@cdxgen/cdxgen 13.2.0 → 13.4.0

package/types/lib/inventory/cmakeBuildDirs.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Where a C/C++ project's build trees are: the build directories its CMake
+ * presets configure, and the conventional ones (`build`, `build-<name>`,
+ * `out`, `builddir`, `cmake-build-<name>`). Shared by the lookups for
+ * `CMakeCache.txt` and for the compilation database, so both search the same
+ * places in the same order.
+ */
+/**
+ * Whether `child` is `parent` or inside it.
+ *
+ * @param {string} child Path to test
+ * @param {string} parent Directory
+ * @returns {boolean}
+ */
+export declare function isInsideDir(child: string, parent: string): boolean;
+/**
+ * CMake's `${hostSystemName}` for this host.
+ *
+ * @returns {string}
+ */
+export declare function hostSystemName(): string;
+/**
+ * Read a project's presets documents: `CMakePresets.json` and
+ * `CMakeUserPresets.json`, each followed by the files it includes (schema
+ * version 4 and later). In secure mode an include outside the project is not
+ * read.
+ *
+ * @param {string} root Project source directory
+ * @returns {Array<{file: string, fileDir: string, document: Object}>}
+ */
+export declare function readCmakePresetDocuments(root: string): Array<{
+    file: string;
+    fileDir: string;
+    document: Object;
+}>;
+/**
+ * The visible configure presets of a project, resolved and with their macros
+ * expanded for this host.
+ *
+ * @param {string} root Project source directory
+ * @returns {Object[]} See `resolveConfigurePresets`
+ */
+export declare function readCmakeConfigurePresets(root: string): Object[];
+/**
+ * The directories a project's build trees may be in, most specific first:
+ * the directory of an explicit `--cmake-cache`, the build directories of its
+ * configure presets, then the `build`, `build-<name>`, `out`, `builddir` and
+ * `cmake-build-<name>` directories at the project root, and the directories
+ * one level below `build`, `out` and `out/build` (where Visual Studio puts
+ * preset builds). Only existing directories are listed; in secure mode, only
+ * those inside the project.
+ *
+ * @param {string} root Project source directory
+ * @param {Object} [options] CLI options (`cmakeCache`)
+ * @returns {string[]} Absolute directories, without duplicates
+ */
+export declare function cmakeBuildDirCandidates(root: string, options?: Object): string[];
+//# sourceMappingURL=cmakeBuildDirs.d.ts.map

package/types/lib/inventory/cmakeBuildDirs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cmakeBuildDirs.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cmakeBuildDirs.js"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA4CH;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAJtB,MAIsB,EAAE,MAAM,EAH9B,MAG8B,GAF5B,OAAO,CAKnB;AAsBD;;;;GAIG;AACH,wBAAgB,cAAc,IAFjB,MAAM,CAIlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAHlC,MAGkC,GAFhC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,CAAC,CAsCpE;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAgBpB;AA+BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAJjC,MAIiC,EAAE,OAAO,AAHlD,CACA,EADQ,MAG+C,GAF7C,MAAM,EAAE,CAoDpB"}

package/types/lib/inventory/deps.d.ts

@@ -1,3 +1,10 @@
+/**
+ * Whether a jar holds sources or javadoc rather than classes.
+ *
+ * @param {string} jarName Jar file name.
+ * @returns {boolean}
+ */
+export declare function isDocumentationJar(jarName: string): boolean;
 /**
  * Collect maven dependencies
  *
@@ -67,11 +74,62 @@ export declare function parsePomProperties(pomProperties: string): Object;
 /**
  * Method to get pom properties from maven directory
  *
+ * A shaded or fat jar carries a `pom.properties` for every artifact folded
+ * into it. When the jar's file name is known, the descriptor whose
+ * `artifactId-version` (or `artifactId`) starts the file name is the jar's
+ * own; otherwise the first descriptor is used, as before.
+ *
  * @param {string} mavenDir Path to maven directory
+ * @param {string} [jarName] File name of the jar the directory came from
  *
  * @return array with pom properties
  */
-export declare function getPomPropertiesFromMavenDir(mavenDir: string): {};
+export declare function getPomPropertiesFromMavenDir(mavenDir: string, jarName?: string): Object;
+/**
+ * The licences a MANIFEST.MF `Bundle-License` value names. The value is a
+ * comma-separated list; each item is an SPDX id, a licence name or a URL,
+ * optionally followed by `;link=` and `;description=` attributes, and any
+ * part may be quoted. Each item is mapped through findLicenseId; an item it
+ * cannot map is replaced by its `link` URL when one is given, which the
+ * licence URL lookup resolves later. `<<EXTERNAL>>` names no licence.
+ *
+ * @param {string} value Raw Bundle-License value.
+ * @returns {string[]} Licence ids, names or URLs, without duplicates.
+ */
+export declare function parseManifestLicenseList(value: string): string[];
+/**
+ * The Maven descriptor a jar carries for itself, read from an extracted
+ * `META-INF/maven` directory: the pom.properties that names the jar's own
+ * coordinates and the pom.xml stored beside it.
+ *
+ * @param {string} mavenDir Path to the extracted META-INF/maven directory
+ * @param {string} [jarName] File name of the jar the directory came from
+ * @returns {{properties: Object, pomXml?: string}|undefined} The chosen
+ *   descriptor, with its pom.xml text when one is stored beside it.
+ */
+export declare function readEmbeddedMavenDescriptor(mavenDir: string, jarName?: string): {
+    properties: Object;
+    pomXml?: string;
+} | undefined;
+/**
+ * The Maven descriptor and manifest licence a jar carries for itself, read
+ * from its zip without extracting it. Entry names are only matched and
+ * paired, never used as paths, and each entry is read only under a size
+ * bound, because the archive is untrusted input.
+ *
+ * @param {string} jarFile Path to the jar.
+ * @param {{group: string, name: string, version: string}} coordinates The jar's own coordinates, which choose its descriptor.
+ * @returns {Promise<{properties?: Object, pomXml?: string, manifestLicenses?: string[]}|undefined>}
+ */
+export declare function readEmbeddedJarMetadata(jarFile: string, coordinates: {
+    group: string;
+    name: string;
+    version: string;
+}): Promise<{
+    properties?: Object;
+    pomXml?: string;
+    manifestLicenses?: string[];
+} | undefined>;
 /**
  * Method to read a single file entry from a zip file
  *

