@cdxgen/cdxgen 13.3.0 → 13.5.0

package/types/lib/inventory/osPackagePurl.d.ts

@@ -0,0 +1,99 @@
+/**
+ * The purl types an OS scan builds from what a package manager reports.
+ * deb, rpm, apk and alpm belong to a distro; brew, macports, snap and flatpak
+ * belong to none. brew, macports, snap and flatpak are not purl-spec types;
+ * cdx-purl builds them as it builds `pkg:chocolatey`.
+ */
+export declare const OS_PACKAGE_PURL_TYPES: Set<string>;
+/**
+ * Whether a purl type is one of the OS package managers handled here.
+ *
+ * @param {string|undefined} type Purl type
+ * @returns {boolean} true for the types in OS_PACKAGE_PURL_TYPES
+ */
+export declare function isOsPackagePurlType(type: string | undefined): boolean;
+/**
+ * Whether a value names an architecture. rpm says `(none)` and trivy says
+ * `None` for a package that has none, such as an rpm's `gpg-pubkey` key record;
+ * neither is an architecture, and neither belongs in a purl.
+ *
+ * @param {string|undefined|null} arch Architecture as a package manager reports it
+ * @returns {boolean} true for a real architecture
+ */
+export declare function isRealArchitecture(arch: string | undefined | null): boolean;
+/**
+ * The epoch of an OS package, as the `epoch` qualifier carries it.
+ *
+ * An rpm keeps its epoch in a field of its own. A deb keeps it in its version
+ * (`2:93`), so the version is read first. Epoch 0 and no epoch are the same,
+ * and apk and Homebrew packages have none.
+ *
+ * @param {{type: string, version?: string, epoch?: string|number}} pkg Package
+ * @returns {string|undefined} The epoch without leading zeros, or undefined
+ */
+export declare function osPackageEpoch(pkg: {
+    type: string;
+    version?: string;
+    epoch?: string | number;
+}): string | undefined;
+/**
+ * The version an OS package carries on its component and in its purl.
+ *
+ * - rpm: `[epoch:]version-release`, the form the container scan writes. The
+ *   purl spec keeps the epoch out of an rpm version, but the container scan
+ *   puts it in the version as well as in the `epoch` qualifier, and an OBOM must
+ *   name the package the same way.
+ * - deb: the version exactly as dpkg reports it, epoch included.
+ * - macports: `version_revision`, the form `port installed` prints.
+ * - apk, alpm, brew, snap and flatpak: the version as it is. A pacman version
+ *   already holds its epoch and release (`1:1.3.2-4`).
+ *
+ * @param {{type: string, version?: string, release?: string, epoch?: string|number, revision?: string|number}} pkg Package
+ * @returns {string} The version, or an empty string when the package has none
+ */
+export declare function osPackageVersion(pkg: {
+    type: string;
+    version?: string;
+    release?: string;
+    epoch?: string | number;
+    revision?: string | number;
+}): string;
+/**
+ * Build the purl of an OS package.
+ *
+ * deb, rpm and apk purls take their vendor (`ubuntu`, `almalinux`, `alpine`,
+ * `wolfi`) and the `distro` and `distro_name` qualifiers from the distro, plus
+ * `arch` and `epoch` from the package. alpm purls take the vendor (`arch`,
+ * `manjaro`) and `arch` only: that is all the alpm type defines, and an Arch
+ * system is rolling, with no release to name. A qualifier with no value is
+ * left out. brew, macports and snap purls carry neither vendor nor qualifiers;
+ * a flatpak purl carries the `arch` and `branch` of the flatpak ref.
+ *
+ * @param {Object} pkg The package
+ * @param {string} pkg.type One of OS_PACKAGE_PURL_TYPES
+ * @param {string} pkg.name Package name; a flatpak's application ID
+ * @param {string} [pkg.version] deb: the dpkg version. rpm: the version tag only. apk: version-rN. macports: the version without its revision.
+ * @param {string} [pkg.release] rpm release tag
+ * @param {string|number} [pkg.epoch] rpm epoch tag
+ * @param {string|number} [pkg.revision] MacPorts revision
+ * @param {string} [pkg.arch] Package architecture
+ * @param {string} [pkg.branch] flatpak branch (`stable`, `48`)
+ * @param {{namespace?: string, distroId?: string, distroName?: string}} [distro]
+ *   What getDistroInfo() reports; read from the host's os-release when left out
+ * @returns {string|null} The purl, or null when the parts do not form a valid one
+ */
+export declare function buildOsPackagePurl(pkg: {
+    type: string;
+    name: string;
+    version?: string;
+    release?: string;
+    epoch?: string | number;
+    revision?: string | number;
+    arch?: string;
+    branch?: string;
+}, distro?: {
+    namespace?: string;
+    distroId?: string;
+    distroName?: string;
+}): string | null;
+//# sourceMappingURL=osPackagePurl.d.ts.map

