@cdxgen/cdxgen 13.3.0 → 13.4.0

package/types/lib/inventory/dosai.d.ts

@@ -75,6 +75,36 @@ export declare function readDosaiMethodsReport(reportFile: string, options?: {
 export declare function readDosaiDataFlowReport(reportFile: string, options?: {
     maxTextBytes?: number;
 }): Object | undefined;
+/**
+ * Whether a dosai run ended because it ran out of time.
+ *
+ * dosai has no limit of its own: cdxgen's spawn timeout
+ * (CDXGEN_TIMEOUT_MS) stops the process, which reaches the caller only as an
+ * ETIMEDOUT error looking like any other failure (issue 4438).
+ *
+ * @param {Object} result spawnSync result
+ * @returns {boolean} true when the run was stopped by the spawn timeout
+ */
+export declare function dosaiRunTimedOut(result: Object): boolean;
+/**
+ * How a dosai run was stopped before it could finish, if it was.
+ *
+ * Besides the spawn timeout, a run is stopped when its console output outgrows
+ * CDXGEN_MAX_BUFFER (ENOBUFS) or a signal ends it, such as the kernel's
+ * out-of-memory killer. A stopped run can leave its slice half written.
+ *
+ * @param {Object} result spawnSync result
+ * @returns {"timeout"|"buffer"|"signal"|undefined} Why the run was stopped, or undefined when it ended by itself
+ */
+export declare function dosaiRunStopReason(result: Object): "timeout" | "buffer" | "signal" | undefined;
+/**
+ * Whether the dosai run that should have written a file was stopped (by the
+ * time limit, the output buffer limit, or a signal) and already reported so.
+ *
+ * @param {string} outputFile Output file passed to the dosai run
+ * @returns {boolean} true when the run was stopped
+ */
+export declare function dosaiRunWasStopped(outputFile: string): boolean;
 /**
  * Run a dosai subcommand ("methods", "dataflows", or "crypto") against a source
  * tree and write its JSON output to the given file.
@@ -138,17 +168,21 @@ export declare function persistDosaiSemanticsReport(options: any, methodsSlice:
  * Build a purl alias map for a list of components.
  *
  * @param {Object[]} [components] Component objects with purl fields
- * @returns {Map<string, string>} Map of exact purls and normalized type/namespace/name keys to canonical purls
+ * @param {Object} [options] Options passed to {@link buildDosaiPurlAliasMap} (`srcPath`)
+ * @returns {Map<string, string>} Map of component purls, carrying the version-free identity index
  */
-export declare function buildPurlAliasMap(components?: Object[]): Map<string, string>;
+export declare function buildPurlAliasMap(components?: Object[], options?: Object): Map<string, string>;
 /**
- * Resolve a possibly-aliased purl to the canonical component purl.
+ * Resolve a dosai purl to the canonical component purl, by version, and for a
+ * package the BOM holds in several versions by the record's location.
  *
  * @param {string} purl Purl from a dosai report
  * @param {Map<string, string>} purlAliasMap Alias map built by buildPurlAliasMap
- * @returns {string|undefined} Canonical component purl, the input purl when unaliased, or undefined when empty
+ * @param {string} [location] Source location of the dosai record
+ * @returns {string|undefined} Canonical component purl, the input purl when the BOM has no such package,
+ *          or undefined when empty or ambiguous
  */
-export declare function resolveComponentPurl(purl: string, purlAliasMap: Map<string, string>): string | undefined;
+export declare function resolveComponentPurl(purl: string, purlAliasMap: Map<string, string>, location?: string): string | undefined;
 /**
  * Copy one dosai PackageReachability fact onto a component as properties.
  *
@@ -169,9 +203,14 @@ export declare function addDosaiReachabilityProperties(component: Object, reacha
  *
  * @param {Object} methodsSlice Parsed dosai methods slice JSON
  * @param {Object[]} [components] BOM components used to resolve purl aliases and mutate
+ * @param {Object} [options] Options
+ * @param {string} [options.srcPath] Directory dosai analyzed; a package the BOM holds in several
+ *        versions is matched by the project of the record's file
  * @returns {number} Number of distinct components enriched
  */
-export declare function applyDosaiReachabilityEvidence(methodsSlice: Object, components?: Object[]): number;
+export declare function applyDosaiReachabilityEvidence(methodsSlice: Object, components?: Object[], options?: {
+    srcPath?: string;
+}): number;
 /**
  * Map a dosai methods slice to per-purl occurrence evidence.
  *
@@ -180,9 +219,14 @@ export declare function applyDosaiReachabilityEvidence(methodsSlice: Object, com
  *
  * @param {Object} methodsSlice Parsed dosai methods slice JSON
  * @param {Object[]} [components] BOM components used to resolve purl aliases
+ * @param {Object} [options] Options
+ * @param {string} [options.srcPath] Directory dosai analyzed; a package the BOM holds in several
+ *        versions is matched by the project of the record's file
  * @returns {Object} Object with purlLocationMap, purlModulesMap, and purlMethodsMap keyed by purl
  */
-export declare function collectDosaiPurlEvidence(methodsSlice: Object, components?: Object[]): Object;
+export declare function collectDosaiPurlEvidence(methodsSlice: Object, components?: Object[], options?: {
+    srcPath?: string;
+}): Object;
 /**
  * Extract data-flow call frames per component purl from a dosai data-flow result.
  *
@@ -191,9 +235,14 @@ export declare function collectDosaiPurlEvidence(methodsSlice: Object, component
  *
  * @param {Object} dataFlowResult Parsed dosai data-flow slice JSON
  * @param {Object[]} [components] BOM components used to resolve purl aliases
+ * @param {Object} [options] Options
+ * @param {string} [options.srcPath] Directory dosai analyzed; a package the BOM holds in several
+ *        versions is matched by the project of the record's file
  * @returns {Object} Map of canonical purl to arrays of call-stack frame objects
  */
-export declare function collectDosaiDataFlowFrames(dataFlowResult: Object, components?: Object[]): Object;
+export declare function collectDosaiDataFlowFrames(dataFlowResult: Object, components?: Object[], options?: {
+    srcPath?: string;
+}): Object;
 /**
  * Consume dosai's AiComponents[] inventory (schema 4.0.0): model identifiers,
  * on-disk model artifacts with hashes, MCP tools, prompts (redacted), and agents

