@cdxgen/cdxgen 13.2.0 → 13.4.0

package/types/lib/ecosystems/cargoCache.d.ts

@@ -72,4 +72,16 @@ export declare function getCargoRegistryDir(): string;
  *   local source has this crate.
  */
 export declare function readCargoCacheMetadata(name: string, version: string): CargoCacheMetadata | undefined;
+/**
+ * The manifest values of a `.crate` archive, read without extracting it.
+ *
+ * @param {string} crateFile Path to the `.crate` archive
+ * @param {string} name Crate name, for the archive's inner directory
+ * @param {string} version Crate version
+ * @returns {Promise<{values: Object, source: string}|undefined>}
+ */
+export declare function readCrateArchiveValues(crateFile: string, name: string, version: string): Promise<{
+    values: Object;
+    source: string;
+} | undefined>;
 //# sourceMappingURL=cargoCache.d.ts.map

package/types/lib/ecosystems/cargoCache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cargoCache.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cargoCache.js"],"names":[],"mappings":"AAsCG,YAAkB,kBAAkB,GACpC;;;;IAAoB,WAAW,AAA/B,CACA,EADW,MAAM,CACjB;;;;IAAoB,OAAO,AAA3B,CACA,EADW,MAAM,CACjB;;;;IAAoB,UAAU,AAA9B,CACA,EADW,MAAM,CACjB;;;;IAAoB,QAAQ,AAA5B,CACA,EADW,MAAM,CACjB;;;;IAAoB,WAAW,AAA/B,CACA,EADW,MAAM,CACjB;;;;IAAoB,QAAQ,AAA5B,CACA,EADW,MAAM,CACjB;;;;IAAoB,QAAQ,AAA5B,CACA,EADW,MAAM,CACjB;;;;IAAqB,MAAM,AAA3B,CACA,EADW,OAAO,CAClB;;;;IAAoB,WAAW,AAA/B,CACA,EADW,MAAM,CACjB;;;;IAAoB,aAAa,AAAjC,CACA,EADW,MAAM,CACjB;;;;IAAqB,OAAO,EAAjB,MAAM,EAAE,CACrB;CAAA,CAAA;AAUD;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAFvB,IAAI,CAKhB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAF5B,OAAO,CAOnB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,CAOlB;AAkCD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EALhC,MAKgC,EAAE,OAAO,EAJzC,MAIyC,GAHvC,kBAAkB,GAAC,SAAS,CA0BxC"}
+{"version":3,"file":"cargoCache.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cargoCache.js"],"names":[],"mappings":"AAyCG,YAAkB,kBAAkB,GACpC;;;;IAAoB,WAAW,AAA/B,CACA,EADW,MAAM,CACjB;;;;IAAoB,OAAO,AAA3B,CACA,EADW,MAAM,CACjB;;;;IAAoB,UAAU,AAA9B,CACA,EADW,MAAM,CACjB;;;;IAAoB,QAAQ,AAA5B,CACA,EADW,MAAM,CACjB;;;;IAAoB,WAAW,AAA/B,CACA,EADW,MAAM,CACjB;;;;IAAoB,QAAQ,AAA5B,CACA,EADW,MAAM,CACjB;;;;IAAoB,QAAQ,AAA5B,CACA,EADW,MAAM,CACjB;;;;IAAqB,MAAM,AAA3B,CACA,EADW,OAAO,CAClB;;;;IAAoB,WAAW,AAA/B,CACA,EADW,MAAM,CACjB;;;;IAAoB,aAAa,AAAjC,CACA,EADW,MAAM,CACjB;;;;IAAqB,OAAO,EAAjB,MAAM,EAAE,CACrB;CAAA,CAAA;AAUD;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAFvB,IAAI,CAKhB;AAID;;;;GAIG;AACH,wBAAgB,yBAAyB,IAF5B,OAAO,CAOnB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,CAOlB;AAmCD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EALtC,MAKsC,EAAE,OAAO,EAJ/C,MAI+C,GAH7C,kBAAkB,GAAC,SAAS,CAmCxC;AAoGD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAAC,SAAS,EAL3C,MAK2C,EAAE,IAAI,EAJjD,MAIiD,EAAE,OAAO,EAH1D,MAG0D,GAFxD,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CA0C/D"}

package/types/lib/ecosystems/caxa.d.ts

@@ -5,4 +5,18 @@
  * @returns {Promise<Object>} Parsed metadata object.
  */
 export declare function parseCaxaMetadata(mfile: string): Promise<Object>;
+/**
+ * Complete caxa metadata from the application the binary extracts (or was
+ * built from): npm integrity from the lockfile pnpm or npm leaves in
+ * node_modules, the native tools a cdxgen plugins manifest describes, with
+ * their own dependencies, and the PHP, Ruby and Java packages vendored inside
+ * npm packages. Everything found is linked from the npm package whose
+ * directory contains it; npm packages that are not in the metadata are
+ * ignored.
+ *
+ * @param {Object} mdata Parsed caxa metadata (see parseCaxaMetadata)
+ * @param {string} appDir Directory of the extracted app
+ * @returns {Promise<Object>} The metadata, with components and dependencies added
+ */
+export declare function enrichCaxaMetadataFromApp(mdata: Object, appDir: string): Promise<Object>;
 //# sourceMappingURL=caxa.d.ts.map

package/types/lib/ecosystems/caxa.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"caxa.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/caxa.js"],"names":[],"mappings":"AAMA;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAHlC,MAGkC,GAFhC,OAAO,CAAC,MAAM,CAAC,CA0E3B"}
+{"version":3,"file":"caxa.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/caxa.js"],"names":[],"mappings":"AAiBA;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAHlC,MAGkC,GAFhC,OAAO,CAAC,MAAM,CAAC,CA0E3B;AAiXD;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAJ1C,MAI0C,EAAE,MAAM,EAHlD,MAGkD,GAFhD,OAAO,CAAC,MAAM,CAAC,CAyC3B"}

