@cdxgen/cdxgen 13.2.0 → 13.3.0

package/types/lib/inventory/atomUtils.d.ts

@@ -3,6 +3,61 @@
  * bundled native `atom` binary.
  */
 export declare const ATOM_NATIVE_PACKAGES: Set<string>;
+/**
+ * Locate the JSON compilation database (`compile_commands.json`) of a C/C++
+ * project, which lets atom parse each file with the include paths, macros and
+ * language its build uses.
+ *
+ * An explicit `options.compileCommands` (a file, or a directory holding one
+ * directly or under `build/`) wins. Otherwise the scan root, `build/`, `out/`,
+ * `builddir/`, `cmake-build-*` and the directory of `options.cmakeCache` are
+ * searched. A database can come with the code it describes, and atom asks the
+ * GCC or Clang driver it names (from the PATH, or an absolute path outside
+ * the project) for its predefined macros, so in secure mode only an explicit
+ * database is used.
+ *
+ * @param {string} src Project scan root
+ * @param {Object} options CLI options
+ * @returns {string|undefined} Absolute path of the database
+ */
+export declare function findCompileCommands(src: string, options?: Object): string | undefined;
+/**
+ * Split an atom command that may carry a leading argument (`node
+ * script.js`, a custom `ATOM_CMD`) into its binary and that argument. The
+ * first space only splits when it can: a binary under a path with spaces
+ * (`C:\Program Files\...\node.exe script.js`) would otherwise be cut
+ * mid-path and the shell told to run `C:\Program`. A command name without a
+ * path separator (`node script.js`) resolves through the PATH, so it splits
+ * at its first space as before; otherwise the first prefix that exists as a
+ * file is the binary, and when none does the first space keeps the old
+ * behaviour.
+ *
+ * @param {string} command The atom command, possibly with an argument
+ * @returns {[string, string|undefined]} The binary and its leading argument, when present
+ */
+export declare function splitAtomCommand(command: string): [string, string | undefined];
+/**
+ * The `--frontend-args` keys the installed atom accepts for a language, as
+ * `atom --frontend-args-keys -l <language>` lists them. Asked once per atom
+ * command and language. An atom that cannot list them (a release without
+ * `--frontend-args`, or one that fails to start) accepts none.
+ *
+ * @param {string} language atom `-l` value
+ * @returns {Set<string>} Supported keys
+ */
+export declare function atomFrontendArgKeys(language: string): Set<string>;
+/**
+ * The `--frontend-args` atom takes for a C/C++ language: the project's
+ * compilation database, when there is one and the installed atom reads it
+ * (atom 4 and later). An older atom is given the arguments it has always
+ * been given, and parses the sources without the database.
+ *
+ * @param {string} src Project scan root
+ * @param {string} language atom `-l` value
+ * @param {Object} options CLI options
+ * @returns {string[]} Arguments to add to the atom command
+ */
+export declare function atomCompileCommandsArgs(src: string, language: string, options?: Object): string[];
 /**
  * Convert cdxgen's glob-style exclude patterns to a Scala/Java regex string.
  *
@@ -69,9 +124,19 @@ export declare function resolveAtomProvider(opts?: {
     libc?: string;
 };
 /**
- * Returns `"native"` or `"jar"` for the currently resolved atom provider.
- * Used to gate Java/JDK advice so users on the five native platforms are not
- * told to install a JDK for a failure that has nothing to do with Java.
+ * Returns `"native"` or `"jar"` for the atom provider that will actually run.
+ *
+ * The platform decides which provider atom prefers, but the dispatcher falls
+ * back to the jar package when the platform's native package is not installed
+ * (optional dependencies skipped, a failed download). The two take the heap
+ * ceiling differently, and a native-image runtime option on a jar run reaches
+ * atom as an unknown argument that fails every slice. So the kind follows what
+ * is installed where cdxgen can see it: the native binary means native, the jar
+ * package without it means jar. With neither in view (a custom `ATOM_CMD`, an
+ * install elsewhere) the platform's kind stands.
+ *
+ * Also used to gate Java/JDK advice, so users on the five native platforms are
+ * not told to install a JDK for a failure that has nothing to do with Java.
  */
 export declare function atomProviderKind(): "jar" | "native";
 /**
@@ -131,6 +196,41 @@ export declare function getAtomCommand(): any;
  * @returns {number|undefined} Heap ceiling in bytes, or `undefined` to leave the runtime default in place
  */
 export declare function atomMaxHeapBytes(): number | undefined;
+/**
+ * Compute how long atom may run, and how long cdxgen waits for it.
+ *
+ * cdxgen's spawn timeout kills only the process cdxgen started, and for atom
+ * that is the npm dispatcher. The runtime under it (the native binary or the
+ * JVM) used to survive that kill, re-parented and still holding its heap. atom
+ * therefore gets its own limit, `ATOM_TIMEOUT`, which the dispatcher enforces on
+ * the runtime, and cdxgen's spawn timeout sits a grace period beyond it as the
+ * last resort.
+ *
+ * An explicit `ATOM_TIMEOUT` (milliseconds) sets atom's limit independently of
+ * `CDXGEN_TIMEOUT_MS`, which keeps bounding every other tool. Otherwise atom's
+ * limit is `CDXGEN_TIMEOUT_MS` less the grace period.
+ *
+ * @returns {{atomTimeoutMs: number, spawnTimeoutMs: number}} atom's own limit and cdxgen's spawn timeout for it
+ */
+export declare function atomTimeouts(): {
+    atomTimeoutMs: number;
+    spawnTimeoutMs: number;
+};
+/**
+ * Whether an atom run ended because it ran out of time.
+ *
+ * The dispatcher reports its own limit with status 124. cdxgen's spawn timeout
+ * shows up as `ETIMEDOUT`. A dispatcher older than the status code stops atom
+ * with SIGTERM and exits 1, so status 1 at or past the limit counts as well,
+ * unless atom's own output shows it failed for another reason first (an
+ * exhausted heap, a crash), which deserves its own diagnosis.
+ *
+ * @param {Object} result spawnSync result
+ * @param {number} elapsedMs How long the run took
+ * @param {number} atomTimeoutMs atom's time limit
+ * @returns {boolean} true when the run hit a time limit
+ */
+export declare function atomRunTimedOut(result: Object, elapsedMs: number, atomTimeoutMs: number): boolean;
 /**
  * Execute the atom tool against a source directory or file with the given arguments.
  *
@@ -145,6 +245,48 @@ export declare function atomMaxHeapBytes(): number | undefined;
  * @returns {boolean} `true` if atom executed successfully and the language is supported; `false` otherwise
  */
 export declare function executeAtom(src: string, args: string[], extra_env?: Object): boolean;
+/**
+ * The numbered chunks atom wrote beside a reachables slices file.
+ *
+ * atom writes reachables at most 1000 flows per file: `<base>.json`, then
+ * `<base>_1.json`, `<base>_2.json` and so on. Chunks are taken until the first
+ * gap. A chunk older than the base file was left by an earlier run with more
+ * flows (atom before 4.0.0 did not remove those), so it ends the sequence
+ * instead of being merged.
+ *
+ * @param {string} slicesFile Path of the base reachables slices file
+ * @returns {string[]} Chunk file paths, in order
+ */
+export declare function reachablesChunkFiles(slicesFile: string): string[];
+/**
+ * Remove the numbered chunks beside a reachables slices file, before atom
+ * writes a new set there, so no chunk of an earlier run survives next to it.
+ *
+ * @param {string} slicesFile Path of the base reachables slices file
+ */
+export declare function removeReachablesChunkFiles(slicesFile: string): void;
+/**
+ * Read an atom slices file, or warn and return `undefined` when it cannot be
+ * parsed. A run stopped while writing (a timeout, a kill) can leave a
+ * truncated file, and the evidence from the other slices is still worth
+ * keeping.
+ *
+ * @param {string} slicesFile Path of the slices file
+ * @param {string} sliceType Slice type, for the warning
+ * @returns {*} The parsed slices, or `undefined`
+ */
+export declare function readSlicesFile(slicesFile: string, sliceType: string): any;
+/**
+ * Read a reachables slices file together with its chunks.
+ *
+ * Reading only the base file silently dropped every flow past the first
+ * thousand. A chunk that cannot be parsed ends the sequence, keeping the flows
+ * read before it.
+ *
+ * @param {string} slicesFile Path of the base reachables slices file
+ * @returns {Object[]|Object|undefined} Every flow, in the base file's shape (an array, or an object with `reachables`)
+ */
+export declare function readReachablesSlices(slicesFile: string): Object[] | Object | undefined;
 /**
  * Find the imported modules in the application with atom parsedeps command
  *

