@cdxgen/cdxgen 13.3.0 → 13.4.0

package/types/lib/helpers/bomSigner.d.ts

@@ -1,4 +1,16 @@
 import crypto from "node:crypto";
+/**
+ * Largest number of entries accepted in a `signers` or `chain` signature.
+ * Every entry is checked against the whole signed object, so the bound keeps
+ * the cost of verifying a document proportional to its size.
+ */
+export declare const MAX_SIGNATURE_ENTRIES = 32;
+/**
+ * Members the CycloneDX 1.4 to 1.7 and 2.0 schemas define at the root of a
+ * BOM. A root signature is only accepted on an object made of these members,
+ * so a signed component, service, or annotation cannot pass as a signed BOM.
+ */
+export declare const BOM_ROOT_MEMBERS: readonly string[];
 /**
  * Renders a value taken from a document for a message. JSON can make any field
  * an object or array, and interpolating those directly can throw.
@@ -49,11 +61,18 @@ export declare function generateSigningKeyPair(algorithm: string): {
  * skipped by default, because changing them would invalidate the existing root
  * signature; explicitly requesting nested signing in that case is an error.
  *
+ * The BOM root must carry `bomFormat` (or `specFormat`) and `specVersion`, and
+ * only members that CycloneDX defines at the root. A nested element that
+ * carries `bomFormat`, `specFormat`, or `specVersion` is refused. Verification
+ * rejects signatures over either shape.
+ *
  * @param {Object} bomJson - CycloneDX BOM Object
  * @param {Object} options - Signing options
  * @param {string|Buffer|Object|crypto.KeyObject} options.privateKey - Private key (PEM or KeyObject), or the shared secret for HS* algorithms
  * @param {string} [options.algorithm] - JSF algorithm identifier (default RS512). It must match the key type.
  * @param {Object} [options.publicKeyJwk] - JWK of the signing key's public key to embed
+ * @param {boolean} [options.embedPublicKey] - Embed the public key derived from the signing key when publicKeyJwk is not given. Ignored for HS* algorithms and for keys without a JWK form, such as rsa-pss.
+ * @param {boolean} [options.embedPublicKeyNested] - Also embed the public key in nested signatures (default true)
  * @param {string} [options.keyId] - Key ID to embed
  * @param {string} [options.mode] - 'replace' (default), 'signers', or 'chain'
  * @param {boolean} [options.signComponents] - Sign each component
@@ -65,6 +84,8 @@ export declare function signBom(bomJson: Object, options?: {
     privateKey: string | Buffer | Object | crypto.KeyObject;
     algorithm?: string;
     publicKeyJwk?: Object;
+    embedPublicKey?: boolean;
+    embedPublicKeyNested?: boolean;
     keyId?: string;
     mode?: string;
     signComponents?: boolean;
@@ -80,6 +101,9 @@ export declare function signBom(bomJson: Object, options?: {
  * embedded publicKey (if any) is the verification key, and its value covers the
  * node content plus the signature metadata as JSF defines.
  *
+ * This checks one object only. To verify a BOM, use {@link verifyBomSignatures}
+ * or {@link verifyBom}, which also require the signed root to be a BOM.
+ *
  * @param {Object} node - The BOM or granular object to verify
  * @param {string|Buffer|Object|crypto.KeyObject} publicKey - Verification key. Strings and Buffers are parsed as public keys; use loadSharedSecret() for HMAC.
  * @param {Object} [options]
@@ -89,10 +113,62 @@ export declare function signBom(bomJson: Object, options?: {
 export declare function verifyNode(node: Object, publicKey: string | Buffer | Object | crypto.KeyObject, options?: {
     reasons?: string[];
 }): boolean | Object;
+/**
+ * Verifies the signatures of a BOM against one or more trusted keys and reports
+ * the outcome for every signature entry.
+ *
+ * The BOM verifies when:
+ * - its root carries `bomFormat` (or `specFormat`) "CycloneDX" and
+ *   `specVersion`, and only members that CycloneDX defines at the root of a BOM;
+ * - its root signature verifies, meaning at least one entry verifies with one
+ *   of the keys. With `requireAll`, every entry must verify with one of the
+ *   keys, and every key must verify at least one entry;
+ * - with `deep`, every signed component, service, and annotation verifies the
+ *   same way and carries none of `bomFormat`, `specFormat`, and `specVersion`.
+ *
+ * A BOM without a root signature fails unless `allowNestedOnly` is set. Then
+ * every component, service, and annotation must carry a signature that
+ * verifies, and `notices` lists the members that no signature covers.
+ *
+ * Parse untrusted BOM text with `parseStrictJson()` from
+ * `lib/parsers/strictJson.js` before calling this function, so that the
+ * verified values are the values every JSON parser reads.
+ *
+ * @param {Object} bom - CycloneDX BOM Object
+ * @param {Array<string|Buffer|Object|crypto.KeyObject>|string|Buffer|Object|crypto.KeyObject} keys - Trusted verification keys (see verifyNode)
+ * @param {Object} [options]
+ * @param {boolean} [options.deep] - Also verify nested signatures (default true)
+ * @param {boolean} [options.allowNestedOnly] - Accept a BOM without a root signature when every nested element is signed
+ * @param {boolean} [options.requireAll] - Require every entry of each signature to verify, and every key to verify an entry of the root signature
+ * @returns {{ verified: boolean, errors: string[], notices: string[], root: Object|null, nested: Object[] }}
+ *   `root` and each `nested` item hold `label`, `form`, `verified`, `match` (the first verified entry),
+ *   `reasons` (why the signature could not be read), `entries` (`index`, `algorithm`, `keyId`, `verified`, `reasons`),
+ *   and `keysMatched` (whether each key verified an entry).
+ */
+export declare function verifyBomSignatures(bom: Object, keys: Array<string | Buffer | Object | crypto.KeyObject> | string | Buffer | Object | crypto.KeyObject, options?: {
+    deep?: boolean;
+    allowNestedOnly?: boolean;
+    requireAll?: boolean;
+}): {
+    verified: boolean;
+    errors: string[];
+    notices: string[];
+    root: Object | null;
+    nested: Object[];
+};
+/**
+ * Flattens a {@link verifyBomSignatures} report into the reasons it did not
+ * verify: policy errors first, then each rejected root entry, then each
+ * rejected nested entry prefixed with the element it belongs to.
+ *
+ * @param {Object} report - Result of verifyBomSignatures
+ * @returns {string[]} - Reasons, empty when the report verified
+ */
+export declare function signatureReportReasons(report: Object): string[];
 /**
  * Verifies a BOM's top-level signature, as well as nested components, services,
- * and annotations. Returns the root match only if the root signature is valid
- * AND every signed nested element is valid for the same key.
+ * and annotations, with one key. Returns the root match only if the BOM verifies
+ * as {@link verifyBomSignatures} defines with `deep` enabled.
  *
  * @param {Object} bom - CycloneDX BOM Object
  * @param {string|Buffer|Object|crypto.KeyObject} publicKey - Verification key (see verifyNode)
@@ -104,8 +180,8 @@ export declare function verifyBom(bom: Object, publicKey: string | Buffer | Obje
  * Checks every signature entry of a node against a set of trusted keys. An
  * entry is verified when one of the keys verifies that entry.
  *
- * `cdx-sign` uses this before appending to a signature chain, because the new
- * chain entry vouches for every earlier entry.
+ * `cdx-sign` uses this before appending a `signers` or `chain` entry, to check
+ * that the content still carries the earlier signatures.
  *
  * @param {Object} node - The BOM or granular object whose signature is checked
  * @param {Array<string|Buffer|Object|crypto.KeyObject>} [keys] - Trusted verification keys (see verifyNode)

