@cdxgen/cdxgen 13.3.0 → 13.4.0

package/types/lib/core/processTree.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Helpers for external commands stopped by cdxgen's spawn timeout.
+ *
+ * Layer 0: this module imports nothing outside `lib/core`, so both the atom
+ * and the dosai runners (layer 2) can share it.
+ */
+/**
+ * A duration for a message: seconds to one decimal below a minute, minutes to
+ * one decimal from there.
+ *
+ * @param {number} ms Duration in milliseconds
+ * @returns {string} Human-readable duration
+ */
+export declare function formatDuration(ms: number): string;
+/**
+ * Stop the descendants a timed-out run left behind on Windows.
+ *
+ * The spawn timeout terminates only the process cdxgen spawned, and Windows
+ * neither kills nor re-parents its children: a shell's command, a runtime's
+ * workers, or the build hosts a .NET analyzer starts keep running while still
+ * pointing at the dead process's pid. `taskkill /T` on that pid finds nothing,
+ * because the root is already gone. The live descendants are therefore found
+ * by parent pid in a process snapshot and stopped, limited to processes
+ * created after the run started. The root's own children must also predate
+ * its end: once the root is gone its pid can be handed to an unrelated
+ * process, whose children would otherwise look like the run's. Elsewhere this
+ * does nothing: an orphan is re-parented and can no longer be told apart.
+ *
+ * @param {number|undefined} rootPid pid of the process cdxgen spawned
+ * @param {number} startedAt Epoch milliseconds at which the run started
+ * @param {number} [endedAt] Epoch milliseconds at which the spawned process ended
+ * @param {string} [toolName] Name of the tool, for the debug message
+ * @returns {number[]} The pids that were stopped
+ */
+export declare function reapProcessTree(rootPid: number | undefined, startedAt: number, endedAt?: number, toolName?: string): number[];
+//# sourceMappingURL=processTree.d.ts.map

package/types/lib/core/processTree.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"processTree.d.ts","sourceRoot":"","sources":["../../../lib/core/processTree.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAHtB,MAGsB,GAFpB,MAAM,CAQlB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAPE,MAAM,GAAC,SAOT,EACP,SAAS,EAPA,MAOA,EACT,OAAO,AAPN,CACA,EADQ,MAOW,EACpB,QAAQ,AAPP,CACA,EADQ,MAOY,GANV,MAAM,EAAE,CAuDpB"}

package/types/lib/core/runState.d.ts

@@ -0,0 +1,29 @@
+/**
+ * State that lasts for one run.
+ *
+ * Registry answers, prefetched documents, recorded misses and local cache
+ * lookups are kept in module state, so that a package several lockfiles name
+ * costs one lookup. A run is one BOM generation. The CLI exits when it ends, but
+ * a long-lived process such as the server performs many, and nothing a run
+ * remembered should outlive it: the registries publish new releases, builds
+ * download new artifacts, and the memory belongs to the next scan.
+ *
+ * Every module that keeps such state registers a reset when it loads. The
+ * server calls {@link resetRunState} between scans. A module that has not
+ * loaded yet holds nothing to reset.
+ */
+/**
+ * Register the function that empties a module's per-run state.
+ *
+ * @param {string} name Unique name, normally the module and what it holds
+ * @param {() => void} reset Empties that state
+ * @returns {void}
+ */
+export declare function registerRunReset(name: string, reset: () => void): void;
+/**
+ * Empty the per-run state of every module that registered one.
+ *
+ * @returns {void}
+ */
+export declare function resetRunState(): void;
+//# sourceMappingURL=runState.d.ts.map

package/types/lib/core/runState.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runState.d.ts","sourceRoot":"","sources":["../../../lib/core/runState.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,KAAK,EAHjC,MAAM,IAG2B,GAF/B,IAAI,CAIhB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,IAFhB,IAAI,CAMhB"}

package/types/lib/core/toml.d.ts

@@ -0,0 +1,20 @@
+/**
+ * TOML parsing with stable, ordinary objects.
+ *
+ * smol-toml 1.9 began returning tables and inline tables with a `null`
+ * prototype so that a hostile `__proto__` key in a manifest cannot pollute
+ * `Object.prototype`. The SBOM data itself is unaffected, but cdxgen hands
+ * parsed manifests straight to callers (and `assert.deepStrictEqual` in the
+ * test suite), which compare by prototype and would see every table as a
+ * different kind of value. Re-wrapping the parse result with the standard
+ * prototype keeps the pre-1.9 contract: plain objects all the way down,
+ * `__proto__` keys included as ordinary own properties.
+ */
+/**
+ * Parse a TOML document into plain objects.
+ *
+ * @param {string} text TOML source
+ * @returns {Object} parsed document whose tables use `Object.prototype`
+ */
+export declare function parseToml(text: string): Object;
+//# sourceMappingURL=toml.d.ts.map

package/types/lib/core/toml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toml.d.ts","sourceRoot":"","sources":["../../../lib/core/toml.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAoDH;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAHnB,MAGmB,GAFjB,MAAM,CAIlB"}

package/types/lib/ecosystems/asarutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"asarutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/asarutils.js"],"names":[],"mappings":"AA6PA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAHlC,MAGkC,GAFhC,OAAO,CA6BnB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAJ1C,MAI0C,GAHxC,MAAM,CAwDlB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAJhC,MAIgC,GAH9B,MAAM,CA2ClB;AAgYD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EANE,MAAM,QAMR,EACP,YAAY,EANH,MAMG,EACZ,WAAW,EANF,MAME,GALA,MAAM,QAAM,CAqDxB;AAyYD;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EARvC,MAQuC,EAAE,OAAO,AAPxD,CAKA,EAJA;IAAyB,eAAe,AAAxC,CAEA,EAFQ,MAAM,CAEd;IAAyB,WAAW,AAApC,CAEA,EAFQ,MAAM,CAEd;CAE6D,GAFnD,OAAO,CAAC,MAAM,CAAC,CAyM3B;AAuGD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,EAH3C,MAG2C,GAFzC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA+BrC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAYzC;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,eAAe,EALN,MAKM,EACf,mBAAmB,EALV,OAKU,GAJR,KAAK,CAAC,MAAM,CAAC,CA0BzB"}
+{"version":3,"file":"asarutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/asarutils.js"],"names":[],"mappings":"AA8PA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAHlC,MAGkC,GAFhC,OAAO,CA6BnB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAJ1C,MAI0C,GAHxC,MAAM,CAwDlB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAJhC,MAIgC,GAH9B,MAAM,CA2ClB;AAgYD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EANE,MAAM,QAMR,EACP,YAAY,EANH,MAMG,EACZ,WAAW,EANF,MAME,GALA,MAAM,QAAM,CAqDxB;AA0YD;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EARvC,MAQuC,EAAE,OAAO,AAPxD,CAKA,EAJA;IAAyB,eAAe,AAAxC,CAEA,EAFQ,MAAM,CAEd;IAAyB,WAAW,AAApC,CAEA,EAFQ,MAAM,CAEd;CAE6D,GAFnD,OAAO,CAAC,MAAM,CAAC,CAyM3B;AAuGD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,EAH3C,MAG2C,GAFzC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA+BrC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAYzC;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,eAAe,EALN,MAKM,EACf,mBAAmB,EALV,OAKU,GAJR,KAAK,CAAC,MAAM,CAAC,CA0BzB"}

