@cdxgen/cdxgen 13.2.0 → 13.4.0

package/types/lib/ecosystems/jsEvidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jsEvidence.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/jsEvidence.js"],"names":[],"mappings":"AA0GA;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EARE,KAAK,CAAC,MAAM,CAQd,EACP,UAAU,EARD,MAQC,EACV,UAAU,EARD,MAQC,EACV,IAAI,EARK,OAQL,GANO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAqMlC"}
+{"version":3,"file":"jsEvidence.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/jsEvidence.js"],"names":[],"mappings":"AAyLA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EARE,KAAK,CAAC,MAAM,CAQd,EACP,UAAU,EARD,MAQC,EACV,UAAU,EARD,MAQC,EACV,IAAI,EARK,OAQL,GANO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CA+KlC"}

package/types/lib/ecosystems/kosi.d.ts

@@ -1,3 +1,16 @@
+/**
+ * Builds the workspace component candidate for one kosi module.
+ *
+ * kosi derives module names from Gradle settings files, so a quoted literal
+ * (rootProject.name = 'KotlinGoat') rides into the reported purl. A purl
+ * cdx-purl rejects anchors nothing and must not reach the BOM: keep the
+ * reported purl when it parses, rebuild one from the cleaned coordinates
+ * when it does not, and return undefined when neither works.
+ *
+ * @param {Object|undefined} workspaceModule One entry of kosi's modules[].
+ * @returns {Object|undefined} Component candidate with a valid purl, or undefined.
+ */
+export declare function kosiWorkspaceComponent(workspaceModule: Object | undefined): Object | undefined;
 export declare function isKosiKotlinLanguage(language: any): boolean;
 /**
  * True when kosi is disabled by CDXGEN_KOSI_DISABLE (1/all/true) or --no-kosi.

package/types/lib/ecosystems/kosi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kosi.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/kosi.js"],"names":[],"mappings":"AA+BA,wBAAgB,oBAAoB,CAAC,QAAQ,KAAA,WAE5C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,QAQ3B;AA6DD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,GAHpC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAkD5B;AA0BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,KAAA,EAAE,SAAS,KAAA,OA4B/C;AAusBD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,KAAK,EAAE,WAAW,KAAK,MAsEpE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,GAJvC,MAI4C,EAAE,WAAW,GAHzD,MAG8D,GAF5D,MAAM,CAoFlB;AAiCD,wBAAgB,mBAAmB,CAAC,UAAU,KAAK,EAAE,UAAU,QAAK;;;;;;;EA2DnE"}
+{"version":3,"file":"kosi.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/kosi.js"],"names":[],"mappings":"AAqCA;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,eAAe,EAH3C,MAAM,GAAC,SAGoC,GAFzC,MAAM,GAAC,SAAS,CAwB5B;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,KAAA,WAE5C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,QAQ3B;AA6DD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,GAHpC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAkE5B;AA0BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,KAAA,EAAE,SAAS,KAAA,OA4B/C;AAusBD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,KAAK,EAAE,WAAW,KAAK,MAsEpE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,GAJvC,MAI4C,EAAE,WAAW,GAHzD,MAG8D,GAF5D,MAAM,CAoFlB;AAiCD,wBAAgB,mBAAmB,CAAC,UAAU,KAAK,EAAE,UAAU,QAAK;;;;;;;EA2DnE"}

package/types/lib/ecosystems/npmutils.d.ts

@@ -19,6 +19,48 @@ export declare function setNpmOptionalProperty(pkg: object): void;
  * @returns {void}
  */
 export declare function setNpmPeerProperty(pkg: object): void;
+/**
+ * Marks an npm component as imported only for its TypeScript types.
+ *
+ * @param {object} pkg Component object to annotate
+ * @returns {void}
+ */
+export declare function setNpmTypeOnlyProperty(pkg: object): void;
+/**
+ * Clean an npm version the way `npm publish` does before it records a release.
+ *
+ * Publishing a directory runs the manifest through `npm pkg fix`
+ * (`fixVersionField` in `@npmcli/package-json`, which calls `semver.clean` in
+ * loose mode) and then through libnpmpublish, which calls `semver.clean` again
+ * in strict mode and records the result as the packument version, the
+ * dist-tag, the `_id` and the tarball file name. Semver build metadata
+ * (`1.0.0+build.5`), a leading `v` or `=`, surrounding whitespace and leading
+ * zeros are dropped; a prerelease is kept.
+ *
+ * The `package.json` inside the published tarball keeps the original string,
+ * and so do the lockfiles npm, pnpm, yarn and bun write for a project, a
+ * workspace member or a git, file or link dependency. The cleaned form is the
+ * version the npm registry knows the package by.
+ *
+ * @param {string} version Version as a manifest or lockfile records it
+ * @returns {string|null} The cleaned version, or null when npm would reject `version` as invalid semver
+ */
+export declare function cleanNpmVersion(version: string): string | null;
+/**
+ * Record the version npm would publish when it differs from the recorded one.
+ *
+ * Sets `cdx:npm:cleanedVersion` on an npm component whose version is valid
+ * semver but not in the form {@link cleanNpmVersion} produces, for example
+ * `1.0.0+build.5` (published as `1.0.0`). The component's `version` and `purl`
+ * keep the recorded string: that is what the manifest and lockfile say. A
+ * component whose version is already clean, or not semver at all (a git
+ * commit, a `file:` path), is left without the property, and a stale value from
+ * an earlier pass is replaced.
+ *
+ * @param {object} component Component or package object with `version` and `purl`
+ * @returns {object} The same component, for chaining
+ */
+export declare function setNpmCleanedVersionProperty(component: object): object;
 /**
  * Helper function to create a properly encoded workspace PURL
  *
@@ -55,6 +97,21 @@ export declare function collectNpmManifestSources(node: object): {
     type: string;
     value: string;
 }[];
+/**
+ * Resolve the license of an npm-style manifest, honouring the legacy plural
+ * `licenses` field that packages published before the SPDX convention still
+ * carry (issue 4466). A modern `license` value is returned unchanged. The
+ * legacy field may hold one entry or an array of them, each a string or a
+ * `{ type, url }` object; one entry is returned as it is. npm documents an
+ * array of several entries as a choice between them, so when every entry is an
+ * SPDX identifier the array becomes the equivalent `MIT OR Apache-2.0`
+ * expression, and otherwise stays a list for `getLicenses` to convert entry by
+ * entry.
+ *
+ * @param {object} pkgData Parsed package.json (or bower.json) manifest
+ * @returns {string|object|Array|undefined} The effective license value
+ */
+export declare function resolveNpmLicense(pkgData: object): string | object | any[] | undefined;
 /**
  * Hydrates sparse npm package metadata from the installed package.json in deep mode.
  * Existing metadata on the Arborist node wins over on-disk values.

