@cdxgen/cdxgen 13.3.0 → 13.5.0

package/types/lib/inventory/source.d.ts

@@ -15,10 +15,14 @@ export declare function isSafeGitRefName(refName: string | undefined): boolean;
  * @param {string[]} args git arguments
  * @param {Object} options command options
  * @param {string|undefined} options.cwd working directory
+ * @param {boolean|undefined} options.noRepository run outside any repository,
+ *   so the config of a repository in the working directory, such as url.*.insteadOf
+ *   or core.sshCommand, cannot change where a remote command connects
  * @returns {Object} spawn result
  */
 export declare function hardenedGitCommand(args: string[], options?: {
     cwd: string | undefined;
+    noRepository: boolean | undefined;
 }): Object;
 /**
  * Build CycloneDX release notes from git tags and commits.
@@ -55,6 +59,17 @@ export declare function isAllowedWinPath(p: string): boolean;
  * @returns {boolean} true if the path is present in the allowed paths. false otherwise.
  */
 export declare function isAllowedPath(p: string): boolean;
+/**
+ * Checks where the given path really points, after following symlinks, against
+ * where the allowed paths really point. Both sides are resolved, so an allowed
+ * directory that is itself reached through a link (such as /tmp on macOS) still
+ * matches, while a link inside an allowed directory that leads outside it does
+ * not.
+ *
+ * @param {string} p Path string to check
+ * @returns {boolean} true if the real path is inside a real allowed path
+ */
+export declare function isAllowedRealPath(p: string): boolean;
 /**
  * Determine if the path could be a package URL.
  *
@@ -76,6 +91,19 @@ export declare function maybeRemotePath(filePath: string): boolean;
  * @returns {Object|null} Error object if invalid, or null if valid
  */
 export declare function validateAndRejectGitSource(filePath: string): Object | null;
+/**
+ * Return the host a git client connects to for a remote, read the way git,
+ * libcurl and OpenSSH read it rather than the way new URL() does. git ends the
+ * authority of ssh:// and git:// URLs only at the first slash, percent-decodes
+ * it before splitting off the host, and reads a leading "[...]" as the host.
+ * OpenSSH takes the host after the last "@". So a "?" or "#" before the first
+ * slash, a second "@", brackets in the user name, or a percent sign in an
+ * ssh:// or git:// authority make the host ambiguous.
+ *
+ * @param {string} remote Git URL or SCP-like address
+ * @returns {string|undefined} lower-cased host, or undefined when it is ambiguous
+ */
+export declare function getGitRemoteHost(remote: string): string | undefined;
 /**
  * Clone a git repository into a temporary directory.
  *

package/types/lib/inventory/source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../lib/inventory/source.js"],"names":[],"mappings":"AAqCA,6FAA6F;AAC7F,eAAO,MAAM,4BAA4B,wIAC8F,CAAC;AAExI,6DAA6D;AAC7D,eAAO,MAAM,2BAA2B,UAWvC,CAAC;AAuBF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAAM,GAAC,SAGsB,GAF3B,OAAO,CAUnB;AAiBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAL5B,MAAM,EAKsB,EAAE,OAAO,GAH7C;IAAkC,GAAG,EAA7B,MAAM,GAAC,SAAS,CACxB;CAEkD,GAFxC,MAAM,CAuClB;AA+ED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAAM,GAAC,SAI+B,EAAE,OAAO,GAH/C,MAGoD,GAFlD,MAAM,GAAC,SAAS,CA6I5B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,CASlB;AAkBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,OAAO,CAWnB;AAkBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAHvB,MAGuB,GAFrB,OAAO,CA+BnB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAHpB,MAGoB,GAFlB,OAAO,CAyBnB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAHxC,MAGwC,GAFtC,MAAM,GAAC,IAAI,CAgEvB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAJrB,MAIqB,EAAE,MAAM,GAH7B,MAAM,GAAC,MAAM,EAAE,GAAC,IAGoB,GAFlC,MAAM,CAyDlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAAM,GAAC,SAGgC,GAFrC,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAJrC,MAIqC,EAAE,cAAc,EAHrD,MAAM,GAAC,SAG8C,GAFnD,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAJtC,MAIsC,EAAE,cAAc,EAHtD,MAAM,GAAC,SAG+C,GAFpD,MAAM,GAAC,SAAS,CAiF5B;AAkJD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAGkC,GAFhC;IAAC,MAAM,EAAC,MAAM,CAAC;IAAA,KAAK,EAAC,MAAM,CAAC;IAAA,OAAO,EAAC,MAAM,CAAA;CAAC,GAAC,IAAI,CA4D5D;AA6GD;;GAEG;AACH,wBAAgB,yBAAyB,SAExC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,WAAW,EAJ5C,KAAK,CAAC,MAAM,CAIgC,GAF1C,OAAO,CAAC,IAAI,CAAC,CA6BzB;AAmDD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CA4MlI;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAF5B,MAE4B,QAkCtC"}
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../lib/inventory/source.js"],"names":[],"mappings":"AAqCA,6FAA6F;AAC7F,eAAO,MAAM,4BAA4B,wIAC8F,CAAC;AAExI,6DAA6D;AAC7D,eAAO,MAAM,2BAA2B,UAWvC,CAAC;AAuBF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAAM,GAAC,SAGsB,GAF3B,OAAO,CAUnB;AAiBD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAR5B,MAAM,EAQsB,EAAE,OAAO,GAN7C;IAAkC,GAAG,EAA7B,MAAM,GAAC,SAAS,CACxB;IAAmC,YAAY,EAAvC,OAAO,GAAC,SAAS,CAGzB;CAEkD,GAFxC,MAAM,CA6ClB;AA+ED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAAM,GAAC,SAI+B,EAAE,OAAO,GAH/C,MAGoD,GAFlD,MAAM,GAAC,SAAS,CAiJ5B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,CASlB;AAkBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,OAAO,CAWnB;AAkBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAHvB,MAGuB,GAFrB,OAAO,CA+BnB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAHpB,MAGoB,GAFlB,OAAO,CAyBnB;AA2BD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAHxB,MAGwB,GAFtB,OAAO,CAkBnB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAHxC,MAGwC,GAFtC,MAAM,GAAC,IAAI,CA2GvB;AAuBD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CAuD5B;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAJrB,MAIqB,EAAE,MAAM,GAH7B,MAAM,GAAC,MAAM,EAAE,GAAC,IAGoB,GAFlC,MAAM,CAgElB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAAM,GAAC,SAGgC,GAFrC,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAJrC,MAIqC,EAAE,cAAc,EAHrD,MAAM,GAAC,SAG8C,GAFnD,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAJtC,MAIsC,EAAE,cAAc,EAHtD,MAAM,GAAC,SAG+C,GAFpD,MAAM,GAAC,SAAS,CAiF5B;AAkJD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAGkC,GAFhC;IAAC,MAAM,EAAC,MAAM,CAAC;IAAA,KAAK,EAAC,MAAM,CAAC;IAAA,OAAO,EAAC,MAAM,CAAA;CAAC,GAAC,IAAI,CA4D5D;AA6GD;;GAEG;AACH,wBAAgB,yBAAyB,SAExC;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,WAAW,EAJ5C,KAAK,CAAC,MAAM,CAIgC,GAF1C,OAAO,CAAC,IAAI,CAAC,CA6BzB;AAiDD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CA4MlI;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAF5B,MAE4B,QAkCtC"}

