@cdxgen/cdxgen 13.3.0 → 13.5.0

package/types/lib/ecosystems/gradleutils.d.ts

@@ -1,10 +1,11 @@
+import { isProjectToolingAllowed } from "../core/projectTooling.js";
+export { isProjectToolingAllowed };
 /**
  * Method to return the gradle command to use.
  *
  * Project-local wrapper scripts (`gradlew`) are attacker-controlled files in
- * the scanned project, so they are only used when dependency tooling is
- * allowed (`options.installDeps !== false`); otherwise the system Gradle is
- * used.
+ * the scanned project, so they are only used when the project's own tooling
+ * may run (see isProjectToolingAllowed); otherwise the system Gradle is used.
  *
  * @param {string} srcPath Path to look for gradlew wrapper
  * @param {string|null} rootPath Root directory to look for gradlew wrapper
@@ -25,6 +26,18 @@ export declare function buildGradleCommandArguments(gradleArguments: string[], g
 /**
  * Method to split the output produced by Gradle using parallel processing by project
  *
+ * Gradle groups console output by task and prints a `> Task :path` header
+ * before each group, repeating it whenever a task's output resumes after
+ * another task's. Each group is therefore keyed by the project in its own
+ * header (`> Task :app:dependencies` belongs to `:app`), never by whatever
+ * report header happened to precede it, and the groups of one project are
+ * concatenated in order, so reordering or interrupting the task reports cannot
+ * move a report to another project or overwrite one (issue 4465). The groups
+ * of a root task (`:dependencies`) all take the root project's name from the
+ * `Root project '…'` header that only a root task prints, so a continuation
+ * group, which carries no report header, stays with the rest of the root
+ * report. The groups of other tasks are dropped along with their headers.
+ *
  * @param {string} rawOutput Full output produced by Gradle using parallel processing
  * @param {string[]} relevantTasks The list of gradle tasks whose output need to be considered.
  * @returns {map} Map with subProject names as keys and corresponding dependency task outputs as values.
@@ -166,19 +179,58 @@ _includeCacheDir?: boolean): Promise<Object>;
  * Method to return the mill command to use.
  *
  * The project-local `mill` script is an attacker-controlled file in the
- * scanned project, so it is only used when dependency tooling is allowed
- * (`options.installDeps !== false`).
+ * scanned project, so it is only used when the project's own tooling may run
+ * (see isProjectToolingAllowed).
  *
  * @param {string} srcPath Path to look for mill wrapper
  * @param {Object} [options] CLI options (`installDeps` gates wrapper use)
  */
 export declare function getMillCommand(srcPath: string, options?: Object): string;
+/**
+ * Determine the Mill version of a build.
+ *
+ * The version is read from the `.mill-version` file, from the
+ * `//| mill-version:` header of the build file, or from the launcher itself.
+ *
+ * @param {string} millRootPath Root of the Mill build
+ * @param {string} millCmd Mill command to use for the fallback probe
+ * @returns {string|null} The Mill version, or null when it cannot be determined
+ */
+export declare function getMillVersion(millRootPath: string, millCmd: string): string | null;
+/**
+ * Find the Mill daemons running under a tree.
+ *
+ * Daemons record their process id in `out/mill-daemon*` (Mill 1.x) or
+ * `out/mill-server*` directories, directly or one level below (Mill 0.12
+ * keeps one subdirectory per server). Only processes that are still alive
+ * are returned.
+ *
+ * @param {string} rootPath Tree to search
+ * @returns {Map<string, Set<number>>} Live daemon process ids by the root of
+ *   the build they belong to
+ */
+export declare function findMillDaemons(rootPath: string): Map<string, Set<number>>;
+/**
+ * Stop the Mill daemons that started under the scanned tree during the scan.
+ *
+ * cdxgen's own Mill calls run with --no-server, but a project build cdxgen
+ * runs can shell out to Mill without it and leave a daemon behind. Daemons
+ * that were already running when the scan started belong to the user, for
+ * example to an IDE, and are left alone; every other live daemon is shut
+ * down through the launcher of the build it belongs to.
+ *
+ * @param {string} rootPath Scanned tree
+ * @param {Map<string, Set<number>>} [runningBefore] Result of
+ *   {@link findMillDaemons} taken before the scan
+ * @param {Object} [options] CLI options
+ */
+export declare function stopMillDaemons(rootPath: string, runningBefore?: Map<string, Set<number>>, options?: Object): void;
 /**
  * Method to return the maven command to use.
  *
  * Project-local wrapper scripts (`mvnw`) are attacker-controlled files in the
- * scanned project, so they are only used when dependency tooling is allowed
- * (`options.installDeps !== false`); otherwise the installed Maven is used.
+ * scanned project, so they are only used when the project's own tooling may
+ * run (see isProjectToolingAllowed); otherwise the installed Maven is used.
  *
  * @param {string} srcPath Path to look for maven wrapper
  * @param {string} rootPath Root directory to look for maven wrapper