package/types/lib/helpers/bomSigner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bomSigner.d.ts","sourceRoot":"","sources":["../../../lib/helpers/bomSigner.js"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAuCjC;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAHvB,GAGuB,GAFrB,MAAM,CAWlB;AAgID;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAH9B,MAAM,GAAC,MAAM,GAAC,MAAM,CAAC,SAGS,GAF5B,MAAM,CAAC,SAAS,CA2B5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAH5B,MAAM,GAAC,MAAM,GAAC,MAAM,GAAC,MAAM,CAAC,SAGA,GAF1B,MAAM,CAAC,SAAS,CAW5B;AAwBD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAHrC,MAGqC,GAFnC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CA2BrD;AA+ND;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAZpB,MAYoB,EAAE,OAAO,GAVrC;IAAuD,UAAU,EAAzD,MAAM,GAAC,MAAM,GAAC,MAAM,GAAC,MAAM,CAAC,SAAS,CAC7C;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;IAAyB,KAAK,AAA9B,CACA,EADQ,MAAM,CACd;IAAyB,IAAI,AAA7B,CACA,EADQ,MAAM,CACd;IAA0B,cAAc,AAAxC,CACA,EADQ,OAAO,CACf;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;IAA0B,eAAe,AAAzC,CACA,EADQ,OAAO,CACf;CAE0C,GAFhC,MAAM,CA+DlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CAAC,IAAI,EANpB,MAMoB,EAAE,SAAS,EAL/B,MAAM,GAAC,MAAM,GAAC,MAAM,GAAC,MAAM,CAAC,SAKG,EAAE,OAAO,AAJhD,CAEA,EADA;IAA2B,OAAO,AAAlC,CACA,EADQ,MAAM,EAAE,CAChB;CAEqD,GAF3C,OAAO,GAAC,MAAM,CA8B1B;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,GAAG,EALlB,MAKkB,EAAE,SAAS,EAJ7B,MAAM,GAAC,MAAM,GAAC,MAAM,GAAC,MAAM,CAAC,SAIC,EAAE,OAAO,AAH9C,CACA,EADQ,MAG2C,GAFzC,OAAO,GAAC,MAAM,CAiC1B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAJ/B,MAI+B,EAAE,IAAI,AAH7C,CACA,EADQ,KAAK,CAAC,MAAM,GAAC,MAAM,GAAC,MAAM,GAAC,MAAM,CAAC,SAAS,CAGD,GAFxC,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA2CtG"}
+{"version":3,"file":"bomSigner.d.ts","sourceRoot":"","sources":["../../../lib/helpers/bomSigner.js"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAyDjC;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,mBAqB3B,CAAC;AAmBH;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAHvB,GAGuB,GAFrB,MAAM,CAWlB;AA+LD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAH9B,MAAM,GAAC,MAAM,GAAC,MAAM,CAAC,SAGS,GAF5B,MAAM,CAAC,SAAS,CA2B5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAH5B,MAAM,GAAC,MAAM,GAAC,MAAM,GAAC,MAAM,CAAC,SAGA,GAF1B,MAAM,CAAC,SAAS,CAW5B;AAwBD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAHrC,MAGqC,GAFnC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CA2BrD;AAmYD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAdpB,MAcoB,EAAE,OAAO,GAZrC;IAAuD,UAAU,EAAzD,MAAM,GAAC,MAAM,GAAC,MAAM,GAAC,MAAM,CAAC,SAAS,CAC7C;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;IAA0B,cAAc,AAAxC,CACA,EADQ,OAAO,CACf;IAA0B,oBAAoB,AAA9C,CACA,EADQ,OAAO,CACf;IAAyB,KAAK,AAA9B,CACA,EADQ,MAAM,CACd;IAAyB,IAAI,AAA7B,CACA,EADQ,MAAM,CACd;IAA0B,cAAc,AAAxC,CACA,EADQ,OAAO,CACf;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;IAA0B,eAAe,AAAzC,CACA,EADQ,OAAO,CACf;CAE0C,GAFhC,MAAM,CA4FlB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,UAAU,CAAC,IAAI,EANpB,MAMoB,EAAE,SAAS,EAL/B,MAAM,GAAC,MAAM,GAAC,MAAM,GAAC,MAAM,CAAC,SAKG,EAAE,OAAO,AAJhD,CAEA,EADA;IAA2B,OAAO,AAAlC,CACA,EADQ,MAAM,EAAE,CAChB;CAEqD,GAF3C,OAAO,GAAC,MAAM,CAe1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAX5B,MAW4B,EAAE,IAAI,EAVlC,KAAK,CAAC,MAAM,GAAC,MAAM,GAAC,MAAM,GAAC,MAAM,CAAC,SAAS,CAAC,GAAC,MAAM,GAAC,MAAM,GAAC,MAAM,GAAC,MAAM,CAAC,SAUvC,EAAE,OAAO,AATnD,CAIA,EAHA;IAA0B,IAAI,AAA9B,CACA,EADQ,OAAO,CACf;IAA0B,eAAe,AAAzC,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;CAKwD,GAL9C;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAqH3G;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAHlC,MAGkC,GAFhC,MAAM,EAAE,CAepB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,GAAG,EALlB,MAKkB,EAAE,SAAS,EAJ7B,MAAM,GAAC,MAAM,GAAC,MAAM,GAAC,MAAM,CAAC,SAIC,EAAE,OAAO,AAH9C,CACA,EADQ,MAG2C,GAFzC,OAAO,GAAC,MAAM,CAc1B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAJ/B,MAI+B,EAAE,IAAI,AAH7C,CACA,EADQ,KAAK,CAAC,MAAM,GAAC,MAAM,GAAC,MAAM,GAAC,MAAM,CAAC,SAAS,CAGD,GAFxC,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAoBtG"}

