@cdxgen/cdxgen 13.2.0 → 13.4.0

package/types/lib/helpers/bomSigner.d.ts

@@ -1,28 +1,197 @@
 import crypto from "node:crypto";
 /**
- * Recursively applies signatures to the BOM and its granular components.
+ * Largest number of entries accepted in a `signers` or `chain` signature.
+ * Every entry is checked against the whole signed object, so the bound keeps
+ * the cost of verifying a document proportional to its size.
+ */
+export declare const MAX_SIGNATURE_ENTRIES = 32;
+/**
+ * Members the CycloneDX 1.4 to 1.7 and 2.0 schemas define at the root of a
+ * BOM. A root signature is only accepted on an object made of these members,
+ * so a signed component, service, or annotation cannot pass as a signed BOM.
+ */
+export declare const BOM_ROOT_MEMBERS: readonly string[];
+/**
+ * Renders a value taken from a document for a message. JSON can make any field
+ * an object or array, and interpolating those directly can throw.
+ *
+ * @param {any} value - Value to render
+ * @returns {string} - Printable text
+ */
+export declare function displayValue(value: any): string;
+/**
+ * Wraps shared-secret material for HMAC (HS256, HS384, HS512) signing or
+ * verification.
+ *
+ * HMAC is only ever used with a key produced by this function (or any secret
+ * KeyObject). Public and private keys are refused, so a document cannot switch
+ * a verifier to HMAC and use its public key as the secret.
+ *
+ * @param {string|Buffer|crypto.KeyObject} material - Secret bytes, a UTF-8 string, or a secret KeyObject
+ * @returns {crypto.KeyObject} - A secret KeyObject
+ */
+export declare function loadSharedSecret(material: string | Buffer | crypto.KeyObject): crypto.KeyObject;
+/**
+ * Loads the key used to verify signatures.
+ *
+ * Strings and Buffers are always parsed as asymmetric keys (a private key is
+ * reduced to its public half). To verify HMAC signatures, pass the result of
+ * {@link loadSharedSecret} instead.
+ *
+ * @param {string|Buffer|Object|crypto.KeyObject} key - PEM text, a createPublicKey() input, or a KeyObject
+ * @returns {crypto.KeyObject} - A public or secret KeyObject
+ */
+export declare function loadVerificationKey(key: string | Buffer | Object | crypto.KeyObject): crypto.KeyObject;
+/**
+ * Generates a PEM key pair suitable for the given JSF algorithm.
+ *
+ * @param {string} algorithm - JSF algorithm identifier
+ * @returns {{ publicKey: string, privateKey: string }} - PEM encoded SPKI public key and PKCS#8 private key
+ */
+export declare function generateSigningKeyPair(algorithm: string): {
+    publicKey: string;
+    privateKey: string;
+};
+/**
+ * Applies JSF signatures to the BOM and, optionally, its components, services,
+ * and annotations.
+ *
+ * Nested elements are signed by default. When a `signers` or `chain` signature
+ * is appended to a BOM that already has a root signature, nested elements are
+ * skipped by default, because changing them would invalidate the existing root
+ * signature; explicitly requesting nested signing in that case is an error.
+ *
+ * The BOM root must carry `bomFormat` (or `specFormat`) and `specVersion`, and
+ * only members that CycloneDX defines at the root. A nested element that
+ * carries `bomFormat`, `specFormat`, or `specVersion` is refused. Verification
+ * rejects signatures over either shape.
  *
  * @param {Object} bomJson - CycloneDX BOM Object
- * @param {Object} options - Signing options { privateKey, algorithm, mode, ... }
+ * @param {Object} options - Signing options
+ * @param {string|Buffer|Object|crypto.KeyObject} options.privateKey - Private key (PEM or KeyObject), or the shared secret for HS* algorithms
+ * @param {string} [options.algorithm] - JSF algorithm identifier (default RS512). It must match the key type.
+ * @param {Object} [options.publicKeyJwk] - JWK of the signing key's public key to embed
+ * @param {boolean} [options.embedPublicKey] - Embed the public key derived from the signing key when publicKeyJwk is not given. Ignored for HS* algorithms and for keys without a JWK form, such as rsa-pss.
+ * @param {boolean} [options.embedPublicKeyNested] - Also embed the public key in nested signatures (default true)
+ * @param {string} [options.keyId] - Key ID to embed
+ * @param {string} [options.mode] - 'replace' (default), 'signers', or 'chain'
+ * @param {boolean} [options.signComponents] - Sign each component
+ * @param {boolean} [options.signServices] - Sign each service
+ * @param {boolean} [options.signAnnotations] - Sign each annotation
  * @returns {Object} - Signed BOM Object
  */
-export declare function signBom(bomJson: Object, options?: Object): Object;
+export declare function signBom(bomJson: Object, options?: {
+    privateKey: string | Buffer | Object | crypto.KeyObject;
+    algorithm?: string;
+    publicKeyJwk?: Object;
+    embedPublicKey?: boolean;
+    embedPublicKeyNested?: boolean;
+    keyId?: string;
+    mode?: string;
+    signComponents?: boolean;
+    signServices?: boolean;
+    signAnnotations?: boolean;
+}): Object;
 /**
- * Verifies the integrity of a specific element node (e.g., BOM root, Component, Service, Annotation).
- * Resolves standard JSF signatures, multisignature (signers), and chains.
+ * Verifies the signature of a single node (e.g., BOM root, Component, Service,
+ * Annotation). Handles single signatures, multi-signatures (signers), and
+ * signature chains, and returns the first signature object that matches the key.
+ *
+ * A signature only matches when its declared algorithm fits the key type, its
+ * embedded publicKey (if any) is the verification key, and its value covers the
+ * node content plus the signature metadata as JSF defines.
+ *
+ * This checks one object only. To verify a BOM, use {@link verifyBomSignatures}
+ * or {@link verifyBom}, which also require the signed root to be a BOM.
  *
  * @param {Object} node - The BOM or granular object to verify
- * @param {string|crypto.KeyObject} publicKey - The public key corresponding to the signature
- * @returns {boolean|Object} - Signature block if signature is valid. False otherwise.
+ * @param {string|Buffer|Object|crypto.KeyObject} publicKey - Verification key. Strings and Buffers are parsed as public keys; use loadSharedSecret() for HMAC.
+ * @param {Object} [options]
+ * @param {string[]} [options.reasons] - When no signature matches, receives the reason each entry was rejected
+ * @returns {boolean|Object} - Matching signature object if valid. False otherwise.
+ */
+export declare function verifyNode(node: Object, publicKey: string | Buffer | Object | crypto.KeyObject, options?: {
+    reasons?: string[];
+}): boolean | Object;
+/**
+ * Verifies the signatures of a BOM against one or more trusted keys and reports
+ * the outcome for every signature entry.
+ *
+ * The BOM verifies when:
+ * - its root carries `bomFormat` (or `specFormat`) "CycloneDX" and
+ *   `specVersion`, and only members that CycloneDX defines at the root of a BOM;
+ * - its root signature verifies, meaning at least one entry verifies with one
+ *   of the keys. With `requireAll`, every entry must verify with one of the
+ *   keys, and every key must verify at least one entry;
+ * - with `deep`, every signed component, service, and annotation verifies the
+ *   same way and carries none of `bomFormat`, `specFormat`, and `specVersion`.
+ *
+ * A BOM without a root signature fails unless `allowNestedOnly` is set. Then
+ * every component, service, and annotation must carry a signature that
+ * verifies, and `notices` lists the members that no signature covers.
+ *
+ * Parse untrusted BOM text with `parseStrictJson()` from
+ * `lib/parsers/strictJson.js` before calling this function, so that the
+ * verified values are the values every JSON parser reads.
+ *
+ * @param {Object} bom - CycloneDX BOM Object
+ * @param {Array<string|Buffer|Object|crypto.KeyObject>|string|Buffer|Object|crypto.KeyObject} keys - Trusted verification keys (see verifyNode)
+ * @param {Object} [options]
+ * @param {boolean} [options.deep] - Also verify nested signatures (default true)
+ * @param {boolean} [options.allowNestedOnly] - Accept a BOM without a root signature when every nested element is signed
+ * @param {boolean} [options.requireAll] - Require every entry of each signature to verify, and every key to verify an entry of the root signature
+ * @returns {{ verified: boolean, errors: string[], notices: string[], root: Object|null, nested: Object[] }}
+ *   `root` and each `nested` item hold `label`, `form`, `verified`, `match` (the first verified entry),
+ *   `reasons` (why the signature could not be read), `entries` (`index`, `algorithm`, `keyId`, `verified`, `reasons`),
+ *   and `keysMatched` (whether each key verified an entry).
+ */
+export declare function verifyBomSignatures(bom: Object, keys: Array<string | Buffer | Object | crypto.KeyObject> | string | Buffer | Object | crypto.KeyObject, options?: {
+    deep?: boolean;
+    allowNestedOnly?: boolean;
+    requireAll?: boolean;
+}): {
+    verified: boolean;
+    errors: string[];
+    notices: string[];
+    root: Object | null;
+    nested: Object[];
+};
+/**
+ * Flattens a {@link verifyBomSignatures} report into the reasons it did not
+ * verify: policy errors first, then each rejected root entry, then each
+ * rejected nested entry prefixed with the element it belongs to.
+ *
+ * @param {Object} report - Result of verifyBomSignatures
+ * @returns {string[]} - Reasons, empty when the report verified
  */
-export declare function verifyNode(node: Object, publicKey: string | crypto.KeyObject): boolean | Object;
+export declare function signatureReportReasons(report: Object): string[];
 /**
- * Verifies the integrity of a BOM's top-level signature, as well as nested components, services, and annotations.
- * Returns true only if the root signature is valid AND all signed nested elements are valid.
+ * Verifies a BOM's top-level signature, as well as nested components, services,
+ * and annotations, with one key. Returns the root match only if the BOM verifies
+ * as {@link verifyBomSignatures} defines with `deep` enabled.
  *
  * @param {Object} bom - CycloneDX BOM Object
- * @param {string|crypto.KeyObject} publicKey - The public key corresponding to the signature
- * @returns {boolean|Object} - Signature block if signature is valid. False otherwise.
+ * @param {string|Buffer|Object|crypto.KeyObject} publicKey - Verification key (see verifyNode)
+ * @param {Object} [options] - Same options as verifyNode
+ * @returns {boolean|Object} - Signature object if valid. False otherwise.
+ */
+export declare function verifyBom(bom: Object, publicKey: string | Buffer | Object | crypto.KeyObject, options?: Object): boolean | Object;
+/**
+ * Checks every signature entry of a node against a set of trusted keys. An
+ * entry is verified when one of the keys verifies that entry.
+ *
+ * `cdx-sign` uses this before appending a `signers` or `chain` entry, to check
+ * that the content still carries the earlier signatures.
+ *
+ * @param {Object} node - The BOM or granular object whose signature is checked
+ * @param {Array<string|Buffer|Object|crypto.KeyObject>} [keys] - Trusted verification keys (see verifyNode)
+ * @returns {Array<{ index: number, algorithm: any, keyId: any, verified: boolean, reasons: string[] }>} - One result per signature entry; empty for an unsigned node
  */
-export declare function verifyBom(bom: Object, publicKey: string | crypto.KeyObject): boolean | Object;
+export declare function checkSignatureEntries(node: Object, keys?: Array<string | Buffer | Object | crypto.KeyObject>): Array<{
+    index: number;
+    algorithm: any;
+    keyId: any;
+    verified: boolean;
+    reasons: string[];
+}>;
 //# sourceMappingURL=bomSigner.d.ts.map