package/types/lib/ecosystems/bunutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bunutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/bunutils.js"],"names":[],"mappings":"AAgCA;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EALlC,MAKkC,GAJhC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAwB1D;AA2ED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,YAAY,CAAC,WAAW,EALnC,MAKmC,EAAE,OAAO,AAJpD,CACA,EADQ,MAIiD,GAH/C,OAAO,CAAC;IAAC,OAAO,QAAQ;IAAC,gBAAgB,QAAO;CAAC,CAAC,CA0Z9D"}
+{"version":3,"file":"bunutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/bunutils.js"],"names":[],"mappings":"AAgCA;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EALlC,MAKkC,GAJhC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAwB1D;AA2ED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,YAAY,CAAC,WAAW,EALnC,MAKmC,EAAE,OAAO,AAJpD,CACA,EADQ,MAIiD,GAH/C,OAAO,CAAC;IAAC,OAAO,QAAQ;IAAC,gBAAgB,QAAO;CAAC,CAAC,CAwZ9D"}

package/types/lib/ecosystems/cargoCache.d.ts

@@ -72,4 +72,16 @@ export declare function getCargoRegistryDir(): string;
  *   local source has this crate.
  */
 export declare function readCargoCacheMetadata(name: string, version: string): CargoCacheMetadata | undefined;
+/**
+ * The manifest values of a `.crate` archive, read without extracting it.
+ *
+ * @param {string} crateFile Path to the `.crate` archive
+ * @param {string} name Crate name, for the archive's inner directory
+ * @param {string} version Crate version
+ * @returns {Promise<{values: Object, source: string}|undefined>}
+ */
+export declare function readCrateArchiveValues(crateFile: string, name: string, version: string): Promise<{
+    values: Object;
+    source: string;
+} | undefined>;
 //# sourceMappingURL=cargoCache.d.ts.map

package/types/lib/ecosystems/cargoCache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cargoCache.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cargoCache.js"],"names":[],"mappings":"AAsCG,YAAkB,kBAAkB,GACpC;;;;IAAoB,WAAW,AAA/B,CACA,EADW,MAAM,CACjB;;;;IAAoB,OAAO,AAA3B,CACA,EADW,MAAM,CACjB;;;;IAAoB,UAAU,AAA9B,CACA,EADW,MAAM,CACjB;;;;IAAoB,QAAQ,AAA5B,CACA,EADW,MAAM,CACjB;;;;IAAoB,WAAW,AAA/B,CACA,EADW,MAAM,CACjB;;;;IAAoB,QAAQ,AAA5B,CACA,EADW,MAAM,CACjB;;;;IAAoB,QAAQ,AAA5B,CACA,EADW,MAAM,CACjB;;;;IAAqB,MAAM,AAA3B,CACA,EADW,OAAO,CAClB;;;;IAAoB,WAAW,AAA/B,CACA,EADW,MAAM,CACjB;;;;IAAoB,aAAa,AAAjC,CACA,EADW,MAAM,CACjB;;;;IAAqB,OAAO,EAAjB,MAAM,EAAE,CACrB;CAAA,CAAA;AAUD;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAFvB,IAAI,CAKhB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAF5B,OAAO,CAOnB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,CAOlB;AAkCD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EALhC,MAKgC,EAAE,OAAO,EAJzC,MAIyC,GAHvC,kBAAkB,GAAC,SAAS,CA0BxC"}
+{"version":3,"file":"cargoCache.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cargoCache.js"],"names":[],"mappings":"AAyCG,YAAkB,kBAAkB,GACpC;;;;IAAoB,WAAW,AAA/B,CACA,EADW,MAAM,CACjB;;;;IAAoB,OAAO,AAA3B,CACA,EADW,MAAM,CACjB;;;;IAAoB,UAAU,AAA9B,CACA,EADW,MAAM,CACjB;;;;IAAoB,QAAQ,AAA5B,CACA,EADW,MAAM,CACjB;;;;IAAoB,WAAW,AAA/B,CACA,EADW,MAAM,CACjB;;;;IAAoB,QAAQ,AAA5B,CACA,EADW,MAAM,CACjB;;;;IAAoB,QAAQ,AAA5B,CACA,EADW,MAAM,CACjB;;;;IAAqB,MAAM,AAA3B,CACA,EADW,OAAO,CAClB;;;;IAAoB,WAAW,AAA/B,CACA,EADW,MAAM,CACjB;;;;IAAoB,aAAa,AAAjC,CACA,EADW,MAAM,CACjB;;;;IAAqB,OAAO,EAAjB,MAAM,EAAE,CACrB;CAAA,CAAA;AAUD;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAFvB,IAAI,CAKhB;AAID;;;;GAIG;AACH,wBAAgB,yBAAyB,IAF5B,OAAO,CAOnB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,CAOlB;AAmCD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EALtC,MAKsC,EAAE,OAAO,EAJ/C,MAI+C,GAH7C,kBAAkB,GAAC,SAAS,CAmCxC;AAoGD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAAC,SAAS,EAL3C,MAK2C,EAAE,IAAI,EAJjD,MAIiD,EAAE,OAAO,EAH1D,MAG0D,GAFxD,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CA0C/D"}