package/types/lib/inventory/dosai.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dosai.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dosai.js"],"names":[],"mappings":"AA6WA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAJpC,MAAM,EAI8B,EAAE,OAAO,EAH7C,MAG6C,GAF3C;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAC,CAyFtE;AAoCD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAW5B;AA2ED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAPtC,MAOsC,EAAE,OAAO,AANvD,CAIA,EAHA;IAA2B,QAAQ,AAAnC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,cAAc,AAAzC,CACA,WAAA;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;CAE4D,GAFlD,MAAM,GAAC,SAAS,CA0B5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EALvC,MAKuC,EAAE,OAAO,AAJxD,CAEA,EADA;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;CAE6D,GAFnD,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAN5B,MAM4B,EAAE,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAoFnB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,UAAU,EAJ5C,MAI4C,EAAE,OAAO,AAH7D,CACA,EADQ,MAG0D,GAFxD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EALlC,MAKkC,EAAE,UAAU,EAJ9C,MAI8C,EAAE,OAAO,AAH/D,CACA,EADQ,MAG4D,GAF1D,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAe5B;AAuDD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,KAAA,EACP,YAAY,KAAA,EACZ,aAAa,KAAA,OAyDd;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,AAHzC,CACA,EADQ,MAAM,EAGgC,GAFpC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/B;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAJ9B,MAI8B,EAAE,YAAY,EAH5C,GAAG,CAAC,MAAM,EAAE,MAAM,CAG0B,GAF1C,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAH7C,MAG6C,EAAE,YAAY,EAF3D,MAE2D,QAyBrE;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,YAAY,EAJhD,MAIgD,EAAE,UAAU,AAHpE,CACA,EADQ,MAAM,EAG2D,GAF/D,MAAM,CAoBlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAJ1C,MAI0C,EAAE,UAAU,AAH9D,CACA,EADQ,MAAM,EAGqD,GAFzD,MAAM,CAmElB;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,cAAc,EAJ9C,MAI8C,EAAE,UAAU,AAHlE,CACA,EADQ,MAAM,EAGyD,GAF7D,MAAM,CAsClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAJ1C,MAI0C,EAAE,UAAU,AAH9D,CACA,OAEmE,SA6FrE;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,YAAY,EAJ/C,MAI+C,EAAE,WAAW,AAHpE,CACA,EADQ,MAGiE,GAF/D,MAAM,CAyKlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC7C,YAAY,EALH,MAKG,EACZ,WAAW,AALV,CACA,EADQ,MAKO,GAJL,MAAM,CA+GlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,AAHjD,CACA,EADQ,MAG8C,GAF5C,MAAM,EAAE,CA6CpB"}
+{"version":3,"file":"dosai.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dosai.js"],"names":[],"mappings":"AA+WA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAJpC,MAAM,EAI8B,EAAE,OAAO,EAH7C,MAG6C,GAF3C;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAC,CAyFtE;AAoCD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAW5B;AA2ED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAPtC,MAOsC,EAAE,OAAO,AANvD,CAIA,EAHA;IAA2B,QAAQ,AAAnC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,cAAc,AAAzC,CACA,WAAA;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;CAE4D,GAFlD,MAAM,GAAC,SAAS,CA0B5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EALvC,MAKuC,EAAE,OAAO,AAJxD,CAEA,EADA;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;CAE6D,GAFnD,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAH5B,MAG4B,GAF1B,OAAO,CAInB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAH9B,MAG8B,GAF5B,SAAS,GAAC,QAAQ,GAAC,QAAQ,GAAC,SAAS,CAajD;AAMD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAGkC,GAFhC,OAAO,CAKnB;AAYD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAN5B,MAM4B,EAAE,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAuGnB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,UAAU,EAJ5C,MAI4C,EAAE,OAAO,AAH7D,CACA,EADQ,MAG0D,GAFxD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EALlC,MAKkC,EAAE,UAAU,EAJ9C,MAI8C,EAAE,OAAO,AAH/D,CACA,EADQ,MAG4D,GAF1D,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAe5B;AAuDD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,KAAA,EACP,YAAY,KAAA,EACZ,aAAa,KAAA,OAyDd;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,AAJzC,CACA,EADQ,MAAM,EAIgC,EAAE,OAAO,AAHvD,CACA,EADQ,MAGoD,GAFlD,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/B;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAN9B,MAM8B,EAAE,YAAY,EAL5C,GAAG,CAAC,MAAM,EAAE,MAAM,CAK0B,EAAE,QAAQ,AAJ9D,CACA,EADQ,MAIsD,GAHpD,MAAM,GAAC,SAAS,CAK5B;AAwCD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAH7C,MAG6C,EAAE,YAAY,EAF3D,MAE2D,QAyBrE;AAED;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAC5C,YAAY,EARH,MAQG,EACZ,UAAU,AART,CACA,EADQ,MAAM,EAQA,EACf,OAAO,AARN,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAKW,GALD,MAAM,CA4ClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EARH,MAQG,EACZ,UAAU,AART,CACA,EADQ,MAAM,EAQA,EACf,OAAO,AARN,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAKW,GALD,MAAM,CA8FlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,cAAc,EARL,MAQK,EACd,UAAU,AART,CACA,EADQ,MAAM,EAQA,EACf,OAAO,AARN,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAKW,GALD,MAAM,CAwDlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAJ1C,MAI0C,EAAE,UAAU,AAH9D,CACA,OAEmE,SA6FrE;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,YAAY,EAJ/C,MAI+C,EAAE,WAAW,AAHpE,CACA,EADQ,MAGiE,GAF/D,MAAM,CAyKlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC7C,YAAY,EALH,MAKG,EACZ,WAAW,AALV,CACA,EADQ,MAKO,GAJL,MAAM,CA+GlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,AAHjD,CACA,EADQ,MAG8C,GAF5C,MAAM,EAAE,CA6CpB"}

