@cdxgen/cdxgen 13.2.0 → 13.4.0

package/types/lib/cli/jvmBom.d.ts

@@ -18,6 +18,25 @@ export declare const GRADLE_INIT_SCRIPT: string;
  * @type {string}
  */
 export declare const SBT_CACHE_DIR: string;
+/**
+ * Collect the namespaces of the jars of resolved sbt dependencies. sbt has
+ * just downloaded them into the user's caches, so each is read from there;
+ * the rest of the cache is never walked.
+ *
+ * @param {Object[]} pkgList Packages from the sbt dependency trees.
+ * @param {Object} [known] Jar namespace mapping already collected. Packages
+ *   it covers are skipped.
+ * @returns {Promise<Object>} Jar namespace mapping keyed by package purl.
+ */
+export declare function collectSbtDependencyJars(pkgList: Object[], known?: Object): Promise<Object>;
+/**
+ * The purls and bom-refs of a parent component and the module components
+ * nested under it.
+ *
+ * @param {Object} parentComponent Parent component.
+ * @returns {Set<string>} Purls and bom-refs.
+ */
+export declare function ownComponentRefs(parentComponent: Object): Set<string>;
 /**
  * Function to create bom string for Java jars
  *
@@ -34,15 +53,19 @@ export declare function createJarBom(path: string, options: Object): Object;
  * (commented-out code, examples, values that merely resemble project defs) that
  * can lead to hangs when those bogus scopes are later passed to `dependencyTree`.
  *
+ * The root project is kept when it has sources of its own, since it is then
+ * the application rather than a pure aggregator.
+ *
  * Falls back to the regex-based {@link discoverSbtProjects} heuristic when the
  * sbt invocation fails or yields nothing useful.
  *
  * @param {string} basePath Directory of the sbt build
  * @param {string} sbtCmd sbt executable
  * @param {Object} env Environment for the spawned process
+ * @param {string[]} [launcherArgs] Launcher options placed before the sbt arguments
  * @returns {string[]} List of sbt project ids
  */
-export declare function discoverSbtProjectsFromCmd(basePath: string, sbtCmd: string, env: Object): string[];
+export declare function discoverSbtProjectsFromCmd(basePath: string, sbtCmd: string, env: Object, launcherArgs?: string[]): string[];
 /**
  * Function to create bom string for Java projects
  *

package/types/lib/cli/jvmBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jvmBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jvmBom.js"],"names":[],"mappings":"AAiGA;;;;;GAKG;AACH,eAAO,IAAI,gBAAgB,EAFjB,MAIsD,CAAC;AAUjE;;;;GAIG;AAEH,eAAO,MAAM,kBAAkB,EAHrB,MAQT,CAAC;AAEF;;;;;GAKG;AAEH,eAAO,MAAM,aAAa,EAHhB,MAIqE,CAAC;AAEhF;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAL5B,MAK4B,EAAE,OAAO,EAJrC,MAIqC,GAFnC,MAAM,CA8ElB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EALxC,MAKwC,EAAE,MAAM,EAJhD,MAIgD,EAAE,GAAG,EAHrD,MAGqD,GAFnD,MAAM,EAAE,CA8DpB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAwtD3B"}
+{"version":3,"file":"jvmBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jvmBom.js"],"names":[],"mappings":"AA0HA;;;;;GAKG;AACH,eAAO,IAAI,gBAAgB,EAFjB,MAIsD,CAAC;AAUjE;;;;GAIG;AAEH,eAAO,MAAM,kBAAkB,EAHrB,MAQT,CAAC;AAEF;;;;;GAKG;AAEH,eAAO,MAAM,aAAa,EAHhB,MAIqE,CAAC;AAuDhF;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAL3C,MAAM,EAKqC,EAAE,KAAK,AAJ1D,CAEA,EAFQ,MAIuD,GAFrD,OAAO,CAAC,MAAM,CAAC,CA2B3B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,eAAe,EAHrC,MAGqC,GAFnC,GAAG,CAAC,MAAM,CAAC,CAwBvB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAL5B,MAK4B,EAAE,OAAO,EAJrC,MAIqC,GAFnC,MAAM,CAmFlB;AAiCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAPC,MAOD,EACR,MAAM,EAPG,MAOH,EACN,GAAG,EAPM,MAON,EACH,YAAY,AAPX,CACA,EADQ,MAAM,EAOE,GANN,MAAM,EAAE,CAwEpB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAqkE3B"}

package/types/lib/cli/managedBom.d.ts

@@ -127,12 +127,15 @@ export declare function createPerlBom(path: string, options: Object): Object;
 /**
  * Function to create bom string for Terraform and OpenTofu projects.
  *
- * The `.terraform.lock.hcl` file pins the providers the configuration
- * resolves to, with content hashes suitable for the CycloneDX hashes array.
+ * The workspace assembly turns the provider lock file, the module manifest
+ * `init` writes and the configuration files into module and provider
+ * components with a dependency graph and offline licenses. When metadata
+ * fetching is enabled, the public registries add licenses, repository URLs
+ * and registry flags to components the offline pass could not resolve.
  *
  * @param {string} path to the project
  * @param {Object} options Parse options from the cli
- * @returns {Object} BOM object
+ * @returns {Promise<Object>} BOM object
  */
-export declare function createTerraformBom(path: string, options: Object): Object;
+export declare function createTerraformBom(path: string, options: Object): Promise<Object>;
 //# sourceMappingURL=managedBom.d.ts.map

package/types/lib/cli/managedBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"managedBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/managedBom.js"],"names":[],"mappings":"AA4HA;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,QAJ5B,MAAM,YACN,MAAM,KACJ,OAMZ,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAJ1B,MAAM,YACN,MAAM,KACJ,OAeZ,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,QAAA,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,GAAG,IAAI,CAsEzB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CA2pB3B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CAyBlB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CA2C3B;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CA0BlB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CA+LlB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAkS3B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAsfrC;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAJpC,MAIoC,EAAE,OAAO,EAH7C,MAG6C,GAF3C,OAAO,CAAC,MAAM,CAAC,CAmF3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAJpB,MAIoB,EAAE,OAAO,EAH7B,MAG6B,GAF3B,MAAM,CA2DlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CAmClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,MAAM,CAyBlB"}
+{"version":3,"file":"managedBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/managedBom.js"],"names":[],"mappings":"AAwIA;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,QAJ5B,MAAM,YACN,MAAM,KACJ,OAMZ,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAJ1B,MAAM,YACN,MAAM,KACJ,OAeZ,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,QAAA,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,GAAG,IAAI,CAsEzB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CA+rB3B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CAyBlB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CA2C3B;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CA0BlB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CA+LlB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAuU3B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAylBrC;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAJpC,MAIoC,EAAE,OAAO,EAH7C,MAG6C,GAF3C,OAAO,CAAC,MAAM,CAAC,CAmF3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAJpB,MAIoB,EAAE,OAAO,EAH7B,MAG6B,GAF3B,MAAM,CA2DlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CAmClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC,OAAO,CAAC,MAAM,CAAC,CA6B3B"}

package/types/lib/cli/nativeBom.d.ts

@@ -25,7 +25,9 @@ export declare function createRustBom(path: any, options: any): Promise<Object |
 export declare function buildCargoCacheComponent(crateFile: string): object | undefined;
 /**
  * Enriches a cargo cache component with a SHA-256 hash and filename-based
- * identity evidence (confidence 0.5). Hash computation failures are ignored.
+ * identity evidence (confidence 0.5), and with what the archive's own manifest
+ * says: its licence, description and repository, read from the archive without
+ * extracting it anywhere. Hash computation failures are ignored.
  *
  * @param {string} crateFile Absolute path to the `.crate` archive
  * @param {object} [component] Component produced by `buildCargoCacheComponent`

