@cdxgen/cdxgen 13.4.0 → 13.5.0

package/types/lib/inventory/dosai.d.ts

@@ -1,3 +1,41 @@
+/**
+ * The .NET runtime a framework-dependent dosai needs, read from the error the
+ * .NET host prints when it refuses to start dosai.
+ *
+ * When an older runtime is installed, the host names the exact framework
+ * version it looked for. When it finds no .NET at all, it names only its own
+ * version. The app host comes from the pack of the runtime the app targets, so
+ * its major version is still the .NET release to install.
+ *
+ * @param {Object|string} resultOrOutput spawnSync result, or the text it printed
+ * @returns {{version: (string|undefined), major: (string|undefined)}|undefined}
+ *   The framework version, when the host named it, and the .NET major version;
+ *   undefined when the output is not a .NET host launch failure
+ */
+export declare function dosaiDotnetRequirement(resultOrOutput: Object | string): {
+    version: (string | undefined);
+    major: (string | undefined);
+} | undefined;
+/**
+ * What stopped dosai from starting, for warnings and ledger details.
+ *
+ * @param {{version: (string|undefined), major: (string|undefined)}} [requirement] Result of dosaiDotnetRequirement
+ * @returns {string} A clause naming the missing .NET runtime when it is known
+ */
+export declare function dosaiDotnetRequirementDetail(requirement?: {
+    version: (string | undefined);
+    major: (string | undefined);
+}): string;
+/**
+ * How to get dosai running when the .NET host refused to start it.
+ *
+ * @param {{version: (string|undefined), major: (string|undefined)}} [requirement] Result of dosaiDotnetRequirement
+ * @returns {string} Install instructions, naming the .NET major version when it is known
+ */
+export declare function dosaiDotnetRequirementAdvice(requirement?: {
+    version: (string | undefined);
+    major: (string | undefined);
+}): string;
 /**
  * Translate cdxgen --exclude globs into dosai --exclude globs.
  *
@@ -41,6 +79,55 @@ export declare function isDosaiDotnetLanguage(language: string): boolean;
  * @returns {Object|undefined} Parsed JSON content, or undefined when missing or invalid
  */
 export declare function readDosaiJsonFile(jsonFile: string): Object | undefined;
+/**
+ * The `--sections` value that writes exactly the sections cdxgen reads.
+ *
+ * Passed as `dosaiMethodsSections` by callers that know their run will not
+ * need the whole report (see {@link runsEvidenceAnalysis}); an older dosai
+ * that rejects `--sections` falls back to the full report on its own.
+ *
+ * @returns {string} Comma-separated section list for dosai `--sections`
+ */
+export declare function dosaiMethodsSectionsArgument(): string;
+/**
+ * Whether this scan will run the evidence (evinse) analysis.
+ *
+ * One place answers for both the trim decision in `createCsharpBom` and the
+ * evinse gate in `bin/cdxgen.js`: `--evidence` alone runs it, and so does
+ * `--include-crypto` alone, after profiles are applied (`--profile research`
+ * turns on both). Testing `options.evidence` alone would trim a report that
+ * `--include-crypto` then needs full.
+ *
+ * @param {Object} options Scan options after profile expansion
+ * @returns {boolean} True when the scan will run evinse
+ */
+export declare function runsEvidenceAnalysis(options: Object): boolean;
+/**
+ * The top-level sections a dosai methods report left out, empty for a full
+ * report. dosai v4 reports have no `OmittedSections`, so they count as full.
+ *
+ * @param {Object} [report] A dosai methods report as read by readDosaiMethodsReport
+ * @returns {string[]} The omitted section names
+ */
+export declare function dosaiOmittedSections(report?: Object): string[];
+/**
+ * The top-level sections a dosai methods report file left out, read from its
+ * Metadata alone. dosai writes Metadata first, so this reads only the head of
+ * the file, however large the report is. A missing or unreadable file counts
+ * as full: the read that follows reports it.
+ *
+ * @param {string} reportFile Path to the dosai methods JSON
+ * @returns {string[]} The omitted section names
+ */
+export declare function dosaiReportFileOmittedSections(reportFile: string): string[];
+/**
+ * The omitted sections of a dosai methods report that cdxgen reads, so the
+ * evidence built from the report lacks their input.
+ *
+ * @param {string[]} omittedSections Sections the report left out
+ * @returns {string[]} The ones cdxgen reads
+ */
+export declare function dosaiSectionsCdxgenReads(omittedSections: string[]): string[];
 /**
  * Read a dosai methods report of any size.
  *
@@ -97,6 +184,13 @@ export declare function dosaiRunTimedOut(result: Object): boolean;
  * @returns {"timeout"|"buffer"|"signal"|undefined} Why the run was stopped, or undefined when it ended by itself
  */
 export declare function dosaiRunStopReason(result: Object): "timeout" | "buffer" | "signal" | undefined;
+/**
+ * Note that the .NET host's refusal to start a dosai executable has been
+ * reported, so dosai runs of the same executable do not repeat the warning.
+ *
+ * @param {string} executable dosai executable
+ */
+export declare function markDosaiLaunchFailureReported(executable: string): void;
 /**
  * Whether the dosai run that should have written a file was stopped (by the
  * time limit, the output buffer limit, or a signal) and already reported so.
@@ -105,14 +199,30 @@ export declare function dosaiRunStopReason(result: Object): "timeout" | "buffer"
  * @returns {boolean} true when the run was stopped
  */
 export declare function dosaiRunWasStopped(outputFile: string): boolean;
+/**
+ * Whether the dosai run that should have written a file failed in a way it has
+ * already reported: it was stopped (see dosaiRunWasStopped), or the .NET host