package/types/lib/helpers/bomSigner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bomSigner.d.ts","sourceRoot":"","sources":["../../../lib/helpers/bomSigner.js"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAiIjC;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAJpB,MAIoB,EAAE,OAAO,GAH7B,MAGkC,GAFhC,MAAM,CAkDlB;AAuDD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAJpB,MAIoB,EAAE,SAAS,EAH/B,MAAM,GAAC,MAAM,CAAC,SAGiB,GAF7B,OAAO,GAAC,MAAM,CA0B1B;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAJlB,MAIkB,EAAE,SAAS,EAH7B,MAAM,GAAC,MAAM,CAAC,SAGe,GAF3B,OAAO,GAAC,MAAM,CAgC1B"}
+{"version":3,"file":"bomSigner.d.ts","sourceRoot":"","sources":["../../../lib/helpers/bomSigner.js"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAyDjC;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,mBAqB3B,CAAC;AAmBH;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAHvB,GAGuB,GAFrB,MAAM,CAWlB;AA+LD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAH9B,MAAM,GAAC,MAAM,GAAC,MAAM,CAAC,SAGS,GAF5B,MAAM,CAAC,SAAS,CA2B5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAH5B,MAAM,GAAC,MAAM,GAAC,MAAM,GAAC,MAAM,CAAC,SAGA,GAF1B,MAAM,CAAC,SAAS,CAW5B;AAwBD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAHrC,MAGqC,GAFnC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CA2BrD;AAmYD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAdpB,MAcoB,EAAE,OAAO,GAZrC;IAAuD,UAAU,EAAzD,MAAM,GAAC,MAAM,GAAC,MAAM,GAAC,MAAM,CAAC,SAAS,CAC7C;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;IAA0B,cAAc,AAAxC,CACA,EADQ,OAAO,CACf;IAA0B,oBAAoB,AAA9C,CACA,EADQ,OAAO,CACf;IAAyB,KAAK,AAA9B,CACA,EADQ,MAAM,CACd;IAAyB,IAAI,AAA7B,CACA,EADQ,MAAM,CACd;IAA0B,cAAc,AAAxC,CACA,EADQ,OAAO,CACf;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;IAA0B,eAAe,AAAzC,CACA,EADQ,OAAO,CACf;CAE0C,GAFhC,MAAM,CA4FlB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,UAAU,CAAC,IAAI,EANpB,MAMoB,EAAE,SAAS,EAL/B,MAAM,GAAC,MAAM,GAAC,MAAM,GAAC,MAAM,CAAC,SAKG,EAAE,OAAO,AAJhD,CAEA,EADA;IAA2B,OAAO,AAAlC,CACA,EADQ,MAAM,EAAE,CAChB;CAEqD,GAF3C,OAAO,GAAC,MAAM,CAe1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAX5B,MAW4B,EAAE,IAAI,EAVlC,KAAK,CAAC,MAAM,GAAC,MAAM,GAAC,MAAM,GAAC,MAAM,CAAC,SAAS,CAAC,GAAC,MAAM,GAAC,MAAM,GAAC,MAAM,GAAC,MAAM,CAAC,SAUvC,EAAE,OAAO,AATnD,CAIA,EAHA;IAA0B,IAAI,AAA9B,CACA,EADQ,OAAO,CACf;IAA0B,eAAe,AAAzC,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;CAKwD,GAL9C;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAqH3G;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAHlC,MAGkC,GAFhC,MAAM,EAAE,CAepB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,GAAG,EALlB,MAKkB,EAAE,SAAS,EAJ7B,MAAM,GAAC,MAAM,GAAC,MAAM,GAAC,MAAM,CAAC,SAIC,EAAE,OAAO,AAH9C,CACA,EADQ,MAG2C,GAFzC,OAAO,GAAC,MAAM,CAc1B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAJ/B,MAI+B,EAAE,IAAI,AAH7C,CACA,EADQ,KAAK,CAAC,MAAM,GAAC,MAAM,GAAC,MAAM,GAAC,MAAM,CAAC,SAAS,CAGD,GAFxC,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAoBtG"}