package/types/lib/inventory/deps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deps.d.ts","sourceRoot":"","sources":["../../../lib/inventory/deps.js"],"names":[],"mappings":"AA6BA;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EANC,MAMD,EACR,QAAQ,EANC,MAMD,EACR,OAAO,GANE,OAMK,EACd,eAAe,GANN,OAMc,eAuDxB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAL/B,MAK+B,EAAE,UAAU,GAJ3C,MAIgD,eAsK1D;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,YAAY,EAH9C,MAG8C,GAF5C,OAAO,CAAC,MAAM,EAAE,CAAC,CAgE7B;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,UAAU,KAAA,GAFzB,MAAM,CAkClB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAHjC,MAGiC,GAF/B,MAAM,CAiBlB;AAgBD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,GAH1C,MAG+C,GAF7C,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAJ7B,MAI6B,EAAE,IAAI,EAHnC,MAGmC,GAFjC,MAAM,CAqBlB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAHrC,MAGqC,GAFnC,MAAM,CAiBlB;AACD;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAJ1C,MAI0C,MAYpD;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAPE,MAOF,EACP,WAAW,EAPF,MAOE,EACX,eAAe,GAPN,MAOgB,GALd,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA4CrC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EARE,MAQF,EACP,YAAY,EARH,MAQG,EACZ,EAAE,eAAyB,EAAE,aAA+B,EAAE,AAR7D,CAGA,EAFA;IAAsB,eAAe,AAArC,CACA,EADQ,MAAM,CACd;IAAsB,aAAa,AAAnC,CACA,EADQ,MAAM,CACd;CAKkE,GALxD,OAAO,CAAC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,CAAC,CAAC,CAkDxD;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAJhC,MAIgC,gBAqE1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,eAAe,EANhC,MAMgC,EAAE,OAAO,EALzC,MAAM,EAKmC,EAAE,cAAc,EAJzD,MAIyD,EAAE,CAAC,EAH5D,MAG4D,GAF1D,IAAI,CAqDhB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAJtB,MAAM,GAAC,MAIe,EAAE,CAAC,EAHzB,MAAM,GAAC,MAGkB,GAFvB,MAAM,CAWlB"}
+{"version":3,"file":"deps.d.ts","sourceRoot":"","sources":["../../../lib/inventory/deps.js"],"names":[],"mappings":"AA+BA;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B,OAAO,CAInB;AA0DD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EANC,MAMD,EACR,QAAQ,EANC,MAMD,EACR,OAAO,GANE,OAMK,EACd,eAAe,GANN,OAMc,eA2ExB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAL/B,MAK+B,EAAE,UAAU,GAJ3C,MAIgD,eA4I1D;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,YAAY,EAH9C,MAG8C,GAF5C,OAAO,CAAC,MAAM,EAAE,CAAC,CAgE7B;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,UAAU,KAAA,GAFzB,MAAM,CAkClB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAHjC,MAGiC,GAF/B,MAAM,CA0BlB;AAgBD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,GAH1C,MAG+C,GAF7C,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAJ7B,MAI6B,EAAE,IAAI,EAHnC,MAGmC,GAFjC,MAAM,CAqBlB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAHrC,MAGqC,GAFnC,MAAM,CAiBlB;AACD;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAL1C,MAK0C,EAAE,OAAO,AAJ3D,CAEA,EAFQ,MAI+D,UAEzE;AAqID;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CA4BpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EALzC,MAKyC,EAAE,OAAO,AAJ1D,CACA,EADQ,MAI8D,GAH5D;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAe3D;AA4BD;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAJ1C,MAI0C,EAAE,WAAW,EAHvD;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAGU,GAFrD,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAAS,CAAC,CAgFlG;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAPE,MAOF,EACP,WAAW,EAPF,MAOE,EACX,eAAe,GAPN,MAOgB,GALd,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA4CrC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EARE,MAQF,EACP,YAAY,EARH,MAQG,EACZ,EAAE,eAAyB,EAAE,aAA+B,EAAE,AAR7D,CAGA,EAFA;IAAsB,eAAe,AAArC,CACA,EADQ,MAAM,CACd;IAAsB,aAAa,AAAnC,CACA,EADQ,MAAM,CACd;CAKkE,GALxD,OAAO,CAAC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,CAAC,CAAC,CAkDxD;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAJhC,MAIgC,gBAqE1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,eAAe,EANhC,MAMgC,EAAE,OAAO,EALzC,MAAM,EAKmC,EAAE,cAAc,EAJzD,MAIyD,EAAE,CAAC,EAH5D,MAG4D,GAF1D,IAAI,CAqDhB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAJtB,MAAM,GAAC,MAIe,EAAE,CAAC,EAHzB,MAAM,GAAC,MAGkB,GAFvB,MAAM,CAWlB"}

package/types/lib/inventory/depsUtils.d.ts

@@ -29,6 +29,21 @@ export declare function markNpmTypesPackagesAsExcluded(components?: Object[]): O
  * @returns {Object[]} The same component array with scopes updated in place
  */
 export declare function propagateRequiredScopeFromDependencies(components?: Object[], dependencies?: Object[]): Object[];
+/**
+ * Scopes the dependencies of type-only npm packages as optional.
+ *
+ * A package imported only for its TypeScript types, like an `@types` package,
+ * is erased at compile time, and so is what it depends on unless a runtime
+ * package depends on it too. A component below a type-only package becomes
+ * optional when no dependency path from a root of the graph reaches it without
+ * passing through a type-only package. A component that already has a scope,
+ * from its manifest or from usage evidence, keeps it.
+ *
+ * @param {Object[]} components CycloneDX component objects
+ * @param {Object[]} dependencies CycloneDX dependency entries
+ * @returns {Object[]} The same component array with scopes updated in place
+ */
+export declare function markTypeOnlyDependenciesOptional(components?: Object[], dependencies?: Object[]): Object[];
 /**
  * Merge CycloneDX services using bom-ref or group/name/version identity.
  *

