@cdxgen/cdxgen 13.4.0 → 13.5.0

package/types/lib/inventory/osinfo.d.ts

@@ -46,14 +46,34 @@ export declare const OS_DISTRO_ALIAS: {
     "ubuntu-24.10": string;
     "ubuntu-25.04": string;
     "ubuntu-25.10": string;
+    "ubuntu-26.04": string;
+    "ubuntu-26.10": string;
     "debian-15": string;
     "debian-14": string;
     "debian-14.5": string;
     "debian-13": string;
+    "debian-13.7": string;
+    "debian-13.6": string;
     "debian-13.5": string;
+    "debian-13.4": string;
+    "debian-13.3": string;
+    "debian-13.2": string;
+    "debian-13.1": string;
     "debian-12": string;
-    "debian-12.5": string;
+    "debian-12.15": string;
+    "debian-12.14": string;
+    "debian-12.13": string;
+    "debian-12.12": string;
+    "debian-12.11": string;
+    "debian-12.10": string;
+    "debian-12.9": string;
+    "debian-12.8": string;
+    "debian-12.7": string;
     "debian-12.6": string;
+    "debian-12.5": string;
+    "debian-12.4": string;
+    "debian-12.2": string;
+    "debian-12.1": string;
     "debian-11": string;
     "debian-11.5": string;
     "debian-10": string;
@@ -179,15 +199,20 @@ export declare function _resetOsReleaseCache(): void;
  * Derive structured distro information from an os-release file.
  *
  * Returns an object with:
- *   - purlType    {string}  "deb" | "apk" | "rpm"
+ *   - purlType    {string}  "deb" | "apk" | "rpm" | "alpm" (Arch and the
+ *                           distros built on it)
  *   - namespace   {string}  canonical purl namespace (e.g. "ubuntu", "alpine",
  *                           "azure-linux" for both Azure Linux and CBL-Mariner)
  *   - distroId    {string}  ID + "-" + VERSION_ID with a canonical vendor
- *                           prefix (e.g. "ubuntu-22.04", "azure-linux-3.0")
- *   - distroName  {string}  codename/alias          (e.g. "jammy")
+ *                           prefix (e.g. "ubuntu-22.04", "azure-linux-3.0",
+ *                           "alpine-3.24.3")
+ *   - distroName  {string}  release codename, or a token OS_DISTRO_ALIAS knows
+ *                           (e.g. "jammy", "rhel", "alpine-3.24"); empty when
+ *                           the distro has neither
  *
- * Mirrors the logic in lib/managers/binary.js getOSPackages() so that both
- * callers share a single implementation.
+ * lib/managers/binary.js getOSPackages() reads its distro from here, so a
+ * container scan and an OBOM run on the same system give a package the same
+ * `distro` and `distro_name` qualifiers.
  *
  * @param {string} [root="/"] - Filesystem root to look for os-release.
  * @returns {{ purlType: string, namespace: string, distroId: string, distroName: string }}

package/types/lib/inventory/osinfo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"osinfo.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osinfo.js"],"names":[],"mappings":"AAGA;;;GAGG;AACH,eAAO,MAAM,eAAe;IAC1B,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,WAAW;IACX,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,UAAU;IACV,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,0BAA0B;IAC1B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,6BAA6B;CAC9B,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB;IAC7B,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,EAAE;IACF,eAAe;IACf,qBAAqB;IACrB,IAAI;IACJ,aAAa;CACd,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,yBAAyB;IACpC,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,EAAE;IACF,IAAI;IACJ,aAAa;CACd,CAAC;AASF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAHrC,MAGqC,GAFnC,OAAO,CAInB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,CAYlB;AAQD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAJ/B,CAEA,EAFQ,MAI6B,GAF3B,MAAM,CAqClB;AAGD;;GAEG;AACH,wBAAgB,oBAAoB,SAEnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAH/B,CACA,EADQ,MAG6B,GAF3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAkHzF"}
+{"version":3,"file":"osinfo.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osinfo.js"],"names":[],"mappings":"AAGA;;;GAGG;AACH,eAAO,MAAM,eAAe;IAC1B,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,WAAW;IACX,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,WAAW;IACX,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,UAAU;IACV,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,0BAA0B;IAC1B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,6BAA6B;CAC9B,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB;IAC7B,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,EAAE;IACF,eAAe;IACf,qBAAqB;IACrB,IAAI;IACJ,aAAa;CACd,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,yBAAyB;IACpC,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,EAAE;IACF,IAAI;IACJ,aAAa;CACd,CAAC;AASF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAHrC,MAGqC,GAFnC,OAAO,CAInB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,CAYlB;AAQD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAJ/B,CAEA,EAFQ,MAI6B,GAF3B,MAAM,CAqClB;AAGD;;GAEG;AACH,wBAAgB,oBAAoB,SAEnC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAH/B,CACA,EADQ,MAG6B,GAF3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAyIzF"}

package/types/lib/inventory/osqueryTransform.d.ts

@@ -81,4 +81,55 @@ export declare function shouldCreateOsQueryPurl(componentType: string): boolean;
  * @returns {string|null} Canonical purl string, or `null` when the parts do not form a valid purl
  */
 export declare function createOsQueryPurl(purlType: string, group: string | null, name: string, version: string, qualifiers: Object | null, subpath: string | null): string | null;
+/**
+ * The version and purl of a row from an OS package table: `deb_packages`,
+ * `rpm_packages`, `pacman_packages`, `homebrew_packages`, `macports_packages`,
+ * `snap_packages`, `flatpak_packages` or the rows of the apk database.
+ *
+ * Such a row is named the way the package manager's own scan names it: deb,
+ * rpm and apk with the vendor and the `arch`, `distro`, `distro_name` and
+ * `epoch` qualifiers of the container scan, an rpm version joined to its
+ * release, a MacPorts version joined to its revision, a flatpak by its
+ * application ID with the `arch` and `branch` of its ref. A row's `path`,
+ * `admindir` or source file is not a path inside the package, so none of them
+ * becomes a subpath.
+ *
+ * @param {string} purlType One of OS_PACKAGE_PURL_TYPES
+ * @param {Object} res osquery row
+ * @param {string} name Component name derived from the row
+ * @param {Object} [distro] What getDistroInfo() reports; the host's by default
+ * @returns {{version: string, purl: string|null}} The component version and the purl, which is null when the row cannot be expressed as one
+ */
+export declare function createOsQueryPackageIdentity(purlType: string, res: Object, name: string, distro?: Object): {
+    version: string;
+    purl: string | null;
+};
+/**
+ * The columns of an OS package row that give its licence and its home page.
+ * They become the component's `licenses` and a `website` reference rather than
+ * properties. `separator` splits a licence column that lists several: pacman
+ * keeps one licence per entry, which osquery joins with commas.
+ */
+export declare const OS_PACKAGE_LICENSE_COLUMNS: {
+    alpm: {
+        license: string;
+        separator: string;
+        website: string;
+    };
+    snap: {
+        license: string;
+    };
+    flatpak: {
+        license: string;
+        website: string;
+    };
+};
+/**
+ * The property name an OS package table column is emitted under.
+ *
+ * @param {string|undefined} purlType Purl type of the table
+ * @param {string} column Column name
+ * @returns {string|undefined} The property name, or undefined when the column is not emitted
+ */
+export declare function osPackagePropertyName(purlType: string | undefined, column: string): string | undefined;
 //# sourceMappingURL=osqueryTransform.d.ts.map