package/types/lib/cli/nativeBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nativeBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/nativeBom.js"],"names":[],"mappings":"AA4KA;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,GAAC,SAAS,CAU5B;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAkdvC;AA2PD,wBAAsB,aAAa,CAAC,IAAI,KAAA,EAAE,OAAO,KAAA,+BAyLhD;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,GAAC,SAAS,CAiC5B;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,SAAS,EAJ9C,MAI8C,EAAE,SAAS,AAHjE,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA8BrC;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAJnC,MAImC,EAAE,OAAO,EAH5C,MAG4C,GAF1C,OAAO,CAAC,MAAM,CAAC,CAwB3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CA0E3B;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CAkZlB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CAmJlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,MAAM,EAAE,CA0BpB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CAiElB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CAiClB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwJ3B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuLvC;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CAkI3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA4D3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwD3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAsE3B;AAqBD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAyB3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA4B3B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CAoE3B;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CAuC3B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA0C3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA2D3B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwD3B"}
+{"version":3,"file":"nativeBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/nativeBom.js"],"names":[],"mappings":"AAwLA;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,GAAC,SAAS,CAU5B;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAoevC;AA2PD,wBAAsB,aAAa,CAAC,IAAI,KAAA,EAAE,OAAO,KAAA,+BAyLhD;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,GAAC,SAAS,CAiC5B;AAED;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAAC,SAAS,EAJ9C,MAI8C,EAAE,SAAS,AAHjE,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAyDrC;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAJnC,MAImC,EAAE,OAAO,EAH5C,MAG4C,GAF1C,OAAO,CAAC,MAAM,CAAC,CAwB3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CA0E3B;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CA4elB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CAmJlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,MAAM,EAAE,CA0BpB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CAiElB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CAiClB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA+N3B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuLvC;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CAkI3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA4D3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwD3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAsE3B;AAqBD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAyB3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA4B3B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CAoE3B;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CAuC3B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA0C3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA2D3B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwD3B"}

package/types/lib/core/activity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"activity.d.ts","sourceRoot":"","sources":["../../../lib/core/activity.js"],"names":[],"mappings":"AAOA,oFAAoF;AACpF,eAAO,MAAM,UAAU,SAEkB,CAAC;AAE1C,+GAA+G;AAC/G,eAAO,MAAM,YAAY,KAE4B,CAAC;AAQtD,8IAA8I;AAC9I,eAAO,IAAI,QAAQ,KACkD,CAAC;AAEtE,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,mBAAmB,CAAC;AAsWnD,gJAAgJ;AAChJ,QAAA,MAAM,oBAAoB,UADd,MAAM,KAA4D,MACA,CAAC;AAe/E;;;;;;;GAOG;AACH,iBAAS,oBAAoB,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;GAKG;AACH,iBAAS,wBAAwB,CAAC,OAAO,EAH9B,MAAM,GAAC,MAAM,EAGiB,GAF5B;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAqClD;AA0BD;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAH/C,MAG+C,GAF7C,OAAO,CAInB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EALhC,MAKgC,EAAE,MAAM,EAJxC,MAIwC,EAAE,OAAO,AAHzD,CACA,EADQ,MAGsD,GAFpD,MAAM,GAAC,SAAS,CA4B5B;AAED,0KAA0K;AAC1K,wBAAgB,sBAAsB,CAAC,MAAM,EADjC,MACiC,EAAE,OAAO,AADV,CAAuE,EAA/D,MACO,GADkE,MAAM,GAAC,SAAS,CAG5I;AAED,0KAA0K;AAC1K,wBAAgB,uBAAuB,CAAC,MAAM,EADlC,MACkC,EAAE,OAAO,AADX,CAAuE,EAA/D,MACQ,GADiE,MAAM,GAAC,SAAS,CAG5I;AAED,0KAA0K;AAC1K,wBAAgB,oBAAoB,CAAC,MAAM,EAD/B,MAC+B,EAAE,OAAO,AADR,CAAuE,EAA/D,MACK,GADoE,MAAM,GAAC,SAAS,CAG5I;AA2CD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAND,MAMC,EACV,YAAY,EANH,MAMG,EACZ,OAAO,AANN,CACA,EADQ,MAMG,GALD,MAAM,GAAC,SAAS,CAuC5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAJlC,MAIkC,EAAE,OAAO,AAHnD,CACA,EADQ,MAGgD,GAF9C,MAAM,GAAC,SAAS,CA2B5B;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAJrC,MAIqC,EAAE,OAAO,AAHtD,CACA,EADQ,MAGmD,GAFjD,MAAM,GAAC,SAAS,CAgC5B;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAJpC,MAIoC,EAAE,OAAO,AAHrD,CACA,EADQ,MAGkD,GAFhD,MAAM,GAAC,SAAS,CAK5B;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,OAG0B,GAFxB,IAAI,CAShB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAL7B,MAK6B,EAAE,MAAM,EAJrC,MAIqC,EAAE,MAAM,AAHrD,CACA,EADQ,MAG6C,GAF3C,KAAK,CAYjB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAHxB,KAGwB,GAFtB,OAAO,CAInB;AAED,0HAA0H;AAC1H,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAJlC,MAIkC,EAAE,MAAM,EAH1C,MAG0C,GAFxC,KAAK,CASjB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,AAHvC,CACA,EADQ,MAGoC,GAFlC,IAAI,CAOhB;AAED,0DAA0D;AAC1D,wBAAgB,oBAAoB,IADc,IAAI,CAGrD;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CAgB5B;AAID,wEAAwE;AACxE,wBAAgB,qBAAqB,IADvB,MAAM,EAAE,CAGrB;AAED,oEAAoE;AACpE,wBAAgB,uBAAuB,IADqB,IAAI,CAO/D;AAED;;;;;;;;;GASG;AACH,iBAAS,wBAAwB,CAC/B,IAAI,EARK,MAQL,EACJ,MAAM,EARG,MAQH,EACN,MAAM,EARG,MAQH,EACN,MAAM,AARL,CACA,EADQ,MAQS,EAClB,QAAQ,AARP,CACA,EADQ,MAQI,GAPF,MAAM,GAAC,SAAS,CAgB5B;AAED,0EAA0E;AAC1E,eAAO,MAAM,mBAAmB,UAAY,CAAC;AAE7C;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EALC,MAKD,EACR,eAAe,AALd,CACA,EADQ,MAKwD,GAJtD,OAAO,CA+BnB;AAED;;;;;GAKG;AAEH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,GAH1B,OAAO,CAmBnB;AAmED,uLAAuL;AACvL,eAAO,MAAM,WAAW,UAyItB,CAAC;AAEH,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,GACzB,CAAC"}
+{"version":3,"file":"activity.d.ts","sourceRoot":"","sources":["../../../lib/core/activity.js"],"names":[],"mappings":"AAOA,oFAAoF;AACpF,eAAO,MAAM,UAAU,SAEkB,CAAC;AAE1C,+GAA+G;AAC/G,eAAO,MAAM,YAAY,KAE4B,CAAC;AAQtD,8IAA8I;AAC9I,eAAO,IAAI,QAAQ,KACkD,CAAC;AAEtE,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,mBAAmB,CAAC;AAkXnD,gJAAgJ;AAChJ,QAAA,MAAM,oBAAoB,UADd,MAAM,KAA4D,MACA,CAAC;AAe/E;;;;;;;GAOG;AACH,iBAAS,oBAAoB,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;GAKG;AACH,iBAAS,wBAAwB,CAAC,OAAO,EAH9B,MAAM,GAAC,MAAM,EAGiB,GAF5B;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAqClD;AA0BD;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAH/C,MAG+C,GAF7C,OAAO,CAInB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EALhC,MAKgC,EAAE,MAAM,EAJxC,MAIwC,EAAE,OAAO,AAHzD,CACA,EADQ,MAGsD,GAFpD,MAAM,GAAC,SAAS,CA4B5B;AAED,0KAA0K;AAC1K,wBAAgB,sBAAsB,CAAC,MAAM,EADjC,MACiC,EAAE,OAAO,AADV,CAAuE,EAA/D,MACO,GADkE,MAAM,GAAC,SAAS,CAG5I;AAED,0KAA0K;AAC1K,wBAAgB,uBAAuB,CAAC,MAAM,EADlC,MACkC,EAAE,OAAO,AADX,CAAuE,EAA/D,MACQ,GADiE,MAAM,GAAC,SAAS,CAG5I;AAED,0KAA0K;AAC1K,wBAAgB,oBAAoB,CAAC,MAAM,EAD/B,MAC+B,EAAE,OAAO,AADR,CAAuE,EAA/D,MACK,GADoE,MAAM,GAAC,SAAS,CAG5I;AA2CD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAND,MAMC,EACV,YAAY,EANH,MAMG,EACZ,OAAO,AANN,CACA,EADQ,MAMG,GALD,MAAM,GAAC,SAAS,CAuC5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAJlC,MAIkC,EAAE,OAAO,AAHnD,CACA,EADQ,MAGgD,GAF9C,MAAM,GAAC,SAAS,CA2B5B;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAJrC,MAIqC,EAAE,OAAO,AAHtD,CACA,EADQ,MAGmD,GAFjD,MAAM,GAAC,SAAS,CAgC5B;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAJpC,MAIoC,EAAE,OAAO,AAHrD,CACA,EADQ,MAGkD,GAFhD,MAAM,GAAC,SAAS,CAK5B;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,OAG0B,GAFxB,IAAI,CAShB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAL7B,MAK6B,EAAE,MAAM,EAJrC,MAIqC,EAAE,MAAM,AAHrD,CACA,EADQ,MAG6C,GAF3C,KAAK,CAYjB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAHxB,KAGwB,GAFtB,OAAO,CAInB;AAED,0HAA0H;AAC1H,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAJlC,MAIkC,EAAE,MAAM,EAH1C,MAG0C,GAFxC,KAAK,CASjB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,AAHvC,CACA,EADQ,MAGoC,GAFlC,IAAI,CAOhB;AAED,0DAA0D;AAC1D,wBAAgB,oBAAoB,IADc,IAAI,CAGrD;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CAgB5B;AAID,wEAAwE;AACxE,wBAAgB,qBAAqB,IADvB,MAAM,EAAE,CAGrB;AAED,oEAAoE;AACpE,wBAAgB,uBAAuB,IADqB,IAAI,CAO/D;AAED;;;;;;;;;GASG;AACH,iBAAS,wBAAwB,CAC/B,IAAI,EARK,MAQL,EACJ,MAAM,EARG,MAQH,EACN,MAAM,EARG,MAQH,EACN,MAAM,AARL,CACA,EADQ,MAQS,EAClB,QAAQ,AARP,CACA,EADQ,MAQI,GAPF,MAAM,GAAC,SAAS,CAgB5B;AAED,0EAA0E;AAC1E,eAAO,MAAM,mBAAmB,UAAY,CAAC;AAE7C;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EALC,MAKD,EACR,eAAe,AALd,CACA,EADQ,MAKwD,GAJtD,OAAO,CA+BnB;AAED;;;;;GAKG;AAEH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,GAH1B,OAAO,CAmBnB;AAmED,uLAAuL;AACvL,eAAO,MAAM,WAAW,UAyItB,CAAC;AAEH,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,GACzB,CAAC"}

