@cdxgen/cdxgen 13.3.0 → 13.4.0

package/types/lib/parsers/compileCommands.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Pure reader for JSON compilation databases (`compile_commands.json`).
+ *
+ * Each entry names a translation unit (`file`), the directory its command ran
+ * in (`directory`) and the command, either as an argument list (`arguments`)
+ * or as one command line (`command`) split with the quoting rules of the
+ * shell it was written for. From the entries this module derives the
+ * compilers a build uses, the include directories each unit is compiled
+ * with, and the security-hardening options in effect.
+ *
+ * Layer 1: data in, data out. Locating and reading the file, and running a
+ * compiler to learn its version, belong to the callers.
+ */
+/**
+ * Split a POSIX shell command line into words: single quotes keep everything
+ * literally, double quotes keep everything except `\"`, `\\`, `\$` and
+ * `` \` ``, and a backslash outside quotes escapes the next character.
+ *
+ * @param {string} command Command line
+ * @returns {string[]} Words
+ */
+export declare function splitPosixCommand(command: string): string[];
+/**
+ * Split a Windows command line into words as the Microsoft C runtime does:
+ * double quotes group, `\"` is a literal quote, and backslashes are literal
+ * unless they precede a quote.
+ *
+ * @param {string} command Command line
+ * @returns {string[]} Words
+ */
+export declare function splitWindowsCommand(command: string): string[];
+/**
+ * The compiler family a driver's name implies.
+ *
+ * @param {string} driver Driver path or name
+ * @returns {string} `msvc`, `clang-cl`, `clang`, `gcc`, `nvcc`, `icx`,
+ *   `icc`, `nvhpc`, `edg` or `unknown`
+ */
+export declare function compilerFamilyOfName(driver: string): string;
+/**
+ * The argument list of a database entry, with any compiler launcher
+ * (`ccache`, `sccache`, ...) removed so the first argument is the compiler.
+ *
+ * @param {Object} entry Database entry
+ * @returns {string[]} Arguments
+ */
+export declare function entryArguments(entry: Object): string[];
+/**
+ * The language a unit is compiled as: from `-x`/`/TP`/`/TC`, the driver
+ * name, then the file extension.
+ *
+ * @param {string[]} args Arguments, compiler first
+ * @param {string} file Translation unit
+ * @returns {string} `c`, `c++`, `cuda` or `unknown`
+ */
+export declare function unitLanguage(args: string[], file: string): string;
+/**
+ * The include directories a unit is compiled with, as absolute paths.
+ *
+ * @param {string[]} args Arguments, compiler first
+ * @param {string} directory The entry's working directory
+ * @returns {string[]} Directories, in command order
+ */
+export declare function includeDirectories(args: string[], directory: string): string[];
+/**
+ * The security-hardening settings an argument list turns on or off. Later
+ * options override earlier ones, as they do for the compiler.
+ *
+ * @param {string[]} args Compiler or linker arguments
+ * @returns {Map<string, string>} Setting name to value:
+ *   `fortifySource` (level), `stackProtector` (`on`, `strong`, `all`,
+ *   `off`), `pie` (`on`/`off`), `relro` (`partial`/`full`, from `-z relro`
+ *   and `-z now`), `cfProtection` (`full`, `branch`, `return`, `none`),
+ *   `sanitizers` (comma-separated), `glibcxxAssertions` (`on`),
+ *   `stackClashProtection` (`on`/`off`), `msvcBufferSecurityCheck` (`/GS`
+ *   `on`/`off`), `msvcControlFlowGuard` (`on`/`off`)
+ */
+export declare function hardeningSettings(args: string[]): Map<string, string>;
+/**
+ * Summarise a compilation database.
+ *
+ * @param {Object[]} entries Parsed database (a JSON array)
+ * @returns {{
+ *   units: number,
+ *   compilers: Map<string, {driver: string, family: string, units: number, languages: Set<string>}>,
+ *   includeDirectories: Set<string>,
+ *   hardening: Map<string, Map<string, number>>,
+ * }} `compilers` is keyed by the driver as written; `hardening` maps each
+ *   setting to the number of units per value
+ */
+export declare function summarizeCompileDatabase(entries: Object[]): {
+    units: number;
+    compilers: Map<string, {
+        driver: string;
+        family: string;
+        units: number;
+        languages: Set<string>;
+    }>;
+    includeDirectories: Set<string>;
+    hardening: Map<string, Map<string, number>>;
+};
+/**
+ * Read a compiler's family and version from what it prints for `--version`
+ * (or, for MSVC, on start-up).
+ *
+ * @param {string} banner Output of the version query
+ * @param {string} [nameFamily] Family implied by the driver's name
+ * @returns {{family: string, version: string|undefined, edgFrontEnd: boolean}}
+ */
+export declare function classifyCompilerBanner(banner: string, nameFamily?: string): {
+    family: string;
+    version: string | undefined;
+    edgFrontEnd: boolean;
+};
+//# sourceMappingURL=compileCommands.d.ts.map