package/types/lib/inventory/osqueryTransform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"osqueryTransform.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osqueryTransform.js"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAH7B,MAG6B,GAF3B,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAL1B,MAK0B,EAAE,YAAY,EAJxC,OAIwC,EAAE,SAAS,EAHnD,MAGmD,GAFjD,MAAM,GAAC,SAAS,CAkB5B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,MAG+B,GAF7B,MAAM,CAWlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAHjC,MAGiC,GAF/B,MAAM,CAelB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAHlC,MAGkC,GAFhC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAJrC,MAIqC,EAAE,QAAQ,AAHvD,CACA,EADQ,MAG2D,GAFzD,MAAM,CAWlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,aAAa,EATJ,MASI,EACb,aAAa,EATJ,MASI,EACb,IAAI,EATK,MAAM,GAAC,SASZ,EACJ,OAAO,EATE,MAAM,GAAC,SAST,EACP,aAAa,EATJ,MAAM,GAAC,SASH,EACb,aAAa,EATJ,MAAM,GAAC,SASH,GARF,MAAM,CA8BlB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAH1C,MAG0C,GAFxC,OAAO,CAMnB;AAaD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EATC,MASD,EACR,KAAK,EATI,MAAM,GAAC,IASX,EACL,IAAI,EATK,MASL,EACJ,OAAO,EATE,MASF,EACP,UAAU,EATD,MAAM,GAAC,IASN,EACV,OAAO,EATE,MAAM,GAAC,IAST,GARI,MAAM,GAAC,IAAI,CAuCvB"}
+{"version":3,"file":"osqueryTransform.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osqueryTransform.js"],"names":[],"mappings":"AAIA;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAH7B,MAG6B,GAF3B,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAL1B,MAK0B,EAAE,YAAY,EAJxC,OAIwC,EAAE,SAAS,EAHnD,MAGmD,GAFjD,MAAM,GAAC,SAAS,CAkB5B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,MAG+B,GAF7B,MAAM,CAalB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAHjC,MAGiC,GAF/B,MAAM,CAelB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAHlC,MAGkC,GAFhC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAJrC,MAIqC,EAAE,QAAQ,AAHvD,CACA,EADQ,MAG2D,GAFzD,MAAM,CAWlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,aAAa,EATJ,MASI,EACb,aAAa,EATJ,MASI,EACb,IAAI,EATK,MAAM,GAAC,SASZ,EACJ,OAAO,EATE,MAAM,GAAC,SAST,EACP,aAAa,EATJ,MAAM,GAAC,SASH,EACb,aAAa,EATJ,MAAM,GAAC,SASH,GARF,MAAM,CA8BlB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAH1C,MAG0C,GAFxC,OAAO,CAMnB;AAgBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EATC,MASD,EACR,KAAK,EATI,MAAM,GAAC,IASX,EACL,IAAI,EATK,MASL,EACJ,OAAO,EATE,MASF,EACP,UAAU,EATD,MAAM,GAAC,IASN,EACV,OAAO,EATE,MAAM,GAAC,IAST,GARI,MAAM,GAAC,IAAI,CAsCvB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAN1C,MAM0C,EAAE,GAAG,EAL/C,MAK+C,EAAE,IAAI,EAJrD,MAIqD,EAAE,MAAM,AAHrE,CACA,EADQ,MAG6D,GAF3D;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAC,IAAI,CAAA;CAAC,CAqBhD;AAmCD;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B;IACrC,IAAI;QAAI,OAAO;QAAc,SAAS;QAAO,OAAO;;IACpD,IAAI;QAAI,OAAO;;IACf,OAAO;QAAI,OAAO;QAAa,OAAO;;CACvC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAJnC,MAAM,GAAC,SAI4B,EAAE,MAAM,EAH3C,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAY5B"}