package/types/lib/inventory/atomUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"atomUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/atomUtils.js"],"names":[],"mappings":"AA6CA;;;GAGG;AACH,eAAO,MAAM,oBAAoB,aAM/B,CAAC;AA4RH;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,GAH3C,MAAM,EAG0C,GAF9C,MAAM,GAAC,SAAS,CAU5B;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAJ1C,MAI0C,EAAE,QAAQ,AAH5D,CACA,EADQ,MAAM,EAGmD,GAFvD,OAAO,CAkBnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAAC,SAAS,EAJhD,MAAM,QAI0C,EAAE,QAAQ,AAHlE,CACA,EADQ,MAAM,EAGyD,GAF7D,MAAM,QAAM,CA2DxB;AA4BD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAJhC,MAIqC,EAAE,QAAQ,GAH/C,MAGoD,GAFlD,MAAM,CAkDlB;AAgBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,AANrC,CAIA,EAHA;IAAsB,QAAQ,AAA9B,CACA,EADQ,MAAM,CACd;IAAsB,IAAI,AAA1B,CACA,EADQ,MAAM,CACd;IAAsB,IAAI,AAA1B,CACA,EADQ,MAAM,CACd;CAE0C,GAFhC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,GAAC,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,CA6CvG;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,qBAE/B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,IAFrB,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,IAF9B,MAAM,GAAC,SAAS,CAkD5B;AAsBD;;GAEG;AACH,wBAAgB,cAAc,QAwB7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,GAAC,SAAS,CA0B5B;AA0DD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,GAAG,EALpB,MAKoB,EAAE,IAAI,EAJ1B,MAAM,EAIoB,EAAE,SAAS,GAHrC,MAG0C,GAFxC,OAAO,CAqJnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EARM,MAQN,EACH,QAAQ,EARC,MAQD,EACR,WAAW,GARF,MAQa,EACtB,UAAU,GARD,MAQa,EACtB,OAAO,GARE,MAQG,OAsCb"}
+{"version":3,"file":"atomUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/atomUtils.js"],"names":[],"mappings":"AAyDA;;;GAGG;AACH,eAAO,MAAM,oBAAoB,aAM/B,CAAC;AA8CH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,EAAE,OAAO,GAHrC,MAG0C,GAFxC,MAAM,GAAC,SAAS,CA0D5B;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAwBtC;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,GAAG,CAAC,MAAM,CAAC,CAwCvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,QAAQ,EAJ1C,MAI0C,EAAE,OAAO,GAHnD,MAGwD,GAFtD,MAAM,EAAE,CAiCpB;AA0RD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,GAH3C,MAAM,EAG0C,GAF9C,MAAM,GAAC,SAAS,CAU5B;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAJ1C,MAI0C,EAAE,QAAQ,AAH5D,CACA,EADQ,MAAM,EAGmD,GAFvD,OAAO,CAkBnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAAC,SAAS,EAJhD,MAAM,QAI0C,EAAE,QAAQ,AAHlE,CACA,EADQ,MAAM,EAGyD,GAF7D,MAAM,QAAM,CA2DxB;AA4BD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAJhC,MAIqC,EAAE,QAAQ,GAH/C,MAGoD,GAFlD,MAAM,CAkDlB;AAgBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,AANrC,CAIA,EAHA;IAAsB,QAAQ,AAA9B,CACA,EADQ,MAAM,CACd;IAAsB,IAAI,AAA1B,CACA,EADQ,MAAM,CACd;IAAsB,IAAI,AAA1B,CACA,EADQ,MAAM,CACd;CAE0C,GAFhC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,GAAC,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,CA6CvG;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,qBAkB/B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,IAFrB,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,IAF9B,MAAM,GAAC,SAAS,CAgB5B;AAmED;;GAEG;AACH,wBAAgB,cAAc,QAwB7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,GAAC,SAAS,CA0B5B;AAgED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,IAFf;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAC,CAkB3D;AAaD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAL3B,MAK2B,EAAE,SAAS,EAJtC,MAIsC,EAAE,aAAa,EAHrD,MAGqD,GAFnD,OAAO,CAcnB;AAUD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,GAAG,EALpB,MAKoB,EAAE,IAAI,EAJ1B,MAAM,EAIoB,EAAE,SAAS,GAHrC,MAG0C,GAFxC,OAAO,CAwKnB;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAHpC,MAGoC,GAFlC,MAAM,EAAE,CAwBpB;AAcD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAF1C,MAE0C,QAQpD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAJ9B,MAI8B,EAAE,SAAS,EAHzC,MAGyC,GAFvC,GAAC,CAcb;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAHpC,MAGoC,GAFlC,MAAM,EAAE,GAAC,MAAM,GAAC,SAAS,CAwBrC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EARM,MAQN,EACH,QAAQ,EARC,MAQD,EACR,WAAW,GARF,MAQa,EACtB,UAAU,GARD,MAQa,EACtB,OAAO,GARE,MAQG,OA8Cb"}

package/types/lib/inventory/cdxrs.d.ts

@@ -3,9 +3,9 @@
  *
  * This module is the ONLY place that spawns the `cdxrs` binary. It enforces
  * the governing invariant: **no failure mode may abort SBOM generation.**
- * Every failure (missing binary, non-zero exit, timeout, malformed stdout,
- * version-major mismatch, CDXGEN_RS_DISABLE) logs once at `warn` and returns
- * a sentinel that makes the caller take the JS path.
+ * Every failure (missing binary, non-zero exit, timeout, oversized stdout,
+ * malformed stdout, version-major mismatch, CDXGEN_RS_DISABLE) logs once at
+ * `warn` and returns a sentinel that makes the caller take the JS path.
  *
  * Protocol:
  *   cdxrs <subcommand> --input <file|-> --output <file|-> --format json
@@ -67,6 +67,11 @@ export declare function cdxrsAvailable(subcommand?: string): {
  *
  * Passing `content` is the normal case, since cdxgen holds BOMs in memory.
  *
+ * Collected stdout is bounded: it must become a single JS string, so a child
+ * that would exceed V8's string limit (by default; see
+ * CDXGEN_RS_MAX_STDOUT_BYTES) is killed and reported as a fallback instead of
+ * crashing the process at the concat.
+ *
  * @param {string} subcommand The subcommand to run (e.g. "info").
  * @param {Object} opts
  * @param {string|Buffer} [opts.content] BOM data to feed over stdin.

package/types/lib/inventory/cdxrs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cdxrs.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cdxrs.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAwBH,iFAAiF;AACjF,eAAO,MAAM,cAAc;;;;;EAKzB,CAAC;AAOH;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAH7B,MAG6B,GAF3B,OAAO,CAkBnB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAFlB,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,UAAU,AAHtC,CACA,EADQ,MAG8B,GAF5B;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAuBrE;AA2BD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,QAAQ,CAAC,UAAU,EAT9B,MAS8B,EAAE,IAAI,GAP5C;IAA6B,OAAO,AAApC,CACA,EADQ,MAAM,GAAC,MAAM,CACrB;IAAsB,KAAK,AAA3B,CAEA,EAFQ,MAAM,CAEd;IAAwB,IAAI,AAA5B,CACA,EADQ,MAAM,EAAE,CAChB;IAAsB,SAAS,AAA/B,CACA,EADQ,MAAM,CACd;CAEiD,GAFvC,OAAO,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAC,CAAC,CAiP1F"}
+{"version":3,"file":"cdxrs.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cdxrs.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAoEH,iFAAiF;AACjF,eAAO,MAAM,cAAc;;;;;EAKzB,CAAC;AAOH;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAH7B,MAG6B,GAF3B,OAAO,CAkBnB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAFlB,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,UAAU,AAHtC,CACA,EADQ,MAG8B,GAF5B;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAuBrE;AA2BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,QAAQ,CAAC,UAAU,EAT9B,MAS8B,EAAE,IAAI,GAP5C;IAA6B,OAAO,AAApC,CACA,EADQ,MAAM,GAAC,MAAM,CACrB;IAAsB,KAAK,AAA3B,CAEA,EAFQ,MAAM,CAEd;IAAwB,IAAI,AAA5B,CACA,EADQ,MAAM,EAAE,CAChB;IAAsB,SAAS,AAA/B,CACA,EADQ,MAAM,CACd;CAEiD,GAFvC,OAAO,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAC,CAAC,CAgS1F"}