package/types/lib/inventory/dosaiParsers.d.ts

@@ -24,6 +24,25 @@ export declare function addDosaiSetValue(map: Object, key: string, value: string
  * @returns {string|undefined} Location string with a `#line` suffix when available, or undefined when no file is known
  */
 export declare function dosaiLocation(item: Object): string | undefined;
+/**
+ * Format the `file#line` location of a dosai MethodCalls row, relative to the
+ * scanned directory like dosai's source rows.
+ *
+ * A call site found in assembly IL names its file through the PDB. dosai 5
+ * writes it relative to the scan root and leaves Path out when the file has
+ * no place in the tree; dosai 4 writes the PDB path as it is: absolute for a
+ * local build, `/_/` for a deterministic one (owasp-dep-scan/dosai#79). An
+ * absolute path under the scanned directory is made relative to it, and any
+ * other build path, or a missing one, gives way to the file name, as for call
+ * graph edges, so both versions list a call site found in source and in IL
+ * once. Where no sequence point covers a call, the row names the assembly and
+ * its line is an IL offset, which is no source location.
+ *
+ * @param {Object} methodCall Dosai MethodCalls row
+ * @param {string} [srcPath] Directory dosai analyzed
+ * @returns {string|undefined} Location string, or undefined when the row names no source file
+ */
+export declare function dosaiCallSiteLocation(methodCall: Object, srcPath?: string): string | undefined;
 /**
  * Return a validated source location for .NET source extensions, from a call graph node.
  *
@@ -41,19 +60,46 @@ export declare function dosaiSourceLocation(location: Object): string | undefine
 /**
  * Build a purl alias map from BOM components.
  *
- * Maps both exact component purls and normalized type/namespace/name keys to
- * the canonical component purl so dosai-reported purls can be reconciled.
+ * Maps each component purl to itself, and indexes the components by their
+ * version-free identity, so a dosai-reported purl can be reconciled by version
+ * (see {@link resolveDosaiComponentPurl}). Two versions of one package are two
+ * components, and nothing here picks one of them on a name alone.
  *
  * @param {Object[]} [components] Component objects with purl fields
- * @returns {Map<string, string>} Map of purl or normalized key to canonical component purl
+ * @param {Object} [options] Options
+ * @param {string} [options.srcPath] Directory dosai analyzed, which its relative locations
+ *        and the BOM's relative manifest paths are relative to
+ * @returns {Map<string, string>} Map of purl to canonical component purl, carrying the identity index
  */
-export declare function buildDosaiPurlAliasMap(components?: Object[]): Map<string, string>;
+export declare function buildDosaiPurlAliasMap(components?: Object[], options?: {
+    srcPath?: string;
+}): Map<string, string>;
 /**
- * Resolve a purl to the canonical component purl via the alias map.
+ * Choose among the components that share a file name (two versions of a
+ * package ship the same DLLs): the only one, else the one whose project
+ * directory is nearest the record's location.
+ *
+ * @param {Iterable<string>} purls Candidate component purls
+ * @param {Map<string, string>} purlAliasMap Alias map built by buildDosaiPurlAliasMap
+ * @param {string} [location] Source location of the dosai record (`path` or `path#line`)
+ * @returns {string|undefined} The component purl, or undefined when it cannot be told
+ */
+export declare function pickDosaiComponentByLocation(purls: Iterable<string>, purlAliasMap: Map<string, string>, location?: string): string | undefined;
+/**
+ * Resolve a dosai-reported purl to a BOM component purl.
+ *
+ * The exact purl wins, then the same package at the same version (ids compare
+ * case-insensitively). A versionless purl, or a version the BOM does not hold,
+ * maps to the package's only component when it has one. When the BOM holds
+ * several versions, the record's location picks the version of the project
+ * that file belongs to; without a location that settles it the purl maps to
+ * nothing rather than to an arbitrary version (issue dosai#72).
  *
  * @param {string} purl Purl reported by dosai
  * @param {Map<string, string>} purlAliasMap Alias map built by buildDosaiPurlAliasMap
- * @returns {string|undefined} Canonical component purl, the input purl when unaliased, or undefined when empty
+ * @param {string} [location] Source location of the dosai record (`path` or `path#line`)
+ * @returns {string|undefined} Canonical component purl, the input purl when the BOM has no
+ *          component of that package, or undefined when empty or ambiguous
  */
-export declare function resolveDosaiComponentPurl(purl: string, purlAliasMap: Map<string, string>): string | undefined;
+export declare function resolveDosaiComponentPurl(purl: string, purlAliasMap: Map<string, string>, location?: string): string | undefined;
 //# sourceMappingURL=dosaiParsers.d.ts.map