package/types/lib/ecosystems/gradleutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gradleutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/gradleutils.js"],"names":[],"mappings":"AAwCA;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAJ7B,MAI6B,EAAE,QAAQ,EAHvC,MAAM,GAAC,IAGgC,EAAE,OAAO,AAFxD,CACF,EADU,MAEqD,UAoG/D;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,eAAe,EARN,MAAM,EAQA,EACf,iBAAiB,EARR,MAAM,EAQE,EACjB,yBAAyB,EARhB,MAAM,EAQU,EACzB,mBAAmB,EARV,GAQU,GANR,MAAM,EAAE,CA2CpB;AAcD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAJ1C,MAI0C,EAAE,aAAa,EAHzD,MAAM,EAGmD,GAFvD,GAAG,CAqCf;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAFlC,MAEkC;;;EAsD5C;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAHpC,MAGoC,EAAE,gBAAgB,GAFtD,MAE6D;;;;;;;;EAoDvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAPM,MAON,EACH,cAAc,EAPL,KAOK,EACd,SAAS,GAPA,KAOK,EACd,OAAO,KAAK,GAND,MAAM,CAwFlB;AAiBD;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAF3B,IAAI,CAKhB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAF7B,OAAO,CAInB;AAiGD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EANzC,MAMyC,EAAE,OAAO,GAJ1D;IAAyB,OAAO,AAAhC,CACA,EADQ,MAAM,CACd;IAAyB,aAAa,AAAtC,CACA,EADQ,MAAM,CACd;CAE+D,GAFrD,IAAI,CA+HhB;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,SAAS,EANA,MAMA,EACT,eAAe,GANN,MAMe,EACxB,aAAa,GANJ,GAMgB,EACzB,cAAc,GANL,MAMU;;;;;;;;;GAkPpB;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,QAAQ,EAHpD,MAGoD,GAFlD,MAAM,CAkDlB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,gBAAgB,EAHjD,MAGiD,GAF/C,MAAM,CAkBlB;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAH5C,MAG4C,GAF1C,MAAM,CAuBlB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAHtC,MAGsC,GAFpC,MAAM,CA8ClB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAPD,MAOC,EACV,SAAS,EAPA,MAOA,EACT,QAAQ,GAPC,OAOM,EAAE,qCAAqC;AACtD,gBAAgB,GAPP,OAOe,GANb,OAAO,CAAC,MAAM,CAAC,CAgC3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,EAAE,OAAO,AAF5C,CACF,EADU,MAEyC,UAcnD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAJ5B,MAI4B,EAAE,QAAQ,EAHtC,MAGsC,EAAE,OAAO,AAFvD,CACF,EADU,MAEoD,UAsK9D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAH1C,MAG0C,GAFxC,MAAM,EAAE,CAoEpB"}
+{"version":3,"file":"gradleutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/gradleutils.js"],"names":[],"mappings":"AAyBA,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAwBpE,OAAO,EAAE,uBAAuB,EAAE,CAAC;AAEnC;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAJ7B,MAI6B,EAAE,QAAQ,EAHvC,MAAM,GAAC,IAGgC,EAAE,OAAO,AAFxD,CACF,EADU,MAEqD,UAiG/D;AA6DD;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,eAAe,EARN,MAAM,EAQA,EACf,iBAAiB,EARR,MAAM,EAQE,EACjB,yBAAyB,EARhB,MAAM,EAQU,EACzB,mBAAmB,EARV,GAQU,GANR,MAAM,EAAE,CA4CpB;AAqCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAJ1C,MAI0C,EAAE,aAAa,EAHzD,MAAM,EAGmD,GAFvD,GAAG,CA0Cf;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAFlC,MAEkC;;;EAsD5C;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAHpC,MAGoC,EAAE,gBAAgB,GAFtD,MAE6D;;;;;;;;EAoDvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAPM,MAON,EACH,cAAc,EAPL,KAOK,EACd,SAAS,GAPA,KAOK,EACd,OAAO,KAAK,GAND,MAAM,CA6GlB;AAiBD;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAF3B,IAAI,CAKhB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAF7B,OAAO,CAInB;AAiGD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EANzC,MAMyC,EAAE,OAAO,GAJ1D;IAAyB,OAAO,AAAhC,CACA,EADQ,MAAM,CACd;IAAyB,aAAa,AAAtC,CACA,EADQ,MAAM,CACd;CAE+D,GAFrD,IAAI,CA+HhB;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,SAAS,EANA,MAMA,EACT,eAAe,GANN,MAMe,EACxB,aAAa,GANJ,GAMgB,EACzB,cAAc,GANL,MAMU;;;;;;;;;GAkPpB;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,QAAQ,EAHpD,MAGoD,GAFlD,MAAM,CAkDlB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,gBAAgB,EAHjD,MAGiD,GAF/C,MAAM,CAkBlB;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAH5C,MAG4C,GAF1C,MAAM,CAuBlB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAHtC,MAGsC,GAFpC,MAAM,CA8ClB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAPD,MAOC,EACV,SAAS,EAPA,MAOA,EACT,QAAQ,GAPC,OAOM,EAAE,qCAAqC;AACtD,gBAAgB,GAPP,OAOe,GANb,OAAO,CAAC,MAAM,CAAC,CAgC3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,EAAE,OAAO,AAF5C,CACF,EADU,MAEyC,UAiBnD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,YAAY,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,MAAM,GAAC,IAAI,CA4BvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAJ7B,MAI6B,GAH3B,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CA2DpC;AAqBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EANC,MAMD,EACR,aAAa,AANZ,CAEA,EAFQ,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAMP,EACzB,OAAO,AALN,CACF,EADU,MAKG,QAoBb;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAJ5B,MAI4B,EAAE,QAAQ,EAHtC,MAGsC,EAAE,OAAO,AAFvD,CACF,EADU,MAEoD,UAmK9D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAH1C,MAG0C,GAFxC,MAAM,EAAE,CAoEpB"}

package/types/lib/ecosystems/jsEvidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jsEvidence.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/jsEvidence.js"],"names":[],"mappings":"AA0GA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EARE,KAAK,CAAC,MAAM,CAQd,EACP,UAAU,EARD,MAQC,EACV,UAAU,EARD,MAQC,EACV,IAAI,EARK,OAQL,GANO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAiMlC"}
+{"version":3,"file":"jsEvidence.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/jsEvidence.js"],"names":[],"mappings":"AAyLA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EARE,KAAK,CAAC,MAAM,CAQd,EACP,UAAU,EARD,MAQC,EACV,UAAU,EARD,MAQC,EACV,IAAI,EARK,OAQL,GANO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CA+KlC"}

package/types/lib/ecosystems/kosi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kosi.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/kosi.js"],"names":[],"mappings":"AAoCA;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,eAAe,EAH3C,MAAM,GAAC,SAGoC,GAFzC,MAAM,GAAC,SAAS,CAwB5B;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,KAAA,WAE5C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,QAQ3B;AA6DD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,GAHpC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAkD5B;AA0BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,KAAA,EAAE,SAAS,KAAA,OA4B/C;AAusBD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,KAAK,EAAE,WAAW,KAAK,MAsEpE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,GAJvC,MAI4C,EAAE,WAAW,GAHzD,MAG8D,GAF5D,MAAM,CAoFlB;AAiCD,wBAAgB,mBAAmB,CAAC,UAAU,KAAK,EAAE,UAAU,QAAK;;;;;;;EA2DnE"}
+{"version":3,"file":"kosi.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/kosi.js"],"names":[],"mappings":"AAqCA;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,eAAe,EAH3C,MAAM,GAAC,SAGoC,GAFzC,MAAM,GAAC,SAAS,CAwB5B;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,KAAA,WAE5C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,QAQ3B;AA6DD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,GAHpC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAkE5B;AA0BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,KAAA,EAAE,SAAS,KAAA,OA4B/C;AAusBD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,KAAK,EAAE,WAAW,KAAK,MAsEpE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,GAJvC,MAI4C,EAAE,WAAW,GAHzD,MAG8D,GAF5D,MAAM,CAoFlB;AAiCD,wBAAgB,mBAAmB,CAAC,UAAU,KAAK,EAAE,UAAU,QAAK;;;;;;;EA2DnE"}

package/types/lib/ecosystems/npmutils.d.ts

@@ -97,6 +97,21 @@ export declare function collectNpmManifestSources(node: object): {
     type: string;
     value: string;
 }[];
+/**
+ * Resolve the license of an npm-style manifest, honouring the legacy plural
+ * `licenses` field that packages published before the SPDX convention still
+ * carry (issue 4466). A modern `license` value is returned unchanged. The
+ * legacy field may hold one entry or an array of them, each a string or a
+ * `{ type, url }` object; one entry is returned as it is. npm documents an
+ * array of several entries as a choice between them, so when every entry is an
+ * SPDX identifier the array becomes the equivalent `MIT OR Apache-2.0`
+ * expression, and otherwise stays a list for `getLicenses` to convert entry by
+ * entry.
+ *
+ * @param {object} pkgData Parsed package.json (or bower.json) manifest
+ * @returns {string|object|Array|undefined} The effective license value
+ */
+export declare function resolveNpmLicense(pkgData: object): string | object | any[] | undefined;
 /**
  * Hydrates sparse npm package metadata from the installed package.json in deep mode.
  * Existing metadata on the Arborist node wins over on-disk values.