package/types/lib/inventory/osPackagePurl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"osPackagePurl.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osPackagePurl.js"],"names":[],"mappings":"AAiBA;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,aAShC,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAH7B,MAAM,GAAC,SAGsB,GAF3B,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAH5B,MAAM,GAAC,SAAS,GAAC,IAGW,GAF1B,OAAO,CAKnB;AAqCD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAC,MAAM,CAAA;CAG/B,GAFrB,MAAM,GAAC,SAAS,CAe5B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAHzB;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAC,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,GAAC,MAAM,CAAA;CAGzE,GAFvB,MAAM,CA6BlB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAZnC;IAAoB,IAAI,EAAhB,MAAM,CACd;IAAoB,IAAI,EAAhB,MAAM,CACd;IAAqB,OAAO,AAA5B,CACA,EADQ,MAAM,CACd;IAAqB,OAAO,AAA5B,CACA,EADQ,MAAM,CACd;IAA4B,KAAK,AAAjC,CACA,EADQ,MAAM,GAAC,MAAM,CACrB;IAA4B,QAAQ,AAApC,CACA,EADQ,MAAM,GAAC,MAAM,CACrB;IAAqB,IAAI,AAAzB,CACA,EADQ,MAAM,CACd;IAAqB,MAAM,AAA3B,CACA,EADQ,MAAM,CACd;CAImC,EAAE,MAAM,AAJ3C,CAEA,EAFQ;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAIxB,GAFjC,MAAM,GAAC,IAAI,CA4DvB"}

package/types/lib/inventory/osPackageResolver.d.ts

@@ -7,13 +7,14 @@ export declare function _resetOsInfoCache(): void;
  * correctly computed purl with distro qualifiers derived from /etc/os-release.
  *
  * @param {string} filePath - Absolute path to the library file
- * @returns {{ name: string, version: string, arch: string, type: string, purl: string } | undefined}
+ * @returns {{ name: string, version: string, arch: string, type: string, epoch?: string, purl: string } | undefined}
  */
 export declare function resolvePackageForFile(filePath: string): {
     name: string;
     version: string;
     arch: string;
     type: string;
+    epoch?: string;
     purl: string;
 } | undefined;
 /**
@@ -42,8 +43,11 @@ export declare function collectExecutables(basePath: any, binPaths: any, exclude
  * @param ldConf {String} Config file used by ldconfig to locate additional paths
  * @param ldConfDirPattern {String} Config directory that can contain more .conf files for ldconfig
  * @param excludePaths {Array[String]} Container-relative paths that should be excluded from the result set
+ * @param extraLibGlobs {Array[String]} Extra container-relative globs for files
+ *   the default paths miss, such as libphp*.so under Apache's modules
+ *   directory. The existing globs are unchanged; this adds candidates only.
  *
  * @return {Array[String]} List of executables
  */
-export declare function collectSharedLibs(basePath: any, libPaths: any, ldConf: string, ldConfDirPattern: string, excludePaths?: any): any;
+export declare function collectSharedLibs(basePath: any, libPaths: any, ldConf: string, ldConfDirPattern: string, excludePaths?: any, extraLibGlobs?: any): any;
 //# sourceMappingURL=osPackageResolver.d.ts.map

package/types/lib/inventory/osPackageResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"osPackageResolver.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osPackageResolver.js"],"names":[],"mappings":"AAwBA;;GAEG;AACH,wBAAgB,iBAAiB,SAGhC;AA8ED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA8BnG;AAoGD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAJ9B,MAI8B,EAAE,UAAU,EAH1C,MAAM,EAGoC,GAFxC,MAAM,GAAC,SAAS,CA+B5B;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,KAAA,EAAE,QAAQ,KAAA,EAAE,YAAY,MAAK,OAqEvE;AAcD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,KAAA,EACR,QAAQ,KAAA,EACR,MAAM,QAAA,EACN,gBAAgB,QAAA,EAChB,YAAY,MAAK,OA8ElB"}
+{"version":3,"file":"osPackageResolver.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osPackageResolver.js"],"names":[],"mappings":"AAwBA;;GAEG;AACH,wBAAgB,iBAAiB,SAGhC;AAsDD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA8BnH;AAuGD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAJ9B,MAI8B,EAAE,UAAU,EAH1C,MAAM,EAGoC,GAFxC,MAAM,GAAC,SAAS,CA+B5B;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,KAAA,EAAE,QAAQ,KAAA,EAAE,YAAY,MAAK,OAqEvE;AAcD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,KAAA,EACR,QAAQ,KAAA,EACR,MAAM,QAAA,EACN,gBAAgB,QAAA,EAChB,YAAY,MAAK,EACjB,aAAa,MAAK,OAiGnB"}

