[], rootList: string[]}}
+ *   The components, edges, and direct dependencies with the gem folded in
+ */
+export declare function describeProjectGem(parentComponent: object, projectGem: object, pkgList: object[], dependencies: object[], rootList: string[], projectGemRefs: string[], options?: object): {
+    pkgList: object[];
+    dependencies: object[];
+    rootList: string[];
+};
+/**
+ * Point each gem resolved from the public RubyGems registry at its `.gem`
+ * tarball with a `distribution` external reference (discussion 4406).
+ *
+ * The registry API supplies `gem_uri` when it is reachable, but an offline
+ * scan — a dry run, an air-gapped host, or one that only consulted Bundler's
+ * local caches — has no way to learn it. For the public registry the URL is
+ * deterministic, so it is derived from the recorded `cdx:gem:remote` and the
+ * release identity instead. Gems from any other remote are left alone: a
+ * private mirror's layout is its own business.
+ *
+ * @param {Array} pkgList Gem components, enriched in place
+ * @returns {Array} The package list
+ */
+export declare function addRubyGemsDistributionUrls(pkgList: any[]): any[];
+/**
+ * Intersect Gem::Requirement strings into one `vers` range with the RubyGems
+ * versioning scheme, as the CycloneDX `versionRange` requires. `>= 2.3` and
+ * `>= 3.3` intersect to `vers:gem/>=3.3`, and `~> 3.1` becomes
+ * `vers:gem/>=3.1|<4`, since vers has no pessimistic operator.
+ *
+ * @param {string[]} requirements Requirement strings, each possibly holding
+ *   several comma separated constraints
+ * @returns {string|null|undefined} The range, `null` when the requirements
+ *   exclude each other, or undefined when none of them could be read
+ */
+export declare function rubyRequirementToVers(requirements: string[]): string | null | undefined;
+/**
+ * Describe the Ruby runtime the gems require as one external `platform`
+ * component, and make the components that declare a `required_ruby_version`
+ * depend on it (discussion 4409).
+ *
+ * The component stands for the Ruby the bundle as a whole runs on, so its
+ * `versionRange` is the intersection of every requirement that could be read,
+ * in the `vers` syntax CycloneDX mandates for the field. Each component's own
+ * requirement stays in its `cdx:gem:rubyVersionSpecifiers` property. One
+ * runtime component per distinct requirement would describe the same
+ * interpreter many times over: a modest bundle spells `>= 2.x` a dozen ways.
+ *
+ * The type is `platform`, the CycloneDX type for a runtime environment that
+ * interprets software, and the one cdxgen gives the Ruby it finds in the
+ * build environment. The purl names no version, since a range is not one.
+ *
+ * `isExternal` and `versionRange` are CycloneDX 1.7 fields, and without them
+ * the component would claim the product bundles its interpreter, so the caller
+ * decides whether the BOM should carry it at all.
+ *
+ * @param {Array} pkgList Components
+ * @param {object} parentComponent The metadata.component, when the project is
+ *   itself a gem
+ * @param {Array} dependencies Dependency edges
+ * @returns {{pkgList: Array, dependencies: Array}} Components and edges with
+ *   the runtime component added
+ */
+export declare function addRubyRuntimeComponent(pkgList: any[], parentComponent: object, dependencies: any[]): {
+    pkgList: any[];
+    dependencies: any[];
+};
 //# sourceMappingURL=rubyutils.d.ts.map

package/types/lib/ecosystems/rubyutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rubyutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/rubyutils.js"],"names":[],"mappings":"AA2DA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAHzB,MAGyB,GAFvB,OAAO,CAOnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAHlC,MAAM,GAAG,SAGyB,GAFhC,MAAM,GAAG,SAAS,CAO9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAHrC,MAAM,GAAG,SAG4B,GAFnC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAAC,QAAQ,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CAAC,CAe3E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CAIlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,IAAI,EALnB,MAKmB,EAAE,OAAO,EAJ5B,MAAM,GAAG,SAImB,EAAE,QAAQ,EAHtC,MAAM,GAAG,SAG6B,GAFpC,MAAM,CAclB;AAsED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAAC,GAAG,SAAS,CAqBjE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,IAF1B,MAAM,CAWlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC,MAAM,CAiClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAHjC,MAGiC,GAF/B,MAAM,CAgClB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,OAAA,EAAE,OAAO,GAJ5D;IAAwB,OAAO,EAAvB,MAAM,CACd;IAAwB,oBAAoB,EAApC,MAAM,CACd;CAEiE,GAFvD,OAAO,OAAO,CA+I1B;AAwID;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,OAAA,kBAmIhD;AA8CD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,KAAA,YAsBpC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,QAAA,EACX,aAAa,QAAA,EACb,OAAO,QAAA,EACP,OAAO,QAAA,EACP,QAAQ,QAAA,GAPG,KAAK,CAAC,MAAM,CAAC,CA4IzB;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EAHvC,MAGuC,EAAE,WAAW,EAFpD,MAEoD,kBAwQ9D;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,EAH3C,MAG2C,EAAE,QAAQ,EAFrD,MAEqD;;;;;;;GAgV/D"}
+{"version":3,"file":"rubyutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/rubyutils.js"],"names":[],"mappings":"AAsEA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAHzB,MAGyB,GAFvB,OAAO,CAOnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAHlC,MAAM,GAAG,SAGyB,GAFhC,MAAM,GAAG,SAAS,CAO9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAHrC,MAAM,GAAG,SAG4B,GAFnC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAAC,QAAQ,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CAAC,CAe3E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CAIlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,IAAI,EALnB,MAKmB,EAAE,OAAO,EAJ5B,MAAM,GAAG,SAImB,EAAE,QAAQ,EAHtC,MAAM,GAAG,SAG6B,GAFpC,MAAM,CAclB;AA4FD;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAN/B,MAM+B,GAL7B;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAG,SAAS,CAqE/F;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAL5B,MAK4B,GAJ1B;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAC,GAAG,SAAS,CAsE7D;AAuPD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAAC,GAAG,SAAS,CAqBjE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,IAF1B,MAAM,CAWlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC,MAAM,CAiClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAHjC,MAGiC,GAF/B,MAAM,CAgClB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,OAAA,EAAE,OAAO,GAJ5D;IAAwB,OAAO,EAAvB,MAAM,CACd;IAAwB,oBAAoB,EAApC,MAAM,CACd;CAEiE,GAFvD,OAAO,OAAO,CAoJ1B;AAiJD;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,OAAA,kBAuIhD;AA8CD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,KAAA,YAsBpC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,QAAA,EACX,aAAa,QAAA,EACb,OAAO,QAAA,EACP,OAAO,QAAA,EACP,QAAQ,QAAA,GAPG,KAAK,CAAC,MAAM,CAAC,CA4IzB;AAuED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EANvC,MAMuC,EAAE,WAAW,EALpD,MAKoD,EAAE,OAAO,AAJrE,CAGF,EAFE;IAAyC,cAAc,AAAvD,CAEF,yBAAA;CAC4E,kBAqa5E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,EAH3C,MAG2C,EAAE,QAAQ,EAFrD,MAEqD;;;;;;;;GAoX/D;AAUD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,kBAAkB,CAChC,eAAe,EAXN,MAWM,EACf,UAAU,EAXD,MAWC,EACV,OAAO,EAXE,MAAM,EAWR,EACP,YAAY,EAXH,MAAM,EAWH,EACZ,QAAQ,EAXC,MAAM,EAWP,EACR,cAAc,EAXL,MAAM,EAWD,EACd,OAAO,GAXE,MAWG,GAVD;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAC,CAkH3E;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,OAAA,SAmClD;AA8GD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EALvC,MAAM,EAKiC,GAHrC,MAAM,GAAC,IAAI,GAAC,SAAS,CAoHjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,OAAA,EACP,eAAe,EARN,MAQM,EACf,YAAY,OAAA,GAND;IAAC,OAAO,QAAQ;IAAC,YAAY,QAAO;CAAC,CAmEjD"}

package/types/lib/ecosystems/rusi.d.ts

@@ -1,3 +1,16 @@
+/**
+ * Returns the backend rusi actually used. `options.backend` is only the
+ * requested backend: when the compiler backend cannot run (missing
+ * components, wrapper build failure), rusi still echoes "compiler" but falls
+ * back to the stable source analysis. Compiler evidence was collected only
+ * when rusi emits its compiler-source-evidence diagnostic; a backend-error
+ * alone is not conclusive because native interop scanning reports failures
+ * under that kind too.
