@cdxgen/cdxgen 13.2.0 → 13.4.0

package/types/lib/inventory/purl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"purl.d.ts","sourceRoot":"","sources":["../../../lib/inventory/purl.js"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,aAAmC,CAAC;AAEtE;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAH1C,MAG0C,GAFxC,OAAO,CASnB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAHpB,MAGoB,GAFlB,MAAM,CAMlB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAHvB,MAGuB,GAFrB,MAAM,GAAC,IAAI,CAcvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAJpB,MAIoB,EAAE,OAAO,AAHrC,CACA,EADQ,MAG6B,GAF3B,MAAM,CAkBlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,MAG4B,GAF1B,MAAM,GAAC,IAAI,CAuBvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAJnB,MAImB,EAAE,OAAO,AAHpC,CACA,EADQ,MAG4B,GAF1B,MAAM,GAAC,IAAI,CAQvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAJlB,MAIkB,EAAE,OAAO,AAHnC,CACA,EADQ,MAG2B,GAFzB,MAAM,GAAC,IAAI,CAQvB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAJpB,MAIoB,EAAE,OAAO,AAHrC,CACA,EADQ,MAG6B,GAF3B,MAAM,CAQlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,KAAK,EANpB,MAMoB,EAAE,IAAI,EAL1B,MAK0B,EAAE,OAAO,AAJ3C,CACA,EADQ,MAImC,EAAE,UAAU,AAHvD,CACA,EADQ,MAG+C,GAF7C,MAAM,GAAC,IAAI,CAUvB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,IAAI,EALxB,MAKwB,EAAE,OAAO,AAJzC,CACA,EADQ,MAIiC,EAAE,UAAU,AAHrD,CACA,EADQ,MAG6C,GAF3C,MAAM,GAAC,IAAI,CASvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAHnB,MAGmB,GAFjB,MAAM,CAIlB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAHrB,MAGqB,GAFnB,MAAM,GAAC,IAAI,CAOvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAH1B,MAG0B,GAFxB,OAAO,CAYnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAH5B,MAG4B,GAF1B,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAH7B,MAG6B,GAF3B,MAAM,CAQlB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,SAAS,CAAC,SAAS,EALxB,MAKwB,EAAE,UAAU,EAJpC,MAAM,GAAC,IAI6B,EAAE,WAAW,AAHzD,CACA,EADQ,MAGiD,GAF/C,MAAM,CAWlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAJnC,MAImC,EAAE,QAAQ,AAHrD,CACA,EADQ,MAG6C,GAF3C,MAAM,CAiClB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CAAC,UAAU,EAJvB,MAIuB,EAAE,GAAG,AAHpC,CACA,EADQ,MAG4B,GAF1B,MAAM,GAAC,IAAI,CA4BvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAL3B,MAK2B,EAAE,OAAO,EAJpC,MAIoC,EAAE,OAAO,EAH7C,MAG6C,GAF3C,UAAU,GAAC,SAAS,CAuDhC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,UAExC;AAwCD;;;;;;;;;GASG;AACH,wBAAgB,2CAA2C,CAAC,WAAW,EAH5D,MAG4D,GAF1D,CAAC,MAAM,GAAC,IAAI,CAAC,EAAE,CA6H3B"}
+{"version":3,"file":"purl.d.ts","sourceRoot":"","sources":["../../../lib/inventory/purl.js"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,aAAmC,CAAC;AAEtE;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAH1C,MAG0C,GAFxC,OAAO,CASnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAHpB,MAGoB,GAFlB,MAAM,CAYlB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAHvB,MAGuB,GAFrB,MAAM,GAAC,IAAI,CAcvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAJpB,MAIoB,EAAE,OAAO,AAHrC,CACA,EADQ,MAG6B,GAF3B,MAAM,CAkBlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,MAG4B,GAF1B,MAAM,GAAC,IAAI,CAuBvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAJnB,MAImB,EAAE,OAAO,AAHpC,CACA,EADQ,MAG4B,GAF1B,MAAM,GAAC,IAAI,CAQvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAJlB,MAIkB,EAAE,OAAO,AAHnC,CACA,EADQ,MAG2B,GAFzB,MAAM,GAAC,IAAI,CAQvB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAJpB,MAIoB,EAAE,OAAO,AAHrC,CACA,EADQ,MAG6B,GAF3B,MAAM,CAQlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,KAAK,EANpB,MAMoB,EAAE,IAAI,EAL1B,MAK0B,EAAE,OAAO,AAJ3C,CACA,EADQ,MAImC,EAAE,UAAU,AAHvD,CACA,EADQ,MAG+C,GAF7C,MAAM,GAAC,IAAI,CAUvB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,IAAI,EALxB,MAKwB,EAAE,OAAO,AAJzC,CACA,EADQ,MAIiC,EAAE,UAAU,AAHrD,CACA,EADQ,MAG6C,GAF3C,MAAM,GAAC,IAAI,CASvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAHnB,MAGmB,GAFjB,MAAM,CAIlB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAHrB,MAGqB,GAFnB,MAAM,GAAC,IAAI,CAOvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAH1B,MAG0B,GAFxB,OAAO,CAYnB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAHxB,MAGwB,GAFtB;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;IAAC,UAAU,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAA;CAAC,GAAC,IAAI,CA6DlJ;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAH9B,MAG8B,GAF5B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;IAAC,UAAU,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAA;CAAC,GAAC,IAAI,CAsBlJ;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAAC,UAAU,EAH5C,MAG4C,GAF1C,MAAM,GAAC,IAAI,CAQvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAH5B,MAG4B,GAF1B,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAH7B,MAG6B,GAF3B,MAAM,CAQlB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,SAAS,CAAC,SAAS,EALxB,MAKwB,EAAE,UAAU,EAJpC,MAAM,GAAC,IAI6B,EAAE,WAAW,AAHzD,CACA,EADQ,MAGiD,GAF/C,MAAM,CAWlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAJnC,MAImC,EAAE,QAAQ,AAHrD,CACA,EADQ,MAG6C,GAF3C,MAAM,CAiClB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CAAC,UAAU,EAJvB,MAIuB,EAAE,GAAG,AAHpC,CACA,EADQ,MAG4B,GAF1B,MAAM,GAAC,IAAI,CA4BvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAL3B,MAK2B,EAAE,OAAO,EAJpC,MAIoC,EAAE,OAAO,EAH7C,MAG6C,GAF3C,UAAU,GAAC,SAAS,CAuDhC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,UAExC;AAwCD;;;;;;;;;GASG;AACH,wBAAgB,2CAA2C,CAAC,WAAW,EAH5D,MAG4D,GAF1D,CAAC,MAAM,GAAC,IAAI,CAAC,EAAE,CA6H3B"}