package/types/lib/ecosystems/npmutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"npmutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/npmutils.js"],"names":[],"mappings":"AA8CA;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAHlC,MAGkC,GAFhC,IAAI,CAgBhB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,MAG+B,GAF7B,IAAI,CAIhB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAH3B,MAG2B,GAFzB,IAAI,CAIhB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,MAG+B,GAF7B,IAAI,CAIhB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,MAG4B,GAF1B,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,EAH3C,MAG2C,GAFzC,MAAM,CA6BlB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAJvC,MAIuC,EAAE,OAAO,EAHhD,MAGgD,GAF9C,MAAM,CA2BlB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,iBAAiB,EAJ/C,MAAM,EAAE,GAAG,SAIoC,EAAE,WAAW,EAH5D,MAG4D,GAF1D,MAAM,GAAG,SAAS,CAmB9B;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAHnC,MAAM,GAAG,SAAS,GAAG,IAGc,GAFjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA0CvD;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAHnC,MAGmC,GAFjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,CA2B7C;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,AAHhD,CACA,EADQ,MAG6C,GAF3C;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAmCrG;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,KAAA,EAAE,KAAK,KAAA,EAAE,IAAI,KAAA,WAoC1D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAHjC,MAGiC,GAF/B,MAAM,CAQlB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAJxC,MAIwC,GAHtC,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAHhC,MAGgC,0BAa1C;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAHjC,MAGiC,GAF/B,MAAM,CAOlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAJ7C,MAI6C,EAAE,WAAW,AAHlE,CACA,wBAEuE,GAF7D,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EALrC,MAKqC,EAAE,KAAK,EAJ5C,MAI4C,EAAE,WAAW,wBAAA,GAFvD,yBAAuB,IAAI,CAYvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAN3C,MAM2C,EAAE,KAAK,EALlD,MAKkD,EAAE,IAAI,EAJxD,MAIwD,EAAE,OAAO,EAHjE,MAGiE,GAF/D,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EARI,MAQJ,EACL,IAAI,EARK,MAQL,EACJ,OAAO,EARE,MAQF,EACP,WAAW,wBAAA,GAPA,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,GAAC,SAAS,CA8BxD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAJhC,MAIgC,GAH9B;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAC,GAAC,IAAI,CAsBtG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,wBAAA,EAAE,SAAS,wBAAA,EAAE,WAAW,AAHjE,CACA,wBAEsE,0BAsExE"}
+{"version":3,"file":"npmutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/npmutils.js"],"names":[],"mappings":"AAkDA;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAHlC,MAGkC,GAFhC,IAAI,CAgBhB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,MAG+B,GAF7B,IAAI,CAIhB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAH3B,MAG2B,GAFzB,IAAI,CAIhB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,MAG+B,GAF7B,IAAI,CAIhB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,MAG4B,GAF1B,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,EAH3C,MAG2C,GAFzC,MAAM,CA6BlB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAJvC,MAIuC,EAAE,OAAO,EAHhD,MAGgD,GAF9C,MAAM,CA2BlB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,iBAAiB,EAJ/C,MAAM,EAAE,GAAG,SAIoC,EAAE,WAAW,EAH5D,MAG4D,GAF1D,MAAM,GAAG,SAAS,CAmB9B;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAHnC,MAAM,GAAG,SAAS,GAAG,IAGc,GAFjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA0CvD;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAHnC,MAGmC,GAFjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,CA2B7C;AAgBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,GAF5B,MAAM,GAAC,MAAM,WAAO,SAAS,CAgCzC;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,AAHhD,CACA,EADQ,MAG6C,GAF3C;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAmCrG;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,KAAA,EAAE,KAAK,KAAA,EAAE,IAAI,KAAA,WAoC1D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAHjC,MAGiC,GAF/B,MAAM,CAQlB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAJxC,MAIwC,GAHtC,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAHhC,MAGgC,0BAa1C;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAHjC,MAGiC,GAF/B,MAAM,CAOlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAJ7C,MAI6C,EAAE,WAAW,AAHlE,CACA,wBAEuE,GAF7D,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EALrC,MAKqC,EAAE,KAAK,EAJ5C,MAI4C,EAAE,WAAW,wBAAA,GAFvD,yBAAuB,IAAI,CAYvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAN3C,MAM2C,EAAE,KAAK,EALlD,MAKkD,EAAE,IAAI,EAJxD,MAIwD,EAAE,OAAO,EAHjE,MAGiE,GAF/D,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EARI,MAQJ,EACL,IAAI,EARK,MAQL,EACJ,OAAO,EARE,MAQF,EACP,WAAW,wBAAA,GAPA,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,GAAC,SAAS,CA8BxD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAJhC,MAIgC,GAH9B;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAC,GAAC,IAAI,CAsBtG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,wBAAA,EAAE,SAAS,wBAAA,EAAE,WAAW,AAHjE,CACA,wBAEsE,0BAsExE"}