package/types/lib/inventory/aiCollector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aiCollector.d.ts","sourceRoot":"","sources":["../../../lib/inventory/aiCollector.js"],"names":[],"mappings":"AAo8DA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAJvC,MAIuC,EAAE,OAAO,AAHxD,CACA,EADQ,MAGqD,GAFnD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CA2YhF;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAAC,aAAa,EAJpD,MAIoD,EAAE,OAAO,AAHrE,CACA,EADQ,MAGkE,GAFhE;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAiMhF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,aAAa,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,aAAa,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,aAAa,EAJjD,MAIiD,EAAE,OAAO,AAHlE,CACA,EADQ,MAG+D,GAF7D;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF"}
+{"version":3,"file":"aiCollector.d.ts","sourceRoot":"","sources":["../../../lib/inventory/aiCollector.js"],"names":[],"mappings":"AAu8DA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAJvC,MAIuC,EAAE,OAAO,AAHxD,CACA,EADQ,MAGqD,GAFnD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CA2YhF;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAAC,aAAa,EAJpD,MAIoD,EAAE,OAAO,AAHrE,CACA,EADQ,MAGkE,GAFhE;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAiMhF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,aAAa,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,aAAa,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,aAAa,EAJjD,MAIiD,EAAE,OAAO,AAHlE,CACA,EADQ,MAG+D,GAF7D;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF"}

package/types/lib/inventory/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../../../lib/inventory/analyzer.js"],"names":[],"mappings":"AA2sDA;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAJ3B,MAAM,QACN,MAAM,KACJ;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAO7C,CAAC;AAoqBF;;;GAGG;AACH,eAAO,MAAM,wCAAwC,UAQpD,CAAC;AA4JF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,UAQpC,CAAC;AA+JF;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAHrC,MAGqC,GAFnC;IAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAC,CA2J/H;AA2hBD;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;EAuGhC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,aAHzB,MAAM,KACJ;IAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,qBAAqB,EAAE,MAAM,EAAE,CAAA;CAe9H,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAHvC,MAGuC,GAFrC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,2BAA0B;CAAC,CAqOnJ;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,aAH3B,MAAM,KACJ;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,2BAA0B;CAAC,GAAC,SAgBpJ,CAAC;AAyQF;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAHjC,MAGiC,GAF/B;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,CA2avD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,aAHrB,MAAM,KACJ;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAUxD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,QAJzB,MAAM,SACN,OAAO,KACL,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,CAiC/D,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,QAN7B,MAAM,SACN,OAAO,KACL;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,2BAA0B;CAuGzE,CAAC;AAg9BF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,QAJ1B,MAAM,SACN,OAAO,KACL;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAiJ7E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,QAJpB,MAAM,SACN,OAAO,KACL;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAqrB7E,CAAC"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../../../lib/inventory/analyzer.js"],"names":[],"mappings":"AA6vDA;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAJ3B,MAAM,QACN,MAAM,KACJ;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAO7C,CAAC;AAmpBF;;;GAGG;AACH,eAAO,MAAM,wCAAwC,UAQpD,CAAC;AA4JF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,UAQpC,CAAC;AA+JF;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAHrC,MAGqC,GAFnC;IAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAC,CA2J/H;AA2hBD;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;EAsGhC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,aAHzB,MAAM,KACJ;IAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,qBAAqB,EAAE,MAAM,EAAE,CAAA;CAe9H,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAHvC,MAGuC,GAFrC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,2BAA0B;CAAC,CAqOnJ;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,aAH3B,MAAM,KACJ;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,2BAA0B;CAAC,GAAC,SAgBpJ,CAAC;AAyQF;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAHjC,MAGiC,GAF/B;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,CA2avD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,aAHrB,MAAM,KACJ;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAUxD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,QAJzB,MAAM,SACN,OAAO,KACL,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,CAgC/D,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,QAN7B,MAAM,SACN,OAAO,KACL;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,2BAA0B;CA+EzE,CAAC;AAg9BF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,QAJ1B,MAAM,SACN,OAAO,KACL;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAiJ7E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,QAJpB,MAAM,SACN,OAAO,KACL;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CA6pB7E,CAAC"}