+ * refused to start dosai and the warning named the missing runtime.
+ *
+ * @param {string} outputFile Output file passed to the dosai run
+ * @returns {boolean} true when the failure has been reported
+ */
+export declare function dosaiFailureReported(outputFile: string): boolean;
 /**
  * Run a dosai subcommand ("methods", "dataflows", or "crypto") against a source
  * tree and write its JSON output to the given file.
  *
+ * Flags cdxgen adds for its own benefit that an older dosai may not know
+ * (--exclude, --sections, --crypto-dataflows) are optional: when dosai reports
+ * them as unknown, every rejected one is dropped in a single retry, later runs
+ * of the same executable skip them up front, and dropping is reported once
+ * (a warning for --exclude, whose loss changes results; a debug line for the
+ * size-only flags). A run that rejects anything else has simply failed.
+ *
  * @param {string} command Dosai subcommand to execute
  * @param {string} src Source directory to analyze
  * @param {string} outputFile Path where the dosai JSON output is written
- * @param {Object} [options] Options carrying dosaiCommand, dataFlowPatterns, patternPacks, or exclude globs
+ * @param {Object} [options] Options carrying dosaiCommand, dataFlowPatterns, patternPacks, exclude globs, or dosaiMethodsSections
  * @returns {boolean} True when the command succeeded and produced the output file, false otherwise
  */
 export declare function runDosaiCommand(command: string, src: string, outputFile: string, options?: Object): boolean;
@@ -121,7 +231,7 @@ export declare function runDosaiCommand(command: string, src: string, outputFile
  *
  * @param {string} src Source directory to analyze
  * @param {string} outputFile Path where the methods slice JSON is written
- * @param {Object} [options] Options forwarded to runDosaiCommand
+ * @param {Object} [options] Options forwarded to runDosaiCommand; `dosaiMethodsSections` names the top-level sections to write (see dosaiMethodsSectionsArgument), omitted for the full report
  * @returns {boolean} True when the slice was produced successfully
  */
 export declare function createDosaiMethodsSlice(src: string, outputFile: string, options?: Object): boolean;
@@ -151,6 +261,27 @@ export declare function createDosaiCryptoAnalysis(src: string, outputFile: strin
  * @returns {Object|undefined} Parsed crypto analysis JSON, or undefined when the analysis fails
  */
 export declare function analyzeDosaiCrypto(src: string, options?: Object): Object | undefined;
+/**
+ * The tool component naming the dosai behind a methods report.
+ *
+ * A report that a dosai run of this process wrote names the executable that
+ * wrote it, with the version that executable reports. A report reused from an
+ * earlier run names the version recorded in its Metadata, or the configured
+ * dosai's own version when that is a build of the same release. No component
+ * is returned for a report that is missing or that no dosai wrote, such as
+ * when the .NET host refused to start dosai.
+ *
+ * The cdxgen-plugins-bin manifest component is returned as-is only for its
+ * own binary at its own version. Any other dosai gets a component built from
+ * the manifest's project fields (description, licenses, references), without
+ * the bundled binary's hashes or path.
+ *
+ * @param {string} reportFile Path of the dosai methods report
+ * @param {Object} [report] The report as read, for its Metadata
+ * @param {Object} [manifestComponent] dosai component of the cdxgen-plugins-bin manifest
+ * @returns {Object[]} The dosai tool component, or an empty array
+ */
+export declare function dosaiToolComponents(reportFile: string, report?: Object, manifestComponent?: Object): Object[];
 /**
  * Persist the combined native dosai report to options.semanticsSlicesFile.
  *
@@ -158,10 +289,12 @@ export declare function analyzeDosaiCrypto(src: string, options?: Object): Objec
  * analyzeGolemProject on branch feat/rusi-persist-report): when a semantics-
  * slices path is provided, the FULL native report is written there and kept so
  * downstream tools (depscan) can consume the complete methods + data-flow
- * facts that cdxgen only projects a subset of into the SBOM evidence. dotnet
- * does not otherwise use the semantics slice (atom is never run for dotnet),
- * so the path is free to carry the combined dosai report. Returns the resolved
- * durable path when something was persisted, otherwise undefined.
+ * facts that cdxgen only projects a subset of into the SBOM evidence. A
+ * methods report the user supplied with --usages-slices-file is written as
+ * given, with a recorded degradation when it was trimmed with --sections.
+ * dotnet does not otherwise use the semantics slice (atom is never run for
+ * dotnet), so the path is free to carry the combined dosai report. Returns the
+ * resolved durable path when something was persisted, otherwise undefined.
  */
 export declare function persistDosaiSemanticsReport(options: any, methodsSlice: any, dataFlowSlice: any): any;
 /**
@@ -278,6 +411,12 @@ export declare function collectDosaiServicesFromMethods(methodsSlice: Object, se
 /**
  * Normalize a services map into a sorted array of CycloneDX service objects.
  *
+ * This is where evinse's service maps — dosai, golem, kosi, scalasem, an
+ * OpenAPI document, and the atom usage and type detectors — become
+ * `services[]`, so it is also where every endpoint is percent-encoded into the
+ * iri-reference CycloneDX requires. The collectors keep the readable template
+ * (`/users/{id}`); the BOM gets `/users/%7Bid%7D`.
+ *
  * @param {Object} [servicesMap] Map of service name to service definition with Set-backed endpoints
  * @returns {Object[]} Array of service objects with sorted endpoint arrays and properties
  */