package/types/lib/inventory/aiCollector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aiCollector.d.ts","sourceRoot":"","sources":["../../../lib/inventory/aiCollector.js"],"names":[],"mappings":"AAo8DA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAJvC,MAIuC,EAAE,OAAO,AAHxD,CACA,EADQ,MAGqD,GAFnD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CA2YhF;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAAC,aAAa,EAJpD,MAIoD,EAAE,OAAO,AAHrE,CACA,EADQ,MAGkE,GAFhE;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAiMhF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,aAAa,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,aAAa,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,aAAa,EAJjD,MAIiD,EAAE,OAAO,AAHlE,CACA,EADQ,MAG+D,GAF7D;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF"}
+{"version":3,"file":"aiCollector.d.ts","sourceRoot":"","sources":["../../../lib/inventory/aiCollector.js"],"names":[],"mappings":"AAu8DA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAJvC,MAIuC,EAAE,OAAO,AAHxD,CACA,EADQ,MAGqD,GAFnD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CA2YhF;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAAC,aAAa,EAJpD,MAIoD,EAAE,OAAO,AAHrE,CACA,EADQ,MAGkE,GAFhE;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAiMhF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,aAAa,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,aAAa,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,aAAa,EAJjD,MAIiD,EAAE,OAAO,AAHlE,CACA,EADQ,MAG+D,GAF7D;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF"}

package/types/lib/inventory/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../../../lib/inventory/analyzer.js"],"names":[],"mappings":"AA2sDA;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAJ3B,MAAM,QACN,MAAM,KACJ;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAO7C,CAAC;AAoqBF;;;GAGG;AACH,eAAO,MAAM,wCAAwC,UAQpD,CAAC;AA4JF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,UAQpC,CAAC;AA+JF;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAHrC,MAGqC,GAFnC;IAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAC,CA2J/H;AA2hBD;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;EAuGhC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,aAHzB,MAAM,KACJ;IAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,qBAAqB,EAAE,MAAM,EAAE,CAAA;CAe9H,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAHvC,MAGuC,GAFrC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,2BAA0B;CAAC,CAqOnJ;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,aAH3B,MAAM,KACJ;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,2BAA0B;CAAC,GAAC,SAgBpJ,CAAC;AAyQF;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAHjC,MAGiC,GAF/B;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,CA2avD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,aAHrB,MAAM,KACJ;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAUxD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,QAJzB,MAAM,SACN,OAAO,KACL,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,CAiC/D,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,QAN7B,MAAM,SACN,OAAO,KACL;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,2BAA0B;CAuGzE,CAAC;AAg9BF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,QAJ1B,MAAM,SACN,OAAO,KACL;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAiJ7E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,QAJpB,MAAM,SACN,OAAO,KACL;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAqrB7E,CAAC"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../../../lib/inventory/analyzer.js"],"names":[],"mappings":"AA6vDA;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAJ3B,MAAM,QACN,MAAM,KACJ;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAO7C,CAAC;AAmpBF;;;GAGG;AACH,eAAO,MAAM,wCAAwC,UAQpD,CAAC;AA4JF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,UAQpC,CAAC;AA+JF;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAHrC,MAGqC,GAFnC;IAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAC,CA2J/H;AA2hBD;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;EAsGhC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,aAHzB,MAAM,KACJ;IAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,qBAAqB,EAAE,MAAM,EAAE,CAAA;CAe9H,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAHvC,MAGuC,GAFrC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,2BAA0B;CAAC,CAqOnJ;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,aAH3B,MAAM,KACJ;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,2BAA0B;CAAC,GAAC,SAgBpJ,CAAC;AAyQF;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAHjC,MAGiC,GAF/B;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,CA2avD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,aAHrB,MAAM,KACJ;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAUxD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,QAJzB,MAAM,SACN,OAAO,KACL,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,CAgC/D,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,QAN7B,MAAM,SACN,OAAO,KACL;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,2BAA0B;CA+EzE,CAAC;AAg9BF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,QAJ1B,MAAM,SACN,OAAO,KACL;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAiJ7E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,QAJpB,MAAM,SACN,OAAO,KACL;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CA6pB7E,CAAC"}