package/types/lib/inventory/depsUtils.d.ts

@@ -29,6 +29,21 @@ export declare function markNpmTypesPackagesAsExcluded(components?: Object[]): O
  * @returns {Object[]} The same component array with scopes updated in place
  */
 export declare function propagateRequiredScopeFromDependencies(components?: Object[], dependencies?: Object[]): Object[];
+/**
+ * Scopes the dependencies of type-only npm packages as optional.
+ *
+ * A package imported only for its TypeScript types, like an `@types` package,
+ * is erased at compile time, and so is what it depends on unless a runtime
+ * package depends on it too. A component below a type-only package becomes
+ * optional when no dependency path from a root of the graph reaches it without
+ * passing through a type-only package. A component that already has a scope,
+ * from its manifest or from usage evidence, keeps it.
+ *
+ * @param {Object[]} components CycloneDX component objects
+ * @param {Object[]} dependencies CycloneDX dependency entries
+ * @returns {Object[]} The same component array with scopes updated in place
+ */
+export declare function markTypeOnlyDependenciesOptional(components?: Object[], dependencies?: Object[]): Object[];
 /**
  * Merge CycloneDX services using bom-ref or group/name/version identity.
  *

package/types/lib/inventory/depsUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"depsUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/depsUtils.js"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EANH,MAAM,EAMH,EACZ,eAAe,EANN,MAAM,EAMA,EACf,eAAe,GANN,MAMW,GALT,MAAM,EAAE,CAuEpB;AA4CD;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,GAH9C,MAAM,EAG6C,GAFjD,MAAM,EAAE,CAYpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sCAAsC,CACpD,UAAU,GALD,MAAM,EAKA,EACf,YAAY,GALH,MAAM,EAKE,GAJN,MAAM,EAAE,CA8DpB;AA0FD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAJ3B,MAAM,EAAE,GAAC,MAIkB,EAAE,WAAW,EAHxC,MAAM,EAAE,GAAC,MAG+B,GAFtC,MAAM,EAAE,CAqFpB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,UAAU,OAAA,SAoIxC;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAH7C,MAAM,EAAE,GAAG,SAAS,GAAG,IAGsB,GAF3C,MAAM,EAAE,CA0CpB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,YAAY,OAAA,EAAE,eAAe,SAAI,WAsB9D;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,OAAA,EAAE,YAAY,OAAA,SAgCnD"}
+{"version":3,"file":"depsUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/depsUtils.js"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EANH,MAAM,EAMH,EACZ,eAAe,EANN,MAAM,EAMA,EACf,eAAe,GANN,MAMW,GALT,MAAM,EAAE,CAuEpB;AA4CD;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,GAH9C,MAAM,EAG6C,GAFjD,MAAM,EAAE,CAYpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sCAAsC,CACpD,UAAU,GALD,MAAM,EAKA,EACf,YAAY,GALH,MAAM,EAKE,GAJN,MAAM,EAAE,CA8DpB;AAgBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gCAAgC,CAC9C,UAAU,GALD,MAAM,EAKA,EACf,YAAY,GALH,MAAM,EAKE,GAJN,MAAM,EAAE,CA8EpB;AA0FD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAJ3B,MAAM,EAAE,GAAC,MAIkB,EAAE,WAAW,EAHxC,MAAM,EAAE,GAAC,MAG+B,GAFtC,MAAM,EAAE,CAqFpB;AAmED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,UAAU,OAAA,SAoIxC;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAH7C,MAAM,EAAE,GAAG,SAAS,GAAG,IAGsB,GAF3C,MAAM,EAAE,CA0CpB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,YAAY,OAAA,EAAE,eAAe,SAAI,WAuB9D;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,OAAA,EAAE,YAAY,OAAA,SAgCnD"}

package/types/lib/inventory/display.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"display.d.ts","sourceRoot":"","sources":["../../../lib/inventory/display.js"],"names":[],"mappings":"AAwKA;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAkFpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAHpC,MAGoC,GAFlC,MAAM,EAAE,CA2CpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAyBpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAwBpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,YANxB,MAAM,eACN,MAAM,EAAE,GAAC,SAAS,eAClB,MAAM,GAAC,SAAS,6BAChB,MAAM,KACJ,MAAM,EAkGlB,CAAC;AAqNF;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,iBAHhC,MAAM,EAAE,KACN,MAAM,EAclB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAJ3C,MAAM,EAIqC,EAAE,UAAU,AAH/D,CACA,EADQ,OAGkE,GAFhE,MAAM,CAsBlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAND,MAAM,EAML,EACV,UAAU,AANT,CACA,EADQ,MAMU,EACnB,UAAU,AANT,CACA,EADQ,OAMY,GALV,MAAM,EAAE,CA8BpB;AA6BD;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAPE,MAOF,EACP,WAAW,AAPV,CACA,EADQ,MAAM,EAOQ,EACvB,SAAS,AAPR,CACA,EADQ,MAOY,EACrB,WAAW,AAPV,CACA,EADQ,MAOc,GANZ,IAAI,CA+EhB;AAQD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAHzB,MAGyB,GAFvB,IAAI,CAsBhB;AACD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,IAAI,CAwBhB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,IAAI,CAuBhB;AA0BD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,IAAI,CAwChB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,GAFzB,IAAI,CA+ChB;AACD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EANE,MAMF,EACP,IAAI,AANH,CACA,EADQ,MAMS,EAClB,SAAS,AANR,CACA,EADQ,MAMY,GALV,IAAI,CAoChB;AAkJD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,iBAJ1B,MAAM,EAAE,SACR,MAAM,KACJ,MAAM,EAyClB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,cAAc,EAHnC,MAGmC,GAFjC,IAAI,CAoChB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,eAAe,EAHzC,MAAM,EAGmC,GAFvC,IAAI,CA4BhB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B,IAAI,CAwBhB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAHzB,MAGyB,GAFvB,IAAI,CAsDhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,AAH5C,CACA,EADQ,MAGgD,GAF9C,IAAI,CAwHhB;AAGE,YAAmG,eAAe,GAAxG;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAC,CAAiB;AA6DrH;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,gBAAgB,GAHnD,eAAe,EAGyC,GAFtD,IAAI,CA+BhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EANC,MAMD,EACR,MAAM,EANG,MAMH,EACN,OAAO,EANE,MAMF,EACP,gBAAgB,EANP,eAAe,EAMR,QAgUjB"}
+{"version":3,"file":"display.d.ts","sourceRoot":"","sources":["../../../lib/inventory/display.js"],"names":[],"mappings":"AAwKA;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAkFpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAHpC,MAGoC,GAFlC,MAAM,EAAE,CA2CpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAyBpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAwBpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,YANxB,MAAM,eACN,MAAM,EAAE,GAAC,SAAS,eAClB,MAAM,GAAC,SAAS,6BAChB,MAAM,KACJ,MAAM,EAkGlB,CAAC;AAqNF;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,iBAHhC,MAAM,EAAE,KACN,MAAM,EAclB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAJ3C,MAAM,EAIqC,EAAE,UAAU,AAH/D,CACA,EADQ,OAGkE,GAFhE,MAAM,CAsBlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAND,MAAM,EAML,EACV,UAAU,AANT,CACA,EADQ,MAMU,EACnB,UAAU,AANT,CACA,EADQ,OAMY,GALV,MAAM,EAAE,CA8BpB;AA6BD;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAPE,MAOF,EACP,WAAW,AAPV,CACA,EADQ,MAAM,EAOQ,EACvB,SAAS,AAPR,CACA,EADQ,MAOY,EACrB,WAAW,AAPV,CACA,EADQ,MAOc,GANZ,IAAI,CA+EhB;AAQD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAHzB,MAGyB,GAFvB,IAAI,CAsBhB;AACD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,IAAI,CAwBhB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,IAAI,CAuBhB;AA0BD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,IAAI,CAwChB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,GAFzB,IAAI,CA+ChB;AACD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EANE,MAMF,EACP,IAAI,AANH,CACA,EADQ,MAMS,EAClB,SAAS,AANR,CACA,EADQ,MAMY,GALV,IAAI,CAoChB;AAkJD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,iBAJ1B,MAAM,EAAE,SACR,MAAM,KACJ,MAAM,EAyClB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,cAAc,EAHnC,MAGmC,GAFjC,IAAI,CAmChB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,eAAe,EAHzC,MAAM,EAGmC,GAFvC,IAAI,CA4BhB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B,IAAI,CAwBhB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAHzB,MAGyB,GAFvB,IAAI,CAsDhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,AAH5C,CACA,EADQ,MAGgD,GAF9C,IAAI,CAwHhB;AAGE,YAAmG,eAAe,GAAxG;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAC,CAAiB;AA6DrH;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,gBAAgB,GAHnD,eAAe,EAGyC,GAFtD,IAAI,CA+BhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EANC,MAMD,EACR,MAAM,EANG,MAMH,EACN,OAAO,EANE,MAMF,EACP,gBAAgB,EANP,eAAe,EAMR,QAgUjB"}