package/types/lib/inventory/dosaiParsers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dosaiParsers.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dosaiParsers.js"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,GAAG,EAJ9B,MAI8B,EAAE,KAAK,EAHrC,MAGqC,GAFnC,IAAI,CAQhB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAHvB,MAGuB,GAFrB,MAAM,GAAC,SAAS,CAc5B;AAcD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,AAH9C,CACA,EADQ,MAAM,EAGqC,GAFzC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAe/B;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAJnC,MAImC,EAAE,YAAY,EAHjD,GAAG,CAAC,MAAM,EAAE,MAAM,CAG+B,GAF/C,MAAM,GAAC,SAAS,CAW5B"}
+{"version":3,"file":"dosaiParsers.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dosaiParsers.js"],"names":[],"mappings":"AAeA;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,GAAG,EAJ9B,MAI8B,EAAE,KAAK,EAHrC,MAGqC,GAFnC,IAAI,CAQhB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAHvB,MAGuB,GAFrB,MAAM,GAAC,SAAS,CAc5B;AAcD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAJrC,MAIqC,EAAE,OAAO,AAHtD,CACA,EADQ,MAG8C,GAF5C,MAAM,GAAC,SAAS,CAU5B;AA8BD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAa5B;AAiHD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,AAN9C,CACA,EADQ,MAAM,EAMqC,EAAE,OAAO,AAL5D,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAEiE,GAFvD,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAqC/B;AAsCD;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EALvC,QAAQ,CAAC,MAAM,CAKwB,EAAE,YAAY,EAJrD,GAAG,CAAC,MAAM,EAAE,MAAM,CAImC,EAAE,QAAQ,AAHvE,CACA,EADQ,MAG+D,GAF7D,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EANnC,MAMmC,EAAE,YAAY,EALjD,GAAG,CAAC,MAAM,EAAE,MAAM,CAK+B,EAAE,QAAQ,AAJnE,CACA,EADQ,MAI2D,GAHzD,MAAM,GAAC,SAAS,CA6B5B"}

package/types/lib/inventory/dynamic.d.ts

@@ -1,3 +1,13 @@
+/**
+ * Converts a traced library path into a purl subpath. Windows paths
+ * ("C:\Windows\System32\bcrypt.dll", "\\server\share\x.dll") use forward
+ * slashes and drop the drive or UNC prefix, which a purl subpath cannot carry;
+ * the full path stays in the cdx:dynamic:filePath property.
+ *
+ * @param {string} libPath - Absolute path of the loaded library
+ * @returns {string|null} Subpath without leading separators, or null
+ */
+export declare function librarySubpath(libPath: string): string | null;
 /**
  * Builds a flat list of CycloneDX component objects and services by executing
  * the given command and inspecting which shared libraries it loads at runtime

package/types/lib/inventory/dynamic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dynamic.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dynamic.js"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAND,MAMC,EACV,UAAU,EAND,MAMC,EACV,YAAY,AANX,CACA,EADQ,MAMQ,GALN,OAAO,CAAC;IAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAAC,CAAC,CA4JzE"}
+{"version":3,"file":"dynamic.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dynamic.js"],"names":[],"mappings":"AAYA;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,GAFzB,MAAM,GAAC,IAAI,CAevB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAND,MAMC,EACV,UAAU,EAND,MAMC,EACV,YAAY,AANX,CACA,EADQ,MAMQ,GALN,OAAO,CAAC;IAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAAC,CAAC,CA8KzE"}

package/types/lib/inventory/evidenceUtils.d.ts

@@ -44,15 +44,30 @@ export declare function attachIdentityTools(subjects: Object | Object[], toolRef
  * Enrich .NET package components with occurrence evidence and imported module/method
  * information from a dosai dependency slices file.
  *
- * Builds a mapping of DLL filenames to purls using the `internal:PackageFiles` property of each
- * package, then reads the slices file to add occurrence locations, imported modules,
- * called methods, and assembly version information where available.
+ * Each dosai record names its package by purl, resolved in the project of the
+ * record's file, and is attached to the component of that version (see
+ * {@link resolveDosaiComponentPurl}). The DLL files of each package
+ * (`internal:PackageFiles`) only fill in for a record whose purl names no
+ * component, and only when the DLL belongs to one component or the record's
+ * location says which: two versions of a package ship the same DLL names.
+ *
+ * The fallback is needed because dosai names a `System.*` assembly it cannot
+ * map to a package with a framework purl (`pkg:nuget/System.Runtime`), as it
+ * does whenever the tree has lock files but no restore output: the DLL of
+ * System.Data.SQLite.Core is still the package's. A DLL that only a package's
+ * build-time folders carry is not listed in `internal:PackageFiles`, so it
+ * credits no package with the project's framework calls (issue 4441).
  *
  * @param {Object[]} pkgList Array of .NET package component objects to enrich
  * @param {string} slicesFile Path to the dosai dependency slices JSON file
+ * @param {Object} [options] Options
+ * @param {string} [options.srcPath] Directory dosai analyzed, which its relative locations
+ *        and the components' relative manifest paths are relative to
  * @returns {Object[]} The enriched package list (same array, mutated in place)
  */
-export declare function addEvidenceForDotnet(pkgList: Object[], slicesFile: string): Object[];
+export declare function addEvidenceForDotnet(pkgList: Object[], slicesFile: string, options?: {
+    srcPath?: string;
+}): Object[];
 /**
  * Convert OS query results
  *