package/types/lib/inventory/dosai.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dosai.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dosai.js"],"names":[],"mappings":"AA+WA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAJpC,MAAM,EAI8B,EAAE,OAAO,EAH7C,MAG6C,GAF3C;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAC,CAyFtE;AAoCD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAW5B;AA2ED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAPtC,MAOsC,EAAE,OAAO,AANvD,CAIA,EAHA;IAA2B,QAAQ,AAAnC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,cAAc,AAAzC,CACA,WAAA;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;CAE4D,GAFlD,MAAM,GAAC,SAAS,CA0B5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EALvC,MAKuC,EAAE,OAAO,AAJxD,CAEA,EADA;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;CAE6D,GAFnD,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAH5B,MAG4B,GAF1B,OAAO,CAInB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAH9B,MAG8B,GAF5B,SAAS,GAAC,QAAQ,GAAC,QAAQ,GAAC,SAAS,CAajD;AAMD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAGkC,GAFhC,OAAO,CAKnB;AAYD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAN5B,MAM4B,EAAE,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAuGnB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,UAAU,EAJ5C,MAI4C,EAAE,OAAO,AAH7D,CACA,EADQ,MAG0D,GAFxD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EALlC,MAKkC,EAAE,UAAU,EAJ9C,MAI8C,EAAE,OAAO,AAH/D,CACA,EADQ,MAG4D,GAF1D,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAe5B;AAuDD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,KAAA,EACP,YAAY,KAAA,EACZ,aAAa,KAAA,OAyDd;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,AAJzC,CACA,EADQ,MAAM,EAIgC,EAAE,OAAO,AAHvD,CACA,EADQ,MAGoD,GAFlD,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/B;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAN9B,MAM8B,EAAE,YAAY,EAL5C,GAAG,CAAC,MAAM,EAAE,MAAM,CAK0B,EAAE,QAAQ,AAJ9D,CACA,EADQ,MAIsD,GAHpD,MAAM,GAAC,SAAS,CAK5B;AAwCD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAH7C,MAG6C,EAAE,YAAY,EAF3D,MAE2D,QAyBrE;AAED;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAC5C,YAAY,EARH,MAQG,EACZ,UAAU,AART,CACA,EADQ,MAAM,EAQA,EACf,OAAO,AARN,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAKW,GALD,MAAM,CA4ClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EARH,MAQG,EACZ,UAAU,AART,CACA,EADQ,MAAM,EAQA,EACf,OAAO,AARN,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAKW,GALD,MAAM,CA8FlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,cAAc,EARL,MAQK,EACd,UAAU,AART,CACA,EADQ,MAAM,EAQA,EACf,OAAO,AARN,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAKW,GALD,MAAM,CAwDlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAJ1C,MAI0C,EAAE,UAAU,AAH9D,CACA,OAEmE,SA6FrE;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,YAAY,EAJ/C,MAI+C,EAAE,WAAW,AAHpE,CACA,EADQ,MAGiE,GAF/D,MAAM,CAyKlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC7C,YAAY,EALH,MAKG,EACZ,WAAW,AALV,CACA,EADQ,MAKO,GAJL,MAAM,CA+GlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,AAHjD,CACA,EADQ,MAG8C,GAF5C,MAAM,EAAE,CA6CpB"}
+{"version":3,"file":"dosai.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dosai.js"],"names":[],"mappings":"AA+KA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,cAAc,EAL1C,MAAM,GAAC,MAKmC,GAJxC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAA;CAAC,GAAC,SAAS,CAmB9E;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,WAAW,AAHrD,CACA,EADQ;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAA;CAGV,GAF3C,MAAM,CAUlB;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,WAAW,AAHrD,CACA,EADQ;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAA;CAGV,GAF3C,MAAM,CAIlB;AAwMD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAJpC,MAAM,EAI8B,EAAE,OAAO,EAH7C,MAG6C,GAF3C;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAC,CAyFtE;AAoDD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAW5B;AAkBD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,IAF/B,MAAM,CAIlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAHjC,MAGiC,GAF/B,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,AAHxC,CACA,EADQ,MAGgC,GAF9B,MAAM,EAAE,CAOpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,EAH9C,MAG8C,GAF5C,MAAM,EAAE,CAapB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,eAAe,EAH7C,MAAM,EAGuC,GAF3C,MAAM,EAAE,CAMpB;AA4DD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAPtC,MAOsC,EAAE,OAAO,AANvD,CAIA,EAHA;IAA2B,QAAQ,AAAnC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,cAAc,AAAzC,CACA,WAAA;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;CAE4D,GAFlD,MAAM,GAAC,SAAS,CA0B5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EALvC,MAKuC,EAAE,OAAO,AAJxD,CAEA,EADA;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;CAE6D,GAFnD,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAH5B,MAG4B,GAF1B,OAAO,CAInB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAH9B,MAG8B,GAF5B,SAAS,GAAC,QAAQ,GAAC,QAAQ,GAAC,SAAS,CAajD;AAeD;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,EAF9C,MAE8C,QAKxD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAGkC,GAFhC,OAAO,CAKnB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAHpC,MAGoC,GAFlC,OAAO,CASnB;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAN5B,MAM4B,EAAE,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAmLnB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,UAAU,EAJ5C,MAI4C,EAAE,OAAO,AAH7D,CACA,EADQ,MAG0D,GAFxD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EALlC,MAKkC,EAAE,UAAU,EAJ9C,MAI8C,EAAE,OAAO,AAH/D,CACA,EADQ,MAG4D,GAF1D,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAe5B;AAiFD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EALnC,MAKmC,EAAE,MAAM,AAJnD,CACA,EADQ,MAI2C,EAAE,iBAAiB,AAHtE,CACA,EADQ,MAG8D,GAF5D,MAAM,EAAE,CAoCpB;AAuDD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,KAAA,EACP,YAAY,KAAA,EACZ,aAAa,KAAA,OAsEd;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,AAJzC,CACA,EADQ,MAAM,EAIgC,EAAE,OAAO,AAHvD,CACA,EADQ,MAGoD,GAFlD,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/B;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAN9B,MAM8B,EAAE,YAAY,EAL5C,GAAG,CAAC,MAAM,EAAE,MAAM,CAK0B,EAAE,QAAQ,AAJ9D,CACA,EADQ,MAIsD,GAHpD,MAAM,GAAC,SAAS,CAK5B;AAwCD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAH7C,MAG6C,EAAE,YAAY,EAF3D,MAE2D,QAyBrE;AAED;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAC5C,YAAY,EARH,MAQG,EACZ,UAAU,AART,CACA,EADQ,MAAM,EAQA,EACf,OAAO,AARN,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAKW,GALD,MAAM,CA4ClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EARH,MAQG,EACZ,UAAU,AART,CACA,EADQ,MAAM,EAQA,EACf,OAAO,AARN,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAKW,GALD,MAAM,CA8FlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,cAAc,EARL,MAQK,EACd,UAAU,AART,CACA,EADQ,MAAM,EAQA,EACf,OAAO,AARN,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAKW,GALD,MAAM,CAwDlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAJ1C,MAI0C,EAAE,UAAU,AAH9D,CACA,OAEmE,SA6FrE;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,YAAY,EAJ/C,MAI+C,EAAE,WAAW,AAHpE,CACA,EADQ,MAGiE,GAF/D,MAAM,CAyKlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC7C,YAAY,EALH,MAKG,EACZ,WAAW,AALV,CACA,EADQ,MAKO,GAJL,MAAM,CA+GlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,AAHjD,CACA,EADQ,MAG8C,GAF5C,MAAM,EAAE,CAmDpB"}