package/types/lib/ecosystems/parsers-dotnet.d.ts

@@ -17,6 +17,110 @@
  * @returns {Object} The same component
  */
 export declare function applyNugetVersion(pkg: Object, version?: string): Object;
+/**
+ * Compare two NuGet versions: up to four numeric release parts (missing parts
+ * read as 0), then the prerelease label, with a release sorting after its own
+ * prereleases. Build metadata after `+` is ignored, as NuGet ignores it.
+ *
+ * @param {string} a Version
+ * @param {string} b Version
+ * @returns {number} Negative, zero or positive, like a sort comparator
+ */
+export declare function compareNugetVersions(a: string, b: string): number;
+/**
+ * Whether a NuGet version range allows a version. A bare version is a minimum
+ * (`1.0` means at least 1.0); brackets are inclusive and parentheses exclusive
+ * (`[1.0]`, `[1.0,2.0)`, `(,2.0]`). An empty or unparseable range allows
+ * anything.
+ *
+ * @param {string} range Range as a nuspec or lock file states it
+ * @param {string} version Version to test
+ * @returns {boolean} True when the range allows the version
+ */
+export declare function nugetRangeAllows(range: string, version: string): boolean;
+/**
+ * Choose the installed version a declared dependency resolves to: the lowest
+ * installed version the range allows, as NuGet picks the lowest applicable
+ * version; else the only installed version, which is what binding redirects
+ * unify a dependency onto. Undefined when nothing installed can be named.
+ *
+ * @param {string} range Declared range
+ * @param {string[]} installedVersions Versions installed for the package
+ * @returns {string|undefined} The chosen version
+ */
+export declare function resolveInstalledNugetVersion(range: string, installedVersions?: string[]): string | undefined;
+/**
+ * The project directory a .NET manifest belongs to. Restore output records its
+ * project file; otherwise project.assets.json sits in the project's `obj/`,
+ * and lock files, packages.config and project files sit in the project
+ * directory itself.
+ *
+ * @param {string} manifestFile Manifest path
+ * @param {string} [projectPath] Project file the manifest names, when it does
+ * @returns {string} Project directory
+ */
+export declare function dotnetManifestProjectDir(manifestFile: string, projectPath?: string): string;
+/**
+ * The path, on this machine, of the project file a project.assets.json belongs to.
+ *
+ * Restore records the project file and the directory it wrote the assets file
+ * to (`outputPath`) as absolute paths on the machine that ran it, which can be
+ * a CI agent, a container, another operating system, or this tree reached
+ * through another path. Where the project file sits relative to that
+ * directory does not change when the tree moves, so the project file is that
+ * offset applied to the directory the assets file is in. An assets file that
+ * records no output path is taken to be in its project's `obj/`. The recorded
+ * path itself is used only when no offset can be worked out, as when restore
+ * wrote to another drive than the project's.
+ *
+ * Nothing is read from disk: the name is spelled as restore recorded it, which
+ * can differ in case from the file a case-insensitive file system holds.
+ *
+ * @param {string} assetsFile project.assets.json path
+ * @param {string} [projectPath] Project file restore recorded
+ * @param {string} [outputPath] Directory restore recorded writing the assets file to
+ * @returns {string|undefined} Project file path, or undefined when none can be named
+ */
+export declare function dotnetRestoredProjectFile(assetsFile: string, projectPath?: string, outputPath?: string): string | undefined;
+/**
+ * Index the MSBuild properties that props files define, by the directory each
+ * file sits in and across the whole scan, so the candidates for every project
+ * come from one read of each file.
+ *
+ * @param {string[]} propsFiles Props files of the scan
+ * @returns {{byDir: Object, treeWide: Object}} Property values per directory and
+ *          across the scan, each a map of property name to values
+ */
+export declare function indexPropsProperties(propsFiles?: string[]): {
+    byDir: Object;
+    treeWide: Object;
+};
+/**
+ * The candidate values of MSBuild properties that can apply to a project file,
+ * from the props files beside it and above it: the nearest directory that
+ * defines a property wins, as the nearest Directory.Build.props is the one
+ * MSBuild imports. A property no such directory defines falls back to the
+ * values the whole scan's props files give it, which a caller only trusts when
+ * there is exactly one.
+ *
+ * @param {string} projFile Project file
+ * @param {{byDir: Object, treeWide: Object}} propsIndex Index built by {@link indexPropsProperties}
+ * @returns {Object} Map of property name to candidate values
+ */
+export declare function projectPropertyCandidates(projFile: string, propsIndex?: {
+    byDir: Object;
+    treeWide: Object;
+}): Object;
+/**
+ * The version of each package that every manifest of a scan agrees on, keyed by
+ * lowercased package id. A package that two manifests give different versions
+ * is left out: without knowing which project a declaration belongs to, picking
+ * one of them would be a guess.
+ *
+ * @param {Object[]} pkgList Components collected from the scan's manifests
+ * @returns {Object} Map of lowercased package id to version
+ */
+export declare function agreedNugetVersions(pkgList?: Object[]): Object;
 /**
  * Method to parse .nupkg files
  *
@@ -78,20 +182,57 @@ export declare function getCentralPackageVersions(projFile: string, cache?: Obje
  * @returns {Object} Containing text nodes from PropertyGroup elements and their values
  */
 export declare function getPropertyGroupTextNodes(propsFiles: string): Object;
+/**
+ * Look up a package version in a name - version map. NuGet package ids are
+ * case-insensitive, so a map may be keyed by the id as written or lowercased.
+ *
+ * @param {Object} versions Map of package id to version
+ * @param {string} name Package id
+ * @returns {string|undefined} The version, or undefined when the map has none
+ */
+export declare function lookupNugetVersion(versions: Object, name: string): string | undefined;
 /**
  * Method to parse .csproj like xml files
  *
+ * A version the project file does not state is taken, in order, from the
+ * versions this project restored, from central package management, and last
+ * from a version the whole scan agrees on. Two projects of one tree routinely
+ * restore different versions of a package, so a version taken from another
+ * project would describe a package this project does not use.
+ *
  * @param {String} csProjData Raw data
  * @param {String} projFile File name
- * @param {Object} pkgNameVersions Package name - version map object
+ * @param {Object} pkgNameVersions Versions this project restored (its project.assets.json,
+ *        packages.lock.json or packages.config), keyed by package id or lowercased id
  * @param {Boolean} msbuildInstalled Whether msbuild is available to resolve properties
- * @param {Object} pkgVersionLabelCandidates Candidate values for msbuild version properties
+ * @param {Object} pkgVersionLabelCandidates Candidate values for msbuild version properties,
+ *        from the props files that can apply to this project
  * @param {Object} centralVersions Versions declared centrally in Directory.Packages.props,
  *        keyed by lowercased package id. See {@link getCentralPackageVersions}.
+ * @param {Object} fallbackVersions Versions every project of the scan agrees on, keyed by
+ *        lowercased package id, used only when nothing closer states one
+ * @param {Object} restoredNames Package ids as this project's restore output spells them,
+ *        keyed by lowercased id. NuGet ids are case-insensitive, so a reference spelled
+ *        differently names the same package and takes the restored spelling.
+ * @param {{name: string, version: (string|undefined)}} [projectIdentity] Package id and
+ *        version this project's project.assets.json records for the project. They name the
+ *        project in place of what the project file states.
  *
- * @returns {Object} Containing parent component, package, and dependencies
+ * @returns {Object} Containing parent component, package, dependencies, and the
+ *   `$(Name)` version labels left unresolved without msbuild
  */
-export declare function parseCsProjData(csProjData: string, projFile: string, pkgNameVersions?: Object, msbuildInstalled?: boolean, pkgVersionLabelCandidates?: Object, centralVersions?: Object): Object;
+export declare function parseCsProjData(csProjData: string, projFile: string, pkgNameVersions?: Object, msbuildInstalled?: boolean, pkgVersionLabelCandidates?: Object, centralVersions?: Object, fallbackVersions?: Object, restoredNames?: Object, projectIdentity?: {
+    name: string;
+    version: (string | undefined);
+}): Object;
+/**
+ * Whether a file of a NuGet package is an assembly a consuming project can
+ * reference: a .dll, .exe, or .so under lib/, ref/, or runtimes/.
+ *
+ * @param {string} packageFile Path of the file inside the package, as project.assets.json lists it
+ * @returns {boolean} true for a referenced assembly
+ */
+export declare function isReferencedDotnetPackageFile(packageFile: string): boolean;
 /**
  * Parse a .NET project.assets.json file and return the package list and dependency tree.
  *
@@ -101,11 +242,20 @@ export declare function parseCsProjData(csProjData: string, projFile: string, pk
  *
  * @param {string} csProjData Raw JSON string of the project.assets.json file
  * @param {string} assetsJsonFile Path to the project.assets.json file, used for evidence properties
- * @returns {{ pkgList: Object[], dependenciesList: Object[] }}
+ * @returns {{ pkgList: Object[], dependenciesList: Object[], projectPath: (string|undefined), outputPath: (string|undefined), projectIdentity: ({name: string, version: (string|undefined)}|undefined) }}
+ *          `projectPath` is the project file the restore output belongs to and `outputPath` the
+ *          directory restore wrote it to, both as restore recorded them. `projectIdentity` is the
+ *          package id and version restore evaluated for the project, which root the dependency tree.
  */
 export declare function parseCsProjAssetsData(csProjData: string, assetsJsonFile: string): {
     pkgList: Object[];
     dependenciesList: Object[];
+    projectPath: (string | undefined);
+    outputPath: (string | undefined);
+    projectIdentity: ({
+        name: string;
+        version: (string | undefined);
+    } | undefined);
 };
 /**
  * Parse a .NET packages.lock.json file and return the package list, dependency tree,