package/types/lib/core/env.d.ts

@@ -30,6 +30,15 @@ export declare function parseMavenArgs(argsString: string): string[];
  * @returns {boolean} True if the FETCH_LICENSE env var is set to "true" or "1"
  */
 export declare function shouldFetchLicense(): boolean;
+/**
+ * Determines whether registry provenance, such as publish times, publishers
+ * and trusted-publishing signals, is wanted. `--bom-audit` turns it on through
+ * CDXGEN_FETCH_PKG_METADATA. Local data cannot answer these questions, so a
+ * package whose licence and description are known locally is still looked up.
+ *
+ * @returns {boolean} True if CDXGEN_FETCH_PKG_METADATA is "true" or "1"
+ */
+export declare function shouldFetchRegistryProvenance(): boolean;
 /**
  * Determines whether remote package metadata should be fetched for enrichment.
  *

package/types/lib/core/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../lib/core/env.js"],"names":[],"mappings":"AAUA,uCAAuC;AACvC,eAAO,MAAM,MAAM,SAAmD,CAAC;AACvE,mCAAmC;AACnC,eAAO,MAAM,KAAK,SAAwC,CAAC;AAC3D,oCAAoC;AACpC,eAAO,MAAM,MAAM,SAA+C,CAAC;AAEnE,yFAAyF;AACzF,eAAO,MAAM,sBAAsB,oBAElC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAIrB,CAAC;AAEX,sJAAsJ;AACtJ,eAAO,MAAM,qBAAqB,SAI/B,CAAC;AAEJ,sIAAsI;AACtI,eAAO,MAAM,sBAAsB,SAElC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAH9B,MAG8B,GAF5B,MAAM,EAAE,CAiDpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAFrB,OAAO,CAOnB;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAF7B,OAAO,CAUnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAFjB,OAAO,CAOnB;AAED,mGAAmG;AACnG,eAAO,MAAM,aAAa,SAAuB,CAAC;AAElD,oJAAoJ;AACpJ,eAAO,MAAM,gBAAgB,SAEwC,CAAC;AAEtE,yFAAyF;AACzF,eAAO,MAAM,QAAQ,QAAmB,CAAC;AAEzC;;;;;GAKG;AACH,wBAAgB,cAAc,IAFjB,MAAM,CAclB;AAED,6FAA6F;AAC7F,eAAO,MAAM,UAAU,QAAqB,CAAC;AAsB7C;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,CAYlB;AAED,mEAAmE;AACnE,eAAO,IAAI,UAAU,QAAW,CAAC;AAIjC,yEAAyE;AACzE,eAAO,IAAI,QAAQ,QAAS,CAAC;AAI7B,mEAAmE;AACnE,eAAO,IAAI,OAAO,QAAQ,CAAC;AAI3B,sEAAsE;AACtE,eAAO,IAAI,QAAQ,QAAS,CAAC;AAI7B,mEAAmE;AACnE,eAAO,IAAI,OAAO,QAAQ,CAAC;AAI3B,yEAAyE;AACzE,eAAO,IAAI,SAAS,QAAU,CAAC;AAI/B,gEAAgE;AAChE,eAAO,IAAI,MAAM,QAAO,CAAC;AAIzB,yEAAyE;AACzE,eAAO,IAAI,SAAS,QAAU,CAAC;AAK/B;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,oBAGd,CAAC;AAEZ,2EAA2E;AAC3E,eAAO,IAAI,OAAO,QAAQ,CAAC;AAK3B,2EAA2E;AAC3E,eAAO,IAAI,QAAQ,QAAS,CAAC;AAK7B,mFAAmF;AACnF,eAAO,IAAI,eAAe,QAAS,CAAC;AAKpC,yEAAyE;AACzE,eAAO,MAAM,SAAS,QAAkD,CAAC;AAEzE,sEAAsE;AACtE,eAAO,MAAM,QAAQ,QAAgD,CAAC;AAEtE,6EAA6E;AAC7E,eAAO,MAAM,0BAA0B,UAWtC,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB;IAC/B,IAAI;IAyBJ,OAAO;IACP,GAAG;IACH,cAAc;IACd,WAAW;IACX,aAAa;IACb,aAAa;IACb,EAAE;IAyCF,GAAG;IACH,UAAU;IACV,OAAO;IACP,EAAE;IAyBF,EAAE;IACF,IAAI;IACJ,GAAG;IACH,IAAI;IACJ,MAAM;IA8BN,IAAI;IACJ,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,CAAC;IACD,KAAK;IACL,GAAG;IACH,OAAO;IACP,GAAG;IACH,GAAG;IACH,IAAI;IACJ,KAAK;IACL,SAAS;IACT,CAAC;IACD,OAAO;IACP,MAAM;IACN,IAAI;IACJ,EAAE;IACF,OAAO;IACP,IAAI;IACJ,YAAY;IACZ,SAAS;IAcT,UAAU;IACV,KAAK;IAUL,MAAM;IACN,GAAG;IACH,KAAK;IACL,KAAK;IACL,GAAG;IACH,GAAG;IACH,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,kBAAkB;IASlB,kBAAkB;IAMlB,OAAO;IACP,eAAe;CAChB,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB;IAClC,KAAK;CACN,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,EAF/B,MAAM,EAQf,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAH9C,MAG8C,GAF5C,OAAO,CAUnB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EALhC,MAKgC,EAAE,OAAO,QAAA,WAiBnD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,OAAA,EAAE,OAAO,EAH5C,MAG4C,EAAE,aAAa,UAAO,OA4G5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAJxC,MAIwC,EAAE,WAAW,AAH7D,CACA,EADQ,MAGqD,GAFnD,OAAO,CAiCnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,QAAA,EAAE,mBAAmB,OAAA,EAAE,OAAO,EAJ/D,MAI+D,WAezE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,KAAA,OA8CvC"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../lib/core/env.js"],"names":[],"mappings":"AAUA,uCAAuC;AACvC,eAAO,MAAM,MAAM,SAAmD,CAAC;AACvE,mCAAmC;AACnC,eAAO,MAAM,KAAK,SAAwC,CAAC;AAC3D,oCAAoC;AACpC,eAAO,MAAM,MAAM,SAA+C,CAAC;AAEnE,yFAAyF;AACzF,eAAO,MAAM,sBAAsB,oBAElC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAIrB,CAAC;AAEX,sJAAsJ;AACtJ,eAAO,MAAM,qBAAqB,SAI/B,CAAC;AAEJ,sIAAsI;AACtI,eAAO,MAAM,sBAAsB,SAElC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAH9B,MAG8B,GAF5B,MAAM,EAAE,CAiDpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAFrB,OAAO,CAOnB;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,IAFhC,OAAO,CAMnB;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAF7B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAFjB,OAAO,CAOnB;AAED,mGAAmG;AACnG,eAAO,MAAM,aAAa,SAAuB,CAAC;AAElD,oJAAoJ;AACpJ,eAAO,MAAM,gBAAgB,SAEwC,CAAC;AAEtE,yFAAyF;AACzF,eAAO,MAAM,QAAQ,QAAmB,CAAC;AAEzC;;;;;GAKG;AACH,wBAAgB,cAAc,IAFjB,MAAM,CAclB;AAED,6FAA6F;AAC7F,eAAO,MAAM,UAAU,QAAqB,CAAC;AAsB7C;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,CAYlB;AAED,mEAAmE;AACnE,eAAO,IAAI,UAAU,QAAW,CAAC;AAIjC,yEAAyE;AACzE,eAAO,IAAI,QAAQ,QAAS,CAAC;AAI7B,mEAAmE;AACnE,eAAO,IAAI,OAAO,QAAQ,CAAC;AAI3B,sEAAsE;AACtE,eAAO,IAAI,QAAQ,QAAS,CAAC;AAI7B,mEAAmE;AACnE,eAAO,IAAI,OAAO,QAAQ,CAAC;AAI3B,yEAAyE;AACzE,eAAO,IAAI,SAAS,QAAU,CAAC;AAI/B,gEAAgE;AAChE,eAAO,IAAI,MAAM,QAAO,CAAC;AAIzB,yEAAyE;AACzE,eAAO,IAAI,SAAS,QAAU,CAAC;AAK/B;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,oBAGd,CAAC;AAEZ,2EAA2E;AAC3E,eAAO,IAAI,OAAO,QAAQ,CAAC;AAK3B,2EAA2E;AAC3E,eAAO,IAAI,QAAQ,QAAS,CAAC;AAK