package/types/lib/inventory/osinfo.d.ts

@@ -46,14 +46,34 @@ export declare const OS_DISTRO_ALIAS: {
     "ubuntu-24.10": string;
     "ubuntu-25.04": string;
     "ubuntu-25.10": string;
+    "ubuntu-26.04": string;
+    "ubuntu-26.10": string;
     "debian-15": string;
     "debian-14": string;
     "debian-14.5": string;
     "debian-13": string;
+    "debian-13.7": string;
+    "debian-13.6": string;
     "debian-13.5": string;
+    "debian-13.4": string;
+    "debian-13.3": string;
+    "debian-13.2": string;
+    "debian-13.1": string;
     "debian-12": string;
-    "debian-12.5": string;
+    "debian-12.15": string;
+    "debian-12.14": string;
+    "debian-12.13": string;
+    "debian-12.12": string;
+    "debian-12.11": string;
+    "debian-12.10": string;
+    "debian-12.9": string;
+    "debian-12.8": string;
+    "debian-12.7": string;
     "debian-12.6": string;
+    "debian-12.5": string;
+    "debian-12.4": string;
+    "debian-12.2": string;
+    "debian-12.1": string;
     "debian-11": string;
     "debian-11.5": string;
     "debian-10": string;
@@ -179,15 +199,20 @@ export declare function _resetOsReleaseCache(): void;
  * Derive structured distro information from an os-release file.
  *
  * Returns an object with:
- *   - purlType    {string}  "deb" | "apk" | "rpm"
+ *   - purlType    {string}  "deb" | "apk" | "rpm" | "alpm" (Arch and the
+ *                           distros built on it)
  *   - namespace   {string}  canonical purl namespace (e.g. "ubuntu", "alpine",
  *                           "azure-linux" for both Azure Linux and CBL-Mariner)
  *   - distroId    {string}  ID + "-" + VERSION_ID with a canonical vendor
- *                           prefix (e.g. "ubuntu-22.04", "azure-linux-3.0")
- *   - distroName  {string}  codename/alias          (e.g. "jammy")
+ *                           prefix (e.g. "ubuntu-22.04", "azure-linux-3.0",
+ *                           "alpine-3.24.3")
+ *   - distroName  {string}  release codename, or a token OS_DISTRO_ALIAS knows
+ *                           (e.g. "jammy", "rhel", "alpine-3.24"); empty when
+ *                           the distro has neither
  *
- * Mirrors the logic in lib/managers/binary.js getOSPackages() so that both
- * callers share a single implementation.
+ * lib/managers/binary.js getOSPackages() reads its distro from here, so a
+ * container scan and an OBOM run on the same system give a package the same
+ * `distro` and `distro_name` qualifiers.
  *
  * @param {string} [root="/"] - Filesystem root to look for os-release.
  * @returns {{ purlType: string, namespace: string, distroId: string, distroName: string }}

package/types/lib/inventory/osinfo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"osinfo.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osinfo.js"],"names":[],"mappings":"AAGA;;;GAGG;AACH,eAAO,MAAM,eAAe;IAC1B,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,WAAW;IACX,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,UAAU;IACV,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,0BAA0B;IAC1B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,6BAA6B;CAC9B,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB;IAC7B,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,EAAE;IACF,eAAe;IACf,qBAAqB;IACrB,IAAI;IACJ,aAAa;CACd,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,yBAAyB;IACpC,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,EAAE;IACF,IAAI;IACJ,aAAa;CACd,CAAC;AASF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAHrC,MAGqC,GAFnC,OAAO,CAInB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,CAYlB;AAQD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAJ/B,CAEA,EAFQ,MAI6B,GAF3B,MAAM,CAqClB;AAGD;;GAEG;AACH,wBAAgB,oBAAoB,SAEnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAH/B,CACA,EADQ,MAG6B,GAF3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAkHzF"}
+{"version":3,"file":"osinfo.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osinfo.js"],"names":[],"mappings":"AAGA;;;GAGG;AACH,eAAO,MAAM,eAAe;IAC1B,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,WAAW;IACX,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,WAAW;IACX,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,UAAU;IACV,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,0BAA0B;IAC1B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,6BAA6B;CAC9B,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB;IAC7B,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,EAAE;IACF,eAAe;IACf,qBAAqB;IACrB,IAAI;IACJ,aAAa;CACd,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,yBAAyB;IACpC,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,EAAE;IACF,IAAI;IACJ,aAAa;CACd,CAAC;AASF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAHrC,MAGqC,GAFnC,OAAO,CAInB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,CAYlB;AAQD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAJ/B,CAEA,EAFQ,MAI6B,GAF3B,MAAM,CAqClB;AAGD;;GAEG;AACH,wBAAgB,oBAAoB,SAEnC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAH/B,CACA,EADQ,MAG6B,GAF3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAyIzF"}