package/types/lib/ecosystems/parsers-dotnet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsers-dotnet.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-dotnet.js"],"names":[],"mappings":"AAeA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAL1B,MAK0B,EAAE,OAAO,AAJ3C,CAEA,QAE2C,GAFjC,MAAM,CAUlB;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,SAAS,QAAA,GAF7B,MAAM,CAWlB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,SAAS,QAAA,EAAE,UAAU,QAAA,GAFxC,MAAM,CAwKlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAP3B,MAO2B,EAAE,OAAO,EANpC,MAMoC,EAAE,eAAe,GALrD,MAK0D,GAFxD,MAAM,EAAE,CAiFpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,QAAA,GAHxC,MAAM,CA+ClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,QAAA,EAAE,KAAK,GAN9C,MAMmD,GAHjD,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,QAAA,GAFvC,MAAM,CA2ClB;AAiBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,UAAU,QAAA,EACV,QAAQ,QAAA,EACR,eAAe,GAXN,MAWW,EACpB,gBAAgB,UAAQ,EACxB,yBAAyB,GAXhB,MAWqB,EAC9B,eAAe,GAXN,MAWW,GART,MAAM,CAiflB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAJrC,MAIqC,EAAE,cAAc,EAHrD,MAGqD,GAFnD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAE,CAuP7D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAJlC,MAIkC,EAAE,WAAW,EAH/C,MAG+C,GAF7C;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAkHjF;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAJrC,MAIqC,EAAE,WAAW,EAHlD,MAGkD,GAFhD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAE,CAyH7D"}
+{"version":3,"file":"parsers-dotnet.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-dotnet.js"],"names":[],"mappings":"AAuBA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAL1B,MAK0B,EAAE,OAAO,AAJ3C,CAEA,QAE2C,GAFjC,MAAM,CAUlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAJ3B,MAI2B,EAAE,CAAC,EAH9B,MAG8B,GAF5B,MAAM,CAwDlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAmCnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAJvC,MAIuC,EAAE,iBAAiB,GAH1D,MAAM,EAGyD,GAF7D,MAAM,GAAC,SAAS,CAU5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAJ1C,MAI0C,EAAE,WAAW,AAH/D,CACA,EADQ,MAGuD,GAFrD,MAAM,CAclB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EALzC,MAKyC,EAAE,WAAW,AAJ9D,CACA,EADQ,MAIsD,EAAE,UAAU,AAH1E,CACA,EADQ,MAGkE,GAFhE,MAAM,GAAC,SAAS,CA4B5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,GAJpC,MAAM,EAImC,GAHvC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,CA2B7C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAJvC,MAIuC,EAAE,UAAU,GAHnD;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAGwB,GAFtD,MAAM,CAoBlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAHhC,MAAM,EAG+B,GAFnC,MAAM,CAmBlB;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,SAAS,QAAA,GAF7B,MAAM,CAWlB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,SAAS,QAAA,EAAE,UAAU,QAAA,GAFxC,MAAM,CAyLlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAP3B,MAO2B,EAAE,OAAO,EANpC,MAMoC,EAAE,eAAe,GALrD,MAK0D,GAFxD,MAAM,EAAE,CAiFpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,QAAA,GAHxC,MAAM,CA+ClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,QAAA,EAAE,KAAK,GAN9C,MAMmD,GAHjD,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,QAAA,GAFvC,MAAM,CA2ClB;AAiBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAJhC,MAIgC,EAAE,IAAI,EAHtC,MAGsC,GAFpC,MAAM,GAAC,SAAS,CAO5B;AAyED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,eAAe,CAC7B,UAAU,QAAA,EACV,QAAQ,QAAA,EACR,eAAe,GAtBN,MAsBW,EACpB,gBAAgB,UAAQ,EACxB,yBAAyB,GArBhB,MAqBqB,EAC9B,eAAe,GApBN,MAoBW,EACpB,gBAAgB,GAnBP,MAmBY,EACrB,aAAa,GAlBJ,MAkBS,EAClB,eAAe,AAhBd,CAIA,EAJQ;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAA;CAgBxB,GAZhB,MAAM,CAmiBlB;AAUD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAH9C,MAG8C,GAF5C,OAAO,CAoBnB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAPrC,MAOqC,EAAE,cAAc,EANrD,MAMqD,GALnD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAC;IAAC,UAAU,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAC;IAAC,eAAe,EAAE,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAA;KAAC,GAAC,SAAS,CAAC,CAAA;CAAE,CA4OxM;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAJlC,MAIkC,EAAE,WAAW,EAH/C,MAG+C,GAF7C;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAkIjF;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAJrC,MAIqC,EAAE,WAAW,EAHlD,MAGkD,GAFhD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAE,CAyH7D"}

package/types/lib/ecosystems/parsers-elm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsers-elm.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-elm.js"],"names":[],"mappings":"AAiEA;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,WAAW,EALhC,MAKgC,EAAE,WAAW,AAJrD,CAEA,EAFQ,MAI6C,GAF3C;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAoGxG;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,kBAAkB,EAJ7C,MAI6C,EAAE,aAAa,AAHpE,CACA,EADQ,MAG4D,GAF1D;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAyFxG;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAH9B,MAG8B,GAF5B,OAAO,CAKnB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,AAJhD,CAEA,EAFQ,MAIwC,GAFtC;IAAE,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,GAAC,IAAI,CAAC;IAAC,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAA;CAAE,CA6FtH;AAmRD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAH7B,MAG6B,GAF3B,OAAO,CAKnB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAJjC,MAAM,EAI2B,EAAE,YAAY,AAHvD,CACA,EADQ,MAAM,EAGyC,GAF7C,OAAO,CAAC,MAAM,EAAE,CAAC,CAyD7B"}
+{"version":3,"file":"parsers-elm.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-elm.js"],"names":[],"mappings":"AA8DA;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,WAAW,EALhC,MAKgC,EAAE,WAAW,AAJrD,CAEA,EAFQ,MAI6C,GAF3C;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAoGxG;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,kBAAkB,EAJ7C,MAI6C,EAAE,aAAa,AAHpE,CACA,EADQ,MAG4D,GAF1D;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAyFxG;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAH9B,MAG8B,GAF5B,OAAO,CAKnB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,AAJhD,CAEA,EAFQ,MAIwC,GAFtC;IAAE,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,GAAC,IAAI,CAAC;IAAC,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAA;CAAE,CA6FtH;AAmRD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAH7B,MAG6B,GAF3B,OAAO,CAKnB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAJjC,MAAM,EAI2B,EAAE,YAAY,AAHvD,CACA,EADQ,MAAM,EAGyC,GAF7C,OAAO,CAAC,MAAM,EAAE,CAAC,CA8E7B"}

package/types/lib/ecosystems/parsers-gleam.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsers-gleam.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-gleam.js"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAJpC,MAIoC,EAAE,gBAAgB,AAH9D,CACA,EADQ,MAGsD,GAFpD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAiGlF"}
+{"version":3,"file":"parsers-gleam.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-gleam.js"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAJpC,MAIoC,EAAE,gBAAgB,AAH9D,CACA,EADQ,MAGsD,GAFpD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAiGlF"}