+ *
+ * @param {Object} rusiReport Parsed rusi report
+ * @returns {string|undefined} Effective backend name
+ */
+export declare function effectiveRusiBackend(rusiReport?: Object): string | undefined;
 /**
  * Checks if the provided language is a Rust language alias.
  *

package/types/lib/ecosystems/rusi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rusi.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/rusi.js"],"names":[],"mappings":"AAqtBA;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAHhC,MAGgC,GAF9B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAH9B,MAG8B,GAF5B,MAAM,GAAC,SAAS,CAW5B;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EALxB,MAKwB,EAAE,UAAU,EAJpC,MAIoC,EAAE,OAAO,GAH7C,MAGkD,GAFhD,OAAO,CAuDnB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,GAHpC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CA2B5B;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,GAJnC,MAIwC,EAAE,UAAU,QAAK,GAFvD,MAAM,CA8DlB"}
+{"version":3,"file":"rusi.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/rusi.js"],"names":[],"mappings":"AAgWA;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,GAHpC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAW5B;AAsZD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAHhC,MAGgC,GAF9B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAH9B,MAG8B,GAF5B,MAAM,GAAC,SAAS,CAW5B;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EALxB,MAKwB,EAAE,UAAU,EAJpC,MAIoC,EAAE,OAAO,GAH7C,MAGkD,GAFhD,OAAO,CAuDnB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,GAHpC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CA2B5B;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,GAJnC,MAIwC,EAAE,UAAU,QAAK,GAFvD,MAAM,CA8DlB"}

package/types/lib/evinser/evinser.d.ts

@@ -1,3 +1,30 @@
+/**
+ * Merges one analyzer run's metadata properties into the BOM's metadata
+ * component. Analyzer metadata describes a single run, so when the input BOM
+ * already carries facts from an earlier run (cdxgen --profile research, then
+ * evinse), everything under the analyzer's own `cdx:<analyzer>:` prefix is
+ * replaced. Replacing by exact name would keep facts the new run no longer
+ * emits, such as a cdx:rusi:requestedBackend left from a fallback run.
+ *
+ * @param {Object} component Metadata component to update in place
+ * @param {Object[]} metadataProperties Properties from the analyzer run
+ */
+export declare function mergeAnalyzerMetadataProperties(component: Object, metadataProperties?: Object[]): void;
+/**
+ * Build the options for the evinse phase (prepareDB, analyzeProject, and
+ * createEvinseFile) from the cdxgen CLI options.
+ *
+ * This object used to be assembled inline in bin/cdxgen.js, which dropped
+ * fields the analyzers read - most notably `exclude`, so every dosai and atom
+ * run triggered by `--evidence` ignored the user's `--exclude` patterns. Keep
+ * the wiring in one place so the forwarded fields stay testable.
+ *
+ * @param {Object} options CLI options
+ * @param {Object} args Parsed CLI arguments; `args._[0]` is the source directory
+ * @param {string} input Path of the BOM file the evinse phase enriches
+ * @returns {Object} Options for prepareDB, analyzeProject, and createEvinseFile
+ */
+export declare function buildEvinseOptions(options: Object, args: Object, input: string): Object;
 /**
  * Function to create the db for the libraries referred in the sbom.
  *
@@ -91,8 +118,9 @@ export declare function purlToLanguage(purl: string, filePath?: string): string
  * Seed purl-location and import maps from SBOM component evidence.
  *
  * Walks the supplied components reading `internal:ImportedModules` (or
- * `internal:Namespaces` for php/ruby) and `evidence.occurrences` properties
- * to construct lookup maps used during slice analysis.