package/types/lib/ecosystems/npmutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"npmutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/npmutils.js"],"names":[],"mappings":"AA4CA;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAHlC,MAGkC,GAFhC,IAAI,CAgBhB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,MAG+B,GAF7B,IAAI,CAIhB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAH3B,MAG2B,GAFzB,IAAI,CAIhB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAJvC,MAIuC,EAAE,OAAO,EAHhD,MAGgD,GAF9C,MAAM,CA2BlB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,iBAAiB,EAJ/C,MAAM,EAAE,GAAG,SAIoC,EAAE,WAAW,EAH5D,MAG4D,GAF1D,MAAM,GAAG,SAAS,CAe9B;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAHnC,MAAM,GAAG,SAAS,GAAG,IAGc,GAFjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA0CvD;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAHnC,MAGmC,GAFjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,CAqB7C;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,AAHhD,CACA,EADQ,MAG6C,GAF3C;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAmCrG;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,KAAA,EAAE,KAAK,KAAA,EAAE,IAAI,KAAA,WAoC1D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAHjC,MAGiC,GAF/B,MAAM,CAQlB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAJxC,MAIwC,GAHtC,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAHhC,MAGgC,0BAa1C;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAHjC,MAGiC,GAF/B,MAAM,CAOlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAJ7C,MAI6C,EAAE,WAAW,AAHlE,CACA,wBAEuE,GAF7D,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EALrC,MAKqC,EAAE,KAAK,EAJ5C,MAI4C,EAAE,WAAW,wBAAA,GAFvD,yBAAuB,IAAI,CAYvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAN3C,MAM2C,EAAE,KAAK,EALlD,MAKkD,EAAE,IAAI,EAJxD,MAIwD,EAAE,OAAO,EAHjE,MAGiE,GAF/D,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EARI,MAQJ,EACL,IAAI,EARK,MAQL,EACJ,OAAO,EARE,MAQF,EACP,WAAW,wBAAA,GAPA,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,GAAC,SAAS,CA8BxD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAJhC,MAIgC,GAH9B;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAC,GAAC,IAAI,CAsBtG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,wBAAA,EAAE,SAAS,wBAAA,EAAE,WAAW,AAHjE,CACA,wBAEsE,0BAgExE"}
+{"version":3,"file":"npmutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/npmutils.js"],"names":[],"mappings":"AAkDA;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAHlC,MAGkC,GAFhC,IAAI,CAgBhB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,MAG+B,GAF7B,IAAI,CAIhB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAH3B,MAG2B,GAFzB,IAAI,CAIhB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,MAG+B,GAF7B,IAAI,CAIhB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,MAG4B,GAF1B,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,EAH3C,MAG2C,GAFzC,MAAM,CA6BlB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAJvC,MAIuC,EAAE,OAAO,EAHhD,MAGgD,GAF9C,MAAM,CA2BlB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,iBAAiB,EAJ/C,MAAM,EAAE,GAAG,SAIoC,EAAE,WAAW,EAH5D,MAG4D,GAF1D,MAAM,GAAG,SAAS,CAmB9B;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAHnC,MAAM,GAAG,SAAS,GAAG,IAGc,GAFjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA0CvD;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAHnC,MAGmC,GAFjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,CA2B7C;AAgBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,GAF5B,MAAM,GAAC,MAAM,WAAO,SAAS,CAgCzC;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,AAHhD,CACA,EADQ,MAG6C,GAF3C;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAmCrG;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,KAAA,EAAE,KAAK,KAAA,EAAE,IAAI,KAAA,WAoC1D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAHjC,MAGiC,GAF/B,MAAM,CAQlB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAJxC,MAIwC,GAHtC,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAHhC,MAGgC,0BAa1C;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAHjC,MAGiC,GAF/B,MAAM,CAOlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAJ7C,MAI6C,EAAE,WAAW,AAHlE,CACA,wBAEuE,GAF7D,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EALrC,MAKqC,EAAE,KAAK,EAJ5C,MAI4C,EAAE,WAAW,wBAAA,GAFvD,yBAAuB,IAAI,CAYvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAN3C,MAM2C,EAAE,KAAK,EALlD,MAKkD,EAAE,IAAI,EAJxD,MAIwD,EAAE,OAAO,EAHjE,MAGiE,GAF/D,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EARI,MAQJ,EACL,IAAI,EARK,MAQL,EACJ,OAAO,EARE,MAQF,EACP,WAAW,wBAAA,GAPA,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,GAAC,SAAS,CA8BxD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAJhC,MAIgC,GAH9B;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAC,GAAC,IAAI,CAsBtG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,wBAAA,EAAE,SAAS,wBAAA,EAAE,WAAW,AAHjE,CACA,wBAEsE,0BAsExE"}