package/types/lib/ecosystems/parsers-go.d.ts

@@ -1,3 +1,57 @@
+/**
+ * The licence notices of a module that is already on this machine, from the
+ * directory `go list` reported, from the project's `vendor/` tree, or from the
+ * module cache. Reading them costs no network round trip, so they answer
+ * before pkg.go.dev is asked. Every notice of the first directory holding
+ * one is returned, as pkg.go.dev reads every notice of a module.
+ *
+ * The directory `go list` reported is always read. The vendor tree and the
+ * module cache stand in for pkg.go.dev, so they are read only when licences
+ * are being fetched. Their directories are built from a module path and
+ * version read from modules.txt or go.sum, so a path or version the Go
+ * toolchain would reject, such as one with a `..` element, is not looked up:
+ * Go never writes such a directory, and joining it could leave the tree.
+ *
+ * @param {string} name Full module path
+ * @param {string} [version] Module version, for the module cache layout
+ * @param {Object} [options] Options
+ * @param {string} [options.dir] The module's directory, as `go list` reports it
+ * @param {string} [options.projectRoot] Project root holding a `vendor/` tree
+ * @param {string} [options.vendorPath] The path the module is vendored under,
+ *   when it differs from `name`: Go vendors a replaced module under the path
+ *   it replaces
+ * @returns {{fileName: string, text: string}[]} The notices, in file name
+ *   order; empty when none is held locally
+ */
+export declare function readLocalGoLicenses(name: string, version?: string, options?: {
+    dir?: string;
+    projectRoot?: string;
+    vendorPath?: string;
+}): {
+    fileName: string;
+    text: string;
+}[];
+/**
+ * The text of the first licence notice {@link readLocalGoLicenses} finds.
+ *
+ * @param {string} name Full module path
+ * @param {string} [version] Module version, for the module cache layout
+ * @param {Object} [options] The options {@link readLocalGoLicenses} takes
+ * @returns {string|undefined} The notice text, or undefined when none is held
+ *   locally
+ */
+export declare function readLocalGoLicense(name: string, version?: string, options?: Object): string | undefined;
+/**
+ * Order two Go module versions by semantic version precedence, as Go's semver
+ * package does: a pre-release, pseudo-versions included, sorts before its
+ * release, and build metadata such as `+incompatible` does not count.
+ *
+ * @param {string} a A module version
+ * @param {string} b Another module version
+ * @returns {number} Negative, zero or positive as `a` sorts before, with or
+ *   after `b`
+ */
+export declare function compareGoVersions(a: string, b: string): number;
 /**
  * Builds a Go package component object containing purl, bom-ref, integrity hash,
  * and optionally license and VCS external reference information.
@@ -6,16 +60,32 @@
  * @param {string} name Package name (full module path when group is empty)
  * @param {string} version Package version string
  * @param {string} hash Integrity hash (e.g. "sha256-…"), used as _integrity
+ * @param {Object} [options] Options
+ * @param {boolean} [options.skipRegistryLookups] Leave the licence and VCS
+ *   URL unset instead of asking pkg.go.dev. Used for the main module, which
+ *   no registry holds.
+ * @param {string} [options.dir] The module's directory, as `go list` reports
+ *   it, where a local licence notice is read first
+ * @param {string} [options.projectRoot] Project root holding a `vendor/` tree
+ *   the module may be vendored in
+ * @param {string} [options.vendorPath] The path the module is vendored under,
+ *   when it differs from `name`
  * @returns {Promise<Object>} Component object ready for inclusion in a BOM package list
  */
-export declare function getGoPkgComponent(group: string, name: string, version: string, hash: string): Promise<Object>;
+export declare function getGoPkgComponent(group: string, name: string, version: string, hash: string, options?: {
+    skipRegistryLookups?: boolean;
+    dir?: string;
+    projectRoot?: string;
+    vendorPath?: string;
+}): Promise<Object>;
 /**
  * Method to parse go.mod files
  *
  * @param {String} goModData Contents of go.mod file
  * @param {Object} gosumMap Data from go.sum files
  *
- * @returns {Object} Object containing parent component, rootList and packages list
+ * @returns {Object} Object containing parent component, rootList, packages
+ *   list, and the replace directives as `replacements`
  */
 export declare function parseGoModData(goModData: string, gosumMap: Object): Object;
 /**
@@ -23,6 +93,12 @@ export declare function parseGoModData(goModData: string, gosumMap: Object): Obj
  * Go package components. Cross-references the go.sum map for integrity hashes and
  * sets scope and confidence based on hash availability.
  *
+ * Only the modules the vendor tree holds become components: a module line
+ * followed by its `##` annotations or its packages. `go mod vendor` also
+ * records every replace directive of go.mod at the end of the file, as a
+ * module line with nothing after it, so the consumer can tell that the
+ * replacement had no effect; those lines name no vendored module.
+ *
  * @param {string} txtFile Path to the modules.txt file
  * @param {Object} gosumMap Map of "module@version" keys to sha256 hash values from go.sum
  * @returns {Promise<Object[]>} List of Go package component objects with evidence
@@ -31,17 +107,40 @@ export declare function parseGoModulesTxt(txtFile: string, gosumMap: Object): Pr
 /**
  * Parse go list output
  *
+ * Each row is printed by the template in createGoBom:
+ * `Path|Version|Indirect|GoMod|GoVersion|Main|Time|Deprecated|GoModSum|Dir|Sum|
+ * Replace.Path|Replace.Version|Replace.Sum`. Rows from older templates end
+ * after `Dir`.
+ *
+ * A replaced module is reported as the module Go builds (see
+ * {@link goReplacement}), with the checksum of the replacement. A go.work
+ * workspace makes every member a main module, so the parent is the main
+ * module in `options.mainModuleDir`, and the other members are returned as
+ * `workspaceModules`.
+ *
  * @param {string} rawOutput Output from go list invocation
  * @param {Object} gosumMap go.sum data
- * @returns Object with parent component and List of packages
+ * @param {Object} [options] Options
+ * @param {string} [options.mainModuleDir] Directory `go list` ran in, whose
+ *   main module is the parent component
+ * @returns Object with parent component, list of packages, and the other main
+ *   modules of a workspace
  */
-export declare function parseGoListDep(rawOutput: string, gosumMap: Object): Promise<{
+export declare function parseGoListDep(rawOutput: string, gosumMap: Object, options?: {
+    mainModuleDir?: string;
+}): Promise<{
     parentComponent: {};
     pkgList: Object[];
+    workspaceModules: Object[];
 }>;
 /**
  * Parse go mod graph
  *
+ * `go mod graph` names every module by the path and version its requirement
+ * names, whatever replaces it. A replaced module is mapped to the module Go
+ * builds: from the components `go list` reported, which record what they
+ * replace, or else from the replace directives of go.mod.
+ *
  * @param {string} rawOutput Output from go mod graph invocation
  * @param {string} goModFile go.mod file
  * @param {Object} gosumMap Hashes from gosum for lookups
@@ -76,12 +175,21 @@ export declare function parseGoModWhy(rawOutput: string): string | undefined;
  * @returns {boolean} True when go reports the module as not needed
  */
 export declare function isGoModWhyNotNeeded(rawOutput: string): boolean;
+/**
+ * Read the `module@version` to hash map out of go.sum contents, without
+ * building components or touching the network.
+ *
+ * @param {string} gosumData Content of go.sum
+ * @returns {Object} Map of `module@version` keys to the `sha256-…` checksum of
+ *   the module content, for every version go.sum holds one for
+ */
+export declare function parseGosumHashes(gosumData: string): Object;
 /**
  * Parse go sum data
  * @param {string} gosumData Content of go.sum
  * @returns package list
  */
-export declare function parseGosumData(gosumData: string): Promise<any[]>;
+export declare function parseGosumData(gosumData: string): Promise<Object[]>;
 /**
  * Parses the contents of a Gopkg.lock or Gopkg.toml file (dep tool format) and
  * returns a list of Go package components. Optionally fetches license information
@@ -95,6 +203,12 @@ export declare function parseGopkgData(gopkgData: string): Promise<Object[]>;
  * Parses the output of `go version -m` (build info) and returns a list of Go
  * package components for each "dep" line, including name, version, and integrity hash.
  *
+ * A dependency that a replace directive swapped out is printed as its `dep`
+ * line followed by a `=>` line naming the replacement (runtime/debug
+ * BuildInfo.String). The replacement is what the binary holds, so it is
+ * reported as {@link goReplacement} describes, with the replacement's
+ * checksum.
+ *
  * @param {string} buildInfoData Raw string output from `go version -m`
  * @returns {Promise<Object[]>} List of Go package component objects
  */