package/types/lib/inventory/atomUtils.d.ts

@@ -3,6 +3,64 @@
  * bundled native `atom` binary.
  */
 export declare const ATOM_NATIVE_PACKAGES: Set<string>;
+/**
+ * Locate the JSON compilation database (`compile_commands.json`) of a C/C++
+ * project, which lets atom parse each file with the include paths, macros and
+ * language its build uses.
+ *
+ * An explicit `options.compileCommands` (a file, or a directory holding one
+ * directly or under `build/`) wins. Otherwise the scan root and the project's
+ * build directories are searched: the directory of `options.cmakeCache`, the
+ * build directories of its CMake presets, and the conventional `build`,
+ * `out`, `builddir` and `cmake-build-` directories (see
+ * `cmakeBuildDirCandidates`). A database can come with the code it describes,
+ * and atom asks the
+ * GCC or Clang driver it names (from the PATH, or an absolute path outside
+ * the project) for its predefined macros, so in secure mode only an explicit
+ * database is used.
+ *
+ * @param {string} src Project scan root
+ * @param {Object} options CLI options
+ * @returns {string|undefined} Absolute path of the database
+ */
+export declare function findCompileCommands(src: string, options?: Object): string | undefined;
+/**
+ * Split an atom command that may carry a leading argument (`node
+ * script.js`, a custom `ATOM_CMD`) into its binary and that argument. The
+ * first space only splits when it can: a binary under a path with spaces
+ * (`C:\Program Files\...\node.exe script.js`) would otherwise be cut
+ * mid-path and the shell told to run `C:\Program`. A command name without a
+ * path separator (`node script.js`) resolves through the PATH, so it splits
+ * at its first space as before; otherwise the first prefix that exists as a
+ * file is the binary, and when none does the first space keeps the old
+ * behaviour.
+ *
+ * @param {string} command The atom command, possibly with an argument
+ * @returns {[string, string|undefined]} The binary and its leading argument, when present
+ */
+export declare function splitAtomCommand(command: string): [string, string | undefined];
+/**
+ * The `--frontend-args` keys the installed atom accepts for a language, as
+ * `atom --frontend-args-keys -l <language>` lists them. Asked once per atom
+ * command and language. An atom that cannot list them (a release without
+ * `--frontend-args`, or one that fails to start) accepts none.
+ *
+ * @param {string} language atom `-l` value
+ * @returns {Set<string>} Supported keys
+ */
+export declare function atomFrontendArgKeys(language: string): Set<string>;
+/**
+ * The `--frontend-args` atom takes for a C/C++ language: the project's
+ * compilation database, when there is one and the installed atom reads it
+ * (atom 4 and later). An older atom is given the arguments it has always
+ * been given, and parses the sources without the database.
+ *
+ * @param {string} src Project scan root
+ * @param {string} language atom `-l` value
+ * @param {Object} options CLI options
+ * @returns {string[]} Arguments to add to the atom command
+ */
+export declare function atomCompileCommandsArgs(src: string, language: string, options?: Object): string[];
 /**
  * Convert cdxgen's glob-style exclude patterns to a Scala/Java regex string.
  *
@@ -69,18 +127,47 @@ export declare function resolveAtomProvider(opts?: {
     libc?: string;
 };
 /**
- * Returns `"native"` or `"jar"` for the currently resolved atom provider.
- * Used to gate Java/JDK advice so users on the five native platforms are not
- * told to install a JDK for a failure that has nothing to do with Java.
+ * Returns `"native"` or `"jar"` for the atom provider that will actually run.
+ *
+ * The platform decides which provider atom prefers, but the dispatcher falls
+ * back to the jar package when the platform's native package is not installed
+ * (optional dependencies skipped, a failed download). The two take the heap
+ * ceiling differently, and a native-image runtime option on a jar run reaches
+ * atom as an unknown argument that fails every slice. So the kind follows what
+ * is installed where cdxgen can see it: the native binary means native, the jar
+ * package without it means jar. An `ATOM_CMD` is classified by what it names
+ * (see `atomCommandKind`). With nothing in view (an install elsewhere) the
+ * platform's kind stands.
+ *
+ * Also used to gate Java/JDK advice, so users on the five native platforms are
+ * not told to install a JDK for a failure that has nothing to do with Java.
  */
 export declare function atomProviderKind(): "jar" | "native";
+/**
+ * Whether `ATOM_CMD` launches a jar or follows the platform.
+ *
+ * The jar launchers (`plugins/bin/atom`, `plugins/bin/atom.bat`) sit next to a
+ * `plugins/lib` directory holding atom's jars, so a launcher with that sibling,
+ * or any `.bat` (only the jar payload ships one), runs on the JVM whatever the
+ * platform is. Everything else, including the npm dispatcher (`node
+ * .../index.js`, its `atom`/`atom.cmd` bin shims) and a native binary, follows
+ * the platform's kind. A GraalVM `-XX:` heap argument handed to a jar launcher
+ * is rejected by atom's option parser before any analysis starts, and a
+ * `JAVA_TOOL_OPTIONS` ceiling handed to a native image is silently ignored, so
+ * the distinction decides whether the heap is bounded at all.
+ *
+ * @param {string} command The `ATOM_CMD` value
+ * @param {"native"|"jar"} platformKind Kind the platform prefers
+ * @returns {"native"|"jar"}
+ */
+export declare function atomCommandKind(command: string, platformKind: "native" | "jar"): "native" | "jar";
 /**
  * Locate the `php-parse` binary that the PHP frontend needs.
  *
  * atom 3's dispatcher unconditionally sets `PHP_PARSER_BIN=<ATOM_HOME>/bin/php-parse`,
  * which for a native sub-package does not exist and also clobbers a caller-set
- * value. cdxgen therefore resolves the real location and forwards it through
- * the child env (see `buildAtomCommandEnv`); `executeAtom` then spawns the
+ * value. cdxgen therefore resolves the real location and forwards it through the
+ * child env (see `buildAtomCommandEnv`); `executeAtom` then spawns the
  * native binary directly for PHP so the dispatcher cannot clobber it (see
  * `resolveDirectAtomBinaryPath`). Resolution order:
  *   1. explicit `PHP_PARSER_BIN` env var (operators / container images)
@@ -94,6 +181,35 @@ export declare function atomProviderKind(): "jar" | "native";
  * @returns {string|undefined}
  */
 export declare function resolvePhpParseBin(): string | undefined;
+/**
+ * Locate the `phpastgen` generator that lets the PHP frontend parse whole
+ * directories in one batch.
+ *
+ * `php-parse` (forwarded as `PHP_PARSER_BIN`) is the per-file parser: atom
+ * starts a php interpreter for every `.php` file, which on windows turns a
+ * vendored PHP project (thousands of files under `vendor/`) into an hours-long