package/types/lib/inventory/phpBuildInfo.d.ts

@@ -0,0 +1,142 @@
+/**
+ * The most PHP-named files one scan opens in search of a build version.
+ *
+ * @type {number}
+ */
+export declare const MAX_PHP_PROBES: number;
+/**
+ * Read the version a text starts with, in the grammar the build-version reader
+ * accepts: `8.4.27`, `8.5.0-dev`, `8.6.0RC3`. What follows the version must not
+ * continue it, so `8.4.26.1` and `8.4.26foo` parse to nothing. A distro
+ * revision such as Ubuntu's `8.1.2-1ubuntu2.14` is not an upstream version
+ * either, and parses to nothing rather than to a guess.
+ *
+ * @param {string} text text that begins with the version
+ * @returns {string|undefined} the version, or undefined when the text does not
+ *   begin with one
+ */
+export declare function parsePhpVersion(text: string): string | undefined;
+/**
+ * Read the version a PHP reports about itself, as `php -v` prints it. An
+ * upstream version parses as parsePhpVersion does. A version with a distro
+ * revision, such as Ubuntu's `8.1.2-1ubuntu2.14`, is kept whole and marked: it
+ * is what that PHP reports, but the distro backports fixes without changing the
+ * upstream part, so it must not be matched against upstream advisories.
+ *
+ * @param {string} text text that begins with the version
+ * @returns {{version: string, distroRevision: boolean}|undefined} the version,
+ *   or undefined when the text does not begin with one
+ */
+export declare function parsePhpReportedVersion(text: string): {
+    version: string;
+    distroRevision: boolean;
+} | undefined;
+/**
+ * The package manager whose store a path lies in. Homebrew (`Cellar/<formula>/
+ * <version>/`), Nix (`nix/store/`) and Guix (`gnu/store/`) own everything under
+ * their stores, whatever links lead there, and a PHP they own is identified by
+ * their package, never as an unpackaged build.
+ *
+ * @param {string} filePath absolute or root-relative path, either separator
+ * @returns {string|undefined} `homebrew`, `nix` or `guix`, or undefined
+ */
+export declare function packageStoreOf(filePath: string): string | undefined;
+/**
+ * Classify a file by its basename into a PHP SAPI, or undefined when the name
+ * is not one php-src installs.
+ *
+ * @param {string} fileName basename or path of the candidate
+ * @returns {string|undefined} cli, fpm, cgi, phpdbg, libphp or frankenphp
+ */
+export declare function classifyPhpSapi(fileName: string): string | undefined;
+/**
+ * Read the PHP build version of a binary or shared library.
+ *
+ * @param {string} absPath absolute path
+ * @param {string|undefined} rootDir extracted root, when the file came from one
+ * @returns {{version: string, source: string}|undefined} source is `binary`
+ *   or `php_version.h`
+ */
+export declare function readPhpBuildVersion(absPath: string, rootDir: string | undefined): {
+    version: string;
+    source: string;
+} | undefined;
+/**
+ * The CPE that lets a downstream scanner match a PHP version. NVD puts a
+ * pre-release suffix in the update field, e.g.
+ * cpe:2.3:a:php:php:8.5.0:rc1:*:*:*:*:*:* (NVD CPE dictionary).
+ *
+ * @param {string} version PHP version in the build-version grammar
+ * @returns {string} CPE 2.3 string
+ */
+export declare function phpCpe(version: string): string;
+/**
+ * A PHP runtime is one `platform` component per distinct version, like the Go
+ * stdlib component. Its identity is `pkg:generic/php`: it is only used where no
+ * package manager owns PHP, or where a PATH probe cannot tell which one does.
+ *
+ * @param {string} version PHP version in the build-version grammar, or as a
+ *   distro build reports it
+ * @param {Object} [options] options
+ * @param {boolean} [options.withCpe=true] false for a version with a distro
+ *   revision, which no upstream CPE describes
+ * @returns {Object} component with `purl`, `bom-ref` and, unless left out, `cpe`
+ */
+export declare function createPhpRuntimeComponent(version: string, { withCpe }?: {
+    withCpe?: boolean;
+}): Object;
+/**
+ * The bom-ref of the runtime component for a version.
+ *
+ * @param {string} version PHP version in the build-version grammar
+ * @returns {string} bom-ref, which is the runtime's purl
+ */
+export declare function phpRuntimeRef(version: string): string;
+/**
+ * The properties a PHP file component carries once its build version is known.
+ * They belong on unpackaged `file` components only: a package-owned PHP is
+ * identified by its package, and distro builds carry backported fixes under
+ * old version numbers, so the PHP-RCE audit rules that match these properties
+ * would raise false positives there.
+ *
+ * @param {{version: string, source: string}} build result of readPhpBuildVersion
+ * @param {string} sapi result of classifyPhpSapi
+ * @returns {{name: string, value: string}[]} properties to append
+ */
+export declare function phpBuildProperties(build: {
+    version: string;
+    source: string;
+}, sapi: string): {
+    name: string;
+    value: string;
+}[];
+/**
+ * Start collecting the runtime components and edges of one scan.
+ *
+ * @returns {{runtimeComponents: Object[], dependencies: Object[], runtimeRefs: Set<string>}}
+ */
+export declare function createPhpRuntimeInventory(): {
+    runtimeComponents: Object[];
+    dependencies: Object[];
+    runtimeRefs: Set<string>;
+};
+/**
+ * Tag a PHP file component with its build facts and link it to the runtime
+ * component of its version, creating that component on first use. Mutates the
+ * component in place, as the Go collector does.
+ *
+ * @param {{runtimeComponents: Object[], dependencies: Object[], runtimeRefs: Set<string>}} inventory
+ *   accumulator from createPhpRuntimeInventory
+ * @param {Object} component file component, with a `properties` array
+ * @param {{version: string, source: string}} build result of readPhpBuildVersion
+ * @param {string} sapi result of classifyPhpSapi
+ */
+export declare function attachPhpBuild(inventory: {
+    runtimeComponents: Object[];
+    dependencies: Object[];
+    runtimeRefs: Set<string>;
+}, component: Object, build: {
+    version: string;
+    source: string;
+}, sapi: string): void;
+//# sourceMappingURL=phpBuildInfo.d.ts.map

package/types/lib/inventory/phpBuildInfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"phpBuildInfo.d.ts","sourceRoot":"","sources":["../../../lib/inventory/phpBuildInfo.js"],"names":[],"mappings":"AA8CA;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAFjB,MAEsB,CAAC;AAUjC;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,GAHvB,MAAM,GAAC,SAAS,CAc5B;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAJjC,MAIiC,GAH/B;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAC,GAAC,SAAS,CAkBhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CAuB5B;AAoBD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,MAAM,GAAC,SAAS,CAa5B;AA6JD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EALhC,MAKgC,EAAE,OAAO,EAJzC,MAAM,GAAC,SAIkC,GAHvC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAwBvD;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,OAAO,EAHnB,MAGmB,GAFjB,MAAM,CAgBlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAPtC,MAOsC,EAAE,EAAE,OAAc,EAAE,AALlE,CAGA,EAFA;IAA0B,OAAO,AAAjC,CAEA,EAFQ,OAAO,CAEf;CAEuE,GAF7D,MAAM,CAWlB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,MAAM,CAIlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAJ7B;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAIH,EAAE,IAAI,EAHnC,MAGmC,GAFjC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAQ3C;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAF5B;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAC,CAI3F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAN7B;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAMjD,EAAE,SAAS,EAJxC,MAIwC,EAAE,KAAK,EAH/C;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAGe,EAAE,IAAI,EAFrD,MAEqD,QAe/D"}