package/types/lib/inventory/depsUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"depsUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/depsUtils.js"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EANH,MAAM,EAMH,EACZ,eAAe,EANN,MAAM,EAMA,EACf,eAAe,GANN,MAMW,GALT,MAAM,EAAE,CAuEpB;AA4CD;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,GAH9C,MAAM,EAG6C,GAFjD,MAAM,EAAE,CAYpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sCAAsC,CACpD,UAAU,GALD,MAAM,EAKA,EACf,YAAY,GALH,MAAM,EAKE,GAJN,MAAM,EAAE,CA8DpB;AA0FD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAJ3B,MAAM,EAAE,GAAC,MAIkB,EAAE,WAAW,EAHxC,MAAM,EAAE,GAAC,MAG+B,GAFtC,MAAM,EAAE,CAqFpB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,UAAU,OAAA,SAoIxC;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAH7C,MAAM,EAAE,GAAG,SAAS,GAAG,IAGsB,GAF3C,MAAM,EAAE,CA0CpB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,YAAY,OAAA,EAAE,eAAe,SAAI,WAsB9D;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,OAAA,EAAE,YAAY,OAAA,SAgCnD"}
+{"version":3,"file":"depsUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/depsUtils.js"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EANH,MAAM,EAMH,EACZ,eAAe,EANN,MAAM,EAMA,EACf,eAAe,GANN,MAMW,GALT,MAAM,EAAE,CAuEpB;AA4CD;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,GAH9C,MAAM,EAG6C,GAFjD,MAAM,EAAE,CAYpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sCAAsC,CACpD,UAAU,GALD,MAAM,EAKA,EACf,YAAY,GALH,MAAM,EAKE,GAJN,MAAM,EAAE,CA8DpB;AAgBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gCAAgC,CAC9C,UAAU,GALD,MAAM,EAKA,EACf,YAAY,GALH,MAAM,EAKE,GAJN,MAAM,EAAE,CA8EpB;AA0FD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAJ3B,MAAM,EAAE,GAAC,MAIkB,EAAE,WAAW,EAHxC,MAAM,EAAE,GAAC,MAG+B,GAFtC,MAAM,EAAE,CAqFpB;AAmED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,UAAU,OAAA,SAoIxC;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAH7C,MAAM,EAAE,GAAG,SAAS,GAAG,IAGsB,GAF3C,MAAM,EAAE,CA0CpB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,YAAY,OAAA,EAAE,eAAe,SAAI,WAuB9D;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,OAAA,EAAE,YAAY,OAAA,SAgCnD"}

package/types/lib/inventory/display.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"display.d.ts","sourceRoot":"","sources":["../../../lib/inventory/display.js"],"names":[],"mappings":"AAwKA;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAkFpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAHpC,MAGoC,GAFlC,MAAM,EAAE,CA2CpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAyBpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAwBpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,YANxB,MAAM,eACN,MAAM,EAAE,GAAC,SAAS,eAClB,MAAM,GAAC,SAAS,6BAChB,MAAM,KACJ,MAAM,EAkGlB,CAAC;AAqNF;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,iBAHhC,MAAM,EAAE,KACN,MAAM,EAclB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAJ3C,MAAM,EAIqC,EAAE,UAAU,AAH/D,CACA,EADQ,OAGkE,GAFhE,MAAM,CAsBlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAND,MAAM,EAML,EACV,UAAU,AANT,CACA,EADQ,MAMU,EACnB,UAAU,AANT,CACA,EADQ,OAMY,GALV,MAAM,EAAE,CA8BpB;AA6BD;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAPE,MAOF,EACP,WAAW,AAPV,CACA,EADQ,MAAM,EAOQ,EACvB,SAAS,AAPR,CACA,EADQ,MAOY,EACrB,WAAW,AAPV,CACA,EADQ,MAOc,GANZ,IAAI,CA+EhB;AAQD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAHzB,MAGyB,GAFvB,IAAI,CAsBhB;AACD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,IAAI,CAwBhB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,IAAI,CAuBhB;AA0BD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,IAAI,CAwChB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,GAFzB,IAAI,CA+ChB;AACD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EANE,MAMF,EACP,IAAI,AANH,CACA,EADQ,MAMS,EAClB,SAAS,AANR,CACA,EADQ,MAMY,GALV,IAAI,CAoChB;AAkJD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,iBAJ1B,MAAM,EAAE,SACR,MAAM,KACJ,MAAM,EAyClB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,cAAc,EAHnC,MAGmC,GAFjC,IAAI,CAoChB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,eAAe,EAHzC,MAAM,EAGmC,GAFvC,IAAI,CA4BhB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B,IAAI,CAwBhB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAHzB,MAGyB,GAFvB,IAAI,CAsDhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,AAH5C,CACA,EADQ,MAGgD,GAF9C,IAAI,CAwHhB;AAGE,YAAmG,eAAe,GAAxG;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAC,CAAiB;AA6DrH;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,gBAAgB,GAHnD,eAAe,EAGyC,GAFtD,IAAI,CA+BhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EANC,MAMD,EACR,MAAM,EANG,MAMH,EACN,OAAO,EANE,MAMF,EACP,gBAAgB,EANP,eAAe,EAMR,QAgUjB"}
+{"version":3,"file":"display.d.ts","sourceRoot":"","sources":["../../../lib/inventory/display.js"],"names":[],"mappings":"AAwKA;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAkFpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAHpC,MAGoC,GAFlC,MAAM,EAAE,CA2CpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAyBpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAwBpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,YANxB,MAAM,eACN,MAAM,EAAE,GAAC,SAAS,eAClB,MAAM,GAAC,SAAS,6BAChB,MAAM,KACJ,MAAM,EAkGlB,CAAC;AAqNF;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,iBAHhC,MAAM,EAAE,KACN,MAAM,EAclB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAJ3C,MAAM,EAIqC,EAAE,UAAU,AAH/D,CACA,EADQ,OAGkE,GAFhE,MAAM,CAsBlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAND,MAAM,EAML,EACV,UAAU,AANT,CACA,EADQ,MAMU,EACnB,UAAU,AANT,CACA,EADQ,OAMY,GALV,MAAM,EAAE,CA8BpB;AA6BD;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAPE,MAOF,EACP,WAAW,AAPV,CACA,EADQ,MAAM,EAOQ,EACvB,SAAS,AAPR,CACA,EADQ,MAOY,EACrB,WAAW,AAPV,CACA,EADQ,MAOc,GANZ,IAAI,CA+EhB;AAQD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAHzB,MAGyB,GAFvB,IAAI,CAsBhB;AACD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,IAAI,CAwBhB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,IAAI,CAuBhB;AA0BD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,IAAI,CAwChB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,GAFzB,IAAI,CA+ChB;AACD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EANE,MAMF,EACP,IAAI,AANH,CACA,EADQ,MAMS,EAClB,SAAS,AANR,CACA,EADQ,MAMY,GALV,IAAI,CAoChB;AAkJD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,iBAJ1B,MAAM,EAAE,SACR,MAAM,KACJ,MAAM,EAyClB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,cAAc,EAHnC,MAGmC,GAFjC,IAAI,CAmChB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,eAAe,EAHzC,MAAM,EAGmC,GAFvC,IAAI,CA4BhB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B,IAAI,CAwBhB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAHzB,MAGyB,GAFvB,IAAI,CAsDhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,AAH5C,CACA,EADQ,MAGgD,GAF9C,IAAI,CAwHhB;AAGE,YAAmG,eAAe,GAAxG;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAC,CAAiB;AA6DrH;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,gBAAgB,GAHnD,eAAe,EAGyC,GAFtD,IAAI,CA+BhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EANC,MAMD,EACR,MAAM,EANG,MAMH,EACN,OAAO,EANE,MAMF,EACP,gBAAgB,EANP,eAAe,EAMR,QAgUjB"}