package/types/lib/inventory/spdx.d.ts

@@ -57,6 +57,30 @@ export declare function readLicenseText(licenseFilepath: any, licenseContentType
  * @param {string} name License full name
  */
 export declare function findLicenseId(name: string): any;
+/**
+ * Identify a license from the title and opening of its full text. A license
+ * text quotes other licenses (the GNU GPL's text names the GNU Lesser GPL),
+ * so the substring scan of `guessLicenseId` alone can name the wrong one.
+ *
+ * @param {string} content License file contents
+ * @returns {string|undefined} SPDX license id or expression
+ */
+export declare function licenseIdFromText(content: string): string | undefined;
+/**
+ * Identify every license a notice grants, in the order the notice grants
+ * them. A notice can grant several: one LICENSE file holding an MIT grant and
+ * an Apache-2.0 grant (gopkg.in/yaml.v3), or a choice of licenses followed by
+ * each full text (github.com/spdx/tools-golang). A license text quotes others
+ * (the GNU GPL names the GNU Lesser GPL, the MPL names the GNU licenses), so
+ * only phrases that a grant carries count: a GNU license is found by its title
+ * standing on a line of its own, the others by a sentence of their grant.
+ * A notice none of these phrases match falls back to {@link guessLicenseId}.
+ *
+ * @param {string} content License file contents
+ * @returns {string[]} SPDX license ids or expressions; empty when none is
+ *   recognized
+ */
+export declare function guessLicenseIds(content: string): string[];
 /**
  * Method to guess the spdx license id from license contents
  *

package/types/lib/inventory/spdx.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spdx.d.ts","sourceRoot":"","sources":["../../../lib/inventory/spdx.js"],"names":[],"mappings":"AAeA;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAFf,MAAM,EAIf,CAAC;AAMF;;;;;;IAMI;AACJ,wBAAgB,uBAAuB,CAAC,OAAO,EAJpC,MAIoC,GAHlC,OAAO,CA0BnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,OAAA,SA2BhD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,KAAA,qBAqG9B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,UAAU,QAAA,EAAE,GAAG,QAAA,GAFnC,MAAM,CAoDjB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,KAAA,EAAE,CAAC,KAAA,EAAE,cAAc,KAAA,QAoCpD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,eAAe,KAAA,EAAE,kBAAkB,KAAA;;SAUlE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAFvB,MAEuB,OAYjC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAF3B,MAE2B,OAUrC"}
+{"version":3,"file":"spdx.d.ts","sourceRoot":"","sources":["../../../lib/inventory/spdx.js"],"names":[],"mappings":"AAeA;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAFf,MAAM,EAIf,CAAC;AAMF;;;;;;IAMI;AACJ,wBAAgB,uBAAuB,CAAC,OAAO,EAJpC,MAIoC,GAHlC,OAAO,CA0BnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,OAAA,SA2BhD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,KAAA,qBAqG9B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,UAAU,QAAA,EAAE,GAAG,QAAA,GAFnC,MAAM,CAoDjB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,KAAA,EAAE,CAAC,KAAA,EAAE,cAAc,KAAA,QAoCpD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,eAAe,KAAA,EAAE,kBAAkB,KAAA;;SAUlE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAFvB,MAEuB,OAYjC;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,GAF5B,MAAM,GAAC,SAAS,CAyF5B;AAqDD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAJ5B,MAI4B,GAH1B,MAAM,EAAE,CAgFpB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAF3B,MAE2B,OAcrC"}

package/types/lib/inventory/traceRunner.d.ts

@@ -57,7 +57,7 @@ export declare function resolveSaferExecBinary(): string | undefined;
  * @param {boolean} [options.denyPersistenceWrites] - Deny writes to auto-execution and persistence locations
  * @param {boolean} [options.privateTmp] - Private tmpfs /tmp and /var/tmp (Linux)
  * @param {string} [options.protectHome] - Home isolation: read-only, tmpfs, or off (Linux)
- * @returns {Promise<{libPaths: string[], httpAccessEntries: Object[], egressEntries?: Object[], dryRunSummary?: Object}>} Collected libraries, HTTP URLs, proxy egress decisions, and the dry-run summary
+ * @returns {Promise<{libPaths: string[], httpAccessEntries: Object[], cryptoEntries?: Object[], cryptoComponents?: Object[], cryptoResult?: Object, egressEntries?: Object[], dryRunSummary?: Object}>} Collected libraries, HTTP URLs, crypto observations, proxy egress decisions, and the dry-run summary
  * @throws {Error} When the @cdxgen/safer-exec tracing runtime is not installed
  *   (for example after pruning it from a standalone payload), since the traced
  *   command could never run and the BOM would silently be empty
@@ -94,9 +94,24 @@ export declare function executeAndTrace(commandStr: string, workingDir?: string,
 }): Promise<{
     libPaths: string[];
     httpAccessEntries: Object[];
+    cryptoEntries?: Object[];
+    cryptoComponents?: Object[];
+    cryptoResult?: Object;
     egressEntries?: Object[];
     dryRunSummary?: Object;
 }>;
+/**
+ * Picks the safer-exec engine's own lines out of the stderr it shares with the
+ * traced command. Warnings start with "safer-exec: warning:"; when the engine
+ * stops a run, its error is the last other "safer-exec: " line it prints.
+ *
+ * @param {string} stderr Captured stderr of a safer-exec run
+ * @returns {{warnings: string[], error: string|undefined}} Unique engine warnings, and the engine's error if any
+ */
+export declare function engineMessages(stderr: string): {
+    warnings: string[];
+    error: string | undefined;
+};
 /**
  * Extracts the egress proxy's decisions from a safer-exec audit log.
  * "proxy-connect" targets are "host:port"; "proxy-violation" targets are