package/types/lib/ecosystems/cmakeResolver.d.ts

@@ -22,9 +22,11 @@ declare function toRepoRelative(absPath: string, scanRoot: string): string | nul
 /**
  * Detect the build directory that holds a `CMakeCache.txt`.
  *
- * Looks for `build/`, `cmake-build-* /`, and `out/` under the scan root. An
- * explicit `--cmake-cache <path>` option (passed via `options.cmakeCache`)
- * takes precedence and skips autodetection.
+ * An explicit `--cmake-cache <path>` option (passed via `options.cmakeCache`)
+ * takes precedence and skips autodetection. Otherwise the project's build
+ * directories are searched in order: those its CMake presets configure, then
+ * the conventional `build`, `out`, `builddir` and `cmake-build-` directories
+ * (see `cmakeBuildDirCandidates`).
  *
  * @param {string} path Project scan root
  * @param {Object} options CLI options; `options.cmakeCache` is an explicit override

package/types/lib/ecosystems/cmakeResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cmakeResolver.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cmakeResolver.js"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH,OAAO,EAEL,WAAW,EAEZ,MAAM,4BAA4B,CAAC;AAgBpC;;;;;;;;GAQG;AACH,iBAAS,cAAc,CAAC,OAAO,EAJpB,MAIoB,EAAE,QAAQ,EAH9B,MAG8B,GAF5B,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAkC1D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC;IAAE,WAAW,EAAE;QAAC,IAAI,CAAC,EAAC,MAAM,CAAC;QAAC,OAAO,CAAC,EAAC,MAAM,CAAA;KAAC,GAAC,IAAI,CAAC;IAAC,QAAQ,gBAAM;IAAC,YAAY,gBAAM;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAuBxJ;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,OAAO,EAH/C,MAG+C,GAF7C;IAAE,GAAG,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,CAmClD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAH7B,MAG6B,GAF3B;IAAE,GAAG,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,CA6BlD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAHhC,MAGgC,GAF9B,GAAG,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAiB/E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAHlC,MAGkC,GAFhC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA4BvF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC;IAAE,WAAW,EAAE;QAAC,IAAI,CAAC,EAAC,MAAM,CAAC;QAAC,OAAO,CAAC,EAAC,MAAM,CAAA;KAAC,GAAC,IAAI,CAAC;IAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAC,MAAM,CAAC,CAAC;IAAC,UAAU,QAAQ;IAAC,SAAS,QAAQ;IAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAC;QAAC,IAAI,EAAC,MAAM,CAAC;QAAA,OAAO,CAAC,EAAC,MAAM,CAAC;QAAA,GAAG,CAAC,EAAC,MAAM,CAAC;QAAA,IAAI,EAAC,MAAM,CAAA;KAAC,CAAC,CAAA;CAAE,CAqGvN;AAgBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAJnC,MAImC,EAAE,OAAO,AAHpD,CACA,EADQ,MAG4C,GAF1C,MAAM,GAAC,IAAI,CAcvB;AAuED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAHlC,MAAM,EAG4B,GAFhC,MAAM,EAAE,CA2DpB;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAH3C,MAAM,EAGqC,GAFzC,MAAM,EAAE,CAyBpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAJ1C,MAAM,EAIoC,EAAE,IAAI,EAHhD,MAGgD,GAF9C,MAAM,EAAE,CAapB;AAED,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"cmakeResolver.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cmakeResolver.js"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAYH,OAAO,EAEL,WAAW,EAEZ,MAAM,4BAA4B,CAAC;AAapC;;;;;;;;GAQG;AACH,iBAAS,cAAc,CAAC,OAAO,EAJpB,MAIoB,EAAE,QAAQ,EAH9B,MAG8B,GAF5B,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAuB1D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC;IAAE,WAAW,EAAE;QAAC,IAAI,CAAC,EAAC,MAAM,CAAC;QAAC,OAAO,CAAC,EAAC,MAAM,CAAA;KAAC,GAAC,IAAI,CAAC;IAAC,QAAQ,gBAAM;IAAC,YAAY,gBAAM;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAuBxJ;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,OAAO,EAH/C,MAG+C,GAF7C;IAAE,GAAG,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,CAmClD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAH7B,MAG6B,GAF3B;IAAE,GAAG,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,CA6BlD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAHhC,MAGgC,GAF9B,GAAG,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAiB/E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAHlC,MAGkC,GAFhC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA4BvF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC;IAAE,WAAW,EAAE;QAAC,IAAI,CAAC,EAAC,MAAM,CAAC;QAAC,OAAO,CAAC,EAAC,MAAM,CAAA;KAAC,GAAC,IAAI,CAAC;IAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAC,MAAM,CAAC,CAAC;IAAC,UAAU,QAAQ;IAAC,SAAS,QAAQ;IAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAC;QAAC,IAAI,EAAC,MAAM,CAAC;QAAA,OAAO,CAAC,EAAC,MAAM,CAAC;QAAA,GAAG,CAAC,EAAC,MAAM,CAAC;QAAA,IAAI,EAAC,MAAM,CAAA;KAAC,CAAC,CAAA;CAAE,CAqGvN;AAgBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAJnC,MAImC,EAAE,OAAO,AAHpD,CACA,EADQ,MAG4C,GAF1C,MAAM,GAAC,IAAI,CAcvB;AAuED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAHlC,MAAM,EAG4B,GAFhC,MAAM,EAAE,CA2DpB;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAH3C,MAAM,EAGqC,GAFzC,MAAM,EAAE,CAyBpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAJ1C,MAAM,EAIoC,EAAE,IAAI,EAHhD,MAGgD,GAF9C,MAAM,EAAE,CAapB;AAED,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC"}