package/types/lib/inventory/dosai.d.ts

@@ -1,3 +1,32 @@
+/**
+ * Translate cdxgen --exclude globs into dosai --exclude globs.
+ *
+ * Dosai is an evidence analyzer, so the translation follows the exclude
+ * filter cdxgen already applies to atom evidence slices
+ * (`globPatternsToAtomIgnoreRegex`): a relative pattern matches at any depth,
+ * and an absolute pattern is anchored to the scanned directory. Dosai itself
+ * uses gitignore conventions, where a pattern with a slash is anchored, so
+ * relative patterns get a leading "**\/". Like the atom filter, and unlike
+ * cdxgen's file discovery, excluding a directory also excludes everything
+ * beneath it.
+ *
+ * Brace groups and numeric ranges are expanded, and comma separated lists are
+ * split, since dosai reads both as literal text. Character classes, extglobs,
+ * escapes, negation, and patterns that step outside the scanned directory
+ * have no dosai equivalent; they are reported as skipped rather than passed
+ * on as literals that match nothing. So is any pattern that still carries a
+ * character outside a small allowlist, such as a literal brace group or a
+ * shell metacharacter. Dosai matches case-sensitively on Linux.
+ *
+ * @param {string[]} excludes cdxgen exclude globs
+ * @param {string} srcPath Absolute directory dosai scans
+ * @returns {{patterns: string[], skipped: string[], truncated: number}} Translated patterns, dropped patterns, and how many were left out by the cap
+ */
+export declare function toDosaiExcludePatterns(excludes: string[], srcPath: string): {
+    patterns: string[];
+    skipped: string[];
+    truncated: number;
+};
 /**
  * Check whether a language is a .NET language supported by dosai analysis.
  *
@@ -12,6 +41,70 @@ export declare function isDosaiDotnetLanguage(language: string): boolean;
  * @returns {Object|undefined} Parsed JSON content, or undefined when missing or invalid
  */
 export declare function readDosaiJsonFile(jsonFile: string): Object | undefined;
+/**
+ * Read a dosai methods report of any size.
+ *
+ * A report that fits in one JavaScript string is parsed whole. A larger one is
+ * read in bounded runs, keeping the requested sections, the CallGraph nodes and
+ * edges that PackageReachability references, and the MethodCalls accepted by
+ * `keepMethodCall` (none when it is omitted). Nothing cdxgen reads is lost.
+ *
+ * @param {string} reportFile Path to the dosai methods JSON
+ * @param {Object} [options] Options
+ * @param {string[]} [options.sections] Sections to keep from a large report (default: every section cdxgen reads)
+ * @param {Function} [options.keepMethodCall] Predicate choosing the MethodCalls to keep from a large report
+ * @param {number} [options.maxTextBytes] Largest report parsed whole, for tests
+ * @returns {Object|undefined} Parsed report, or undefined when missing or invalid
+ */
+export declare function readDosaiMethodsReport(reportFile: string, options?: {
+    sections?: string[];
+    keepMethodCall?: Function;
+    maxTextBytes?: number;
+}): Object | undefined;
+/**
+ * Read a dosai data-flow report of any size.
+ *
+ * A report that fits in one JavaScript string is parsed whole. A larger one
+ * keeps Metadata, Slices, PackageReachability, and the Nodes those reference.
+ *
+ * @param {string} reportFile Path to the dosai data-flow JSON
+ * @param {Object} [options] Options
+ * @param {number} [options.maxTextBytes] Largest report parsed whole, for tests
+ * @returns {Object|undefined} Parsed report, or undefined when missing or invalid
+ */
+export declare function readDosaiDataFlowReport(reportFile: string, options?: {
+    maxTextBytes?: number;
+}): Object | undefined;
+/**
+ * Whether a dosai run ended because it ran out of time.
+ *
+ * dosai has no limit of its own: cdxgen's spawn timeout
+ * (CDXGEN_TIMEOUT_MS) stops the process, which reaches the caller only as an
+ * ETIMEDOUT error looking like any other failure (issue 4438).
+ *
+ * @param {Object} result spawnSync result
+ * @returns {boolean} true when the run was stopped by the spawn timeout
+ */
+export declare function dosaiRunTimedOut(result: Object): boolean;
+/**
+ * How a dosai run was stopped before it could finish, if it was.
+ *
+ * Besides the spawn timeout, a run is stopped when its console output outgrows
+ * CDXGEN_MAX_BUFFER (ENOBUFS) or a signal ends it, such as the kernel's
+ * out-of-memory killer. A stopped run can leave its slice half written.
+ *
+ * @param {Object} result spawnSync result
+ * @returns {"timeout"|"buffer"|"signal"|undefined} Why the run was stopped, or undefined when it ended by itself
+ */
+export declare function dosaiRunStopReason(result: Object): "timeout" | "buffer" | "signal" | undefined;
+/**
+ * Whether the dosai run that should have written a file was stopped (by the
+ * time limit, the output buffer limit, or a signal) and already reported so.
+ *
+ * @param {string} outputFile Output file passed to the dosai run
+ * @returns {boolean} true when the run was stopped
+ */
+export declare function dosaiRunWasStopped(outputFile: string): boolean;
 /**
  * Run a dosai subcommand ("methods", "dataflows", or "crypto") against a source
  * tree and write its JSON output to the given file.