package/types/lib/inventory/dosai.d.ts

@@ -1,3 +1,32 @@
+/**
+ * Translate cdxgen --exclude globs into dosai --exclude globs.
+ *
+ * Dosai is an evidence analyzer, so the translation follows the exclude
+ * filter cdxgen already applies to atom evidence slices
+ * (`globPatternsToAtomIgnoreRegex`): a relative pattern matches at any depth,
+ * and an absolute pattern is anchored to the scanned directory. Dosai itself
+ * uses gitignore conventions, where a pattern with a slash is anchored, so
+ * relative patterns get a leading "**\/". Like the atom filter, and unlike
+ * cdxgen's file discovery, excluding a directory also excludes everything
+ * beneath it.
+ *
+ * Brace groups and numeric ranges are expanded, and comma separated lists are
+ * split, since dosai reads both as literal text. Character classes, extglobs,
+ * escapes, negation, and patterns that step outside the scanned directory
+ * have no dosai equivalent; they are reported as skipped rather than passed
+ * on as literals that match nothing. So is any pattern that still carries a
+ * character outside a small allowlist, such as a literal brace group or a
+ * shell metacharacter. Dosai matches case-sensitively on Linux.
+ *
+ * @param {string[]} excludes cdxgen exclude globs
+ * @param {string} srcPath Absolute directory dosai scans
+ * @returns {{patterns: string[], skipped: string[], truncated: number}} Translated patterns, dropped patterns, and how many were left out by the cap
+ */
+export declare function toDosaiExcludePatterns(excludes: string[], srcPath: string): {
+    patterns: string[];
+    skipped: string[];
+    truncated: number;
+};
 /**
  * Check whether a language is a .NET language supported by dosai analysis.
  *
@@ -12,6 +41,40 @@ export declare function isDosaiDotnetLanguage(language: string): boolean;
  * @returns {Object|undefined} Parsed JSON content, or undefined when missing or invalid
  */
 export declare function readDosaiJsonFile(jsonFile: string): Object | undefined;
+/**
+ * Read a dosai methods report of any size.
+ *
+ * A report that fits in one JavaScript string is parsed whole. A larger one is
+ * read in bounded runs, keeping the requested sections, the CallGraph nodes and
+ * edges that PackageReachability references, and the MethodCalls accepted by
+ * `keepMethodCall` (none when it is omitted). Nothing cdxgen reads is lost.
+ *
+ * @param {string} reportFile Path to the dosai methods JSON
+ * @param {Object} [options] Options
+ * @param {string[]} [options.sections] Sections to keep from a large report (default: every section cdxgen reads)
+ * @param {Function} [options.keepMethodCall] Predicate choosing the MethodCalls to keep from a large report
+ * @param {number} [options.maxTextBytes] Largest report parsed whole, for tests
+ * @returns {Object|undefined} Parsed report, or undefined when missing or invalid
+ */
+export declare function readDosaiMethodsReport(reportFile: string, options?: {
+    sections?: string[];
+    keepMethodCall?: Function;
+    maxTextBytes?: number;
+}): Object | undefined;
+/**
+ * Read a dosai data-flow report of any size.
+ *
+ * A report that fits in one JavaScript string is parsed whole. A larger one
+ * keeps Metadata, Slices, PackageReachability, and the Nodes those reference.
+ *
+ * @param {string} reportFile Path to the dosai data-flow JSON
+ * @param {Object} [options] Options
+ * @param {number} [options.maxTextBytes] Largest report parsed whole, for tests
+ * @returns {Object|undefined} Parsed report, or undefined when missing or invalid
+ */
+export declare function readDosaiDataFlowReport(reportFile: string, options?: {
+    maxTextBytes?: number;
+}): Object | undefined;
 /**
  * Run a dosai subcommand ("methods", "dataflows", or "crypto") against a source
  * tree and write its JSON output to the given file.
@@ -19,7 +82,7 @@ export declare function readDosaiJsonFile(jsonFile: string): Object | undefined;
  * @param {string} command Dosai subcommand to execute
  * @param {string} src Source directory to analyze
  * @param {string} outputFile Path where the dosai JSON output is written
- * @param {Object} [options] Options carrying dosaiCommand, dataFlowPatterns, or patternPacks overrides
+ * @param {Object} [options] Options carrying dosaiCommand, dataFlowPatterns, patternPacks, or exclude globs
  * @returns {boolean} True when the command succeeded and produced the output file, false otherwise
  */
 export declare function runDosaiCommand(command: string, src: string, outputFile: string, options?: Object): boolean;

package/types/lib/inventory/dosai.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dosai.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dosai.js"],"names":[],"mappings":"AA8LA;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAW5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAN5B,MAM4B,EAAE,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAiEnB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,UAAU,EAJ5C,MAI4C,EAAE,OAAO,AAH7D,CACA,EADQ,MAG0D,GAFxD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EALlC,MAKkC,EAAE,UAAU,EAJ9C,MAI8C,EAAE,OAAO,AAH/D,CACA,EADQ,MAG4D,GAF1D,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAe5B;AAuBD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,KAAA,EACP,YAAY,KAAA,EACZ,aAAa,KAAA,OA+Bd;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,AAHzC,CACA,EADQ,MAAM,EAGgC,GAFpC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/B;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAJ9B,MAI8B,EAAE,YAAY,EAH5C,GAAG,CAAC,MAAM,EAAE,MAAM,CAG0B,GAF1C,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAH7C,MAG6C,EAAE,YAAY,EAF3D,MAE2D,QAyBrE;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,YAAY,EAJhD,MAIgD,EAAE,UAAU,AAHpE,CACA,EADQ,MAAM,EAG2D,GAF/D,MAAM,CAoBlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAJ1C,MAI0C,EAAE,UAAU,AAH9D,CACA,EADQ,MAAM,EAGqD,GAFzD,MAAM,CAmElB;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,cAAc,EAJ9C,MAI8C,EAAE,UAAU,AAHlE,CACA,EADQ,MAAM,EAGyD,GAF7D,MAAM,CAsClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAJ1C,MAI0C,EAAE,UAAU,AAH9D,CACA,OAEmE,SA6FrE;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,YAAY,EAJ/C,MAI+C,EAAE,WAAW,AAHpE,CACA,EADQ,MAGiE,GAF/D,MAAM,CAyKlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC7C,YAAY,EALH,MAKG,EACZ,WAAW,AALV,CACA,EADQ,MAKO,GAJL,MAAM,CA+GlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,AAHjD,CACA,EADQ,MAG8C,GAF5C,MAAM,EAAE,CA6CpB"}
+{"version":3,"file":"dosai.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dosai.js"],"names":[],"mappings":"AA6WA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAJpC,MAAM,EAI8B,EAAE,OAAO,EAH7C,MAG6C,GAF3C;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAC,CAyFtE;AAoCD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAW5B;AA2ED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAPtC,MAOsC,EAAE,OAAO,AANvD,CAIA,EAHA;IAA2B,QAAQ,AAAnC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,cAAc,AAAzC,CACA,WAAA;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;CAE4D,GAFlD,MAAM,GAAC,SAAS,CA0B5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EALvC,MAKuC,EAAE,OAAO,AAJxD,CAEA,EADA;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;CAE6D,GAFnD,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAN5B,MAM4B,EAAE,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAoFnB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,UAAU,EAJ5C,MAI4C,EAAE,OAAO,AAH7D,CACA,EADQ,MAG0D,GAFxD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EALlC,MAKkC,EAAE,UAAU,EAJ9C,MAI8C,EAAE,OAAO,AAH/D,CACA,EADQ,MAG4D,GAF1D,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAe5B;AAuDD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,KAAA,EACP,YAAY,KAAA,EACZ,aAAa,KAAA,OAyDd;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,AAHzC,CACA,EADQ,MAAM,EAGgC,GAFpC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/B;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAJ9B,MAI8B,EAAE,YAAY,EAH5C,GAAG,CAAC,MAAM,EAAE,MAAM,CAG0B,GAF1C,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAH7C,MAG6C,EAAE,YAAY,EAF3D,MAE2D,QAyBrE;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,YAAY,EAJhD,MAIgD,EAAE,UAAU,AAHpE,CACA,EADQ,MAAM,EAG2D,GAF/D,MAAM,CAoBlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAJ1C,MAI0C,EAAE,UAAU,AAH9D,CACA,EADQ,MAAM,EAGqD,GAFzD,MAAM,CAmElB;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,cAAc,EAJ9C,MAI8C,EAAE,UAAU,AAHlE,CACA,EADQ,MAAM,EAGyD,GAF7D,MAAM,CAsClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAJ1C,MAI0C,EAAE,UAAU,AAH9D,CACA,OAEmE,SA6FrE;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,YAAY,EAJ/C,MAI+C,EAAE,WAAW,AAHpE,CACA,EADQ,MAGiE,GAF/D,MAAM,CAyKlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC7C,YAAY,EALH,MAKG,EACZ,WAAW,AALV,CACA,EADQ,MAKO,GAJL,MAAM,CA+GlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,AAHjD,CACA,EADQ,MAG8C,GAF5C,MAAM,EAAE,CA6CpB"}