package/types/lib/inventory/osqueryTransform.d.ts

@@ -81,4 +81,55 @@ export declare function shouldCreateOsQueryPurl(componentType: string): boolean;
  * @returns {string|null} Canonical purl string, or `null` when the parts do not form a valid purl
  */
 export declare function createOsQueryPurl(purlType: string, group: string | null, name: string, version: string, qualifiers: Object | null, subpath: string | null): string | null;
+/**
+ * The version and purl of a row from an OS package table: `deb_packages`,
+ * `rpm_packages`, `pacman_packages`, `homebrew_packages`, `macports_packages`,
+ * `snap_packages`, `flatpak_packages` or the rows of the apk database.
+ *
+ * Such a row is named the way the package manager's own scan names it: deb,
+ * rpm and apk with the vendor and the `arch`, `distro`, `distro_name` and
+ * `epoch` qualifiers of the container scan, an rpm version joined to its
+ * release, a MacPorts version joined to its revision, a flatpak by its
+ * application ID with the `arch` and `branch` of its ref. A row's `path`,
+ * `admindir` or source file is not a path inside the package, so none of them
+ * becomes a subpath.
+ *
+ * @param {string} purlType One of OS_PACKAGE_PURL_TYPES
+ * @param {Object} res osquery row
+ * @param {string} name Component name derived from the row
+ * @param {Object} [distro] What getDistroInfo() reports; the host's by default
+ * @returns {{version: string, purl: string|null}} The component version and the purl, which is null when the row cannot be expressed as one
+ */
+export declare function createOsQueryPackageIdentity(purlType: string, res: Object, name: string, distro?: Object): {
+    version: string;
+    purl: string | null;
+};
+/**
+ * The columns of an OS package row that give its licence and its home page.
+ * They become the component's `licenses` and a `website` reference rather than
+ * properties. `separator` splits a licence column that lists several: pacman
+ * keeps one licence per entry, which osquery joins with commas.
+ */
+export declare const OS_PACKAGE_LICENSE_COLUMNS: {
+    alpm: {
+        license: string;
+        separator: string;
+        website: string;
+    };
+    snap: {
+        license: string;
+    };
+    flatpak: {
+        license: string;
+        website: string;
+    };
+};
+/**
+ * The property name an OS package table column is emitted under.
+ *
+ * @param {string|undefined} purlType Purl type of the table
+ * @param {string} column Column name
+ * @returns {string|undefined} The property name, or undefined when the column is not emitted
+ */
+export declare function osPackagePropertyName(purlType: string | undefined, column: string): string | undefined;
 //# sourceMappingURL=osqueryTransform.d.ts.map

package/types/lib/inventory/osqueryTransform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"osqueryTransform.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osqueryTransform.js"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAH7B,MAG6B,GAF3B,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAL1B,MAK0B,EAAE,YAAY,EAJxC,OAIwC,EAAE,SAAS,EAHnD,MAGmD,GAFjD,MAAM,GAAC,SAAS,CAkB5B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,MAG+B,GAF7B,MAAM,CAWlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAHjC,MAGiC,GAF/B,MAAM,CAelB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAHlC,MAGkC,GAFhC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAJrC,MAIqC,EAAE,QAAQ,AAHvD,CACA,EADQ,MAG2D,GAFzD,MAAM,CAWlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,aAAa,EATJ,MASI,EACb,aAAa,EATJ,MASI,EACb,IAAI,EATK,MAAM,GAAC,SASZ,EACJ,OAAO,EATE,MAAM,GAAC,SAST,EACP,aAAa,EATJ,MAAM,GAAC,SASH,EACb,aAAa,EATJ,MAAM,GAAC,SASH,GARF,MAAM,CA8BlB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAH1C,MAG0C,GAFxC,OAAO,CAMnB;AAaD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EATC,MASD,EACR,KAAK,EATI,MAAM,GAAC,IASX,EACL,IAAI,EATK,MASL,EACJ,OAAO,EATE,MASF,EACP,UAAU,EATD,MAAM,GAAC,IASN,EACV,OAAO,EATE,MAAM,GAAC,IAST,GARI,MAAM,GAAC,IAAI,CAuCvB"}
+{"version":3,"file":"osqueryTransform.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osqueryTransform.js"],"names":[],"mappings":"AAIA;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAH7B,MAG6B,GAF3B,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAL1B,MAK0B,EAAE,YAAY,EAJxC,OAIwC,EAAE,SAAS,EAHnD,MAGmD,GAFjD,MAAM,GAAC,SAAS,CAkB5B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,MAG+B,GAF7B,MAAM,CAalB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAHjC,MAGiC,GAF/B,MAAM,CAelB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAHlC,MAGkC,GAFhC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAJrC,MAIqC,EAAE,QAAQ,AAHvD,CACA,EADQ,MAG2D,GAFzD,MAAM,CAWlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,aAAa,EATJ,MASI,EACb,aAAa,EATJ,MASI,EACb,IAAI,EATK,MAAM,GAAC,SASZ,EACJ,OAAO,EATE,MAAM,GAAC,SAST,EACP,aAAa,EATJ,MAAM,GAAC,SASH,EACb,aAAa,EATJ,MAAM,GAAC,SASH,GARF,MAAM,CA8BlB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAH1C,MAG0C,GAFxC,OAAO,CAMnB;AAgBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EATC,MASD,EACR,KAAK,EATI,MAAM,GAAC,IASX,EACL,IAAI,EATK,MASL,EACJ,OAAO,EATE,MASF,EACP,UAAU,EATD,MAAM,GAAC,IASN,EACV,OAAO,EATE,MAAM,GAAC,IAST,GARI,MAAM,GAAC,IAAI,CAsCvB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAN1C,MAM0C,EAAE,GAAG,EAL/C,MAK+C,EAAE,IAAI,EAJrD,MAIqD,EAAE,MAAM,AAHrE,CACA,EADQ,MAG6D,GAF3D;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAC,IAAI,CAAA;CAAC,CAqBhD;AAmCD;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B;IACrC,IAAI;QAAI,OAAO;QAAc,SAAS;QAAO,OAAO;;IACpD,IAAI;QAAI,OAAO;;IACf,OAAO;QAAI,OAAO;QAAa,OAAO;;CACvC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAJnC,MAAM,GAAC,SAI4B,EAAE,MAAM,EAH3C,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAY5B"}