package/types/lib/inventory/evidenceUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evidenceUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/evidenceUtils.js"],"names":[],"mappings":"AA+BA;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,OAAO,AAHvD,CACA,EADQ,MAGoD,GAFlD,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,MAAM,GAAC,SAAS,CA8B5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAHxC,MAGwC,GAFtC,MAAM,CAalB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAJ1B,MAAM,EAAE,GAAC,MAIiB,EAAE,SAAS,UAAA,GAFnC,MAAM,EAAE,CAmDpB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAAM,GAAC,MAAM,EAIoB,EAAE,QAAQ,EAH3C,MAAM,EAGqC,GAFzC,MAAM,GAAC,MAAM,EAAE,CAwB3B;AAsCD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAJjC,MAAM,EAI2B,EAAE,UAAU,EAH7C,MAG6C,GAF3C,MAAM,EAAE,CAwOpB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EANJ,MAMI,EACb,QAAQ,EANC,MAMD,EACR,OAAO,OAAA,EACP,OAAO,UAAQ,EACf,gBAAgB,YAAY;;;;;;;;;IA6H7B"}
+{"version":3,"file":"evidenceUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/evidenceUtils.js"],"names":[],"mappings":"AAiCA;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,OAAO,AAHvD,CACA,EADQ,MAGoD,GAFlD,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,MAAM,GAAC,SAAS,CA8B5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAHxC,MAGwC,GAFtC,MAAM,CAalB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAJ1B,MAAM,EAAE,GAAC,MAIiB,EAAE,SAAS,UAAA,GAFnC,MAAM,EAAE,CAmDpB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAAM,GAAC,MAAM,EAIoB,EAAE,QAAQ,EAH3C,MAAM,EAGqC,GAFzC,MAAM,GAAC,MAAM,EAAE,CAwB3B;AAsCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAPjC,MAAM,EAO2B,EAAE,UAAU,EAN7C,MAM6C,EAAE,OAAO,AAL9D,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAEmE,GAFzD,MAAM,EAAE,CAsQpB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EANJ,MAMI,EACb,QAAQ,EANC,MAMD,EACR,OAAO,OAAA,EACP,OAAO,UAAQ,EACf,gBAAgB,YAAY;;;;;;;;;IA6H7B"}

package/types/lib/inventory/fetchBatch.d.ts

@@ -10,11 +10,13 @@
  * read instead of the network.
  *
  * There is one policy layer (`fetchRate.js`, mirrored by the Rust `rate.rs`)
- * and two transports. When the `cdxrs` binary is available it is preferred,
- * because it brings an on-disk conditional cache (D26) the JS pool does not
- * have. When it is absent, disabled, or unusable, the JS pool runs every
- * request through `cdxgenAgent` so the secure-mode host allowlist, the
- * activity recorder and the test cassette interceptor all still apply.
+ * and two transports. When the `cdxrs` binary is available it is preferred for
+ * the JSON it can carry. When it is absent, disabled, or unusable, and whenever
+ * a dry run, secure mode or a host allowlist is in force, the JS pool runs
+ * every request through `cdxgenAgent` so those policies, the activity recorder
+ * and the test cassette interceptor all still apply. The JS pool keeps the same
+ * on-disk conditional cache as cdxrs (`fetchDiskCache.js`), in the same
+ * directory and layout.
  *
  * Two properties are deliberate and load-bearing:
  *
@@ -27,11 +29,43 @@
  *    JS on all three registries it covered.
  *
  * 2. **Fallback is per URL, not per run.** A URL that the batch could not
- *    resolve for a transport reason is simply absent from the map, and the
- *    caller's own `cdxgenAgent.get` runs for it exactly as before. A URL that
- *    resolved to a definite HTTP error is recorded as such, so the caller does
- *    not re-request it only to get the same 404.
+ *    resolve for a transport reason is left to the caller, whose own request
+ *    goes through {@link gatedGet} and the same per-host gate. A URL the server
+ *    answered with an error status, after the batch's retries, is recorded as
+ *    such, so the caller does not ask again only to get the same answer, and a
+ *    404 or 410 is remembered for the rest of the run.
  */
+/**
+ * Whether requests to a host are paused.
+ *
+ * @param {string|null} host Hostname.
+ * @returns {boolean}
+ */
+export declare function isHostCircuitOpen(host: string | null): boolean;
+/**
+ * Pause requests to a host, for at least {@link DEFAULT_CIRCUIT_OPEN_MS} or for
+ * as long as the server asked. Warns once per pause.
+ *
+ * @param {string} host Hostname.
+ * @param {{delayMs?: number|null, cause?: string, quiet?: boolean, minimumMs?: number}} [details]
+ *   Server-supplied delay, a short description of what happened, whether to
+ *   pause without a warning or a degradation record (for failures that are not
+ *   the host's doing, such as a dry run or an allowlist block), and the
+ *   shortest pause, which a host that says exactly when it recovers sets to 0.
+ * @returns {void}
+ */
+export declare function openHostCircuit(host: string, { delayMs, cause, quiet, minimumMs }?: {
+    delayMs?: number | null;
+    cause?: string;
+    quiet?: boolean;
+    minimumMs?: number;
+}): void;
+/**
+ * Clear every paused host. Tests only.
+ *
+ * @returns {void}
+ */
+export declare function resetHostCircuits(): void;
 /**
  * @returns {Object|null} Stats from the last batch (requests, unique, ok,
  *   failures, cacheHits, elapsedMs, peakConcurrency), or null.
@@ -69,6 +103,11 @@ export type BatchEntry = {
      * other than 429) and re-requesting it in JS would be pointless.
      */
     definite?: boolean;
+    /**
+     * Response headers of a failed request, when the
+     * JS pool made it. cdxrs reports no headers.
+     */
+    headers?: Object;
 };
 /**
  * Fetch a batch of registry URLs concurrently.
@@ -132,12 +171,40 @@ export declare function recordPolicyDegradationFromError(err: Error): void;
  * The per-host semaphore and limiter are module state, so this shares one gate
  * per host for the life of the process.
  *
+ * A host paused by its circuit breaker fails at once with a 429-shaped error,
+ * and a 429 from a breaker host pauses it.
+ *
+ * With `deferGate`, `issue` receives request options carrying a
+ * `beforeNetwork` hook and must pass them to `cdxgenAgent`. The rate limiter
+ * then runs only when the request misses the response cache, so a cached
+ * answer does not wait for a slot. Without it, the limiter runs before
+ * `issue`, as before.
+ *
  * @template T
  * @param {string} url The URL about to be requested.
- * @param {() => Promise<T>} issue Issues the request and resolves its result.
+ * @param {(gate: Object) => Promise<T>} issue Issues the request and resolves its result.
+ * @param {{deferGate?: boolean}} [opts]
  * @returns {Promise<T>} Whatever `issue` resolves to.
  */
-export declare function withHostRateLimit<T>(url: string, issue: () => Promise<T>): Promise<T>;
+export declare function withHostRateLimit<T>(url: string, issue: (gate: Object) => Promise<T>, { deferGate }?: {
+    deferGate?: boolean;
+}): Promise<T>;
+/**
+ * Request a URL the batch did not answer, the way the pool would have: behind
+ * the per-host gate, failing at once for a document that already answered 404
+ * or 410 this run, and remembering such an answer for the next pass.
+ *
+ * This is the fallback every metadata function uses after a prefetch. Without
+ * it, a URL the batch left open went straight to the network with no rate gate,
+ * and the same miss was asked again on every pass.
+ *
+ * @param {string} url URL to request.
+ * @param {Object} [options] `cdxgenAgent.get` options.
+ * @returns {Promise<Object>} The response.
+ * @throws {Error} The request's own error, or a 404-shaped error for a
+ *   remembered miss, so the caller's `catch` runs as it would for the network.
+ */
+export declare function gatedGet(url: string, options?: Object): Promise<Object>;
 /**
  * Read a prefetched response, or signal that the caller should fetch it itself.
  *
@@ -145,9 +212,11 @@ export declare function withHostRateLimit<T>(url: string, issue: () => Promise<T
  * @param {string} url The URL the caller is about to request.
  * @returns {{body: *}|undefined} A response-shaped object when the body is
  *   available, or `undefined` when the caller should issue its own request.
- * @throws {Error} When the batch established a definite HTTP error for this
- *   URL, so that the caller's existing `catch` treats it exactly as it treats a
- *   failed `cdxgenAgent.get`.
+ * @throws {Error} When the server answered with an error status, so that the
+ *   caller's existing `catch` treats it exactly as it treats a failed
+ *   `cdxgenAgent.get`. A 5xx or a 429 is the answer after the batch's own
+ *   retries, and asking once more at once would only add to the load. Only a
+ *   transport failure, with no status, is left to the caller to retry.
  */
 export declare function prefetchedResponse(prefetched: Map<string, BatchEntry>, url: string): {
     body: any;