package/types/lib/ecosystems/parsers-dotnet.d.ts

@@ -17,6 +17,88 @@
  * @returns {Object} The same component
  */
 export declare function applyNugetVersion(pkg: Object, version?: string): Object;
+/**
+ * Compare two NuGet versions: up to four numeric release parts (missing parts
+ * read as 0), then the prerelease label, with a release sorting after its own
+ * prereleases. Build metadata after `+` is ignored, as NuGet ignores it.
+ *
+ * @param {string} a Version
+ * @param {string} b Version
+ * @returns {number} Negative, zero or positive, like a sort comparator
+ */
+export declare function compareNugetVersions(a: string, b: string): number;
+/**
+ * Whether a NuGet version range allows a version. A bare version is a minimum
+ * (`1.0` means at least 1.0); brackets are inclusive and parentheses exclusive
+ * (`[1.0]`, `[1.0,2.0)`, `(,2.0]`). An empty or unparseable range allows
+ * anything.
+ *
+ * @param {string} range Range as a nuspec or lock file states it
+ * @param {string} version Version to test
+ * @returns {boolean} True when the range allows the version
+ */
+export declare function nugetRangeAllows(range: string, version: string): boolean;
+/**
+ * Choose the installed version a declared dependency resolves to: the lowest
+ * installed version the range allows, as NuGet picks the lowest applicable
+ * version; else the only installed version, which is what binding redirects
+ * unify a dependency onto. Undefined when nothing installed can be named.
+ *
+ * @param {string} range Declared range
+ * @param {string[]} installedVersions Versions installed for the package
+ * @returns {string|undefined} The chosen version
+ */
+export declare function resolveInstalledNugetVersion(range: string, installedVersions?: string[]): string | undefined;
+/**
+ * The project directory a .NET manifest belongs to. Restore output records its
+ * project file; otherwise project.assets.json sits in the project's `obj/`,
+ * and lock files, packages.config and project files sit in the project
+ * directory itself.
+ *
+ * @param {string} manifestFile Manifest path
+ * @param {string} [projectPath] Project file the manifest names, when it does
+ * @returns {string} Project directory
+ */
+export declare function dotnetManifestProjectDir(manifestFile: string, projectPath?: string): string;
+/**
+ * Index the MSBuild properties that props files define, by the directory each
+ * file sits in and across the whole scan, so the candidates for every project
+ * come from one read of each file.
+ *
+ * @param {string[]} propsFiles Props files of the scan
+ * @returns {{byDir: Object, treeWide: Object}} Property values per directory and
+ *          across the scan, each a map of property name to values
+ */
+export declare function indexPropsProperties(propsFiles?: string[]): {
+    byDir: Object;
+    treeWide: Object;
+};
+/**
+ * The candidate values of MSBuild properties that can apply to a project file,
+ * from the props files beside it and above it: the nearest directory that
+ * defines a property wins, as the nearest Directory.Build.props is the one
+ * MSBuild imports. A property no such directory defines falls back to the
+ * values the whole scan's props files give it, which a caller only trusts when
+ * there is exactly one.
+ *
+ * @param {string} projFile Project file
+ * @param {{byDir: Object, treeWide: Object}} propsIndex Index built by {@link indexPropsProperties}
+ * @returns {Object} Map of property name to candidate values
+ */
+export declare function projectPropertyCandidates(projFile: string, propsIndex?: {
+    byDir: Object;
+    treeWide: Object;
+}): Object;
+/**
+ * The version of each package that every manifest of a scan agrees on, keyed by
+ * lowercased package id. A package that two manifests give different versions
+ * is left out: without knowing which project a declaration belongs to, picking
+ * one of them would be a guess.
+ *
+ * @param {Object[]} pkgList Components collected from the scan's manifests
+ * @returns {Object} Map of lowercased package id to version
+ */
+export declare function agreedNugetVersions(pkgList?: Object[]): Object;
 /**
  * Method to parse .nupkg files
  *
@@ -78,20 +160,50 @@ export declare function getCentralPackageVersions(projFile: string, cache?: Obje
  * @returns {Object} Containing text nodes from PropertyGroup elements and their values
  */
 export declare function getPropertyGroupTextNodes(propsFiles: string): Object;
+/**
+ * Look up a package version in a name - version map. NuGet package ids are
+ * case-insensitive, so a map may be keyed by the id as written or lowercased.
+ *
+ * @param {Object} versions Map of package id to version
+ * @param {string} name Package id
+ * @returns {string|undefined} The version, or undefined when the map has none
+ */
+export declare function lookupNugetVersion(versions: Object, name: string): string | undefined;
 /**
  * Method to parse .csproj like xml files
  *
+ * A version the project file does not state is taken, in order, from the
+ * versions this project restored, from central package management, and last
+ * from a version the whole scan agrees on. Two projects of one tree routinely
+ * restore different versions of a package, so a version taken from another
+ * project would describe a package this project does not use.
+ *
  * @param {String} csProjData Raw data
  * @param {String} projFile File name
- * @param {Object} pkgNameVersions Package name - version map object
+ * @param {Object} pkgNameVersions Versions this project restored (its project.assets.json,
+ *        packages.lock.json or packages.config), keyed by package id or lowercased id
  * @param {Boolean} msbuildInstalled Whether msbuild is available to resolve properties
- * @param {Object} pkgVersionLabelCandidates Candidate values for msbuild version properties
+ * @param {Object} pkgVersionLabelCandidates Candidate values for msbuild version properties,
+ *        from the props files that can apply to this project
  * @param {Object} centralVersions Versions declared centrally in Directory.Packages.props,
  *        keyed by lowercased package id. See {@link getCentralPackageVersions}.
+ * @param {Object} fallbackVersions Versions every project of the scan agrees on, keyed by
+ *        lowercased package id, used only when nothing closer states one
+ * @param {Object} restoredNames Package ids as this project's restore output spells them,
+ *        keyed by lowercased id. NuGet ids are case-insensitive, so a reference spelled
+ *        differently names the same package and takes the restored spelling.
  *
  * @returns {Object} Containing parent component, package, and dependencies
  */
-export declare function parseCsProjData(csProjData: string, projFile: string, pkgNameVersions?: Object, msbuildInstalled?: boolean, pkgVersionLabelCandidates?: Object, centralVersions?: Object): Object;
+export declare function parseCsProjData(csProjData: string, projFile: string, pkgNameVersions?: Object, msbuildInstalled?: boolean, pkgVersionLabelCandidates?: Object, centralVersions?: Object, fallbackVersions?: Object, restoredNames?: Object): Object;
+/**
+ * Whether a file of a NuGet package is an assembly a consuming project can
+ * reference: a .dll, .exe, or .so under lib/, ref/, or runtimes/.
+ *
+ * @param {string} packageFile Path of the file inside the package, as project.assets.json lists it
+ * @returns {boolean} true for a referenced assembly
+ */
+export declare function isReferencedDotnetPackageFile(packageFile: string): boolean;
 /**
  * Parse a .NET project.assets.json file and return the package list and dependency tree.
  *
@@ -101,11 +213,13 @@ export declare function parseCsProjData(csProjData: string, projFile: string, pk
  *
  * @param {string} csProjData Raw JSON string of the project.assets.json file
  * @param {string} assetsJsonFile Path to the project.assets.json file, used for evidence properties
- * @returns {{ pkgList: Object[], dependenciesList: Object[] }}
+ * @returns {{ pkgList: Object[], dependenciesList: Object[], projectPath: (string|undefined) }}
+ *          `projectPath` is the project file the restore output belongs to, as restore recorded it
  */
 export declare function parseCsProjAssetsData(csProjData: string, assetsJsonFile: string): {
     pkgList: Object[];
     dependenciesList: Object[];
+    projectPath: (string | undefined);
 };
 /**
  * Parse a .NET packages.lock.json file and return the package list, dependency tree,