package/types/lib/ecosystems/parsers-go.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsers-go.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-go.js"],"names":[],"mappings":"AAgCA;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EANlC,MAMkC,EAAE,IAAI,EALxC,MAKwC,EAAE,OAAO,EAJjD,MAIiD,EAAE,IAAI,EAHvD,MAGuD,GAFrD,OAAO,CAAC,MAAM,CAAC,CAqD3B;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,SAAS,QAAA,EAAE,QAAQ,EAJ7C,MAI6C,GAF3C,MAAM,CA2ClB;AAkHD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAJpC,MAIoC,EAAE,QAAQ,EAH9C,MAG8C,GAF5C,OAAO,CAAC,MAAM,EAAE,CAAC,CA6B7B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAJnC,MAImC,EAAE,QAAQ,EAH7C,MAG6C;;;GAuHvD;AA6CD;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CACnC,SAAS,EATA,MASA,EACT,SAAS,EATA,MASA,EACT,QAAQ,EATC,MASD,EACR,QAAQ,QAAK,EACb,eAAe,GATN,MASW;;;;;;;;GAwMrB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CAc5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAHlC,MAGkC,GAFhC,OAAO,CASnB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAHnC,MAGmC,kBA6B7C;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAHnC,MAGmC,GAFjC,OAAO,CAAC,MAAM,EAAE,CAAC,CAiD7B;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,aAAa,EAH3C,MAG2C,GAFzC,OAAO,CAAC,MAAM,EAAE,CAAC,CAkC7B"}
+{"version":3,"file":"parsers-go.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-go.js"],"names":[],"mappings":"AAyPA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAX7B,MAW6B,EAAE,OAAO,AAV9C,CACA,EADQ,MAUsC,EAAE,OAAO,AATvD,CAMA,EALA;IAAyB,GAAG,AAA5B,CACA,EADQ,MAAM,CACd;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,UAAU,AAAnC,CAGA,EAHQ,MAAM,CAGd;CAG4D,GAHlD;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,EAAE,CAqE9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAN5B,MAM4B,EAAE,OAAO,AAL7C,CACA,EADQ,MAKqC,EAAE,OAAO,AAJtD,CACA,EADQ,MAImD,GAHjD,MAAM,GAAC,SAAS,CAK5B;AA2ID;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EALxB,MAKwB,EAAE,CAAC,EAJ3B,MAI2B,GAHzB,MAAM,CASlB;AAaD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAjBI,MAiBJ,EACL,IAAI,EAjBK,MAiBL,EACJ,OAAO,EAjBE,MAiBF,EACP,IAAI,EAjBK,MAiBL,EACJ,OAAO,AAjBN,CAUA,EATA;IAA0B,mBAAmB,AAA7C,CAGA,EAHQ,OAAO,CAGf;IAAyB,GAAG,AAA5B,CAEA,EAFQ,MAAM,CAEd;IAAyB,WAAW,AAApC,CAEA,EAFQ,MAAM,CAEd;IAAyB,UAAU,AAAnC,CAEA,EAFQ,MAAM,CAEd;CAOW,GAPD,OAAO,CAAC,MAAM,CAAC,CAwE3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,SAAS,QAAA,EAAE,QAAQ,EAL7C,MAK6C,GAH3C,MAAM,CAgDlB;AAkQD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAJpC,MAIoC,EAAE,QAAQ,EAH9C,MAG8C,GAF5C,OAAO,CAAC,MAAM,EAAE,CAAC,CA0E7B;AAyBD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,cAAc,CAAC,SAAS,EARnC,MAQmC,EAAE,QAAQ,EAP7C,MAO6C,EAAE,OAAO,AAN9D,CAGA,EAFA;IAAyB,aAAa,AAAtC,CAEA,EAFQ,MAAM,CAEd;CAGmE;;;;GA2HrE;AAsED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CACnC,SAAS,EATA,MASA,EACT,SAAS,EATA,MASA,EACT,QAAQ,EATC,MASD,EACR,QAAQ,QAAK,EACb,eAAe,GATN,MASW;;;;;;;;GAuTrB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CAc5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAHlC,MAGkC,GAFhC,OAAO,CASnB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAJ/B,MAI+B,GAH7B,MAAM,CAWlB;AAyCD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAHnC,MAGmC,qBAY7C;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAHnC,MAGmC,GAFjC,OAAO,CAAC,MAAM,EAAE,CAAC,CAmD7B;AAoBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,aAAa,EAH3C,MAG2C,GAFzC,OAAO,CAAC,MAAM,EAAE,CAAC,CAqD7B"}

package/types/lib/ecosystems/parsers-js.d.ts

@@ -7,10 +7,15 @@ import { Buffer } from "node:buffer";
  *   identity evidence and skip npm registry metadata fetching.
  * @param {boolean} [securityProps=false] When true, append npm security-relevant
  *   properties such as lifecycle scripts, binaries, native addons, and deprecation notices.
+ * @param {Object} [options] Options
+ * @param {boolean} [options.fetchMetadata=true] When false, skip the npm
+ *   registry round so that a caller can make one round for many manifests.
  * @returns {Promise<Array<object>>} Parsed component list, enriched with npm
  *   registry metadata when available and not in simple mode.
  */
-export declare function parsePkgJson(pkgJsonFile: string, simple?: boolean, securityProps?: boolean): Promise<Array<object>>;
+export declare function parsePkgJson(pkgJsonFile: string, simple?: boolean, securityProps?: boolean, options?: {
+    fetchMetadata?: boolean;
+}): Promise<Array<object>>;
 /**
  * Hash a root `.npm-extension` file exactly as npm does: ssri sha512 over
  * `npm-extension:v1:<format>\n` followed by the raw file bytes. Mirrors