package/types/lib/inventory/fetchBatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetchBatch.d.ts","sourceRoot":"","sources":["../../../lib/inventory/fetchBatch.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AA8EH;;;GAGG;AACH,wBAAgB,cAAc,IAHjB,MAAM,GAAC,IAAI,CAKvB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAFtB,OAAO,CASnB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,SAO1C;AAKE,YAAkB,UAAU,GAC5B;;;;IAAoB,EAAE,EAAX,OAAO,CAClB;;;;IAAe,IAAI,AAAnB,CACA,EADW,GAAC,CACZ;;;;IAAoB,MAAM,AAA1B,CACA,EADW,MAAM,CACjB;;;;;IAAqB,QAAQ,AAA7B,CAEF,EAFa,OAAO,CAEpB;CAAA,CAAA;AAoCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EARhC,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,CAAC,MAAM,GAAC,MAAM,GAAC,QAAQ,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAQnF,EAAE,OAAO,AANjD,CAEA,EADA;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;CAIsD,GAJ5C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAgC5C;AAoCD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAHtB,MAAM,GAAC,IAGe,GAFpB,OAAO,CAQnB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAH1B,MAAM,GAAC,IAGmB,GAFxB,OAAO,CAOnB;AAwZD;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAHzC,KAGyC,GAFvC,IAAI,CAuBhB;AAqGD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,iBAAiB,CAL1B,CAAC,EAK0B,GAAG,EAJhC,MAIgC,EAAE,KAAK,EAHvC,MAAM,OAAO,CAAC,CAAC,CAGwB,GAFrC,OAAO,CAAC,CAAC,CAAC,CAiBtB;AAyFD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EARlC,GAAG,CAAC,MAAM,EAAE,UAAU,CAQY,EAAE,GAAG,EAPvC,MAOuC,GANrC;IAAC,IAAI,EAAE,GAAC,CAAA;CAAC,GAAC,SAAS,CAoB/B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,IAFlB,OAAO,CAOnB"}
+{"version":3,"file":"fetchBatch.d.ts","sourceRoot":"","sources":["../../../lib/inventory/fetchBatch.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AA0HH;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAH3B,MAAM,GAAC,IAGoB,GAFzB,OAAO,CAenB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EATK,MASL,EACJ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAmC,EAAE,AAT7D,CAKA,EALQ;IAAC,OAAO,CAAC,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CASjB,GAJxD,IAAI,CA8ChB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAFpB,IAAI,CAKhB;AA8KD;;;GAGG;AACH,wBAAgB,cAAc,IAHjB,MAAM,GAAC,IAAI,CAKvB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAFtB,OAAO,CASnB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,SAO1C;AAKE,YAAkB,UAAU,GAC5B;;;;IAAoB,EAAE,EAAX,OAAO,CAClB;;;;IAAe,IAAI,AAAnB,CACA,EADW,GAAC,CACZ;;;;IAAoB,MAAM,AAA1B,CACA,EADW,MAAM,CACjB;;;;;IAAqB,QAAQ,AAA7B,CAEA,EAFW,OAAO,CAElB;;;;;IAAoB,OAAO,AAA3B,CAEF,EAFa,MAAM,CAEnB;CAAA,CAAA;AAoCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EARhC,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,CAAC,MAAM,GAAC,MAAM,GAAC,QAAQ,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAQnF,EAAE,OAAO,AANjD,CAEA,EADA;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;CAIsD,GAJ5C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CA4D5C;AA0DD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAHtB,MAAM,GAAC,IAGe,GAFpB,OAAO,CAQnB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAH1B,MAAM,GAAC,IAGmB,GAFxB,OAAO,CAOnB;AA+cD;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAHzC,KAGyC,GAFvC,IAAI,CAuBhB;AAkID;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,iBAAiB,CAN1B,CAAC,EAM0B,GAAG,EALhC,MAKgC,EAAE,KAAK,EAJvC,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAIY,EAAE,EAAE,SAAS,EAAE,AAH9D,CACA,EADQ;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAGuC,GAFzD,OAAO,CAAC,CAAC,CAAC,CAoCtB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EANvB,MAMuB,EAAE,OAAO,AALxC,CACA,EADQ,MAKqC,GAJnC,OAAO,CAAC,MAAM,CAAC,CA8B3B;AA6GD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAVlC,GAAG,CAAC,MAAM,EAAE,UAAU,CAUY,EAAE,GAAG,EATvC,MASuC,GARrC;IAAC,IAAI,EAAE,GAAC,CAAA;CAAC,GAAC,SAAS,CAoB/B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,IAFlB,OAAO,CAOnB"}