package/types/lib/inventory/dynamic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dynamic.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dynamic.js"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAND,MAMC,EACV,UAAU,EAND,MAMC,EACV,YAAY,AANX,CACA,EADQ,MAMQ,GALN,OAAO,CAAC;IAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAAC,CAAC,CAsHzE"}
+{"version":3,"file":"dynamic.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dynamic.js"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAND,MAMC,EACV,UAAU,EAND,MAMC,EACV,YAAY,AANX,CACA,EADQ,MAMQ,GALN,OAAO,CAAC;IAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAAC,CAAC,CA4JzE"}

package/types/lib/inventory/evidenceUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evidenceUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/evidenceUtils.js"],"names":[],"mappings":"AA6BA;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,OAAO,AAHvD,CACA,EADQ,MAGoD,GAFlD,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,MAAM,GAAC,SAAS,CA8B5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAHxC,MAGwC,GAFtC,MAAM,CAalB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAJ1B,MAAM,EAAE,GAAC,MAIiB,EAAE,SAAS,UAAA,GAFnC,MAAM,EAAE,CAmDpB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAAM,GAAC,MAAM,EAIoB,EAAE,QAAQ,EAH3C,MAAM,EAGqC,GAFzC,MAAM,GAAC,MAAM,EAAE,CAwB3B;AAsCD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAJjC,MAAM,EAI2B,EAAE,UAAU,EAH7C,MAG6C,GAF3C,MAAM,EAAE,CAkOpB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EANJ,MAMI,EACb,QAAQ,EANC,MAMD,EACR,OAAO,OAAA,EACP,OAAO,UAAQ,EACf,gBAAgB,YAAY;;;;;;;;;IA6H7B"}
+{"version":3,"file":"evidenceUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/evidenceUtils.js"],"names":[],"mappings":"AA+BA;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,OAAO,AAHvD,CACA,EADQ,MAGoD,GAFlD,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,MAAM,GAAC,SAAS,CA8B5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAHxC,MAGwC,GAFtC,MAAM,CAalB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAJ1B,MAAM,EAAE,GAAC,MAIiB,EAAE,SAAS,UAAA,GAFnC,MAAM,EAAE,CAmDpB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAAM,GAAC,MAAM,EAIoB,EAAE,QAAQ,EAH3C,MAAM,EAGqC,GAFzC,MAAM,GAAC,MAAM,EAAE,CAwB3B;AAsCD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAJjC,MAAM,EAI2B,EAAE,UAAU,EAH7C,MAG6C,GAF3C,MAAM,EAAE,CAwOpB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EANJ,MAMI,EACb,QAAQ,EANC,MAMD,EACR,OAAO,OAAA,EACP,OAAO,UAAQ,EACf,gBAAgB,YAAY;;;;;;;;;IA6H7B"}

package/types/lib/inventory/fetchBatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetchBatch.d.ts","sourceRoot":"","sources":["../../../lib/inventory/fetchBatch.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AA8EH;;;GAGG;AACH,wBAAgB,cAAc,IAHjB,MAAM,GAAC,IAAI,CAKvB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAFtB,OAAO,CASnB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,SAO1C;AAKE,YAAkB,UAAU,GAC5B;;;;IAAoB,EAAE,EAAX,OAAO,CAClB;;;;IAAe,IAAI,AAAnB,CACA,EADW,GAAC,CACZ;;;;IAAoB,MAAM,AAA1B,CACA,EADW,MAAM,CACjB;;;;;IAAqB,QAAQ,AAA7B,CAEF,EAFa,OAAO,CAEpB;CAAA,CAAA;AAoCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EARhC,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,CAAC,MAAM,GAAC,MAAM,GAAC,QAAQ,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAQnF,EAAE,OAAO,AANjD,CAEA,EADA;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;CAIsD,GAJ5C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAgC5C;AAoCD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAHtB,MAAM,GAAC,IAGe,GAFpB,OAAO,CAQnB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAH1B,MAAM,GAAC,IAGmB,GAFxB,OAAO,CAOnB;AAqTD;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAHzC,KAGyC,GAFvC,IAAI,CAuBhB;AAqGD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,iBAAiB,CAL1B,CAAC,EAK0B,GAAG,EAJhC,MAIgC,EAAE,KAAK,EAHvC,MAAM,OAAO,CAAC,CAAC,CAGwB,GAFrC,OAAO,CAAC,CAAC,CAAC,CAiBtB;AAyFD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EARlC,GAAG,CAAC,MAAM,EAAE,UAAU,CAQY,EAAE,GAAG,EAPvC,MAOuC,GANrC;IAAC,IAAI,EAAE,GAAC,CAAA;CAAC,GAAC,SAAS,CAoB/B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,IAFlB,OAAO,CAOnB"}
+{"version":3,"file":"fetchBatch.d.ts","sourceRoot":"","sources":["../../../lib/inventory/fetchBatch.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AA8EH;;;GAGG;AACH,wBAAgB,cAAc,IAHjB,MAAM,GAAC,IAAI,CAKvB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAFtB,OAAO,CASnB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,SAO1C;AAKE,YAAkB,UAAU,GAC5B;;;;IAAoB,EAAE,EAAX,OAAO,CAClB;;;;IAAe,IAAI,AAAnB,CACA,EADW,GAAC,CACZ;;;;IAAoB,MAAM,AAA1B,CACA,EADW,MAAM,CACjB;;;;;IAAqB,QAAQ,AAA7B,CAEF,EAFa,OAAO,CAEpB;CAAA,CAAA;AAoCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EARhC,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,CAAC,MAAM,GAAC,MAAM,GAAC,QAAQ,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAQnF,EAAE,OAAO,AANjD,CAEA,EADA;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;CAIsD,GAJ5C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAgC5C;AAoCD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAHtB,MAAM,GAAC,IAGe,GAFpB,OAAO,CAQnB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAH1B,MAAM,GAAC,IAGmB,GAFxB,OAAO,CAOnB;AAwZD;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAHzC,KAGyC,GAFvC,IAAI,CAuBhB;AAqGD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,iBAAiB,CAL1B,CAAC,EAK0B,GAAG,EAJhC,MAIgC,EAAE,KAAK,EAHvC,MAAM,OAAO,CAAC,CAAC,CAGwB,GAFrC,OAAO,CAAC,CAAC,CAAC,CAiBtB;AAyFD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EARlC,GAAG,CAAC,MAAM,EAAE,UAAU,CAQY,EAAE,GAAG,EAPvC,MAOuC,GANrC;IAAC,IAAI,EAAE,GAAC,CAAA;CAAC,GAAC,SAAS,CAoB/B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,IAFlB,OAAO,CAOnB"}

package/types/lib/inventory/plugins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugins.d.ts","sourceRoot":"","sources":["../../../lib/inventory/plugins.js"],"names":[],"mappings":"AAiDA;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAC,CAgCpF;AA8DD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,IAXvB;IACR,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,GAAC,SAAS,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,GAAC,SAAS,CAAC;IACrC,aAAa,EAAE,MAAM,GAAC,SAAS,CAAC;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB,CAqMH;AAYD;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAF1B,UAAU,CAAC,OAAO,oBAAoB,CAAC,CASnD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,AAH5C,CACA,EADQ,UAAU,CAAC,OAAO,oBAAoB,CAGU,GAF9C,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAWnD;AAwDD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAIiC,EAAE,aAAa,AAHxD,CACA,EADQ,UAAU,CAAC,OAAO,oBAAoB,CAGsB,GAF1D,MAAM,GAAC,SAAS,CAS5B"}
+{"version":3,"file":"plugins.d.ts","sourceRoot":"","sources":["../../../lib/inventory/plugins.js"],"names":[],"mappings":"AAiDA;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAC,CAgCpF;AA8DD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,IAXvB;IACR,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,GAAC,SAAS,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,GAAC,SAAS,CAAC;IACrC,aAAa,EAAE,MAAM,GAAC,SAAS,CAAC;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB,CAqMH;AAYD;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAF1B,UAAU,CAAC,OAAO,oBAAoB,CAAC,CASnD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,AAH5C,CACA,EADQ,UAAU,CAAC,OAAO,oBAAoB,CAGU,GAF9C,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAWnD;AAyDD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAIiC,EAAE,aAAa,AAHxD,CACA,EADQ,UAAU,CAAC,OAAO,oBAAoB,CAGsB,GAF1D,MAAM,GAAC,SAAS,CAS5B"}