package/types/lib/ecosystems/parsers-dotnet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsers-dotnet.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-dotnet.js"],"names":[],"mappings":"AAeA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAL1B,MAK0B,EAAE,OAAO,AAJ3C,CAEA,QAE2C,GAFjC,MAAM,CAUlB;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,SAAS,QAAA,GAF7B,MAAM,CAWlB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,SAAS,QAAA,EAAE,UAAU,QAAA,GAFxC,MAAM,CAwKlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAP3B,MAO2B,EAAE,OAAO,EANpC,MAMoC,EAAE,eAAe,GALrD,MAK0D,GAFxD,MAAM,EAAE,CAiFpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,QAAA,GAHxC,MAAM,CA+ClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,QAAA,EAAE,KAAK,GAN9C,MAMmD,GAHjD,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,QAAA,GAFvC,MAAM,CA2ClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,UAAU,QAAA,EACV,QAAQ,QAAA,EACR,eAAe,GAXN,MAWW,EACpB,gBAAgB,UAAQ,EACxB,yBAAyB,GAXhB,MAWqB,EAC9B,eAAe,GAXN,MAWW,GART,MAAM,CAudlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAJrC,MAIqC,EAAE,cAAc,EAHrD,MAGqD,GAFnD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAE,CAuP7D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAJlC,MAIkC,EAAE,WAAW,EAH/C,MAG+C,GAF7C;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAkHjF;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAJrC,MAIqC,EAAE,WAAW,EAHlD,MAGkD,GAFhD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAE,CAyH7D"}
+{"version":3,"file":"parsers-dotnet.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-dotnet.js"],"names":[],"mappings":"AAeA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAL1B,MAK0B,EAAE,OAAO,AAJ3C,CAEA,QAE2C,GAFjC,MAAM,CAUlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAJ3B,MAI2B,EAAE,CAAC,EAH9B,MAG8B,GAF5B,MAAM,CAwDlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAmCnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAJvC,MAIuC,EAAE,iBAAiB,GAH1D,MAAM,EAGyD,GAF7D,MAAM,GAAC,SAAS,CAU5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAJ1C,MAI0C,EAAE,WAAW,AAH/D,CACA,EADQ,MAGuD,GAFrD,MAAM,CAWlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,GAJpC,MAAM,EAImC,GAHvC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,CA2B7C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAJvC,MAIuC,EAAE,UAAU,GAHnD;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAGwB,GAFtD,MAAM,CAoBlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAHhC,MAAM,EAG+B,GAFnC,MAAM,CAmBlB;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,SAAS,QAAA,GAF7B,MAAM,CAWlB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,SAAS,QAAA,EAAE,UAAU,QAAA,GAFxC,MAAM,CAyLlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAP3B,MAO2B,EAAE,OAAO,EANpC,MAMoC,EAAE,eAAe,GALrD,MAK0D,GAFxD,MAAM,EAAE,CAiFpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,QAAA,GAHxC,MAAM,CA+ClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,QAAA,EAAE,KAAK,GAN9C,MAMmD,GAHjD,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,QAAA,GAFvC,MAAM,CA2ClB;AAiBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAJhC,MAIgC,EAAE,IAAI,EAHtC,MAGsC,GAFpC,MAAM,GAAC,SAAS,CAO5B;AAyED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,eAAe,CAC7B,UAAU,QAAA,EACV,QAAQ,QAAA,EACR,eAAe,GAlBN,MAkBW,EACpB,gBAAgB,UAAQ,EACxB,yBAAyB,GAjBhB,MAiBqB,EAC9B,eAAe,GAhBN,MAgBW,EACpB,gBAAgB,GAfP,MAeY,EACrB,aAAa,GAdJ,MAcS,GAVP,MAAM,CAqgBlB;AAUD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAH9C,MAG8C,GAF5C,OAAO,CAoBnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EALrC,MAKqC,EAAE,cAAc,EAJrD,MAIqD,GAHnD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAA;CAAE,CAsO9F;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAJlC,MAIkC,EAAE,WAAW,EAH/C,MAG+C,GAF7C;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAkIjF;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAJrC,MAIqC,EAAE,WAAW,EAHlD,MAGkD,GAFhD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAE,CAyH7D"}

package/types/lib/ecosystems/parsers-elm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsers-elm.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-elm.js"],"names":[],"mappings":"AAiEA;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,WAAW,EALhC,MAKgC,EAAE,WAAW,AAJrD,CAEA,EAFQ,MAI6C,GAF3C;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAoGxG;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,kBAAkB,EAJ7C,MAI6C,EAAE,aAAa,AAHpE,CACA,EADQ,MAG4D,GAF1D;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAyFxG;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAH9B,MAG8B,GAF5B,OAAO,CAKnB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,AAJhD,CAEA,EAFQ,MAIwC,GAFtC;IAAE,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,GAAC,IAAI,CAAC;IAAC,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAA;CAAE,CA6FtH;AAmRD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAH7B,MAG6B,GAF3B,OAAO,CAKnB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAJjC,MAAM,EAI2B,EAAE,YAAY,AAHvD,CACA,EADQ,MAAM,EAGyC,GAF7C,OAAO,CAAC,MAAM,EAAE,CAAC,CAyD7B"}
+{"version":3,"file":"parsers-elm.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-elm.js"],"names":[],"mappings":"AA8DA;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,WAAW,EALhC,MAKgC,EAAE,WAAW,AAJrD,CAEA,EAFQ,MAI6C,GAF3C;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAoGxG;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,kBAAkB,EAJ7C,MAI6C,EAAE,aAAa,AAHpE,CACA,EADQ,MAG4D,GAF1D;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAyFxG;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAH9B,MAG8B,GAF5B,OAAO,CAKnB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,AAJhD,CAEA,EAFQ,MAIwC,GAFtC;IAAE,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,GAAC,IAAI,CAAC;IAAC,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAA;CAAE,CA6FtH;AAmRD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAH7B,MAG6B,GAF3B,OAAO,CAKnB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAJjC,MAAM,EAI2B,EAAE,YAAY,AAHvD,CACA,EADQ,MAAM,EAGyC,GAF7C,OAAO,CAAC,MAAM,EAAE,CAAC,CA8E7B"}