+ * run that no timeout can rescue. `phpastgen` answers the `--parser-info`
+ * capability probe, so atom's batch path engages, and atom-parsetools 1.9 and
+ * later parse the whole tree, vendor included, with a few interpreters that
+ * each take a chunk of files. It is a Node script, so the frontend launches it
+ * with `node` rather than `php`; an atom that does not know `PHP_ASTGEN_BIN`
+ * simply ignores it and keeps today's per-file behaviour. Resolution order:
+ *   1. explicit `PHP_ASTGEN_BIN` env var (operators / container images)
+ *   2. `@appthreat/atom-parsetools/phpastgen.js` under cdxgen's own
+ *      node_modules, then under `GLOBAL_NODE_MODULES_PATH` for global installs
+ *
+ * @returns {string|undefined}
+ */
+export declare function resolvePhpAstgenBin(): string | undefined;
+/**
+ * Resolve a file inside the installed `@appthreat/atom-parsetools` package,
+ * searching cdxgen's own node_modules and `GLOBAL_NODE_MODULES_PATH` for global
+ * installs.
+ *
+ * @param {...string} segments Path segments below the package root
+ * @returns {string|undefined}
+ */
+export declare function parsetoolsFile(...segments: string[]): string | undefined;
 /**
  * Resolve the atom native binary path directly, bypassing the dispatcher.
  *
@@ -131,6 +247,62 @@ export declare function getAtomCommand(): any;
  * @returns {number|undefined} Heap ceiling in bytes, or `undefined` to leave the runtime default in place
  */
 export declare function atomMaxHeapBytes(): number | undefined;
+/**
+ * Compute how long atom may run, and how long cdxgen waits for it.
+ *
+ * cdxgen's spawn timeout kills only the process cdxgen started, and for atom
+ * that is the npm dispatcher. The runtime under it (the native binary or the
+ * JVM) used to survive that kill, re-parented and still holding its heap. atom
+ * therefore gets its own limit, `ATOM_TIMEOUT`, which the dispatcher enforces on
+ * the runtime, and cdxgen's spawn timeout sits a grace period beyond it as the
+ * last resort.
+ *
+ * An explicit `ATOM_TIMEOUT` (milliseconds) sets atom's limit independently of
+ * `CDXGEN_TIMEOUT_MS`, which keeps bounding every other tool. Otherwise atom's
+ * limit is `CDXGEN_TIMEOUT_MS` less the grace period.
+ *
+ * @returns {{atomTimeoutMs: number, spawnTimeoutMs: number}} atom's own limit and cdxgen's spawn timeout for it
+ */
+export declare function atomTimeouts(): {
+    atomTimeoutMs: number;
+    spawnTimeoutMs: number;
+};
+/**
+ * Reap everything a timed-out atom run left behind on Windows.
+ *
+ * cdxgen starts atom through a shell there (`shell: isWin`), so the spawn
+ * timeout terminates only that `cmd.exe`, and the runtime and every parser
+ * worker under it (one `php.exe` per file for the per-file PHP frontend) keep
+ * running against the next slice of the same run. See
+ * {@link reapProcessTree} for how they are found. A chain broken by an
+ * intermediate that already exited (the npm dispatcher stopping its runtime
+ * itself) cannot be followed, and atom 4 stops its helpers once
+ * `ATOM_PARENT_PID` is gone.
+ *
+ * @param {number|undefined} rootPid pid of the process cdxgen spawned
+ * @param {number} startedAt Epoch milliseconds at which the run started
+ * @param {number} [endedAt] Epoch milliseconds at which the spawned process ended
+ * @returns {number[]} The pids that were stopped
+ */
+export declare function reapAtomProcessTree(rootPid: number | undefined, startedAt: number, endedAt?: number): number[];
+/**
+ * Whether an atom run ended because it ran out of time.
+ *
+ * The dispatcher reports its own limit with status 124. cdxgen's spawn timeout
+ * shows up as `ETIMEDOUT`. A dispatcher older than the status code stops atom
+ * with SIGTERM and passes on how the runtime ended: 1, or the runtime's own
+ * exit on SIGTERM (143) or SIGKILL (137), which is what atom 3.1 reports. Those
+ * statuses at or past the limit count as well, unless atom's own output shows
+ * it failed for another reason first (an exhausted heap, a crash), which
+ * deserves its own diagnosis. Missing one leaves the half-written atom behind,
+ * and the next slice of the run fails to load it.
+ *
+ * @param {Object} result spawnSync result
+ * @param {number} elapsedMs How long the run took
+ * @param {number} atomTimeoutMs atom's time limit
+ * @returns {boolean} true when the run hit a time limit
+ */
+export declare function atomRunTimedOut(result: Object, elapsedMs: number, atomTimeoutMs: number): boolean;
 /**
  * Execute the atom tool against a source directory or file with the given arguments.
  *
@@ -145,6 +317,48 @@ export declare function atomMaxHeapBytes(): number | undefined;
  * @returns {boolean} `true` if atom executed successfully and the language is supported; `false` otherwise
  */
 export declare function executeAtom(src: string, args: string[], extra_env?: Object): boolean;
+/**
+ * The numbered chunks atom wrote beside a reachables slices file.
+ *
+ * atom writes reachables at most 1000 flows per file: `<base>.json`, then
+ * `<base>_1.json`, `<base>_2.json` and so on. Chunks are taken until the first
+ * gap. A chunk older than the base file was left by an earlier run with more
+ * flows (atom before 4.0.0 did not remove those), so it ends the sequence
+ * instead of being merged.
+ *
+ * @param {string} slicesFile Path of the base reachables slices file
+ * @returns {string[]} Chunk file paths, in order
+ */
+export declare function reachablesChunkFiles(slicesFile: string): string[];
+/**
+ * Remove the numbered chunks beside a reachables slices file, before atom
+ * writes a new set there, so no chunk of an earlier run survives next to it.
+ *
+ * @param {string} slicesFile Path of the base reachables slices file
+ */
+export declare function removeReachablesChunkFiles(slicesFile: string): void;
+/**
+ * Read an atom slices file, or warn and return `undefined` when it cannot be
+ * parsed. A run stopped while writing (a timeout, a kill) can leave a
+ * truncated file, and the evidence from the other slices is still worth
+ * keeping.
+ *
+ * @param {string} slicesFile Path of the slices file
+ * @param {string} sliceType Slice type, for the warning
+ * @returns {*} The parsed slices, or `undefined`
+ */
+export declare function readSlicesFile(slicesFile: string, sliceType: string): any;
+/**
+ * Read a reachables slices file together with its chunks.
+ *
+ * Reading only the base file silently dropped every flow past the first
+ * thousand. A chunk that cannot be parsed ends the sequence, keeping the flows
+ * read before it.
+ *
+ * @param {string} slicesFile Path of the base reachables slices file
+ * @returns {Object[]|Object|undefined} Every flow, in the base file's shape (an array, or an object with `reachables`)
+ */
+export declare function readReachablesSlices(slicesFile: string): Object[] | Object | undefined;
 /**
  * Find the imported modules in the application with atom parsedeps command
  *