package/types/lib/inventory/rustFormulationParser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rustFormulationParser.d.ts","sourceRoot":"","sources":["../../../lib/inventory/rustFormulationParser.js"],"names":[],"mappings":"AAmTA;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,EAFxB;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAC,CAAA;CAwBxF,CAAC"}
+{"version":3,"file":"rustFormulationParser.d.ts","sourceRoot":"","sources":["../../../lib/inventory/rustFormulationParser.js"],"names":[],"mappings":"AAkTA;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,EAFxB;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAC,CAAA;CAwBxF,CAAC"}

package/types/lib/inventory/sbomDocument.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sbomDocument.d.ts","sourceRoot":"","sources":["../../../lib/inventory/sbomDocument.js"],"names":[],"mappings":"AAqBA;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAF1B,MAE4C,CAAC;AAsBvD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAPK,MAOL,EACJ,EAAE,MAAkB,EAAE,QAAkC,EAAE,AAPzD,CAGA,EAFA;IAAuB,MAAM,AAA7B,CACA,EADQ,MAAM,CACd;IAAuB,QAAQ,AAA/B,CACA,EADQ,MAAM,CACd;CAI8D,GAJpD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAA;CAAC,GAAC,IAAI,CAoE5G;AA6FD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAFzB,MAEyB,QAsBnC;AAsDD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAJjC,MAAM,EAI2B,EAAE,UAAU,EAH7C,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAGU,GAF3C,MAAM,EAAE,CAoBpB"}
+{"version":3,"file":"sbomDocument.d.ts","sourceRoot":"","sources":["../../../lib/inventory/sbomDocument.js"],"names":[],"mappings":"AAsBA;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAF1B,MAE4C,CAAC;AAsBvD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAPK,MAOL,EACJ,EAAE,MAAkB,EAAE,QAAkC,EAAE,AAPzD,CAGA,EAFA;IAAuB,MAAM,AAA7B,CACA,EADQ,MAAM,CACd;IAAuB,QAAQ,AAA/B,CACA,EADQ,MAAM,CACd;CAI8D,GAJpD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAA;CAAC,GAAC,IAAI,CAoE5G;AAwBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAFzB,MAEyB,QAsBnC;AAsDD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAJjC,MAAM,EAI2B,EAAE,UAAU,EAH7C,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAGU,GAF3C,MAAM,EAAE,CAoBpB"}

package/types/lib/inventory/scalaCoords.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Parse a Scala-published Maven artifact name into its coordinate parts.
+ *
+ * @param {string} name Maven artifactId, for example `upickle_sjs1_3`
+ * @returns {{ originalName: string, artifactBase: string, binaryVersion: string|null,
+ *   platformSuffix: string, purlName: string }} The artifact name without any
+ *   Scala suffix (`upickle`), the Scala binary version from the suffix (`3`),
+ *   the platform suffix including the underscore (`_sjs1`) or an empty string,
+ *   and the artifact name sbt-style purls emit (binary suffix dropped, platform
+ *   suffix kept).
+ */
+export declare function parseScalaArtifact(name: string): {
+    originalName: string;
+    artifactBase: string;
+    binaryVersion: string | null;
+    platformSuffix: string;
+    purlName: string;
+};
+/**
+ * Build a qualifier-free coordinate key for a Scala-published artifact.
+ *
+ * The key ignores purl qualifiers such as `repository_url` and `type`, so the
+ * POM-coordinate keys of the jar namespace mapping and the sbt-style purls of
+ * the components resolve to the same entry.
+ *
+ * @param {Object} parts Coordinate parts
+ * @param {string} [parts.type] Purl type, defaults to `maven`
+ * @param {string} [parts.group] Maven groupId
+ * @param {string} parts.artifactBase Artifact name without any Scala suffix
+ * @param {string} [parts.platformSuffix] `_sjs1`, `_native0.5` or empty
+ * @param {string} [parts.version] Package version
+ * @returns {string} The coordinate key
+ */
+export declare function scalaCoordinateKey({ type, group, artifactBase, platformSuffix, version, }?: {
+    type?: string;
+    group?: string;
+    artifactBase: string;
+    platformSuffix?: string;
+    version?: string;
+}): string;
+/**
+ * Build the qualifier-free coordinate key of a purl string.
+ *
+ * The artifact name is normalized with {@link parseScalaArtifact}, so
+ * `pkg:maven/g/foo_3@1.0` and the sbt-style `pkg:maven/g/foo@1.0` share a key,
+ * while the Scala.js build `foo_sjs1_3` keeps its own key (`foo` plus the
+ * `_sjs1` platform suffix) and never joins the plain `foo` component.
+ *
+ * @param {string} purlString Package URL to normalize
+ * @returns {string|undefined} The coordinate key, or undefined when the string
+ *   is not a parseable purl
+ */
+export declare function coordinateKeyFromPurl(purlString: string): string | undefined;
+/**
+ * The coordinate key of a purl together with the Scala binary version its
+ * artifact name carries, if any.
+ *
+ * @param {string} purlString Package URL to normalize
+ * @returns {{ key: string, binaryVersion: string|null }|undefined} The key
+ *   and binary version, or undefined when the string is not a parseable purl
+ */
+export declare function scalaCoordinateOfPurl(purlString: string): {
+    key: string;
+    binaryVersion: string | null;
+} | undefined;
+/**
+ * The artifactId the library is published under, for cache and repository
+ * lookups only. Components a Scala build tool reports carry the name with the
+ * Scala binary suffix stripped (the platform suffix kept) together with
+ * `cdx:scala:compilerVersion`; on disk and in the repository the artifact is
+ * `cats-core_2.13` or `upickle_sjs1_3`. Names that end in a full Scala version
+ * are used as they are.
+ *
+ * The component's own `name`, `purl` and `bom-ref` never change.
+ *
+ * @param {Object} pkg Package with `name` and `properties`.
+ * @returns {string} The artifactId to look up.
+ */
+export declare function publishedArtifactId(pkg: Object): string;
+//# sourceMappingURL=scalaCoords.d.ts.map

package/types/lib/inventory/scalaCoords.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scalaCoords.d.ts","sourceRoot":"","sources":["../../../lib/inventory/scalaCoords.js"],"names":[],"mappings":"AAWA;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAR5B,MAQ4B,GAP1B;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAC;IACjF,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CA+B9C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,IAAc,EACd,KAAU,EACV,YAAiB,EACjB,cAAmB,EACnB,OAAY,GACb,GAbE;IAAuB,IAAI,AAA3B,CACA,EADQ,MAAM,CACd;IAAuB,KAAK,AAA5B,CACA,EADQ,MAAM,CACd;IAAsB,YAAY,EAA1B,MAAM,CACd;IAAuB,cAAc,AAArC,CACA,EADQ,MAAM,CACd;IAAuB,OAAO,AAA9B,CACA,EADQ,MAAM,CACd;CAQG,GARO,MAAM,CAUlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAJrC,MAIqC,GAHnC,MAAM,GAAC,SAAS,CAK5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAJrC,MAIqC,GAHnC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,GAAC,SAAS,CA2BjE;AAQD;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAH5B,MAG4B,GAF1B,MAAM,CAWlB"}