package/types/lib/ecosystems/parsers-gleam.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsers-gleam.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-gleam.js"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAJpC,MAIoC,EAAE,gBAAgB,AAH9D,CACA,EADQ,MAGsD,GAFpD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAiGlF"}
+{"version":3,"file":"parsers-gleam.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-gleam.js"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAJpC,MAIoC,EAAE,gBAAgB,AAH9D,CACA,EADQ,MAGsD,GAFpD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAiGlF"}

package/types/lib/ecosystems/parsers-go.d.ts

@@ -1,3 +1,25 @@
+/**
+ * The licence or copying notice of a module that is already on this machine,
+ * from the directory `go list` reported, from the project's `vendor/` tree, or
+ * from the module cache. Reading it costs no network round trip, so it answers
+ * before pkg.go.dev is asked.
+ *
+ * The directory `go list` reported is always read. The vendor tree and the
+ * module cache stand in for pkg.go.dev, so they are read only when licences
+ * are being fetched.
+ *
+ * @param {string} name Full module path
+ * @param {string} [version] Module version, for the module cache layout
+ * @param {Object} [options] Options
+ * @param {string} [options.dir] The module's directory, as `go list` reports it
+ * @param {string} [options.projectRoot] Project root holding a `vendor/` tree
+ * @returns {string|undefined} The notice text, or undefined when none is held
+ *   locally
+ */
+export declare function readLocalGoLicense(name: string, version?: string, options?: {
+    dir?: string;
+    projectRoot?: string;
+}): string | undefined;
 /**
  * Builds a Go package component object containing purl, bom-ref, integrity hash,
  * and optionally license and VCS external reference information.
@@ -6,9 +28,21 @@
  * @param {string} name Package name (full module path when group is empty)
  * @param {string} version Package version string
  * @param {string} hash Integrity hash (e.g. "sha256-…"), used as _integrity
+ * @param {Object} [options] Options
+ * @param {boolean} [options.skipRegistryLookups] Leave the licence and VCS
+ *   URL unset instead of asking pkg.go.dev. Used for the main module, which
+ *   no registry holds.
+ * @param {string} [options.dir] The module's directory, as `go list` reports
+ *   it, where a local licence notice is read first
+ * @param {string} [options.projectRoot] Project root holding a `vendor/` tree
+ *   the module may be vendored in
  * @returns {Promise<Object>} Component object ready for inclusion in a BOM package list
  */
-export declare function getGoPkgComponent(group: string, name: string, version: string, hash: string): Promise<Object>;
+export declare function getGoPkgComponent(group: string, name: string, version: string, hash: string, options?: {
+    skipRegistryLookups?: boolean;
+    dir?: string;
+    projectRoot?: string;
+}): Promise<Object>;
 /**
  * Method to parse go.mod files
  *
@@ -66,12 +100,30 @@ export declare function parseGoModGraph(rawOutput: string, goModFile: string, go
  * @returns {string|undefined} package name or none
  */
 export declare function parseGoModWhy(rawOutput: string): string | undefined;
+/**
+ * Reports whether `go mod why -m` output says the main module does not need
+ * the module. go prints `(main module does not need module X)`, or
+ * `(main module does not need to vendor module X)` with `-vendor`, and exits
+ * with status 0 either way.
+ *
+ * @param {string} rawOutput Output from go mod why
+ * @returns {boolean} True when go reports the module as not needed
+ */
+export declare function isGoModWhyNotNeeded(rawOutput: string): boolean;
+/**
+ * Read the `module@version` to hash map out of go.sum contents, without
+ * building components or touching the network.
+ *
+ * @param {string} gosumData Content of go.sum
+ * @returns {Object} Map of `module@version` keys to `sha256-…` values
+ */
+export declare function parseGosumHashes(gosumData: string): Object;
 /**
  * Parse go sum data
  * @param {string} gosumData Content of go.sum
  * @returns package list
  */
-export declare function parseGosumData(gosumData: string): Promise<any[]>;
+export declare function parseGosumData(gosumData: string): Promise<Object[]>;
 /**
  * Parses the contents of a Gopkg.lock or Gopkg.toml file (dep tool format) and
  * returns a list of Go package components. Optionally fetches license information

package/types/lib/ecosystems/parsers-go.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsers-go.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-go.js"],"names":[],"mappings":"AA2BA;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EANlC,MAMkC,EAAE,IAAI,EALxC,MAKwC,EAAE,OAAO,EAJjD,MAIiD,EAAE,IAAI,EAHvD,MAGuD,GAFrD,OAAO,CAAC,MAAM,CAAC,CAqD3B;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,SAAS,QAAA,EAAE,QAAQ,EAJ7C,MAI6C,GAF3C,MAAM,CA2ClB;AAkHD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAJpC,MAIoC,EAAE,QAAQ,EAH9C,MAG8C,GAF5C,OAAO,CAAC,MAAM,EAAE,CAAC,CA6B7B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAJnC,MAImC,EAAE,QAAQ,EAH7C,MAG6C;;;GAuHvD;AA4BD;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CACnC,SAAS,EATA,MASA,EACT,SAAS,EATA,MASA,EACT,QAAQ,EATC,MASD,EACR,QAAQ,QAAK,EACb,eAAe,GATN,MASW;;;;;;;;GA0MrB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CAc5B;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAHnC,MAGmC,kBA6B7C;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAHnC,MAGmC,GAFjC,OAAO,CAAC,MAAM,EAAE,CAAC,CAiD7B;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,aAAa,EAH3C,MAG2C,GAFzC,OAAO,CAAC,MAAM,EAAE,CAAC,CAkC7B"}
+{"version":3,"file":"parsers-go.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-go.js"],"names":[],"mappings":"AAmFA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAR5B,MAQ4B,EAAE,OAAO,AAP7C,CACA,EADQ,MAOqC,EAAE,OAAO,AANtD,CAGA,EAFA;IAAyB,GAAG,AAA5B,CACA,EADQ,MAAM,CACd;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;CAG2D,GAHjD,MAAM,GAAC,SAAS,CAqD5B;AAsCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAfI,MAeJ,EACL,IAAI,EAfK,MAeL,EACJ,OAAO,EAfE,MAeF,EACP,IAAI,EAfK,MAeL,EACJ,OAAO,AAfN,CAQA,EAPA;IAA0B,mBAAmB,AAA7C,CAGA,EAHQ,OAAO,CAGf;IAAyB,GAAG,AAA5B,CAEA,EAFQ,MAAM,CAEd;IAAyB,WAAW,AAApC,CAEA,EAFQ,MAAM,CAEd;CAOW,GAPD,OAAO,CAAC,MAAM,CAAC,CAqE3B;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,SAAS,QAAA,EAAE,QAAQ,EAJ7C,MAI6C,GAF3C,MAAM,CA2ClB;AAkHD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAJpC,MAIoC,EAAE,QAAQ,EAH9C,MAG8C,GAF5C,OAAO,CAAC,MAAM,EAAE,CAAC,CAyC7B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAJnC,MAImC,EAAE,QAAQ,EAH7C,MAG6C;;;GAuIvD;AA6CD;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CACnC,SAAS,EATA,MASA,EACT,SAAS,EATA,MASA,EACT,QAAQ,EATC,MASD,EACR,QAAQ,QAAK,EACb,eAAe,GATN,MASW;;;;;;;;GAiNrB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CAc5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAHlC,MAGkC,GAFhC,OAAO,CASnB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAH/B,MAG+B,GAF7B,MAAM,CAQlB;AA6BD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAHnC,MAGmC,qBAY7C;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAHnC,MAGmC,GAFjC,OAAO,CAAC,MAAM,EAAE,CAAC,CAmD7B;AAoBD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,aAAa,EAH3C,MAG2C,GAFzC,OAAO,CAAC,MAAM,EAAE,CAAC,CAkC7B"}