package/types/lib/ecosystems/parsers-js.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsers-js.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-js.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA0arC;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAChC,WAAW,EATF,MASE,EACX,MAAM,AATL,CAEA,EAFQ,OASK,EACd,aAAa,AARZ,CAEA,EAFQ,OAQY,GANV,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CA+OlC;AA0CD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAJhC,MAIgC,EAAE,KAAK,EAHvC,MAGuC,GAFrC,MAAM,CASlB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAHpC,MAGoC,GAFlC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAC,GAAC,IAAI,CA6BjF;AA+ED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,WAAW,EAHnC,MAGmC,EAAE,OAAO,GAF5C,MAEiD;;;GA0vB3D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAFhC,MAEgC,MA2E1C;AAwND;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,YAAY,EARH,MAQG,EACZ,eAAe,GARN,MAQa,EACtB,iBAAiB,MAAK,EACtB,iBAAiB,GARR,MAQa,EACtB,mBAAmB,GARV,MAQe,EACxB,iBAAiB,GARR,MAQa;;;;;;GAwhBvB;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAFrC,MAEqC,kBA+D/C;AA6GD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,QAAA,UAQ1C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAPnC,MAAM,GAAC,MAO4B,EAAE,YAAY,EANjD,MAMiD,GAF/C,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAoCrC;AAqBD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,cAAc,CAClC,MAAM,EATG,MAAM,GAAC,MASV,EACN,WAAW,EATF,MASE,EACX,UAAU,EATD,MASC,EACV,YAAY,EATH,MASG,EACZ,gBAAgB,EATP,MASO,EAChB,WAAW,AATV,CACA,EADQ,MASO,GARL,OAAO,CAAC,MAAM,CAAC,CA8D3B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAHrC,MAGqC,GAFnC,MAAM,CAoClB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,eAAe,EAHvC,MAGuC,GAFrC,MAAM,CA2BlB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EALhC,MAKgC,EAAE,WAAW,EAJ7C,MAI6C,EAAE,OAAO,EAHtD,MAGsD,GAFpD,MAAM,GAAC,IAAI,CA4DvB;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,OAAA,EAAE,YAAY,EAH7C,MAG6C,SAsFvD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,QAAA,GAH1B,MAAM,GAAC,SAAS,CAkC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAVC,MAUD,EACR,eAAe,GAVN,MAUa,EACtB,iBAAiB,MAAK,EACtB,iBAAiB,GAVR,MAUa,EACtB,kBAAkB,GAVT,MAUc,EACvB,oBAAoB,GAVX,MAUgB,EACzB,iBAAiB,GAVR,MAUa,EACtB,WAAW,GAVF,MAUc;;;;;;;;;;;;;;;;;;GA6+BxB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,aAAa,EAFvC,MAEuC,kBA6CjD;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,SAAS,EAF/B,MAE+B,kBA2FzC;AAGD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAAM,GAAC,MAGuB,GAF5B;IAAE,KAAK,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,CAoBvG;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,aAAa,QAAA,GAFjC,KAAK,QAAQ,CA4CzB"}
+{"version":3,"file":"parsers-js.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-js.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAgbrC;;;;;;;;;;;;;GAaG;AACH,wBAAsB,YAAY,CAChC,WAAW,EAZF,MAYE,EACX,MAAM,AAZL,CAEA,EAFQ,OAYK,EACd,aAAa,AAXZ,CAEA,EAFQ,OAWY,EACrB,OAAO,AAVN,CAGA,EAFA;IAA0B,aAAa,AAAvC,CAEA,EAFQ,OAAO,CAEf;CAOW,GAPD,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAwPlC;AA0CD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAJhC,MAIgC,EAAE,KAAK,EAHvC,MAGuC,GAFrC,MAAM,CASlB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAHpC,MAGoC,GAFlC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAC,GAAC,IAAI,CA6BjF;AA+ED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,WAAW,EAHnC,MAGmC,EAAE,OAAO,GAF5C,MAEiD;;;GAyyB3D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAFhC,MAEgC,MA2E1C;AAwND;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,YAAY,EARH,MAQG,EACZ,eAAe,GARN,MAQa,EACtB,iBAAiB,MAAK,EACtB,iBAAiB,GARR,MAQa,EACtB,mBAAmB,GARV,MAQe,EACxB,iBAAiB,GARR,MAQa;;;;;;GAwhBvB;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAFrC,MAEqC,kBAgE/C;AA6GD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,QAAA,UAQ1C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAPnC,MAAM,GAAC,MAO4B,EAAE,YAAY,EANjD,MAMiD,GAF/C,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAoCrC;AAqBD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,cAAc,CAClC,MAAM,EATG,MAAM,GAAC,MASV,EACN,WAAW,EATF,MASE,EACX,UAAU,EATD,MASC,EACV,YAAY,EATH,MASG,EACZ,gBAAgB,EATP,MASO,EAChB,WAAW,AATV,CACA,EADQ,MASO,GARL,OAAO,CAAC,MAAM,CAAC,CA8D3B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAHrC,MAGqC,GAFnC,MAAM,CAoClB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,eAAe,EAHvC,MAGuC,GAFrC,MAAM,CA2BlB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EALhC,MAKgC,EAAE,WAAW,EAJ7C,MAI6C,EAAE,OAAO,EAHtD,MAGsD,GAFpD,MAAM,GAAC,IAAI,CA4DvB;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,OAAA,EAAE,YAAY,EAH7C,MAG6C,SAsFvD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,QAAA,GAH1B,MAAM,GAAC,SAAS,CAkC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAVC,MAUD,EACR,eAAe,GAVN,MAUa,EACtB,iBAAiB,MAAK,EACtB,iBAAiB,GAVR,MAUa,EACtB,kBAAkB,GAVT,MAUc,EACvB,oBAAoB,GAVX,MAUgB,EACzB,iBAAiB,GAVR,MAUa,EACtB,WAAW,GAVF,MAUc;;;;;;;;;;;;;;;;;;GA6+BxB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,aAAa,EAFvC,MAEuC,kBA6CjD;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,SAAS,EAF/B,MAE+B,kBA2FzC;AAGD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAAM,GAAC,MAGuB,GAF5B;IAAE,KAAK,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,CAoBvG;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,aAAa,QAAA,GAFjC,KAAK,QAAQ,CA4CzB"}

package/types/lib/ecosystems/parsers-julia.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsers-julia.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-julia.js"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,eAAe,AAJ9C,CACA,EADQ,MAIsC,EAAE,gBAAgB,AAHhE,CACA,EADQ,MAGwD,GAFtD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CA+FzG;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAHhC,MAGgC,GAF9B,OAAO,CAUnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,OAAO,CASnB"}
+{"version":3,"file":"parsers-julia.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-julia.js"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,eAAe,AAJ9C,CACA,EADQ,MAIsC,EAAE,gBAAgB,AAHhE,CACA,EADQ,MAGwD,GAFtD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CA+FzG;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAHhC,MAGgC,GAF9B,OAAO,CAUnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,OAAO,CASnB"}