package/types/lib/parsers/compileCommands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compileCommands.d.ts","sourceRoot":"","sources":["../../../lib/parsers/compileCommands.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAcH;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,GAF5B,MAAM,EAAE,CAoDpB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,GAF9B,MAAM,EAAE,CA6CpB;AAQD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAJhC,MAIgC,GAH9B,MAAM,CAwClB;AAKD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAHzB,MAGyB,GAFvB,MAAM,EAAE,CA8BpB;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAAM,EAIgB,EAAE,IAAI,EAH5B,MAG4B,GAF1B,MAAM,CA6ClB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAJ5B,MAAM,EAIsB,EAAE,SAAS,EAHvC,MAGuC,GAFrC,MAAM,EAAE,CAwCpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAT3B,MAAM,EASqB,GARzB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAgH/B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EATrC,MAAM,EAS+B,GARnC;IACR,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;KAAC,CAAC,CAAC;IAChG,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC7C,CA0CH;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAJlC,MAIkC,EAAE,UAAU,AAHtD,CACA,EADQ,MAG0D,GAFxD;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAC,SAAS,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAC,CA4B7E"}

package/types/lib/parsers/strictJson.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Strict JSON reading for signed documents.
+ *
+ * JSF signs the RFC 8785 (JCS) form of a document, and JCS is defined over
+ * I-JSON (RFC 7493) input. `JSON.parse` and lenient UTF-8 decoding accept
+ * things I-JSON rules out, and each lets two parsers read different values
+ * from the same signed bytes:
+ *
+ * - a member name repeated within one object, where `JSON.parse` keeps the last
+ *   value and other parsers keep the first or refuse the document;
+ * - a number an IEEE 754 double cannot hold exactly, which JavaScript rounds
+ *   while arbitrary-precision parsers keep every digit;
+ * - bytes that are not UTF-8, which lenient decoders turn into U+FFFD while
+ *   others refuse them or read another encoding;
+ * - an unpaired UTF-16 surrogate escape, which some parsers keep and others
+ *   replace.
+ *
+ * {@link parseStrictJson} rejects all of them, so the values a verifier checks
+ * are the values every consumer of the document reads.
+ */
+/**
+ * Raised when JSON text is well-formed but breaks one of the rules above.
+ */
+export declare class StrictJsonError extends Error {
+    pointer: string;
+    /**
+     * @param {string} message - Description of the problem
+     * @param {string} pointer - RFC 6901 JSON Pointer to the offending member or value
+     */
+    constructor(message: string, pointer: string);
+}
+/**
+ * Parses JSON the way `JSON.parse` does, but refuses bytes that are not UTF-8,
+ * repeated member names within an object, numbers that an IEEE 754 double
+ * cannot hold exactly, and unpaired UTF-16 surrogates.
+ *
+ * Pass the raw bytes of a document rather than text decoded elsewhere, so that
+ * invalid UTF-8 is detected instead of being replaced by U+FFFD.
+ *
+ * @param {string|Uint8Array} input - JSON text, or its UTF-8 bytes
+ * @returns {any} - The parsed value
+ * @throws {SyntaxError} When the text is not JSON
+ * @throws {StrictJsonError} When the input breaks one of the rules above
+ */
+export declare function parseStrictJson(input: string | Uint8Array): any;
+//# sourceMappingURL=strictJson.d.ts.map