package/types/lib/inventory/source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../lib/inventory/source.js"],"names":[],"mappings":"AAoCA,6FAA6F;AAC7F,eAAO,MAAM,4BAA4B,wIAC8F,CAAC;AAExI,6DAA6D;AAC7D,eAAO,MAAM,2BAA2B,UAWvC,CAAC;AAuBF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAAM,GAAC,SAGsB,GAF3B,OAAO,CAUnB;AAiBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAL5B,MAAM,EAKsB,EAAE,OAAO,GAH7C;IAAkC,GAAG,EAA7B,MAAM,GAAC,SAAS,CACxB;CAEkD,GAFxC,MAAM,CAuClB;AA+ED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAAM,GAAC,SAI+B,EAAE,OAAO,GAH/C,MAGoD,GAFlD,MAAM,GAAC,SAAS,CA6I5B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,CASlB;AAkBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,OAAO,CAWnB;AAkBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAHvB,MAGuB,GAFrB,OAAO,CA+BnB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAHpB,MAGoB,GAFlB,OAAO,CAyBnB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAHxC,MAGwC,GAFtC,MAAM,GAAC,IAAI,CAgEvB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAJrB,MAIqB,EAAE,MAAM,GAH7B,MAAM,GAAC,MAAM,EAAE,GAAC,IAGoB,GAFlC,MAAM,CAyDlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAAM,GAAC,SAGgC,GAFrC,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAJrC,MAIqC,EAAE,cAAc,EAHrD,MAAM,GAAC,SAG8C,GAFnD,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAJtC,MAIsC,EAAE,cAAc,EAHtD,MAAM,GAAC,SAG+C,GAFpD,MAAM,GAAC,SAAS,CAiF5B;AAoHD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAGkC,GAFhC;IAAC,MAAM,EAAC,MAAM,CAAC;IAAA,KAAK,EAAC,MAAM,CAAC;IAAA,OAAO,EAAC,MAAM,CAAA;CAAC,GAAC,IAAI,CA8D5D;AA6GD;;GAEG;AACH,wBAAgB,yBAAyB,SAExC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,WAAW,EAJ5C,KAAK,CAAC,MAAM,CAIgC,GAF1C,OAAO,CAAC,IAAI,CAAC,CA6BzB;AA8DD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CA4MlI;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAF5B,MAE4B,QAkCtC"}
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../lib/inventory/source.js"],"names":[],"mappings":"AAqCA,6FAA6F;AAC7F,eAAO,MAAM,4BAA4B,wIAC8F,CAAC;AAExI,6DAA6D;AAC7D,eAAO,MAAM,2BAA2B,UAWvC,CAAC;AAuBF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAAM,GAAC,SAGsB,GAF3B,OAAO,CAUnB;AAiBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAL5B,MAAM,EAKsB,EAAE,OAAO,GAH7C;IAAkC,GAAG,EAA7B,MAAM,GAAC,SAAS,CACxB;CAEkD,GAFxC,MAAM,CAuClB;AA+ED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAAM,GAAC,SAI+B,EAAE,OAAO,GAH/C,MAGoD,GAFlD,MAAM,GAAC,SAAS,CA6I5B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,CASlB;AAkBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,OAAO,CAWnB;AAkBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAHvB,MAGuB,GAFrB,OAAO,CA+BnB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAHpB,MAGoB,GAFlB,OAAO,CAyBnB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAHxC,MAGwC,GAFtC,MAAM,GAAC,IAAI,CAgEvB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAJrB,MAIqB,EAAE,MAAM,GAH7B,MAAM,GAAC,MAAM,EAAE,GAAC,IAGoB,GAFlC,MAAM,CAyDlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAAM,GAAC,SAGgC,GAFrC,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAJrC,MAIqC,EAAE,cAAc,EAHrD,MAAM,GAAC,SAG8C,GAFnD,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAJtC,MAIsC,EAAE,cAAc,EAHtD,MAAM,GAAC,SAG+C,GAFpD,MAAM,GAAC,SAAS,CAiF5B;AAkJD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAGkC,GAFhC;IAAC,MAAM,EAAC,MAAM,CAAC;IAAA,KAAK,EAAC,MAAM,CAAC;IAAA,OAAO,EAAC,MAAM,CAAA;CAAC,GAAC,IAAI,CA4D5D;AA6GD;;GAEG;AACH,wBAAgB,yBAAyB,SAExC;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,WAAW,EAJ5C,KAAK,CAAC,MAAM,CAIgC,GAF1C,OAAO,CAAC,IAAI,CAAC,CA6BzB;AAiDD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CA4MlI;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAF5B,MAE4B,QAkCtC"}

package/types/lib/inventory/spdx.d.ts

@@ -57,6 +57,15 @@ export declare function readLicenseText(licenseFilepath: any, licenseContentType
  * @param {string} name License full name
  */
 export declare function findLicenseId(name: string): any;
+/**
+ * Identify a license from the title and opening of its full text. A license
+ * text quotes other licenses (the GNU GPL's text names the GNU Lesser GPL),
+ * so the substring scan of `guessLicenseId` alone can name the wrong one.
+ *
+ * @param {string} content License file contents
+ * @returns {string|undefined} SPDX license id or expression
+ */
+export declare function licenseIdFromText(content: string): string | undefined;
 /**
  * Method to guess the spdx license id from license contents
  *

package/types/lib/inventory/spdx.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spdx.d.ts","sourceRoot":"","sources":["../../../lib/inventory/spdx.js"],"names":[],"mappings":"AAeA;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAFf,MAAM,EAIf,CAAC;AAMF;;;;;;IAMI;AACJ,wBAAgB,uBAAuB,CAAC,OAAO,EAJpC,MAIoC,GAHlC,OAAO,CA0BnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,OAAA,SA2BhD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,KAAA,qBAqG9B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,UAAU,QAAA,EAAE,GAAG,QAAA,GAFnC,MAAM,CAoDjB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,KAAA,EAAE,CAAC,KAAA,EAAE,cAAc,KAAA,QAoCpD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,eAAe,KAAA,EAAE,kBAAkB,KAAA;;SAUlE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAFvB,MAEuB,OAYjC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAF3B,MAE2B,OAUrC"}
+{"version":3,"file":"spdx.d.ts","sourceRoot":"","sources":["../../../lib/inventory/spdx.js"],"names":[],"mappings":"AAeA;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAFf,MAAM,EAIf,CAAC;AAMF;;;;;;IAMI;AACJ,wBAAgB,uBAAuB,CAAC,OAAO,EAJpC,MAIoC,GAHlC,OAAO,CA0BnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,OAAA,SA2BhD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,KAAA,qBAqG9B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,UAAU,QAAA,EAAE,GAAG,QAAA,GAFnC,MAAM,CAoDjB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,KAAA,EAAE,CAAC,KAAA,EAAE,cAAc,KAAA,QAoCpD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,eAAe,KAAA,EAAE,kBAAkB,KAAA;;SAUlE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAFvB,MAEuB,OAYjC;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,GAF5B,MAAM,GAAC,SAAS,CAyF5B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAF3B,MAE2B,OAcrC"}