package/types/lib/inventory/fetchDiskCache.d.ts

@@ -0,0 +1,169 @@
+/**
+ * The on-disk response cache of the JS batch pool.
+ *
+ * cdxrs keeps registry JSON on disk between runs. The requests it cannot carry
+ * run on the JS pool instead: crates.io and package.elm-lang.org, which have
+ * one rate gate in JS; the GitHub API, whose quota headers cdxrs does not
+ * report; HTML pages such as pkg.go.dev and podspecs; and POMs. Without a disk
+ * cache of their own, the most tightly limited hosts were asked again on every
+ * run. All of them are kept here, in the cdxrs layout and under the same rules:
+ *
+ * - `<cacheDir>/cdxrs-fetch/<host>/<hash>.json`, written atomically, mode 0600,
+ *   with the URL redacted;
+ * - keyed by URL, method, `Accept` and the auth realm, hashed as cdxrs hashes
+ *   them, so a JSON entry either side writes serves the other. A text body adds
+ *   its type to the key, so cdxrs never reads it as JSON;
+ * - fresh for `CDXGEN_CACHE_TTL` seconds (24 hours by default, 0 for never);
+ *   a stale entry with an ETag or Last-Modified is revalidated, and is served
+ *   when the server fails;
+ * - loopback hosts are not cached unless `CDXGEN_CACHE_LOOPBACK=1`;
+ * - least recently used entries are removed past 256 MB.
+ *
+ * Two rules are the JS pool's own. A release POM never changes once published,
+ * so it does not expire. A 404 or 410 is kept for the same TTL, or for 24
+ * hours when the TTL is 0, under a key of its own that cdxrs never reads.
+ *
+ * Requests that carry their own headers, such as a registry token, are never
+ * cached here, and nothing is read or written during a dry run, for a host
+ * outside `CDXGEN_ALLOWED_HOSTS`, or over plain HTTP in secure mode, so the
+ * cache never answers a request the policy would have refused. The directory
+ * is cdxgen's own, and its files are written as cdxrs writes them, without an
+ * activity record per entry.
+ */
+export type DiskCacheKey = {
+    /**
+     * Request URL.
+     */
+    url: string;
+    /**
+     * `Accept` header.
+     */
+    accept?: string;
+    /**
+     * Identity of the credential, never itself.
+     */
+    authRealm?: string;
+    /**
+     * `json`, `text` or `buffer`.
+     */
+    responseType?: string;
+};
+export type DiskCacheEntry = {
+    /**
+     * Schema version.
+     */
+    v: number;
+    /**
+     * Redacted URL.
+     */
+    url: string;
+    /**
+     * Always `GET`.
+     */
+    method: string;
+    /**
+     * HTTP status.
+     */
+    status: number;
+    /**
+     * ETag validator.
+     */
+    etag: string | null;
+    /**
+     * Last-Modified validator.
+     */
+    last_modified: string | null;
+    /**
+     * Unix seconds when fetched or revalidated.
+     */
+    fetched_at: number;
+    /**
+     * Response body.
+     */
+    body: any;
+    /**
+     * Never expires.
+     */
+    immutable?: boolean;
+};
+/**
+ * Hash of a cache key, as cdxrs computes it for a JSON response.
+ *
+ * @param {DiskCacheKey} key Cache key.
+ * @param {{miss?: boolean}} [opts] Whether this is the key of a recorded miss.
+ * @returns {string}
+ */
+export declare function diskCacheKeyHash(key: DiskCacheKey, { miss }?: {
+    miss?: boolean;
+}): string;
+/**
+ * Whether the disk cache may serve or store a request.
+ *
+ * @param {{url: string, headers?: Object, responseType?: string}} request
+ * @returns {boolean}
+ */
+export declare function diskCacheable(request: {
+    url: string;
+    headers?: Object;
+    responseType?: string;
+}): boolean;
+export type DiskCacheLookup = {
+    /**
+     * `fresh` and `miss` are
+     * answers; `stale` needs revalidation; `none` means nothing is stored.
+     */
+    state: "fresh" | "stale" | "miss" | "none";
+    /**
+     * The stored entry.
+     */
+    entry?: DiskCacheEntry;
+};
+/**
+ * @typedef {Object} DiskCacheLookup
+ * @property {"fresh"|"stale"|"miss"|"none"} state `fresh` and `miss` are
+ *   answers; `stale` needs revalidation; `none` means nothing is stored.
+ * @property {DiskCacheEntry} [entry] The stored entry.
+ */
+/**
+ * Look a request up.
+ *
+ * @param {DiskCacheKey} key Cache key.
+ * @returns {DiskCacheLookup}
+ */
+export declare function diskCacheGet(key: DiskCacheKey): DiskCacheLookup;
+/**
+ * Store a successful response.
+ *
+ * @param {DiskCacheKey} key Cache key.
+ * @param {{statusCode: number, headers?: Object, body: *}} response Response.
+ * @returns {void}
+ */
+export declare function diskCachePut(key: DiskCacheKey, response: {
+    statusCode: number;
+    headers?: Object;
+    body: any;
+}): void;
+/**
+ * Record that a request answered 404 or 410, and forget any body stored for it.
+ *
+ * @param {DiskCacheKey} key Cache key.
+ * @param {number} status HTTP status.
+ * @returns {void}
+ */
+export declare function diskCachePutMiss(key: DiskCacheKey, status: number): void;
+/**
+ * Mark a stale entry fresh again after a 304.
+ *
+ * @param {DiskCacheKey} key Cache key.
+ * @param {DiskCacheEntry} entry The stale entry.
+ * @param {Object} [headers] Headers of the 304, which may carry new validators.
+ * @returns {void}
+ */
+export declare function diskCacheRefresh(key: DiskCacheKey, entry: DiskCacheEntry, headers?: Object): void;
+/**
+ * Forget which host directories were swept. Tests only.
+ *
+ * @returns {void}
+ */
+export declare function resetDiskCacheState(): void;
+//# sourceMappingURL=fetchDiskCache.d.ts.map