package/types/lib/ecosystems/cmakeResolver.d.ts

@@ -22,9 +22,11 @@ declare function toRepoRelative(absPath: string, scanRoot: string): string | nul
 /**
  * Detect the build directory that holds a `CMakeCache.txt`.
  *
- * Looks for `build/`, `cmake-build-* /`, and `out/` under the scan root. An
- * explicit `--cmake-cache <path>` option (passed via `options.cmakeCache`)
- * takes precedence and skips autodetection.
+ * An explicit `--cmake-cache <path>` option (passed via `options.cmakeCache`)
+ * takes precedence and skips autodetection. Otherwise the project's build
+ * directories are searched in order: those its CMake presets configure, then
+ * the conventional `build`, `out`, `builddir` and `cmake-build-` directories
+ * (see `cmakeBuildDirCandidates`).
  *
  * @param {string} path Project scan root
  * @param {Object} options CLI options; `options.cmakeCache` is an explicit override
@@ -172,5 +174,28 @@ export declare function buildDependentPurl(resolvedUrl: string, version?: string
  * @returns {Object[]} Components with one entry per package name, in first-seen order
  */
 export declare function collapseCmakeVersions(pkgList: Object[]): Object[];
+/**
+ * Keep one component per dependency downloaded at configure time.
+ *
+ * The same `FetchContent_Declare` may be read from several files, and a
+ * `find_package(<name>)` names the package a `FetchContent_Declare(<name>)` or
+ * `CPMAddPackage` fetches. Within the components scraped from CMake files, the
+ * first fetched component of each name stands for all of them, and a plain
+ * `find_package` entry of that name is dropped.
+ *
+ * @param {Object[]} pkgList Components scraped from CMake-like files
+ * @returns {Object[]} The components, in first-seen order
+ */
+export declare function preferFetchedCmakeDependencies(pkgList: Object[]): Object[];
+/**
+ * Drop the components scraped from CMake files for a dependency the build tree
+ * has resolved: the gitclone script names the repository and tag that were
+ * really checked out, so its component replaces the declared one.
+ *
+ * @param {Object[]} pkgList Components collected so far
+ * @param {string} name Name of the resolved dependency
+ * @returns {Object[]} The components without the scraped entries for `name`
+ */
+export declare function withoutScrapedFetchDependency(pkgList: Object[], name: string): Object[];
 export { GIT_COMMAND, toRepoRelative };
 //# sourceMappingURL=cmakeResolver.d.ts.map

package/types/lib/ecosystems/cmakeResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cmakeResolver.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cmakeResolver.js"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH,OAAO,EAEL,WAAW,EAEZ,MAAM,4BAA4B,CAAC;AAgBpC;;;;;;;;GAQG;AACH,iBAAS,cAAc,CAAC,OAAO,EAJpB,MAIoB,EAAE,QAAQ,EAH9B,MAG8B,GAF5B,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAkC1D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC;IAAE,WAAW,EAAE;QAAC,IAAI,CAAC,EAAC,MAAM,CAAC;QAAC,OAAO,CAAC,EAAC,MAAM,CAAA;KAAC,GAAC,IAAI,CAAC;IAAC,QAAQ,gBAAM;IAAC,YAAY,gBAAM;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAuBxJ;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,OAAO,EAH/C,MAG+C,GAF7C;IAAE,GAAG,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,CAmClD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAH7B,MAG6B,GAF3B;IAAE,GAAG,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,CA6BlD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAHhC,MAGgC,GAF9B,GAAG,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAiB/E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAHlC,MAGkC,GAFhC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA4BvF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC;IAAE,WAAW,EAAE;QAAC,IAAI,CAAC,EAAC,MAAM,CAAC;QAAC,OAAO,CAAC,EAAC,MAAM,CAAA;KAAC,GAAC,IAAI,CAAC;IAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAC,MAAM,CAAC,CAAC;IAAC,UAAU,QAAQ;IAAC,SAAS,QAAQ;IAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAC;QAAC,IAAI,EAAC,MAAM,CAAC;QAAA,OAAO,CAAC,EAAC,MAAM,CAAC;QAAA,GAAG,CAAC,EAAC,MAAM,CAAC;QAAA,IAAI,EAAC,MAAM,CAAA;KAAC,CAAC,CAAA;CAAE,CAqGvN;AAgBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAJnC,MAImC,EAAE,OAAO,AAHpD,CACA,EADQ,MAG4C,GAF1C,MAAM,GAAC,IAAI,CAcvB;AAuED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAHlC,MAAM,EAG4B,GAFhC,MAAM,EAAE,CA2DpB;AAED,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"cmakeResolver.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cmakeResolver.js"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAYH,OAAO,EAEL,WAAW,EAEZ,MAAM,4BAA4B,CAAC;AAapC;;;;;;;;GAQG;AACH,iBAAS,cAAc,CAAC,OAAO,EAJpB,MAIoB,EAAE,QAAQ,EAH9B,MAG8B,GAF5B,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAuB1D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC;IAAE,WAAW,EAAE;QAAC,IAAI,CAAC,EAAC,MAAM,CAAC;QAAC,OAAO,CAAC,EAAC,MAAM,CAAA;KAAC,GAAC,IAAI,CAAC;IAAC,QAAQ,gBAAM;IAAC,YAAY,gBAAM;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAuBxJ;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,OAAO,EAH/C,MAG+C,GAF7C;IAAE,GAAG,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,CAmClD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAH7B,MAG6B,GAF3B;IAAE,GAAG,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,CA6BlD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAHhC,MAGgC,GAF9B,GAAG,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAiB/E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAHlC,MAGkC,GAFhC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA4BvF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC;IAAE,WAAW,EAAE;QAAC,IAAI,CAAC,EAAC,MAAM,CAAC;QAAC,OAAO,CAAC,EAAC,MAAM,CAAA;KAAC,GAAC,IAAI,CAAC;IAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAC,MAAM,CAAC,CAAC;IAAC,UAAU,QAAQ;IAAC,SAAS,QAAQ;IAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAC;QAAC,IAAI,EAAC,MAAM,CAAC;QAAA,OAAO,CAAC,EAAC,MAAM,CAAC;QAAA,GAAG,CAAC,EAAC,MAAM,CAAC;QAAA,IAAI,EAAC,MAAM,CAAA;KAAC,CAAC,CAAA;CAAE,CAqGvN;AAgBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAJnC,MAImC,EAAE,OAAO,AAHpD,CACA,EADQ,MAG4C,GAF1C,MAAM,GAAC,IAAI,CAcvB;AAuED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAHlC,MAAM,EAG4B,GAFhC,MAAM,EAAE,CA2DpB;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAH3C,MAAM,EAGqC,GAFzC,MAAM,EAAE,CAyBpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAJ1C,MAAM,EAIoC,EAAE,IAAI,EAHhD,MAGgD,GAF9C,MAAM,EAAE,CAapB;AAED,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC"}