package/types/lib/inventory/traceRunner.d.ts

@@ -1,3 +1,11 @@
+/**
+ * Whether the @cdxgen/safer-exec tracing runtime could be loaded. When false,
+ * dynamic tracing cannot run at all, and every trace would otherwise exit 0
+ * with a valid but empty BOM, hiding the broken installation (#4378).
+ *
+ * @returns {boolean} True when the tracing runtime is available
+ */
+export declare function isSaferExecAvailable(): boolean;
 /**
  * Parses a command string into command and arguments array.
  * @param {string} cmdStr - Command string to parse
@@ -40,7 +48,19 @@ export declare function resolveSaferExecBinary(): string | undefined;
  * @param {boolean} [options.traceExec] - Log every child process spawned
  * @param {string[]} [options.allowExec] - Executables the command is allowed to run
  * @param {string[]} [options.blockExec] - Executables to block from running
- * @returns {Promise<{libPaths: string[], httpAccessEntries: Object[]}>} Collected libraries and HTTP URLs
+ * @param {boolean} [options.proxyEgress] - Route egress through safer-exec's hostname-pinning proxy (network stays enabled; only allowHosts are reachable)
+ * @param {boolean} [options.allowLoopback] - Allow loopback connections
+ * @param {boolean} [options.dryRun] - Deny every filesystem and network side effect and collect a dry-run report
+ * @param {string} [options.policy] - Named safer-exec ecosystem policy (npm, pypi, maven, ...)
+ * @param {string} [options.policyFile] - Path to a safer-exec JSON policy file
+ * @param {boolean} [options.blockInterpreters] - Block interpreters with sandbox or task-port exemptions (macOS)
+ * @param {boolean} [options.denyPersistenceWrites] - Deny writes to auto-execution and persistence locations
+ * @param {boolean} [options.privateTmp] - Private tmpfs /tmp and /var/tmp (Linux)
+ * @param {string} [options.protectHome] - Home isolation: read-only, tmpfs, or off (Linux)
+ * @returns {Promise<{libPaths: string[], httpAccessEntries: Object[], egressEntries?: Object[], dryRunSummary?: Object}>} Collected libraries, HTTP URLs, proxy egress decisions, and the dry-run summary
+ * @throws {Error} When the @cdxgen/safer-exec tracing runtime is not installed
+ *   (for example after pruning it from a standalone payload), since the traced
+ *   command could never run and the BOM would silently be empty
  */
 export declare function executeAndTrace(commandStr: string, workingDir?: string, options?: {
     readPaths?: string[];
@@ -62,10 +82,48 @@ export declare function executeAndTrace(commandStr: string, workingDir?: string,
     traceExec?: boolean;
     allowExec?: string[];
     blockExec?: string[];
+    proxyEgress?: boolean;
+    allowLoopback?: boolean;
+    dryRun?: boolean;
+    policy?: string;
+    policyFile?: string;
+    blockInterpreters?: boolean;
+    denyPersistenceWrites?: boolean;
+    privateTmp?: boolean;
+    protectHome?: string;
 }): Promise<{
     libPaths: string[];
     httpAccessEntries: Object[];
+    egressEntries?: Object[];
+    dryRunSummary?: Object;
 }>;
+/**
+ * Picks the safer-exec engine's own lines out of the stderr it shares with the
+ * traced command. Warnings start with "safer-exec: warning:"; when the engine
+ * stops a run, its error is the last other "safer-exec: " line it prints.
+ *
+ * @param {string} stderr Captured stderr of a safer-exec run
+ * @returns {{warnings: string[], error: string|undefined}} Unique engine warnings, and the engine's error if any
+ */
+export declare function engineMessages(stderr: string): {
+    warnings: string[];
+    error: string | undefined;
+};
+/**
+ * Extracts the egress proxy's decisions from a safer-exec audit log.
+ * "proxy-connect" targets are "host:port"; "proxy-violation" targets are
+ * "CONNECT host:port" or "METHOD http://host[:port]/path". Only the authority
+ * is kept, never a path or query.
+ *
+ * @param {Object[]} auditLog - safer-exec audit entries
+ * @returns {{host: string, port: number, protocol: string, decision: string}[]} Unique egress decisions
+ */
+export declare function parseEgressEntries(auditLog: Object[]): {
+    host: string;
+    port: number;
+    protocol: string;
+    decision: string;
+}[];
 /**
  * Groups HTTP access entries into a CycloneDX services-ready map.
  * Each unique (host, port, protocol) combination becomes a service.

package/types/lib/inventory/traceRunner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"traceRunner.d.ts","sourceRoot":"","sources":["../../../lib/inventory/traceRunner.js"],"names":[],"mappings":"AAyBA;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAHxB,MAGwB,GAFtB;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,CA6BzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAFzB,MAAM,GAAC,SAAS,CAoE5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAxBrC,MAwBqC,EAAE,UAAU,AAvBzD,CACA,EADQ,MAuBiD,EAAE,OAAO,AAtBlE,CAoBA,EAnBA;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;IAA0B,cAAc,AAAxC,CACA,EADQ,OAAO,CACf;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;CAEuE,GAF7D,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CAyOtE;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,iBAAiB,EAHjD,MAAM,EAG2C;eAFlB,GAAG,CAAC,MAAM,CAAC;gBAAc,MAAM,EAAE;GAuC1E"}
+{"version":3,"file":"traceRunner.d.ts","sourceRoot":"","sources":["../../../lib/inventory/traceRunner.js"],"names":[],"mappings":"AAsBA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAFvB,OAAO,CAInB;AAKD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAHxB,MAGwB,GAFtB;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,CA6BzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAFzB,MAAM,GAAC,SAAS,CAsF5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAsB,eAAe,CAAC,UAAU,EApCrC,MAoCqC,EAAE,UAAU,AAnCzD,CACA,EADQ,MAmCiD,EAAE,OAAO,AAlClE,CA6BA,EA5BA;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;IAA0B,cAAc,AAAxC,CACA,EADQ,OAAO,CACf;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAAyB,MAAM,AAA/B,CACA,EADQ,MAAM,CACd;IAAyB,UAAU,AAAnC,CACA,EADQ,MAAM,CACd;IAA0B,iBAAiB,AAA3C,CACA,EADQ,OAAO,CACf;IAA0B,qBAAqB,AAA/C,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;CAKuE,GAL7D,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAC,CAAC,CAoWxH;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAH1B,MAG0B,GAFxB;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,GAAC,SAAS,CAAA;CAAC,CAazD;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAHhC,MAAM,EAG0B,GAF9B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,EAAE,CAkD9E;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,iBAAiB,EAHjD,MAAM,EAG2C;eAFlB,GAAG,CAAC,MAAM,CAAC;gBAAc,MAAM,EAAE;GA+C1E"}