package/types/lib/inventory/dynamic.d.ts

@@ -23,13 +23,18 @@ export declare function librarySubpath(libPath: string): string | null;
  * Services are detected from HTTP request URLs collected during tracing and
  * follow the CycloneDX service schema with endpoints.
  *
+ * The certificate chains servers presented in TLS ≤ 1.2 handshakes become the
+ * shared certificate model, with `provides` edges from the TLS protocol
+ * components.
+ *
  * @param {string} commandStr - Shell command to execute and trace (e.g. "node --version")
  * @param {string} workingDir - Working directory for the traced process
  * @param {Object} [traceOptions] - Additional sandbox options forwarded to executeAndTrace
- * @returns {Promise<{components: Array<Object>, services: Array<Object>}>} Components and services
+ * @returns {Promise<{components: Array<Object>, services: Array<Object>, dependencies: Array<Object>}>} Components, services and dependencies
  */
 export declare function buildDynamicComponents(commandStr: string, workingDir: string, traceOptions?: Object): Promise<{
     components: Array<Object>;
     services: Array<Object>;
+    dependencies: Array<Object>;
 }>;
 //# sourceMappingURL=dynamic.d.ts.map

package/types/lib/inventory/dynamic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dynamic.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dynamic.js"],"names":[],"mappings":"AAYA;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,GAFzB,MAAM,GAAC,IAAI,CAevB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAND,MAMC,EACV,UAAU,EAND,MAMC,EACV,YAAY,AANX,CACA,EADQ,MAMQ,GALN,OAAO,CAAC;IAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAAC,CAAC,CA8KzE"}
+{"version":3,"file":"dynamic.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dynamic.js"],"names":[],"mappings":"AAaA;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,GAFzB,MAAM,GAAC,IAAI,CAevB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAND,MAMC,EACV,UAAU,EAND,MAMC,EACV,YAAY,AANX,CACA,EADQ,MAMQ,GALN,OAAO,CAAC;IAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAAC,CAAC,CAmNtG"}

package/types/lib/inventory/envcontext.d.ts

@@ -187,6 +187,41 @@ export declare function collectRubyInfo(dir: string): {
     name: string;
     version: string;
 } | undefined;
+/**
+ * Collect the PHP version of the PHP found on the PATH.
+ *
+ * `-n` stops PHP loading any php.ini, so a PHPRC or an auto_prepend_file cannot
+ * run code, and `-v` is used rather than `-r 'echo PHP_VERSION;'` because the
+ * shell on Windows does not quote arguments. The first line is
+ * `PHP 8.5.11 (cli) (built: Sep 22 2026 13:32:06) (NTS)`.
+ *
+ * The identity is `pkg:generic/php`: a probe of the PATH cannot tell which
+ * package manager, if any, installed this PHP. A banner with a distro revision,
+ * such as Ubuntu 22.04's `PHP 8.1.2-1ubuntu2.14`, is recorded as reported but
+ * without a CPE: the distro backports fixes under the old upstream number.
+ *
+ * @param {string} dir Working directory
+ * @returns Object containing the PHP details
+ */
+export declare function collectPhpInfo(dir: string): Object | undefined;
+/**
+ * Collect the Composer version.
+ *
+ * `--no-plugins` and `--no-scripts` keep the plugins and scripts of the
+ * project in the working directory from running, which `composer --version`
+ * would otherwise let a plugin do. It needs no network. The banner is
+ * `Composer version 2.10.3 2026-08-27 13:34:23`, but an older Composer on a
+ * newer PHP prints deprecation notices above it, so the first line that starts
+ * with it is read; the line after it names the PHP Composer runs on, with its
+ * path, and is never read. The banner must start its line: an indented echo of
+ * the project's composer.json in an error block does not count. Only a stable
+ * release is recorded: a pre-release or a snapshot has no version a CPE can
+ * name.
+ *
+ * @param {string} dir Working directory
+ * @returns Object containing the Composer details
+ */
+export declare function collectComposerInfo(dir: string): Object | undefined;
 /**
  * Method to run a swift command
  *
@@ -199,12 +234,15 @@ export declare function runSwiftCommand(dir: string, args: any[]): string | unde
  * Collect toolchain information components for the current environment.
  *
  * Probes the working directory for java, dotnet, python, node, gcc, rust, go,
- * and ruby toolchains and returns one component per detected tool.
+ * ruby, php and composer toolchains and returns one component per detected
+ * tool.
  *
  * @param {string} dir Working directory to inspect
+ * @param {Object} [options] CLI options, which decide whether the project's
+ *   own toolchain files may choose the tools that run
  * @returns {Object[]} Array of toolchain component objects; empty when nothing is detected
  */
-export declare function collectEnvInfo(dir: string): Object[];
+export declare function collectEnvInfo(dir: string, options?: Object): Object[];
 /**
  * Method to check if sdkman is available.
  */