package/types/lib/parsers/strictJson.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strictJson.d.ts","sourceRoot":"","sources":["../../../lib/parsers/strictJson.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;GAEG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IAQjC,OAAO;IAPd;;;OAGG;IACH,YAAY,OAAO,EAHR,MAGQ,EAAE,OAAO,EAFjB,MAEiB,EAI3B;CACF;AAoQD;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAL1B,MAAM,GAAC,UAKmB,GAJxB,GAAG,CAkBf"}

package/types/lib/parsers/terraformConfig.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Pure extractor for the Terraform / OpenTofu configuration files in one
+ * directory: `*.tf`, `*.tf.json`, `*.tofu` and `*.tofu.json`.
+ *
+ * Only three things in a configuration matter for a BOM: the `module` blocks
+ * (name, `source`, `version`), the `required_providers` entries inside the
+ * `terraform` block, and `required_version`. Full HCL is a much larger
+ * grammar, so this module scans characters directly — comments, quoted
+ * strings with `${…}`/`%{…}` template sequences, heredocs, and
+ * bracket-depth-aware attribute boundaries — and skips everything else with
+ * balanced matching. It never throws and always terminates: every loop either
+ * consumes input or stops at EOF.
+ *
+ * An expression counts as a literal only when it is exactly one quoted string
+ * without template sequences; module inputs, provider configuration and
+ * backend settings are never captured, let alone emitted.
+ */
+/**
+ * Parse one configuration file.
+ *
+ * @param {string} text File contents
+ * @param {Object} [options]
+ * @param {boolean} [options.json] Parse as the JSON variant (`.tf.json`)
+ * @returns {{ moduleCalls: object[], requiredProviders: object[], requiredVersions: string[], errors: string[] }}
+ */
+export declare function parseTerraformConfig(text: string, { json }?: {
+    json?: boolean;
+}): {
+    moduleCalls: object[];
+    requiredProviders: object[];
+    requiredVersions: string[];
+    errors: string[];
+};
+/**
+ * Whether a file is a Terraform override file: base name `override` or ending
+ * `_override`, with a `.tf`/`.tf.json`/`.tofu`/`.tofu.json` extension.
+ *
+ * @param {string} fileName File name (a bare name or a path)
+ * @returns {boolean}
+ */
+export declare function isTerraformOverrideFile(fileName: string): boolean;
+/**
+ * Split one directory's configuration file names into primary and override
+ * files, applying OpenTofu's `.tofu` precedence when any `.tofu` file exists.
+ *
+ * @param {string[]} fileNames File names within a single directory
+ * @returns {{ primary: string[], overrides: string[] }} Sorted lists
+ */
+export declare function terraformConfigFileSet(fileNames: string[]): {
+    primary: string[];
+    overrides: string[];
+};
+/**
+ * Merge parsed configuration files (primary files first, then overrides, each
+ * group in the given order).
+ *
+ * @param {{ file: string, override: boolean, result: object }[]} parsedFiles
+ * @returns {{ moduleCalls: object[], requiredProviders: object[], requiredVersions: string[], errors: string[] }}
+ */
+export declare function mergeTerraformConfigs(parsedFiles: {
+    file: string;
+    override: boolean;
+    result: object;
+}[]): {
+    moduleCalls: object[];
+    requiredProviders: object[];
+    requiredVersions: string[];
+    errors: string[];
+};
+//# sourceMappingURL=terraformConfig.d.ts.map

package/types/lib/parsers/terraformConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terraformConfig.d.ts","sourceRoot":"","sources":["../../../lib/parsers/terraformConfig.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAL9B,MAK8B,EAAE,EAAE,IAAY,EAAE,AAJxD,CAEA,EADA;IAA0B,IAAI,AAA9B,CACA,EADQ,OAAO,CACf;CAE6D,GAFnD;IAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAYhH;AA+2BD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAHrC,MAGqC,GAFnC,OAAO,CAanB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAHrC,MAAM,EAG+B,GAFnC;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA8CtD;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAHtC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAGb,GAFpC;IAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CA2EhH"}