package/types/lib/inventory/traceRunner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"traceRunner.d.ts","sourceRoot":"","sources":["../../../lib/inventory/traceRunner.js"],"names":[],"mappings":"AAsBA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAFvB,OAAO,CAInB;AAKD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAHxB,MAGwB,GAFtB;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,CA6BzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAFzB,MAAM,GAAC,SAAS,CAsE5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAsB,eAAe,CAAC,UAAU,EApCrC,MAoCqC,EAAE,UAAU,AAnCzD,CACA,EADQ,MAmCiD,EAAE,OAAO,AAlClE,CA6BA,EA5BA;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;IAA0B,cAAc,AAAxC,CACA,EADQ,OAAO,CACf;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAAyB,MAAM,AAA/B,CACA,EADQ,MAAM,CACd;IAAyB,UAAU,AAAnC,CACA,EADQ,MAAM,CACd;IAA0B,iBAAiB,AAA3C,CACA,EADQ,OAAO,CACf;IAA0B,qBAAqB,AAA/C,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;CAKuE,GAL7D,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAC,CAAC,CAwTxH;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAHhC,MAAM,EAG0B,GAF9B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,EAAE,CAkD9E;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,iBAAiB,EAHjD,MAAM,EAG2C;eAFlB,GAAG,CAAC,MAAM,CAAC;gBAAc,MAAM,EAAE;GA+C1E"}
+{"version":3,"file":"traceRunner.d.ts","sourceRoot":"","sources":["../../../lib/inventory/traceRunner.js"],"names":[],"mappings":"AAsBA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAFvB,OAAO,CAInB;AAKD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAHxB,MAGwB,GAFtB;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,CA6BzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAFzB,MAAM,GAAC,SAAS,CAsF5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAsB,eAAe,CAAC,UAAU,EApCrC,MAoCqC,EAAE,UAAU,AAnCzD,CACA,EADQ,MAmCiD,EAAE,OAAO,AAlClE,CA6BA,EA5BA;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;IAA0B,cAAc,AAAxC,CACA,EADQ,OAAO,CACf;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAAyB,MAAM,AAA/B,CACA,EADQ,MAAM,CACd;IAAyB,UAAU,AAAnC,CACA,EADQ,MAAM,CACd;IAA0B,iBAAiB,AAA3C,CACA,EADQ,OAAO,CACf;IAA0B,qBAAqB,AAA/C,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;CAKuE,GAL7D,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAC,CAAC,CAwWtM;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAH1B,MAG0B,GAFxB;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,GAAC,SAAS,CAAA;CAAC,CAazD;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAHhC,MAAM,EAG0B,GAF9B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,EAAE,CAkD9E;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,iBAAiB,EAHjD,MAAM,EAG2C;eAFlB,GAAG,CAAC,MAAM,CAAC;gBAAc,MAAM,EAAE;GA+C1E"}

package/types/lib/inventory/tracedCrypto.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Names the bulk cipher of a TLS cipher suite as a crypto-oid.json key, from
+ * either its IANA name (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) or its OpenSSL
+ * name (ECDHE-RSA-AES128-GCM-SHA256).
+ *
+ * @param {string} suiteName Cipher suite name
+ * @returns {{name: string, bits: number, mode: string|undefined}|undefined} The cipher, when it has an OID
+ */
+export declare function suiteCipher(suiteName: string): {
+    name: string;
+    bits: number;
+    mode: string | undefined;
+} | undefined;
+/**
+ * Turns the CBOM safer-exec writes for a traced command into components that
+ * cdxgen can merge and validate:
+ *
+ * - every asset gets a bom-ref, without which the assets merge into one
+ * - algorithms carry their OID, and those without one are left out
+ * - hybrid key-exchange groups become their classical and ML-KEM halves
+ * - cipher suites become their bulk cipher, which the protocol's suites refer
+ *   to by bom-ref
+ * - algorithm properties keep only values the schema allows
+ * - crypto libraries are left out: they are the traced library components,
+ *   marked with cdx:dynamic:cryptoLibrary
+ *
+ * @param {Object[]} cbomComponents Components of the safer-exec CBOM
+ * @returns {Object[]} Normalized cryptographic-asset components
+ */
+export declare function normalizeTracedCryptoComponents(cbomComponents: Object[]): Object[];
+/**
+ * Builds the shared certificate model for the chains servers presented in TLS
+ * ≤ 1.2 handshakes, from the `chain` arrays of safer-exec's crypto result
+ * (report channel, safer-exec ≥ 1.2.0; earlier releases and TLS 1.3 entries
+ * carry no chain and yield nothing). The records go through the shared
+ * certificate collector, so bom-refs, properties and dedup match certificates
+ * found on disk. A presented chain is untrusted server input: no issuer edges
+ * are inferred from it, and the certificate and public-key components link
+ * through the collector as every producer's do. Each TLS protocol component
+ * provides the certificates and keys presented under it — the edge safer-
+ * exec's own CBOM records — which answers which servers presented a key.
+ *
+ * @param {Object} cryptoResult safer-exec CRYPTO result (`result.crypto`)
+ * @param {Set<string>} protocolRefs bom-refs of the protocol components in the BOM;
+ *   a provides edge is only emitted for a protocol that is actually present
+ * @returns {{components: Object[], dependencies: Object[]}} certificate,
+ *   public-key and algorithm components, and the protocol provides edges
+ */
+export declare function observedChainComponents(cryptoResult: Object, protocolRefs?: Set<string>): {
+    components: Object[];
+    dependencies: Object[];
+};
+/**
+ * Maps the crypto libraries safer-exec reported to the paths they were loaded
+ * from.
+ *
+ * @param {Object[]} cryptoEntries safer-exec crypto-library and crypto-cipher audit entries
+ * @returns {Map<string, {name: string, version: string}>} Crypto libraries by path
+ */
+export declare function cryptoLibrariesByPath(cryptoEntries: Object[]): Map<string, {
+    name: string;
+    version: string;
+}>;
+//# sourceMappingURL=tracedCrypto.d.ts.map