package/types/lib/inventory/envcontext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"envcontext.d.ts","sourceRoot":"","sources":["../../../lib/inventory/envcontext.js"],"names":[],"mappings":"AAkDA;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAFd,MAE4D,CAAC;AAuCvE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,wBAapC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAL3B,MAK2B,EAAE,GAAG,EAJhC,MAIgC,sBAE1C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAJrB,MAIqB,sBAE/B;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,UAAU,KAAA,EAAE,GAAG,EAJ9B,MAI8B,sBAExC;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAJtB,MAIsB,MAkBhC;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAJlB,MAIkB,SA4B5B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EALvB,MAKuB,EAAE,IAAI,OAAA,sBAiBvC;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EALtB,MAKsB,EAAE,QAAQ,GAJhC,MAIqC,GAFnC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAAC,CA+BhD;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EALvB,MAKuB,EAAE,QAAQ,GAJjC,MAIsC,GAFpC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CA8BlD;AAwDD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB;;;;;;;;;cAsBlC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAH1B,MAG0B;;;;;cAgBpC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAH1B,MAG0B;;;;;cAiBpC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB,GAFtB,MAAM,CAkBlB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB;;;;;cAejC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB;;;;;cAelC;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAHtB,MAGsB;;;;cAahC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAHzB,MAGyB;;;;cAanC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB;;;;cAalC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,QAAA,EAAE,IAAI,OAAA,sBAExC;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB,MAAM,EAAE,CAqCpB;AA6CD;;GAEG;AACH,wBAAgB,iBAAiB,YAiBhC;AAED;;GAEG;AACH,wBAAgB,cAAc,YAO7B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,QAAA,EAAE,QAAQ,QAAA,WA0BvD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,QAAA,EAAE,QAAQ,QAAA,WA8GnD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,QAAA,UA8B3C;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,QAAA,UA8B9C;AASD;;;;GAIG;AACH,wBAAgB,gBAAgB,YAgB/B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAH/B,MAG+B,GAF7B,MAAM,CAWlB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,KAAA,EAAE,aAAa,KAAA,EAAE,QAAQ,KAAA,WAuC3E;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,KAAA,EAAE,QAAQ,KAAA;;;;;;EA2HvD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,KAAA,EAAE,cAAc,KAAA,WA2D7D;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,KAAA,EACb,WAAW,KAAA,EACX,aAAa,KAAA,EACb,QAAQ,KAAA,GANG,OAAO,CA+MnB;AAmDD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,EAAE,QAAQ,GAHxC,MAG6C,GAF3C,KAAK,CAAC,MAAM,CAAC,CAmDzB;AAyDD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,EAAE,UAAU,EAH1C,MAG0C,GAFxC,MAAM,CA6FlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,GAAG,EANnB,MAMmB,EAAE,OAAO,AALpC,CAGA,EAFA;IAAyB,GAAG,AAA5B,CACA,EADQ,MAAM,CACd;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;CAEyC,GAF/B,KAAK,CAAC,MAAM,CAAC,CA4CzB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,EAAE,QAAQ,GAHxC,MAG6C,GAF3C,KAAK,CAAC,MAAM,CAAC,CA+BzB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAFxB,MAAM,CA4GlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,WAUpC;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,IAF9B,MAAM,GAAC,SAAS,CAc5B"}
+{"version":3,"file":"envcontext.d.ts","sourceRoot":"","sources":["../../../lib/inventory/envcontext.js"],"names":[],"mappings":"AAyDA;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAFd,MAE4D,CAAC;AAwDvE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,wBAapC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAL3B,MAK2B,EAAE,GAAG,EAJhC,MAIgC,sBAE1C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAJrB,MAIqB,sBAE/B;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,UAAU,KAAA,EAAE,GAAG,EAJ9B,MAI8B,sBAExC;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAJtB,MAIsB,MAkBhC;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAJlB,MAIkB,SA4B5B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EALvB,MAKuB,EAAE,IAAI,OAAA,sBAiBvC;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EALtB,MAKsB,EAAE,QAAQ,GAJhC,MAIqC,GAFnC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAAC,CA+BhD;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EALvB,MAKuB,EAAE,QAAQ,GAJjC,MAIsC,GAFpC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CA8BlD;AA0DD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB;;;;;;;;;cAsBlC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAH1B,MAG0B;;;;;cAgBpC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAH1B,MAG0B;;;;;cAiBpC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB,GAFtB,MAAM,CAkBlB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB;;;;;cAejC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB;;;;;cAelC;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAHtB,MAGsB;;;;cAahC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAHzB,MAGyB;;;;cAanC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAHxB,MAGwB;;;;cAalC;AA0BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,sBAuBjC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAH5B,MAG4B,sBAkCtC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,QAAA,EAAE,IAAI,OAAA,sBAExC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EALvB,MAKuB,EAAE,OAAO,AAJxC,CAEA,EAFQ,MAI4C,GAF1C,MAAM,EAAE,CAqDpB;AA6CD;;GAEG;AACH,wBAAgB,iBAAiB,YAiBhC;AAED;;GAEG;AACH,wBAAgB,cAAc,YAO7B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,QAAA,EAAE,QAAQ,QAAA,WA0BvD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,QAAA,EAAE,QAAQ,QAAA,WA8GnD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,QAAA,UA8B3C;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,QAAA,UA8B9C;AASD;;;;GAIG;AACH,wBAAgB,gBAAgB,YAgB/B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAH/B,MAG+B,GAF7B,MAAM,CAWlB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,KAAA,EAAE,aAAa,KAAA,EAAE,QAAQ,KAAA,WAuC3E;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,KAAA,EAAE,QAAQ,KAAA;;;;;;EA2HvD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,KAAA,EAAE,cAAc,KAAA,WA2D7D;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,KAAA,EACb,WAAW,KAAA,EACX,aAAa,KAAA,EACb,QAAQ,KAAA,GANG,OAAO,CA+MnB;AAmDD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,EAAE,QAAQ,GAHxC,MAG6C,GAF3C,KAAK,CAAC,MAAM,CAAC,CAmDzB;AAyDD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,EAAE,UAAU,EAH1C,MAG0C,GAFxC,MAAM,CA6FlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,GAAG,EANnB,MAMmB,EAAE,OAAO,AALpC,CAGA,EAFA;IAAyB,GAAG,AAA5B,CACA,EADQ,MAAM,CACd;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;CAEyC,GAF/B,KAAK,CAAC,MAAM,CAAC,CA4CzB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,EAAE,QAAQ,GAHxC,MAG6C,GAF3C,KAAK,CAAC,MAAM,CAAC,CA+BzB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAFxB,MAAM,CA4GlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,WAUpC;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,IAF9B,MAAM,GAAC,SAAS,CAc5B"}

package/types/lib/inventory/evidenceUtils.d.ts

@@ -76,14 +76,33 @@ export declare function addEvidenceForDotnet(pkgList: Object[], slicesFile: stri
  * @param {Array} results Query Results
  * @param {Boolean} enhance Optionally enhance results by invoking additional package manager commands
  */
-export declare function convertOSQueryResults(queryCategory: string, queryObj: Object, results: any[], enhance?: boolean, osPackageListers?: undefined): {
-    name: string;
-    group: string;
-    version: string;
-    description: any;
-    publisher: string;
-    "bom-ref": string;
-    scope: any;
-    type: any;
-}[];
+export declare function convertOSQueryResults(queryCategory: string, queryObj: Object, results: any[], enhance?: boolean, osPackageListers?: undefined): any[];
+/**
+ * Convert the packages of an apk installed database into components.
+ *
+ * The packages are named as the container scan names an Alpine, Wolfi or
+ * Chainguard package, and grouped with the other OS package categories under
+ * `cdx:osquery:category` = `apk_packages`. Beyond what an osquery package row
+ * gives, an apk record knows its licence and home page, which become
+ * `licenses` and a `website` external reference.
+ *
+ * @param {Object[]} packages Packages from readApkInstalledDb()
+ * @returns {Object[]} Components
+ */
+export declare function convertApkPackages(packages: Object[]): Object[];
+/**
+ * Convert the rows of the `ai_agent_skills` query into components.
+ *
+ * A skill installed on the host is what the `ai-skill` project scan finds in a
+ * repository, so it is a `file` component with the same `cdx:file:kind` and
+ * `cdx:skill:*` properties, and no purl: a skill has no package identity. Its
+ * bom-ref is the SHA-256 of its SKILL.md rather than the path, which is under a
+ * home directory, and where it was found is an occurrence. The same skill
+ * found under several roots, such as a plugin marketplace checkout and the
+ * plugin cache, is one component with one occurrence for each.
+ *
+ * @param {Object[]} results Rows of `ai_agent_skills` joined with `hash`
+ * @returns {Object[]} Components
+ */
+export declare function convertAgentSkillRows(results: Object[]): Object[];
 //# sourceMappingURL=evidenceUtils.d.ts.map