7B,mFAAmF;AACnF,eAAO,IAAI,eAAe,QAAS,CAAC;AAKpC,yEAAyE;AACzE,eAAO,MAAM,SAAS,QAAkD,CAAC;AAEzE,sEAAsE;AACtE,eAAO,MAAM,QAAQ,QAAgD,CAAC;AAEtE,6EAA6E;AAC7E,eAAO,MAAM,0BAA0B,UAWtC,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB;IAC/B,IAAI;IAyBJ,OAAO;IACP,GAAG;IACH,cAAc;IACd,WAAW;IACX,aAAa;IACb,aAAa;IACb,EAAE;IAyCF,GAAG;IACH,UAAU;IACV,OAAO;IACP,EAAE;IAyBF,EAAE;IACF,IAAI;IACJ,GAAG;IACH,IAAI;IACJ,MAAM;IA8BN,IAAI;IACJ,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,CAAC;IACD,KAAK;IACL,GAAG;IACH,OAAO;IACP,GAAG;IACH,GAAG;IACH,IAAI;IACJ,KAAK;IACL,SAAS;IACT,CAAC;IACD,OAAO;IACP,MAAM;IACN,IAAI;IACJ,EAAE;IACF,OAAO;IACP,IAAI;IACJ,YAAY;IACZ,SAAS;IAcT,UAAU;IACV,KAAK;IAUL,MAAM;IACN,GAAG;IACH,KAAK;IACL,KAAK;IACL,GAAG;IACH,GAAG;IACH,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,kBAAkB;IASlB,kBAAkB;IAMlB,OAAO;IACP,eAAe;CAChB,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB;IAClC,KAAK;CACN,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,EAF/B,MAAM,EAQf,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAH9C,MAG8C,GAF5C,OAAO,CAUnB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EALhC,MAKgC,EAAE,OAAO,QAAA,WAiBnD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,OAAA,EAAE,OAAO,EAH5C,MAG4C,EAAE,aAAa,UAAO,OA2G5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAJxC,MAIwC,EAAE,WAAW,AAH7D,CACA,EADQ,MAGqD,GAFnD,OAAO,CAiCnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,QAAA,EAAE,mBAAmB,OAAA,EAAE,OAAO,EAJ/D,MAI+D,WAezE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,KAAA,OA8CvC"}

package/types/lib/core/fs.d.ts

@@ -25,6 +25,18 @@ export declare function safeIsExecutableSync(filePath: string): boolean;
  * @returns {void}
  */
 export declare function safeWriteSync(filePath: string, data: string | Buffer, options?: Object): void;
+/**
+ * Permission- and dry-run-aware write of a sequence of chunks, for content too
+ * large to join into one string first. The chunks go to a temporary file next
+ * to the target, which is renamed into place once complete, so a chunk may be
+ * read from the file being replaced and a failed write leaves the target as it
+ * was.
+ *
+ * @param {string} filePath File path to write.
+ * @param {Iterable<string|Buffer>} chunks Chunks written in order.
+ * @returns {void}
+ */
+export declare function safeWriteChunksSync(filePath: string, chunks: Iterable<string | Buffer>): void;
 /**
  * Permission-aware wrapper around readFileSync that returns undefined instead
  * of throwing. Reads are allowed in dry-run mode, so unlike the write wrappers
@@ -97,6 +109,49 @@ export declare function safeExtractArchive(sourcePath: string, targetPath: strin
 export declare const temporaryFiles: Set<any>;
 /** Set accumulating every executable command spawned via safeSpawnSync. */
 export declare const commandsExecuted: Set<any>;
+/**
+ * Quote one argument of a shell command line that is built as a single
+ * string. The shell flag exists so cmd.exe can resolve bare command names,
+ * `.cmd` shims and scripts, and every argument is data (paths, flags) that
+ * must arrive as one token whatever it contains: joined unquoted, an
+ * argument with spaces splits into several and hands the tool the wrong
+ * tokens.
+ *
+ * Windows follows the quoting rules cmd.exe and the MSVC runtimes share:
+ * wrap in double quotes, doubling the backslashes that precede a quote and
+ * escaping the quote itself. Inside double quotes cmd.exe already treats
+ * `&`, `|`, `<`, `>`, `^` and parentheses as literals, and the
+ * shell-metacharacter block above refuses `%` and the rest before this
+ * runs. A POSIX shell gets single quotes, which no expansion can leave.
+ *
+ * The same quoting is applied to the command itself when it names an
+ * existing file under a path with spaces; a command the shell must parse
+ * (a bare name, `sh -c`) never names a file as a whole and stays verbatim.
+ *
+ * @param {string} arg Argument to quote
+ * @param {boolean} [forWindows] Quote for cmd.exe rather than a POSIX shell; defaults to the current platform
+ * @returns {string} The argument, quoted when the shell needs it
+ */
+export declare function shellQuoteArgument(arg: string, forWindows?: boolean): string;
+/**
+ * Build the single command string a shell spawn runs. Every argument is
+ * quoted for the platform shell, so an argument containing spaces stays one
+ * token and cannot alter the command, and a command that is itself a file
+ * under a path with spaces (`C:\Program Files\...\node.exe`) is quoted too;
+ * a command the shell must parse (`sh -c`, a bare name) never names an
+ * existing file as a whole and is left verbatim.
+ *
+ * The one exception is a caller that composes shell fragments itself (sbt
+ * command lines embed their own quoting for the shell to strip): it passes
+ * `rawShellArgs` and keeps the verbatim join, under the shell-metacharacter
+ * block in safeSpawnSync like every other argument.
+ *
+ * @param {string} command The executable
+ * @param {string[]|undefined} args Arguments, when the caller passed any
+ * @param {boolean} [rawShellArgs] Join the arguments verbatim instead of quoting them
+ * @returns {string} The command line the shell will run
+ */
+export declare function joinShellCommand(command: string, args: string[] | undefined, rawShellArgs?: boolean): string;
 /**
  * Safe wrapper around spawnSync that enforces permission checks, injects default
  * options (maxBuffer, encoding, timeout), warns about unsafe Python and pip/uv