package/types/lib/ecosystems/cppBuildContext.d.ts

@@ -0,0 +1,55 @@
+/**
+ * How a C/C++ project is built: its CMake configure presets, the compilers
+ * its compilation database or configured build tree names, the
+ * security-hardening options it is compiled and linked with, and which of the
+ * headers it includes are its own.
+ *
+ * The presets and compilers become formulation components, the hardening
+ * options properties of the project component, and the project's own include
+ * directories let the include analysis tell first-party headers from
+ * dependencies.
+ *
+ * Layer 3: this module reads the build tree and may run a compiler (only
+ * `--version`, only outside secure mode, only a GCC, Clang, MSVC, Intel,
+ * NVIDIA or EDG driver found on the PATH or named by an absolute path outside
+ * the project).
+ */
+/**
+ * The empty build context, for scans that are not of a source tree.
+ *
+ * @returns {Object}
+ */
+export declare function emptyCppBuildContext(): Object;
+/**
+ * The executable a driver names, when it may be run: an absolute path, or a
+ * command found on the PATH, that is a file outside the project. A relative
+ * path, or anything inside the project tree, is never run, since a
+ * compilation database can come with the code it describes.
+ */
+export declare function trustedCompilerPath(driver: any, root: any): any;
+/**
+ * Resolve the build context of a C/C++ project.
+ *
+ * @param {string} path Project scan root
+ * @param {Object} options CLI options
+ * @param {Object} [cmakeContext] The CMake context (`boundaries` lists the
+ *   source directories of fetched and submodule dependencies)
+ * @param {string[]} [vendoredDirs] Directories of code the project carries
+ *   under another license; their headers are not the project's own
+ * @returns {{
+ *   formulationComponents: Object[],
+ *   parentProperties: Object[],
+ *   firstPartyIncludeDirs: string[],
+ *   compileDatabase: string|undefined,
+ *   isFirstPartyHeader: function(string): boolean,
+ * }}
+ */
+export declare function resolveCppBuildContext(path: string, options?: Object, cmakeContext?: Object, vendoredDirs?: string[]): {
+    formulationComponents: Object[];
+    parentProperties: Object[];
+    firstPartyIncludeDirs: string[];
+    compileDatabase: string | undefined;
+    isFirstPartyHeader: Function;
+    (string: any): boolean;
+};
+//# sourceMappingURL=cppBuildContext.d.ts.map

package/types/lib/ecosystems/cppBuildContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cppBuildContext.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cppBuildContext.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAqEH;;;;GAIG;AACH,wBAAgB,oBAAoB,IAFvB,MAAM,CAIlB;AAgKD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,KAAA,EAAE,IAAI,KAAA,OA0C/C;AA0KD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAfK,MAeL,EACJ,OAAO,GAfE,MAeG,EACZ,YAAY,AAfX,CAEA,EAFQ,MAee,EACxB,YAAY,AAdX,CAEA,EAFQ,MAAM,EAcE,GAZN;IACR,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,eAAe,EAAE,MAAM,GAAC,SAAS,CAAC;IAClC,kBAAkB,WAAU;IAAA,CAAC,MAAM,KAAA,GAAG,OAAO,CAAC;CAC/C,CAkJH"}

package/types/lib/ecosystems/cppEvidence.d.ts

@@ -1,3 +1,15 @@
+/**
+ * Whether a directory holds C or C++ sources for atom to parse.
+ *
+ * The search skips the directories the manifest searches skip, such as
+ * node_modules and dot directories, and honours the exclude patterns, so the
+ * sources of a native npm addon do not count.
+ *
+ * @param {string} src directory
+ * @param {Object} options CLI options
+ * @returns {boolean} true when the directory holds at least one C or C++ file
+ */
+export declare function hasCppSources(src: string, options?: Object): boolean;
 /**
  * Method to find c/c++ modules by collecting usages with atom
  *
@@ -5,8 +17,12 @@
  * @param {object} options Command line options
  * @param {array} osPkgsList Array of OS pacakges represented as components
  * @param {array} epkgList Existing packages list
+ * @param {function(string): boolean} [isFirstPartyHeader] Whether an
+ *   included header is the project's own (found under the project root or
+ *   one of its own include directories, outside any dependency's sources);
+ *   such a header is not a component
  */
-export declare function getCppModules(src: string, options: object, osPkgsList: array, epkgList: array): {
+export declare function getCppModules(src: string, options: object, osPkgsList: array, epkgList: array, isFirstPartyHeader?: Function): {
     parentComponent: Object | {
         name: any;
         version: any;

package/types/lib/ecosystems/cppEvidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cppEvidence.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cppEvidence.js"],"names":[],"mappings":"AAgCA;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EALtB,MAKsB,EAAE,OAAO,EAJ/B,MAI+B,EAAE,UAAU,EAH3C,KAG2C,EAAE,QAAQ,EAFrD,KAEqD;;;;;;;;;;;;;;;;;;;;;;;;;EA8S/D"}
+{"version":3,"file":"cppEvidence.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cppEvidence.js"],"names":[],"mappings":"AA0MA;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAJtB,MAIsB,EAAE,OAAO,GAH/B,MAGoC,GAFlC,OAAO,CAOnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAVM,MAUN,EACH,OAAO,EAVE,MAUF,EACP,UAAU,EAVD,KAUC,EACV,QAAQ,EAVC,KAUD,EACR,kBAAkB,WAAY;;;;;;;;;;;;;;;;;;;;;;;;;EAqc/B"}

