@cdxgen/cdxgen 13.4.0 → 13.6.0

package/types/lib/cli/cliOptions.d.ts

@@ -37,6 +37,49 @@ export declare function validateSpecVersion(specVersion: number, commandName?: s
  * @returns {boolean}  True when the user explicitly set this flag
  */
 export declare function isUserProvided(value: any, yaDefault: any): boolean;
+/**
+ * The value the operator gave an option on the command line or through its
+ * CDXGEN_* environment variable. yargs also fills options in from defaults
+ * and from a config file, which cannot be told apart in its output.
+ *
+ * @param {string} option kebab-case option name
+ * @param {object} [context]
+ * @param {string[]} [context.argv] Raw command-line arguments
+ * @param {object} [context.env] Environment variables
+ * @param {boolean} [context.boolean] Read the option as a boolean flag
+ * @returns {string|boolean|undefined} The operator's value, or undefined
+ */
+export declare function operatorOptionChoice(option: string, { argv, env, boolean }?: {
+    argv?: string[];
+    env?: object;
+    boolean?: boolean;
+}): string | boolean | undefined;
+/**
+ * Make the operator's choice about running the scanned project's own code
+ * final. A config file is read from the working directory, which is usually
+ * the scanned project, so it carries that project's trust. Neither the config
+ * file nor a profile or lifecycle may turn installs on when the operator
+ * disabled them, and secure mode keeps installs off unless the operator
+ * passes --install-deps. Introspection keeps the project's build tools
+ * running with installs off, which is likewise the operator's decision, so
+ * introspection asked for only by the config file does not do that.
+ *
+ * **Mutates `options` in place.**
+ *
+ * @param {object} options The options object, after applyAdvancedOptions
+ * @param {object} [context]
+ * @param {object} [context.projectConfig] Sanitized config file contents
+ * @param {boolean} [context.isSecureMode] Whether cdxgen runs in secure mode
+ * @param {string[]} [context.argv] Raw command-line arguments
+ * @param {object} [context.env] Environment variables
+ * @returns {void}
+ */
+export declare function applyOperatorToolingChoice(options: object, context?: {
+    projectConfig?: object;
+    isSecureMode?: boolean;
+    argv?: string[];
+    env?: object;
+}): void;
 /**
  * Combine the custom metadata properties of every source (discussion 4391):
  * the `--metadata-property` flag, the CDXGEN_METADATA_PROPERTY and