package/types/lib/inventory/phpHostProbe.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Look for PHP no package manager owns, in the fixed directories of the host.
+ * Components come back only for the files nothing owns: a `file` component for
+ * each PHP binary or library with the cdx:php properties, one `platform`
+ * component per version with its CPE, and the edges between them.
+ *
+ * @param {Object} [options] probe options
+ * @param {string} [options.rootPath] directory the fixed directories hang off:
+ *   `/`, or the system drive on Windows. Tests point it at a built tree.
+ * @param {string} [options.platform] `linux`, `darwin` or `win32`
+ * @param {Object} [options.env] environment read for ProgramFiles, SystemDrive
+ *   and ChocolateyInstall, instead of the process's
+ * @param {{dpkgInfoDirectory?: string, apkInstalledFile?: string, rpmDatabaseDirectories?: string[]}} [options.packageDatabases]
+ *   where the package databases are, instead of under `rootPath`
+ * @param {function(string): (Object[]|undefined)} [options.executeOsQuery] runs
+ *   an osquery query; the rpm database is only asked through it
+ * @param {Object[]} [options.packageComponents] the packages the OS scan has
+ *   inventoried, from which Chocolatey's are known
+ * @param {number} [options.maxProbes] most candidate files to look at
+ * @returns {{components: Object[], dependencies: Object[]}}
+ */
+export declare function probeHostPhp(options?: {
+    rootPath?: string;
+    platform?: string;
+    env?: Object;
+    packageDatabases?: {
+        dpkgInfoDirectory?: string;
+        apkInstalledFile?: string;
+        rpmDatabaseDirectories?: string[];
+    };
+}): {
+    components: Object[];
+    dependencies: Object[];
+};
+//# sourceMappingURL=phpHostProbe.d.ts.map

package/types/lib/inventory/phpHostProbe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"phpHostProbe.d.ts","sourceRoot":"","sources":["../../../lib/inventory/phpHostProbe.js"],"names":[],"mappings":"AAmjBA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAAC,OAAO,AAfjC,CAQA,EAPA;IAAyB,QAAQ,AAAjC,CAEA,EAFQ,MAAM,CAEd;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;IAAyB,GAAG,AAA5B,CAEA,EAFQ,MAAM,CAEd;IAA6G,gBAAgB,AAA7H,CAEA,EAFQ;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;KAAC,CAElG;CAOsC,GAF5B;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CA0D1D"}

package/types/lib/inventory/rootfsCerts.d.ts

@@ -0,0 +1,27 @@
+export declare const ROOTFS_CERT_LIMITS: Readonly<{
+    maxFileBytes: number;
+    maxFiles: 20000;
+    maxEntries: 500000;
+    maxDepth: 12;
+}>;
+/**
+ * Pure-JS inventory of the certificate locations trustinspector's rootfs
+ * mode covers, plus Kubernetes TLS secrets and Android pins. Used when the
+ * plugin is not available. Produces components through the shared
+ * CertificateCollector, so bom-refs, names and deduplication match the other
+ * producers; locations are root-relative ("/etc/ssl/certs/x.crt").
+ *
+ * Every access stays inside the root: symlinks (files or directories) are
+ * skipped, only regular files are opened, and the walk is bounded by entry,
+ * file, size and depth limits.
+ *
+ * @param {string} rootDir extracted root filesystem
+ * @param {object} [limits] overrides for ROOTFS_CERT_LIMITS (tests)
+ * @returns {{components: object[], dependencies: object[], warnings: string[]}}
+ */
+export declare function collectRootfsCertificates(rootDir: string, limits?: object): {
+    components: object[];
+    dependencies: object[];
+    warnings: string[];
+};
+//# sourceMappingURL=rootfsCerts.d.ts.map

package/types/lib/inventory/rootfsCerts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rootfsCerts.d.ts","sourceRoot":"","sources":["../../../lib/inventory/rootfsCerts.js"],"names":[],"mappings":"AAqBA,eAAO,MAAM,kBAAkB;;;;;EAK7B,CAAC;AA0IH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAJtC,MAIsC,EAAE,MAAM,AAHtD,CACA,EADQ,MAGmD,GAFjD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAC,CA6N9E"}

package/types/lib/inventory/source.d.ts

@@ -15,10 +15,14 @@ export declare function isSafeGitRefName(refName: string | undefined): boolean;
  * @param {string[]} args git arguments
  * @param {Object} options command options
  * @param {string|undefined} options.cwd working directory
+ * @param {boolean|undefined} options.noRepository run outside any repository,
+ *   so the config of a repository in the working directory, such as url.*.insteadOf
+ *   or core.sshCommand, cannot change where a remote command connects
  * @returns {Object} spawn result
  */
 export declare function hardenedGitCommand(args: string[], options?: {
     cwd: string | undefined;
+    noRepository: boolean | undefined;
 }): Object;
 /**
  * Build CycloneDX release notes from git tags and commits.
@@ -55,6 +59,17 @@ export declare function isAllowedWinPath(p: string): boolean;
  * @returns {boolean} true if the path is present in the allowed paths. false otherwise.
  */
 export declare function isAllowedPath(p: string): boolean;
+/**
+ * Checks where the given path really points, after following symlinks, against
+ * where the allowed paths really point. Both sides are resolved, so an allowed
+ * directory that is itself reached through a link (such as /tmp on macOS) still
+ * matches, while a link inside an allowed directory that leads outside it does
+ * not.
+ *
+ * @param {string} p Path string to check
+ * @returns {boolean} true if the real path is inside a real allowed path
+ */
+export declare function isAllowedRealPath(p: string): boolean;
 /**
  * Determine if the path could be a package URL.
  *
@@ -76,6 +91,19 @@ export declare function maybeRemotePath(filePath: string): boolean;
  * @returns {Object|null} Error object if invalid, or null if valid
  */
 export declare function validateAndRejectGitSource(filePath: string): Object | null;
+/**
+ * Return the host a git client connects to for a remote, read the way git,
+ * libcurl and OpenSSH read it rather than the way new URL() does. git ends the
+ * authority of ssh:// and git:// URLs only at the first slash, percent-decodes
+ * it before splitting off the host, and reads a leading "[...]" as the host.
+ * OpenSSH takes the host after the last "@". So a "?" or "#" before the first
+ * slash, a second "@", brackets in the user name, or a percent sign in an
+ * ssh:// or git:// authority make the host ambiguous.
+ *
+ * @param {string} remote Git URL or SCP-like address
+ * @returns {string|undefined} lower-cased host, or undefined when it is ambiguous
+ */
+export declare function getGitRemoteHost(remote: string): string | undefined;
 /**
  * Clone a git repository into a temporary directory.
  *