package/types/lib/parsers/terraformSource.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Pure parser for Terraform / OpenTofu module and provider source addresses.
+ *
+ * A module `source` argument can be a local path, a registry shorthand, a git
+ * URL (forced with `git::` or detected from a github.com/gitlab.com/bitbucket.org
+ * host or an scp-style `git@host:path` string), a mercurial URL, or an archive
+ * URL over http/s3/gcs. The grammar is go-getter's: an optional `<getter>::`
+ * prefix, a base address, an optional `//subdirectory` suffix that starts after
+ * the `://` of a URL when one is present, and go-getter query parameters such
+ * as `ref`, `rev`, `checksum` and `archive`.
+ *
+ * Source strings are untrusted and can carry credentials (URL passwords, the
+ * git `sshkey` parameter, S3 keys), so this module never returns the raw input.
+ * The `url` field is rebuilt from parsed, sanitized pieces — userinfo, query
+ * and fragment removed — and `displaySource` is assembled from those pieces
+ * only. `credentialInSource` flags that a secret-shaped parameter was present
+ * without repeating it.
+ *
+ * Layer 1: no filesystem, no network, no purl construction. Callers turn the
+ * returned plain data into components and purls.
+ */
+export declare const TERRAFORM_REGISTRY_HOST = "registry.terraform.io";
+export declare const OPENTOFU_REGISTRY_HOST = "registry.opentofu.org";
+/**
+ * Parse a module `source` argument into a classified descriptor.
+ *
+ * @param {string} source Module source string as written in the configuration
+ * @param {Object} [options]
+ * @param {string} [options.defaultRegistryHost] Host for 3-segment registry
+ *   shorthand (`registry.terraform.io` unless the caller knows better)
+ * @returns {null|Object} `null` for non-strings, otherwise a descriptor whose
+ *   `kind` is `local`, `registry`, `git`, `hg`, `http`, `s3`, `gcs`, `file` or
+ *   `unknown`
+ */
+export declare function parseModuleSource(source: string, { defaultRegistryHost }?: {
+    defaultRegistryHost?: string;
+}): null | Object;
+/**
+ * Parse a `required_providers` source string into a provider address.
+ *
+ * @param {string} source Provider source such as `hashicorp/aws` or
+ *   `registry.terraform.io/hashicorp/aws`
+ * @param {Object} [options]
+ * @param {string} [options.defaultRegistryHost] Host for 2-segment shorthand
+ * @returns {null|Object} `{ host, namespace, type, address }` lower-cased,
+ *   `{ builtin: true }` for `terraform.io/builtin/*`, or `null`
+ */
+export declare function parseProviderSource(source: string, { defaultRegistryHost }?: {
+    defaultRegistryHost?: string;
+}): null | Object;
+/**
+ * Classify a module `version` constraint by how tightly it pins.
+ *
+ * @param {string} constraint Constraint string from the configuration
+ * @returns {Object} `{ pinning: "exact", version }`, `{ pinning: "range" }` or
+ *   `{ pinning: "none" }`
+ */
+export declare function classifyVersionConstraint(constraint: string): Object;
+/**
+ * Classify a git/hg ref by how immutably it identifies a commit.
+ *
+ * @param {string} ref Ref value from `?ref=` or `?rev=`
+ * @returns {"sha"|"tag"|"branch"|"none"}
+ */
+export declare function classifyVcsRef(ref: string): "sha" | "tag" | "branch" | "none";
+//# sourceMappingURL=terraformSource.d.ts.map