+ * `internal:Namespaces` for php/ruby, plus the `internal:ImportedSymbols` the
+ * C/C++ collector records) and `evidence.occurrences` properties to construct
+ * lookup maps used during slice analysis.
  *
  * @param {Object[]} components CycloneDX components from the input SBOM
  * @param {string} language Application language used to select the import property name
@@ -102,6 +130,26 @@ export declare function initFromSbom(components: Object[], language: string): {
     purlLocationMap: Record<string, Set<any>>;
     purlImportsMap: Record<string, string[]>;
 };
+/**
+ * Load a semantics slices file for reuse when it belongs to this project.
+ *
+ * `--semantics-slices-file` defaults to `semantics.slices.json` in the working
+ * directory, which is shared by every project scanned from there and also
+ * receives the reports of other analyzers (dosai, rusi, golem). A file is
+ * only reused when its shape matches the language. Swift slices must also
+ * describe the same project directory and must not predate the input SBOM:
+ * `cdxgen --evidence` writes a fresh SBOM before evinse runs, so an older
+ * slice was made from an earlier state of the sources and is regenerated.
+ * Scala slices cannot be regenerated by evinse and are reused whenever their
+ * shape matches.
+ *
+ * @param {string} language Project language
+ * @param {string} slicesFile Candidate semantics slices file
+ * @param {string} bomFile Input SBOM
+ * @param {string} dirPath Project directory
+ * @returns {undefined|Object} Parsed slice when it can be reused
+ */
+export declare function loadReusableSemanticsSlice(language: string, slicesFile: string, bomFile: string, dirPath: string): undefined | Object;
 /**
  * Function to analyze the project
  *
@@ -155,13 +203,7 @@ export declare function analyzeProject(dbObjMap: Object, options: Object): Promi
     cryptoGeneratePurls: {};
     servicesMap: {};
     userDefinedTypesMap: {};
-    workspaceComponent: {
-        type: string;
-        name: any;
-        version: any;
-        purl: any;
-        "bom-ref": any;
-    } | undefined;
+    workspaceComponent: Object | undefined;
     atomFile?: undefined;
     usagesSlicesFile?: undefined;
     dataFlowSlicesFile?: undefined;
@@ -244,6 +286,14 @@ export declare function parseSliceUsages(language: string, userDefinedTypesMap:
 /**
  * Method to parse semantic slice data. Currently supported for swift and scala languages.
  *
+ * Swift slices created by cdxgen record, for every indexed source file, the
+ * lines that reference each dependency module (`moduleReferences`); the module
+ * of a reference is the declaring module recovered from the compiler-resolved
+ * USR. Components are mapped to their package's modules through the
+ * `packages` slice, so every occurrence is backed by a resolved reference.
+ * Slices without `moduleReferences` (created by older cdxgen versions) fall
+ * back to matching symbol names.
+ *
  * @param {String} language Project language.
  * @param {Array} components Components from the input SBOM
  * @param {Object} semanticsSlice Semantic slice data