package/types/lib/inventory/evidenceUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evidenceUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/evidenceUtils.js"],"names":[],"mappings":"AAiCA;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,OAAO,AAHvD,CACA,EADQ,MAGoD,GAFlD,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,MAAM,GAAC,SAAS,CA8B5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAHxC,MAGwC,GAFtC,MAAM,CAalB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAJ1B,MAAM,EAAE,GAAC,MAIiB,EAAE,SAAS,UAAA,GAFnC,MAAM,EAAE,CAmDpB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAAM,GAAC,MAAM,EAIoB,EAAE,QAAQ,EAH3C,MAAM,EAGqC,GAFzC,MAAM,GAAC,MAAM,EAAE,CAwB3B;AAsCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAPjC,MAAM,EAO2B,EAAE,UAAU,EAN7C,MAM6C,EAAE,OAAO,AAL9D,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAEmE,GAFzD,MAAM,EAAE,CAsQpB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EANJ,MAMI,EACb,QAAQ,EANC,MAMD,EACR,OAAO,OAAA,EACP,OAAO,UAAQ,EACf,gBAAgB,YAAY;;;;;;;;;IA6H7B"}
+{"version":3,"file":"evidenceUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/evidenceUtils.js"],"names":[],"mappings":"AA6CA;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,OAAO,AAHvD,CACA,EADQ,MAGoD,GAFlD,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,MAAM,GAAC,SAAS,CA8B5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAHxC,MAGwC,GAFtC,MAAM,CAalB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAJ1B,MAAM,EAAE,GAAC,MAIiB,EAAE,SAAS,UAAA,GAFnC,MAAM,EAAE,CAmDpB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAAM,GAAC,MAAM,EAIoB,EAAE,QAAQ,EAH3C,MAAM,EAGqC,GAFzC,MAAM,GAAC,MAAM,EAAE,CAwB3B;AAsCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAPjC,MAAM,EAO2B,EAAE,UAAU,EAN7C,MAM6C,EAAE,OAAO,AAL9D,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAEmE,GAFzD,MAAM,EAAE,CAsQpB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EANJ,MAMI,EACb,QAAQ,EANC,MAMD,EACR,OAAO,OAAA,EACP,OAAO,UAAQ,EACf,gBAAgB,YAAY,SAsO7B;AA6ID;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAHhC,MAAM,EAG0B,GAF9B,MAAM,EAAE,CAqCpB;AAgCD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAHlC,MAAM,EAG4B,GAFhC,MAAM,EAAE,CAgEpB"}

package/types/lib/inventory/formulationParsers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"formulationParsers.d.ts","sourceRoot":"","sources":["../../../lib/inventory/formulationParsers.js"],"names":[],"mappings":"AA0GA;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAF1B;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,WAAU;CAEvB,QAkBpC;AAED;;;;GAIG;AACH,wBAAgB,UAAU,IAFb,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,WAAU;CAAE,CAAC,CAItE;AAgDD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAZnC,MAYmC,EAAE,OAAO,EAX5C,MAW4C,EAAE,OAAO,AAT7D,CAIA,EAJQ,MAS0D,GALxD;IAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CAuN7D"}
+{"version":3,"file":"formulationParsers.d.ts","sourceRoot":"","sources":["../../../lib/inventory/formulationParsers.js"],"names":[],"mappings":"AA0GA;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAF1B;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,WAAU;CAEvB,QAkBpC;AAED;;;;GAIG;AACH,wBAAgB,UAAU,IAFb,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,WAAU;CAAE,CAAC,CAItE;AAgDD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAZnC,MAYmC,EAAE,OAAO,EAX5C,MAW4C,EAAE,OAAO,AAT7D,CAIA,EAJQ,MAS0D,GALxD;IAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CAwN7D"}

package/types/lib/inventory/goBuildInfo.d.ts

@@ -0,0 +1,10 @@
+export declare const PRE_1_18_VERSION = "unknown-pre-1.18";
+/**
+ * Read the Go toolchain version from an executable's buildinfo header.
+ *
+ * @param {string} filePath absolute path to a possible Go binary
+ * @returns {string|undefined} `go1.x.y`, `unknown-pre-1.18` for old layouts,
+ *   or undefined when the file carries no Go buildinfo
+ */
+export declare function readGoBuildVersion(filePath: string): string | undefined;
+//# sourceMappingURL=goBuildInfo.d.ts.map

package/types/lib/inventory/goBuildInfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"goBuildInfo.d.ts","sourceRoot":"","sources":["../../../lib/inventory/goBuildInfo.js"],"names":[],"mappings":"AAuBA,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAyDnD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAJhC,MAIgC,GAH9B,MAAM,GAAC,SAAS,CAuD5B"}

package/types/lib/inventory/hbom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hbom.d.ts","sourceRoot":"","sources":["../../../lib/inventory/hbom.js"],"names":[],"mappings":"AAwSA;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAHpC,MAAM,GAAC,MAAM,EAAE,GAAC,SAAS,GAAC,IAGU,GAFlC,OAAO,CAMnB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,YAAY,EAHxC,MAAM,GAAC,MAAM,EAAE,GAAC,SAAS,GAAC,IAGc,GAFtC,OAAO,CAUnB;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,YAAY,EAF/C,MAAM,GAAC,MAAM,EAAE,GAAC,SAAS,GAAC,IAEqB,QAgBzD;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,WAAW,EAF/C,MAAM,GAAC,MAAM,GAAC,SAAS,GAAC,IAEuB,QAOzD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,AAH7C,CACA,EADQ,MAG0C,EAAE,WAAW,AAF/D,CACF,EADU,MAEgE,QAmB1E;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,AAHzC,CACA,EADQ,MAGsC,GAFpC,MAAM,CA2BlB;AA8GD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAHtC,MAGsC,GAFpC,MAAM,CA8HlB;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,AAH7C,CACA,EADQ,MAG0C,GAFxC,OAAO,CAAC,MAAM,CAAC,CAiC3B"}
+{"version":3,"file":"hbom.d.ts","sourceRoot":"","sources":["../../../lib/inventory/hbom.js"],"names":[],"mappings":"AAiWA;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAHpC,MAAM,GAAC,MAAM,EAAE,GAAC,SAAS,GAAC,IAGU,GAFlC,OAAO,CAMnB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,YAAY,EAHxC,MAAM,GAAC,MAAM,EAAE,GAAC,SAAS,GAAC,IAGc,GAFtC,OAAO,CAUnB;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,YAAY,EAF/C,MAAM,GAAC,MAAM,EAAE,GAAC,SAAS,GAAC,IAEqB,QAgBzD;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,WAAW,EAF/C,MAAM,GAAC,MAAM,GAAC,SAAS,GAAC,IAEuB,QAOzD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,AAH7C,CACA,EADQ,MAG0C,EAAE,WAAW,AAF/D,CACF,EADU,MAEgE,QAmB1E;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,AAHzC,CACA,EADQ,MAGsC,GAFpC,MAAM,CA8BlB;AA8GD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAHtC,MAGsC,GAFpC,MAAM,CA8HlB;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,AAH7C,CACA,EADQ,MAG0C,GAFxC,OAAO,CAAC,MAAM,CAAC,CAiC3B"}