package/types/lib/ecosystems/parsers-js.d.ts

@@ -7,10 +7,15 @@ import { Buffer } from "node:buffer";
  *   identity evidence and skip npm registry metadata fetching.
  * @param {boolean} [securityProps=false] When true, append npm security-relevant
  *   properties such as lifecycle scripts, binaries, native addons, and deprecation notices.
+ * @param {Object} [options] Options
+ * @param {boolean} [options.fetchMetadata=true] When false, skip the npm
+ *   registry round so that a caller can make one round for many manifests.
  * @returns {Promise<Array<object>>} Parsed component list, enriched with npm
  *   registry metadata when available and not in simple mode.
  */
-export declare function parsePkgJson(pkgJsonFile: string, simple?: boolean, securityProps?: boolean): Promise<Array<object>>;
+export declare function parsePkgJson(pkgJsonFile: string, simple?: boolean, securityProps?: boolean, options?: {
+    fetchMetadata?: boolean;
+}): Promise<Array<object>>;
 /**
  * Hash a root `.npm-extension` file exactly as npm does: ssri sha512 over
  * `npm-extension:v1:<format>\n` followed by the raw file bytes. Mirrors
@@ -62,12 +67,15 @@ export declare function yarnLockToIdentMap(lockData: string): {};
  * @param {Object} parentComponent parent component
  * @param {Array[String]} workspacePackages Workspace packages
  * @param {Object} workspaceSrcFiles Workspace package.json files
- * @param {Object} _workspaceDirectDeps Direct dependencies of each workspace
+ * @param {Object} workspaceDirectDeps Declared dependencies (name to range) of each workspace package
  * @param {Object} depsWorkspaceRefs Workspace references for each dependency
  */
-export declare function parseYarnLock(yarnLockFile: string, parentComponent?: Object, workspacePackages?: any, workspaceSrcFiles?: Object, _workspaceDirectDeps?: Object, depsWorkspaceRefs?: Object): Promise<{
+export declare function parseYarnLock(yarnLockFile: string, parentComponent?: Object, workspacePackages?: any, workspaceSrcFiles?: Object, workspaceDirectDeps?: Object, depsWorkspaceRefs?: Object): Promise<{
     pkgList: any[];
-    dependenciesList: any[];
+    dependenciesList: {
+        ref: string;
+        dependsOn: any[];
+    }[];
 }>;
 /**
  * Parse nodejs shrinkwrap deps file
@@ -103,7 +111,10 @@ export declare function stripPnpmPeerSuffix(version: string): string;
  * {@link stripPnpmPeerSuffix}.
  *
  * @param {string|object} depPkg Dependency version string or package object.
- * @param {string} relativePath Base path for resolving link/file references.
+ * @param {string} relativePath Base path for resolving link/file references:
+ *   the directory of the importer that declares the dependency. Without it the
+ *   path is tried against the working directory, which only works when cdxgen
+ *   runs from the lock file's directory.
  * @returns {Promise<string|undefined>} The resolved published version.
  */
 export declare function getVersionNumPnpm(depPkg: string | object, relativePath: string): Promise<string | undefined>;