package/types/lib/inventory/source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../lib/inventory/source.js"],"names":[],"mappings":"AAqCA,6FAA6F;AAC7F,eAAO,MAAM,4BAA4B,wIAC8F,CAAC;AAExI,6DAA6D;AAC7D,eAAO,MAAM,2BAA2B,UAWvC,CAAC;AAuBF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAAM,GAAC,SAGsB,GAF3B,OAAO,CAUnB;AAiBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAL5B,MAAM,EAKsB,EAAE,OAAO,GAH7C;IAAkC,GAAG,EAA7B,MAAM,GAAC,SAAS,CACxB;CAEkD,GAFxC,MAAM,CAuClB;AA+ED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAAM,GAAC,SAI+B,EAAE,OAAO,GAH/C,MAGoD,GAFlD,MAAM,GAAC,SAAS,CA6I5B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,CASlB;AAkBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,OAAO,CAWnB;AAkBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAHvB,MAGuB,GAFrB,OAAO,CA+BnB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAHpB,MAGoB,GAFlB,OAAO,CAyBnB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAHxC,MAGwC,GAFtC,MAAM,GAAC,IAAI,CAgEvB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAJrB,MAIqB,EAAE,MAAM,GAH7B,MAAM,GAAC,MAAM,EAAE,GAAC,IAGoB,GAFlC,MAAM,CAyDlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAAM,GAAC,SAGgC,GAFrC,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAJrC,MAIqC,EAAE,cAAc,EAHrD,MAAM,GAAC,SAG8C,GAFnD,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAJtC,MAIsC,EAAE,cAAc,EAHtD,MAAM,GAAC,SAG+C,GAFpD,MAAM,GAAC,SAAS,CAiF5B;AAkJD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAGkC,GAFhC;IAAC,MAAM,EAAC,MAAM,CAAC;IAAA,KAAK,EAAC,MAAM,CAAC;IAAA,OAAO,EAAC,MAAM,CAAA;CAAC,GAAC,IAAI,CA4D5D;AA6GD;;GAEG;AACH,wBAAgB,yBAAyB,SAExC;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,WAAW,EAJ5C,KAAK,CAAC,MAAM,CAIgC,GAF1C,OAAO,CAAC,IAAI,CAAC,CA6BzB;AAiDD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CA4MlI;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAF5B,MAE4B,QAkCtC"}
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../lib/inventory/source.js"],"names":[],"mappings":"AAqCA,6FAA6F;AAC7F,eAAO,MAAM,4BAA4B,wIAC8F,CAAC;AAExI,6DAA6D;AAC7D,eAAO,MAAM,2BAA2B,UAWvC,CAAC;AAuBF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAAM,GAAC,SAGsB,GAF3B,OAAO,CAUnB;AAiBD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAR5B,MAAM,EAQsB,EAAE,OAAO,GAN7C;IAAkC,GAAG,EAA7B,MAAM,GAAC,SAAS,CACxB;IAAmC,YAAY,EAAvC,OAAO,GAAC,SAAS,CAGzB;CAEkD,GAFxC,MAAM,CA6ClB;AA+ED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAAM,GAAC,SAI+B,EAAE,OAAO,GAH/C,MAGoD,GAFlD,MAAM,GAAC,SAAS,CAiJ5B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,CASlB;AAkBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,OAAO,CAWnB;AAkBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAHvB,MAGuB,GAFrB,OAAO,CA+BnB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAHpB,MAGoB,GAFlB,OAAO,CAyBnB;AA2BD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAHxB,MAGwB,GAFtB,OAAO,CAkBnB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAHxC,MAGwC,GAFtC,MAAM,GAAC,IAAI,CA2GvB;AAuBD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CAuD5B;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAJrB,MAIqB,EAAE,MAAM,GAH7B,MAAM,GAAC,MAAM,EAAE,GAAC,IAGoB,GAFlC,MAAM,CAgElB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAAM,GAAC,SAGgC,GAFrC,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAJrC,MAIqC,EAAE,cAAc,EAHrD,MAAM,GAAC,SAG8C,GAFnD,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAJtC,MAIsC,EAAE,cAAc,EAHtD,MAAM,GAAC,SAG+C,GAFpD,MAAM,GAAC,SAAS,CAiF5B;AAkJD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAGkC,GAFhC;IAAC,MAAM,EAAC,MAAM,CAAC;IAAA,KAAK,EAAC,MAAM,CAAC;IAAA,OAAO,EAAC,MAAM,CAAA;CAAC,GAAC,IAAI,CA4D5D;AA6GD;;GAEG;AACH,wBAAgB,yBAAyB,SAExC;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,WAAW,EAJ5C,KAAK,CAAC,MAAM,CAIgC,GAF1C,OAAO,CAAC,IAAI,CAAC,CA6BzB;AAiDD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CA4MlI;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAF5B,MAE4B,QAkCtC"}

package/types/lib/inventory/spdx.d.ts

@@ -66,6 +66,21 @@ export declare function findLicenseId(name: string): any;
  * @returns {string|undefined} SPDX license id or expression
  */
 export declare function licenseIdFromText(content: string): string | undefined;
+/**
+ * Identify every license a notice grants, in the order the notice grants
+ * them. A notice can grant several: one LICENSE file holding an MIT grant and
+ * an Apache-2.0 grant (gopkg.in/yaml.v3), or a choice of licenses followed by
+ * each full text (github.com/spdx/tools-golang). A license text quotes others
+ * (the GNU GPL names the GNU Lesser GPL, the MPL names the GNU licenses), so
+ * only phrases that a grant carries count: a GNU license is found by its title
+ * standing on a line of its own, the others by a sentence of their grant.
+ * A notice none of these phrases match falls back to {@link guessLicenseId}.
+ *
+ * @param {string} content License file contents
+ * @returns {string[]} SPDX license ids or expressions; empty when none is
+ *   recognized
+ */
+export declare function guessLicenseIds(content: string): string[];
 /**
  * Method to guess the spdx license id from license contents
  *

package/types/lib/inventory/spdx.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spdx.d.ts","sourceRoot":"","sources":["../../../lib/inventory/spdx.js"],"names":[],"mappings":"AAeA;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAFf,MAAM,EAIf,CAAC;AAMF;;;;;;IAMI;AACJ,wBAAgB,uBAAuB,CAAC,OAAO,EAJpC,MAIoC,GAHlC,OAAO,CA0BnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,OAAA,SA2BhD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,KAAA,qBAqG9B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,UAAU,QAAA,EAAE,GAAG,QAAA,GAFnC,MAAM,CAoDjB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,KAAA,EAAE,CAAC,KAAA,EAAE,cAAc,KAAA,QAoCpD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,eAAe,KAAA,EAAE,kBAAkB,KAAA;;SAUlE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAFvB,MAEuB,OAYjC;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,GAF5B,MAAM,GAAC,SAAS,CAyF5B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAF3B,MAE2B,OAcrC"}
+{"version":3,"file":"spdx.d.ts","sourceRoot":"","sources":["../../../lib/inventory/spdx.js"],"names":[],"mappings":"AAeA;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAFf,MAAM,EAIf,CAAC;AAMF;;;;;;IAMI;AACJ,wBAAgB,uBAAuB,CAAC,OAAO,EAJpC,MAIoC,GAHlC,OAAO,CA0BnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,OAAA,SA2BhD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,KAAA,qBAqG9B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,UAAU,QAAA,EAAE,GAAG,QAAA,GAFnC,MAAM,CAoDjB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,KAAA,EAAE,CAAC,KAAA,EAAE,cAAc,KAAA,QAoCpD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,eAAe,KAAA,EAAE,kBAAkB,KAAA;;SAUlE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAFvB,MAEuB,OAYjC;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,GAF5B,MAAM,GAAC,SAAS,CAyF5B;AAqDD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAJ5B,MAI4B,GAH1B,MAAM,EAAE,CAgFpB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAF3B,MAE2B,OAcrC"}