@@ -19,7 +112,7 @@ export declare function readDosaiJsonFile(jsonFile: string): Object | undefined;
  * @param {string} command Dosai subcommand to execute
  * @param {string} src Source directory to analyze
  * @param {string} outputFile Path where the dosai JSON output is written
- * @param {Object} [options] Options carrying dosaiCommand, dataFlowPatterns, or patternPacks overrides
+ * @param {Object} [options] Options carrying dosaiCommand, dataFlowPatterns, patternPacks, or exclude globs
  * @returns {boolean} True when the command succeeded and produced the output file, false otherwise
  */
 export declare function runDosaiCommand(command: string, src: string, outputFile: string, options?: Object): boolean;
@@ -75,17 +168,21 @@ export declare function persistDosaiSemanticsReport(options: any, methodsSlice:
  * Build a purl alias map for a list of components.
  *
  * @param {Object[]} [components] Component objects with purl fields
- * @returns {Map<string, string>} Map of exact purls and normalized type/namespace/name keys to canonical purls
+ * @param {Object} [options] Options passed to {@link buildDosaiPurlAliasMap} (`srcPath`)
+ * @returns {Map<string, string>} Map of component purls, carrying the version-free identity index
  */
-export declare function buildPurlAliasMap(components?: Object[]): Map<string, string>;
+export declare function buildPurlAliasMap(components?: Object[], options?: Object): Map<string, string>;
 /**
- * Resolve a possibly-aliased purl to the canonical component purl.
+ * Resolve a dosai purl to the canonical component purl, by version, and for a
+ * package the BOM holds in several versions by the record's location.
  *
  * @param {string} purl Purl from a dosai report
  * @param {Map<string, string>} purlAliasMap Alias map built by buildPurlAliasMap
- * @returns {string|undefined} Canonical component purl, the input purl when unaliased, or undefined when empty
+ * @param {string} [location] Source location of the dosai record
+ * @returns {string|undefined} Canonical component purl, the input purl when the BOM has no such package,
+ *          or undefined when empty or ambiguous
  */
-export declare function resolveComponentPurl(purl: string, purlAliasMap: Map<string, string>): string | undefined;
+export declare function resolveComponentPurl(purl: string, purlAliasMap: Map<string, string>, location?: string): string | undefined;
 /**
  * Copy one dosai PackageReachability fact onto a component as properties.
  *
@@ -106,9 +203,14 @@ export declare function addDosaiReachabilityProperties(component: Object, reacha
  *
  * @param {Object} methodsSlice Parsed dosai methods slice JSON
  * @param {Object[]} [components] BOM components used to resolve purl aliases and mutate
+ * @param {Object} [options] Options
+ * @param {string} [options.srcPath] Directory dosai analyzed; a package the BOM holds in several
+ *        versions is matched by the project of the record's file
  * @returns {number} Number of distinct components enriched
  */
-export declare function applyDosaiReachabilityEvidence(methodsSlice: Object, components?: Object[]): number;
+export declare function applyDosaiReachabilityEvidence(methodsSlice: Object, components?: Object[], options?: {
+    srcPath?: string;
+}): number;
 /**
  * Map a dosai methods slice to per-purl occurrence evidence.
  *
@@ -117,9 +219,14 @@ export declare function applyDosaiReachabilityEvidence(methodsSlice: Object, com
  *
  * @param {Object} methodsSlice Parsed dosai methods slice JSON
  * @param {Object[]} [components] BOM components used to resolve purl aliases
+ * @param {Object} [options] Options
+ * @param {string} [options.srcPath] Directory dosai analyzed; a package the BOM holds in several
+ *        versions is matched by the project of the record's file
  * @returns {Object} Object with purlLocationMap, purlModulesMap, and purlMethodsMap keyed by purl
  */
-export declare function collectDosaiPurlEvidence(methodsSlice: Object, components?: Object[]): Object;
+export declare function collectDosaiPurlEvidence(methodsSlice: Object, components?: Object[], options?: {
+    srcPath?: string;
+}): Object;
 /**
  * Extract data-flow call frames per component purl from a dosai data-flow result.
  *
@@ -128,9 +235,14 @@ export declare function collectDosaiPurlEvidence(methodsSlice: Object, component
  *
  * @param {Object} dataFlowResult Parsed dosai data-flow slice JSON
  * @param {Object[]} [components] BOM components used to resolve purl aliases
+ * @param {Object} [options] Options
+ * @param {string} [options.srcPath] Directory dosai analyzed; a package the BOM holds in several
+ *        versions is matched by the project of the record's file
  * @returns {Object} Map of canonical purl to arrays of call-stack frame objects
  */
-export declare function collectDosaiDataFlowFrames(dataFlowResult: Object, components?: Object[]): Object;
+export declare function collectDosaiDataFlowFrames(dataFlowResult: Object, components?: Object[], options?: {
+    srcPath?: string;
+}): Object;
 /**
  * Consume dosai's AiComponents[] inventory (schema 4.0.0): model identifiers,
  * on-disk model artifacts with hashes, MCP tools, prompts (redacted), and agents