package/types/lib/cli/cliOptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cliOptions.d.ts","sourceRoot":"","sources":["../../../lib/cli/cliOptions.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAwBH;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAJpC,MAIoC,EAAE,WAAW,AAHzD,CACA,EADQ,MAG4D,GAF1D,MAAM,GAAC,IAAI,CAoBvB;AA4CD;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAJzB,GAIyB,EAAE,SAAS,EAHpC,GAGoC,GAFlC,OAAO,CAInB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EATK,MASL,EACJ,EAAE,IAAmB,EAAE,aAAa,EAAE,AATrC,CAKA,EAJA;IAA2B,IAAI,AAA/B,CAEA,EAFQ,MAAM,EAAE,CAEhB;IAAyB,aAAa,AAAtC,CAEA,EAFQ,MAAM,CAEd;CAI0C,GAJhC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAsD3C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,kBAAkB,EAHtD,MAGsD,GAFpD,MAAM,CAoBlB;AAuED,wBAAgB,mBAAmB,CACjC,IAAI,KAAA,EACJ,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAmB,EAAE,aAAa,EAAE;;;;;CAAA,OAqDjE;AAqBE,YAAkB,cAAc,GAChC;;;;IAAkC,KAAK,EAA5B,MAAM,GAAC,MAAM,GAAC,OAAO,CAChC;;;;IAAkC,OAAO,EAA9B,MAAM,CACnB;CAAA,CAAA;AAJD;;;;GAIG;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAR3C,MAQ2C,EAAE,OAAO,EAN5D;IAAwB,kBAAkB,EAAlC,MAAM,CACd;IAAyB,kBAAkB,EAAnC,OAAO,CAEf;IAA0B,QAAQ,AAAlC,CACA,EADQ,OAAO,CACf;CAE4D,GAFlD,cAAc,EAAE,CA6G5B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EALjC,MAKiC,EAAE,OAAO,AAJlD,CAEA,EADA;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;CAEuD,GAF7C,cAAc,EAAE,CAqI5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAd9B,MAc8B,EAAE,OAAO,EAZ/C;IAAwB,kBAAkB,EAAlC,MAAM,CACd;IAAwB,QAAQ,EAAxB,MAAM,CACd;IAAyB,cAAc,EAA/B,OAAO,CACf;IAAyB,kBAAkB,EAAnC,OAAO,CAEf;IAA0B,QAAQ,AAAlC,CACA,EADQ,OAAO,CACf;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;IAAyB,aAAa,AAAtC,CAGA,EAHQ,MAAM,CAGd;CAE+C,GAFrC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;CAAE,CA+B3D"}
+{"version":3,"file":"cliOptions.d.ts","sourceRoot":"","sources":["../../../lib/cli/cliOptions.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAyBH;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAJpC,MAIoC,EAAE,WAAW,AAHzD,CACA,EADQ,MAG4D,GAF1D,MAAM,GAAC,IAAI,CAoBvB;AA4CD;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAJzB,GAIyB,EAAE,SAAS,EAHpC,GAGoC,GAFlC,OAAO,CAInB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EARG,MAQH,EACN,EAAE,IAA4B,EAAE,GAAiB,EAAE,OAAe,EAAE,AARnE,CAIA,EAHA;IAA2B,IAAI,AAA/B,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,GAAG,AAA5B,CACA,EADQ,MAAM,CACd;IAA0B,OAAO,AAAjC,CACA,EADQ,OAAO,CACf;CAIwE,GAJ9D,MAAM,GAAC,OAAO,GAAC,SAAS,CA4CpC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EARvC,MAQuC,EAAE,OAAO,AAPxD,CAKA,EAJA;IAAyB,aAAa,AAAtC,CACA,EADQ,MAAM,CACd;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;IAA2B,IAAI,AAA/B,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,GAAG,AAA5B,CACA,EADQ,MAAM,CACd;CAE6D,GAFnD,IAAI,CAwBhB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EATK,MASL,EACJ,EAAE,IAAmB,EAAE,aAAa,EAAE,AATrC,CAKA,EAJA;IAA2B,IAAI,AAA/B,CAEA,EAFQ,MAAM,EAAE,CAEhB;IAAyB,aAAa,AAAtC,CAEA,EAFQ,MAAM,CAEd;CAI0C,GAJhC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAsD3C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,kBAAkB,EAHtD,MAGsD,GAFpD,MAAM,CAoBlB;AAuED,wBAAgB,mBAAmB,CACjC,IAAI,KAAA,EACJ,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAmB,EAAE,aAAa,EAAE;;;;;CAAA,OAqDjE;AAqBE,YAAkB,cAAc,GAChC;;;;IAAkC,KAAK,EAA5B,MAAM,GAAC,MAAM,GAAC,OAAO,CAChC;;;;IAAkC,OAAO,EAA9B,MAAM,CACnB;CAAA,CAAA;AAJD;;;;GAIG;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAR3C,MAQ2C,EAAE,OAAO,EAN5D;IAAwB,kBAAkB,EAAlC,MAAM,CACd;IAAyB,kBAAkB,EAAnC,OAAO,CAEf;IAA0B,QAAQ,AAAlC,CACA,EADQ,OAAO,CACf;CAE4D,GAFlD,cAAc,EAAE,CA6G5B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EALjC,MAKiC,EAAE,OAAO,AAJlD,CAEA,EADA;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;CAEuD,GAF7C,cAAc,EAAE,CA2I5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAd9B,MAc8B,EAAE,OAAO,EAZ/C;IAAwB,kBAAkB,EAAlC,MAAM,CACd;IAAwB,QAAQ,EAAxB,MAAM,CACd;IAAyB,cAAc,EAA/B,OAAO,CACf;IAAyB,kBAAkB,EAAnC,OAAO,CAEf;IAA0B,QAAQ,AAAlC,CACA,EADQ,OAAO,CACf;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;IAAyB,aAAa,AAAtC,CAGA,EAHQ,MAAM,CAGd;CAE+C,GAFrC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;CAAE,CA+B3D"}