package/types/lib/inventory/atomUtils.d.ts

@@ -9,9 +9,12 @@ export declare const ATOM_NATIVE_PACKAGES: Set<string>;
  * language its build uses.
  *
  * An explicit `options.compileCommands` (a file, or a directory holding one
- * directly or under `build/`) wins. Otherwise the scan root, `build/`, `out/`,
- * `builddir/`, `cmake-build-*` and the directory of `options.cmakeCache` are
- * searched. A database can come with the code it describes, and atom asks the
+ * directly or under `build/`) wins. Otherwise the scan root and the project's
+ * build directories are searched: the directory of `options.cmakeCache`, the
+ * build directories of its CMake presets, and the conventional `build`,
+ * `out`, `builddir` and `cmake-build-` directories (see
+ * `cmakeBuildDirCandidates`). A database can come with the code it describes,
+ * and atom asks the
  * GCC or Clang driver it names (from the PATH, or an absolute path outside
  * the project) for its predefined macros, so in secure mode only an explicit
  * database is used.
@@ -132,20 +135,39 @@ export declare function resolveAtomProvider(opts?: {
  * ceiling differently, and a native-image runtime option on a jar run reaches
  * atom as an unknown argument that fails every slice. So the kind follows what
  * is installed where cdxgen can see it: the native binary means native, the jar
- * package without it means jar. With neither in view (a custom `ATOM_CMD`, an
- * install elsewhere) the platform's kind stands.
+ * package without it means jar. An `ATOM_CMD` is classified by what it names
+ * (see `atomCommandKind`). With nothing in view (an install elsewhere) the
+ * platform's kind stands.
  *
  * Also used to gate Java/JDK advice, so users on the five native platforms are
  * not told to install a JDK for a failure that has nothing to do with Java.
  */
 export declare function atomProviderKind(): "jar" | "native";
+/**
+ * Whether `ATOM_CMD` launches a jar or follows the platform.
+ *
+ * The jar launchers (`plugins/bin/atom`, `plugins/bin/atom.bat`) sit next to a
+ * `plugins/lib` directory holding atom's jars, so a launcher with that sibling,
+ * or any `.bat` (only the jar payload ships one), runs on the JVM whatever the
+ * platform is. Everything else, including the npm dispatcher (`node
+ * .../index.js`, its `atom`/`atom.cmd` bin shims) and a native binary, follows
+ * the platform's kind. A GraalVM `-XX:` heap argument handed to a jar launcher
+ * is rejected by atom's option parser before any analysis starts, and a
+ * `JAVA_TOOL_OPTIONS` ceiling handed to a native image is silently ignored, so
+ * the distinction decides whether the heap is bounded at all.
+ *
+ * @param {string} command The `ATOM_CMD` value
+ * @param {"native"|"jar"} platformKind Kind the platform prefers
+ * @returns {"native"|"jar"}
+ */
+export declare function atomCommandKind(command: string, platformKind: "native" | "jar"): "native" | "jar";
 /**
  * Locate the `php-parse` binary that the PHP frontend needs.
  *
  * atom 3's dispatcher unconditionally sets `PHP_PARSER_BIN=<ATOM_HOME>/bin/php-parse`,
  * which for a native sub-package does not exist and also clobbers a caller-set
- * value. cdxgen therefore resolves the real location and forwards it through
- * the child env (see `buildAtomCommandEnv`); `executeAtom` then spawns the
+ * value. cdxgen therefore resolves the real location and forwards it through the
+ * child env (see `buildAtomCommandEnv`); `executeAtom` then spawns the
  * native binary directly for PHP so the dispatcher cannot clobber it (see
  * `resolveDirectAtomBinaryPath`). Resolution order:
  *   1. explicit `PHP_PARSER_BIN` env var (operators / container images)
@@ -159,6 +181,35 @@ export declare function atomProviderKind(): "jar" | "native";
  * @returns {string|undefined}
  */
 export declare function resolvePhpParseBin(): string | undefined;
+/**
+ * Locate the `phpastgen` generator that lets the PHP frontend parse whole
+ * directories in one batch.
+ *
+ * `php-parse` (forwarded as `PHP_PARSER_BIN`) is the per-file parser: atom
+ * starts a php interpreter for every `.php` file, which on windows turns a
+ * vendored PHP project (thousands of files under `vendor/`) into an hours-long
+ * run that no timeout can rescue. `phpastgen` answers the `--parser-info`
+ * capability probe, so atom's batch path engages, and atom-parsetools 1.9 and
+ * later parse the whole tree, vendor included, with a few interpreters that
+ * each take a chunk of files. It is a Node script, so the frontend launches it
+ * with `node` rather than `php`; an atom that does not know `PHP_ASTGEN_BIN`
+ * simply ignores it and keeps today's per-file behaviour. Resolution order:
+ *   1. explicit `PHP_ASTGEN_BIN` env var (operators / container images)
+ *   2. `@appthreat/atom-parsetools/phpastgen.js` under cdxgen's own
+ *      node_modules, then under `GLOBAL_NODE_MODULES_PATH` for global installs
+ *
+ * @returns {string|undefined}
+ */
+export declare function resolvePhpAstgenBin(): string | undefined;
+/**
+ * Resolve a file inside the installed `@appthreat/atom-parsetools` package,
+ * searching cdxgen's own node_modules and `GLOBAL_NODE_MODULES_PATH` for global
+ * installs.
+ *
+ * @param {...string} segments Path segments below the package root
+ * @returns {string|undefined}
+ */
+export declare function parsetoolsFile(...segments: string[]): string | undefined;
 /**
  * Resolve the atom native binary path directly, bypassing the dispatcher.
  *
@@ -216,14 +267,35 @@ export declare function atomTimeouts(): {
     atomTimeoutMs: number;
     spawnTimeoutMs: number;
 };
+/**
+ * Reap everything a timed-out atom run left behind on Windows.
+ *
+ * cdxgen starts atom through a shell there (`shell: isWin`), so the spawn
+ * timeout terminates only that `cmd.exe`, and the runtime and every parser
+ * worker under it (one `php.exe` per file for the per-file PHP frontend) keep
+ * running against the next slice of the same run. See
+ * {@link reapProcessTree} for how they are found. A chain broken by an
+ * intermediate that already exited (the npm dispatcher stopping its runtime
+ * itself) cannot be followed, and atom 4 stops its helpers once
+ * `ATOM_PARENT_PID` is gone.
+ *
+ * @param {number|undefined} rootPid pid of the process cdxgen spawned
+ * @param {number} startedAt Epoch milliseconds at which the run started
+ * @param {number} [endedAt] Epoch milliseconds at which the spawned process ended
+ * @returns {number[]} The pids that were stopped
+ */
+export declare function reapAtomProcessTree(rootPid: number | undefined, startedAt: number, endedAt?: number): number[];
 /**
  * Whether an atom run ended because it ran out of time.
  *
  * The dispatcher reports its own limit with status 124. cdxgen's spawn timeout
  * shows up as `ETIMEDOUT`. A dispatcher older than the status code stops atom
- * with SIGTERM and exits 1, so status 1 at or past the limit counts as well,
- * unless atom's own output shows it failed for another reason first (an
- * exhausted heap, a crash), which deserves its own diagnosis.
+ * with SIGTERM and passes on how the runtime ended: 1, or the runtime's own
+ * exit on SIGTERM (143) or SIGKILL (137), which is what atom 3.1 reports. Those
+ * statuses at or past the limit count as well, unless atom's own output shows
+ * it failed for another reason first (an exhausted heap, a crash), which
+ * deserves its own diagnosis. Missing one leaves the half-written atom behind,
+ * and the next slice of the run fails to load it.
  *
  * @param {Object} result spawnSync result
  * @param {number} elapsedMs How long the run took