package/types/lib/inventory/traceRunner.d.ts

@@ -57,7 +57,7 @@ export declare function resolveSaferExecBinary(): string | undefined;
  * @param {boolean} [options.denyPersistenceWrites] - Deny writes to auto-execution and persistence locations
  * @param {boolean} [options.privateTmp] - Private tmpfs /tmp and /var/tmp (Linux)
  * @param {string} [options.protectHome] - Home isolation: read-only, tmpfs, or off (Linux)
- * @returns {Promise<{libPaths: string[], httpAccessEntries: Object[], egressEntries?: Object[], dryRunSummary?: Object}>} Collected libraries, HTTP URLs, proxy egress decisions, and the dry-run summary
+ * @returns {Promise<{libPaths: string[], httpAccessEntries: Object[], cryptoEntries?: Object[], cryptoComponents?: Object[], cryptoResult?: Object, egressEntries?: Object[], dryRunSummary?: Object}>} Collected libraries, HTTP URLs, crypto observations, proxy egress decisions, and the dry-run summary
  * @throws {Error} When the @cdxgen/safer-exec tracing runtime is not installed
  *   (for example after pruning it from a standalone payload), since the traced
  *   command could never run and the BOM would silently be empty
@@ -94,6 +94,9 @@ export declare function executeAndTrace(commandStr: string, workingDir?: string,
 }): Promise<{
     libPaths: string[];
     httpAccessEntries: Object[];
+    cryptoEntries?: Object[];
+    cryptoComponents?: Object[];
+    cryptoResult?: Object;
     egressEntries?: Object[];
     dryRunSummary?: Object;
 }>;

package/types/lib/inventory/traceRunner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"traceRunner.d.ts","sourceRoot":"","sources":["../../../lib/inventory/traceRunner.js"],"names":[],"mappings":"AAsBA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAFvB,OAAO,CAInB;AAKD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAHxB,MAGwB,GAFtB;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,CA6BzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAFzB,MAAM,GAAC,SAAS,CAsF5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAsB,eAAe,CAAC,UAAU,EApCrC,MAoCqC,EAAE,UAAU,AAnCzD,CACA,EADQ,MAmCiD,EAAE,OAAO,AAlClE,CA6BA,EA5BA;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;IAA0B,cAAc,AAAxC,CACA,EADQ,OAAO,CACf;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAAyB,MAAM,AAA/B,CACA,EADQ,MAAM,CACd;IAAyB,UAAU,AAAnC,CACA,EADQ,MAAM,CACd;IAA0B,iBAAiB,AAA3C,CACA,EADQ,OAAO,CACf;IAA0B,qBAAqB,AAA/C,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;CAKuE,GAL7D,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAC,CAAC,CAoWxH;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAH1B,MAG0B,GAFxB;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,GAAC,SAAS,CAAA;CAAC,CAazD;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAHhC,MAAM,EAG0B,GAF9B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,EAAE,CAkD9E;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,iBAAiB,EAHjD,MAAM,EAG2C;eAFlB,GAAG,CAAC,MAAM,CAAC;gBAAc,MAAM,EAAE;GA+C1E"}
+{"version":3,"file":"traceRunner.d.ts","sourceRoot":"","sources":["../../../lib/inventory/traceRunner.js"],"names":[],"mappings":"AAsBA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAFvB,OAAO,CAInB;AAKD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAHxB,MAGwB,GAFtB;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,CA6BzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAFzB,MAAM,GAAC,SAAS,CAsF5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAsB,eAAe,CAAC,UAAU,EApCrC,MAoCqC,EAAE,UAAU,AAnCzD,CACA,EADQ,MAmCiD,EAAE,OAAO,AAlClE,CA6BA,EA5BA;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;IAA0B,cAAc,AAAxC,CACA,EADQ,OAAO,CACf;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAAyB,MAAM,AAA/B,CACA,EADQ,MAAM,CACd;IAAyB,UAAU,AAAnC,CACA,EADQ,MAAM,CACd;IAA0B,iBAAiB,AAA3C,CACA,EADQ,OAAO,CACf;IAA0B,qBAAqB,AAA/C,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;CAKuE,GAL7D,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAC,CAAC,CAwWtM;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAH1B,MAG0B,GAFxB;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,GAAC,SAAS,CAAA;CAAC,CAazD;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAHhC,MAAM,EAG0B,GAF9B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,EAAE,CAkD9E;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,iBAAiB,EAHjD,MAAM,EAG2C;eAFlB,GAAG,CAAC,MAAM,CAAC;gBAAc,MAAM,EAAE;GA+C1E"}

package/types/lib/inventory/tracedCrypto.d.ts

@@ -28,6 +28,28 @@ export declare function suiteCipher(suiteName: string): {
  * @returns {Object[]} Normalized cryptographic-asset components
  */
 export declare function normalizeTracedCryptoComponents(cbomComponents: Object[]): Object[];
+/**
+ * Builds the shared certificate model for the chains servers presented in TLS
+ * ≤ 1.2 handshakes, from the `chain` arrays of safer-exec's crypto result
+ * (report channel, safer-exec ≥ 1.2.0; earlier releases and TLS 1.3 entries
+ * carry no chain and yield nothing). The records go through the shared
+ * certificate collector, so bom-refs, properties and dedup match certificates
+ * found on disk. A presented chain is untrusted server input: no issuer edges
+ * are inferred from it, and the certificate and public-key components link
+ * through the collector as every producer's do. Each TLS protocol component
+ * provides the certificates and keys presented under it — the edge safer-
+ * exec's own CBOM records — which answers which servers presented a key.
+ *
+ * @param {Object} cryptoResult safer-exec CRYPTO result (`result.crypto`)
+ * @param {Set<string>} protocolRefs bom-refs of the protocol components in the BOM;
+ *   a provides edge is only emitted for a protocol that is actually present
+ * @returns {{components: Object[], dependencies: Object[]}} certificate,
+ *   public-key and algorithm components, and the protocol provides edges
+ */
+export declare function observedChainComponents(cryptoResult: Object, protocolRefs?: Set<string>): {
+    components: Object[];
+    dependencies: Object[];
+};
 /**
  * Maps the crypto libraries safer-exec reported to the paths they were loaded
  * from.