package/types/lib/ecosystems/cppBuildContext.d.ts

@@ -0,0 +1,55 @@
+/**
+ * How a C/C++ project is built: its CMake configure presets, the compilers
+ * its compilation database or configured build tree names, the
+ * security-hardening options it is compiled and linked with, and which of the
+ * headers it includes are its own.
+ *
+ * The presets and compilers become formulation components, the hardening
+ * options properties of the project component, and the project's own include
+ * directories let the include analysis tell first-party headers from
+ * dependencies.
+ *
+ * Layer 3: this module reads the build tree and may run a compiler (only
+ * `--version`, only outside secure mode, only a GCC, Clang, MSVC, Intel,
+ * NVIDIA or EDG driver found on the PATH or named by an absolute path outside
+ * the project).
+ */
+/**
+ * The empty build context, for scans that are not of a source tree.
+ *
+ * @returns {Object}
+ */
+export declare function emptyCppBuildContext(): Object;
+/**
+ * The executable a driver names, when it may be run: an absolute path, or a
+ * command found on the PATH, that is a file outside the project. A relative
+ * path, or anything inside the project tree, is never run, since a
+ * compilation database can come with the code it describes.
+ */
+export declare function trustedCompilerPath(driver: any, root: any): any;
+/**
+ * Resolve the build context of a C/C++ project.
+ *
+ * @param {string} path Project scan root
+ * @param {Object} options CLI options
+ * @param {Object} [cmakeContext] The CMake context (`boundaries` lists the
+ *   source directories of fetched and submodule dependencies)
+ * @param {string[]} [vendoredDirs] Directories of code the project carries
+ *   under another license; their headers are not the project's own
+ * @returns {{
+ *   formulationComponents: Object[],
+ *   parentProperties: Object[],
+ *   firstPartyIncludeDirs: string[],
+ *   compileDatabase: string|undefined,
+ *   isFirstPartyHeader: function(string): boolean,
+ * }}
+ */
+export declare function resolveCppBuildContext(path: string, options?: Object, cmakeContext?: Object, vendoredDirs?: string[]): {
+    formulationComponents: Object[];
+    parentProperties: Object[];
+    firstPartyIncludeDirs: string[];
+    compileDatabase: string | undefined;
+    isFirstPartyHeader: Function;
+    (string: any): boolean;
+};
+//# sourceMappingURL=cppBuildContext.d.ts.map

package/types/lib/ecosystems/cppBuildContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cppBuildContext.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cppBuildContext.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAqEH;;;;GAIG;AACH,wBAAgB,oBAAoB,IAFvB,MAAM,CAIlB;AAgKD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,KAAA,EAAE,IAAI,KAAA,OA0C/C;AA0KD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAfK,MAeL,EACJ,OAAO,GAfE,MAeG,EACZ,YAAY,AAfX,CAEA,EAFQ,MAee,EACxB,YAAY,AAdX,CAEA,EAFQ,MAAM,EAcE,GAZN;IACR,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,eAAe,EAAE,MAAM,GAAC,SAAS,CAAC;IAClC,kBAAkB,WAAU;IAAA,CAAC,MAAM,KAAA,GAAG,OAAO,CAAC;CAC/C,CAkJH"}

package/types/lib/ecosystems/cppEvidence.d.ts

@@ -1,3 +1,15 @@
+/**
+ * Whether a directory holds C or C++ sources for atom to parse.
+ *
+ * The search skips the directories the manifest searches skip, such as
+ * node_modules and dot directories, and honours the exclude patterns, so the
+ * sources of a native npm addon do not count.
+ *
+ * @param {string} src directory
+ * @param {Object} options CLI options
+ * @returns {boolean} true when the directory holds at least one C or C++ file
+ */
+export declare function hasCppSources(src: string, options?: Object): boolean;
 /**
  * Method to find c/c++ modules by collecting usages with atom
  *
@@ -5,8 +17,12 @@
  * @param {object} options Command line options
  * @param {array} osPkgsList Array of OS pacakges represented as components
  * @param {array} epkgList Existing packages list
+ * @param {function(string): boolean} [isFirstPartyHeader] Whether an
+ *   included header is the project's own (found under the project root or
+ *   one of its own include directories, outside any dependency's sources);
+ *   such a header is not a component
  */
-export declare function getCppModules(src: string, options: object, osPkgsList: array, epkgList: array): {
+export declare function getCppModules(src: string, options: object, osPkgsList: array, epkgList: array, isFirstPartyHeader?: Function): {
     parentComponent: Object | {
         name: any;
         version: any;
@@ -26,7 +42,7 @@ export declare function getCppModules(src: string, options: object, osPkgsList:
         version: string;
         type: string;
     } | undefined;
-    pkgList: object[];
+    pkgList: any[];
     dependenciesList: {
         ref: any;
         dependsOn: any[];

package/types/lib/ecosystems/cppEvidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cppEvidence.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cppEvidence.js"],"names":[],"mappings":"AAwDA;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EALtB,MAKsB,EAAE,OAAO,EAJ/B,MAI+B,EAAE,UAAU,EAH3C,KAG2C,EAAE,QAAQ,EAFrD,KAEqD;;;;;;;;;;;;;;;;;;;;;;;;;EAuT/D"}
+{"version":3,"file":"cppEvidence.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cppEvidence.js"],"names":[],"mappings":"AA0MA;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAJtB,MAIsB,EAAE,OAAO,GAH/B,MAGoC,GAFlC,OAAO,CAOnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAVM,MAUN,EACH,OAAO,EAVE,MAUF,EACP,UAAU,EAVD,KAUC,EACV,QAAQ,EAVC,KAUD,EACR,kBAAkB,WAAY;;;;;;;;;;;;;;;;;;;;;;;;;EAqc/B"}