package/types/lib/inventory/atomUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"atomUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/atomUtils.js"],"names":[],"mappings":"AAyDA;;;GAGG;AACH,eAAO,MAAM,oBAAoB,aAM/B,CAAC;AA8CH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,EAAE,OAAO,GAHrC,MAG0C,GAFxC,MAAM,GAAC,SAAS,CA0D5B;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAwBtC;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,GAAG,CAAC,MAAM,CAAC,CAwCvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,QAAQ,EAJ1C,MAI0C,EAAE,OAAO,GAHnD,MAGwD,GAFtD,MAAM,EAAE,CAiCpB;AA0RD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,GAH3C,MAAM,EAG0C,GAF9C,MAAM,GAAC,SAAS,CAU5B;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAJ1C,MAI0C,EAAE,QAAQ,AAH5D,CACA,EADQ,MAAM,EAGmD,GAFvD,OAAO,CAkBnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAAC,SAAS,EAJhD,MAAM,QAI0C,EAAE,QAAQ,AAHlE,CACA,EADQ,MAAM,EAGyD,GAF7D,MAAM,QAAM,CA2DxB;AA4BD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAJhC,MAIqC,EAAE,QAAQ,GAH/C,MAGoD,GAFlD,MAAM,CAkDlB;AAgBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,AANrC,CAIA,EAHA;IAAsB,QAAQ,AAA9B,CACA,EADQ,MAAM,CACd;IAAsB,IAAI,AAA1B,CACA,EADQ,MAAM,CACd;IAAsB,IAAI,AAA1B,CACA,EADQ,MAAM,CACd;CAE0C,GAFhC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,GAAC,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,CA6CvG;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,qBAkB/B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,IAFrB,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,IAF9B,MAAM,GAAC,SAAS,CAgB5B;AAmED;;GAEG;AACH,wBAAgB,cAAc,QAwB7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,GAAC,SAAS,CA0B5B;AAgED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,IAFf;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAC,CAkB3D;AAaD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAL3B,MAK2B,EAAE,SAAS,EAJtC,MAIsC,EAAE,aAAa,EAHrD,MAGqD,GAFnD,OAAO,CAcnB;AAUD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,GAAG,EALpB,MAKoB,EAAE,IAAI,EAJ1B,MAAM,EAIoB,EAAE,SAAS,GAHrC,MAG0C,GAFxC,OAAO,CAwKnB;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAHpC,MAGoC,GAFlC,MAAM,EAAE,CAwBpB;AAcD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAF1C,MAE0C,QAQpD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAJ9B,MAI8B,EAAE,SAAS,EAHzC,MAGyC,GAFvC,GAAC,CAcb;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAHpC,MAGoC,GAFlC,MAAM,EAAE,GAAC,MAAM,GAAC,SAAS,CAwBrC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EARM,MAQN,EACH,QAAQ,EARC,MAQD,EACR,WAAW,GARF,MAQa,EACtB,UAAU,GARD,MAQa,EACtB,OAAO,GARE,MAQG,OA8Cb"}
+{"version":3,"file":"atomUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/atomUtils.js"],"names":[],"mappings":"AAiEA;;;GAGG;AACH,eAAO,MAAM,oBAAoB,aAM/B,CAAC;AA2CH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,EAAE,OAAO,GAHrC,MAG0C,GAFxC,MAAM,GAAC,SAAS,CA6C5B;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAwBtC;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,GAAG,CAAC,MAAM,CAAC,CAwCvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,QAAQ,EAJ1C,MAI0C,EAAE,OAAO,GAHnD,MAGwD,GAFtD,MAAM,EAAE,CAiCpB;AA0RD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,GAH3C,MAAM,EAG0C,GAF9C,MAAM,GAAC,SAAS,CAU5B;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAJ1C,MAI0C,EAAE,QAAQ,AAH5D,CACA,EADQ,MAAM,EAGmD,GAFvD,OAAO,CAkBnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAAC,SAAS,EAJhD,MAAM,QAI0C,EAAE,QAAQ,AAHlE,CACA,EADQ,MAAM,EAGyD,GAF7D,MAAM,QAAM,CA2DxB;AA4BD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAJhC,MAIqC,EAAE,QAAQ,GAH/C,MAGoD,GAFlD,MAAM,CA6DlB;AAgBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,AANrC,CAIA,EAHA;IAAsB,QAAQ,AAA9B,CACA,EADQ,MAAM,CACd;IAAsB,IAAI,AAA1B,CACA,EADQ,MAAM,CACd;IAAsB,IAAI,AAA1B,CACA,EADQ,MAAM,CACd;CAE0C,GAFhC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,GAAC,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,CA6CvG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,qBAqB/B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAJ5B,MAI4B,EAAE,YAAY,EAH1C,QAAQ,GAAC,KAGiC,GAFxC,QAAQ,GAAC,KAAK,CAkC1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,IAFrB,MAAM,GAAC,SAAS,CAO5B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,GAAC,SAAS,CAO5B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,QAAQ,EAH5B,MAAM,EAGsB,GAF7B,MAAM,GAAC,SAAS,CAoB5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,IAF9B,MAAM,GAAC,SAAS,CAgB5B;AAmED;;GAEG;AACH,wBAAgB,cAAc,QAwB7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,GAAC,SAAS,CA0B5B;AAgED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,IAFf;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAC,CAkB3D;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EALhC,MAAM,GAAC,SAKyB,EAAE,SAAS,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGiE,GAF/D,MAAM,EAAE,CAIpB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAL3B,MAK2B,EAAE,SAAS,EAJtC,MAIsC,EAAE,aAAa,EAHrD,MAGqD,GAFnD,OAAO,CAiBnB;AAeD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,GAAG,EALpB,MAKoB,EAAE,IAAI,EAJ1B,MAAM,EAIoB,EAAE,SAAS,GAHrC,MAG0C,GAFxC,OAAO,CA0KnB;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAHpC,MAGoC,GAFlC,MAAM,EAAE,CAwBpB;AAcD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAF1C,MAE0C,QAQpD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAJ9B,MAI8B,EAAE,SAAS,EAHzC,MAGyC,GAFvC,GAAC,CAcb;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAHpC,MAGoC,GAFlC,MAAM,EAAE,GAAC,MAAM,GAAC,SAAS,CAwBrC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EARM,MAQN,EACH,QAAQ,EARC,MAQD,EACR,WAAW,GARF,MAQa,EACtB,UAAU,GARD,MAQa,EACtB,OAAO,GARE,MAQG,OA8Cb"}