package/types/lib/evinser/evinser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evinser.d.ts","sourceRoot":"","sources":["../../../lib/evinser/evinser.js"],"names":[],"mappings":"AAqGA;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAF5B,MAE4B;;;;;;;eAuDtC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAPE,MAOF,EACP,SAAS,wBAAA,EACT,UAAU,EAPD,MAOC,EACV,OAAO,GAPE,MAOG,GAND,OAAO,CAAC,IAAI,CAAC,CAmDzB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EALpC,MAKoC,EAAE,SAAS,wBAAA,EAAE,UAAU,EAH3D,MAG2D,GAFzD,OAAO,CAAC,IAAI,CAAC,CAoCzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAPK,MAOL,EACJ,SAAS,wBAAA,EACT,MAAM,EAPG,MAOH,EACN,OAAO,GAPE,MAOG,GAND,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAuBrC;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAH9B,MAG8B,GAF5B,MAAM,CAOlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAC/B,eAAe,EAPN,MAAM,GAAC,MAAM,EAOP,EACf,QAAQ,EAPC,MAOD,EACR,SAAS,AAPR,CACA,EADQ,MAOW,EACpB,OAAO,AAPN,CACA,EADQ,MAOG,GAND,OAAO,CAAC,MAAM,CAAC,CAyN3B;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAJxB,MAIwB,EAAE,QAAQ,AAH1C,CACA,EADQ,MAGkC,GAFhC,MAAM,GAAC,SAAS,CA4B5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAJ5B,MAAM,EAIsB,EAAE,QAAQ,EAHtC,MAGsC,GAFpC;IAAE,eAAe,2BAAsB;IAAC,cAAc,2BAA0B;CAAE,CAqC9F;AAcD;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAHlC,MAGkC,EAAE,OAAO,EAF3C,MAE2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoarD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAVC,MAUD,EACR,UAAU,EAVD,MAUC,EACV,QAAQ,EAVC,MAUD,EACR,WAAW,AAVV,CACA,EADQ,MAUO,EAChB,eAAe,AAVd,CACA,0BASmB,EACpB,cAAc,AAVb,CACA,0BASkB,EACnB,eAAe,AAVd,CACA,EADQ,MAUkB,GAThB,OAAO,CAAC,MAAM,CAAC,CAgE3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EATC,MASD,EACR,mBAAmB,EATV,MASU,EACnB,KAAK,OAAA,EACL,QAAQ,EATC,MASD,EACR,eAAe,EATN,MASM,EACf,cAAc,EATL,MASK,iBA4Nf;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,QAAA,EAAE,UAAU,OAAA,EAAE,cAAc,EAH7D,MAG6D,GAF3D,MAAM,CAiGlB;AAyBD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAL9B,MAK8B,EAAE,mBAAmB,yBAAA,EAAE,YAAY,EAHjE,MAGiE,GAF/D,OAAO,CA2EnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EANA,MAMA,EACT,eAAe,EANN,MAMM,EACf,WAAW,EANF,MAME,GALA,IAAI,CAqChB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,KAAK,OAAA,EAAE,WAAW,GAF1D,MAE+D,uBA2DzE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAJnC,MAImC,EAAE,gBAAgB,OAAA,EAAE,WAAW,EAFlE,MAEkE,QAgD5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAJnC,MAImC,EAAE,KAAK,EAH1C,MAG0C,GAFxC,MAAM,CAalB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAJ9B,MAI8B,EAAE,IAAI,EAHpC,MAGoC,GAFlC,MAAM,EAAE,GAAC,SAAS,CAwF9B;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,cAAc,EAJ1C,MAI0C,EAAE,OAAO,EAHnD,MAGmD,gBAqM7D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EARC,MAQD,EACR,mBAAmB,EARV,MAQU,EACnB,aAAa,EARJ,MAQI,EACb,QAAQ,EARC,MAQD,EACR,gBAAgB,EARP,MAQO,EAChB,cAAc,EARL,MAQK,eA4Gf;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAHrC,MAGqC,EAAE,eAAe,EAFtD,MAEsD;;;;;;;;YAgFzD,SAAS;YACT,GAAG;;;;EASV;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,OAAA,qBA4DnC;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,YAAY,EAH9B,MAG8B,UAExC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAJvC,MAIuC,EAAE,YAAY,EAHrD,MAGqD,GAFnD,MAAM,GAAC,SAAS,CAmD5B"}