package/types/lib/ecosystems/cppIncludeResolver.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Which package provides a C/C++ header, from the file the include resolved
+ * to. atom 4 and later name that file in each include's usages slice
+ * (`resolvedPath`); with it, a header is attributed exactly instead of by its
+ * name: to the project itself, to a dependency whose sources CMake fetched or
+ * a submodule checked out, to code the project vendors, to a port vcpkg
+ * installed, to a package in the Conan cache, or to the operating-system
+ * package that owns the file.
+ *
+ * Layer 3: reads the vcpkg installed tree and the Conan cache, and asks the
+ * OS package manager about a file (`dpkg-query -S`, `rpm -qf`, `apk info -W`,
+ * or the Homebrew Cellar path).
+ */
+/**
+ * The include slices of an atom C/C++ usages report: for each header as
+ * written, the files it resolved to, whether it was written as a system
+ * include, and the functions the including files call that it declares.
+ * Slices from atom releases that do not name the resolved file contribute no
+ * paths and no symbols.
+ *
+ * @param {Object} sliceData Parsed atom usages report
+ * @returns {Map<string, {paths: Set<string>, system: boolean, symbols: Set<string>}>}
+ */
+export declare function parseCIncludeSlices(sliceData: Object): Map<string, {
+    paths: Set<string>;
+    system: boolean;
+    symbols: Set<string>;
+}>;
+/**
+ * Index the ports vcpkg installed into the given `vcpkg_installed`
+ * directories: every file a port installed, by absolute path. vcpkg lists a
+ * port's files in `vcpkg/info/<port>_<version>_<triplet>.list`, one path per
+ * line relative to the installed directory.
+ *
+ * @param {string[]} installedDirs `vcpkg_installed` directories
+ * @returns {Map<string, {port: string, version: string, triplet: string}>}
+ */
+export declare function readVcpkgInstalledIndex(installedDirs: string[]): Map<string, {
+    port: string;
+    version: string;
+    triplet: string;
+}>;
+/**
+ * The package folders of a Conan 2 cache, from its database
+ * (`<home>/p/cache.sqlite3`, table `packages`).
+ *
+ * @param {string} conanHome Conan 2 home (`CONAN_HOME`, or `~/.conan2`)
+ * @returns {Array<{dir: string, name: string, version: string}>}
+ */
+export declare function conan2Packages(conanHome: string): Array<{
+    dir: string;
+    name: string;
+    version: string;
+}>;
+/**
+ * The Conan package a file belongs to: in a Conan 1 cache
+ * (`<home>/.conan/data/<name>/<version>/<user>/<channel>/package/<id>/...`)
+ * from its path, in a Conan 2 cache from the cache's database.
+ *
+ * @param {string} file Absolute path
+ * @param {Object[]} conan2 Conan 2 package folders (see `conan2Packages`)
+ * @returns {{name: string, version: string}|undefined}
+ */
+export declare function conanPackageOf(file: string, conan2: Object[]): {
+    name: string;
+    version: string;
+} | undefined;
+/**
+ * Build the function that attributes a header from the files it resolved
+ * to.
+ *
+ * @param {Object} context
+ * @param {string} context.src Project scan root
+ * @param {Object[]} [context.components] Components already known: CMake
+ *   dependencies (`cdx:cmake:sourceDir`) and vendored code
+ *   (`cdx:vendored:path`) claim the headers under their directories
+ * @param {string[]} [context.buildDirs] Build directories, searched for
+ *   `vcpkg_installed`
+ * @param {function(string): boolean} [context.isFirstPartyHeader] Whether a
+ *   file is the project's own
+ * @returns {function(Iterable<string>): Object|undefined} Given the resolved
+ *   files, `{kind: "first-party"}`, `{kind: "component", component}`,
+ *   `{kind: "vcpkg", port, version, triplet}`, `{kind: "conan", name,
+ *   version}`, `{kind: "os", pkgInfo}`, or `undefined` when no file says.
+ *   Its `vcpkgPorts()` lists the ports vcpkg installed.
+ */
+export declare function createIncludeAttributor(context: {
+    src: string;
+    components?: Object[];
+    buildDirs?: string[];
+}): Function;
+//# sourceMappingURL=cppIncludeResolver.d.ts.map

package/types/lib/ecosystems/cppIncludeResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cppIncludeResolver.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cppIncludeResolver.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAYH;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAHlC,MAGkC,GAFhC,GAAG,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAC,CAAC,CA+BpF;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAH1C,MAAM,EAGoC,GAFxC,GAAG,CAAC,MAAM,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CAsCzE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAH7B,MAG6B,GAF3B,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CAuC/D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAJxB,MAIwB,EAAE,MAAM,EAHhC,MAAM,EAG0B,GAF9B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAgBrD;AAMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAd5C;IAAwB,GAAG,EAAnB,MAAM,CACd;IAA2B,UAAU,AAArC,CAGA,EAHQ,MAAM,EAAE,CAGhB;IAA2B,SAAS,AAApC,CAEA,EAFQ,MAAM,EAAE,CAEhB;CAQ4C,YAuF9C"}

package/types/lib/ecosystems/denoutils.d.ts

@@ -28,9 +28,15 @@ export declare function findDenoJson(dir: string): string | undefined;
 /**
  * Fetch JSR registry metadata for deno/jsr package components.
  *
- * For each component carrying a `cdx:deno:jsrKey` property, fetches the version
- * and package endpoints from the JSR API (batched in a single prefetch round
- * when enabled) and fills in license, description, and the GitHub source link.
+ * For each component carrying a `cdx:deno:jsrKey` property, fetches the
+ * version and package endpoints from the JSR API and fills in license,
+ * description, and the GitHub source link. A document is requested only for
+ * a component that still misses a field that document supplies: the version
+ * document carries the license, the package document the description and the
+ * repository link, so whatever the lockfile and the installed-manifest
+ * mining filled is never asked for again. Neither document carries
+ * provenance, so a provenance fetch, as under --bom-audit, asks for nothing
+ * more.
  *
  * @param {Array<object>} pkgList Package components potentially enriched with `cdx:deno:jsrKey`.
  * @returns {Promise<Array<object>>} The enriched package list (same reference as pkgList).

package/types/lib/ecosystems/denoutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"denoutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/denoutils.js"],"names":[],"mappings":"AA8DA;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAHpB,MAGoB,GAFlB,MAAM,CAuDlB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAuB5B;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAHrB,MAGqB,GAFnB,MAAM,GAAC,SAAS,CAY5B;AAwSD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAHjC,KAAK,CAAC,MAAM,CAGqB,GAF/B,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAwElC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EALjC,MAKiC,EAAE,OAAO,AAJlD,CACA,EADQ,MAI+C,GAH7C,OAAO,CAAC;IAAC,OAAO,QAAQ;IAAC,gBAAgB,QAAO;CAAC,CAAC,CAke9D"}
+{"version":3,"file":"denoutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/denoutils.js"],"names":[],"mappings":"AA8DA;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAHpB,MAGoB,GAFlB,MAAM,CAuDlB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAuB5B;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAHrB,MAGqB,GAFnB,MAAM,GAAC,SAAS,CAY5B;AA2TD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAHjC,KAAK,CAAC,MAAM,CAGqB,GAF/B,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CA4ElC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EALjC,MAKiC,EAAE,OAAO,AAJlD,CACA,EADQ,MAI+C,GAH7C,OAAO,CAAC;IAAC,OAAO,QAAQ;IAAC,gBAAgB,QAAO;CAAC,CAAC,CAge9D"}