package/types/lib/inventory/auditCategories.d.ts

@@ -6,6 +6,8 @@ export declare const CBOM_AUDIT_CATEGORIES: readonly string[];
 export declare const HOST_TOPOLOGY_AUDIT_CATEGORIES: readonly string[];
 /** Frozen list of Golem (Go Evinse) audit categories. */
 export declare const GOLEM_AUDIT_CATEGORIES: readonly string[];
+/** Frozen list of Scala Evinse (scalasem) audit categories. */
+export declare const SCALA_AUDIT_CATEGORIES: readonly string[];
 /** Frozen list of Cargo (Rust) audit categories. */
 export declare const CARGO_AUDIT_CATEGORIES: readonly string[];
 /**
@@ -36,6 +38,7 @@ export declare const BOM_AUDIT_CATEGORY_ALIASES: Readonly<{
     golem: string[];
     hbom: string[];
     rust: string[];
+    scala: string[];
     host: string[];
 }>;
 /**

package/types/lib/inventory/auditCategories.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auditCategories.d.ts","sourceRoot":"","sources":["../../../lib/inventory/auditCategories.js"],"names":[],"mappings":"AAEA,yEAAyE;AACzE,eAAO,MAAM,qBAAqB,mBAIhC,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,mBAGhC,CAAC;AAEH,qDAAqD;AACrD,eAAO,MAAM,8BAA8B,mBAAmC,CAAC;AAE/E,yDAAyD;AACzD,eAAO,MAAM,sBAAsB,mBAIjC,CAAC;AAEH,oDAAoD;AACpD,eAAO,MAAM,sBAAsB,mBAGjC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,mBAAoC,CAAC;AAE7E,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,mBAIlC,CAAC;AAEH,gFAAgF;AAChF,eAAO,MAAM,6BAA6B,QAAkC,CAAC;AAE7E;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;EAarC,CAAC;AAMH;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAH3C,MAAM,GAAC,MAAM,EAG8B,GAFzC,MAAM,EAAE,CAiBpB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAHxC,MAAM,GAAC,MAAM,EAG2B,GAFtC,MAAM,EAAE,CAapB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAHtC,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,CAGa,GAFpC,MAAM,EAAE,CAMpB;AAUD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAJ1C,MAAM,GAAC,MAAM,EAI6B,EAAE,KAAK,EAHjD,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,CAGwB,GAF/C;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAC,CAyB3F;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAJzC,MAIyC,EAAE,WAAW,AAH9D,CACA,EADQ,MAGsD,GAFpD,MAAM,GAAG,SAAS,CA8B9B"}
+{"version":3,"file":"auditCategories.d.ts","sourceRoot":"","sources":["../../../lib/inventory/auditCategories.js"],"names":[],"mappings":"AAEA,yEAAyE;AACzE,eAAO,MAAM,qBAAqB,mBAIhC,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,mBAGhC,CAAC;AAEH,qDAAqD;AACrD,eAAO,MAAM,8BAA8B,mBAAmC,CAAC;AAE/E,yDAAyD;AACzD,eAAO,MAAM,sBAAsB,mBAIjC,CAAC;AAEH,+DAA+D;AAC/D,eAAO,MAAM,sBAAsB,mBAGjC,CAAC;AAEH,oDAAoD;AACpD,eAAO,MAAM,sBAAsB,mBAGjC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,mBAAoC,CAAC;AAE7E,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,mBAIlC,CAAC;AAEH,gFAAgF;AAChF,eAAO,MAAM,6BAA6B,QAAkC,CAAC;AAE7E;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;EAcrC,CAAC;AAMH;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAH3C,MAAM,GAAC,MAAM,EAG8B,GAFzC,MAAM,EAAE,CAiBpB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAHxC,MAAM,GAAC,MAAM,EAG2B,GAFtC,MAAM,EAAE,CAapB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAHtC,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,CAGa,GAFpC,MAAM,EAAE,CAMpB;AAUD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAJ1C,MAAM,GAAC,MAAM,EAI6B,EAAE,KAAK,EAHjD,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,CAGwB,GAF/C;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAC,CAyB3F;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAJzC,MAIyC,EAAE,WAAW,AAH9D,CACA,EADQ,MAGsD,GAFpD,MAAM,GAAG,SAAS,CA8B9B"}

package/types/lib/inventory/buildToolRateLimit.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Whether a tool's combined output names a rate limit from its repository.
+ * The answer text is treated as untrusted: only fixed substrings are looked
+ * for, nothing from the output is kept.
+ *
+ * @param {string} output Combined stdout and stderr of one invocation.
+ * @param {string} tool One of maven, gradle, sbt, mill, scala-cli.
+ * @returns {boolean} True when the output names an HTTP 429 answer.
+ */
+export declare function detectBuildToolRateLimit(output: string, tool: string): boolean;
+/**
+ * Whether a tool was already found rate limited in this scan, so the caller
+ * can skip its remaining invocations.
+ *
+ * @param {string} tool One of maven, gradle, sbt, mill, scala-cli.
+ * @returns {boolean}
+ */
+export declare function isBuildToolRateLimited(tool: string): boolean;
+/**
+ * Read a completed invocation's output for a rate limit. When one is found,
+ * the tool is remembered for the scan, one hint naming the tool's mirror
+ * setting is printed, and the `build.rate-limited` degradation is recorded.
+ * The first invocation that shows the rate limit is the one recorded; later
+ * ones add nothing, because the same answer ends them all.
+ *
+ * @param {string} tool One of maven, gradle, sbt, mill, scala-cli.
+ * @param {string|undefined} output Combined output, as commandOutputText
+ *   returns it for a spawn result.
+ * @param {Object} [context] Call-site facts for the degradation event.
+ * @param {string} [context.command] The redacted command that was attempted.
+ * @param {number} [context.exitCode] The invocation's exit status.
+ * @returns {boolean} True when this output names a rate limit.
+ */
+export declare function noteBuildToolRateLimit(tool: string, output: string | undefined, context?: {
+    command?: string;
+    exitCode?: number;
+}): boolean;
+//# sourceMappingURL=buildToolRateLimit.d.ts.map

package/types/lib/inventory/buildToolRateLimit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildToolRateLimit.d.ts","sourceRoot":"","sources":["../../../lib/inventory/buildToolRateLimit.js"],"names":[],"mappings":"AA4EA;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAJpC,MAIoC,EAAE,IAAI,EAH1C,MAG0C,GAFxC,OAAO,CAQnB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAHhC,MAGgC,GAF9B,OAAO,CAInB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EARhC,MAQgC,EAAE,MAAM,EAPxC,MAAM,GAAC,SAOiC,EAAE,OAAO,AALzD,CAGA,EAFA;IAAyB,OAAO,AAAhC,CACA,EADQ,MAAM,CACd;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;CAE8D,GAFpD,OAAO,CA0BnB"}