package/types/lib/inventory/tracedCrypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracedCrypto.d.ts","sourceRoot":"","sources":["../../../lib/inventory/tracedCrypto.js"],"names":[],"mappings":"AA0DA;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAH1B,MAG0B,GAFxB;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAC,SAAS,CAAA;CAAC,GAAC,SAAS,CAuB1E;AA+DD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,+BAA+B,CAAC,cAAc,EAHnD,MAAM,EAG6C,GAFjD,MAAM,EAAE,CA+GpB;AAqBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAPH,MAOG,EACZ,YAAY,GAPH,GAAG,CAAC,MAAM,CAOK,GALb;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAwF1D;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAHxC,MAAM,EAGkC,GAFtC,GAAG,CAAC,MAAM,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CAgBxD"}

package/types/lib/managers/binary.d.ts

@@ -115,6 +115,16 @@ export declare function dropRedundantSourceComponents(pkgList: any[]): any[];
  * @returns {Object} Metadata containing packages, dependencies, etc
  */
 export declare function getOSPackages(src: string, imageConfig: Object, options?: {}): Object;
+/**
+ * Split a `Name <address>` maintainer string into an `organizationalContact`.
+ *
+ * @param {string} value Maintainer or supplier string
+ * @returns {{name: string, email?: string}|undefined} The contact, if any
+ */
+export declare function parseOrganizationalContact(value: string): {
+    name: string;
+    email?: string;
+} | undefined;
 /**
  * Collect the dependency edges trivy recorded for one OS package component.
  *

package/types/lib/managers/binary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"binary.d.ts","sourceRoot":"","sources":["../../../lib/managers/binary.js"],"names":[],"mappings":"AA+YA;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,AAH9C,CACA,EADQ,MAAM,EAGqC,GAFzC,MAAM,EAAE,CAgBpB;AA4FD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,GAH5B,MAAM,GAAC,SAAS,CAmB5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EALtB,MAKsB,UA+BpC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,OAAA,EAAE,GAAG,EAJ9B,MAI8B,GAFhC,SAAS,GAAC,MAAM,CAmC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EARK,MAQL,EACJ,OAAO,EARE,MAQF,EACP,IAAI,EARK,MAQL,EACJ,KAAK,EARI,MAQJ,EACL,QAAQ,AARP,CACA,EADQ,MAQD,GAPG,MAAM,CAgDlB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAJ/B,MAI+B,EAAE,QAAQ,AAHjD,CACA,EADQ,MAGyC,GAFvC,MAAM,CA6BlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,OAAA,SAoBpD;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,GAAG,QAAA,EAAE,WAAW,EAL7B,MAK6B,EAAE,OAAO,KAAK,GAFrD,MAAM,CAinBlB;AA4lDD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,0DAJtB,MAAM,QACN,MAAM,KACJ;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAsD/C,CAAC;AAyHF;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,AALvD,CACA,EADQ,MAAM,EAK8C,GAJlD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAC,CAmEnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EALzB,MAKyB,GAJvB,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAJxB,MAIwB,EAAE,UAAU,EAHpC,MAGoC,WA6C9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EANrB,MAMqB,EAAE,aAAa,EALpC,MAKoC,EAAE,QAAQ,EAJ9C,OAI8C,GAF7C,OAAO,CAiClB"}
+{"version":3,"file":"binary.d.ts","sourceRoot":"","sources":["../../../lib/managers/binary.js"],"names":[],"mappings":"AA2aA;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,AAH9C,CACA,EADQ,MAAM,EAGqC,GAFzC,MAAM,EAAE,CAgBpB;AA4FD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,GAH5B,MAAM,GAAC,SAAS,CAmB5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EALtB,MAKsB,UA+BpC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,OAAA,EAAE,GAAG,EAJ9B,MAI8B,GAFhC,SAAS,GAAC,MAAM,CAmC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EARK,MAQL,EACJ,OAAO,EARE,MAQF,EACP,IAAI,EARK,MAQL,EACJ,KAAK,EARI,MAQJ,EACL,QAAQ,AARP,CACA,EADQ,MAQD,GAPG,MAAM,CA4ElB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAJ/B,MAI+B,EAAE,QAAQ,AAHjD,CACA,EADQ,MAGyC,GAFvC,MAAM,CA6BlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,OAAA,SAoBpD;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,GAAG,QAAA,EAAE,WAAW,EAL7B,MAK6B,EAAE,OAAO,KAAK,GAFrD,MAAM,CAymBlB;AA6HD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAHrC,MAGqC,GAFnC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAgBpD;AAqlDD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,0DAJtB,MAAM,QACN,MAAM,KACJ;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAsD/C,CAAC;AAyHF;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,AALvD,CACA,EADQ,MAAM,EAK8C,GAJlD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAC,CA8FnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EALzB,MAKyB,GAJvB,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAJxB,MAIwB,EAAE,UAAU,EAHpC,MAGoC,WA6C9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EANrB,MAMqB,EAAE,aAAa,EALpC,MAKoC,EAAE,QAAQ,EAJ9C,OAI8C,GAF7C,OAAO,CAiClB"}

package/types/lib/managers/docker.d.ts

@@ -74,6 +74,18 @@ export declare const makeRequest: (path: string, method: string, forRegistry?: s
  * @returns {boolean} true when the string is a plausible image reference
  */
 export declare const isImageReference: (fullImageName: string) => boolean;
+/**
+ * Whether an image named in a scanned manifest, such as a docker-compose file
+ * or a Kubernetes spec, may be pulled and inventoried. The name comes from the
+ * scanned project, so a local archive path would read files outside the
+ * allowed paths and a registry outside CDXGEN_ALLOWED_HOSTS would bypass the
+ * host allowlist.
+ *
+ * @param {string} fullImageName Image name from the manifest
+ * @param {Object} [imageObj] Result of parseImageName for the same name
+ * @returns {boolean} true when the image may be followed
+ */
+export declare const isFollowableManifestImage: (fullImageName: string, imageObj?: Object) => boolean;
 /**
  * Parse image name
  *