package/types/lib/ecosystems/ecosystems.d.ts

@@ -1,10 +1,10 @@
-export declare let metadata_cache: {};
 /**
- * Internal helper to reset metadata_cache. Used by parseGoModData (still in
- * utils.js until batch 6) because ESM forbids reassigning an imported binding.
- * NOT re-exported through the utils.js barrel.
+ * No longer used. Registry answers are kept per ecosystem and for one run; this
+ * object stays exported for callers that imported it.
+ *
+ * @deprecated
  */
-export declare function _clearMetadataCache(): void;
+export declare const metadata_cache: {};
 /**
  * Fetches license information for a list of Swift packages by querying the
  * GitHub repository license API for packages hosted on github.com.
@@ -16,9 +16,27 @@ export declare function getSwiftPackageMetadata(pkgList: Object[]): Promise<Obje
 /**
  * Method to retrieve metadata for npm packages by querying npmjs
  *
+ * Packages a public registry cannot hold are skipped: the project itself,
+ * workspace and link members, file and git sources, and scopes served by
+ * another registry. See {@link npmLookupRegistry}. A package whose licence,
+ * description and repository the project or lockfile already supplied is left
+ * alone as well: the registry answers only what is still missing, and never
+ * overwrites a licence that is already set. The registry's licence is read
+ * with its legacy `licenses` field, and only a package for which neither the
+ * package nor the registry names one falls back to its repository's licence.
+ *
  * @param {Array} pkgList Package list
+ * @param {string} [registryUrl] Registry to query instead of NPM_URL
+ * @param {Object} [options] Options
+ * @param {Object} [options.npmrcConfig] Merged .npmrc configuration, used to
+ *   resolve a scope's own registry
+ * @param {boolean} [options.secureMode] Whether secure mode is on. Defaults to
+ *   the process-wide setting.
  */
-export declare function getNpmMetadata(pkgList: any[], registryUrl: any): Promise<any[]>;
+export declare function getNpmMetadata(pkgList: any[], registryUrl?: string, options?: {
+    npmrcConfig?: Object;
+    secureMode?: boolean;
+}): Promise<any[]>;
 /**
  * Method to locate local Gradle, Maven, or Coursier cache files for a given maven coordinate.
  *
@@ -29,15 +47,25 @@ export declare function getNpmMetadata(pkgList: any[], registryUrl: any): Promis
  */
 export declare function findLocalMvnArtifact(group: string, name: string, version: string): Object | null;
 /**
- * Method to retrieve metadata for maven packages by querying maven central
+ * Method to retrieve metadata for maven packages, from the local caches first
+ * and from Maven Central only for what remains.
+ *
+ * Every package is first enriched from data on disk. Only when license
+ * fetching is enabled (FETCH_LICENSE) or `force` is set are the packages
+ * still without a licence looked up remotely, and then only those a public
+ * repository can hold.
  *
  * @param {Array} pkgList Package list
  * @param {Object} jarNSMapping Jar Namespace mapping object
  * @param {Boolean} force Force fetching of license
+ * @param {{skipPurls?: Set<string>}} [context] Purls or bom-refs of the
+ *   project's own modules, which are never looked up remotely.
  *
  * @returns {Array} Updated package list
  */
-export declare function getMvnMetadata(pkgList: any[], jarNSMapping?: Object, force?: boolean): any[];
+export declare function getMvnMetadata(pkgList: any[], jarNSMapping?: Object, force?: boolean, context?: {
+    skipPurls?: Set<string>;
+}): any[];
 /**
  * Method to compose URL of pom.xml
  *
@@ -50,7 +78,10 @@ export declare function getMvnMetadata(pkgList: any[], jarNSMapping?: Object, fo
  */
 export declare function composePomXmlUrl({ urlPrefix, group, name, version }: string): string;
 /**
- * Method to fetch pom.xml data and parse it to JSON
+ * Method to fetch pom.xml data and parse it to JSON, merged with its parents.
+ *
+ * Each level is read from the local caches first. When a parent cannot be
+ * found, the child and any nearer parents are still returned.
  *
  * @param {String} urlPrefix
  * @param {String} group
@@ -61,7 +92,7 @@ export declare function composePomXmlUrl({ urlPrefix, group, name, version }: st
  */
 export declare function fetchPomXmlAsJson({ urlPrefix, group, name, version }: string): Object | undefined;
 /**
- * Method to fetch pom.xml data
+ * Method to fetch pom.xml data, from the local caches when present.
  *
  * @param {String} urlPrefix
  * @param {String} group
@@ -231,8 +262,9 @@ export declare function getGoPkgLicense(repoMetadata: Object): Promise<any>;
  *
  * @param {String} group Package group
  * @param {String} name Package name
+ * @param {String} [version] Package version, part of the page URL
  */
-export declare function getGoPkgVCSUrl(group: string, name: string): Promise<any>;
+export declare function getGoPkgVCSUrl(group: string, name: string, version?: string): Promise<any>;
 /**
  * Method to retrieve metadata for rust packages by querying crates
  *
@@ -243,7 +275,13 @@ export declare function getGoPkgVCSUrl(group: string, name: string): Promise<any
  *
  * What it does not hold is publisher identity, so a caller that needs the
  * publisher-drift and release-cadence signals — the predictive audit does —
- * passes `preferLocalCache: false` and takes the slower registry path.
+ * passes `preferLocalCache: false` and takes the slower registry path. That is
+ * also the only caller that needs the crate's owners, so the `/owners` request
+ * is made for it alone.
+ *
+ * Crates a public registry cannot hold are skipped: the project itself, path
+ * and git crates, and crates from an alternate registry. See
+ * {@link canCratesIoServe}.
  *
  * @param {Array} pkgList Package list
  * @param {Object} [options] Options
@@ -256,9 +294,20 @@ export declare function getCratesMetadata(pkgList: any[], options?: {
 /**
  * Method to retrieve metadata for dart packages by querying pub.dev
  *
+ * A hosted package whose lockfile names another registry is looked up there;
+ * the score endpoint that carries the licence tag is pub.dev's, so a private
+ * registry is asked only for the package document. In secure mode cdxgen does
+ * not contact a registry the scanned project names, so such a package is not
+ * looked up at all.
+ *
  * @param {Array} pkgList Package list
+ * @param {Object} [options] Options
+ * @param {boolean} [options.secureMode] Whether secure mode is on. Defaults to
+ *   the process-wide setting.
  */
-export declare function getDartMetadata(pkgList: any[]): Promise<any[]>;
+export declare function getDartMetadata(pkgList: any[], options?: {
+    secureMode?: boolean;
+}): Promise<any[]>;
 /**
  * Normalize a Cargo checksum/integrity string into canonical hex-prefixed form.
  *