package/types/lib/inventory/atomUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"atomUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/atomUtils.js"],"names":[],"mappings":"AA6CA;;;GAGG;AACH,eAAO,MAAM,oBAAoB,aAM/B,CAAC;AA4RH;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,GAH3C,MAAM,EAG0C,GAF9C,MAAM,GAAC,SAAS,CAU5B;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAJ1C,MAI0C,EAAE,QAAQ,AAH5D,CACA,EADQ,MAAM,EAGmD,GAFvD,OAAO,CAkBnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAAC,SAAS,EAJhD,MAAM,QAI0C,EAAE,QAAQ,AAHlE,CACA,EADQ,MAAM,EAGyD,GAF7D,MAAM,QAAM,CA2DxB;AA4BD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAJhC,MAIqC,EAAE,QAAQ,GAH/C,MAGoD,GAFlD,MAAM,CAkDlB;AAgBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,AANrC,CAIA,EAHA;IAAsB,QAAQ,AAA9B,CACA,EADQ,MAAM,CACd;IAAsB,IAAI,AAA1B,CACA,EADQ,MAAM,CACd;IAAsB,IAAI,AAA1B,CACA,EADQ,MAAM,CACd;CAE0C,GAFhC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,GAAC,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,CA6CvG;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,qBAE/B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,IAFrB,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,IAF9B,MAAM,GAAC,SAAS,CAkD5B;AAsBD;;GAEG;AACH,wBAAgB,cAAc,QAwB7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,GAAC,SAAS,CA0B5B;AA0DD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,GAAG,EALpB,MAKoB,EAAE,IAAI,EAJ1B,MAAM,EAIoB,EAAE,SAAS,GAHrC,MAG0C,GAFxC,OAAO,CAqJnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EARM,MAQN,EACH,QAAQ,EARC,MAQD,EACR,WAAW,GARF,MAQa,EACtB,UAAU,GARD,MAQa,EACtB,OAAO,GARE,MAQG,OAsCb"}
+{"version":3,"file":"atomUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/atomUtils.js"],"names":[],"mappings":"AAiEA;;;GAGG;AACH,eAAO,MAAM,oBAAoB,aAM/B,CAAC;AA2CH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,EAAE,OAAO,GAHrC,MAG0C,GAFxC,MAAM,GAAC,SAAS,CA6C5B;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAwBtC;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,GAAG,CAAC,MAAM,CAAC,CAwCvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,QAAQ,EAJ1C,MAI0C,EAAE,OAAO,GAHnD,MAGwD,GAFtD,MAAM,EAAE,CAiCpB;AA0RD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,GAH3C,MAAM,EAG0C,GAF9C,MAAM,GAAC,SAAS,CAU5B;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAJ1C,MAI0C,EAAE,QAAQ,AAH5D,CACA,EADQ,MAAM,EAGmD,GAFvD,OAAO,CAkBnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAAC,SAAS,EAJhD,MAAM,QAI0C,EAAE,QAAQ,AAHlE,CACA,EADQ,MAAM,EAGyD,GAF7D,MAAM,QAAM,CA2DxB;AA4BD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAJhC,MAIqC,EAAE,QAAQ,GAH/C,MAGoD,GAFlD,MAAM,CA6DlB;AAgBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,AANrC,CAIA,EAHA;IAAsB,QAAQ,AAA9B,CACA,EADQ,MAAM,CACd;IAAsB,IAAI,AAA1B,CACA,EADQ,MAAM,CACd;IAAsB,IAAI,AAA1B,CACA,EADQ,MAAM,CACd;CAE0C,GAFhC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,GAAC,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,CA6CvG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,qBAqB/B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAJ5B,MAI4B,EAAE,YAAY,EAH1C,QAAQ,GAAC,KAGiC,GAFxC,QAAQ,GAAC,KAAK,CAkC1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,IAFrB,MAAM,GAAC,SAAS,CAO5B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,GAAC,SAAS,CAO5B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,QAAQ,EAH5B,MAAM,EAGsB,GAF7B,MAAM,GAAC,SAAS,CAoB5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,IAF9B,MAAM,GAAC,SAAS,CAgB5B;AAmED;;GAEG;AACH,wBAAgB,cAAc,QAwB7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,GAAC,SAAS,CA0B5B;AAgED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,IAFf;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAC,CAkB3D;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EALhC,MAAM,GAAC,SAKyB,EAAE,SAAS,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGiE,GAF/D,MAAM,EAAE,CAIpB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAL3B,MAK2B,EAAE,SAAS,EAJtC,MAIsC,EAAE,aAAa,EAHrD,MAGqD,GAFnD,OAAO,CAiBnB;AAeD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,GAAG,EALpB,MAKoB,EAAE,IAAI,EAJ1B,MAAM,EAIoB,EAAE,SAAS,GAHrC,MAG0C,GAFxC,OAAO,CA0KnB;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAHpC,MAGoC,GAFlC,MAAM,EAAE,CAwBpB;AAcD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAF1C,MAE0C,QAQpD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAJ9B,MAI8B,EAAE,SAAS,EAHzC,MAGyC,GAFvC,GAAC,CAcb;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAHpC,MAGoC,GAFlC,MAAM,EAAE,GAAC,MAAM,GAAC,SAAS,CAwBrC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EARM,MAQN,EACH,QAAQ,EARC,MAQD,EACR,WAAW,GARF,MAQa,EACtB,UAAU,GARD,MAQa,EACtB,OAAO,GARE,MAQG,OA8Cb"}