package/types/lib/ecosystems/cppIncludeResolver.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Which package provides a C/C++ header, from the file the include resolved
+ * to. atom 4 and later name that file in each include's usages slice
+ * (`resolvedPath`); with it, a header is attributed exactly instead of by its
+ * name: to the project itself, to a dependency whose sources CMake fetched or
+ * a submodule checked out, to code the project vendors, to a port vcpkg
+ * installed, to a package in the Conan cache, or to the operating-system
+ * package that owns the file.
+ *
+ * Layer 3: reads the vcpkg installed tree and the Conan cache, and asks the
+ * OS package manager about a file (`dpkg-query -S`, `rpm -qf`, `apk info -W`,
+ * or the Homebrew Cellar path).
+ */
+/**
+ * The include slices of an atom C/C++ usages report: for each header as
+ * written, the files it resolved to, whether it was written as a system
+ * include, and the functions the including files call that it declares.
+ * Slices from atom releases that do not name the resolved file contribute no
+ * paths and no symbols.
+ *
+ * @param {Object} sliceData Parsed atom usages report
+ * @returns {Map<string, {paths: Set<string>, system: boolean, symbols: Set<string>}>}
+ */
+export declare function parseCIncludeSlices(sliceData: Object): Map<string, {
+    paths: Set<string>;
+    system: boolean;
+    symbols: Set<string>;
+}>;
+/**
+ * Index the ports vcpkg installed into the given `vcpkg_installed`
+ * directories: every file a port installed, by absolute path. vcpkg lists a
+ * port's files in `vcpkg/info/<port>_<version>_<triplet>.list`, one path per
+ * line relative to the installed directory.
+ *
+ * @param {string[]} installedDirs `vcpkg_installed` directories
+ * @returns {Map<string, {port: string, version: string, triplet: string}>}
+ */
+export declare function readVcpkgInstalledIndex(installedDirs: string[]): Map<string, {
+    port: string;
+    version: string;
+    triplet: string;
+}>;
+/**
+ * The package folders of a Conan 2 cache, from its database
+ * (`<home>/p/cache.sqlite3`, table `packages`).
+ *
+ * @param {string} conanHome Conan 2 home (`CONAN_HOME`, or `~/.conan2`)
+ * @returns {Array<{dir: string, name: string, version: string}>}
+ */
+export declare function conan2Packages(conanHome: string): Array<{
+    dir: string;
+    name: string;
+    version: string;
+}>;
+/**
+ * The Conan package a file belongs to: in a Conan 1 cache
+ * (`<home>/.conan/data/<name>/<version>/<user>/<channel>/package/<id>/...`)
+ * from its path, in a Conan 2 cache from the cache's database.
+ *
+ * @param {string} file Absolute path
+ * @param {Object[]} conan2 Conan 2 package folders (see `conan2Packages`)
+ * @returns {{name: string, version: string}|undefined}
+ */
+export declare function conanPackageOf(file: string, conan2: Object[]): {
+    name: string;
+    version: string;
+} | undefined;
+/**
+ * Build the function that attributes a header from the files it resolved
+ * to.
+ *
+ * @param {Object} context
+ * @param {string} context.src Project scan root
+ * @param {Object[]} [context.components] Components already known: CMake
+ *   dependencies (`cdx:cmake:sourceDir`) and vendored code
+ *   (`cdx:vendored:path`) claim the headers under their directories
+ * @param {string[]} [context.buildDirs] Build directories, searched for
+ *   `vcpkg_installed`
+ * @param {function(string): boolean} [context.isFirstPartyHeader] Whether a
+ *   file is the project's own
+ * @returns {function(Iterable<string>): Object|undefined} Given the resolved
+ *   files, `{kind: "first-party"}`, `{kind: "component", component}`,
+ *   `{kind: "vcpkg", port, version, triplet}`, `{kind: "conan", name,
+ *   version}`, `{kind: "os", pkgInfo}`, or `undefined` when no file says.
+ *   Its `vcpkgPorts()` lists the ports vcpkg installed.
+ */
+export declare function createIncludeAttributor(context: {
+    src: string;
+    components?: Object[];
+    buildDirs?: string[];
+}): Function;
+//# sourceMappingURL=cppIncludeResolver.d.ts.map

package/types/lib/ecosystems/cppIncludeResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cppIncludeResolver.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cppIncludeResolver.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAYH;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAHlC,MAGkC,GAFhC,GAAG,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAC,CAAC,CA+BpF;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAH1C,MAAM,EAGoC,GAFxC,GAAG,CAAC,MAAM,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CAsCzE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAH7B,MAG6B,GAF3B,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CAuC/D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAJxB,MAIwB,EAAE,MAAM,EAHhC,MAAM,EAG0B,GAF9B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAgBrD;AAMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAd5C;IAAwB,GAAG,EAAnB,MAAM,CACd;IAA2B,UAAU,AAArC,CAGA,EAHQ,MAAM,EAAE,CAGhB;IAA2B,SAAS,AAApC,CAEA,EAFQ,MAAM,EAAE,CAEhB;CAQ4C,YAuF9C"}

package/types/lib/ecosystems/denoutils.d.ts

@@ -28,9 +28,15 @@ export declare function findDenoJson(dir: string): string | undefined;
 /**
  * Fetch JSR registry metadata for deno/jsr package components.
  *
- * For each component carrying a `cdx:deno:jsrKey` property, fetches the version
- * and package endpoints from the JSR API (batched in a single prefetch round
- * when enabled) and fills in license, description, and the GitHub source link.
+ * For each component carrying a `cdx:deno:jsrKey` property, fetches the
+ * version and package endpoints from the JSR API and fills in license,
+ * description, and the GitHub source link. A document is requested only for
+ * a component that still misses a field that document supplies: the version
+ * document carries the license, the package document the description and the
+ * repository link, so whatever the lockfile and the installed-manifest
+ * mining filled is never asked for again. Neither document carries
+ * provenance, so a provenance fetch, as under --bom-audit, asks for nothing
+ * more.
  *
  * @param {Array<object>} pkgList Package components potentially enriched with `cdx:deno:jsrKey`.
  * @returns {Promise<Array<object>>} The enriched package list (same reference as pkgList).

package/types/lib/ecosystems/denoutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"denoutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/denoutils.js"],"names":[],"mappings":"AA8DA;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAHpB,MAGoB,GAFlB,MAAM,CAuDlB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAuB5B;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAHrB,MAGqB,GAFnB,MAAM,GAAC,SAAS,CAY5B;AAwSD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAHjC,KAAK,CAAC,MAAM,CAGqB,GAF/B,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAwElC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EALjC,MAKiC,EAAE,OAAO,AAJlD,CACA,EADQ,MAI+C,GAH7C,OAAO,CAAC;IAAC,OAAO,QAAQ;IAAC,gBAAgB,QAAO;CAAC,CAAC,CAke9D"}
+{"version":3,"file":"denoutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/denoutils.js"],"names":[],"mappings":"AA8DA;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAHpB,MAGoB,GAFlB,MAAM,CAuDlB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAuB5B;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAHrB,MAGqB,GAFnB,MAAM,GAAC,SAAS,CAY5B;AA2TD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAHjC,KAAK,CAAC,MAAM,CAGqB,GAF/B,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CA4ElC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EALjC,MAKiC,EAAE,OAAO,AAJlD,CACA,EADQ,MAI+C,GAH7C,OAAO,CAAC;IAAC,OAAO,QAAQ;IAAC,gBAAgB,QAAO;CAAC,CAAC,CAge9D"}