package/types/lib/cli/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/cli/index.js"],"names":[],"mappings":"AA2EA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAwCnE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,aAAa,EACb,wBAAwB,EACxB,eAAe,EACf,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA0C1D,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,eAAe,EACf,UAAU,EACV,aAAa,EACb,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,YAAY,EACZ,eAAe,EACf,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,aAAa,EACb,cAAc,EACd,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AA8BxB;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,OAAO,CAAC,MAAM,CAAC,CAwE3B;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,OAAO,EAHnD,MAGmD,GAFjD,OAAO,CAAC,MAAM,CAAC,CAkU3B;AAgCD;;;;;;GAMG;AACH;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAGF,GAF1B,MAAM,CAUlB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAAM,EAG4B,GAFhC,MAAM,CAalB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EALnC,MAAM,GAAC,MAAM,EAKsB,EAAE,OAAO,EAJ5C,MAI4C,GAH1C,OAAO,CAAC,MAAM,CAAC,CAkqC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CAoF3B;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAsgBrC;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,CAAC,CAsB3B;AAED;;;;;;GAMG;AACH;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,OAAO,CAAC,MAAM,CAAC,CAa3B;AAgYD;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,IAAI,EALzB,MAKyB,EAAE,WAAW,EAJtC,MAIsC,GAHrC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CA+FjD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/cli/index.js"],"names":[],"mappings":"AAuFA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AA8CnE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,aAAa,EACb,wBAAwB,EACxB,eAAe,EACf,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA0C1D,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,eAAe,EACf,UAAU,EACV,aAAa,EACb,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,YAAY,EACZ,eAAe,EACf,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,aAAa,EACb,cAAc,EACd,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AA8BxB;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA4I3B;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,OAAO,EAHnD,MAGmD,GAFjD,OAAO,CAAC,MAAM,CAAC,CAqU3B;AAgCD;;;;;;GAMG;AACH;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAGF,GAF1B,MAAM,CAUlB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAAM,EAG4B,GAFhC,MAAM,CAalB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EALnC,MAAM,GAAC,MAAM,EAKsB,EAAE,OAAO,EAJ5C,MAI4C,GAH1C,OAAO,CAAC,MAAM,CAAC,CAstC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CAsF3B;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAsgBrC;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,CAAC,CAsB3B;AAED;;;;;;GAMG;AACH;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,OAAO,CAAC,MAAM,CAAC,CAa3B;AAgYD;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,IAAI,EALzB,MAKyB,EAAE,WAAW,EAJtC,MAIsC,GAHrC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CA+FjD"}

package/types/lib/cli/jsBom.d.ts

@@ -1,20 +1,4 @@
-/**
- * Detects an exact AI inventory type from a direct HuggingFace reference or a
- * local Modelfile/`.gguf` file input. Returns the explicit selection from
- * `getExactAiInventoryType` when one is present.
- *
- * Direct HuggingFace interpretation of the source path is opt-in: only
- * unambiguous references (`pkg:huggingface/...` purls and huggingface.co
- * URLs) are recognized on their own. Bare `owner/repo`-shaped values are
- * ordinary relative paths (eg: `repotests/sveltejs-realworld`) unless an AI
- * inventory type such as `-t ai` is explicitly selected, in which case
- * `getExactAiInventoryType` already returned it above.
- *
- * @param {string} path Project or file path
- * @param {object} options CLI options
- * @returns {string|undefined} The detected AI inventory type (`"ai"`) or undefined
- */
-export declare function getDirectAiInventoryType(path: string, options: object): string | undefined;
+export declare function getDirectAiInventoryType(path: any, options: any): string | undefined;
 /**
  * Main Node.js/npm BOM generator. Parses manifests, lockfiles, and import
  * evidence to assemble components, dependencies, formulation data, AI inventory,