package/types/lib/inventory/parentSelection.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Which detected project becomes the parent (`metadata.component`) when one
+ * scan covers several ecosystems and no parent was given.
+ *
+ * Each ecosystem detects its own project from its own manifest. The project
+ * whose manifest sits at the scan root describes the repository; one found
+ * deeper is a part of it (a web client in `tools/ui/`, a helper script's
+ * `pyproject.toml`). So candidates are ordered by how deep their ecosystem's
+ * manifests sit, the scan root first, and ties keep the ecosystem order the
+ * scan ran in.
+ */
+/**
+ * How deep the shallowest manifest of an ecosystem sits under a scan root:
+ * 0 for one at the root itself, `Infinity` when there is none (or the
+ * ecosystem is not one this module knows).
+ *
+ * @param {string} root Scan root
+ * @param {string} purlType Purl type of the ecosystem
+ * @param {Object} options CLI options (exclusions)
+ * @returns {number}
+ */
+export declare function manifestDepth(root: string, purlType: string, options?: Object): number;
+/**
+ * Order parent candidates by the depth of their ecosystem's manifests under
+ * the scan roots (the shallowest first). The sort is stable, so candidates of
+ * equal depth keep the order the ecosystems were scanned in.
+ *
+ * @param {Object[]} candidates Detected parent components, in scan order
+ * @param {string[]} roots Scan roots
+ * @param {Object} options CLI options
+ * @returns {Object[]} The candidates, reordered
+ */
+export declare function orderParentCandidates(candidates: Object[], roots: string[], options?: Object): Object[];
+//# sourceMappingURL=parentSelection.d.ts.map

package/types/lib/inventory/parentSelection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parentSelection.d.ts","sourceRoot":"","sources":["../../../lib/inventory/parentSelection.js"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA8DH;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EALvB,MAKuB,EAAE,QAAQ,EAJjC,MAIiC,EAAE,OAAO,GAH1C,MAG+C,GAF7C,MAAM,CA2BlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EALrC,MAAM,EAK+B,EAAE,KAAK,EAJ5C,MAAM,EAIsC,EAAE,OAAO,GAHrD,MAG0D,GAFxD,MAAM,EAAE,CA4BpB"}