package/types/lib/ecosystems/parsers-js.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsers-js.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-js.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA0arC;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAChC,WAAW,EATF,MASE,EACX,MAAM,AATL,CAEA,EAFQ,OASK,EACd,aAAa,AARZ,CAEA,EAFQ,OAQY,GANV,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CA+OlC;AA0CD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAJhC,MAIgC,EAAE,KAAK,EAHvC,MAGuC,GAFrC,MAAM,CASlB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAHpC,MAGoC,GAFlC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAC,GAAC,IAAI,CA6BjF;AA+ED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,WAAW,EAHnC,MAGmC,EAAE,OAAO,GAF5C,MAEiD;;;GAqvB3D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAFhC,MAEgC,MA2E1C;AA0ND;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,YAAY,EARH,MAQG,EACZ,eAAe,GARN,MAQa,EACtB,iBAAiB,MAAK,EACtB,iBAAiB,GARR,MAQa,EACtB,oBAAoB,GARX,MAQgB,EACzB,iBAAiB,GARR,MAQa;;;GAsfvB;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAFrC,MAEqC,kBA+D/C;AA6GD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,QAAA,UAQ1C;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAJnC,MAAM,GAAC,MAI4B,EAAE,YAAY,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAoCrC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,cAAc,CAClC,MAAM,EATG,MAAM,GAAC,MASV,EACN,WAAW,EATF,MASE,EACX,UAAU,EATD,MASC,EACV,YAAY,EATH,MASG,EACZ,gBAAgB,EATP,MASO,EAChB,WAAW,AATV,CACA,EADQ,MASO,GARL,OAAO,CAAC,MAAM,CAAC,CAyD3B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAHrC,MAGqC,GAFnC,MAAM,CAoClB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,eAAe,EAHvC,MAGuC,GAFrC,MAAM,CA2BlB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EALhC,MAKgC,EAAE,WAAW,EAJ7C,MAI6C,EAAE,OAAO,EAHtD,MAGsD,GAFpD,MAAM,GAAC,IAAI,CA4DvB;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,OAAA,EAAE,YAAY,EAH7C,MAG6C,SAqFvD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,QAAA,GAH1B,MAAM,GAAC,SAAS,CAkC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAVC,MAUD,EACR,eAAe,GAVN,MAUa,EACtB,iBAAiB,MAAK,EACtB,iBAAiB,GAVR,MAUa,EACtB,kBAAkB,GAVT,MAUc,EACvB,oBAAoB,GAVX,MAUgB,EACzB,iBAAiB,GAVR,MAUa,EACtB,WAAW,GAVF,MAUc;;;;;;;;;;;;;;;;;;GAq7BxB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,aAAa,EAFvC,MAEuC,kBA6CjD;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,SAAS,EAF/B,MAE+B,kBA2FzC;AAGD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAAM,GAAC,MAGuB,GAF5B;IAAE,KAAK,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,CAoBvG;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,aAAa,QAAA,GAFjC,KAAK,QAAQ,CA4CzB"}
+{"version":3,"file":"parsers-js.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-js.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAgbrC;;;;;;;;;;;;;GAaG;AACH,wBAAsB,YAAY,CAChC,WAAW,EAZF,MAYE,EACX,MAAM,AAZL,CAEA,EAFQ,OAYK,EACd,aAAa,AAXZ,CAEA,EAFQ,OAWY,EACrB,OAAO,AAVN,CAGA,EAFA;IAA0B,aAAa,AAAvC,CAEA,EAFQ,OAAO,CAEf;CAOW,GAPD,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAwPlC;AA0CD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAJhC,MAIgC,EAAE,KAAK,EAHvC,MAGuC,GAFrC,MAAM,CASlB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAHpC,MAGoC,GAFlC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAC,GAAC,IAAI,CA6BjF;AA+ED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,WAAW,EAHnC,MAGmC,EAAE,OAAO,GAF5C,MAEiD;;;GAyyB3D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAFhC,MAEgC,MA2E1C;AAwND;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,YAAY,EARH,MAQG,EACZ,eAAe,GARN,MAQa,EACtB,iBAAiB,MAAK,EACtB,iBAAiB,GARR,MAQa,EACtB,mBAAmB,GARV,MAQe,EACxB,iBAAiB,GARR,MAQa;;;;;;GAwhBvB;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAFrC,MAEqC,kBAgE/C;AA6GD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,QAAA,UAQ1C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAPnC,MAAM,GAAC,MAO4B,EAAE,YAAY,EANjD,MAMiD,GAF/C,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAoCrC;AAqBD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,cAAc,CAClC,MAAM,EATG,MAAM,GAAC,MASV,EACN,WAAW,EATF,MASE,EACX,UAAU,EATD,MASC,EACV,YAAY,EATH,MASG,EACZ,gBAAgB,EATP,MASO,EAChB,WAAW,AATV,CACA,EADQ,MASO,GARL,OAAO,CAAC,MAAM,CAAC,CA8D3B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAHrC,MAGqC,GAFnC,MAAM,CAoClB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,eAAe,EAHvC,MAGuC,GAFrC,MAAM,CA2BlB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EALhC,MAKgC,EAAE,WAAW,EAJ7C,MAI6C,EAAE,OAAO,EAHtD,MAGsD,GAFpD,MAAM,GAAC,IAAI,CA4DvB;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,OAAA,EAAE,YAAY,EAH7C,MAG6C,SAsFvD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,QAAA,GAH1B,MAAM,GAAC,SAAS,CAkC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAVC,MAUD,EACR,eAAe,GAVN,MAUa,EACtB,iBAAiB,MAAK,EACtB,iBAAiB,GAVR,MAUa,EACtB,kBAAkB,GAVT,MAUc,EACvB,oBAAoB,GAVX,MAUgB,EACzB,iBAAiB,GAVR,MAUa,EACtB,WAAW,GAVF,MAUc;;;;;;;;;;;;;;;;;;GA6+BxB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,aAAa,EAFvC,MAEuC,kBA6CjD;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,SAAS,EAF/B,MAE+B,kBA2FzC;AAGD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAAM,GAAC,MAGuB,GAF5B;IAAE,KAAK,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,CAoBvG;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,aAAa,QAAA,GAFjC,KAAK,QAAQ,CA4CzB"}

package/types/lib/ecosystems/parsers-julia.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsers-julia.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-julia.js"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,eAAe,AAJ9C,CACA,EADQ,MAIsC,EAAE,gBAAgB,AAHhE,CACA,EADQ,MAGwD,GAFtD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CA+FzG;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAHhC,MAGgC,GAF9B,OAAO,CAUnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,OAAO,CASnB"}
+{"version":3,"file":"parsers-julia.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-julia.js"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,eAAe,AAJ9C,CACA,EADQ,MAIsC,EAAE,gBAAgB,AAHhE,CACA,EADQ,MAGwD,GAFtD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CA+FzG;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAHhC,MAGgC,GAF9B,OAAO,CAUnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,OAAO,CASnB"}