package/types/lib/ecosystems/ecosystems.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ecosystems.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/ecosystems.js"],"names":[],"mappings":"AAmGA,eAAO,IAAI,cAAc,IAAK,CAAC;AAY/B;;;;GAIG;AACH,wBAAgB,mBAAmB,SAElC;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAH1C,MAAM,EAGoC,GAFxC,OAAO,CAAC,MAAM,EAAE,CAAC,CAmC7B;AAyBD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,OAAO,OAAA,EAAE,WAAW,KAAA,kBAiGxD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAL/B,MAK+B,EAAE,IAAI,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,MAAM,GAAC,IAAI,CAmIvB;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,OAAA,EACP,YAAY,GAPH,MAOQ,EACjB,KAAK,UAAQ,SA+Ed;AA4ND;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,UAGnE;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,GAF/D,MAAM,GAAC,SAAS,CA6B3B;AAgBD;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,GAFzD,OAAO,QAAQ,CAkB1B;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAF/C,MAAM,QAEyC,qBAUzD;AAED;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CAAC,EACpD,SAAS,EACT,KAAK,EACL,IAAI,EACJ,OAAO,GACR,QAAA,GAPW,OAAO,QAAQ,CAc1B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,OAAA,EAAE,iBAAiB,EAF7D,GAE6D,OAwBvE;AA6BD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,OAAA,EAAE,aAAa,SAAA,kBA8PzD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAJjC,MAIiC,EAAE,WAAW,GAH9C,MAG0D;;;;;;;;IAiIpE;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAHzC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAGH,GAFvC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAJtC,MAIsC,EAAE,UAAU,EAHlD,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAGD,GAFhD,IAAI,CAuBhB;AAiBD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,YAAY,EAH5C,MAG4C,GAF3C,SAAO,SAAS,CAqB3B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,QAAA,GAF7B,QAAQ,CAQnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,QAAA,EAAE,YAAY,EAHzC,MAGyC,GAFxC,SAAO,SAAS,CAc3B;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAJxC,KAAK,CAAC,MAAM,GAAC,SAAS,CAIkB,GAFtC,OAAO,CAAC,IAAI,CAAC,CAqCzB;AAED;;GAEG;AACH,wBAAgB,wBAAwB,SAEvC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,OAAO,EALjC,MAKiC,EAAE,YAAY,AAJvD,CACA,EADQ,MAI+C,GAH7C,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CAkExE;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAJxC,KAAK,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,CAIG,GAFtC,OAAO,CAAC,IAAI,CAAC,CAwCzB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,SAEjC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,YAAY,EAFvC,MAEuC,gBA2CjD;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,KAAK,QAAA,EAAE,IAAI,QAAA,gBAsB/C;AA2CD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,OAAA,EAAE,OAAO,AAJrD,CAGF,EAFE;IAA0B,gBAAgB,AAA1C,CAEF,EAFU,OAAO,CAEjB;CAC4D,kBAiJ5D;AAkFD;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,OAAO,OAAA,kBAiE5C;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAHtC,MAGsC,GAFpC,MAAM,GAAC,SAAS,CA6B5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EANpC,MAMoC,EAAE,OAAO,EAL7C,MAK6C,EAAE,YAAY,GAJ3D,MAIgE,kBAyY1E;AAqMD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,OAAA,EAAE,YAAY,QAAY;;;GA2KvE"}
+{"version":3,"file":"ecosystems.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/ecosystems.js"],"names":[],"mappings":"AAiHA;;;;;GAKG;AACH,eAAO,MAAM,cAAc,IAAK,CAAC;AAqDjC;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAH1C,MAAM,EAGoC,GAFxC,OAAO,CAAC,MAAM,EAAE,CAAC,CAmC7B;AA8LD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,cAAc,CAAC,OAAO,OAAA,EAAE,WAAW,AAPtD,CACA,EADQ,MAO8C,EAAE,OAAO,AAN/D,CAKF,EAJE;IAAyB,WAAW,AAApC,CAEA,EAFQ,MAAM,CAEd;IAA0B,UAAU,AAApC,CAEF,EAFU,OAAO,CAEjB;CACsE,kBAgItE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAL/B,MAK+B,EAAE,IAAI,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,MAAM,GAAC,IAAI,CAYvB;AAscD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,cAAc,CAClC,OAAO,OAAA,EACP,YAAY,GATH,MASQ,EACjB,KAAK,UAAQ,EACb,OAAO,AATN,CAGA,EAHQ;IAAC,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CASrB,SAkHb;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,UAGnE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,GAF/D,MAAM,GAAC,SAAS,CAa3B;AA+DD;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,GAFzD,OAAO,QAAQ,CAY1B;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAF/C,MAAM,QAEyC,qBAUzD;AAED;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CAAC,EACpD,SAAS,EACT,KAAK,EACL,IAAI,EACJ,OAAO,GACR,QAAA,GAPW,OAAO,QAAQ,CAW1B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,OAAA,EAAE,iBAAiB,EAF7D,GAE6D,OAwBvE;AAwHD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,OAAA,EAAE,aAAa,SAAA,kBA6QzD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAJjC,MAIiC,EAAE,WAAW,GAH9C,MAG0D;;;;;;;;IAiIpE;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAHzC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAGH,GAFvC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAJtC,MAIsC,EAAE,UAAU,EAHlD,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAGD,GAFhD,IAAI,CAuBhB;AAiBD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,YAAY,EAH5C,MAG4C,GAF3C,SAAO,SAAS,CAqB3B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,QAAA,GAF7B,QAAQ,CAQnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,QAAA,EAAE,YAAY,EAHzC,MAGyC,GAFxC,SAAO,SAAS,CAc3B;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAJxC,KAAK,CAAC,MAAM,GAAC,SAAS,CAIkB,GAFtC,OAAO,CAAC,IAAI,CAAC,CAoDzB;AAED;;GAEG;AACH,wBAAgB,wBAAwB,SAEvC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,OAAO,EALjC,MAKiC,EAAE,YAAY,AAJvD,CACA,EADQ,MAI+C,GAH7C,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CAgExE;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAJxC,KAAK,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,CAIG,GAFtC,OAAO,CAAC,IAAI,CAAC,CAiDzB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,SAEjC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,YAAY,EAFvC,MAEuC,gBAiDjD;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,KAAK,QAAA,EAAE,IAAI,QAAA,EAAE,OAAO,AAFtD,CACF,QACwD,gBA6BxD;AAiND;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,OAAA,EAAE,OAAO,AAJrD,CAGF,EAFE;IAA0B,gBAAgB,AAA1C,CAEF,EAFU,OAAO,CAEjB;CAC4D,kBAmK5D;AA8GD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CAAC,OAAO,OAAA,EAAE,OAAO,AAJnD,CAGF,EAFE;IAA0B,UAAU,AAApC,CAEF,EAFU,OAAO,CAEjB;CAC0D,kBAwF1D;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAHtC,MAGsC,GAFpC,MAAM,GAAC,SAAS,CA6B5B;AAwDD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EANpC,MAMoC,EAAE,OAAO,EAL7C,MAK6C,EAAE,YAAY,GAJ3D,MAIgE,kBAoe1E;AAkbD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,OAAA,EAAE,YAAY,QAAY;;;GA4IvE"}