package/types/lib/inventory/tracedCrypto.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Names the bulk cipher of a TLS cipher suite as a crypto-oid.json key, from
+ * either its IANA name (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) or its OpenSSL
+ * name (ECDHE-RSA-AES128-GCM-SHA256).
+ *
+ * @param {string} suiteName Cipher suite name
+ * @returns {{name: string, bits: number, mode: string|undefined}|undefined} The cipher, when it has an OID
+ */
+export declare function suiteCipher(suiteName: string): {
+    name: string;
+    bits: number;
+    mode: string | undefined;
+} | undefined;
+/**
+ * Turns the CBOM safer-exec writes for a traced command into components that
+ * cdxgen can merge and validate:
+ *
+ * - every asset gets a bom-ref, without which the assets merge into one
+ * - algorithms carry their OID, and those without one are left out
+ * - hybrid key-exchange groups become their classical and ML-KEM halves
+ * - cipher suites become their bulk cipher, which the protocol's suites refer
+ *   to by bom-ref
+ * - algorithm properties keep only values the schema allows
+ * - crypto libraries are left out: they are the traced library components,
+ *   marked with cdx:dynamic:cryptoLibrary
+ *
+ * @param {Object[]} cbomComponents Components of the safer-exec CBOM
+ * @returns {Object[]} Normalized cryptographic-asset components
+ */
+export declare function normalizeTracedCryptoComponents(cbomComponents: Object[]): Object[];
+/**
+ * Maps the crypto libraries safer-exec reported to the paths they were loaded
+ * from.
+ *
+ * @param {Object[]} cryptoEntries safer-exec crypto-library and crypto-cipher audit entries
+ * @returns {Map<string, {name: string, version: string}>} Crypto libraries by path
+ */
+export declare function cryptoLibrariesByPath(cryptoEntries: Object[]): Map<string, {
+    name: string;
+    version: string;
+}>;
+//# sourceMappingURL=tracedCrypto.d.ts.map

package/types/lib/inventory/tracedCrypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracedCrypto.d.ts","sourceRoot":"","sources":["../../../lib/inventory/tracedCrypto.js"],"names":[],"mappings":"AAqDA;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAH1B,MAG0B,GAFxB;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAC,SAAS,CAAA;CAAC,GAAC,SAAS,CAuB1E;AA+DD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,+BAA+B,CAAC,cAAc,EAHnD,MAAM,EAG6C,GAFjD,MAAM,EAAE,CA+GpB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAHxC,MAAM,EAGkC,GAFtC,GAAG,CAAC,MAAM,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CAgBxD"}

package/types/lib/managers/binary.d.ts

@@ -15,13 +15,25 @@ export declare function getPluginToolComponents(toolNames?: string[]): Object[];
  *   is unavailable or produced no output.
  */
 export declare function getCargoAuditableInfo(src: string): string | undefined;
+/**
+ * Check that sourcekitten (bundled plugin or SOURCEKITTEN_CMD) answers a
+ * trivial syntax request.
+ *
+ * @param env {Object} Optional environment overrides merged over process.env
+ * @returns {String} `ok`; `unavailable` when there is no bundled plugin and
+ *   SOURCEKITTEN_CMD is unset; `not-found` when the configured executable does
+ *   not exist; `failed` when it ran but could not answer
+ */
+export declare function probeSourcekitten(env: Object): string;
 /**
  * Execute sourcekitten plugin with the given arguments
  *
  * @param args {Array} Arguments
+ * @param env {Object} Optional environment overrides merged over process.env,
+ *   used to align sourcekitten with a specific Swift toolchain
  * @returns {undefined|Object} Command output
  */
-export declare function executeSourcekitten(args: any[]): undefined | Object;
+export declare function executeSourcekitten(args: any[], env: Object): undefined | Object;
 /**
  * Canonicalise the distro vendor namespace of an OS package component
  * produced by trivy, regardless of whether trivy expressed the vendor via the
@@ -103,6 +115,23 @@ export declare function dropRedundantSourceComponents(pkgList: any[]): any[];
  * @returns {Object} Metadata containing packages, dependencies, etc
  */
 export declare function getOSPackages(src: string, imageConfig: Object, options?: {}): Object;
+/**
+ * Collect the dependency edges trivy recorded for one OS package component.
+ *
+ * Trivy keys its `dependencies` by its own bom-refs, which may leave the `+` of
+ * an rpm or deb version unescaped (`...libstdc%2B%2B6@14.2.0+git10526-...`), so
+ * each ref is read structurally and re-rendered in cdxgen's decoded bom-ref
+ * form with the component's type, namespace and distro qualifiers.
+ *
+ * @param {Object<string, string[]>} tmpDependencies Trivy's refs mapped to the refs they depend on
+ * @param {string} origBomRef The component's bom-ref as trivy wrote it
+ * @param {object} comp The component after cdxgen rewrote its purl and bom-ref
+ * @returns {{ref: string, dependsOn: string[]}|undefined} Dependency entry for the component
+ */
+export declare const retrieveDependencies: (tmpDependencies: Record<string, string[]>, origBomRef: string, comp: object) => {
+    ref: string;
+    dependsOn: string[];
+} | undefined;
 /**
  * Batch-enrich operating-system components with host-path trust data using the
  * `trustinspector` helper on darwin and Windows.