package/types/lib/parsers/terraformSource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terraformSource.d.ts","sourceRoot":"","sources":["../../../lib/parsers/terraformSource.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,eAAO,MAAM,uBAAuB,0BAA0B,CAAC;AAC/D,eAAO,MAAM,sBAAsB,0BAA0B,CAAC;AA8D9D;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAR7B,MAQ6B,EAAE,EAAE,mBAAmB,EAAE,AAP9D,CAGA,EAFA;IAAyB,mBAAmB,AAA5C,CAEA,EAFQ,MAAM,CAEd;CAImE,GAJzD,IAAI,GAAC,MAAM,CA8IvB;AA8TD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAP/B,MAO+B,EAAE,EAAE,mBAAmB,EAAE,AALhE,CAEA,EADA;IAAyB,mBAAmB,AAA5C,CACA,EADQ,MAAM,CACd;CAGqE,GAH3D,IAAI,GAAC,MAAM,CA6CvB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAJzC,MAIyC,GAHvC,MAAM,CAmBlB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB,KAAK,GAAC,KAAK,GAAC,QAAQ,GAAC,MAAM,CAgBvC"}

package/types/lib/server/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../lib/server/server.js"],"names":[],"mappings":"AAWA,OAAO,EACL,iBAAiB,EAGlB,MAAM,qBAAqB,CAAC;AAsE7B,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAc7B;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAJnB,MAAM,GAAC,MAAM,GAAC,KAAK,CAAC,MAAM,GAAC,MAAM,CAId,GAHjB,MAAM,GAAC,MAAM,GAAC,OAAO,GAAC,KAAK,CAAC,MAAM,GAAC,MAAM,GAAC,OAAO,CAAC,CAwC9D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EALvB,MAKuB,EAAE,IAAI,AAJrC,CACA,EADQ,MAIkC,EAAE,OAAO,AAHnD,CACA,EADQ,MAGgD,GAF9C,MAAM,CAmBlB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB,MAAM,CAiClB;AAiBD;;;;;GAKG;AACH,QAAA,MAAM,eAAe,iBAHV,OAAO,WAAW,EAAE,MAAM,KACxB,IAOZ,CAAC;AAIF;;;;;;;;;GASG;AACH,QAAA,MAAM,KAAK,YAHA,MAAM,KACJ,IAuWZ,CAAC;AAEF,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../lib/server/server.js"],"names":[],"mappings":"AAWA,OAAO,EACL,iBAAiB,EAGlB,MAAM,qBAAqB,CAAC;AAuE7B,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAc7B;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAJnB,MAAM,GAAC,MAAM,GAAC,KAAK,CAAC,MAAM,GAAC,MAAM,CAId,GAHjB,MAAM,GAAC,MAAM,GAAC,OAAO,GAAC,KAAK,CAAC,MAAM,GAAC,MAAM,GAAC,OAAO,CAAC,CAwC9D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EALvB,MAKuB,EAAE,IAAI,AAJrC,CACA,EADQ,MAIkC,EAAE,OAAO,AAHnD,CACA,EADQ,MAGgD,GAF9C,MAAM,CAmBlB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB,MAAM,CAiClB;AAiBD;;;;;GAKG;AACH,QAAA,MAAM,eAAe,iBAHV,OAAO,WAAW,EAAE,MAAM,KACxB,IAOZ,CAAC;AAwBF;;;;;;;;;GASG;AACH,QAAA,MAAM,KAAK,YAHA,MAAM,KACJ,IAyWZ,CAAC;AAEF,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC"}