package/types/lib/ecosystems/ecosystems.d.ts

@@ -1,10 +1,10 @@
-export declare let metadata_cache: {};
 /**
- * Internal helper to reset metadata_cache. Used by parseGoModData (still in
- * utils.js until batch 6) because ESM forbids reassigning an imported binding.
- * NOT re-exported through the utils.js barrel.
+ * No longer used. Registry answers are kept per ecosystem and for one run; this
+ * object stays exported for callers that imported it.
+ *
+ * @deprecated
  */
-export declare function _clearMetadataCache(): void;
+export declare const metadata_cache: {};
 /**
  * Fetches license information for a list of Swift packages by querying the
  * GitHub repository license API for packages hosted on github.com.
@@ -16,9 +16,27 @@ export declare function getSwiftPackageMetadata(pkgList: Object[]): Promise<Obje
 /**
  * Method to retrieve metadata for npm packages by querying npmjs
  *
+ * Packages a public registry cannot hold are skipped: the project itself,
+ * workspace and link members, file and git sources, and scopes served by
+ * another registry. See {@link npmLookupRegistry}. A package whose licence,
+ * description and repository the project or lockfile already supplied is left
+ * alone as well: the registry answers only what is still missing, and never
+ * overwrites a licence that is already set. The registry's licence is read
+ * with its legacy `licenses` field, and only a package for which neither the
+ * package nor the registry names one falls back to its repository's licence.
+ *
  * @param {Array} pkgList Package list
+ * @param {string} [registryUrl] Registry to query instead of NPM_URL
+ * @param {Object} [options] Options
+ * @param {Object} [options.npmrcConfig] Merged .npmrc configuration, used to
+ *   resolve a scope's own registry
+ * @param {boolean} [options.secureMode] Whether secure mode is on. Defaults to
+ *   the process-wide setting.
  */
-export declare function getNpmMetadata(pkgList: any[], registryUrl: any): Promise<any[]>;
+export declare function getNpmMetadata(pkgList: any[], registryUrl?: string, options?: {
+    npmrcConfig?: Object;
+    secureMode?: boolean;
+}): Promise<any[]>;
 /**
  * Method to locate local Gradle, Maven, or Coursier cache files for a given maven coordinate.
  *
@@ -29,15 +47,25 @@ export declare function getNpmMetadata(pkgList: any[], registryUrl: any): Promis
  */
 export declare function findLocalMvnArtifact(group: string, name: string, version: string): Object | null;
 /**
- * Method to retrieve metadata for maven packages by querying maven central
+ * Method to retrieve metadata for maven packages, from the local caches first
+ * and from Maven Central only for what remains.
+ *
+ * Every package is first enriched from data on disk. Only when license
+ * fetching is enabled (FETCH_LICENSE) or `force` is set are the packages
+ * still without a licence looked up remotely, and then only those a public
+ * repository can hold.
  *
  * @param {Array} pkgList Package list
  * @param {Object} jarNSMapping Jar Namespace mapping object
  * @param {Boolean} force Force fetching of license
+ * @param {{skipPurls?: Set<string>}} [context] Purls or bom-refs of the
+ *   project's own modules, which are never looked up remotely.
  *
  * @returns {Array} Updated package list
  */
-export declare function getMvnMetadata(pkgList: any[], jarNSMapping?: Object, force?: boolean): any[];
+export declare function getMvnMetadata(pkgList: any[], jarNSMapping?: Object, force?: boolean, context?: {
+    skipPurls?: Set<string>;
+}): any[];
 /**
  * Method to compose URL of pom.xml
  *
@@ -50,7 +78,10 @@ export declare function getMvnMetadata(pkgList: any[], jarNSMapping?: Object, fo
  */
 export declare function composePomXmlUrl({ urlPrefix, group, name, version }: string): string;
 /**
- * Method to fetch pom.xml data and parse it to JSON
+ * Method to fetch pom.xml data and parse it to JSON, merged with its parents.
+ *
+ * Each level is read from the local caches first. When a parent cannot be
+ * found, the child and any nearer parents are still returned.
  *
  * @param {String} urlPrefix
  * @param {String} group
@@ -61,7 +92,7 @@ export declare function composePomXmlUrl({ urlPrefix, group, name, version }: st
  */
 export declare function fetchPomXmlAsJson({ urlPrefix, group, name, version }: string): Object | undefined;
 /**
- * Method to fetch pom.xml data
+ * Method to fetch pom.xml data, from the local caches when present.
  *
  * @param {String} urlPrefix
  * @param {String} group
@@ -231,8 +262,9 @@ export declare function getGoPkgLicense(repoMetadata: Object): Promise<any>;
  *
  * @param {String} group Package group
  * @param {String} name Package name
+ * @param {String} [version] Package version, part of the page URL
  */
-export declare function getGoPkgVCSUrl(group: string, name: string): Promise<any>;
+export declare function getGoPkgVCSUrl(group: string, name: string, version?: string): Promise<any>;
 /**
  * Method to retrieve metadata for rust packages by querying crates
  *
@@ -243,7 +275,13 @@ export declare function getGoPkgVCSUrl(group: string, name: string): Promise<any
  *
  * What it does not hold is publisher identity, so a caller that needs the
  * publisher-drift and release-cadence signals — the predictive audit does —
- * passes `preferLocalCache: false` and takes the slower registry path.
+ * passes `preferLocalCache: false` and takes the slower registry path. That is
+ * also the only caller that needs the crate's owners, so the `/owners` request
+ * is made for it alone.
+ *
+ * Crates a public registry cannot hold are skipped: the project itself, path
+ * and git crates, and crates from an alternate registry. See
+ * {@link canCratesIoServe}.
  *
  * @param {Array} pkgList Package list
  * @param {Object} [options] Options
@@ -256,9 +294,20 @@ export declare function getCratesMetadata(pkgList: any[], options?: {
 /**
  * Method to retrieve metadata for dart packages by querying pub.dev
  *
+ * A hosted package whose lockfile names another registry is looked up there;
+ * the score endpoint that carries the licence tag is pub.dev's, so a private
+ * registry is asked only for the package document. In secure mode cdxgen does
+ * not contact a registry the scanned project names, so such a package is not
+ * looked up at all.
+ *
  * @param {Array} pkgList Package list
+ * @param {Object} [options] Options
+ * @param {boolean} [options.secureMode] Whether secure mode is on. Defaults to
+ *   the process-wide setting.
  */
-export declare function getDartMetadata(pkgList: any[]): Promise<any[]>;
+export declare function getDartMetadata(pkgList: any[], options?: {
+    secureMode?: boolean;
+}): Promise<any[]>;
 /**
  * Normalize a Cargo checksum/integrity string into canonical hex-prefixed form.
  *