package/types/lib/managers/binary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"binary.d.ts","sourceRoot":"","sources":["../../../lib/managers/binary.js"],"names":[],"mappings":"AA0YA;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,AAH9C,CACA,EADQ,MAAM,EAGqC,GAFzC,MAAM,EAAE,CAgBpB;AA4FD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,GAH5B,MAAM,GAAC,SAAS,CAmB5B;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,OAAA,GAF3B,SAAS,GAAC,MAAM,CAkB5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EARK,MAQL,EACJ,OAAO,EARE,MAQF,EACP,IAAI,EARK,MAQL,EACJ,KAAK,EARI,MAQJ,EACL,QAAQ,AARP,CACA,EADQ,MAQD,GAPG,MAAM,CAgDlB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAJ/B,MAI+B,EAAE,QAAQ,AAHjD,CACA,EADQ,MAGyC,GAFvC,MAAM,CA6BlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,OAAA,SAoBpD;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,GAAG,QAAA,EAAE,WAAW,EAL7B,MAK6B,EAAE,OAAO,KAAK,GAFrD,MAAM,CA4mBlB;AAkwDD;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,AALvD,CACA,EADQ,MAAM,EAK8C,GAJlD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAC,CAmEnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EALzB,MAKyB,GAJvB,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAJxB,MAIwB,EAAE,UAAU,EAHpC,MAGoC,WA6C9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EANrB,MAMqB,EAAE,aAAa,EALpC,MAKoC,EAAE,QAAQ,EAJ9C,OAI8C,GAF7C,OAAO,CAiClB"}
+{"version":3,"file":"binary.d.ts","sourceRoot":"","sources":["../../../lib/managers/binary.js"],"names":[],"mappings":"AA+YA;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,AAH9C,CACA,EADQ,MAAM,EAGqC,GAFzC,MAAM,EAAE,CAgBpB;AA4FD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,GAH5B,MAAM,GAAC,SAAS,CAmB5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EALtB,MAKsB,UA+BpC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,OAAA,EAAE,GAAG,EAJ9B,MAI8B,GAFhC,SAAS,GAAC,MAAM,CAmC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EARK,MAQL,EACJ,OAAO,EARE,MAQF,EACP,IAAI,EARK,MAQL,EACJ,KAAK,EARI,MAQJ,EACL,QAAQ,AARP,CACA,EADQ,MAQD,GAPG,MAAM,CAgDlB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAJ/B,MAI+B,EAAE,QAAQ,AAHjD,CACA,EADQ,MAGyC,GAFvC,MAAM,CA6BlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,OAAA,SAoBpD;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,GAAG,QAAA,EAAE,WAAW,EAL7B,MAK6B,EAAE,OAAO,KAAK,GAFrD,MAAM,CAinBlB;AA4lDD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,0DAJtB,MAAM,QACN,MAAM,KACJ;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAsD/C,CAAC;AAyHF;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,AALvD,CACA,EADQ,MAAM,EAK8C,GAJlD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAC,CAmEnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EALzB,MAKyB,GAJvB,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAJxB,MAIwB,EAAE,UAAU,EAHpC,MAGoC,WA6C9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EANrB,MAMqB,EAAE,aAAa,EALpC,MAKoC,EAAE,QAAQ,EAJ9C,OAI8C,GAF7C,OAAO,CAiClB"}

package/types/lib/managers/docker.d.ts

@@ -53,6 +53,27 @@ export declare const getConnection: (_options: Object, forRegistry?: string) =>
  *   requests, raw Buffer for other methods, or `undefined` if no client is available
  */
 export declare const makeRequest: (path: string, method: string, forRegistry?: string) => Promise<Object | Buffer | undefined>;
+/**
+ * Decide whether a CLI path argument is a container image reference in the
+ * styles the container pipeline documents: name, name:tag, namespace/name,
+ * registry/namespace/name:tag, registry:port/..., and any of those with a
+ * @digest. Everything that smells like a filesystem path, a URL or a CLI
+ * option never matches, so strings such as "c:\Users", "c:/tmp" or
+ * "file:///etc" can never reach the container clients: backslashes and
+ * schemes are rejected outright, and a drive-letter prefix fails because a
+ * lone letter is neither a dotted host nor a host:port, and a tag may not
+ * begin with the "/" that follows the colon in "c:/tmp".
+ *
+ * The check mirrors how the distribution reference grammar detects a registry
+ * host: the first component counts as a host only when it carries a dot, a
+ * numeric port, or is exactly localhost. Each piece is validated by a linear
+ * regex or plain string splitting, and the input is length-capped, so hostile
+ * inputs cannot backtrack expensively.
+ *
+ * @param {string} fullImageName Candidate image reference
+ * @returns {boolean} true when the string is a plausible image reference
+ */
+export declare const isImageReference: (fullImageName: string) => boolean;
 /**
  * Parse image name
  *
@@ -70,6 +91,14 @@ export declare const parseImageName: (fullImageName: any) => {
     group: string;
     name: string;
 };
+/**
+ * Prefer cli on windows, nerdctl on mac, or when using tcp/ssh based host.
+ * On Windows, fall back to wslc (WSL Containers) when the docker CLI is not
+ * installed, so OCI image scans work on hosts that only have WSL.
+ *
+ * @returns {string} Container CLI command to invoke
+ */
+export declare const getContainerCliCmd: () => string;
 /**
  * Method to get image to the local registry by pulling from the remote if required
  */

package/types/lib/managers/docker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../lib/managers/docker.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAwCrC,yDAAyD;AACzD,eAAO,MAAM,KAAK,SAA0B,CAAC;AAC7C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAEoC,CAAC;AAsQ/C;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,SAHnB,MAAM,KACJ,MAiBZ,CAAC;AAEF;;GAEG;AACH,wBAAgB,YAAY,QAoB3B;AAED;;GAEG;AACH,wBAAgB,oBAAoB,QA2CnC;AAyTD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,aANf,MAAM,gBAEN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,SAAS,CA6HpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,SANb,MAAM,UACN,MAAM,gBACN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,MAAM,GAAC,SAAS,CAgC3C,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;;;;;;CA2E1B,CAAC;AAkCF;;GAEG;AACH,eAAO,MAAM,QAAQ,sCA2LpB,CAAC;AAGC,YAA4B,gBAAgB,GAAlC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAkB;AAiH/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,kBANZ,MAAM,OACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,OAAO,CAqF3B,CAAC;AAiGF;;;GAGG;AACH,eAAO,MAAM,aAAa,mEAqGzB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,iBATrB,MAAM,aACN,MAAM,WACN,MAAM,wBACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,MAAM,CAgI1B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,oDAkJvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,iDAkJ1B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,kBALb,MAAM,UACN,OAAO,KACL,OAAO,CAAC,MAAM,GAAC,SAAS,CAKpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,cALpB,MAAM,iBACN,MAAM,KACJ,MAAM,GAAC,SA2CnB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,qBAHpB,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,cACnC,KAAK,CAAC,MAAM,CAAC,SA4BvB,CAAC"}
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../lib/managers/docker.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA+CrC,yDAAyD;AACzD,eAAO,MAAM,KAAK,SAA0B,CAAC;AAC7C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAEoC,CAAC;AAkS/C;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,SAHnB,MAAM,KACJ,MAiBZ,CAAC;AAEF;;GAEG;AACH,wBAAgB,YAAY,QAoB3B;AAED;;GAEG;AACH,wBAAgB,oBAAoB,QA2CnC;AAyTD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,aANf,MAAM,gBAEN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,SAAS,CA6HpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,SANb,MAAM,UACN,MAAM,gBACN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,MAAM,GAAC,SAAS,CAgC3C,CAAC;AA8CF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,gBAAgB,kBAHlB,MAAM,KACJ,OAsEZ,CAAC;AAgBF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;;;;;;CA2E1B,CAAC;AAyFF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,QAFlB,MAgCZ,CAAC;AAkBF;;GAEG;AACH,eAAO,MAAM,QAAQ,sCA6MpB,CAAC;AAkBC,YAA4B,gBAAgB,GAAlC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAkB;AAiH/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,kBANZ,MAAM,OACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,OAAO,CAqF3B,CAAC;AAiGF;;;GAGG;AACH,eAAO,MAAM,aAAa,mEAqGzB,CAAC;AAmDF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,iBATrB,MAAM,aACN,MAAM,WACN,MAAM,wBACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,MAAM,CAuK1B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,oDAyJvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,iDAkJ1B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,kBALb,MAAM,UACN,OAAO,KACL,OAAO,CAAC,MAAM,GAAC,SAAS,CAKpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,cALpB,MAAM,iBACN,MAAM,KACJ,MAAM,GAAC,SA2CnB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,qBAHpB,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,cACnC,KAAK,CAAC,MAAM,CAAC,SA4BvB,CAAC"}