package/types/lib/inventory/hbomAnalysis.d.ts

@@ -19,6 +19,16 @@ export declare function getHbomCommandDiagnosticSummary(bomJson: Object): Object
  * @returns {boolean} `true` when the BOM looks like an HBOM
  */
 export declare function isHbomLikeBom(bomJson: Object): boolean;
+/**
+ * Explain how the permission-denied enrichments of an HBOM can be recovered.
+ *
+ * Windows never uses sudo: the elevated-only batch needs an already-elevated
+ * session, and a network logon is denied every WMI query.
+ *
+ * @param {string|undefined} platform `cdx:hbom:platform` of the HBOM
+ * @returns {string} Guidance for the platform; the Linux wording for any other platform
+ */
+export declare function getHbomPrivilegeGuidance(platform: string | undefined): string;
 /**
  * Return a component's `cdx:hbom:hardwareClass` property value.
  *

package/types/lib/inventory/hbomAnalysis.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hbomAnalysis.d.ts","sourceRoot":"","sources":["../../../lib/inventory/hbomAnalysis.js"],"names":[],"mappings":"AAoDA;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAHtC,MAGsC,GAFpC,MAAM,EAAE,CAMpB;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAH5C,MAG4C,GAF1C,MAAM,CAuElB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,OAAO,CA6BnB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,AAHlD,CACA,EADQ,MAAM,EAGyC,GAF7C;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAkBpD;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,mBAAmB,AAH/D,CACA,EADQ;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAGsB,GAF1D,MAAM,CAOlB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,GAFzB,MAAM,CAkFlB"}
+{"version":3,"file":"hbomAnalysis.d.ts","sourceRoot":"","sources":["../../../lib/inventory/hbomAnalysis.js"],"names":[],"mappings":"AAoDA;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAHtC,MAGsC,GAFpC,MAAM,EAAE,CAMpB;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAH5C,MAG4C,GAF1C,MAAM,CAuElB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,OAAO,CA6BnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAHtC,MAAM,GAAC,SAG+B,GAFpC,MAAM,CAOlB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,AAHlD,CACA,EADQ,MAAM,EAGyC,GAF7C;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAkBpD;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,mBAAmB,AAH/D,CACA,EADQ;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAGsB,GAF1D,MAAM,CAOlB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,GAFzB,MAAM,CAkFlB"}

package/types/lib/inventory/hostTopology.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hostTopology.d.ts","sourceRoot":"","sources":["../../../lib/inventory/hostTopology.js"],"names":[],"mappings":"AA2mBA;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,GAF9B,OAAO,CAUnB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B;IAAC,4BAA4B,EAAE,MAAM,CAAC;IAAC,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,GAAC,SAAS,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAC;IAAC,qBAAqB,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAC,CA0BnM;AAYD;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAHvC,MAGuC,GAFrC,MAAM,CAiFlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAJpC,MAIoC,EAAE,QAAQ,EAH9C;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAGG,GAF5C,MAAM,CA0DlB"}
+{"version":3,"file":"hostTopology.d.ts","sourceRoot":"","sources":["../../../lib/inventory/hostTopology.js"],"names":[],"mappings":"AA4nBA;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,GAF9B,OAAO,CAUnB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B;IAAC,4BAA4B,EAAE,MAAM,CAAC;IAAC,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,GAAC,SAAS,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAC;IAAC,qBAAqB,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAC,CA0BnM;AAYD;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAHvC,MAGuC,GAFrC,MAAM,CAiFlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAJpC,MAIoC,EAAE,QAAQ,EAH9C;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAGG,GAF5C,MAAM,CA8DlB"}

package/types/lib/inventory/osPackagePurl.d.ts

@@ -0,0 +1,99 @@
+/**
+ * The purl types an OS scan builds from what a package manager reports.
+ * deb, rpm, apk and alpm belong to a distro; brew, macports, snap and flatpak
+ * belong to none. brew, macports, snap and flatpak are not purl-spec types;
+ * cdx-purl builds them as it builds `pkg:chocolatey`.
+ */
+export declare const OS_PACKAGE_PURL_TYPES: Set<string>;
+/**
+ * Whether a purl type is one of the OS package managers handled here.
+ *
+ * @param {string|undefined} type Purl type
+ * @returns {boolean} true for the types in OS_PACKAGE_PURL_TYPES
+ */
+export declare function isOsPackagePurlType(type: string | undefined): boolean;
+/**
+ * Whether a value names an architecture. rpm says `(none)` and trivy says
+ * `None` for a package that has none, such as an rpm's `gpg-pubkey` key record;
+ * neither is an architecture, and neither belongs in a purl.
+ *
+ * @param {string|undefined|null} arch Architecture as a package manager reports it
+ * @returns {boolean} true for a real architecture
+ */
+export declare function isRealArchitecture(arch: string | undefined | null): boolean;
+/**
+ * The epoch of an OS package, as the `epoch` qualifier carries it.
+ *
+ * An rpm keeps its epoch in a field of its own. A deb keeps it in its version
+ * (`2:93`), so the version is read first. Epoch 0 and no epoch are the same,
+ * and apk and Homebrew packages have none.
+ *
+ * @param {{type: string, version?: string, epoch?: string|number}} pkg Package
+ * @returns {string|undefined} The epoch without leading zeros, or undefined
+ */
+export declare function osPackageEpoch(pkg: {
+    type: string;
+    version?: string;
+    epoch?: string | number;
+}): string | undefined;
+/**
+ * The version an OS package carries on its component and in its purl.
+ *
+ * - rpm: `[epoch:]version-release`, the form the container scan writes. The
+ *   purl spec keeps the epoch out of an rpm version, but the container scan
+ *   puts it in the version as well as in the `epoch` qualifier, and an OBOM must
+ *   name the package the same way.
+ * - deb: the version exactly as dpkg reports it, epoch included.
+ * - macports: `version_revision`, the form `port installed` prints.
+ * - apk, alpm, brew, snap and flatpak: the version as it is. A pacman version
+ *   already holds its epoch and release (`1:1.3.2-4`).
+ *
+ * @param {{type: string, version?: string, release?: string, epoch?: string|number, revision?: string|number}} pkg Package
+ * @returns {string} The version, or an empty string when the package has none
+ */
+export declare function osPackageVersion(pkg: {
+    type: string;
+    version?: string;
+    release?: string;
+    epoch?: string | number;
+    revision?: string | number;
+}): string;
+/**
+ * Build the purl of an OS package.
+ *
+ * deb, rpm and apk purls take their vendor (`ubuntu`, `almalinux`, `alpine`,
+ * `wolfi`) and the `distro` and `distro_name` qualifiers from the distro, plus
+ * `arch` and `epoch` from the package. alpm purls take the vendor (`arch`,
+ * `manjaro`) and `arch` only: that is all the alpm type defines, and an Arch
+ * system is rolling, with no release to name. A qualifier with no value is
+ * left out. brew, macports and snap purls carry neither vendor nor qualifiers;
+ * a flatpak purl carries the `arch` and `branch` of the flatpak ref.
+ *
+ * @param {Object} pkg The package
+ * @param {string} pkg.type One of OS_PACKAGE_PURL_TYPES
+ * @param {string} pkg.name Package name; a flatpak's application ID
+ * @param {string} [pkg.version] deb: the dpkg version. rpm: the version tag only. apk: version-rN. macports: the version without its revision.
+ * @param {string} [pkg.release] rpm release tag
+ * @param {string|number} [pkg.epoch] rpm epoch tag
+ * @param {string|number} [pkg.revision] MacPorts revision
+ * @param {string} [pkg.arch] Package architecture
+ * @param {string} [pkg.branch] flatpak branch (`stable`, `48`)
+ * @param {{namespace?: string, distroId?: string, distroName?: string}} [distro]
+ *   What getDistroInfo() reports; read from the host's os-release when left out
+ * @returns {string|null} The purl, or null when the parts do not form a valid one
+ */
+export declare function buildOsPackagePurl(pkg: {
+    type: string;
+    name: string;
+    version?: string;
+    release?: string;
+    epoch?: string | number;
+    revision?: string | number;
+    arch?: string;
+    branch?: string;
+}, distro?: {
+    namespace?: string;
+    distroId?: string;
+    distroName?: string;
+}): string | null;
+//# sourceMappingURL=osPackagePurl.d.ts.map