package/types/lib/managers/docker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../lib/managers/docker.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA+CrC,yDAAyD;AACzD,eAAO,MAAM,KAAK,SAA0B,CAAC;AAC7C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAEoC,CAAC;AAkS/C;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,SAHnB,MAAM,KACJ,MAiBZ,CAAC;AAEF;;GAEG;AACH,wBAAgB,YAAY,QAoB3B;AAED;;GAEG;AACH,wBAAgB,oBAAoB,QA2CnC;AAyTD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,aANf,MAAM,gBAEN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,SAAS,CA6HpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,SANb,MAAM,UACN,MAAM,gBACN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,MAAM,GAAC,SAAS,CAgC3C,CAAC;AA8CF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,gBAAgB,kBAHlB,MAAM,KACJ,OAsEZ,CAAC;AAgBF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;;;;;;CA2E1B,CAAC;AAyFF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,QAFlB,MAgCZ,CAAC;AAkBF;;GAEG;AACH,eAAO,MAAM,QAAQ,sCA4MpB,CAAC;AAkBC,YAA4B,gBAAgB,GAAlC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAkB;AAiH/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,kBANZ,MAAM,OACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,OAAO,CAqF3B,CAAC;AAiGF;;;GAGG;AACH,eAAO,MAAM,aAAa,mEAqGzB,CAAC;AAmDF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,iBATrB,MAAM,aACN,MAAM,WACN,MAAM,wBACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,MAAM,CAuK1B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,oDAyJvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,iDAkJ1B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,kBALb,MAAM,UACN,OAAO,KACL,OAAO,CAAC,MAAM,GAAC,SAAS,CAKpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,cALpB,MAAM,iBACN,MAAM,KACJ,MAAM,GAAC,SA2CnB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,qBAHpB,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,cACnC,KAAK,CAAC,MAAM,CAAC,SA4BvB,CAAC"}
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../lib/managers/docker.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAgDrC,yDAAyD;AACzD,eAAO,MAAM,KAAK,SAA0B,CAAC;AAC7C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAEoC,CAAC;AAkS/C;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,SAHnB,MAAM,KACJ,MAiBZ,CAAC;AAEF;;GAEG;AACH,wBAAgB,YAAY,QAoB3B;AAED;;GAEG;AACH,wBAAgB,oBAAoB,QA2CnC;AAyTD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,aANf,MAAM,gBAEN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,SAAS,CA6HpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,SANb,MAAM,UACN,MAAM,gBACN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,MAAM,GAAC,SAAS,CAgC3C,CAAC;AA8CF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,gBAAgB,kBAHlB,MAAM,KACJ,OAsEZ,CAAC;AAgBF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,kBAJ3B,MAAM,aACN,MAAM,KACJ,OAmBZ,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;;;;;;CA2E1B,CAAC;AAyFF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,QAFlB,MAgCZ,CAAC;AAkBF;;GAEG;AACH,eAAO,MAAM,QAAQ,sCA6MpB,CAAC;AAkBC,YAA4B,gBAAgB,GAAlC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAkB;AAmH/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,kBANZ,MAAM,OACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,OAAO,CAqF3B,CAAC;AAiGF;;;GAGG;AACH,eAAO,MAAM,aAAa,mEAqGzB,CAAC;AA2KF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,iBATrB,MAAM,aACN,MAAM,WACN,MAAM,wBACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,MAAM,CAwK1B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,oDAyJvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,iDAkJ1B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,kBALb,MAAM,UACN,OAAO,KACL,OAAO,CAAC,MAAM,GAAC,SAAS,CAKpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,cALpB,MAAM,iBACN,MAAM,KACJ,MAAM,GAAC,SA2CnB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,qBAHpB,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,cACnC,KAAK,CAAC,MAAM,CAAC,SA4BvB,CAAC"}

package/types/lib/managers/oci.d.ts

@@ -18,9 +18,11 @@ export declare function isSameRegistryHost(registry: string, realmUrl: URL): boo
  *
  * @param {string} image OCI image reference (e.g. `"registry.example.com/org/app:tag"`)
  * @param {string} [platform] OCI platform string (e.g. `"linux/amd64"`); no-op for JS implementation
+ * @param {Object} [options]
+ * @param {function(Buffer): void} [options.checkBytes] Called with the raw bytes of the BOM layer that is about to be returned. An error it throws is rethrown, and no other referrer is tried.
  * @returns {Promise<Object|undefined>} Parsed CycloneDX BOM JSON object, or `undefined` if not found
  */
-export declare function getBomWithOras(image: string, _platform?: undefined): Promise<Object | undefined>;
+export declare function getBomWithOras(image: string, _platform?: undefined, options?: Object): Promise<Object | undefined>;
 /**
  * Attach a CycloneDX BOM to an OCI image using the OCI 1.1 artifact manifest
  * API, pushing the BOM as a blob and linking it via the referrers API (with a

package/types/lib/managers/oci.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oci.d.ts","sourceRoot":"","sources":["../../../lib/managers/oci.js"],"names":[],"mappings":"AAuOA;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAJhC,MAIgC,EAAE,QAAQ,EAH1C,GAG0C,GAFxC,OAAO,CAgBnB;AAoJD;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAJ/B,MAI+B,EAAE,SAAS,YAAY,GAFpD,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA4GrC;AAmFD;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,KAAK,EALhC,MAKgC,EAAE,OAAO,EAJzC,MAIyC,GAHvC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAmIrC"}
+{"version":3,"file":"oci.d.ts","sourceRoot":"","sources":["../../../lib/managers/oci.js"],"names":[],"mappings":"AAuOA;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAJhC,MAIgC,EAAE,QAAQ,EAH1C,GAG0C,GAFxC,OAAO,CAgBnB;AAuJD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAPI,MAOJ,EACL,SAAS,YAAY,EACrB,OAAO,AAPN,CACA,EADQ,MAOG,GALD,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA6HrC;AAmFD;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,KAAK,EALhC,MAKgC,EAAE,OAAO,EAJzC,MAIyC,GAHvC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAmIrC"}