package/types/lib/inventory/protobom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protobom.d.ts","sourceRoot":"","sources":["../../../lib/inventory/protobom.js"],"names":[],"mappings":"AAaA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAIxD,OAAO,EAAE,cAAc,EAAE,CAAC;AAsB1B;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,gBAH7B,MAAM,GAAC,SAAS,KACd,OAGgE,CAAC;AAE9E;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,gBAHjC,MAAM,GAAC,SAAS,cAChB,MAAM,SAYhB,CAAC;AAgCF;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAJb,MAAM,GAAG,MAAM,WACf,MAAM,gBACN,MAAM,GAAG,MAAM,SAezB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,YAJZ,MAAM,UACN,OAAO,gBACP,MAAM,GAAG,MAAM,4FAiBzB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAJb,MAAM,GAAG,MAAM,gBACf,MAAM,GAAG,MAAM,KACb,MAKV,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,qBAAqB,YALvB,MAAM,GAAG,MAAM,qBACf,MAAM,GAAG,MAAM,gBACf,MAAM,GAAG,MAAM,KACb;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAahD,CAAC"}
+{"version":3,"file":"protobom.d.ts","sourceRoot":"","sources":["../../../lib/inventory/protobom.js"],"names":[],"mappings":"AAaA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAIxD,OAAO,EAAE,cAAc,EAAE,CAAC;AAsB1B;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,gBAH7B,MAAM,GAAC,SAAS,KACd,OAGgE,CAAC;AAE9E;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,gBAHjC,MAAM,GAAC,SAAS,cAChB,MAAM,SAYhB,CAAC;AAgCF;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAJb,MAAM,GAAG,MAAM,WACf,MAAM,gBACN,MAAM,GAAG,MAAM,SAezB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,YAJZ,MAAM,UACN,OAAO,gBACP,MAAM,GAAG,MAAM,4FAwBzB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAJb,MAAM,GAAG,MAAM,gBACf,MAAM,GAAG,MAAM,KACb,MAKV,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,qBAAqB,YALvB,MAAM,GAAG,MAAM,qBACf,MAAM,GAAG,MAAM,gBACf,MAAM,GAAG,MAAM,KACb;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAahD,CAAC"}

package/types/lib/inventory/purl.d.ts

@@ -35,8 +35,17 @@ export declare function purlTypeIsRegistered(type: string): boolean;
  */
 export declare function purlTypeIsRegisteredString(purlString: string): boolean;
 /**
- * Encode a string for safe inclusion in a PackageURL, percent-encoding special characters
- * while preserving already-encoded `%40` sequences and keeping `:` and `/` unencoded.
+ * Encode a string for inclusion in a hand-written PackageURL string,
+ * percent-encoding every character the purl grammar does not allow literally,
+ * while preserving already-encoded `%40` sequences and keeping `:` and `/`
+ * unencoded.
+ *
+ * `encodeURIComponent` alone leaves `!`, `'`, `(`, `)` and `*` literal, and the
+ * purl grammar requires them escaped, so they are escaped here as well.
+ *
+ * Only for comparing against or assembling purl text. Never pass the result to
+ * `build()`, `new Purl()` or one of the helpers in this module: they escape
+ * their inputs themselves, and escaping twice turns `+` into `%252B`.
  *
  * @param {string} s String to encode
  * @returns {string} Encoded string suitable for use in a PackageURL component
@@ -195,6 +204,66 @@ export declare function genericPurl(name: string): string | null;
  * @returns {boolean} true when cdx-purl parses it
  */
 export declare function isValidPurl(candidate: string): boolean;
+/**
+ * Split a purl into its components without requiring it to be well-formed.
+ *
+ * `Purl.parse` rejects a purl whose parts are not already escaped, which is the
+ * case this exists to handle: a `bom-ref` (cdxgen writes the decoded form of the
+ * purl there), a `go mod graph` token such as `github.com/Azure/go-autorest@v14.2.0+incompatible`,
+ * or a purl from a third-party document that left a `+` or a `://` unescaped.
+ * The separators (`:`, `/`, `@`, `?`, `#`, `&`, `=`) are structural and are read
+ * positionally; everything between them is decoded and handed back raw, ready
+ * for `build` to escape correctly.
+ *
+ * The version is taken after the last `@` of the path, so a scoped npm name
+ * (`@scope/name@1.0.0`) and a composer branch version (`dev-feature/x`) both
+ * split correctly.
+ *
+ * @param {string} purl Purl to split
+ * @returns {{type: string, namespace: (string|null), name: string, version: (string|null), qualifiers: (Object|null), subpath: (string|null)}|null} Parts, or null when the purl has no type and name
+ */
+export declare function splitPurlLoose(purl: string): {
+    type: string;
+    namespace: (string | null);
+    name: string;
+    version: (string | null);
+    qualifiers: (Object | null);
+    subpath: (string | null);
+} | null;
+/**
+ * Parse a purl string that may carry unescaped reserved characters.
+ *
+ * A well-formed purl is parsed strictly, so its components come back exactly as
+ * cdx-purl reads them. Anything else is split structurally by
+ * {@link splitPurlLoose}. Use this where the input is known to be a decoded or
+ * hand-written purl (a `bom-ref`, a workspace reference, a package manager's
+ * `name@version` token), never to accept an invalid purl into a `purl` field:
+ * pass the parts to `build()` instead, which escapes them.
+ *
+ * @param {string} purlString Purl or decoded purl
+ * @returns {{type: string, namespace: (string|null), name: string, version: (string|null), qualifiers: (Object|null), subpath: (string|null)}|null} Raw components, or null when nothing purl-shaped remains
+ */
+export declare function parsePurlLoose(purlString: string): {
+    type: string;
+    namespace: (string | null);
+    name: string;
+    version: (string | null);
+    qualifiers: (Object | null);
+    subpath: (string | null);
+} | null;
+/**
+ * Turn a decoded or hand-written purl into a canonical, correctly escaped one.
+ *
+ * `bom-ref` values are the decoded form of a purl
+ * (`pkg:npm/foo@1.0.0+build`), which cdx-purl rightly rejects as a purl. This
+ * recovers the purl the ref was made from by splitting it structurally and
+ * rebuilding it with `build()`, so every reserved character is escaped exactly
+ * once.
+ *
+ * @param {string} purlString Purl or decoded purl
+ * @returns {string|null} Canonical purl string, or `null` when no valid purl can be built
+ */
+export declare function canonicalPurlFromLooseString(purlString: string): string | null;
 /**
  * Parse a purl string, returning `null` instead of throwing when it is invalid.
  *