package/types/lib/inventory/dosai.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dosai.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dosai.js"],"names":[],"mappings":"AA8LA;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAW5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAN5B,MAM4B,EAAE,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAiEnB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,UAAU,EAJ5C,MAI4C,EAAE,OAAO,AAH7D,CACA,EADQ,MAG0D,GAFxD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EALlC,MAKkC,EAAE,UAAU,EAJ9C,MAI8C,EAAE,OAAO,AAH/D,CACA,EADQ,MAG4D,GAF1D,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAe5B;AAuBD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,KAAA,EACP,YAAY,KAAA,EACZ,aAAa,KAAA,OA+Bd;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,AAHzC,CACA,EADQ,MAAM,EAGgC,GAFpC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/B;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAJ9B,MAI8B,EAAE,YAAY,EAH5C,GAAG,CAAC,MAAM,EAAE,MAAM,CAG0B,GAF1C,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAH7C,MAG6C,EAAE,YAAY,EAF3D,MAE2D,QAyBrE;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,YAAY,EAJhD,MAIgD,EAAE,UAAU,AAHpE,CACA,EADQ,MAAM,EAG2D,GAF/D,MAAM,CAoBlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAJ1C,MAI0C,EAAE,UAAU,AAH9D,CACA,EADQ,MAAM,EAGqD,GAFzD,MAAM,CAmElB;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,cAAc,EAJ9C,MAI8C,EAAE,UAAU,AAHlE,CACA,EADQ,MAAM,EAGyD,GAF7D,MAAM,CAsClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAJ1C,MAI0C,EAAE,UAAU,AAH9D,CACA,OAEmE,SA6FrE;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,YAAY,EAJ/C,MAI+C,EAAE,WAAW,AAHpE,CACA,EADQ,MAGiE,GAF/D,MAAM,CAyKlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC7C,YAAY,EALH,MAKG,EACZ,WAAW,AALV,CACA,EADQ,MAKO,GAJL,MAAM,CA+GlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,AAHjD,CACA,EADQ,MAG8C,GAF5C,MAAM,EAAE,CA6CpB"}
+{"version":3,"file":"dosai.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dosai.js"],"names":[],"mappings":"AA+WA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAJpC,MAAM,EAI8B,EAAE,OAAO,EAH7C,MAG6C,GAF3C;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAC,CAyFtE;AAoCD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAW5B;AA2ED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAPtC,MAOsC,EAAE,OAAO,AANvD,CAIA,EAHA;IAA2B,QAAQ,AAAnC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,cAAc,AAAzC,CACA,WAAA;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;CAE4D,GAFlD,MAAM,GAAC,SAAS,CA0B5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EALvC,MAKuC,EAAE,OAAO,AAJxD,CAEA,EADA;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;CAE6D,GAFnD,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAH5B,MAG4B,GAF1B,OAAO,CAInB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAH9B,MAG8B,GAF5B,SAAS,GAAC,QAAQ,GAAC,QAAQ,GAAC,SAAS,CAajD;AAMD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAGkC,GAFhC,OAAO,CAKnB;AAYD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAN5B,MAM4B,EAAE,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAuGnB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,UAAU,EAJ5C,MAI4C,EAAE,OAAO,AAH7D,CACA,EADQ,MAG0D,GAFxD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EALlC,MAKkC,EAAE,UAAU,EAJ9C,MAI8C,EAAE,OAAO,AAH/D,CACA,EADQ,MAG4D,GAF1D,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAe5B;AAuDD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,KAAA,EACP,YAAY,KAAA,EACZ,aAAa,KAAA,OAyDd;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,AAJzC,CACA,EADQ,MAAM,EAIgC,EAAE,OAAO,AAHvD,CACA,EADQ,MAGoD,GAFlD,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/B;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAN9B,MAM8B,EAAE,YAAY,EAL5C,GAAG,CAAC,MAAM,EAAE,MAAM,CAK0B,EAAE,QAAQ,AAJ9D,CACA,EADQ,MAIsD,GAHpD,MAAM,GAAC,SAAS,CAK5B;AAwCD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAH7C,MAG6C,EAAE,YAAY,EAF3D,MAE2D,QAyBrE;AAED;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAC5C,YAAY,EARH,MAQG,EACZ,UAAU,AART,CACA,EADQ,MAAM,EAQA,EACf,OAAO,AARN,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAKW,GALD,MAAM,CA4ClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EARH,MAQG,EACZ,UAAU,AART,CACA,EADQ,MAAM,EAQA,EACf,OAAO,AARN,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAKW,GALD,MAAM,CA8FlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,cAAc,EARL,MAQK,EACd,UAAU,AART,CACA,EADQ,MAAM,EAQA,EACf,OAAO,AARN,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAKW,GALD,MAAM,CAwDlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAJ1C,MAI0C,EAAE,UAAU,AAH9D,CACA,OAEmE,SA6FrE;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,YAAY,EAJ/C,MAI+C,EAAE,WAAW,AAHpE,CACA,EADQ,MAGiE,GAF/D,MAAM,CAyKlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC7C,YAAY,EALH,MAKG,EACZ,WAAW,AALV,CACA,EADQ,MAKO,GAJL,MAAM,CA+GlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,AAHjD,CACA,EADQ,MAG8C,GAF5C,MAAM,EAAE,CA6CpB"}