package/types/lib/parsers/cmakeCache.d.ts

@@ -67,4 +67,20 @@ export declare function resolveCmakeCacheFacts(map: Map<string, {
     findPackages: Map<string, string>;
     fetchContentBase?: string;
 };
+/**
+ * Parse a compiler description CMake writes when it configures a build
+ * (`CMakeFiles/<cmake version>/CMake<LANG>Compiler.cmake`): the compiler's
+ * path, CMake's id for it and its version, all identified by CMake itself.
+ *
+ * @param {string} text File contents
+ * @returns {{language: string, compiler: string, family: string, id: string, version: string}|null}
+ *   `null` when the text names no compiler
+ */
+export declare function parseCmakeCompilerFile(text: string): {
+    language: string;
+    compiler: string;
+    family: string;
+    id: string;
+    version: string;
+} | null;
 //# sourceMappingURL=cmakeCache.d.ts.map

package/types/lib/parsers/cmakeCache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cmakeCache.d.ts","sourceRoot":"","sources":["../../../lib/parsers/cmakeCache.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAHzB,MAGyB,GAFvB,GAAG,CAAC,MAAM,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAAC,CA0BtD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAJlC,MAIkC,GAHhC,MAAM,GAAC,IAAI,CA0BvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,GAAG,CAAC,MAAM,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAGV,GAF7B;IAAE,WAAW,EAAE;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAC,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;IAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,CAiG1P"}
+{"version":3,"file":"cmakeCache.d.ts","sourceRoot":"","sources":["../../../lib/parsers/cmakeCache.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAHzB,MAGyB,GAFvB,GAAG,CAAC,MAAM,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAAC,CA0BtD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAJlC,MAIkC,GAHhC,MAAM,GAAC,IAAI,CA0BvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,GAAG,CAAC,MAAM,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAGV,GAF7B;IAAE,WAAW,EAAE;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAC,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;IAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,CAiG1P;AAeD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAJhC,MAIgC,GAH9B;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAAC,IAAI,CAgDlG"}

package/types/lib/parsers/cmakeLists.d.ts

@@ -27,7 +27,8 @@ export declare function parseCmakeCommands(text: string): {
 /**
  * Replace `${VAR}` references with the values of simple `set()` calls. A
  * reference to an unknown variable is left in place, so callers can tell a
- * resolved value from an unresolved one.
+ * resolved value from an unresolved one. Expansion stops at the previous
+ * round once the text would exceed 64 KiB.
  *
  * @param {string} value Argument text
  * @param {Map<string,string>} variables Known variable values

package/types/lib/parsers/cmakeLists.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cmakeLists.d.ts","sourceRoot":"","sources":["../../../lib/parsers/cmakeLists.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA8DH;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAL5B,MAK4B,GAJ1B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,EAAE,CA8G1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAJ/B,MAI+B,EAAE,SAAS,EAH1C,GAAG,CAAC,MAAM,EAAC,MAAM,CAGyB,GAFxC,MAAM,CA+BlB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,EAGC,GAF7B,GAAG,CAAC,MAAM,EAAC,MAAM,CAAC,CAkB9B;AAgFD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EALhC,MAKgC,GAJ9B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAC,EAAE,CAyG3K"}
+{"version":3,"file":"cmakeLists.d.ts","sourceRoot":"","sources":["../../../lib/parsers/cmakeLists.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA8DH;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAL5B,MAK4B,GAJ1B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,EAAE,CA8G1D;AAMD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAJ/B,MAI+B,EAAE,SAAS,EAH1C,GAAG,CAAC,MAAM,EAAC,MAAM,CAGyB,GAFxC,MAAM,CAkClB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,EAGC,GAF7B,GAAG,CAAC,MAAM,EAAC,MAAM,CAAC,CAwB9B;AAgFD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EALhC,MAKgC,GAJ9B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAC,EAAE,CAyG3K"}

package/types/lib/parsers/cmakePresets.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Pure reader for CMake presets (`CMakePresets.json` and
+ * `CMakeUserPresets.json`, schema versions 1 to 10).
+ *
+ * A configure preset names how a project is configured: the generator, the
+ * build directory, the toolchain file and the cache variables (build type,
+ * compilers). Presets inherit from one another, may be hidden (templates
+ * that only exist to be inherited), may be enabled only under a condition,
+ * and spell paths with macros such as `${sourceDir}` and `$env{NAME}`.
+ *
+ * This module is layer 1: text and a context object in, data out. Reading the
+ * files (and their `include` lists) is done by the caller, which also supplies
+ * the process environment through `context.penv`.
+ */
+/**
+ * Parse the text of a presets file.
+ *
+ * @param {string} text File contents
+ * @returns {{version: number|undefined, include: string[], configurePresets: Object[]}|null}
+ *   `null` when the text is not a presets document
+ */
+export declare function parseCmakePresets(text: string): {
+    version: number | undefined;
+    include: string[];
+    configurePresets: Object[];
+} | null;
+/**
+ * Expand the macros CMake allows in preset strings.
+ *
+ * Supported: `${sourceDir}`, `${sourceParentDir}`, `${sourceDirName}`,
+ * `${presetName}`, `${generator}`, `${hostSystemName}`, `${fileDir}`,
+ * `${dollar}`, `${pathListSep}`, `$env{NAME}` (the preset's own environment,
+ * then the process environment) and `$penv{NAME}` (the process environment).
+ * `$vendor{...}` and unknown macros are left as written.
+ *
+ * @param {string} value String to expand
+ * @param {Object} context Macro values; `env` (preset environment, a plain
+ *   object) and `penv` (a function reading the process environment) are
+ *   optional
+ * @returns {string} Expanded string
+ */
+export declare function expandPresetMacros(value: string, context?: Object): string;
+/**
+ * Evaluate a preset condition (schema version 3 and later).
+ *
+ * @param {*} condition Condition object (or boolean, or null)
+ * @param {function(string): string} expand Macro expander for the preset
+ * @returns {boolean|undefined} `undefined` when the condition cannot be
+ *   decided here: `matches`/`notMatches` take a regular expression from the
+ *   repository, which is not run
+ */
+export declare function evaluatePresetCondition(condition: any, expand: Function): boolean | undefined;
+/**
+ * Resolve the configure presets of a set of presets documents.
+ *
+ * Inheritance follows CMake: a preset's own fields win, then those of its
+ * `inherits` entries in order (the first wins), recursively; `cacheVariables`
+ * and `environment` merge key by key the same way, and a `null` entry unsets
+ * the key. `name`, `hidden`, `inherits`, `description` and `displayName` are
+ * not inherited. A preset that is part of an inheritance cycle, or inherits
+ * one that does not exist, is dropped.
+ *
+ * @param {Array<{file: string, fileDir: string, document: Object}>} documents
+ *   Parsed documents in reading order (`CMakePresets.json` first, then its
+ *   includes, then `CMakeUserPresets.json`)
+ * @param {Object} context `sourceDir`, `hostSystemName`, `pathListSep`, and
+ *   `penv` (a function reading the process environment)
+ * @returns {Object[]} Visible configure presets: `name`, `displayName`,
+ *   `file`, `inherits`, `generator`, `binaryDir` (absolute), `toolchainFile`,
+ *   `cacheVariables` (expanded strings), `environment` (expanded strings),
+ *   `hasCondition`, and `conditionMet` (true, false or undefined)
+ */
+export declare function resolveConfigurePresets(documents: Array<{
+    file: string;
+    fileDir: string;
+    document: Object;
+}>, context?: Object): Object[];
+//# sourceMappingURL=cmakePresets.d.ts.map