package/types/lib/ecosystems/golem.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"golem.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/golem.js"],"names":[],"mappings":"AA+iDA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAJ/B,MAI+B,GAH7B,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,UAAU,EAJrC,MAIqC,EAAE,OAAO,AAHtD,CACA,EADQ,MAGmD,GAFjD,OAAO,CAmDnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,EAAE,OAAO,AAH7C,CACA,EADQ,MAG0C,GAFxC,MAAM,GAAC,SAAS,CA2B5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,AAL7C,CACA,EADQ,MAK0C,EAAE,UAAU,AAJ9D,CACA,EADQ,KAAK,CAAC,MAAM,CAI+C,GAHzD;IAAC,sBAAsB,2BAAgC;IAAC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,mBAAmB,0BAA0B;IAAC,cAAc,wBAAwB;IAAC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,eAAe,wBAAuB;CAAC,CAsFpQ"}
+{"version":3,"file":"golem.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/golem.js"],"names":[],"mappings":"AAgkDA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAJ/B,MAI+B,GAH7B,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,UAAU,EAJrC,MAIqC,EAAE,OAAO,AAHtD,CACA,EADQ,MAGmD,GAFjD,OAAO,CA4DnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,EAAE,OAAO,AAH7C,CACA,EADQ,MAG0C,GAFxC,MAAM,GAAC,SAAS,CA2B5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,AAL7C,CACA,EADQ,MAK0C,EAAE,UAAU,AAJ9D,CACA,EADQ,KAAK,CAAC,MAAM,CAI+C,GAHzD;IAAC,sBAAsB,2BAAgC;IAAC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,mBAAmB,0BAA0B;IAAC,cAAc,wBAAwB;IAAC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,eAAe,wBAAuB;CAAC,CAsFpQ"}

package/types/lib/ecosystems/gradleutils.d.ts

@@ -1,10 +1,16 @@
 /**
  * Method to return the gradle command to use.
  *
+ * Project-local wrapper scripts (`gradlew`) are attacker-controlled files in
+ * the scanned project, so they are only used when dependency tooling is
+ * allowed (`options.installDeps !== false`); otherwise the system Gradle is
+ * used.
+ *
  * @param {string} srcPath Path to look for gradlew wrapper
  * @param {string|null} rootPath Root directory to look for gradlew wrapper
+ * @param {Object} [options] CLI options (`installDeps` gates wrapper use)
  */
-export declare function getGradleCommand(srcPath: string, rootPath: string | null): string;
+export declare function getGradleCommand(srcPath: string, rootPath: string | null, options?: Object): string;
 /**
  * Method to combine the general gradle arguments, the sub-commands and the sub-commands' arguments in the correct way
  *
@@ -19,6 +25,18 @@ export declare function buildGradleCommandArguments(gradleArguments: string[], g
 /**
  * Method to split the output produced by Gradle using parallel processing by project
  *
+ * Gradle groups console output by task and prints a `> Task :path` header
+ * before each group, repeating it whenever a task's output resumes after
+ * another task's. Each group is therefore keyed by the project in its own
+ * header (`> Task :app:dependencies` belongs to `:app`), never by whatever
+ * report header happened to precede it, and the groups of one project are
+ * concatenated in order, so reordering or interrupting the task reports cannot
+ * move a report to another project or overwrite one (issue 4465). The groups
+ * of a root task (`:dependencies`) all take the root project's name from the
+ * `Root project '…'` header that only a root task prints, so a continuation
+ * group, which carries no report header, stays with the rest of the root
+ * report. The groups of other tasks are dropped along with their headers.
+ *
  * @param {string} rawOutput Full output produced by Gradle using parallel processing
  * @param {string[]} relevantTasks The list of gradle tasks whose output need to be considered.
  * @returns {map} Map with subProject names as keys and corresponding dependency task outputs as values.
@@ -57,7 +75,7 @@ export declare function parseGradleProperties(rawOutput: string, gradleModuleNam
  *
  * @returns {string} The combined output for all subprojects of the Gradle properties task
  */
-export declare function executeParallelGradleProperties(dir: string, allProjectsStr: array, extraArgs?: array): string;
+export declare function executeParallelGradleProperties(dir: string, allProjectsStr: array, extraArgs?: array, options?: {}): string;
 /**
  * Forget the causes diagnosed so far, so a process that generates more than
  * one BOM diagnoses each run on its own.
@@ -159,16 +177,64 @@ _includeCacheDir?: boolean): Promise<Object>;
 /**
  * Method to return the mill command to use.
  *
+ * The project-local `mill` script is an attacker-controlled file in the
+ * scanned project, so it is only used when dependency tooling is allowed
+ * (`options.installDeps !== false`).
+ *
  * @param {string} srcPath Path to look for mill wrapper
+ * @param {Object} [options] CLI options (`installDeps` gates wrapper use)
+ */
+export declare function getMillCommand(srcPath: string, options?: Object): string;
+/**
+ * Determine the Mill version of a build.
+ *
+ * The version is read from the `.mill-version` file, from the
+ * `//| mill-version:` header of the build file, or from the launcher itself.
+ *
+ * @param {string} millRootPath Root of the Mill build
+ * @param {string} millCmd Mill command to use for the fallback probe
+ * @returns {string|null} The Mill version, or null when it cannot be determined
+ */
+export declare function getMillVersion(millRootPath: string, millCmd: string): string | null;
+/**
+ * Find the Mill daemons running under a tree.
+ *
+ * Daemons record their process id in `out/mill-daemon*` (Mill 1.x) or
+ * `out/mill-server*` directories, directly or one level below (Mill 0.12
+ * keeps one subdirectory per server). Only processes that are still alive
+ * are returned.
+ *
+ * @param {string} rootPath Tree to search
+ * @returns {Map<string, Set<number>>} Live daemon process ids by the root of
+ *   the build they belong to
+ */
+export declare function findMillDaemons(rootPath: string): Map<string, Set<number>>;
+/**
+ * Stop the Mill daemons that started under the scanned tree during the scan.
+ *
+ * cdxgen's own Mill calls run with --no-server, but a project build cdxgen
+ * runs can shell out to Mill without it and leave a daemon behind. Daemons
+ * that were already running when the scan started belong to the user, for
+ * example to an IDE, and are left alone; every other live daemon is shut
+ * down through the launcher of the build it belongs to.
+ *
+ * @param {string} rootPath Scanned tree
+ * @param {Map<string, Set<number>>} [runningBefore] Result of
+ *   {@link findMillDaemons} taken before the scan
  */
-export declare function getMillCommand(srcPath: string): string;
+export declare function stopMillDaemons(rootPath: string, runningBefore?: Map<string, Set<number>>): void;
 /**
  * Method to return the maven command to use.
  *
+ * Project-local wrapper scripts (`mvnw`) are attacker-controlled files in the
+ * scanned project, so they are only used when dependency tooling is allowed
+ * (`options.installDeps !== false`); otherwise the installed Maven is used.
+ *
  * @param {string} srcPath Path to look for maven wrapper
  * @param {string} rootPath Root directory to look for maven wrapper
+ * @param {Object} [options] CLI options (`installDeps` gates wrapper use)
  */
-export declare function getMavenCommand(srcPath: string, rootPath: string): string;
+export declare function getMavenCommand(srcPath: string, rootPath: string, options?: Object): string;
 /**
  * Parse a Gradle version catalog (`gradle/libs.versions.toml`).
  *