package/types/lib/inventory/phpBuildInfo.d.ts

@@ -0,0 +1,142 @@
+/**
+ * The most PHP-named files one scan opens in search of a build version.
+ *
+ * @type {number}
+ */
+export declare const MAX_PHP_PROBES: number;
+/**
+ * Read the version a text starts with, in the grammar the build-version reader
+ * accepts: `8.4.27`, `8.5.0-dev`, `8.6.0RC3`. What follows the version must not
+ * continue it, so `8.4.26.1` and `8.4.26foo` parse to nothing. A distro
+ * revision such as Ubuntu's `8.1.2-1ubuntu2.14` is not an upstream version
+ * either, and parses to nothing rather than to a guess.
+ *
+ * @param {string} text text that begins with the version
+ * @returns {string|undefined} the version, or undefined when the text does not
+ *   begin with one
+ */
+export declare function parsePhpVersion(text: string): string | undefined;
+/**
+ * Read the version a PHP reports about itself, as `php -v` prints it. An
+ * upstream version parses as parsePhpVersion does. A version with a distro
+ * revision, such as Ubuntu's `8.1.2-1ubuntu2.14`, is kept whole and marked: it
+ * is what that PHP reports, but the distro backports fixes without changing the
+ * upstream part, so it must not be matched against upstream advisories.
+ *
+ * @param {string} text text that begins with the version
+ * @returns {{version: string, distroRevision: boolean}|undefined} the version,
+ *   or undefined when the text does not begin with one
+ */
+export declare function parsePhpReportedVersion(text: string): {
+    version: string;
+    distroRevision: boolean;
+} | undefined;
+/**
+ * The package manager whose store a path lies in. Homebrew (`Cellar/<formula>/
+ * <version>/`), Nix (`nix/store/`) and Guix (`gnu/store/`) own everything under
+ * their stores, whatever links lead there, and a PHP they own is identified by
+ * their package, never as an unpackaged build.
+ *
+ * @param {string} filePath absolute or root-relative path, either separator
+ * @returns {string|undefined} `homebrew`, `nix` or `guix`, or undefined
+ */
+export declare function packageStoreOf(filePath: string): string | undefined;
+/**
+ * Classify a file by its basename into a PHP SAPI, or undefined when the name
+ * is not one php-src installs.
+ *
+ * @param {string} fileName basename or path of the candidate
+ * @returns {string|undefined} cli, fpm, cgi, phpdbg, libphp or frankenphp
+ */
+export declare function classifyPhpSapi(fileName: string): string | undefined;
+/**
+ * Read the PHP build version of a binary or shared library.
+ *
+ * @param {string} absPath absolute path
+ * @param {string|undefined} rootDir extracted root, when the file came from one
+ * @returns {{version: string, source: string}|undefined} source is `binary`
+ *   or `php_version.h`
+ */
+export declare function readPhpBuildVersion(absPath: string, rootDir: string | undefined): {
+    version: string;
+    source: string;
+} | undefined;
+/**
+ * The CPE that lets a downstream scanner match a PHP version. NVD puts a
+ * pre-release suffix in the update field, e.g.
+ * cpe:2.3:a:php:php:8.5.0:rc1:*:*:*:*:*:* (NVD CPE dictionary).
+ *
+ * @param {string} version PHP version in the build-version grammar
+ * @returns {string} CPE 2.3 string
+ */
+export declare function phpCpe(version: string): string;
+/**
+ * A PHP runtime is one `platform` component per distinct version, like the Go
+ * stdlib component. Its identity is `pkg:generic/php`: it is only used where no
+ * package manager owns PHP, or where a PATH probe cannot tell which one does.
+ *
+ * @param {string} version PHP version in the build-version grammar, or as a
+ *   distro build reports it
+ * @param {Object} [options] options
+ * @param {boolean} [options.withCpe=true] false for a version with a distro
+ *   revision, which no upstream CPE describes
+ * @returns {Object} component with `purl`, `bom-ref` and, unless left out, `cpe`
+ */
+export declare function createPhpRuntimeComponent(version: string, { withCpe }?: {
+    withCpe?: boolean;
+}): Object;
+/**
+ * The bom-ref of the runtime component for a version.
+ *
+ * @param {string} version PHP version in the build-version grammar
+ * @returns {string} bom-ref, which is the runtime's purl
+ */
+export declare function phpRuntimeRef(version: string): string;
+/**
+ * The properties a PHP file component carries once its build version is known.
+ * They belong on unpackaged `file` components only: a package-owned PHP is
+ * identified by its package, and distro builds carry backported fixes under
+ * old version numbers, so the PHP-RCE audit rules that match these properties
+ * would raise false positives there.
+ *
+ * @param {{version: string, source: string}} build result of readPhpBuildVersion
+ * @param {string} sapi result of classifyPhpSapi
+ * @returns {{name: string, value: string}[]} properties to append
+ */
+export declare function phpBuildProperties(build: {
+    version: string;
+    source: string;
+}, sapi: string): {
+    name: string;
+    value: string;
+}[];
+/**
+ * Start collecting the runtime components and edges of one scan.
+ *
+ * @returns {{runtimeComponents: Object[], dependencies: Object[], runtimeRefs: Set<string>}}
+ */
+export declare function createPhpRuntimeInventory(): {
+    runtimeComponents: Object[];
+    dependencies: Object[];
+    runtimeRefs: Set<string>;
+};
+/**
+ * Tag a PHP file component with its build facts and link it to the runtime
+ * component of its version, creating that component on first use. Mutates the
+ * component in place, as the Go collector does.
+ *
+ * @param {{runtimeComponents: Object[], dependencies: Object[], runtimeRefs: Set<string>}} inventory
+ *   accumulator from createPhpRuntimeInventory
+ * @param {Object} component file component, with a `properties` array
+ * @param {{version: string, source: string}} build result of readPhpBuildVersion
+ * @param {string} sapi result of classifyPhpSapi
+ */
+export declare function attachPhpBuild(inventory: {
+    runtimeComponents: Object[];
+    dependencies: Object[];
+    runtimeRefs: Set<string>;
+}, component: Object, build: {
+    version: string;
+    source: string;
+}, sapi: string): void;
+//# sourceMappingURL=phpBuildInfo.d.ts.map

package/types/lib/inventory/phpBuildInfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"phpBuildInfo.d.ts","sourceRoot":"","sources":["../../../lib/inventory/phpBuildInfo.js"],"names":[],"mappings":"AA8CA;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAFjB,MAEsB,CAAC;AAUjC;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,GAHvB,MAAM,GAAC,SAAS,CAc5B;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAJjC,MAIiC,GAH/B;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAC,GAAC,SAAS,CAkBhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CAuB5B;AAoBD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,MAAM,GAAC,SAAS,CAa5B;AA6JD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EALhC,MAKgC,EAAE,OAAO,EAJzC,MAAM,GAAC,SAIkC,GAHvC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAwBvD;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,OAAO,EAHnB,MAGmB,GAFjB,MAAM,CAgBlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAPtC,MAOsC,EAAE,EAAE,OAAc,EAAE,AALlE,CAGA,EAFA;IAA0B,OAAO,AAAjC,CAEA,EAFQ,OAAO,CAEf;CAEuE,GAF7D,MAAM,CAWlB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,MAAM,CAIlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAJ7B;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAIH,EAAE,IAAI,EAHnC,MAGmC,GAFjC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAQ3C;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAF5B;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAC,CAI3F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAN7B;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAMjD,EAAE,SAAS,EAJxC,MAIwC,EAAE,KAAK,EAH/C;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAGe,EAAE,IAAI,EAFrD,MAEqD,QAe/D"}