package/types/lib/stages/postgen/postgen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postgen.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/postgen.js"],"names":[],"mappings":"AAiiBA;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,SAAS,EANhC,MAMgC,EAAE,OAAO,EALzC,MAKyC,EAAE,QAAQ,AAJ3D,CAEA,EAFQ,MAImD,GAFjD,OAAO,CAAC,MAAM,CAAC,CAsE3B;AAgHD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAL1B,MAK0B,EAAE,OAAO,EAJnC,MAImC,GAFjC,MAAM,CA6IlB;AAuCD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAL3B,MAK2B,EAAE,OAAO,EAJpC,MAIoC,GAFlC,MAAM,CAqClB;AAqHD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EALvC,MAKuC,EAAE,OAAO,EAJhD,MAIgD,GAF9C,MAAM,EAAE,CAmBpB;AAgBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EALrC,MAKqC,EAAE,OAAO,EAJ9C,MAI8C,GAF5C,MAAM,CAiClB;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,EALtB,MAKsB,EAAE,OAAO,EAJ/B,MAI+B,GAF7B,MAAM,CAoNlB;AAUD;;GAEG;AACH,wBAAgB,UAAU,CAAC,QAAQ,KAAA,QAUlC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,IAFhB,IAAI,CAYhB;AAMD;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EALrB,MAKqB,EAAE,OAAO,EAJ9B,MAI8B,GAF5B,MAAM,CA2HlB"}
+{"version":3,"file":"postgen.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/postgen.js"],"names":[],"mappings":"AAiiBA;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,SAAS,EANhC,MAMgC,EAAE,OAAO,EALzC,MAKyC,EAAE,QAAQ,AAJ3D,CAEA,EAFQ,MAImD,GAFjD,OAAO,CAAC,MAAM,CAAC,CAsE3B;AAgHD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAL1B,MAK0B,EAAE,OAAO,EAJnC,MAImC,GAFjC,MAAM,CA2JlB;AAuCD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAL3B,MAK2B,EAAE,OAAO,EAJpC,MAIoC,GAFlC,MAAM,CAqClB;AAqHD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EALvC,MAKuC,EAAE,OAAO,EAJhD,MAIgD,GAF9C,MAAM,EAAE,CAmBpB;AAgBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EALrC,MAKqC,EAAE,OAAO,EAJ9C,MAI8C,GAF5C,MAAM,CAiClB;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,EALtB,MAKsB,EAAE,OAAO,EAJ/B,MAI+B,GAF7B,MAAM,CAoNlB;AAUD;;GAEG;AACH,wBAAgB,UAAU,CAAC,QAAQ,KAAA,QAUlC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,IAFhB,IAAI,CAYhB;AAMD;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EALrB,MAKqB,EAAE,OAAO,EAJ9B,MAI8B,GAF5B,MAAM,CA2HlB"}

package/types/lib/stages/postgen/specVersionCompat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"specVersionCompat.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/specVersionCompat.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA0SH;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,MAAM,CAclB;AAmRD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAJ1C,MAI0C,EAAE,OAAO,EAHnD,MAGmD,GAFjD,MAAM,CA6BlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAL9B,MAK8B,EAAE,MAAM,AAJ9C,CACA,EADQ,MAI2C,EAAE,KAAK,AAH1D,CACA,EADQ,GAAG,CAAC,MAAM,CAGoD,GAF5D,GAAG,CAAC,MAAM,CAAC,CAkBvB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAJxC,MAIwC,EAAE,iBAAiB,EAH3D,MAG2D,GAFzD,MAAM,EAAE,CAOpB"}
+{"version":3,"file":"specVersionCompat.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/specVersionCompat.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAqTH;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,MAAM,CAclB;AAwSD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAJ1C,MAI0C,EAAE,OAAO,EAHnD,MAGmD,GAFjD,MAAM,CA6BlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAL9B,MAK8B,EAAE,MAAM,AAJ9C,CACA,EADQ,MAI2C,EAAE,KAAK,AAH1D,CACA,EADQ,GAAG,CAAC,MAAM,CAGoD,GAF5D,GAAG,CAAC,MAAM,CAAC,CAkBvB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAJxC,MAIwC,EAAE,iBAAiB,EAH3D,MAG2D,GAFzD,MAAM,EAAE,CAOpB"}