package/types/lib/inventory/cacheCommands.d.ts

@@ -1,5 +1,6 @@
 /**
- * `cdxgen cache` subcommand — inspect and purge the metadata fetch cache.
+ * `cdxgen cache` subcommand — inspect and purge the metadata fetch cache that
+ * cdxrs and the JS batch pool share.
  *
  * This module operates directly on the filesystem because JS is the authority
  * for the cache directory. The cache layout is:

package/types/lib/inventory/cacheCommands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cacheCommands.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cacheCommands.js"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAgCH;;;;;GAKG;AACH,wBAAgB,SAAS,IAHZ,MAAM,CAwDlB;AAED;;;;GAIG;AACH,wBAAgB,UAAU,IAFb,MAAM,CAwBlB;AAUD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAHjC,MAAM,GAAC,OAG0B,GAF/B,OAAO,CAAC,MAAM,CAAC,CAyC3B"}
+{"version":3,"file":"cacheCommands.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cacheCommands.js"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAgCH;;;;;GAKG;AACH,wBAAgB,SAAS,IAHZ,MAAM,CAwDlB;AAED;;;;GAIG;AACH,wBAAgB,UAAU,IAFb,MAAM,CAwBlB;AAUD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAHjC,MAAM,GAAC,OAG0B,GAF/B,OAAO,CAAC,MAAM,CAAC,CAyC3B"}

package/types/lib/inventory/cmakeBuildDirs.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Where a C/C++ project's build trees are: the build directories its CMake
+ * presets configure, and the conventional ones (`build`, `build-<name>`,
+ * `out`, `builddir`, `cmake-build-<name>`). Shared by the lookups for
+ * `CMakeCache.txt` and for the compilation database, so both search the same
+ * places in the same order.
+ */
+/**
+ * Whether `child` is `parent` or inside it.
+ *
+ * @param {string} child Path to test
+ * @param {string} parent Directory
+ * @returns {boolean}
+ */
+export declare function isInsideDir(child: string, parent: string): boolean;
+/**
+ * CMake's `${hostSystemName}` for this host.
+ *
+ * @returns {string}
+ */
+export declare function hostSystemName(): string;
+/**
+ * Read a project's presets documents: `CMakePresets.json` and
+ * `CMakeUserPresets.json`, each followed by the files it includes (schema
+ * version 4 and later). In secure mode an include outside the project is not
+ * read.
+ *
+ * @param {string} root Project source directory
+ * @returns {Array<{file: string, fileDir: string, document: Object}>}
+ */
+export declare function readCmakePresetDocuments(root: string): Array<{
+    file: string;
+    fileDir: string;
+    document: Object;
+}>;
+/**
+ * The visible configure presets of a project, resolved and with their macros
+ * expanded for this host.
+ *
+ * @param {string} root Project source directory
+ * @returns {Object[]} See `resolveConfigurePresets`
+ */
+export declare function readCmakeConfigurePresets(root: string): Object[];
+/**
+ * The directories a project's build trees may be in, most specific first:
+ * the directory of an explicit `--cmake-cache`, the build directories of its
+ * configure presets, then the `build`, `build-<name>`, `out`, `builddir` and
+ * `cmake-build-<name>` directories at the project root, and the directories
+ * one level below `build`, `out` and `out/build` (where Visual Studio puts
+ * preset builds). Only existing directories are listed; in secure mode, only
+ * those inside the project.
+ *
+ * @param {string} root Project source directory
+ * @param {Object} [options] CLI options (`cmakeCache`)
+ * @returns {string[]} Absolute directories, without duplicates
+ */
+export declare function cmakeBuildDirCandidates(root: string, options?: Object): string[];
+//# sourceMappingURL=cmakeBuildDirs.d.ts.map

package/types/lib/inventory/cmakeBuildDirs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cmakeBuildDirs.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cmakeBuildDirs.js"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA4CH;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAJtB,MAIsB,EAAE,MAAM,EAH9B,MAG8B,GAF5B,OAAO,CAKnB;AAsBD;;;;GAIG;AACH,wBAAgB,cAAc,IAFjB,MAAM,CAIlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAHlC,MAGkC,GAFhC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,CAAC,CAsCpE;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAgBpB;AA+BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAJjC,MAIiC,EAAE,OAAO,AAHlD,CACA,EADQ,MAG+C,GAF7C,MAAM,EAAE,CAoDpB"}