package/types/lib/ecosystems/gradleutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gradleutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/gradleutils.js"],"names":[],"mappings":"AAwCA;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,EAAE,QAAQ,EAFvC,MAAM,GAAC,IAEgC,UA2FjD;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,eAAe,EARN,MAAM,EAQA,EACf,iBAAiB,EARR,MAAM,EAQE,EACjB,yBAAyB,EARhB,MAAM,EAQU,EACzB,mBAAmB,EARV,GAQU,GANR,MAAM,EAAE,CA2CpB;AAcD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAJ1C,MAI0C,EAAE,aAAa,EAHzD,MAAM,EAGmD,GAFvD,GAAG,CAqCf;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAFlC,MAEkC;;;EAsD5C;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAHpC,MAGoC,EAAE,gBAAgB,GAFtD,MAE6D;;;;;;;;EAoDvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAPM,MAON,EACH,cAAc,EAPL,KAOK,EACd,SAAS,GAPA,KAOK,GALH,MAAM,CAuFlB;AAiBD;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAF3B,IAAI,CAKhB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAF7B,OAAO,CAInB;AAiGD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EANzC,MAMyC,EAAE,OAAO,GAJ1D;IAAyB,OAAO,AAAhC,CACA,EADQ,MAAM,CACd;IAAyB,aAAa,AAAtC,CACA,EADQ,MAAM,CACd;CAE+D,GAFrD,IAAI,CA+HhB;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,SAAS,EANA,MAMA,EACT,eAAe,GANN,MAMe,EACxB,aAAa,GANJ,GAMgB,EACzB,cAAc,GANL,MAMU;;;;;;;;;GAkPpB;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,QAAQ,EAHpD,MAGoD,GAFlD,MAAM,CAkDlB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,gBAAgB,EAHjD,MAGiD,GAF/C,MAAM,CAkBlB;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAH5C,MAG4C,GAF1C,MAAM,CAuBlB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAHtC,MAGsC,GAFpC,MAAM,CA8ClB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAPD,MAOC,EACV,SAAS,EAPA,MAOA,EACT,QAAQ,GAPC,OAOM,EAAE,qCAAqC;AACtD,gBAAgB,GAPP,OAOe,GANb,OAAO,CAAC,MAAM,CAAC,CAgC3B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAF3B,MAE2B,UAcrC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,MAG4B,EAAE,QAAQ,EAFtC,MAEsC,UA6JhD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAH1C,MAG0C,GAFxC,MAAM,EAAE,CAoEpB"}
+{"version":3,"file":"gradleutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/gradleutils.js"],"names":[],"mappings":"AA8CA;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAJ7B,MAI6B,EAAE,QAAQ,EAHvC,MAAM,GAAC,IAGgC,EAAE,OAAO,AAFxD,CACF,EADU,MAEqD,UAoG/D;AA6DD;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,eAAe,EARN,MAAM,EAQA,EACf,iBAAiB,EARR,MAAM,EAQE,EACjB,yBAAyB,EARhB,MAAM,EAQU,EACzB,mBAAmB,EARV,GAQU,GANR,MAAM,EAAE,CA4CpB;AAqCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAJ1C,MAI0C,EAAE,aAAa,EAHzD,MAAM,EAGmD,GAFvD,GAAG,CA0Cf;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAFlC,MAEkC;;;EAsD5C;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAHpC,MAGoC,EAAE,gBAAgB,GAFtD,MAE6D;;;;;;;;EAoDvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAPM,MAON,EACH,cAAc,EAPL,KAOK,EACd,SAAS,GAPA,KAOK,EACd,OAAO,KAAK,GAND,MAAM,CA6GlB;AAiBD;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAF3B,IAAI,CAKhB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAF7B,OAAO,CAInB;AAiGD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EANzC,MAMyC,EAAE,OAAO,GAJ1D;IAAyB,OAAO,AAAhC,CACA,EADQ,MAAM,CACd;IAAyB,aAAa,AAAtC,CACA,EADQ,MAAM,CACd;CAE+D,GAFrD,IAAI,CA+HhB;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,SAAS,EANA,MAMA,EACT,eAAe,GANN,MAMe,EACxB,aAAa,GANJ,GAMgB,EACzB,cAAc,GANL,MAMU;;;;;;;;;GAkPpB;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,QAAQ,EAHpD,MAGoD,GAFlD,MAAM,CAkDlB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,gBAAgB,EAHjD,MAGiD,GAF/C,MAAM,CAkBlB;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAH5C,MAG4C,GAF1C,MAAM,CAuBlB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAHtC,MAGsC,GAFpC,MAAM,CA8ClB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAPD,MAOC,EACV,SAAS,EAPA,MAOA,EACT,QAAQ,GAPC,OAOM,EAAE,qCAAqC;AACtD,gBAAgB,GAPP,OAOe,GANb,OAAO,CAAC,MAAM,CAAC,CAgC3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,EAAE,OAAO,AAF5C,CACF,EADU,MAEyC,UAcnD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,YAAY,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,MAAM,GAAC,IAAI,CA4BvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAJ7B,MAI6B,GAH3B,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CA2DpC;AAqBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAJ7B,MAI6B,EAAE,aAAa,AAHpD,CAEF,EAFU,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAGiC,QAelE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAJ5B,MAI4B,EAAE,QAAQ,EAHtC,MAGsC,EAAE,OAAO,AAFvD,CACF,EADU,MAEoD,UAsK9D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAH1C,MAG0C,GAFxC,MAAM,EAAE,CAoEpB"}

package/types/lib/ecosystems/jsEvidence.d.ts

@@ -3,8 +3,11 @@
  *
  * For each component, resolves its module aliases (including the deno jsr
  * specifier), records imported/exported modules as properties, attaches
- * occurrence evidence, and adjusts the component scope to "required" when the
- * package is used or "optional" when it is not.
+ * occurrence evidence, and promotes the component scope to "required" when the
+ * package is used. A package with no observed usage keeps the scope its
+ * manifest parser assigned: static import analysis cannot see packages loaded
+ * from configuration, bundler entrypoints, stylesheets, or plugins, so a
+ * missing import is not evidence that a package is optional.
  *
  * @param {Array<object>} pkgList Package components to enrich.
  * @param {object} allImports Map of import specifier to usage evidence objects.