package/types/lib/core/fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../lib/core/fs.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAyErC;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,QAAA,OAmCtC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAHlC,MAGkC,GAFhC,OAAO,CAYnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAL3B,MAK2B,EAAE,IAAI,EAJjC,MAAM,GAAC,MAI0B,EAAE,OAAO,AAHlD,CACA,EADQ,MAG0C,GAFxC,IAAI,CA0BhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAJ9B,MAI8B,EAAE,OAAO,AAH/C,CACA,EADQ,MAAM,GAAC,MAG0C,GAF/C,MAAM,GAAC,MAAM,GAAC,SAAS,CA0BnC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,QAAA,EAAE,OAAO,EAH5B,OAG4B,aAwB9C;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAAM,GAAC,MAGyC,GAF9C,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAJxB,MAIwB,EAAE,OAAO,AAHzC,CACA,EADQ,MAG6C,GAF3C,IAAI,CAchB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,IAAI,CAchB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,IAAI,EAJ/B,MAI+B,EAAE,IAAI,AAH7C,CACA,EADQ,MAGiD,GAF/C,IAAI,CAkBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EARD,MAQC,EACV,UAAU,EARD,MAQC,EACV,SAAS,EARA,kBAQA,EACT,IAAI,AARH,CACA,EADQ,MAQK,EACd,OAAO,AARN,CACA,EADQ,MAQU,GAPR,OAAO,CAAC,OAAO,CAAC,CAwD5B;AAED,sFAAsF;AACtF,eAAO,MAAM,cAAc,UAAY,CAAC;AASxC,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,UAAY,CAAC;AAuK1C;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAL1B,MAK0B,EAAE,IAAI,EAJhC,MAAM,EAI0B,EAAE,OAAO,EAHzC,MAGyC,GAFvC,MAAM,CA8OlB;AAED,6FAA6F;AAC7F,eAAO,MAAM,UAAU,QAEP,CAAC;AAEjB,4GAA4G;AAC5G,eAAO,MAAM,UAAU,QAEJ,CAAC;AAEpB;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,OAAO,EANxB,MAMwB,EAAE,OAAO,EALjC,MAKiC,EAAE,OAAO,GAJ1C,MAI+C,OAuCzD;AA0BD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAFhC,MAAM,GAAC,SAEyB,QAK1C;AA4BD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,SAGtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EARE,MAQF,EACP,OAAO,EARE,MAQF,EACP,UAAU,SAAA,EACV,UAAU,OAAA,OAmDX;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAFf,MAAM,CAIlB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,IAFZ,MAAM,CAYlB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAJ1B,MAI0B,EAAE,IAAI,EAHhC,MAGgC,GAF9B,OAAO,QAAQ,CAU3B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,KAAA,EAAE,IAAI,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA8B3B"}
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../lib/core/fs.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA8ErC;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,QAAA,OAmCtC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAHlC,MAGkC,GAFhC,OAAO,CAYnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAL3B,MAK2B,EAAE,IAAI,EAJjC,MAAM,GAAC,MAI0B,EAAE,OAAO,AAHlD,CACA,EADQ,MAG0C,GAFxC,IAAI,CAQhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAIiC,EAAE,MAAM,EAHzC,QAAQ,CAAC,MAAM,GAAC,MAAM,CAGmB,GAFvC,IAAI,CA4BhB;AA2BD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAJ9B,MAI8B,EAAE,OAAO,AAH/C,CACA,EADQ,MAAM,GAAC,MAG0C,GAF/C,MAAM,GAAC,MAAM,GAAC,SAAS,CA0BnC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,QAAA,EAAE,OAAO,EAH5B,OAG4B,aAwB9C;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAAM,GAAC,MAGyC,GAF9C,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAJxB,MAIwB,EAAE,OAAO,AAHzC,CACA,EADQ,MAG6C,GAF3C,IAAI,CAchB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,IAAI,CAchB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,IAAI,EAJ/B,MAI+B,EAAE,IAAI,AAH7C,CACA,EADQ,MAGiD,GAF/C,IAAI,CAkBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EARD,MAQC,EACV,UAAU,EARD,MAQC,EACV,SAAS,EARA,kBAQA,EACT,IAAI,AARH,CACA,EADQ,MAQK,EACd,OAAO,AARN,CACA,EADQ,MAQU,GAPR,OAAO,CAAC,OAAO,CAAC,CAwD5B;AAED,sFAAsF;AACtF,eAAO,MAAM,cAAc,UAAY,CAAC;AASxC,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,UAAY,CAAC;AA+D1C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,UAAU,AAH/C,CACA,EADQ,OAG+C,GAF7C,MAAM,CAuClB;AAkBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAL7B,MAK6B,EAAE,IAAI,EAJnC,MAAM,EAAE,GAAC,SAI0B,EAAE,YAAY,AAHzD,CACA,EADQ,OAGyD,GAFvD,MAAM,CAclB;AA0GD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAL1B,MAK0B,EAAE,IAAI,EAJhC,MAAM,EAI0B,EAAE,OAAO,EAHzC,MAGyC,GAFvC,MAAM,CAqPlB;AAED,6FAA6F;AAC7F,eAAO,MAAM,UAAU,QAEP,CAAC;AAEjB,4GAA4G;AAC5G,eAAO,MAAM,UAAU,QAEJ,CAAC;AAEpB;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,OAAO,EANxB,MAMwB,EAAE,OAAO,EALjC,MAKiC,EAAE,OAAO,GAJ1C,MAI+C,OAwCzD;AA0BD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAFhC,MAAM,GAAC,SAEyB,QAK1C;AA4BD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,SAGtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EARE,MAQF,EACP,OAAO,EARE,MAQF,EACP,UAAU,SAAA,EACV,UAAU,OAAA,OAmDX;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAFf,MAAM,CAIlB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,IAFZ,MAAM,CAYlB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAJ1B,MAI0B,EAAE,IAAI,EAHhC,MAGgC,GAF9B,OAAO,QAAQ,CAU3B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,KAAA,EAAE,IAAI,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA8B3B"}