package/types/lib/ecosystems/ecosystems.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ecosystems.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/ecosystems.js"],"names":[],"mappings":"AAkGA,eAAO,IAAI,cAAc,IAAK,CAAC;AAY/B;;;;GAIG;AACH,wBAAgB,mBAAmB,SAElC;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAH1C,MAAM,EAGoC,GAFxC,OAAO,CAAC,MAAM,EAAE,CAAC,CAmC7B;AAyBD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,OAAO,OAAA,EAAE,WAAW,KAAA,kBAiGxD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAL/B,MAK+B,EAAE,IAAI,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,MAAM,GAAC,IAAI,CAmIvB;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,OAAA,EACP,YAAY,GAPH,MAOQ,EACjB,KAAK,UAAQ,SA+Ed;AA4ND;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,UAGnE;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,GAF/D,MAAM,GAAC,SAAS,CA6B3B;AAgBD;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,GAFzD,OAAO,QAAQ,CAkB1B;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAF/C,MAAM,QAEyC,qBAUzD;AAED;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CAAC,EACpD,SAAS,EACT,KAAK,EACL,IAAI,EACJ,OAAO,GACR,QAAA,GAPW,OAAO,QAAQ,CAc1B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,OAAA,EAAE,iBAAiB,EAF7D,GAE6D,OAwBvE;AA6BD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,OAAA,EAAE,aAAa,SAAA,kBA8PzD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAJjC,MAIiC,EAAE,WAAW,GAH9C,MAG0D;;;;;;;;IAiIpE;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAHzC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAGH,GAFvC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAJtC,MAIsC,EAAE,UAAU,EAHlD,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAGD,GAFhD,IAAI,CAuBhB;AAiBD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,YAAY,EAH5C,MAG4C,GAF3C,SAAO,SAAS,CAqB3B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,QAAA,GAF7B,QAAQ,CAQnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,QAAA,EAAE,YAAY,EAHzC,MAGyC,GAFxC,SAAO,SAAS,CAc3B;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAJxC,KAAK,CAAC,MAAM,GAAC,SAAS,CAIkB,GAFtC,OAAO,CAAC,IAAI,CAAC,CAqCzB;AAED;;GAEG;AACH,wBAAgB,wBAAwB,SAEvC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,OAAO,EALjC,MAKiC,EAAE,YAAY,AAJvD,CACA,EADQ,MAI+C,GAH7C,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CAkExE;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAJxC,KAAK,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,CAIG,GAFtC,OAAO,CAAC,IAAI,CAAC,CAwCzB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,SAEjC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,YAAY,EAFvC,MAEuC,gBA2CjD;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,KAAK,QAAA,EAAE,IAAI,QAAA,gBAsB/C;AA2CD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,OAAA,EAAE,OAAO,AAJrD,CAGF,EAFE;IAA0B,gBAAgB,AAA1C,CAEF,EAFU,OAAO,CAEjB;CAC4D,kBAiJ5D;AAkFD;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,OAAO,OAAA,kBAiE5C;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAHtC,MAGsC,GAFpC,MAAM,GAAC,SAAS,CA6B5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EANpC,MAMoC,EAAE,OAAO,EAL7C,MAK6C,EAAE,YAAY,GAJ3D,MAIgE,kBAyY1E;AAiND;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,OAAA,EAAE,YAAY,QAAY;;;GA2KvE"}
+{"version":3,"file":"ecosystems.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/ecosystems.js"],"names":[],"mappings":"AAiHA;;;;;GAKG;AACH,eAAO,MAAM,cAAc,IAAK,CAAC;AAqDjC;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAH1C,MAAM,EAGoC,GAFxC,OAAO,CAAC,MAAM,EAAE,CAAC,CAmC7B;AA8LD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,cAAc,CAAC,OAAO,OAAA,EAAE,WAAW,AAPtD,CACA,EADQ,MAO8C,EAAE,OAAO,AAN/D,CAKF,EAJE;IAAyB,WAAW,AAApC,CAEA,EAFQ,MAAM,CAEd;IAA0B,UAAU,AAApC,CAEF,EAFU,OAAO,CAEjB;CACsE,kBAgItE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAL/B,MAK+B,EAAE,IAAI,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,MAAM,GAAC,IAAI,CAYvB;AAscD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,cAAc,CAClC,OAAO,OAAA,EACP,YAAY,GATH,MASQ,EACjB,KAAK,UAAQ,EACb,OAAO,AATN,CAGA,EAHQ;IAAC,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CASrB,SAkHb;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,UAGnE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,GAF/D,MAAM,GAAC,SAAS,CAa3B;AA+DD;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,GAFzD,OAAO,QAAQ,CAY1B;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAF/C,MAAM,QAEyC,qBAUzD;AAED;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CAAC,EACpD,SAAS,EACT,KAAK,EACL,IAAI,EACJ,OAAO,GACR,QAAA,GAPW,OAAO,QAAQ,CAW1B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,OAAA,EAAE,iBAAiB,EAF7D,GAE6D,OAwBvE;AAwHD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,OAAA,EAAE,aAAa,SAAA,kBA6QzD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAJjC,MAIiC,EAAE,WAAW,GAH9C,MAG0D;;;;;;;;IAiIpE;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAHzC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAGH,GAFvC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAJtC,MAIsC,EAAE,UAAU,EAHlD,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAGD,GAFhD,IAAI,CAuBhB;AAiBD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,YAAY,EAH5C,MAG4C,GAF3C,SAAO,SAAS,CAqB3B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,QAAA,GAF7B,QAAQ,CAQnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,QAAA,EAAE,YAAY,EAHzC,MAGyC,GAFxC,SAAO,SAAS,CAc3B;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAJxC,KAAK,CAAC,MAAM,GAAC,SAAS,CAIkB,GAFtC,OAAO,CAAC,IAAI,CAAC,CAoDzB;AAED;;GAEG;AACH,wBAAgB,wBAAwB,SAEvC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,OAAO,EALjC,MAKiC,EAAE,YAAY,AAJvD,CACA,EADQ,MAI+C,GAH7C,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CAgExE;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAJxC,KAAK,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,CAIG,GAFtC,OAAO,CAAC,IAAI,CAAC,CAiDzB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,SAEjC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,YAAY,EAFvC,MAEuC,gBAiDjD;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,KAAK,QAAA,EAAE,IAAI,QAAA,EAAE,OAAO,AAFtD,CACF,QACwD,gBA6BxD;AAiND;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,OAAA,EAAE,OAAO,AAJrD,CAGF,EAFE;IAA0B,gBAAgB,AAA1C,CAEF,EAFU,OAAO,CAEjB;CAC4D,kBAmK5D;AA8GD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CAAC,OAAO,OAAA,EAAE,OAAO,AAJnD,CAGF,EAFE;IAA0B,UAAU,AAApC,CAEF,EAFU,OAAO,CAEjB;CAC0D,kBAwF1D;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAHtC,MAGsC,GAFpC,MAAM,GAAC,SAAS,CA6B5B;AAwDD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EANpC,MAMoC,EAAE,OAAO,EAL7C,MAK6C,EAAE,YAAY,GAJ3D,MAIgE,kBAoe1E;AAkbD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,OAAA,EAAE,YAAY,QAAY;;;GA4IvE"}