package/types/lib/validator/index.d.ts

@@ -50,12 +50,14 @@ export declare function validateGeneratedBom(bomJson: object): Promise<{
  * @param {string} [options.publicKey]          If set, verify the BOM signature with this public key.
  * @param {string|Buffer} [options.secretKey]   If set, verify an HMAC (HS*) BOM signature with this shared secret.
  * @param {boolean} [options.nestedSignatures]  Also verify component, service, and annotation signatures (default true), as cdx-verify does.
+ *   Parse untrusted BOM text with `parseStrictJson()` from `lib/parsers/strictJson.js` when verifying signatures.
  * @returns {{
  *   schemaValid: boolean,
  *   deepValid: boolean,
  *   validationErrors: Array<{ stage: string, message: string }>,
  *   signatureVerified: boolean | null,
  *   signatureDetails: object | null,
+ *   signatureEntries: Array<{ index: number, algorithm: any, keyId: any, verified: boolean }> | null,
  *   findings: Array<object>,
  *   allFindings: Array<object>,
  *   benchmarks: Array<object>,
@@ -82,6 +84,12 @@ export declare function validateBomAdvanced(bomJson: object, options?: {
     }>;
     signatureVerified: boolean | null;
     signatureDetails: object | null;
+    signatureEntries: Array<{
+        index: number;
+        algorithm: any;
+        keyId: any;
+        verified: boolean;
+    }> | null;
     findings: Array<object>;
     allFindings: Array<object>;
     benchmarks: Array<object>;

package/types/lib/validator/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/validator/index.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAgBH;;;;;GAKG;AACH,QAAA,MAAM,cAAc,wBAAuD,CAAC;AA4D5E;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,CAAC,CAKrE;AAgDD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAxBtC,MAwBsC,EAAE,OAAO,AAvBvD,CAWA,EAVA;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAA0B,IAAI,AAA9B,CACA,EADQ,OAAO,CACf;IAAgC,UAAU,AAA1C,CACA,EADQ,KAAK,CAAC,MAAM,CAAC,CACrB;IAAgC,UAAU,AAA1C,CACA,EADQ,KAAK,CAAC,MAAM,CAAC,CACrB;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;IAAgC,SAAS,AAAzC,CACA,EADQ,MAAM,GAAC,MAAM,CACrB;IAA0B,gBAAgB,AAA1C,CACA,EADQ,OAAO,CACf;CAY4D,GAZlD;IACR,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,gBAAgB,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAA;CAChB,CA8DH;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAPtB,MAOsB,EAAE,IAAI,GALpC;IAAsB,YAAY,AAAlC,CACA,EADQ,MAAM,CACd;IAAuB,MAAM,AAA7B,CACA,EADQ,OAAO,CACf;IAAuB,gBAAgB,AAAvC,CACA,EADQ,OAAO,CACf;CAEyC,GAF/B;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CA0B1D;AAED,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/validator/index.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAgBH;;;;;GAKG;AACH,QAAA,MAAM,cAAc,wBAAuD,CAAC;AA4D5E;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,CAAC,CAKrE;AAgDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EA1BtC,MA0BsC,EAAE,OAAO,AAzBvD,CAYA,EAXA;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAA0B,IAAI,AAA9B,CACA,EADQ,OAAO,CACf;IAAgC,UAAU,AAA1C,CACA,EADQ,KAAK,CAAC,MAAM,CAAC,CACrB;IAAgC,UAAU,AAA1C,CACA,EADQ,KAAK,CAAC,MAAM,CAAC,CACrB;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;IAAgC,SAAS,AAAzC,CACA,EADQ,MAAM,GAAC,MAAM,CACrB;IAA0B,gBAAgB,AAA1C,CAEA,EAFQ,OAAO,CAEf;CAa4D,GAblD;IACR,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,gBAAgB,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,GAAG,CAAC;QAAC,KAAK,EAAE,GAAG,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IACjG,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAA;CAChB,CA2EH;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAPtB,MAOsB,EAAE,IAAI,GALpC;IAAsB,YAAY,AAAlC,CACA,EADQ,MAAM,CACd;IAAuB,MAAM,AAA7B,CACA,EADQ,OAAO,CACf;IAAuB,gBAAgB,AAAvC,CACA,EADQ,OAAO,CACf;CAEyC,GAF/B;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CA0B1D;AAED,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,CAAC"}

package/types/lib/validator/reporters/json.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../../../lib/validator/reporters/json.js"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAJlB,MAIkB,EAAE,QAAQ,AAHpC,CACA,EADQ,MAGiC,GAF/B,MAAM,CA6BlB"}
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../../../lib/validator/reporters/json.js"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAJlB,MAIkB,EAAE,QAAQ,AAHpC,CACA,EADQ,MAGiC,GAF/B,MAAM,CA8BlB"}