package/types/lib/core/httpClient.d.ts

@@ -26,9 +26,8 @@
  *   `Content-Encoding` header, matching `got`'s transparent decoding.
  * - Proxy support via the standard `HTTP_PROXY`/`HTTPS_PROXY`/`NO_PROXY`
  *   environment variables (through undici's `EnvHttpProxyAgent`).
- * - An in-memory GET response cache (enabled by default, disabled by setting
- *   the `CDXGEN_NO_CACHE` environment variable) that replaces the got + Keyv
- *   cache cdxgen previously relied on.
+ * - An in-memory GET response cache that replaces the got + Keyv cache cdxgen
+ *   previously relied on. A request opts out with `cache: false`.
  * - Response objects exposing `statusCode`, `headers`, `body`, `rawBody`,
  *   `url` and `request.options`.
  * - A lazily-resolved `.json()` method on the returned promise, mirroring
@@ -86,13 +85,19 @@ export declare function getDefaultHttpTimeoutMs(): number;
  */
 export declare function resolveTimeout(timeout?: number | Object): number | undefined;
 /**
- * Determine whether the in-memory HTTP response cache is disabled via the
- * CDXGEN_NO_CACHE environment variable. Evaluated per request so tests and
- * callers can toggle it at runtime.
+ * Override the response cache bounds. Returns the previous bounds so tests can
+ * restore them. Not part of the public API.
  *
- * @returns {boolean} True when caching should be skipped.
+ * @param {{ttlMs?: number, maxBytes?: number}} limits New bounds.
+ * @returns {{ttlMs: number, maxBytes: number}} Previous bounds.
  */
-export declare function isCacheDisabled(): boolean;
+export declare function _setHttpCacheLimits(limits: {
+    ttlMs?: number;
+    maxBytes?: number;
+}): {
+    ttlMs: number;
+    maxBytes: number;
+};
 /**
  * Clear the in-memory HTTP response cache. Primarily useful for tests.
  *

package/types/lib/core/httpClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"httpClient.d.ts","sourceRoot":"","sources":["../../../lib/core/httpClient.js"],"names":[],"mappings":"AAeA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH;;;;;GAKG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAU3B,QAAQ;IACR,OAAO;IACP,IAAI;IAXX;;;OAGG;IACH,YAAY,QAAQ,EAHT,MAGS,EAAE,OAAO,EAFlB,MAEkB,EAQ5B;CACF;AAED;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,KAAK;IAQ9B,OAAO;IACP,IAAI;IACJ,KAAK;IATZ;;;OAGG;IACH,YAAY,KAAK,EAHN,KAGM,EAAE,OAAO,EAFf,MAEe,EAMzB;CACF;AA8DD;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAF1B,MAAM,CAYlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,AAHnC,CACA,EADQ,MAAM,GAAC,MAGoB,GAFzB,MAAM,GAAC,SAAS,CAyB5B;AAwGD;;;;;;GAMG;AACH,wBAAgB,eAAe,IAFlB,OAAO,CAKnB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAFjB,IAAI,CAIhB;AAkBD;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAUnC,MAAM;IACN,GAAG;IAVV;;;OAGG;IACH,YAAY,MAAM,EAHP,MAGO,EAAE,GAAG,EAFZ,MAEY,EAOtB;CACF;AASD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAJ1B,CAAC,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,GAAC,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,MAAM,GAAC,IAAI,CAIlG,GAFxB,IAAI,CAIhB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAFvB,IAAI,CAIhB;AA8RD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,AAJtC,CACA,EADQ,MAImC,YAwC7C"}
+{"version":3,"file":"httpClient.d.ts","sourceRoot":"","sources":["../../../lib/core/httpClient.js"],"names":[],"mappings":"AAkBA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH;;;;;GAKG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAU3B,QAAQ;IACR,OAAO;IACP,IAAI;IAXX;;;OAGG;IACH,YAAY,QAAQ,EAHT,MAGS,EAAE,OAAO,EAFlB,MAEkB,EAQ5B;CACF;AAED;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,KAAK;IAQ9B,OAAO;IACP,IAAI;IACJ,KAAK;IATZ;;;OAGG;IACH,YAAY,KAAK,EAHN,KAGM,EAAE,OAAO,EAFf,MAEe,EAMzB;CACF;AAmED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAF1B,MAAM,CAYlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,AAHnC,CACA,EADQ,MAAM,GAAC,MAGoB,GAFzB,MAAM,GAAC,SAAS,CAyB5B;AAsMD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAH/B;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAGH,GAF7B;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,CAM7C;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAFjB,IAAI,CAKhB;AAoBD;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAUnC,MAAM;IACN,GAAG;IAVV;;;OAGG;IACH,YAAY,MAAM,EAHP,MAGO,EAAE,GAAG,EAFZ,MAEY,EAOtB;CACF;AASD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAJ1B,CAAC,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,GAAC,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,MAAM,GAAC,IAAI,CAIlG,GAFxB,IAAI,CAIhB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAFvB,IAAI,CAIhB;AA4TD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,AAJtC,CACA,EADQ,MAImC,YAwC7C"}

package/types/lib/core/metadataProperties.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The spellings under which a config file may list custom metadata
+ * properties: those of the `--metadata-property` flag, and the plural that
+ * the CDXGEN_METADATA_PROPERTIES environment variable maps to.
+ */
+export declare const METADATA_PROPERTY_CONFIG_KEYS: string[];
+/**
+ * Report whether a property name belongs to a namespace cdxgen reserves for
+ * the facts it establishes itself, such as `cdx:bom:componentSrcFiles`.
+ *
+ * @param {string} name Property name
+ * @returns {boolean} true for a reserved name
+ */
+export declare function isReservedMetadataPropertyName(name: string): boolean;
+/**
+ * Normalize user-supplied metadata properties into `[{name, value}]`
+ * (discussion 4391).
+ *
+ * Accepted shapes:
+ * - a `name=value` string, or a JSON document holding any of the shapes below
+ *   — an environment variable
+ * - an array of `name=value` strings or `{name, value}` objects — the
+ *   `--metadata-property` flag and a JSON config file
+ * - a plain object mapping a name to a value, or to a list of values for a
+ *   property that repeats — a JSON document or a YAML config file
+ *
+ * Values must be strings, numbers, or booleans. An entry without a name, a
+ * `name=value` string without a separator, and an empty or structured value
+ * are dropped rather than guessed at: a property with a mangled name or an
+ * `[object Object]` value is worse than none.
+ *
+ * @param {unknown} input Properties in any accepted shape
+ * @returns {{name: string, value: string}[]} Normalized properties
+ */
+export declare function parseMetadataProperties(input: unknown): {
+    name: string;
+    value: string;
+}[];
+//# sourceMappingURL=metadataProperties.d.ts.map

package/types/lib/core/metadataProperties.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadataProperties.d.ts","sourceRoot":"","sources":["../../../lib/core/metadataProperties.js"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,UAKzC,CAAC;AAMF;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAHxC,MAGwC,GAFtC,OAAO,CAMnB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAHlC,OAGkC,GAFhC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAiD3C"}