package/types/lib/ecosystems/parsers-jvm.d.ts

@@ -5,6 +5,44 @@
  * @returns {Object} Object containing pom properties, modules, and array of dependencies
  */
 export declare function parsePom(pomFile: string): Object;
+/**
+ * Every pom file of the reactor an aggregator pom builds: its own modules,
+ * recursively through nested aggregators. A recursive dependency:tree run
+ * from the aggregator resolves all of them, so their own runs repeat it.
+ *
+ * A module entry names a directory relative to its pom, sometimes a direct
+ * path to a pom file. Entries that are absolute, or that climb out of the
+ * aggregator's directory, are ignored: the scan never listed them, and the
+ * walk must not follow a pom's pointers outside its own tree.
+ *
+ * @param {string} rootPom Path of the aggregator pom.
+ * @returns {Set<string>} Pom files of the reactor, excluding the aggregator.
+ */
+export declare function resolveReactorPomFiles(rootPom: string): Set<string>;
+/**
+ * File name stem for the trees of one recursive dependency:tree run. Maven
+ * expands the project expressions for each reactor module, so every module
+ * writes its own file; a fixed name would hold only the last module's tree.
+ */
+export declare const MAVEN_MODULE_TREE_STEM = "${project.groupId}-${project.artifactId}";
+/**
+ * Read the trees one dependency:tree run wrote, one file per reactor module
+ * (see MAVEN_MODULE_TREE_STEM), and tell which of the reactor's pom files
+ * they cover. The pom the run started from comes first, then its modules in
+ * reactor order. A module pom counts as covered only when its own tree is
+ * among the files, so a module the run left out still runs on its own.
+ *
+ * @param {string} treeDir Directory the run wrote its trees into.
+ * @param {string} rootPom The pom file the run started from.
+ * @returns {{trees: Array<{pomFile: string, text: string}>, covered: Set<string>}}
+ */
+export declare function readMavenModuleTrees(treeDir: string, rootPom: string): {
+    trees: Array<{
+        pomFile: string;
+        text: string;
+    }>;
+    covered: Set<string>;
+};
 /**
  * Parse maven dependency:tree json output
  *
@@ -34,14 +72,21 @@ export declare function parseMavenTree(rawOutput: string, pomFile: string): Obje
 /**
  * Parse mill dependencies from file
  *
+ * Scala artifacts are emitted in the sbt purl form: the Scala binary suffix
+ * is stripped from the artifact name and the version it carried is recorded
+ * in the cdx:scala:compilerVersion property, so one library keeps a single
+ * purl whichever build tool reported it.
+ *
  * @param {string} module name of the module
  * @param {map} dependencies the parsed dependencies
  * @param {map} relations a map containing all relations
  * @param {string} millRootPath root of the project
+ * @param {string} logFileName name of the tree log the module wrote
  *
  * @returns the bom-ref of the module
  */
-export declare function parseMillDependency(module: string, dependencies: map, relations: map, millRootPath: string): any;
+export declare function parseMillDependency(module: string, dependencies: map, relations: map, millRootPath: string, logFileName?: string): any;
+export declare function completeComponent(component: any): any;
 /**
  * Parse clojure cli dependencies output
  * @param {string} rawOutput Raw string output

package/types/lib/ecosystems/parsers-jvm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsers-jvm.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-jvm.js"],"names":[],"mappings":"AAaA;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAHrB,MAGqB,GAFnB,MAAM,CA4JlB;AA2HD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,KAAA,EAAE,OAAO,KAAA,GAFxC;IAAC,eAAe,EAAE,EAAE,CAAC;IAAC,OAAO,EAAE,GAAC,EAAE,CAAC;IAAC,gBAAgB,EAAE,GAAC,EAAE,CAAA;CAAC,GAAC,EAAE,GAAC,EAAE,GAAC,GAAC,GAAC;IAAC,eAAe,EAAE;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,GAAC,CAAA;KAAC,GAAC,EAAE,CAAC;IAAC,OAAO,EAAE,EAAE,CAAC;IAAC,gBAAgB,EAAE,EAAE,CAAA;CAAC,CAkExJ;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAL7B,MAK6B,EAAE,OAAO,EAJtC,MAIsC,GAFpC,MAAM,CA8FlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EARG,MAQH,EACN,YAAY,EARH,GAQG,EACZ,SAAS,EARA,GAQA,EACT,YAAY,EARH,MAQG,OAuGb;AAmBD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAF1B,MAE0B,SAkCpC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAF3B,MAE2B,YAWrC;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EALtB,MAKsB,EAAE,UAAU,EAJlC,MAIkC,EAAE,IAAI,EAHxC,MAAM,EAGkC,GAFtC,MAAM,EAAE,CA0BpB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAFpC,MAEoC,SAkC9C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAFjC,MAEiC,SAqD3C;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAF9B,MAE8B,SAexC;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,SAAS,KAAA,SAmCnC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAHhC,MAGgC,GAF9B,MAAM,EAAE,CAkCpB;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAH5B,MAG4B,GAF1B,MAAM,EAAE,CAoDpB"}
+{"version":3,"file":"parsers-jvm.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-jvm.js"],"names":[],"mappings":"AAsBA;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAHrB,MAGqB,GAFnB,MAAM,CA4JlB;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,GAAG,CAAC,MAAM,CAAC,CAsDvB;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,6CAES,CAAC;AAiB7C;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAJjC,MAIiC,EAAE,OAAO,EAH1C,MAG0C,GAFxC;IAAC,KAAK,EAAE,KAAK,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAC,CA8CjF;AA2HD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,KAAA,EAAE,OAAO,KAAA,GAFxC;IAAC,eAAe,EAAE,EAAE,CAAC;IAAC,OAAO,EAAE,GAAC,EAAE,CAAC;IAAC,gBAAgB,EAAE,GAAC,EAAE,CAAA;CAAC,GAAC,EAAE,GAAC,EAAE,GAAC,GAAC,GAAC;IAAC,eAAe,EAAE;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,GAAC,CAAA;KAAC,GAAC,EAAE,CAAC;IAAC,OAAO,EAAE,EAAE,CAAC;IAAC,gBAAgB,EAAE,EAAE,CAAA;CAAC,CAkExJ;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAL7B,MAK6B,EAAE,OAAO,EAJtC,MAIsC,GAFpC,MAAM,CA8FlB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EATG,MASH,EACN,YAAY,EATH,GASG,EACZ,SAAS,EATA,GASA,EACT,YAAY,EATH,MASG,EACZ,WAAW,GATF,MASsB,OA+HhC;AAED,wBAAgB,iBAAiB,CAAC,SAAS,KAAA,OAe1C;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAF1B,MAE0B,SAkCpC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAF3B,MAE2B,YAWrC;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EALtB,MAKsB,EAAE,UAAU,EAJlC,MAIkC,EAAE,IAAI,EAHxC,MAAM,EAGkC,GAFtC,MAAM,EAAE,CA0BpB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAFpC,MAEoC,SAkC9C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAFjC,MAEiC,SAqD3C;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAF9B,MAE8B,SAexC;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,SAAS,KAAA,SAmCnC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAHhC,MAGgC,GAF9B,MAAM,EAAE,CAkCpB;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAH5B,MAG4B,GAF1B,MAAM,EAAE,CAoDpB"}