package/types/lib/inventory/tracedCrypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tracedCrypto.d.ts","sourceRoot":"","sources":["../../../lib/inventory/tracedCrypto.js"],"names":[],"mappings":"AAqDA;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAH1B,MAG0B,GAFxB;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAC,SAAS,CAAA;CAAC,GAAC,SAAS,CAuB1E;AA+DD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,+BAA+B,CAAC,cAAc,EAHnD,MAAM,EAG6C,GAFjD,MAAM,EAAE,CA+GpB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAHxC,MAAM,EAGkC,GAFtC,GAAG,CAAC,MAAM,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CAgBxD"}
+{"version":3,"file":"tracedCrypto.d.ts","sourceRoot":"","sources":["../../../lib/inventory/tracedCrypto.js"],"names":[],"mappings":"AA0DA;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAH1B,MAG0B,GAFxB;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAC,SAAS,CAAA;CAAC,GAAC,SAAS,CAuB1E;AA+DD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,+BAA+B,CAAC,cAAc,EAHnD,MAAM,EAG6C,GAFjD,MAAM,EAAE,CA+GpB;AAqBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAPH,MAOG,EACZ,YAAY,GAPH,GAAG,CAAC,MAAM,CAOK,GALb;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAwF1D;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAHxC,MAAM,EAGkC,GAFtC,GAAG,CAAC,MAAM,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CAgBxD"}

package/types/lib/managers/binary.d.ts

@@ -115,6 +115,16 @@ export declare function dropRedundantSourceComponents(pkgList: any[]): any[];
  * @returns {Object} Metadata containing packages, dependencies, etc
  */
 export declare function getOSPackages(src: string, imageConfig: Object, options?: {}): Object;
+/**
+ * Split a `Name <address>` maintainer string into an `organizationalContact`.
+ *
+ * @param {string} value Maintainer or supplier string
+ * @returns {{name: string, email?: string}|undefined} The contact, if any
+ */
+export declare function parseOrganizationalContact(value: string): {
+    name: string;
+    email?: string;
+} | undefined;
 /**
  * Collect the dependency edges trivy recorded for one OS package component.
  *

package/types/lib/managers/binary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"binary.d.ts","sourceRoot":"","sources":["../../../lib/managers/binary.js"],"names":[],"mappings":"AA+YA;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,AAH9C,CACA,EADQ,MAAM,EAGqC,GAFzC,MAAM,EAAE,CAgBpB;AA4FD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,GAH5B,MAAM,GAAC,SAAS,CAmB5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EALtB,MAKsB,UA+BpC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,OAAA,EAAE,GAAG,EAJ9B,MAI8B,GAFhC,SAAS,GAAC,MAAM,CAmC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EARK,MAQL,EACJ,OAAO,EARE,MAQF,EACP,IAAI,EARK,MAQL,EACJ,KAAK,EARI,MAQJ,EACL,QAAQ,AARP,CACA,EADQ,MAQD,GAPG,MAAM,CAgDlB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAJ/B,MAI+B,EAAE,QAAQ,AAHjD,CACA,EADQ,MAGyC,GAFvC,MAAM,CA6BlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,OAAA,SAoBpD;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,GAAG,QAAA,EAAE,WAAW,EAL7B,MAK6B,EAAE,OAAO,KAAK,GAFrD,MAAM,CAinBlB;AA4lDD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,0DAJtB,MAAM,QACN,MAAM,KACJ;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAsD/C,CAAC;AAyHF;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,AALvD,CACA,EADQ,MAAM,EAK8C,GAJlD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAC,CAmEnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EALzB,MAKyB,GAJvB,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAJxB,MAIwB,EAAE,UAAU,EAHpC,MAGoC,WA6C9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EANrB,MAMqB,EAAE,aAAa,EALpC,MAKoC,EAAE,QAAQ,EAJ9C,OAI8C,GAF7C,OAAO,CAiClB"}
+{"version":3,"file":"binary.d.ts","sourceRoot":"","sources":["../../../lib/managers/binary.js"],"names":[],"mappings":"AA2aA;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,AAH9C,CACA,EADQ,MAAM,EAGqC,GAFzC,MAAM,EAAE,CAgBpB;AA4FD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,GAH5B,MAAM,GAAC,SAAS,CAmB5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EALtB,MAKsB,UA+BpC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,OAAA,EAAE,GAAG,EAJ9B,MAI8B,GAFhC,SAAS,GAAC,MAAM,CAmC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EARK,MAQL,EACJ,OAAO,EARE,MAQF,EACP,IAAI,EARK,MAQL,EACJ,KAAK,EARI,MAQJ,EACL,QAAQ,AARP,CACA,EADQ,MAQD,GAPG,MAAM,CA4ElB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAJ/B,MAI+B,EAAE,QAAQ,AAHjD,CACA,EADQ,MAGyC,GAFvC,MAAM,CA6BlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,OAAA,SAoBpD;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,GAAG,QAAA,EAAE,WAAW,EAL7B,MAK6B,EAAE,OAAO,KAAK,GAFrD,MAAM,CAymBlB;AA6HD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAHrC,MAGqC,GAFnC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAgBpD;AAqlDD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,0DAJtB,MAAM,QACN,MAAM,KACJ;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAsD/C,CAAC;AAyHF;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,AALvD,CACA,EADQ,MAAM,EAK8C,GAJlD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAC,CA8FnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EALzB,MAKyB,GAJvB,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAJxB,MAIwB,EAAE,UAAU,EAHpC,MAGoC,WA6C9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EANrB,MAMqB,EAAE,aAAa,EALpC,MAKoC,EAAE,QAAQ,EAJ9C,OAI8C,GAF7C,OAAO,CAiClB"}