package/types/lib/inventory/deps.d.ts

@@ -1,3 +1,10 @@
+/**
+ * Whether a jar holds sources or javadoc rather than classes.
+ *
+ * @param {string} jarName Jar file name.
+ * @returns {boolean}
+ */
+export declare function isDocumentationJar(jarName: string): boolean;
 /**
  * Collect maven dependencies
  *
@@ -67,11 +74,62 @@ export declare function parsePomProperties(pomProperties: string): Object;
 /**
  * Method to get pom properties from maven directory
  *
+ * A shaded or fat jar carries a `pom.properties` for every artifact folded
+ * into it. When the jar's file name is known, the descriptor whose
+ * `artifactId-version` (or `artifactId`) starts the file name is the jar's
+ * own; otherwise the first descriptor is used, as before.
+ *
  * @param {string} mavenDir Path to maven directory
+ * @param {string} [jarName] File name of the jar the directory came from
  *
  * @return array with pom properties
  */
-export declare function getPomPropertiesFromMavenDir(mavenDir: string): {};
+export declare function getPomPropertiesFromMavenDir(mavenDir: string, jarName?: string): Object;
+/**
+ * The licences a MANIFEST.MF `Bundle-License` value names. The value is a
+ * comma-separated list; each item is an SPDX id, a licence name or a URL,
+ * optionally followed by `;link=` and `;description=` attributes, and any
+ * part may be quoted. Each item is mapped through findLicenseId; an item it
+ * cannot map is replaced by its `link` URL when one is given, which the
+ * licence URL lookup resolves later. `<<EXTERNAL>>` names no licence.
+ *
+ * @param {string} value Raw Bundle-License value.
+ * @returns {string[]} Licence ids, names or URLs, without duplicates.
+ */
+export declare function parseManifestLicenseList(value: string): string[];
+/**
+ * The Maven descriptor a jar carries for itself, read from an extracted
+ * `META-INF/maven` directory: the pom.properties that names the jar's own
+ * coordinates and the pom.xml stored beside it.
+ *
+ * @param {string} mavenDir Path to the extracted META-INF/maven directory
+ * @param {string} [jarName] File name of the jar the directory came from
+ * @returns {{properties: Object, pomXml?: string}|undefined} The chosen
+ *   descriptor, with its pom.xml text when one is stored beside it.
+ */
+export declare function readEmbeddedMavenDescriptor(mavenDir: string, jarName?: string): {
+    properties: Object;
+    pomXml?: string;
+} | undefined;
+/**
+ * The Maven descriptor and manifest licence a jar carries for itself, read
+ * from its zip without extracting it. Entry names are only matched and
+ * paired, never used as paths, and each entry is read only under a size
+ * bound, because the archive is untrusted input.
+ *
+ * @param {string} jarFile Path to the jar.
+ * @param {{group: string, name: string, version: string}} coordinates The jar's own coordinates, which choose its descriptor.
+ * @returns {Promise<{properties?: Object, pomXml?: string, manifestLicenses?: string[]}|undefined>}
+ */
+export declare function readEmbeddedJarMetadata(jarFile: string, coordinates: {
+    group: string;
+    name: string;
+    version: string;
+}): Promise<{
+    properties?: Object;
+    pomXml?: string;
+    manifestLicenses?: string[];
+} | undefined>;
 /**
  * Method to read a single file entry from a zip file
  *

package/types/lib/inventory/deps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deps.d.ts","sourceRoot":"","sources":["../../../lib/inventory/deps.js"],"names":[],"mappings":"AA6BA;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EANC,MAMD,EACR,QAAQ,EANC,MAMD,EACR,OAAO,GANE,OAMK,EACd,eAAe,GANN,OAMc,eAuDxB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAL/B,MAK+B,EAAE,UAAU,GAJ3C,MAIgD,eAsK1D;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,YAAY,EAH9C,MAG8C,GAF5C,OAAO,CAAC,MAAM,EAAE,CAAC,CAgE7B;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,UAAU,KAAA,GAFzB,MAAM,CAkClB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAHjC,MAGiC,GAF/B,MAAM,CAiBlB;AAgBD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,GAH1C,MAG+C,GAF7C,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAJ7B,MAI6B,EAAE,IAAI,EAHnC,MAGmC,GAFjC,MAAM,CAqBlB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAHrC,MAGqC,GAFnC,MAAM,CAiBlB;AACD;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAJ1C,MAI0C,MAYpD;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAPE,MAOF,EACP,WAAW,EAPF,MAOE,EACX,eAAe,GAPN,MAOgB,GALd,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA4CrC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EARE,MAQF,EACP,YAAY,EARH,MAQG,EACZ,EAAE,eAAyB,EAAE,aAA+B,EAAE,AAR7D,CAGA,EAFA;IAAsB,eAAe,AAArC,CACA,EADQ,MAAM,CACd;IAAsB,aAAa,AAAnC,CACA,EADQ,MAAM,CACd;CAKkE,GALxD,OAAO,CAAC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,CAAC,CAAC,CAkDxD;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAJhC,MAIgC,gBAqE1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,eAAe,EANhC,MAMgC,EAAE,OAAO,EALzC,MAAM,EAKmC,EAAE,cAAc,EAJzD,MAIyD,EAAE,CAAC,EAH5D,MAG4D,GAF1D,IAAI,CAqDhB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAJtB,MAAM,GAAC,MAIe,EAAE,CAAC,EAHzB,MAAM,GAAC,MAGkB,GAFvB,MAAM,CAWlB"}
+{"version":3,"file":"deps.d.ts","sourceRoot":"","sources":["../../../lib/inventory/deps.js"],"names":[],"mappings":"AA+BA;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B,OAAO,CAInB;AA0DD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EANC,MAMD,EACR,QAAQ,EANC,MAMD,EACR,OAAO,GANE,OAMK,EACd,eAAe,GANN,OAMc,eA2ExB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAL/B,MAK+B,EAAE,UAAU,GAJ3C,MAIgD,eA4I1D;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,YAAY,EAH9C,MAG8C,GAF5C,OAAO,CAAC,MAAM,EAAE,CAAC,CAgE7B;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,UAAU,KAAA,GAFzB,MAAM,CAkClB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAHjC,MAGiC,GAF/B,MAAM,CA0BlB;AAgBD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,GAH1C,MAG+C,GAF7C,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAJ7B,MAI6B,EAAE,IAAI,EAHnC,MAGmC,GAFjC,MAAM,CAqBlB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAHrC,MAGqC,GAFnC,MAAM,CAiBlB;AACD;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAL1C,MAK0C,EAAE,OAAO,AAJ3D,CAEA,EAFQ,MAI+D,UAEzE;AAqID;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CA4BpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EALzC,MAKyC,EAAE,OAAO,AAJ1D,CACA,EADQ,MAI8D,GAH5D;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAe3D;AA4BD;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAJ1C,MAI0C,EAAE,WAAW,EAHvD;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAGU,GAFrD,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAAS,CAAC,CAgFlG;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAPE,MAOF,EACP,WAAW,EAPF,MAOE,EACX,eAAe,GAPN,MAOgB,GALd,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA4CrC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EARE,MAQF,EACP,YAAY,EARH,MAQG,EACZ,EAAE,eAAyB,EAAE,aAA+B,EAAE,AAR7D,CAGA,EAFA;IAAsB,eAAe,AAArC,CACA,EADQ,MAAM,CACd;IAAsB,aAAa,AAAnC,CACA,EADQ,MAAM,CACd;CAKkE,GALxD,OAAO,CAAC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,CAAC,CAAC,CAkDxD;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAJhC,MAIgC,gBAqE1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,eAAe,EANhC,MAMgC,EAAE,OAAO,EALzC,MAAM,EAKmC,EAAE,cAAc,EAJzD,MAIyD,EAAE,CAAC,EAH5D,MAG4D,GAF1D,IAAI,CAqDhB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAJtB,MAAM,GAAC,MAIe,EAAE,CAAC,EAHzB,MAAM,GAAC,MAGkB,GAFvB,MAAM,CAWlB"}