package/types/lib/inventory/purl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"purl.d.ts","sourceRoot":"","sources":["../../../lib/inventory/purl.js"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,aAAmC,CAAC;AAEtE;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAH1C,MAG0C,GAFxC,OAAO,CASnB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAHpB,MAGoB,GAFlB,MAAM,CAMlB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAHvB,MAGuB,GAFrB,MAAM,GAAC,IAAI,CAcvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAJpB,MAIoB,EAAE,OAAO,AAHrC,CACA,EADQ,MAG6B,GAF3B,MAAM,CAkBlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,MAG4B,GAF1B,MAAM,GAAC,IAAI,CAuBvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAJnB,MAImB,EAAE,OAAO,AAHpC,CACA,EADQ,MAG4B,GAF1B,MAAM,GAAC,IAAI,CAQvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAJlB,MAIkB,EAAE,OAAO,AAHnC,CACA,EADQ,MAG2B,GAFzB,MAAM,GAAC,IAAI,CAQvB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAJpB,MAIoB,EAAE,OAAO,AAHrC,CACA,EADQ,MAG6B,GAF3B,MAAM,CAQlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,KAAK,EANpB,MAMoB,EAAE,IAAI,EAL1B,MAK0B,EAAE,OAAO,AAJ3C,CACA,EADQ,MAImC,EAAE,UAAU,AAHvD,CACA,EADQ,MAG+C,GAF7C,MAAM,GAAC,IAAI,CAUvB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,IAAI,EALxB,MAKwB,EAAE,OAAO,AAJzC,CACA,EADQ,MAIiC,EAAE,UAAU,AAHrD,CACA,EADQ,MAG6C,GAF3C,MAAM,GAAC,IAAI,CASvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAHnB,MAGmB,GAFjB,MAAM,CAIlB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAHrB,MAGqB,GAFnB,MAAM,GAAC,IAAI,CAOvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAH1B,MAG0B,GAFxB,OAAO,CAYnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAH5B,MAG4B,GAF1B,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAH7B,MAG6B,GAF3B,MAAM,CAQlB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,SAAS,CAAC,SAAS,EALxB,MAKwB,EAAE,UAAU,EAJpC,MAAM,GAAC,IAI6B,EAAE,WAAW,AAHzD,CACA,EADQ,MAGiD,GAF/C,MAAM,CAWlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAJnC,MAImC,EAAE,QAAQ,AAHrD,CACA,EADQ,MAG6C,GAF3C,MAAM,CAiClB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CAAC,UAAU,EAJvB,MAIuB,EAAE,GAAG,AAHpC,CACA,EADQ,MAG4B,GAF1B,MAAM,GAAC,IAAI,CA4BvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAL3B,MAK2B,EAAE,OAAO,EAJpC,MAIoC,EAAE,OAAO,EAH7C,MAG6C,GAF3C,UAAU,GAAC,SAAS,CAuDhC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,UAExC;AAwCD;;;;;;;;;GASG;AACH,wBAAgB,2CAA2C,CAAC,WAAW,EAH5D,MAG4D,GAF1D,CAAC,MAAM,GAAC,IAAI,CAAC,EAAE,CA6H3B"}
+{"version":3,"file":"purl.d.ts","sourceRoot":"","sources":["../../../lib/inventory/purl.js"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,aAAmC,CAAC;AAEtE;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAH1C,MAG0C,GAFxC,OAAO,CASnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAHpB,MAGoB,GAFlB,MAAM,CAYlB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAHvB,MAGuB,GAFrB,MAAM,GAAC,IAAI,CAcvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAJpB,MAIoB,EAAE,OAAO,AAHrC,CACA,EADQ,MAG6B,GAF3B,MAAM,CAkBlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,MAG4B,GAF1B,MAAM,GAAC,IAAI,CAuBvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAJnB,MAImB,EAAE,OAAO,AAHpC,CACA,EADQ,MAG4B,GAF1B,MAAM,GAAC,IAAI,CAQvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAJlB,MAIkB,EAAE,OAAO,AAHnC,CACA,EADQ,MAG2B,GAFzB,MAAM,GAAC,IAAI,CAQvB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAJpB,MAIoB,EAAE,OAAO,AAHrC,CACA,EADQ,MAG6B,GAF3B,MAAM,CAQlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,KAAK,EANpB,MAMoB,EAAE,IAAI,EAL1B,MAK0B,EAAE,OAAO,AAJ3C,CACA,EADQ,MAImC,EAAE,UAAU,AAHvD,CACA,EADQ,MAG+C,GAF7C,MAAM,GAAC,IAAI,CAUvB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,IAAI,EALxB,MAKwB,EAAE,OAAO,AAJzC,CACA,EADQ,MAIiC,EAAE,UAAU,AAHrD,CACA,EADQ,MAG6C,GAF3C,MAAM,GAAC,IAAI,CASvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAHnB,MAGmB,GAFjB,MAAM,CAIlB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAHrB,MAGqB,GAFnB,MAAM,GAAC,IAAI,CAOvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAH1B,MAG0B,GAFxB,OAAO,CAYnB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAHxB,MAGwB,GAFtB;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;IAAC,UAAU,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAA;CAAC,GAAC,IAAI,CA6DlJ;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAH9B,MAG8B,GAF5B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;IAAC,UAAU,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAA;CAAC,GAAC,IAAI,CAsBlJ;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAAC,UAAU,EAH5C,MAG4C,GAF1C,MAAM,GAAC,IAAI,CAQvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAH5B,MAG4B,GAF1B,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAH7B,MAG6B,GAF3B,MAAM,CAQlB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,SAAS,CAAC,SAAS,EALxB,MAKwB,EAAE,UAAU,EAJpC,MAAM,GAAC,IAI6B,EAAE,WAAW,AAHzD,CACA,EADQ,MAGiD,GAF/C,MAAM,CAWlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAJnC,MAImC,EAAE,QAAQ,AAHrD,CACA,EADQ,MAG6C,GAF3C,MAAM,CAiClB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CAAC,UAAU,EAJvB,MAIuB,EAAE,GAAG,AAHpC,CACA,EADQ,MAG4B,GAF1B,MAAM,GAAC,IAAI,CA4BvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAL3B,MAK2B,EAAE,OAAO,EAJpC,MAIoC,EAAE,OAAO,EAH7C,MAG6C,GAF3C,UAAU,GAAC,SAAS,CAuDhC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,UAExC;AAwCD;;;;;;;;;GASG;AACH,wBAAgB,2CAA2C,CAAC,WAAW,EAH5D,MAG4D,GAF1D,CAAC,MAAM,GAAC,IAAI,CAAC,EAAE,CA6H3B"}

package/types/lib/inventory/sbomDocument.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sbomDocument.d.ts","sourceRoot":"","sources":["../../../lib/inventory/sbomDocument.js"],"names":[],"mappings":"AAqBA;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAF1B,MAE4C,CAAC;AAsBvD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAPK,MAOL,EACJ,EAAE,MAAkB,EAAE,QAAkC,EAAE,AAPzD,CAGA,EAFA;IAAuB,MAAM,AAA7B,CACA,EADQ,MAAM,CACd;IAAuB,QAAQ,AAA/B,CACA,EADQ,MAAM,CACd;CAI8D,GAJpD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAA;CAAC,GAAC,IAAI,CAoE5G;AA6FD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAFzB,MAEyB,QAsBnC;AAsDD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAJjC,MAAM,EAI2B,EAAE,UAAU,EAH7C,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAGU,GAF3C,MAAM,EAAE,CAoBpB"}
+{"version":3,"file":"sbomDocument.d.ts","sourceRoot":"","sources":["../../../lib/inventory/sbomDocument.js"],"names":[],"mappings":"AAsBA;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAF1B,MAE4C,CAAC;AAsBvD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAPK,MAOL,EACJ,EAAE,MAAkB,EAAE,QAAkC,EAAE,AAPzD,CAGA,EAFA;IAAuB,MAAM,AAA7B,CACA,EADQ,MAAM,CACd;IAAuB,QAAQ,AAA/B,CACA,EADQ,MAAM,CACd;CAI8D,GAJpD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAA;CAAC,GAAC,IAAI,CAoE5G;AAwBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAFzB,MAEyB,QAsBnC;AAsDD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAJjC,MAAM,EAI2B,EAAE,UAAU,EAH7C,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAGU,GAF3C,MAAM,EAAE,CAoBpB"}