package/types/lib/managers/oci.d.ts

@@ -1,12 +1,28 @@
+/**
+ * Check whether a token realm URL belongs to the registry itself.
+ *
+ * A registry's 401 response names the realm, so a hostile registry picks the
+ * URL cdxgen will call. Credentials picked up for the registry must therefore
+ * only be attached when the realm resolves to the same host and port; public
+ * delegating realms (docker.io to auth.docker.io) are still usable, just
+ * anonymously.
+ *
+ * @param {string} registry Registry host, optionally with a port
+ * @param {URL} realmUrl Parsed realm URL from the WWW-Authenticate header
+ * @returns {boolean} true when host and port match the registry
+ */
+export declare function isSameRegistryHost(registry: string, realmUrl: URL): boolean;
 /**
  * Retrieves a CycloneDX BOM attached to an OCI image purely in JavaScript
  * without relying on the `oras` CLI tool.
  *
  * @param {string} image OCI image reference (e.g. `"registry.example.com/org/app:tag"`)
  * @param {string} [platform] OCI platform string (e.g. `"linux/amd64"`); no-op for JS implementation
+ * @param {Object} [options]
+ * @param {function(Buffer): void} [options.checkBytes] Called with the raw bytes of the BOM layer that is about to be returned. An error it throws is rethrown, and no other referrer is tried.
  * @returns {Promise<Object|undefined>} Parsed CycloneDX BOM JSON object, or `undefined` if not found
  */
-export declare function getBomWithOras(image: string, _platform?: undefined): Promise<Object | undefined>;
+export declare function getBomWithOras(image: string, _platform?: undefined, options?: Object): Promise<Object | undefined>;
 /**
  * Attach a CycloneDX BOM to an OCI image using the OCI 1.1 artifact manifest
  * API, pushing the BOM as a blob and linking it via the referrers API (with a

package/types/lib/managers/oci.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oci.d.ts","sourceRoot":"","sources":["../../../lib/managers/oci.js"],"names":[],"mappings":"AAgXA;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAJ/B,MAI+B,EAAE,SAAS,YAAY,GAFpD,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA4GrC;AAmFD;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,KAAK,EALhC,MAKgC,EAAE,OAAO,EAJzC,MAIyC,GAHvC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAmIrC"}
+{"version":3,"file":"oci.d.ts","sourceRoot":"","sources":["../../../lib/managers/oci.js"],"names":[],"mappings":"AAuOA;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAJhC,MAIgC,EAAE,QAAQ,EAH1C,GAG0C,GAFxC,OAAO,CAgBnB;AAuJD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAPI,MAOJ,EACL,SAAS,YAAY,EACrB,OAAO,AAPN,CACA,EADQ,MAOG,GALD,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA6HrC;AAmFD;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,KAAK,EALhC,MAKgC,EAAE,OAAO,EAJzC,MAIyC,GAHvC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAmIrC"}

package/types/lib/parsers/cmakeCache.d.ts

@@ -67,4 +67,20 @@ export declare function resolveCmakeCacheFacts(map: Map<string, {
     findPackages: Map<string, string>;
     fetchContentBase?: string;
 };
+/**
+ * Parse a compiler description CMake writes when it configures a build
+ * (`CMakeFiles/<cmake version>/CMake<LANG>Compiler.cmake`): the compiler's
+ * path, CMake's id for it and its version, all identified by CMake itself.
+ *
+ * @param {string} text File contents
+ * @returns {{language: string, compiler: string, family: string, id: string, version: string}|null}
+ *   `null` when the text names no compiler
+ */
+export declare function parseCmakeCompilerFile(text: string): {
+    language: string;
+    compiler: string;
+    family: string;
+    id: string;
+    version: string;
+} | null;
 //# sourceMappingURL=cmakeCache.d.ts.map

package/types/lib/parsers/cmakeCache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cmakeCache.d.ts","sourceRoot":"","sources":["../../../lib/parsers/cmakeCache.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAHzB,MAGyB,GAFvB,GAAG,CAAC,MAAM,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAAC,CA0BtD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAJlC,MAIkC,GAHhC,MAAM,GAAC,IAAI,CA0BvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,GAAG,CAAC,MAAM,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAGV,GAF7B;IAAE,WAAW,EAAE;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAC,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;IAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,CAiG1P"}
+{"version":3,"file":"cmakeCache.d.ts","sourceRoot":"","sources":["../../../lib/parsers/cmakeCache.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAHzB,MAGyB,GAFvB,GAAG,CAAC,MAAM,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAAC,CA0BtD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAJlC,MAIkC,GAHhC,MAAM,GAAC,IAAI,CA0BvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,GAAG,CAAC,MAAM,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAGV,GAF7B;IAAE,WAAW,EAAE;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAC,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;IAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,CAiG1P;AAeD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAJhC,MAIgC,GAH9B;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAAC,IAAI,CAgDlG"}