package/types/lib/inventory/auditCategories.d.ts

@@ -6,6 +6,8 @@ export declare const CBOM_AUDIT_CATEGORIES: readonly string[];
 export declare const HOST_TOPOLOGY_AUDIT_CATEGORIES: readonly string[];
 /** Frozen list of Golem (Go Evinse) audit categories. */
 export declare const GOLEM_AUDIT_CATEGORIES: readonly string[];
+/** Frozen list of Scala Evinse (scalasem) audit categories. */
+export declare const SCALA_AUDIT_CATEGORIES: readonly string[];
 /** Frozen list of Cargo (Rust) audit categories. */
 export declare const CARGO_AUDIT_CATEGORIES: readonly string[];
 /**
@@ -36,6 +38,7 @@ export declare const BOM_AUDIT_CATEGORY_ALIASES: Readonly<{
     golem: string[];
     hbom: string[];
     rust: string[];
+    scala: string[];
     host: string[];
 }>;
 /**

package/types/lib/inventory/auditCategories.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auditCategories.d.ts","sourceRoot":"","sources":["../../../lib/inventory/auditCategories.js"],"names":[],"mappings":"AAEA,yEAAyE;AACzE,eAAO,MAAM,qBAAqB,mBAIhC,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,mBAGhC,CAAC;AAEH,qDAAqD;AACrD,eAAO,MAAM,8BAA8B,mBAAmC,CAAC;AAE/E,yDAAyD;AACzD,eAAO,MAAM,sBAAsB,mBAIjC,CAAC;AAEH,oDAAoD;AACpD,eAAO,MAAM,sBAAsB,mBAGjC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,mBAAoC,CAAC;AAE7E,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,mBAIlC,CAAC;AAEH,gFAAgF;AAChF,eAAO,MAAM,6BAA6B,QAAkC,CAAC;AAE7E;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;EAarC,CAAC;AAMH;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAH3C,MAAM,GAAC,MAAM,EAG8B,GAFzC,MAAM,EAAE,CAiBpB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAHxC,MAAM,GAAC,MAAM,EAG2B,GAFtC,MAAM,EAAE,CAapB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAHtC,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,CAGa,GAFpC,MAAM,EAAE,CAMpB;AAUD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAJ1C,MAAM,GAAC,MAAM,EAI6B,EAAE,KAAK,EAHjD,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,CAGwB,GAF/C;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAC,CAyB3F;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAJzC,MAIyC,EAAE,WAAW,AAH9D,CACA,EADQ,MAGsD,GAFpD,MAAM,GAAG,SAAS,CA8B9B"}
+{"version":3,"file":"auditCategories.d.ts","sourceRoot":"","sources":["../../../lib/inventory/auditCategories.js"],"names":[],"mappings":"AAEA,yEAAyE;AACzE,eAAO,MAAM,qBAAqB,mBAIhC,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,mBAGhC,CAAC;AAEH,qDAAqD;AACrD,eAAO,MAAM,8BAA8B,mBAAmC,CAAC;AAE/E,yDAAyD;AACzD,eAAO,MAAM,sBAAsB,mBAIjC,CAAC;AAEH,+DAA+D;AAC/D,eAAO,MAAM,sBAAsB,mBAGjC,CAAC;AAEH,oDAAoD;AACpD,eAAO,MAAM,sBAAsB,mBAGjC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,mBAAoC,CAAC;AAE7E,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,mBAIlC,CAAC;AAEH,gFAAgF;AAChF,eAAO,MAAM,6BAA6B,QAAkC,CAAC;AAE7E;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;EAcrC,CAAC;AAMH;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAH3C,MAAM,GAAC,MAAM,EAG8B,GAFzC,MAAM,EAAE,CAiBpB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAHxC,MAAM,GAAC,MAAM,EAG2B,GAFtC,MAAM,EAAE,CAapB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAHtC,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,CAGa,GAFpC,MAAM,EAAE,CAMpB;AAUD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAJ1C,MAAM,GAAC,MAAM,EAI6B,EAAE,KAAK,EAHjD,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,CAGwB,GAF/C;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAC,CAyB3F;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAJzC,MAIyC,EAAE,WAAW,AAH9D,CACA,EADQ,MAGsD,GAFpD,MAAM,GAAG,SAAS,CA8B9B"}

package/types/lib/inventory/buildToolRateLimit.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Whether a tool's combined output names a rate limit from its repository.
+ * The answer text is treated as untrusted: only fixed substrings are looked
+ * for, nothing from the output is kept.
+ *
+ * @param {string} output Combined stdout and stderr of one invocation.
+ * @param {string} tool One of maven, gradle, sbt, mill, scala-cli.
+ * @returns {boolean} True when the output names an HTTP 429 answer.
+ */
+export declare function detectBuildToolRateLimit(output: string, tool: string): boolean;
+/**
+ * Whether a tool was already found rate limited in this scan, so the caller
+ * can skip its remaining invocations.
+ *
+ * @param {string} tool One of maven, gradle, sbt, mill, scala-cli.
+ * @returns {boolean}
+ */
+export declare function isBuildToolRateLimited(tool: string): boolean;
+/**
+ * Read a completed invocation's output for a rate limit. When one is found,
+ * the tool is remembered for the scan, one hint naming the tool's mirror
+ * setting is printed, and the `build.rate-limited` degradation is recorded.
+ * The first invocation that shows the rate limit is the one recorded; later
+ * ones add nothing, because the same answer ends them all.
+ *
+ * @param {string} tool One of maven, gradle, sbt, mill, scala-cli.
+ * @param {string|undefined} output Combined output, as commandOutputText
+ *   returns it for a spawn result.
+ * @param {Object} [context] Call-site facts for the degradation event.
+ * @param {string} [context.command] The redacted command that was attempted.
+ * @param {number} [context.exitCode] The invocation's exit status.
+ * @returns {boolean} True when this output names a rate limit.
+ */
+export declare function noteBuildToolRateLimit(tool: string, output: string | undefined, context?: {
+    command?: string;
+    exitCode?: number;
+}): boolean;
+//# sourceMappingURL=buildToolRateLimit.d.ts.map