package/types/lib/inventory/source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../lib/inventory/source.js"],"names":[],"mappings":"AAoCA,6FAA6F;AAC7F,eAAO,MAAM,4BAA4B,wIAC8F,CAAC;AAExI,6DAA6D;AAC7D,eAAO,MAAM,2BAA2B,UAWvC,CAAC;AAuBF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAAM,GAAC,SAGsB,GAF3B,OAAO,CAUnB;AAiBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAL5B,MAAM,EAKsB,EAAE,OAAO,GAH7C;IAAkC,GAAG,EAA7B,MAAM,GAAC,SAAS,CACxB;CAEkD,GAFxC,MAAM,CAuClB;AA+ED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAAM,GAAC,SAI+B,EAAE,OAAO,GAH/C,MAGoD,GAFlD,MAAM,GAAC,SAAS,CA6I5B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,CASlB;AAkBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,OAAO,CAWnB;AAkBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAHvB,MAGuB,GAFrB,OAAO,CA+BnB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAHpB,MAGoB,GAFlB,OAAO,CAyBnB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAHxC,MAGwC,GAFtC,MAAM,GAAC,IAAI,CAgEvB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAJrB,MAIqB,EAAE,MAAM,GAH7B,MAAM,GAAC,MAAM,EAAE,GAAC,IAGoB,GAFlC,MAAM,CAyDlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAAM,GAAC,SAGgC,GAFrC,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAJrC,MAIqC,EAAE,cAAc,EAHrD,MAAM,GAAC,SAG8C,GAFnD,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAJtC,MAIsC,EAAE,cAAc,EAHtD,MAAM,GAAC,SAG+C,GAFpD,MAAM,GAAC,SAAS,CAiF5B;AAoHD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAGkC,GAFhC;IAAC,MAAM,EAAC,MAAM,CAAC;IAAA,KAAK,EAAC,MAAM,CAAC;IAAA,OAAO,EAAC,MAAM,CAAA;CAAC,GAAC,IAAI,CA8D5D;AA6GD;;GAEG;AACH,wBAAgB,yBAAyB,SAExC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,WAAW,EAJ5C,KAAK,CAAC,MAAM,CAIgC,GAF1C,OAAO,CAAC,IAAI,CAAC,CA6BzB;AA8DD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CA4MlI;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAF5B,MAE4B,QAkCtC"}
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../lib/inventory/source.js"],"names":[],"mappings":"AAqCA,6FAA6F;AAC7F,eAAO,MAAM,4BAA4B,wIAC8F,CAAC;AAExI,6DAA6D;AAC7D,eAAO,MAAM,2BAA2B,UAWvC,CAAC;AAuBF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAAM,GAAC,SAGsB,GAF3B,OAAO,CAUnB;AAiBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAL5B,MAAM,EAKsB,EAAE,OAAO,GAH7C;IAAkC,GAAG,EAA7B,MAAM,GAAC,SAAS,CACxB;CAEkD,GAFxC,MAAM,CAuClB;AA+ED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAAM,GAAC,SAI+B,EAAE,OAAO,GAH/C,MAGoD,GAFlD,MAAM,GAAC,SAAS,CA6I5B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,CASlB;AAkBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,OAAO,CAWnB;AAkBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAHvB,MAGuB,GAFrB,OAAO,CA+BnB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAHpB,MAGoB,GAFlB,OAAO,CAyBnB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAHxC,MAGwC,GAFtC,MAAM,GAAC,IAAI,CAgEvB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAJrB,MAIqB,EAAE,MAAM,GAH7B,MAAM,GAAC,MAAM,EAAE,GAAC,IAGoB,GAFlC,MAAM,CAyDlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAAM,GAAC,SAGgC,GAFrC,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAJrC,MAIqC,EAAE,cAAc,EAHrD,MAAM,GAAC,SAG8C,GAFnD,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAJtC,MAIsC,EAAE,cAAc,EAHtD,MAAM,GAAC,SAG+C,GAFpD,MAAM,GAAC,SAAS,CAiF5B;AAkJD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAGkC,GAFhC;IAAC,MAAM,EAAC,MAAM,CAAC;IAAA,KAAK,EAAC,MAAM,CAAC;IAAA,OAAO,EAAC,MAAM,CAAA;CAAC,GAAC,IAAI,CA4D5D;AA6GD;;GAEG;AACH,wBAAgB,yBAAyB,SAExC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,WAAW,EAJ5C,KAAK,CAAC,MAAM,CAIgC,GAF1C,OAAO,CAAC,IAAI,CAAC,CA6BzB;AAmDD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CA4MlI;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAF5B,MAE4B,QAkCtC"}

package/types/lib/inventory/traceRunner.d.ts

@@ -1,3 +1,11 @@
+/**
+ * Whether the @cdxgen/safer-exec tracing runtime could be loaded. When false,
+ * dynamic tracing cannot run at all, and every trace would otherwise exit 0
+ * with a valid but empty BOM, hiding the broken installation (#4378).
+ *
+ * @returns {boolean} True when the tracing runtime is available
+ */
+export declare function isSaferExecAvailable(): boolean;
 /**
  * Parses a command string into command and arguments array.
  * @param {string} cmdStr - Command string to parse
@@ -40,7 +48,19 @@ export declare function resolveSaferExecBinary(): string | undefined;
  * @param {boolean} [options.traceExec] - Log every child process spawned
  * @param {string[]} [options.allowExec] - Executables the command is allowed to run
  * @param {string[]} [options.blockExec] - Executables to block from running
- * @returns {Promise<{libPaths: string[], httpAccessEntries: Object[]}>} Collected libraries and HTTP URLs
+ * @param {boolean} [options.proxyEgress] - Route egress through safer-exec's hostname-pinning proxy (network stays enabled; only allowHosts are reachable)
+ * @param {boolean} [options.allowLoopback] - Allow loopback connections
+ * @param {boolean} [options.dryRun] - Deny every filesystem and network side effect and collect a dry-run report
+ * @param {string} [options.policy] - Named safer-exec ecosystem policy (npm, pypi, maven, ...)
+ * @param {string} [options.policyFile] - Path to a safer-exec JSON policy file
+ * @param {boolean} [options.blockInterpreters] - Block interpreters with sandbox or task-port exemptions (macOS)
+ * @param {boolean} [options.denyPersistenceWrites] - Deny writes to auto-execution and persistence locations
+ * @param {boolean} [options.privateTmp] - Private tmpfs /tmp and /var/tmp (Linux)
+ * @param {string} [options.protectHome] - Home isolation: read-only, tmpfs, or off (Linux)
+ * @returns {Promise<{libPaths: string[], httpAccessEntries: Object[], egressEntries?: Object[], dryRunSummary?: Object}>} Collected libraries, HTTP URLs, proxy egress decisions, and the dry-run summary
+ * @throws {Error} When the @cdxgen/safer-exec tracing runtime is not installed
+ *   (for example after pruning it from a standalone payload), since the traced
+ *   command could never run and the BOM would silently be empty
  */
 export declare function executeAndTrace(commandStr: string, workingDir?: string, options?: {
     readPaths?: string[];
@@ -62,10 +82,36 @@ export declare function executeAndTrace(commandStr: string, workingDir?: string,
     traceExec?: boolean;
     allowExec?: string[];
     blockExec?: string[];
+    proxyEgress?: boolean;
+    allowLoopback?: boolean;
+    dryRun?: boolean;
+    policy?: string;
+    policyFile?: string;
+    blockInterpreters?: boolean;
+    denyPersistenceWrites?: boolean;
+    privateTmp?: boolean;
+    protectHome?: string;
 }): Promise<{
     libPaths: string[];
     httpAccessEntries: Object[];
+    egressEntries?: Object[];
+    dryRunSummary?: Object;
 }>;
+/**
+ * Extracts the egress proxy's decisions from a safer-exec audit log.
+ * "proxy-connect" targets are "host:port"; "proxy-violation" targets are
+ * "CONNECT host:port" or "METHOD http://host[:port]/path". Only the authority
+ * is kept, never a path or query.
+ *
+ * @param {Object[]} auditLog - safer-exec audit entries
+ * @returns {{host: string, port: number, protocol: string, decision: string}[]} Unique egress decisions
+ */
+export declare function parseEgressEntries(auditLog: Object[]): {
+    host: string;
+    port: number;
+    protocol: string;
+    decision: string;
+}[];
 /**
  * Groups HTTP access entries into a CycloneDX services-ready map.
  * Each unique (host, port, protocol) combination becomes a service.

package/types/lib/inventory/traceRunner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"traceRunner.d.ts","sourceRoot":"","sources":["../../../lib/inventory/traceRunner.js"],"names":[],"mappings":"AAyBA;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAHxB,MAGwB,GAFtB;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,CA6BzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAFzB,MAAM,GAAC,SAAS,CAoE5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAxBrC,MAwBqC,EAAE,UAAU,AAvBzD,CACA,EADQ,MAuBiD,EAAE,OAAO,AAtBlE,CAoBA,EAnBA;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;IAA0B,cAAc,AAAxC,CACA,EADQ,OAAO,CACf;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;CAEuE,GAF7D,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CAyOtE;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,iBAAiB,EAHjD,MAAM,EAG2C;eAFlB,GAAG,CAAC,MAAM,CAAC;gBAAc,MAAM,EAAE;GAuC1E"}
+{"version":3,"file":"traceRunner.d.ts","sourceRoot":"","sources":["../../../lib/inventory/traceRunner.js"],"names":[],"mappings":"AAsBA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAFvB,OAAO,CAInB;AAKD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAHxB,MAGwB,GAFtB;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,CA6BzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAFzB,MAAM,GAAC,SAAS,CAsE5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAsB,eAAe,CAAC,UAAU,EApCrC,MAoCqC,EAAE,UAAU,AAnCzD,CACA,EADQ,MAmCiD,EAAE,OAAO,AAlClE,CA6BA,EA5BA;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;IAA0B,cAAc,AAAxC,CACA,EADQ,OAAO,CACf;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAAyB,MAAM,AAA/B,CACA,EADQ,MAAM,CACd;IAAyB,UAAU,AAAnC,CACA,EADQ,MAAM,CACd;IAA0B,iBAAiB,AAA3C,CACA,EADQ,OAAO,CACf;IAA0B,qBAAqB,AAA/C,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;CAKuE,GAL7D,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAC,CAAC,CAwTxH;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAHhC,MAAM,EAG0B,GAF9B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,EAAE,CAkD9E;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,iBAAiB,EAHjD,MAAM,EAG2C;eAFlB,GAAG,CAAC,MAAM,CAAC;gBAAc,MAAM,EAAE;GA+C1E"}