package/types/lib/inventory/fetchDiskCache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetchDiskCache.d.ts","sourceRoot":"","sources":["../../../lib/inventory/fetchDiskCache.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAgDA,YAAkB,YAAY,GAC9B;;;;IAAmB,GAAG,EAAX,MAAM,CACjB;;;;IAAoB,MAAM,AAA1B,CACA,EADW,MAAM,CACjB;;;;IAAoB,SAAS,AAA7B,CACA,EADW,MAAM,CACjB;;;;IAAoB,YAAY,AAAhC,CACF,EADa,MAAM,CACnB;CAAA,CAAA;AAGE,YAAkB,cAAc,GAChC;;;;IAAmB,CAAC,EAAT,MAAM,CACjB;;;;IAAmB,GAAG,EAAX,MAAM,CACjB;;;;IAAmB,MAAM,EAAd,MAAM,CACjB;;;;IAAmB,MAAM,EAAd,MAAM,CACjB;;;;IAAwB,IAAI,EAAjB,MAAM,GAAC,IAAI,CACtB;;;;IAAwB,aAAa,EAA1B,MAAM,GAAC,IAAI,CACtB;;;;IAAmB,UAAU,EAAlB,MAAM,CACjB;;;;IAAc,IAAI,EAAP,GAAC,CACZ;;;;IAAqB,SAAS,AAA9B,CACF,EADa,OAAO,CACpB;CAAA,CAAA;AAgED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAJzB,YAIyB,EAAE,EAAE,IAAY,EAAE,AAHnD,CACA,EADQ;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAGiC,GAF9C,MAAM,CAYlB;AAmDD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAG3B,GAFxB,OAAO,CA6BnB;AA2EE,YAAkB,eAAe,GACjC;;;;;IAA0C,KAAK,EAApC,OAAO,GAAC,OAAO,GAAC,MAAM,GAAC,MAAM,CAExC;;;;IAA4B,KAAK,AAAjC,CACF,EADa,cAAc,CAC3B;CAAA,CAAA;AALD;;;;;GAKG;AAEH;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAHrB,YAGqB,GAFnB,eAAe,CAwB3B;AAkCD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAJrB,YAIqB,EAAE,QAAQ,EAH/B;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,GAAC,CAAA;CAGf,GAF7B,IAAI,CAwBhB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAJzB,YAIyB,EAAE,MAAM,EAHjC,MAGiC,GAF/B,IAAI,CAqBhB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,YAKyB,EAAE,KAAK,EAJhC,cAIgC,EAAE,OAAO,AAHjD,CACA,EADQ,MAG8C,GAF5C,IAAI,CAahB;AAyGD;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,IAAI,CAKhB"}

package/types/lib/inventory/forgeEnricher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forgeEnricher.d.ts","sourceRoot":"","sources":["../../../lib/inventory/forgeEnricher.js"],"names":[],"mappings":"AAkDA;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,IAAI,CAa9C;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAL9B,MAK8B,EAAE,SAAS,EAJzC,KAAK,CAAC,MAAM,CAI6B,EAAE,OAAO,GAHlD,MAGuD,GAFrD,OAAO,CAAC,MAAM,CAAC,CA4M3B"}
+{"version":3,"file":"forgeEnricher.d.ts","sourceRoot":"","sources":["../../../lib/inventory/forgeEnricher.js"],"names":[],"mappings":"AA2DA;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,IAAI,CAa9C;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAL9B,MAK8B,EAAE,SAAS,EAJzC,KAAK,CAAC,MAAM,CAI6B,EAAE,OAAO,GAHlD,MAGuD,GAFrD,OAAO,CAAC,MAAM,CAAC,CA4M3B"}