package/types/lib/parsers/cmakePresets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cmakePresets.d.ts","sourceRoot":"","sources":["../../../lib/parsers/cmakePresets.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAmBH;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAJ3B,MAI2B,GAHzB;IAAC,OAAO,EAAE,MAAM,GAAC,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,IAAI,CAiC3F;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAN7B,MAM6B,EAAE,OAAO,GALtC,MAK2C,GAFzC,MAAM,CAkClB;AAgCD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EANtC,GAMsC,EAAE,MAAM,UAAA,GAJ5C,OAAO,GAAC,SAAS,CA8D7B;AAiBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAVtC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,CAUjB,EAAE,OAAO,GAP/C,MAOoD,GALlD,MAAM,EAAE,CA0EpB"}

package/types/lib/parsers/compileCommands.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Pure reader for JSON compilation databases (`compile_commands.json`).
+ *
+ * Each entry names a translation unit (`file`), the directory its command ran
+ * in (`directory`) and the command, either as an argument list (`arguments`)
+ * or as one command line (`command`) split with the quoting rules of the
+ * shell it was written for. From the entries this module derives the
+ * compilers a build uses, the include directories each unit is compiled
+ * with, and the security-hardening options in effect.
+ *
+ * Layer 1: data in, data out. Locating and reading the file, and running a
+ * compiler to learn its version, belong to the callers.
+ */
+/**
+ * Split a POSIX shell command line into words: single quotes keep everything
+ * literally, double quotes keep everything except `\"`, `\\`, `\$` and
+ * `` \` ``, and a backslash outside quotes escapes the next character.
+ *
+ * @param {string} command Command line
+ * @returns {string[]} Words
+ */
+export declare function splitPosixCommand(command: string): string[];
+/**
+ * Split a Windows command line into words as the Microsoft C runtime does:
+ * double quotes group, `\"` is a literal quote, and backslashes are literal
+ * unless they precede a quote.
+ *
+ * @param {string} command Command line
+ * @returns {string[]} Words
+ */
+export declare function splitWindowsCommand(command: string): string[];
+/**
+ * The compiler family a driver's name implies.
+ *
+ * @param {string} driver Driver path or name
+ * @returns {string} `msvc`, `clang-cl`, `clang`, `gcc`, `nvcc`, `icx`,
+ *   `icc`, `nvhpc`, `edg` or `unknown`
+ */
+export declare function compilerFamilyOfName(driver: string): string;
+/**
+ * The argument list of a database entry, with any compiler launcher
+ * (`ccache`, `sccache`, ...) removed so the first argument is the compiler.
+ *
+ * @param {Object} entry Database entry
+ * @returns {string[]} Arguments
+ */
+export declare function entryArguments(entry: Object): string[];
+/**
+ * The language a unit is compiled as: from `-x`/`/TP`/`/TC`, the driver
+ * name, then the file extension.
+ *
+ * @param {string[]} args Arguments, compiler first
+ * @param {string} file Translation unit
+ * @returns {string} `c`, `c++`, `cuda` or `unknown`
+ */
+export declare function unitLanguage(args: string[], file: string): string;
+/**
+ * The include directories a unit is compiled with, as absolute paths.
+ *
+ * @param {string[]} args Arguments, compiler first
+ * @param {string} directory The entry's working directory
+ * @returns {string[]} Directories, in command order
+ */
+export declare function includeDirectories(args: string[], directory: string): string[];
+/**
+ * The security-hardening settings an argument list turns on or off. Later
+ * options override earlier ones, as they do for the compiler.
+ *
+ * @param {string[]} args Compiler or linker arguments
+ * @returns {Map<string, string>} Setting name to value:
+ *   `fortifySource` (level), `stackProtector` (`on`, `strong`, `all`,
+ *   `off`), `pie` (`on`/`off`), `relro` (`partial`/`full`, from `-z relro`
+ *   and `-z now`), `cfProtection` (`full`, `branch`, `return`, `none`),
+ *   `sanitizers` (comma-separated), `glibcxxAssertions` (`on`),
+ *   `stackClashProtection` (`on`/`off`), `msvcBufferSecurityCheck` (`/GS`
+ *   `on`/`off`), `msvcControlFlowGuard` (`on`/`off`)
+ */
+export declare function hardeningSettings(args: string[]): Map<string, string>;
+/**
+ * Summarise a compilation database.
+ *
+ * @param {Object[]} entries Parsed database (a JSON array)
+ * @returns {{
+ *   units: number,
+ *   compilers: Map<string, {driver: string, family: string, units: number, languages: Set<string>}>,
+ *   includeDirectories: Set<string>,
+ *   hardening: Map<string, Map<string, number>>,
+ * }} `compilers` is keyed by the driver as written; `hardening` maps each
+ *   setting to the number of units per value
+ */
+export declare function summarizeCompileDatabase(entries: Object[]): {
+    units: number;
+    compilers: Map<string, {
+        driver: string;
+        family: string;
+        units: number;
+        languages: Set<string>;
+    }>;
+    includeDirectories: Set<string>;
+    hardening: Map<string, Map<string, number>>;
+};
+/**
+ * Read a compiler's family and version from what it prints for `--version`
+ * (or, for MSVC, on start-up).
+ *
+ * @param {string} banner Output of the version query
+ * @param {string} [nameFamily] Family implied by the driver's name
+ * @returns {{family: string, version: string|undefined, edgFrontEnd: boolean}}
+ */
+export declare function classifyCompilerBanner(banner: string, nameFamily?: string): {
+    family: string;
+    version: string | undefined;
+    edgFrontEnd: boolean;
+};
+//# sourceMappingURL=compileCommands.d.ts.map