package/types/lib/inventory/osPackagePurl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"osPackagePurl.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osPackagePurl.js"],"names":[],"mappings":"AAiBA;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,aAShC,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAH7B,MAAM,GAAC,SAGsB,GAF3B,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAH5B,MAAM,GAAC,SAAS,GAAC,IAGW,GAF1B,OAAO,CAKnB;AAqCD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAC,MAAM,CAAA;CAG/B,GAFrB,MAAM,GAAC,SAAS,CAe5B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAHzB;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAC,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,GAAC,MAAM,CAAA;CAGzE,GAFvB,MAAM,CA6BlB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAZnC;IAAoB,IAAI,EAAhB,MAAM,CACd;IAAoB,IAAI,EAAhB,MAAM,CACd;IAAqB,OAAO,AAA5B,CACA,EADQ,MAAM,CACd;IAAqB,OAAO,AAA5B,CACA,EADQ,MAAM,CACd;IAA4B,KAAK,AAAjC,CACA,EADQ,MAAM,GAAC,MAAM,CACrB;IAA4B,QAAQ,AAApC,CACA,EADQ,MAAM,GAAC,MAAM,CACrB;IAAqB,IAAI,AAAzB,CACA,EADQ,MAAM,CACd;IAAqB,MAAM,AAA3B,CACA,EADQ,MAAM,CACd;CAImC,EAAE,MAAM,AAJ3C,CAEA,EAFQ;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAIxB,GAFjC,MAAM,GAAC,IAAI,CA4DvB"}

package/types/lib/inventory/osPackageResolver.d.ts

@@ -7,13 +7,14 @@ export declare function _resetOsInfoCache(): void;
  * correctly computed purl with distro qualifiers derived from /etc/os-release.
  *
  * @param {string} filePath - Absolute path to the library file
- * @returns {{ name: string, version: string, arch: string, type: string, purl: string } | undefined}
+ * @returns {{ name: string, version: string, arch: string, type: string, epoch?: string, purl: string } | undefined}
  */
 export declare function resolvePackageForFile(filePath: string): {
     name: string;
     version: string;
     arch: string;
     type: string;
+    epoch?: string;
     purl: string;
 } | undefined;
 /**
@@ -42,8 +43,11 @@ export declare function collectExecutables(basePath: any, binPaths: any, exclude
  * @param ldConf {String} Config file used by ldconfig to locate additional paths
  * @param ldConfDirPattern {String} Config directory that can contain more .conf files for ldconfig
  * @param excludePaths {Array[String]} Container-relative paths that should be excluded from the result set
+ * @param extraLibGlobs {Array[String]} Extra container-relative globs for files
+ *   the default paths miss, such as libphp*.so under Apache's modules
+ *   directory. The existing globs are unchanged; this adds candidates only.
  *
  * @return {Array[String]} List of executables
  */
-export declare function collectSharedLibs(basePath: any, libPaths: any, ldConf: string, ldConfDirPattern: string, excludePaths?: any): any;
+export declare function collectSharedLibs(basePath: any, libPaths: any, ldConf: string, ldConfDirPattern: string, excludePaths?: any, extraLibGlobs?: any): any;
 //# sourceMappingURL=osPackageResolver.d.ts.map

package/types/lib/inventory/osPackageResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"osPackageResolver.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osPackageResolver.js"],"names":[],"mappings":"AAwBA;;GAEG;AACH,wBAAgB,iBAAiB,SAGhC;AA8ED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA8BnG;AAoGD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAJ9B,MAI8B,EAAE,UAAU,EAH1C,MAAM,EAGoC,GAFxC,MAAM,GAAC,SAAS,CA+B5B;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,KAAA,EAAE,QAAQ,KAAA,EAAE,YAAY,MAAK,OAqEvE;AAcD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,KAAA,EACR,QAAQ,KAAA,EACR,MAAM,QAAA,EACN,gBAAgB,QAAA,EAChB,YAAY,MAAK,OA8ElB"}
+{"version":3,"file":"osPackageResolver.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osPackageResolver.js"],"names":[],"mappings":"AAwBA;;GAEG;AACH,wBAAgB,iBAAiB,SAGhC;AAsDD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA8BnH;AAuGD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAJ9B,MAI8B,EAAE,UAAU,EAH1C,MAAM,EAGoC,GAFxC,MAAM,GAAC,SAAS,CA+B5B;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,KAAA,EAAE,QAAQ,KAAA,EAAE,YAAY,MAAK,OAqEvE;AAcD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,KAAA,EACR,QAAQ,KAAA,EACR,MAAM,QAAA,EACN,gBAAgB,QAAA,EAChB,YAAY,MAAK,EACjB,aAAa,MAAK,OAiGnB"}