package/types/lib/inventory/dosaiParsers.d.ts

@@ -24,6 +24,25 @@ export declare function addDosaiSetValue(map: Object, key: string, value: string
  * @returns {string|undefined} Location string with a `#line` suffix when available, or undefined when no file is known
  */
 export declare function dosaiLocation(item: Object): string | undefined;
+/**
+ * Format the `file#line` location of a dosai MethodCalls row, relative to the
+ * scanned directory like dosai's source rows.
+ *
+ * A call site found in assembly IL names its file through the PDB. dosai 5
+ * writes it relative to the scan root and leaves Path out when the file has
+ * no place in the tree; dosai 4 writes the PDB path as it is: absolute for a
+ * local build, `/_/` for a deterministic one (owasp-dep-scan/dosai#79). An
+ * absolute path under the scanned directory is made relative to it, and any
+ * other build path, or a missing one, gives way to the file name, as for call
+ * graph edges, so both versions list a call site found in source and in IL
+ * once. Where no sequence point covers a call, the row names the assembly and
+ * its line is an IL offset, which is no source location.
+ *
+ * @param {Object} methodCall Dosai MethodCalls row
+ * @param {string} [srcPath] Directory dosai analyzed
+ * @returns {string|undefined} Location string, or undefined when the row names no source file
+ */
+export declare function dosaiCallSiteLocation(methodCall: Object, srcPath?: string): string | undefined;
 /**
  * Return a validated source location for .NET source extensions, from a call graph node.
  *
@@ -41,19 +60,46 @@ export declare function dosaiSourceLocation(location: Object): string | undefine
 /**
  * Build a purl alias map from BOM components.
  *
- * Maps both exact component purls and normalized type/namespace/name keys to
- * the canonical component purl so dosai-reported purls can be reconciled.
+ * Maps each component purl to itself, and indexes the components by their
+ * version-free identity, so a dosai-reported purl can be reconciled by version
+ * (see {@link resolveDosaiComponentPurl}). Two versions of one package are two
+ * components, and nothing here picks one of them on a name alone.
  *
  * @param {Object[]} [components] Component objects with purl fields
- * @returns {Map<string, string>} Map of purl or normalized key to canonical component purl
+ * @param {Object} [options] Options
+ * @param {string} [options.srcPath] Directory dosai analyzed, which its relative locations
+ *        and the BOM's relative manifest paths are relative to
+ * @returns {Map<string, string>} Map of purl to canonical component purl, carrying the identity index
  */
-export declare function buildDosaiPurlAliasMap(components?: Object[]): Map<string, string>;
+export declare function buildDosaiPurlAliasMap(components?: Object[], options?: {
+    srcPath?: string;
+}): Map<string, string>;
 /**
- * Resolve a purl to the canonical component purl via the alias map.
+ * Choose among the components that share a file name (two versions of a
+ * package ship the same DLLs): the only one, else the one whose project
+ * directory is nearest the record's location.
+ *
+ * @param {Iterable<string>} purls Candidate component purls
+ * @param {Map<string, string>} purlAliasMap Alias map built by buildDosaiPurlAliasMap
+ * @param {string} [location] Source location of the dosai record (`path` or `path#line`)
+ * @returns {string|undefined} The component purl, or undefined when it cannot be told
+ */
+export declare function pickDosaiComponentByLocation(purls: Iterable<string>, purlAliasMap: Map<string, string>, location?: string): string | undefined;
+/**
+ * Resolve a dosai-reported purl to a BOM component purl.
+ *
+ * The exact purl wins, then the same package at the same version (ids compare
+ * case-insensitively). A versionless purl, or a version the BOM does not hold,
+ * maps to the package's only component when it has one. When the BOM holds
+ * several versions, the record's location picks the version of the project
+ * that file belongs to; without a location that settles it the purl maps to
+ * nothing rather than to an arbitrary version (issue dosai#72).
  *
  * @param {string} purl Purl reported by dosai
  * @param {Map<string, string>} purlAliasMap Alias map built by buildDosaiPurlAliasMap
- * @returns {string|undefined} Canonical component purl, the input purl when unaliased, or undefined when empty
+ * @param {string} [location] Source location of the dosai record (`path` or `path#line`)
+ * @returns {string|undefined} Canonical component purl, the input purl when the BOM has no
+ *          component of that package, or undefined when empty or ambiguous
  */
-export declare function resolveDosaiComponentPurl(purl: string, purlAliasMap: Map<string, string>): string | undefined;
+export declare function resolveDosaiComponentPurl(purl: string, purlAliasMap: Map<string, string>, location?: string): string | undefined;
 //# sourceMappingURL=dosaiParsers.d.ts.map

package/types/lib/inventory/dosaiParsers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dosaiParsers.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dosaiParsers.js"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,GAAG,EAJ9B,MAI8B,EAAE,KAAK,EAHrC,MAGqC,GAFnC,IAAI,CAQhB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAHvB,MAGuB,GAFrB,MAAM,GAAC,SAAS,CAc5B;AAcD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,AAH9C,CACA,EADQ,MAAM,EAGqC,GAFzC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAe/B;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAJnC,MAImC,EAAE,YAAY,EAHjD,GAAG,CAAC,MAAM,EAAE,MAAM,CAG+B,GAF/C,MAAM,GAAC,SAAS,CAW5B"}
+{"version":3,"file":"dosaiParsers.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dosaiParsers.js"],"names":[],"mappings":"AAeA;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,GAAG,EAJ9B,MAI8B,EAAE,KAAK,EAHrC,MAGqC,GAFnC,IAAI,CAQhB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAHvB,MAGuB,GAFrB,MAAM,GAAC,SAAS,CAc5B;AAcD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAJrC,MAIqC,EAAE,OAAO,AAHtD,CACA,EADQ,MAG8C,GAF5C,MAAM,GAAC,SAAS,CAU5B;AA8BD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAa5B;AAiHD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,AAN9C,CACA,EADQ,MAAM,EAMqC,EAAE,OAAO,AAL5D,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAEiE,GAFvD,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAqC/B;AAsCD;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EALvC,QAAQ,CAAC,MAAM,CAKwB,EAAE,YAAY,EAJrD,GAAG,CAAC,MAAM,EAAE,MAAM,CAImC,EAAE,QAAQ,AAHvE,CACA,EADQ,MAG+D,GAF7D,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EANnC,MAMmC,EAAE,YAAY,EALjD,GAAG,CAAC,MAAM,EAAE,MAAM,CAK+B,EAAE,QAAQ,AAJnE,CACA,EADQ,MAI2D,GAHzD,MAAM,GAAC,SAAS,CA6B5B"}