package/types/lib/inventory/phpHostProbe.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Look for PHP no package manager owns, in the fixed directories of the host.
+ * Components come back only for the files nothing owns: a `file` component for
+ * each PHP binary or library with the cdx:php properties, one `platform`
+ * component per version with its CPE, and the edges between them.
+ *
+ * @param {Object} [options] probe options
+ * @param {string} [options.rootPath] directory the fixed directories hang off:
+ *   `/`, or the system drive on Windows. Tests point it at a built tree.
+ * @param {string} [options.platform] `linux`, `darwin` or `win32`
+ * @param {Object} [options.env] environment read for ProgramFiles, SystemDrive
+ *   and ChocolateyInstall, instead of the process's
+ * @param {{dpkgInfoDirectory?: string, apkInstalledFile?: string, rpmDatabaseDirectories?: string[]}} [options.packageDatabases]
+ *   where the package databases are, instead of under `rootPath`
+ * @param {function(string): (Object[]|undefined)} [options.executeOsQuery] runs
+ *   an osquery query; the rpm database is only asked through it
+ * @param {Object[]} [options.packageComponents] the packages the OS scan has
+ *   inventoried, from which Chocolatey's are known
+ * @param {number} [options.maxProbes] most candidate files to look at
+ * @returns {{components: Object[], dependencies: Object[]}}
+ */
+export declare function probeHostPhp(options?: {
+    rootPath?: string;
+    platform?: string;
+    env?: Object;
+    packageDatabases?: {
+        dpkgInfoDirectory?: string;
+        apkInstalledFile?: string;
+        rpmDatabaseDirectories?: string[];
+    };
+}): {
+    components: Object[];
+    dependencies: Object[];
+};
+//# sourceMappingURL=phpHostProbe.d.ts.map

package/types/lib/inventory/phpHostProbe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"phpHostProbe.d.ts","sourceRoot":"","sources":["../../../lib/inventory/phpHostProbe.js"],"names":[],"mappings":"AAmjBA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAAC,OAAO,AAfjC,CAQA,EAPA;IAAyB,QAAQ,AAAjC,CAEA,EAFQ,MAAM,CAEd;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;IAAyB,GAAG,AAA5B,CAEA,EAFQ,MAAM,CAEd;IAA6G,gBAAgB,AAA7H,CAEA,EAFQ;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;KAAC,CAElG;CAOsC,GAF5B;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CA0D1D"}

package/types/lib/inventory/rootfsCerts.d.ts

@@ -0,0 +1,27 @@
+export declare const ROOTFS_CERT_LIMITS: Readonly<{
+    maxFileBytes: number;
+    maxFiles: 20000;
+    maxEntries: 500000;
+    maxDepth: 12;
+}>;
+/**
+ * Pure-JS inventory of the certificate locations trustinspector's rootfs
+ * mode covers, plus Kubernetes TLS secrets and Android pins. Used when the
+ * plugin is not available. Produces components through the shared
+ * CertificateCollector, so bom-refs, names and deduplication match the other
+ * producers; locations are root-relative ("/etc/ssl/certs/x.crt").
+ *
+ * Every access stays inside the root: symlinks (files or directories) are
+ * skipped, only regular files are opened, and the walk is bounded by entry,
+ * file, size and depth limits.
+ *
+ * @param {string} rootDir extracted root filesystem
+ * @param {object} [limits] overrides for ROOTFS_CERT_LIMITS (tests)
+ * @returns {{components: object[], dependencies: object[], warnings: string[]}}
+ */
+export declare function collectRootfsCertificates(rootDir: string, limits?: object): {
+    components: object[];
+    dependencies: object[];
+    warnings: string[];
+};
+//# sourceMappingURL=rootfsCerts.d.ts.map

package/types/lib/inventory/rootfsCerts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rootfsCerts.d.ts","sourceRoot":"","sources":["../../../lib/inventory/rootfsCerts.js"],"names":[],"mappings":"AAqBA,eAAO,MAAM,kBAAkB;;;;;EAK7B,CAAC;AA0IH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAJtC,MAIsC,EAAE,MAAM,AAHtD,CACA,EADQ,MAGmD,GAFjD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAC,CA6N9E"}

package/types/lib/inventory/rustFormulationParser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rustFormulationParser.d.ts","sourceRoot":"","sources":["../../../lib/inventory/rustFormulationParser.js"],"names":[],"mappings":"AAmTA;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,EAFxB;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAC,CAAA;CAwBxF,CAAC"}
+{"version":3,"file":"rustFormulationParser.d.ts","sourceRoot":"","sources":["../../../lib/inventory/rustFormulationParser.js"],"names":[],"mappings":"AAkTA;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,EAFxB;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAC,CAAA;CAwBxF,CAAC"}