package/types/lib/parsers/compileCommands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compileCommands.d.ts","sourceRoot":"","sources":["../../../lib/parsers/compileCommands.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAcH;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,GAF5B,MAAM,EAAE,CAoDpB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,GAF9B,MAAM,EAAE,CA6CpB;AAQD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAJhC,MAIgC,GAH9B,MAAM,CAwClB;AAKD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAHzB,MAGyB,GAFvB,MAAM,EAAE,CA8BpB;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAAM,EAIgB,EAAE,IAAI,EAH5B,MAG4B,GAF1B,MAAM,CA6ClB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAJ5B,MAAM,EAIsB,EAAE,SAAS,EAHvC,MAGuC,GAFrC,MAAM,EAAE,CAwCpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAT3B,MAAM,EASqB,GARzB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAgH/B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EATrC,MAAM,EAS+B,GARnC;IACR,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;KAAC,CAAC,CAAC;IAChG,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC7C,CA0CH;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAJlC,MAIkC,EAAE,UAAU,AAHtD,CACA,EADQ,MAG0D,GAFxD;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAC,SAAS,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAC,CA4B7E"}

package/types/lib/parsers/email.d.ts

@@ -0,0 +1,19 @@
+/**
+ * An internationalized hostname: mapped to its A-label form with UTS #46
+ * processing, held to the ASCII hostname rules, and every A-label decoded
+ * back and checked for the characters IDNA allows.
+ *
+ * @param {string} hostname Hostname, possibly holding non-ASCII labels
+ * @returns {boolean} Whether it is a valid IDN hostname
+ */
+export declare const isValidIdnHostname: (hostname: string) => boolean;
+/**
+ * Whether a value is a valid RFC 6531 email address (`idn-email`): a dot-atom
+ * or quoted local part, where non-ASCII characters are allowed, then `@` and
+ * an internationalized hostname or a bracketed IPv4/IPv6 literal.
+ *
+ * @param {string} value Candidate email address
+ * @returns {boolean} true when the value is a valid address
+ */
+export declare const isValidIdnEmail: (value: string) => boolean;
+//# sourceMappingURL=email.d.ts.map

package/types/lib/parsers/email.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../../lib/parsers/email.js"],"names":[],"mappings":"AA8LA;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,aAHpB,MAAM,KACJ,OAyCZ,CAAC;AAkBF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,UAHjB,MAAM,KACJ,OAeZ,CAAC"}

package/types/lib/parsers/largeJson.d.ts

@@ -17,6 +17,19 @@ export declare function indexJsonObject(filePath: string, options?: Object): Map
     start: number;
     end: number;
 }>;
+/**
+ * Decode one member of the top-level object in a JSON file, reading the file
+ * only up to the end of that member. A member near the start of a large file
+ * costs a few bounded reads, however large the rest of the file is; the rest
+ * is not checked for well-formedness.
+ *
+ * @param {string} filePath JSON file whose top-level value is an object
+ * @param {string} name Member to decode
+ * @param {Object} [options] Batch and chunk size overrides, for tests
+ * @returns {*} The decoded value, or undefined when the object has no such member
+ * @throws {SyntaxError} When the object is malformed before the member ends
+ */
+export declare function readJsonMember(filePath: string, name: string, options?: Object): any;
 /**
  * Decode the JSON value stored in a byte range of a file, without ever holding
  * more than a bounded run of it in one string.

package/types/lib/parsers/largeJson.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"largeJson.d.ts","sourceRoot":"","sources":["../../../lib/parsers/largeJson.js"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,KAA8B,CAAC;AAiY/D;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAL7B,MAK6B,EAAE,OAAO,AAJ9C,CACA,EADQ,MAI2C,GAHzC,GAAG,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,CAarD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAP3B,MAO2B,EAAE,KAAK,EANlC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAMO,EAAE,IAAI,AALhD,CACA,EADQ,MAKoD,EAAE,OAAO,AAJrE,CACA,EADQ,MAIkE,GAHhE,GAAC,CAOb;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAN1B,MAM0B,EAAE,IAAI,AALxC,CACA,EADQ,MAK4C,EAAE,OAAO,AAJ7D,CACA,EADQ,MAI0D,GAHxD,GAAC,CASb"}
+{"version":3,"file":"largeJson.d.ts","sourceRoot":"","sources":["../../../lib/parsers/largeJson.js"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,KAA8B,CAAC;AAqY/D;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAL7B,MAK6B,EAAE,OAAO,AAJ9C,CACA,EADQ,MAI2C,GAHzC,GAAG,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,CAarD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAN5B,MAM4B,EAAE,IAAI,EALlC,MAKkC,EAAE,OAAO,AAJnD,CACA,EADQ,MAIgD,GAH9C,GAAC,CAiBb;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAP3B,MAO2B,EAAE,KAAK,EANlC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAMO,EAAE,IAAI,AALhD,CACA,EADQ,MAKoD,EAAE,OAAO,AAJrE,CACA,EADQ,MAIkE,GAHhE,GAAC,CAOb;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAN1B,MAM0B,EAAE,IAAI,AALxC,CACA,EADQ,MAK4C,EAAE,OAAO,AAJ7D,CACA,EADQ,MAI0D,GAHxD,GAAC,CASb"}