+{"version":3,"file":"evinser.d.ts","sourceRoot":"","sources":["../../../lib/evinser/evinser.js"],"names":[],"mappings":"AA0GA;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC7C,SAAS,EAJA,MAIA,EACT,kBAAkB,GAJT,MAAM,EAIQ,QAkBxB;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAL/B,MAK+B,EAAE,IAAI,EAJrC,MAIqC,EAAE,KAAK,EAH5C,MAG4C,GAF1C,MAAM,CA+BlB;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAF5B,MAE4B;;;;;;;eAuDtC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAPE,MAOF,EACP,SAAS,wBAAA,EACT,UAAU,EAPD,MAOC,EACV,OAAO,GAPE,MAOG,GAND,OAAO,CAAC,IAAI,CAAC,CAmDzB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EALpC,MAKoC,EAAE,SAAS,wBAAA,EAAE,UAAU,EAH3D,MAG2D,GAFzD,OAAO,CAAC,IAAI,CAAC,CAoCzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAPK,MAOL,EACJ,SAAS,wBAAA,EACT,MAAM,EAPG,MAOH,EACN,OAAO,GAPE,MAOG,GAND,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAuBrC;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAH9B,MAG8B,GAF5B,MAAM,CAOlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAC/B,eAAe,EAPN,MAAM,GAAC,MAAM,EAOP,EACf,QAAQ,EAPC,MAOD,EACR,SAAS,AAPR,CACA,EADQ,MAOW,EACpB,OAAO,AAPN,CACA,EADQ,MAOG,GAND,OAAO,CAAC,MAAM,CAAC,CA+N3B;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAJxB,MAIwB,EAAE,QAAQ,AAH1C,CACA,EADQ,MAGkC,GAFhC,MAAM,GAAC,SAAS,CA4B5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAJ5B,MAAM,EAIsB,EAAE,QAAQ,EAHtC,MAGsC,GAFpC;IAAE,eAAe,2BAAsB;IAAC,cAAc,2BAA0B;CAAE,CAiD9F;AAcD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAPC,MAOD,EACR,UAAU,EAPD,MAOC,EACV,OAAO,EAPE,MAOF,EACP,OAAO,EAPE,MAOF,GANI,SAAS,GAAC,MAAM,CAwC5B;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAHlC,MAGkC,EAAE,OAAO,EAF3C,MAE2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkarD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAVC,MAUD,EACR,UAAU,EAVD,MAUC,EACV,QAAQ,EAVC,MAUD,EACR,WAAW,AAVV,CACA,EADQ,MAUO,EAChB,eAAe,AAVd,CACA,0BASmB,EACpB,cAAc,AAVb,CACA,0BASkB,EACnB,eAAe,AAVd,CACA,EADQ,MAUkB,GAThB,OAAO,CAAC,MAAM,CAAC,CAgE3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EATC,MASD,EACR,mBAAmB,EATV,MASU,EACnB,KAAK,OAAA,EACL,QAAQ,EATC,MASD,EACR,eAAe,EATN,MASM,EACf,cAAc,EATL,MASK,iBA4Nf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,QAAA,EAAE,UAAU,OAAA,EAAE,cAAc,EAH7D,MAG6D,GAF3D,MAAM,CA0DlB;AA2LD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAL9B,MAK8B,EAAE,mBAAmB,yBAAA,EAAE,YAAY,EAHjE,MAGiE,GAF/D,OAAO,CA2EnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EANA,MAMA,EACT,eAAe,EANN,MAMM,EACf,WAAW,EANF,MAME,GALA,IAAI,CAqChB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,KAAK,OAAA,EAAE,WAAW,GAF1D,MAE+D,uBA2DzE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAJnC,MAImC,EAAE,gBAAgB,OAAA,EAAE,WAAW,EAFlE,MAEkE,QAgD5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAJnC,MAImC,EAAE,KAAK,EAH1C,MAG0C,GAFxC,MAAM,CAalB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAJ9B,MAI8B,EAAE,IAAI,EAHpC,MAGoC,GAFlC,MAAM,EAAE,GAAC,SAAS,CAwF9B;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,cAAc,EAJ1C,MAI0C,EAAE,OAAO,EAHnD,MAGmD,gBA8M7D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EARC,MAQD,EACR,mBAAmB,EARV,MAQU,EACnB,aAAa,EARJ,MAQI,EACb,QAAQ,EARC,MAQD,EACR,gBAAgB,EARP,MAQO,EAChB,cAAc,EARL,MAQK,eA4Gf;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAHrC,MAGqC,EAAE,eAAe,EAFtD,MAEsD;;;;;;;;YAgFzD,SAAS;YACT,GAAG;;;;EASV;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,OAAA,qBA4DnC;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,YAAY,EAH9B,MAG8B,UAExC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAJvC,MAIuC,EAAE,YAAY,EAHrD,MAGqD,GAFnD,MAAM,GAAC,SAAS,CAmD5B"}