package/types/lib/inventory/scalaCoords.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Parse a Scala-published Maven artifact name into its coordinate parts.
+ *
+ * @param {string} name Maven artifactId, for example `upickle_sjs1_3`
+ * @returns {{ originalName: string, artifactBase: string, binaryVersion: string|null,
+ *   platformSuffix: string, purlName: string }} The artifact name without any
+ *   Scala suffix (`upickle`), the Scala binary version from the suffix (`3`),
+ *   the platform suffix including the underscore (`_sjs1`) or an empty string,
+ *   and the artifact name sbt-style purls emit (binary suffix dropped, platform
+ *   suffix kept).
+ */
+export declare function parseScalaArtifact(name: string): {
+    originalName: string;
+    artifactBase: string;
+    binaryVersion: string | null;
+    platformSuffix: string;
+    purlName: string;
+};
+/**
+ * Build a qualifier-free coordinate key for a Scala-published artifact.
+ *
+ * The key ignores purl qualifiers such as `repository_url` and `type`, so the
+ * POM-coordinate keys of the jar namespace mapping and the sbt-style purls of
+ * the components resolve to the same entry.
+ *
+ * @param {Object} parts Coordinate parts
+ * @param {string} [parts.type] Purl type, defaults to `maven`
+ * @param {string} [parts.group] Maven groupId
+ * @param {string} parts.artifactBase Artifact name without any Scala suffix
+ * @param {string} [parts.platformSuffix] `_sjs1`, `_native0.5` or empty
+ * @param {string} [parts.version] Package version
+ * @returns {string} The coordinate key
+ */
+export declare function scalaCoordinateKey({ type, group, artifactBase, platformSuffix, version, }?: {
+    type?: string;
+    group?: string;
+    artifactBase: string;
+    platformSuffix?: string;
+    version?: string;
+}): string;
+/**
+ * Build the qualifier-free coordinate key of a purl string.
+ *
+ * The artifact name is normalized with {@link parseScalaArtifact}, so
+ * `pkg:maven/g/foo_3@1.0` and the sbt-style `pkg:maven/g/foo@1.0` share a key,
+ * while the Scala.js build `foo_sjs1_3` keeps its own key (`foo` plus the
+ * `_sjs1` platform suffix) and never joins the plain `foo` component.
+ *
+ * @param {string} purlString Package URL to normalize
+ * @returns {string|undefined} The coordinate key, or undefined when the string
+ *   is not a parseable purl
+ */
+export declare function coordinateKeyFromPurl(purlString: string): string | undefined;
+/**
+ * The coordinate key of a purl together with the Scala binary version its
+ * artifact name carries, if any.
+ *
+ * @param {string} purlString Package URL to normalize
+ * @returns {{ key: string, binaryVersion: string|null }|undefined} The key
+ *   and binary version, or undefined when the string is not a parseable purl
+ */
+export declare function scalaCoordinateOfPurl(purlString: string): {
+    key: string;
+    binaryVersion: string | null;
+} | undefined;
+/**
+ * The artifactId the library is published under, for cache and repository
+ * lookups only. Components a Scala build tool reports carry the name with the
+ * Scala binary suffix stripped (the platform suffix kept) together with
+ * `cdx:scala:compilerVersion`; on disk and in the repository the artifact is
+ * `cats-core_2.13` or `upickle_sjs1_3`. Names that end in a full Scala version
+ * are used as they are.
+ *
+ * The component's own `name`, `purl` and `bom-ref` never change.
+ *
+ * @param {Object} pkg Package with `name` and `properties`.
+ * @returns {string} The artifactId to look up.
+ */
+export declare function publishedArtifactId(pkg: Object): string;
+//# sourceMappingURL=scalaCoords.d.ts.map

package/types/lib/inventory/scalaCoords.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scalaCoords.d.ts","sourceRoot":"","sources":["../../../lib/inventory/scalaCoords.js"],"names":[],"mappings":"AAWA;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAR5B,MAQ4B,GAP1B;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAC;IACjF,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CA+B9C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,IAAc,EACd,KAAU,EACV,YAAiB,EACjB,cAAmB,EACnB,OAAY,GACb,GAbE;IAAuB,IAAI,AAA3B,CACA,EADQ,MAAM,CACd;IAAuB,KAAK,AAA5B,CACA,EADQ,MAAM,CACd;IAAsB,YAAY,EAA1B,MAAM,CACd;IAAuB,cAAc,AAArC,CACA,EADQ,MAAM,CACd;IAAuB,OAAO,AAA9B,CACA,EADQ,MAAM,CACd;CAQG,GARO,MAAM,CAUlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAJrC,MAIqC,GAHnC,MAAM,GAAC,SAAS,CAK5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAJrC,MAIqC,GAHnC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,GAAC,SAAS,CA2BjE;AAQD;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAH5B,MAG4B,GAF1B,MAAM,CAWlB"}