package/types/lib/inventory/buildToolRateLimit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildToolRateLimit.d.ts","sourceRoot":"","sources":["../../../lib/inventory/buildToolRateLimit.js"],"names":[],"mappings":"AA4EA;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAJpC,MAIoC,EAAE,IAAI,EAH1C,MAG0C,GAFxC,OAAO,CAQnB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAHhC,MAGgC,GAF9B,OAAO,CAInB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EARhC,MAQgC,EAAE,MAAM,EAPxC,MAAM,GAAC,SAOiC,EAAE,OAAO,AALzD,CAGA,EAFA;IAAyB,OAAO,AAAhC,CACA,EADQ,MAAM,CACd;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;CAE8D,GAFpD,OAAO,CA0BnB"}

package/types/lib/inventory/cacheCommands.d.ts

@@ -1,5 +1,6 @@
 /**
- * `cdxgen cache` subcommand — inspect and purge the metadata fetch cache.
+ * `cdxgen cache` subcommand — inspect and purge the metadata fetch cache that
+ * cdxrs and the JS batch pool share.
  *
  * This module operates directly on the filesystem because JS is the authority
  * for the cache directory. The cache layout is:

package/types/lib/inventory/cacheCommands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cacheCommands.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cacheCommands.js"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAgCH;;;;;GAKG;AACH,wBAAgB,SAAS,IAHZ,MAAM,CAwDlB;AAED;;;;GAIG;AACH,wBAAgB,UAAU,IAFb,MAAM,CAwBlB;AAUD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAHjC,MAAM,GAAC,OAG0B,GAF/B,OAAO,CAAC,MAAM,CAAC,CAyC3B"}
+{"version":3,"file":"cacheCommands.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cacheCommands.js"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAgCH;;;;;GAKG;AACH,wBAAgB,SAAS,IAHZ,MAAM,CAwDlB;AAED;;;;GAIG;AACH,wBAAgB,UAAU,IAFb,MAAM,CAwBlB;AAUD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAHjC,MAAM,GAAC,OAG0B,GAF/B,OAAO,CAAC,MAAM,CAAC,CAyC3B"}

package/types/lib/inventory/cdxrs.d.ts

@@ -3,9 +3,9 @@
  *
  * This module is the ONLY place that spawns the `cdxrs` binary. It enforces
  * the governing invariant: **no failure mode may abort SBOM generation.**
- * Every failure (missing binary, non-zero exit, timeout, malformed stdout,
- * version-major mismatch, CDXGEN_RS_DISABLE) logs once at `warn` and returns
- * a sentinel that makes the caller take the JS path.
+ * Every failure (missing binary, non-zero exit, timeout, oversized stdout,
+ * malformed stdout, version-major mismatch, CDXGEN_RS_DISABLE) logs once at
+ * `warn` and returns a sentinel that makes the caller take the JS path.
  *
  * Protocol:
  *   cdxrs <subcommand> --input <file|-> --output <file|-> --format json
@@ -67,6 +67,11 @@ export declare function cdxrsAvailable(subcommand?: string): {
  *
  * Passing `content` is the normal case, since cdxgen holds BOMs in memory.
  *
+ * Collected stdout is bounded: it must become a single JS string, so a child
+ * that would exceed V8's string limit (by default; see
+ * CDXGEN_RS_MAX_STDOUT_BYTES) is killed and reported as a fallback instead of
+ * crashing the process at the concat.
+ *
  * @param {string} subcommand The subcommand to run (e.g. "info").
  * @param {Object} opts
  * @param {string|Buffer} [opts.content] BOM data to feed over stdin.

package/types/lib/inventory/cdxrs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cdxrs.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cdxrs.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAwBH,iFAAiF;AACjF,eAAO,MAAM,cAAc;;;;;EAKzB,CAAC;AAOH;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAH7B,MAG6B,GAF3B,OAAO,CAkBnB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAFlB,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,UAAU,AAHtC,CACA,EADQ,MAG8B,GAF5B;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAuBrE;AA2BD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,QAAQ,CAAC,UAAU,EAT9B,MAS8B,EAAE,IAAI,GAP5C;IAA6B,OAAO,AAApC,CACA,EADQ,MAAM,GAAC,MAAM,CACrB;IAAsB,KAAK,AAA3B,CAEA,EAFQ,MAAM,CAEd;IAAwB,IAAI,AAA5B,CACA,EADQ,MAAM,EAAE,CAChB;IAAsB,SAAS,AAA/B,CACA,EADQ,MAAM,CACd;CAEiD,GAFvC,OAAO,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAC,CAAC,CAiP1F"}
+{"version":3,"file":"cdxrs.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cdxrs.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAoEH,iFAAiF;AACjF,eAAO,MAAM,cAAc;;;;;EAKzB,CAAC;AAOH;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAH7B,MAG6B,GAF3B,OAAO,CAkBnB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAFlB,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,UAAU,AAHtC,CACA,EADQ,MAG8B,GAF5B;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAuBrE;AA2BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,QAAQ,CAAC,UAAU,EAT9B,MAS8B,EAAE,IAAI,GAP5C;IAA6B,OAAO,AAApC,CACA,EADQ,MAAM,GAAC,MAAM,CACrB;IAAsB,KAAK,AAA3B,CAEA,EAFQ,MAAM,CAEd;IAAwB,IAAI,AAA5B,CACA,EADQ,MAAM,EAAE,CAChB;IAAsB,SAAS,AAA/B,CACA,EADQ,MAAM,CACd;CAEiD,GAFvC,OAAO,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAC,CAAC,CAgS1F"}