package/types/lib/core/pluginRun.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Shared plumbing for plugin (rusi/golem/kosi) invocations: resolving the
+ * directory to analyze, and reporting a failed run.
+ */
+/**
+ * The working directory, when a relative source argument names it.
+ *
+ * cdxgen is frequently launched with its working directory already set to the
+ * project (depscan does exactly that) while the path argument stays relative
+ * to some repository root, e.g. cwd `/work/repo/test/data/app` with argument
+ * `test/data/app`. A plain `path.resolve` then produces the doubled
+ * `/work/repo/test/data/app/test/data/app`. This recognises that shape and
+ * nothing looser: the argument's path segments must be the trailing segments
+ * of the working directory, so a mistyped argument run from some other
+ * project is never silently redirected to that project.
+ *
+ * @param {string} src The source path as the caller typed it.
+ * @param {string} [cwd] Working directory; defaults to `process.cwd()`.
+ * @returns {string|undefined} The absolute working directory when the
+ *   argument names it, otherwise undefined.
+ */
+export declare function cwdNamedByRelativeSource(src: string, cwd?: string): string | undefined;
+/**
+ * Resolve the source path argument once, at cdxgen's entry point.
+ *
+ * Everything downstream — the BOM generators, evinse, and the rusi/golem/kosi
+ * launchers — resolves the argument against the working directory, so the
+ * doubled-directory shape has to be corrected before any of them run;
+ * correcting it only in the plugin launchers leaves the main BOM built from a
+ * directory that does not exist.
+ *
+ * @param {string} src The source path as the caller typed it.
+ * @param {string} [cwd] Working directory; defaults to `process.cwd()`.
+ * @returns {{path: string, rewritten: boolean, missing: boolean}} `path` is
+ *   the argument to use: unchanged when it resolves to an existing path, the
+ *   working directory when the argument names it (`rewritten`), and otherwise
+ *   unchanged with `missing` set.
+ */
+export declare function resolveSourcePathArgument(src: string, cwd?: string): {
+    path: string;
+    rewritten: boolean;
+    missing: boolean;
+};
+/**
+ * Resolve the directory a plugin should analyze.
+ *
+ * The entry point already corrects the doubled-directory shape (see
+ * resolveSourcePathArgument); this is the same rule for callers that reach a
+ * plugin launcher directly (evinse, the library API). An existing directory
+ * wins and an absolute path is never rewritten. Otherwise the working
+ * directory is used only when the argument names it AND it carries the
+ * project marker the plugin needs (a `Cargo.toml` for rusi, a `go.mod` for
+ * golem). Anything else keeps the resolved path so the plugin's own error
+ * names the directory that was actually attempted.
+ *
+ * @param {string} src The source path as the caller typed it.
+ * @param {string[]} markerFiles File names that, present in the working
+ *   directory, identify it as the project the plugin should analyze.
+ * @returns {string} The directory to pass to the plugin.
+ */
+export declare function resolvePluginSourceDir(src: string, markerFiles?: string[]): string;
+/**
+ * Report a failed plugin run, keeping the two failure classes apart.
+ *
+ * A spawn error means the plugin binary itself could not run — not installed,
+ * not executable, blocked by the command policy — which is an installation
+ * problem. A non-zero exit status or a missing report means the plugin ran
+ * and the analysis failed, which must not be dressed up as an installation
+ * problem: the message names the directory and says the reachability
+ * evidence will be missing, because a silent degradation is what let a
+ * doubled `--dir` go unnoticed in the first place.
+ *
+ * Under `--fail-on-error` the failure additionally claims the process exit
+ * status through the deferred-exit contract.
+ *
+ * @param {Object} run What ran and how it failed.
+ * @param {string} run.tool Plugin name, e.g. "rusi".
+ * @param {string} run.ecosystem Ecosystem the plugin serves, e.g. "rust".
+ * @param {string} run.executable The binary that was invoked.
+ * @param {string[]} run.args The arguments it was invoked with.
+ * @param {string} run.dir The directory that was analyzed.
+ * @param {Object} run.result The spawn result.
+ * @param {string} run.outputFile The report file the plugin should have written.
+ * @param {Object} [run.options] CLI options, for the `--fail-on-error` contract.
+ * @returns {void}
+ */
+export declare function reportPluginRunFailure({ tool, ecosystem, executable, args, dir, result, outputFile, options, }: {
+    tool: string;
+    ecosystem: string;
+    executable: string;
+    args: string[];
+    dir: string;
+    result: Object;
+    outputFile: string;
+    options?: Object;
+}): void;
+//# sourceMappingURL=pluginRun.d.ts.map

package/types/lib/core/pluginRun.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginRun.d.ts","sourceRoot":"","sources":["../../../lib/core/pluginRun.js"],"names":[],"mappings":"AAAA;;;GAGG;AASH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EALjC,MAKiC,EAAE,GAAG,AAJ9C,CACA,EADQ,MAIsD,GAHpD,MAAM,GAAC,SAAS,CA0B5B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAPlC,MAOkC,EAAE,GAAG,AAN/C,CACA,EADQ,MAMuD,GALrD;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAC,CAiBhE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAL/B,MAK+B,EAAE,WAAW,GAJ5C,MAAM,EAI2C,GAF/C,MAAM,CAoBlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,IAAI,EACJ,SAAS,EACT,UAAU,EACV,IAAI,EACJ,GAAG,EACH,MAAM,EACN,UAAU,EACV,OAAO,GACR,EAnBE;IAAoB,IAAI,EAAhB,MAAM,CACd;IAAoB,SAAS,EAArB,MAAM,CACd;IAAoB,UAAU,EAAtB,MAAM,CACd;IAAsB,IAAI,EAAlB,MAAM,EAAE,CAChB;IAAoB,GAAG,EAAf,MAAM,CACd;IAAoB,MAAM,EAAlB,MAAM,CACd;IAAoB,UAAU,EAAtB,MAAM,CACd;IAAqB,OAAO,AAA5B,CACA,EADQ,MAAM,CACd;CAWF,GAXY,IAAI,CAuChB"}

package/types/lib/core/processTree.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Helpers for external commands stopped by cdxgen's spawn timeout.
+ *
+ * Layer 0: this module imports nothing outside `lib/core`, so both the atom
+ * and the dosai runners (layer 2) can share it.
+ */
+/**
+ * A duration for a message: seconds to one decimal below a minute, minutes to
+ * one decimal from there.
+ *
+ * @param {number} ms Duration in milliseconds
+ * @returns {string} Human-readable duration
+ */
+export declare function formatDuration(ms: number): string;
+/**
+ * Stop the descendants a timed-out run left behind on Windows.
+ *
+ * The spawn timeout terminates only the process cdxgen spawned, and Windows
+ * neither kills nor re-parents its children: a shell's command, a runtime's
+ * workers, or the build hosts a .NET analyzer starts keep running while still
+ * pointing at the dead process's pid. `taskkill /T` on that pid finds nothing,
+ * because the root is already gone. The live descendants are therefore found
+ * by parent pid in a process snapshot and stopped, limited to processes
+ * created after the run started. The root's own children must also predate
+ * its end: once the root is gone its pid can be handed to an unrelated
+ * process, whose children would otherwise look like the run's. Elsewhere this
+ * does nothing: an orphan is re-parented and can no longer be told apart.
+ *
+ * @param {number|undefined} rootPid pid of the process cdxgen spawned
+ * @param {number} startedAt Epoch milliseconds at which the run started
+ * @param {number} [endedAt] Epoch milliseconds at which the spawned process ended
+ * @param {string} [toolName] Name of the tool, for the debug message
+ * @returns {number[]} The pids that were stopped
+ */
+export declare function reapProcessTree(rootPid: number | undefined, startedAt: number, endedAt?: number, toolName?: string): number[];
+//# sourceMappingURL=processTree.d.ts.map

package/types/lib/core/processTree.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"processTree.d.ts","sourceRoot":"","sources":["../../../lib/core/processTree.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAHtB,MAGsB,GAFpB,MAAM,CAQlB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAPE,MAAM,GAAC,SAOT,EACP,SAAS,EAPA,MAOA,EACT,OAAO,AAPN,CACA,EADQ,MAOW,EACpB,QAAQ,AAPP,CACA,EADQ,MAOY,GANV,MAAM,EAAE,CAuDpB"}

package/types/lib/core/projectConfig.d.ts

@@ -9,15 +9,19 @@ export declare const PROJECT_CONFIG_FILENAMES: string[];
  * whenever that tree is. Path options are therefore confined to the config's
  * own directory - a scanned project may choose where in itself the BOM lands,
  * but not write outside it - and options that redirect data off the host or
- * widen what cdxgen executes are announced on the console.
+ * widen what cdxgen executes are announced on the console. A project may
+ * describe itself with custom metadata properties, but not in the namespaces
+ * cdxgen reserves for the facts it establishes, so a scanned tree cannot pass
+ * its own claims off as cdxgen's.
  *
  * @param {Object} config parsed config file contents
  * @param {string} configDir directory the config file was read from
- * @returns {{config: Object, rejected: string[], announced: string[]}} sanitized config and what it did
+ * @returns {{config: Object, rejected: string[], announced: string[], reservedProperties: string[]}} sanitized config and what it did
  */
 export declare function sanitizeProjectConfig(config: Object, configDir: string): {
     config: Object;
     rejected: string[];
     announced: string[];
+    reservedProperties: string[];
 };
 //# sourceMappingURL=projectConfig.d.ts.map

package/types/lib/core/projectConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"projectConfig.d.ts","sourceRoot":"","sources":["../../../lib/core/projectConfig.js"],"names":[],"mappings":"AAIA;;GAEG;AACH,eAAO,MAAM,wBAAwB,UAKpC,CAAC;AAsEF;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAJjC,MAIiC,EAAE,SAAS,EAH5C,MAG4C,GAF1C;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,CA4BrE"}
+{"version":3,"file":"projectConfig.d.ts","sourceRoot":"","sources":["../../../lib/core/projectConfig.js"],"names":[],"mappings":"AASA;;GAEG;AACH,eAAO,MAAM,wBAAwB,UAKpC,CAAC;AAsEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAJjC,MAIiC,EAAE,SAAS,EAH5C,MAG4C,GAF1C;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,EAAE,MAAM,EAAE,CAAA;CAAC,CA+CnG"}