package/types/lib/managers/docker.d.ts

@@ -74,6 +74,18 @@ export declare const makeRequest: (path: string, method: string, forRegistry?: s
  * @returns {boolean} true when the string is a plausible image reference
  */
 export declare const isImageReference: (fullImageName: string) => boolean;
+/**
+ * Whether an image named in a scanned manifest, such as a docker-compose file
+ * or a Kubernetes spec, may be pulled and inventoried. The name comes from the
+ * scanned project, so a local archive path would read files outside the
+ * allowed paths and a registry outside CDXGEN_ALLOWED_HOSTS would bypass the
+ * host allowlist.
+ *
+ * @param {string} fullImageName Image name from the manifest
+ * @param {Object} [imageObj] Result of parseImageName for the same name
+ * @returns {boolean} true when the image may be followed
+ */
+export declare const isFollowableManifestImage: (fullImageName: string, imageObj?: Object) => boolean;
 /**
  * Parse image name
  *

package/types/lib/managers/docker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../lib/managers/docker.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA+CrC,yDAAyD;AACzD,eAAO,MAAM,KAAK,SAA0B,CAAC;AAC7C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAEoC,CAAC;AAkS/C;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,SAHnB,MAAM,KACJ,MAiBZ,CAAC;AAEF;;GAEG;AACH,wBAAgB,YAAY,QAoB3B;AAED;;GAEG;AACH,wBAAgB,oBAAoB,QA2CnC;AAyTD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,aANf,MAAM,gBAEN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,SAAS,CA6HpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,SANb,MAAM,UACN,MAAM,gBACN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,MAAM,GAAC,SAAS,CAgC3C,CAAC;AA8CF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,gBAAgB,kBAHlB,MAAM,KACJ,OAsEZ,CAAC;AAgBF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;;;;;;CA2E1B,CAAC;AAyFF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,QAFlB,MAgCZ,CAAC;AAkBF;;GAEG;AACH,eAAO,MAAM,QAAQ,sCA6MpB,CAAC;AAkBC,YAA4B,gBAAgB,GAAlC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAkB;AAiH/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,kBANZ,MAAM,OACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,OAAO,CAqF3B,CAAC;AAiGF;;;GAGG;AACH,eAAO,MAAM,aAAa,mEAqGzB,CAAC;AAmDF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,iBATrB,MAAM,aACN,MAAM,WACN,MAAM,wBACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,MAAM,CAuK1B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,oDAyJvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,iDAkJ1B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,kBALb,MAAM,UACN,OAAO,KACL,OAAO,CAAC,MAAM,GAAC,SAAS,CAKpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,cALpB,MAAM,iBACN,MAAM,KACJ,MAAM,GAAC,SA2CnB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,qBAHpB,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,cACnC,KAAK,CAAC,MAAM,CAAC,SA4BvB,CAAC"}
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../lib/managers/docker.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAgDrC,yDAAyD;AACzD,eAAO,MAAM,KAAK,SAA0B,CAAC;AAC7C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAEoC,CAAC;AAkS/C;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,SAHnB,MAAM,KACJ,MAiBZ,CAAC;AAEF;;GAEG;AACH,wBAAgB,YAAY,QAoB3B;AAED;;GAEG;AACH,wBAAgB,oBAAoB,QA2CnC;AAyTD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,aANf,MAAM,gBAEN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,SAAS,CA6HpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,SANb,MAAM,UACN,MAAM,gBACN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,MAAM,GAAC,SAAS,CAgC3C,CAAC;AA8CF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,gBAAgB,kBAHlB,MAAM,KACJ,OAsEZ,CAAC;AAgBF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,kBAJ3B,MAAM,aACN,MAAM,KACJ,OAmBZ,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;;;;;;CA2E1B,CAAC;AAyFF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,QAFlB,MAgCZ,CAAC;AAkBF;;GAEG;AACH,eAAO,MAAM,QAAQ,sCA6MpB,CAAC;AAkBC,YAA4B,gBAAgB,GAAlC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAkB;AAmH/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,kBANZ,MAAM,OACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,OAAO,CAqF3B,CAAC;AAiGF;;;GAGG;AACH,eAAO,MAAM,aAAa,mEAqGzB,CAAC;AA2KF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,iBATrB,MAAM,aACN,MAAM,WACN,MAAM,wBACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,MAAM,CAwK1B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,oDAyJvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,iDAkJ1B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,kBALb,MAAM,UACN,OAAO,KACL,OAAO,CAAC,MAAM,GAAC,SAAS,CAKpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,cALpB,MAAM,iBACN,MAAM,KACJ,MAAM,GAAC,SA2CnB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,qBAHpB,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,cACnC,KAAK,CAAC,MAAM,CAAC,SA4BvB,CAAC"}

package/types/lib/parsers/email.d.ts

@@ -0,0 +1,19 @@
+/**
+ * An internationalized hostname: mapped to its A-label form with UTS #46
+ * processing, held to the ASCII hostname rules, and every A-label decoded
+ * back and checked for the characters IDNA allows.
+ *
+ * @param {string} hostname Hostname, possibly holding non-ASCII labels
+ * @returns {boolean} Whether it is a valid IDN hostname
+ */
+export declare const isValidIdnHostname: (hostname: string) => boolean;
+/**
+ * Whether a value is a valid RFC 6531 email address (`idn-email`): a dot-atom
+ * or quoted local part, where non-ASCII characters are allowed, then `@` and
+ * an internationalized hostname or a bracketed IPv4/IPv6 literal.
+ *
+ * @param {string} value Candidate email address
+ * @returns {boolean} true when the value is a valid address
+ */
+export declare const isValidIdnEmail: (value: string) => boolean;
+//# sourceMappingURL=email.d.ts.map

package/types/lib/parsers/email.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../../lib/parsers/email.js"],"names":[],"mappings":"AA8LA;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,aAHpB,MAAM,KACJ,OAyCZ,CAAC;AAkBF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,UAHjB,MAAM,KACJ,OAeZ,CAAC"}

package/types/lib/parsers/largeJson.d.ts

@@ -17,6 +17,19 @@ export declare function indexJsonObject(filePath: string, options?: Object): Map
     start: number;
     end: number;
 }>;
+/**
+ * Decode one member of the top-level object in a JSON file, reading the file
+ * only up to the end of that member. A member near the start of a large file
+ * costs a few bounded reads, however large the rest of the file is; the rest
+ * is not checked for well-formedness.
+ *
+ * @param {string} filePath JSON file whose top-level value is an object
+ * @param {string} name Member to decode
+ * @param {Object} [options] Batch and chunk size overrides, for tests
+ * @returns {*} The decoded value, or undefined when the object has no such member
+ * @throws {SyntaxError} When the object is malformed before the member ends
+ */
+export declare function readJsonMember(filePath: string, name: string, options?: Object): any;
 /**
  * Decode the JSON value stored in a byte range of a file, without ever holding
  * more than a bounded run of it in one string.