package/types/lib/inventory/dynamic.d.ts

@@ -1,3 +1,13 @@
+/**
+ * Converts a traced library path into a purl subpath. Windows paths
+ * ("C:\Windows\System32\bcrypt.dll", "\\server\share\x.dll") use forward
+ * slashes and drop the drive or UNC prefix, which a purl subpath cannot carry;
+ * the full path stays in the cdx:dynamic:filePath property.
+ *
+ * @param {string} libPath - Absolute path of the loaded library
+ * @returns {string|null} Subpath without leading separators, or null
+ */
+export declare function librarySubpath(libPath: string): string | null;
 /**
  * Builds a flat list of CycloneDX component objects and services by executing
  * the given command and inspecting which shared libraries it loads at runtime

package/types/lib/inventory/dynamic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dynamic.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dynamic.js"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAND,MAMC,EACV,UAAU,EAND,MAMC,EACV,YAAY,AANX,CACA,EADQ,MAMQ,GALN,OAAO,CAAC;IAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAAC,CAAC,CAsHzE"}
+{"version":3,"file":"dynamic.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dynamic.js"],"names":[],"mappings":"AAYA;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,GAFzB,MAAM,GAAC,IAAI,CAevB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAND,MAMC,EACV,UAAU,EAND,MAMC,EACV,YAAY,AANX,CACA,EADQ,MAMQ,GALN,OAAO,CAAC;IAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAAC,CAAC,CA8KzE"}

package/types/lib/inventory/evidenceUtils.d.ts

@@ -44,15 +44,30 @@ export declare function attachIdentityTools(subjects: Object | Object[], toolRef
  * Enrich .NET package components with occurrence evidence and imported module/method
  * information from a dosai dependency slices file.
  *
- * Builds a mapping of DLL filenames to purls using the `internal:PackageFiles` property of each
- * package, then reads the slices file to add occurrence locations, imported modules,
- * called methods, and assembly version information where available.
+ * Each dosai record names its package by purl, resolved in the project of the
+ * record's file, and is attached to the component of that version (see
+ * {@link resolveDosaiComponentPurl}). The DLL files of each package
+ * (`internal:PackageFiles`) only fill in for a record whose purl names no
+ * component, and only when the DLL belongs to one component or the record's
+ * location says which: two versions of a package ship the same DLL names.
+ *
+ * The fallback is needed because dosai names a `System.*` assembly it cannot
+ * map to a package with a framework purl (`pkg:nuget/System.Runtime`), as it
+ * does whenever the tree has lock files but no restore output: the DLL of
+ * System.Data.SQLite.Core is still the package's. A DLL that only a package's
+ * build-time folders carry is not listed in `internal:PackageFiles`, so it
+ * credits no package with the project's framework calls (issue 4441).
  *
  * @param {Object[]} pkgList Array of .NET package component objects to enrich
  * @param {string} slicesFile Path to the dosai dependency slices JSON file
+ * @param {Object} [options] Options
+ * @param {string} [options.srcPath] Directory dosai analyzed, which its relative locations
+ *        and the components' relative manifest paths are relative to
  * @returns {Object[]} The enriched package list (same array, mutated in place)
  */
-export declare function addEvidenceForDotnet(pkgList: Object[], slicesFile: string): Object[];
+export declare function addEvidenceForDotnet(pkgList: Object[], slicesFile: string, options?: {
+    srcPath?: string;
+}): Object[];
 /**
  * Convert OS query results
  *

package/types/lib/inventory/evidenceUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evidenceUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/evidenceUtils.js"],"names":[],"mappings":"AA6BA;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,OAAO,AAHvD,CACA,EADQ,MAGoD,GAFlD,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,MAAM,GAAC,SAAS,CA8B5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAHxC,MAGwC,GAFtC,MAAM,CAalB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAJ1B,MAAM,EAAE,GAAC,MAIiB,EAAE,SAAS,UAAA,GAFnC,MAAM,EAAE,CAmDpB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAAM,GAAC,MAAM,EAIoB,EAAE,QAAQ,EAH3C,MAAM,EAGqC,GAFzC,MAAM,GAAC,MAAM,EAAE,CAwB3B;AAsCD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAJjC,MAAM,EAI2B,EAAE,UAAU,EAH7C,MAG6C,GAF3C,MAAM,EAAE,CAkOpB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EANJ,MAMI,EACb,QAAQ,EANC,MAMD,EACR,OAAO,OAAA,EACP,OAAO,UAAQ,EACf,gBAAgB,YAAY;;;;;;;;;IA6H7B"}
+{"version":3,"file":"evidenceUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/evidenceUtils.js"],"names":[],"mappings":"AAiCA;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,OAAO,AAHvD,CACA,EADQ,MAGoD,GAFlD,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,MAAM,GAAC,SAAS,CA8B5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAHxC,MAGwC,GAFtC,MAAM,CAalB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAJ1B,MAAM,EAAE,GAAC,MAIiB,EAAE,SAAS,UAAA,GAFnC,MAAM,EAAE,CAmDpB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAAM,GAAC,MAAM,EAIoB,EAAE,QAAQ,EAH3C,MAAM,EAGqC,GAFzC,MAAM,GAAC,MAAM,EAAE,CAwB3B;AAsCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAPjC,MAAM,EAO2B,EAAE,UAAU,EAN7C,MAM6C,EAAE,OAAO,AAL9D,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAEmE,GAFzD,MAAM,EAAE,CAsQpB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EANJ,MAMI,EACb,QAAQ,EANC,MAMD,EACR,OAAO,OAAA,EACP,OAAO,UAAQ,EACf,gBAAgB,YAAY;;;;;;;;;IA6H7B"}