package/types/lib/core/runState.d.ts

@@ -0,0 +1,29 @@
+/**
+ * State that lasts for one run.
+ *
+ * Registry answers, prefetched documents, recorded misses and local cache
+ * lookups are kept in module state, so that a package several lockfiles name
+ * costs one lookup. A run is one BOM generation. The CLI exits when it ends, but
+ * a long-lived process such as the server performs many, and nothing a run
+ * remembered should outlive it: the registries publish new releases, builds
+ * download new artifacts, and the memory belongs to the next scan.
+ *
+ * Every module that keeps such state registers a reset when it loads. The
+ * server calls {@link resetRunState} between scans. A module that has not
+ * loaded yet holds nothing to reset.
+ */
+/**
+ * Register the function that empties a module's per-run state.
+ *
+ * @param {string} name Unique name, normally the module and what it holds
+ * @param {() => void} reset Empties that state
+ * @returns {void}
+ */
+export declare function registerRunReset(name: string, reset: () => void): void;
+/**
+ * Empty the per-run state of every module that registered one.
+ *
+ * @returns {void}
+ */
+export declare function resetRunState(): void;
+//# sourceMappingURL=runState.d.ts.map

package/types/lib/core/runState.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runState.d.ts","sourceRoot":"","sources":["../../../lib/core/runState.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,KAAK,EAHjC,MAAM,IAG2B,GAF/B,IAAI,CAIhB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,IAFhB,IAAI,CAMhB"}

package/types/lib/core/toml.d.ts

@@ -0,0 +1,20 @@
+/**
+ * TOML parsing with stable, ordinary objects.
+ *
+ * smol-toml 1.9 began returning tables and inline tables with a `null`
+ * prototype so that a hostile `__proto__` key in a manifest cannot pollute
+ * `Object.prototype`. The SBOM data itself is unaffected, but cdxgen hands
+ * parsed manifests straight to callers (and `assert.deepStrictEqual` in the
+ * test suite), which compare by prototype and would see every table as a
+ * different kind of value. Re-wrapping the parse result with the standard
+ * prototype keeps the pre-1.9 contract: plain objects all the way down,
+ * `__proto__` keys included as ordinary own properties.
+ */
+/**
+ * Parse a TOML document into plain objects.
+ *
+ * @param {string} text TOML source
+ * @returns {Object} parsed document whose tables use `Object.prototype`
+ */
+export declare function parseToml(text: string): Object;
+//# sourceMappingURL=toml.d.ts.map

package/types/lib/core/toml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toml.d.ts","sourceRoot":"","sources":["../../../lib/core/toml.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAoDH;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAHnB,MAGmB,GAFjB,MAAM,CAIlB"}

package/types/lib/ecosystems/asarutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"asarutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/asarutils.js"],"names":[],"mappings":"AA6PA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAHlC,MAGkC,GAFhC,OAAO,CA6BnB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAJ1C,MAI0C,GAHxC,MAAM,CAwDlB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAJhC,MAIgC,GAH9B,MAAM,CA2ClB;AAgYD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EANE,MAAM,QAMR,EACP,YAAY,EANH,MAMG,EACZ,WAAW,EANF,MAME,GALA,MAAM,QAAM,CAqDxB;AAyYD;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EARvC,MAQuC,EAAE,OAAO,AAPxD,CAKA,EAJA;IAAyB,eAAe,AAAxC,CAEA,EAFQ,MAAM,CAEd;IAAyB,WAAW,AAApC,CAEA,EAFQ,MAAM,CAEd;CAE6D,GAFnD,OAAO,CAAC,MAAM,CAAC,CAyM3B;AAuGD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,EAH3C,MAG2C,GAFzC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA+BrC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAYzC;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,eAAe,EALN,MAKM,EACf,mBAAmB,EALV,OAKU,GAJR,KAAK,CAAC,MAAM,CAAC,CA0BzB"}
+{"version":3,"file":"asarutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/asarutils.js"],"names":[],"mappings":"AA8PA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAHlC,MAGkC,GAFhC,OAAO,CA6BnB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAJ1C,MAI0C,GAHxC,MAAM,CAwDlB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAJhC,MAIgC,GAH9B,MAAM,CA2ClB;AAgYD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EANE,MAAM,QAMR,EACP,YAAY,EANH,MAMG,EACZ,WAAW,EANF,MAME,GALA,MAAM,QAAM,CAqDxB;AA0YD;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EARvC,MAQuC,EAAE,OAAO,AAPxD,CAKA,EAJA;IAAyB,eAAe,AAAxC,CAEA,EAFQ,MAAM,CAEd;IAAyB,WAAW,AAApC,CAEA,EAFQ,MAAM,CAEd;CAE6D,GAFnD,OAAO,CAAC,MAAM,CAAC,CAyM3B;AAuGD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,EAH3C,MAG2C,GAFzC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA+BrC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAYzC;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,eAAe,EALN,MAKM,EACf,mBAAmB,EALV,OAKU,GAJR,KAAK,CAAC,MAAM,CAAC,CA0BzB"}

package/types/lib/ecosystems/bunutils.d.ts

@@ -14,14 +14,21 @@ export declare function parseBunDescriptor(descriptor: string): {
     version: string;
 };
 /**
- * Parse a bun text lockfile (`bun.lock`, lockfileVersion 1).
+ * Parse a bun text lockfile (`bun.lock`, lockfileVersion 1-3; v1 was written
+ * by the Zig implementation in bun 1.2.x-1.3.x and v2/v3 by the Rust one in
+ * bun 1.4+ - the content shape is identical, only parse strictness changed).
  *
  * Bun's text lockfile is JSONC (JSON with trailing commas). It records the
  * workspace roots under `workspaces` and the fully resolved dependency tree
- * under `packages`, where each entry is an array of the form
- * `["name@version", "registry", { dependencies, optionalDependencies, bin,
- * os, cpu, ... }, "sha512-..."]`. Nested duplicate versions are keyed by their
- * dependency path (eg `"parent/child"`).
+ * under `packages`, where nested duplicate versions are keyed by their
+ * dependency path (eg `"parent/child"`). The entry layout after the leading
+ * `"name@version"` descriptor depends on the resolution type (see the
+ * Stringifier in bun's bun.lock.rs):
+ * - npm: `["name@version", tarballUrlOrEmpty, { dependencies, bin, os, ... }, "sha512-..."]`
+ * - git/github: `["name@git+repo", { ... }, ".bun-tag", "sha512-..."]`
+ * - tarball/folder/symlink: `["name@url", { ... }, "sha512-..."]`
+ * - workspace: `["name@workspace:path"]`
+ * so the elements are recognised by shape instead of fixed indices.
  *
  * The binary lockfile (`bun.lockb`) is intentionally not supported - callers
  * should ask users to regenerate it with `bun install --save-text-lockfile`.

package/types/lib/ecosystems/bunutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bunutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/bunutils.js"],"names":[],"mappings":"AAuBA;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EALlC,MAKkC,GAJhC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAwB1D;AAyBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,YAAY,CAAC,WAAW,EALnC,MAKmC,EAAE,OAAO,AAJpD,CACA,EADQ,MAIiD,GAH/C,OAAO,CAAC;IAAC,OAAO,QAAQ;IAAC,gBAAgB,QAAO;CAAC,CAAC,CAoT9D"}
+{"version":3,"file":"bunutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/bunutils.js"],"names":[],"mappings":"AAgCA;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EALlC,MAKkC,GAJhC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAwB1D;AA2ED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,YAAY,CAAC,WAAW,EALnC,MAKmC,EAAE,OAAO,AAJpD,CACA,EADQ,MAIiD,GAH/C,OAAO,CAAC;IAAC,OAAO,QAAQ;IAAC,gBAAgB,QAAO;CAAC,CAAC,CAwZ9D"}