package/types/lib/parsers/cmakeLists.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Pure parser for CMake language files (`CMakeLists.txt`, `*.cmake`).
+ *
+ * `parseCmakeCommands` splits a file into command invocations the way CMake
+ * reads it: command names are case-insensitive, an invocation may span several
+ * lines, and arguments may be quoted, bracketed (`[[...]]`) or interleaved with
+ * comments. `cmakeFetchDependencies` reads the commands that download a
+ * dependency at configure time: `FetchContent_Declare`, `ExternalProject_Add`
+ * and the CPM.cmake `CPMAddPackage` family.
+ *
+ * This module is layer 1 (text in, data out): no filesystem or subprocess
+ * access. `lib/ecosystems/parsers-misc.js` turns the facts into components.
+ */
+/**
+ * Split CMake source into command invocations.
+ *
+ * @param {string} text Contents of a CMake file
+ * @returns {{name: string, args: string[], line: number}[]} Invocations in
+ *   source order. `name` is lower-cased; `args` have their quotes and bracket
+ *   delimiters removed; `line` is the 1-based line of the command name.
+ */
+export declare function parseCmakeCommands(text: string): {
+    name: string;
+    args: string[];
+    line: number;
+}[];
+/**
+ * Replace `${VAR}` references with the values of simple `set()` calls. A
+ * reference to an unknown variable is left in place, so callers can tell a
+ * resolved value from an unresolved one. Expansion stops at the previous
+ * round once the text would exceed 64 KiB.
+ *
+ * @param {string} value Argument text
+ * @param {Map<string,string>} variables Known variable values
+ * @returns {string} The expanded text
+ */
+export declare function expandCmakeVariables(value: string, variables: Map<string, string>): string;
+/**
+ * The variables a file sets to a single value: `set(FOO_VERSION 1.2.3)` and
+ * `set(FOO_VERSION "1.2.3" CACHE STRING "...")`. Later definitions win.
+ *
+ * @param {{name: string, args: string[]}[]} commands Parsed commands
+ * @returns {Map<string,string>} Variable values
+ */
+export declare function cmakeSetVariables(commands: {
+    name: string;
+    args: string[];
+}[]): Map<string, string>;
+/**
+ * The dependencies a CMake file downloads at configure time.
+ *
+ * `FetchContent_Declare(<name> ...)` and `ExternalProject_Add(<name> ...)` are
+ * read for `GIT_REPOSITORY`/`GIT_TAG` and `URL`/`URL_HASH`/`URL_MD5`.
+ * `CPMAddPackage`, `CPMFindPackage` and `CPMDeclarePackage` are read in both
+ * the shorthand form and the keyword form (`NAME`, `VERSION`,
+ * `GITHUB_REPOSITORY`, `GITLAB_REPOSITORY`, `BITBUCKET_REPOSITORY`,
+ * `GIT_REPOSITORY`, `GIT_TAG`, `URL`, `URL_HASH`). `${VAR}` references are
+ * expanded with the file's simple `set()` values; anything still unresolved
+ * stays as written.
+ *
+ * @param {string} text Contents of a CMake file
+ * @returns {{kind: string, name: string, line: number, gitRepository?: string, gitTag?: string, url?: string, urlHash?: string, version?: string, madeAvailable: boolean}[]}
+ *   `kind` is `fetch`, `external-project` or `cpm`; `madeAvailable` is true
+ *   when a `FetchContent_MakeAvailable` in the same file names the dependency.
+ */
+export declare function cmakeFetchDependencies(text: string): {
+    kind: string;
+    name: string;
+    line: number;
+    gitRepository?: string;
+    gitTag?: string;
+    url?: string;
+    urlHash?: string;
+    version?: string;
+    madeAvailable: boolean;
+}[];
+//# sourceMappingURL=cmakeLists.d.ts.map

package/types/lib/parsers/cmakeLists.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cmakeLists.d.ts","sourceRoot":"","sources":["../../../lib/parsers/cmakeLists.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA8DH;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAL5B,MAK4B,GAJ1B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,EAAE,CA8G1D;AAMD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAJ/B,MAI+B,EAAE,SAAS,EAH1C,GAAG,CAAC,MAAM,EAAC,MAAM,CAGyB,GAFxC,MAAM,CAkClB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,EAGC,GAF7B,GAAG,CAAC,MAAM,EAAC,MAAM,CAAC,CAwB9B;AAgFD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EALhC,MAKgC,GAJ9B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAC,EAAE,CAyG3K"}

package/types/lib/parsers/cmakePresets.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Pure reader for CMake presets (`CMakePresets.json` and
+ * `CMakeUserPresets.json`, schema versions 1 to 10).
+ *
+ * A configure preset names how a project is configured: the generator, the
+ * build directory, the toolchain file and the cache variables (build type,
+ * compilers). Presets inherit from one another, may be hidden (templates
+ * that only exist to be inherited), may be enabled only under a condition,
+ * and spell paths with macros such as `${sourceDir}` and `$env{NAME}`.
+ *
+ * This module is layer 1: text and a context object in, data out. Reading the
+ * files (and their `include` lists) is done by the caller, which also supplies
+ * the process environment through `context.penv`.
+ */
+/**
+ * Parse the text of a presets file.
+ *
+ * @param {string} text File contents
+ * @returns {{version: number|undefined, include: string[], configurePresets: Object[]}|null}
+ *   `null` when the text is not a presets document
+ */
+export declare function parseCmakePresets(text: string): {
+    version: number | undefined;
+    include: string[];
+    configurePresets: Object[];
+} | null;
+/**
+ * Expand the macros CMake allows in preset strings.
+ *
+ * Supported: `${sourceDir}`, `${sourceParentDir}`, `${sourceDirName}`,
+ * `${presetName}`, `${generator}`, `${hostSystemName}`, `${fileDir}`,
+ * `${dollar}`, `${pathListSep}`, `$env{NAME}` (the preset's own environment,
+ * then the process environment) and `$penv{NAME}` (the process environment).
+ * `$vendor{...}` and unknown macros are left as written.
+ *
+ * @param {string} value String to expand
+ * @param {Object} context Macro values; `env` (preset environment, a plain
+ *   object) and `penv` (a function reading the process environment) are
+ *   optional
+ * @returns {string} Expanded string
+ */
+export declare function expandPresetMacros(value: string, context?: Object): string;
+/**
+ * Evaluate a preset condition (schema version 3 and later).
+ *
+ * @param {*} condition Condition object (or boolean, or null)
+ * @param {function(string): string} expand Macro expander for the preset
+ * @returns {boolean|undefined} `undefined` when the condition cannot be
+ *   decided here: `matches`/`notMatches` take a regular expression from the
+ *   repository, which is not run
+ */
+export declare function evaluatePresetCondition(condition: any, expand: Function): boolean | undefined;
+/**
+ * Resolve the configure presets of a set of presets documents.
+ *
+ * Inheritance follows CMake: a preset's own fields win, then those of its
+ * `inherits` entries in order (the first wins), recursively; `cacheVariables`
+ * and `environment` merge key by key the same way, and a `null` entry unsets
+ * the key. `name`, `hidden`, `inherits`, `description` and `displayName` are
+ * not inherited. A preset that is part of an inheritance cycle, or inherits
+ * one that does not exist, is dropped.
+ *
+ * @param {Array<{file: string, fileDir: string, document: Object}>} documents
+ *   Parsed documents in reading order (`CMakePresets.json` first, then its
+ *   includes, then `CMakeUserPresets.json`)
+ * @param {Object} context `sourceDir`, `hostSystemName`, `pathListSep`, and
+ *   `penv` (a function reading the process environment)
+ * @returns {Object[]} Visible configure presets: `name`, `displayName`,
+ *   `file`, `inherits`, `generator`, `binaryDir` (absolute), `toolchainFile`,
+ *   `cacheVariables` (expanded strings), `environment` (expanded strings),
+ *   `hasCondition`, and `conditionMet` (true, false or undefined)
+ */
+export declare function resolveConfigurePresets(documents: Array<{
+    file: string;
+    fileDir: string;
+    document: Object;
+}>, context?: Object): Object[];
+//# sourceMappingURL=cmakePresets.d.ts.map