package/types/lib/ecosystems/golem.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"golem.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/golem.js"],"names":[],"mappings":"AAyjDA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAJ/B,MAI+B,GAH7B,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,UAAU,EAJrC,MAIqC,EAAE,OAAO,AAHtD,CACA,EADQ,MAGmD,GAFjD,OAAO,CAmDnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,EAAE,OAAO,AAH7C,CACA,EADQ,MAG0C,GAFxC,MAAM,GAAC,SAAS,CA2B5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,AAL7C,CACA,EADQ,MAK0C,EAAE,UAAU,AAJ9D,CACA,EADQ,KAAK,CAAC,MAAM,CAI+C,GAHzD;IAAC,sBAAsB,2BAAgC;IAAC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,mBAAmB,0BAA0B;IAAC,cAAc,wBAAwB;IAAC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,eAAe,wBAAuB;CAAC,CAsFpQ"}
+{"version":3,"file":"golem.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/golem.js"],"names":[],"mappings":"AAgkDA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAJ/B,MAI+B,GAH7B,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,UAAU,EAJrC,MAIqC,EAAE,OAAO,AAHtD,CACA,EADQ,MAGmD,GAFjD,OAAO,CA4DnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,EAAE,OAAO,AAH7C,CACA,EADQ,MAG0C,GAFxC,MAAM,GAAC,SAAS,CA2B5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,AAL7C,CACA,EADQ,MAK0C,EAAE,UAAU,AAJ9D,CACA,EADQ,KAAK,CAAC,MAAM,CAI+C,GAHzD;IAAC,sBAAsB,2BAAgC;IAAC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,mBAAmB,0BAA0B;IAAC,cAAc,wBAAwB;IAAC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,eAAe,wBAAuB;CAAC,CAsFpQ"}

package/types/lib/ecosystems/gradleutils.d.ts

@@ -25,6 +25,18 @@ export declare function buildGradleCommandArguments(gradleArguments: string[], g
 /**
  * Method to split the output produced by Gradle using parallel processing by project
  *
+ * Gradle groups console output by task and prints a `> Task :path` header
+ * before each group, repeating it whenever a task's output resumes after
+ * another task's. Each group is therefore keyed by the project in its own
+ * header (`> Task :app:dependencies` belongs to `:app`), never by whatever
+ * report header happened to precede it, and the groups of one project are
+ * concatenated in order, so reordering or interrupting the task reports cannot
+ * move a report to another project or overwrite one (issue 4465). The groups
+ * of a root task (`:dependencies`) all take the root project's name from the
+ * `Root project '…'` header that only a root task prints, so a continuation
+ * group, which carries no report header, stays with the rest of the root
+ * report. The groups of other tasks are dropped along with their headers.
+ *
  * @param {string} rawOutput Full output produced by Gradle using parallel processing
  * @param {string[]} relevantTasks The list of gradle tasks whose output need to be considered.
  * @returns {map} Map with subProject names as keys and corresponding dependency task outputs as values.
@@ -173,6 +185,44 @@ _includeCacheDir?: boolean): Promise<Object>;
  * @param {Object} [options] CLI options (`installDeps` gates wrapper use)
  */
 export declare function getMillCommand(srcPath: string, options?: Object): string;
+/**
+ * Determine the Mill version of a build.
+ *
+ * The version is read from the `.mill-version` file, from the
+ * `//| mill-version:` header of the build file, or from the launcher itself.
+ *
+ * @param {string} millRootPath Root of the Mill build
+ * @param {string} millCmd Mill command to use for the fallback probe
+ * @returns {string|null} The Mill version, or null when it cannot be determined
+ */
+export declare function getMillVersion(millRootPath: string, millCmd: string): string | null;
+/**
+ * Find the Mill daemons running under a tree.
+ *
+ * Daemons record their process id in `out/mill-daemon*` (Mill 1.x) or
+ * `out/mill-server*` directories, directly or one level below (Mill 0.12
+ * keeps one subdirectory per server). Only processes that are still alive
+ * are returned.
+ *
+ * @param {string} rootPath Tree to search
+ * @returns {Map<string, Set<number>>} Live daemon process ids by the root of
+ *   the build they belong to
+ */
+export declare function findMillDaemons(rootPath: string): Map<string, Set<number>>;
+/**
+ * Stop the Mill daemons that started under the scanned tree during the scan.
+ *
+ * cdxgen's own Mill calls run with --no-server, but a project build cdxgen
+ * runs can shell out to Mill without it and leave a daemon behind. Daemons
+ * that were already running when the scan started belong to the user, for
+ * example to an IDE, and are left alone; every other live daemon is shut
+ * down through the launcher of the build it belongs to.
+ *
+ * @param {string} rootPath Scanned tree
+ * @param {Map<string, Set<number>>} [runningBefore] Result of
+ *   {@link findMillDaemons} taken before the scan
+ */
+export declare function stopMillDaemons(rootPath: string, runningBefore?: Map<string, Set<number>>): void;
 /**
  * Method to return the maven command to use.
  *