package/types/lib/cli/jsBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jsBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jsBom.js"],"names":[],"mappings":"AAiHA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAwB5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAq3C3B;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAE4C,CAAC;AAEvD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,YAJ9B,KAAK,CAAC,MAAM,CAAC,cACb,MAAM,KACJ,KAAK,CAAC,MAAM,CAwExB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAmD3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CA+F3B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EANhC,MAMgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CA6B3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAoN3B;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CAoD3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CA2ChE;AAED;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CACjD,aAAa,EANJ,MAMI,EACb,OAAO,EANE,MAMF,EACP,OAAO,EANE,MAAM,EAMR,EACP,YAAY,EANH,MAAM,EAMH,iBAsBb"}
+{"version":3,"file":"jsBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jsBom.js"],"names":[],"mappings":"AAyIA,wBAAgB,wBAAwB,CAAC,IAAI,KAAA,EAAE,OAAO,KAAA,sBAsBrD;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAs5C3B;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAE4C,CAAC;AAEvD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,YAJ9B,KAAK,CAAC,MAAM,CAAC,cACb,MAAM,KACJ,KAAK,CAAC,MAAM,CAwExB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAmD3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CA+F3B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EANhC,MAMgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CA6B3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAoN3B;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CAoD3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CA2ChE;AAED;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CACjD,aAAa,EANJ,MAMI,EACb,OAAO,EANE,MAMF,EACP,OAAO,EANE,MAAM,EAMR,EACP,YAAY,EANH,MAAM,EAMH,iBAsBb"}

package/types/lib/cli/jvmBom.d.ts

@@ -66,6 +66,26 @@ export declare function createJarBom(path: string, options: Object): Object;
  * @returns {string[]} List of sbt project ids
  */
 export declare function discoverSbtProjectsFromCmd(basePath: string, sbtCmd: string, env: Object, launcherArgs?: string[]): string[];
+/**
+ * Read one pom.xml without running Maven: the module it declares and its
+ * direct dependencies. Versions resolve from the pom's properties and
+ * dependencyManagement and from parent poms inside the scanned directory.
+ * Versions that an imported BOM or a parent outside the directory manages
+ * stay empty, and transitive dependencies are unknown.
+ *
+ * No dependency edges are produced. The build-fidelity rules (BF-JVM-001,
+ * BF-GEN-001) recognise a pom read without Maven by its missing graph, and a
+ * graph of direct edges alone would pass for a resolved one.
+ *
+ * @param {string} pomFile pom.xml to read
+ * @param {string} rootPath Scanned directory
+ * @param {Map} [cache] Parent pom results shared by the poms of one scan
+ * @returns {{moduleComponent: Object|undefined, pkgList: Object[]}}
+ */
+export declare function readMavenModuleStatically(pomFile: string, rootPath: string, cache?: Map<any, any>): {
+    moduleComponent: Object | undefined;
+    pkgList: Object[];
+};
 /**
  * Function to create bom string for Java projects
  *

package/types/lib/cli/jvmBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jvmBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jvmBom.js"],"names":[],"mappings":"AA0HA;;;;;GAKG;AACH,eAAO,IAAI,gBAAgB,EAFjB,MAIsD,CAAC;AAUjE;;;;GAIG;AAEH,eAAO,MAAM,kBAAkB,EAHrB,MAQT,CAAC;AAEF;;;;;GAKG;AAEH,eAAO,MAAM,aAAa,EAHhB,MAIqE,CAAC;AAuDhF;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAL3C,MAAM,EAKqC,EAAE,KAAK,AAJ1D,CAEA,EAFQ,MAIuD,GAFrD,OAAO,CAAC,MAAM,CAAC,CA2B3B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,eAAe,EAHrC,MAGqC,GAFnC,GAAG,CAAC,MAAM,CAAC,CAwBvB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAL5B,MAK4B,EAAE,OAAO,EAJrC,MAIqC,GAFnC,MAAM,CAmFlB;AAiCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAPC,MAOD,EACR,MAAM,EAPG,MAOH,EACN,GAAG,EAPM,MAON,EACH,YAAY,AAPX,CACA,EADQ,MAAM,EAOE,GANN,MAAM,EAAE,CAwEpB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAqkE3B"}
+{"version":3,"file":"jvmBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jvmBom.js"],"names":[],"mappings":"AAuIA;;;;;GAKG;AACH,eAAO,IAAI,gBAAgB,EAFjB,MAIsD,CAAC;AAUjE;;;;GAIG;AAEH,eAAO,MAAM,kBAAkB,EAHrB,MAQT,CAAC;AAEF;;;;;GAKG;AAEH,eAAO,MAAM,aAAa,EAHhB,MAIqE,CAAC;AAuDhF;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAL3C,MAAM,EAKqC,EAAE,KAAK,AAJ1D,CAEA,EAFQ,MAIuD,GAFrD,OAAO,CAAC,MAAM,CAAC,CA2B3B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,eAAe,EAHrC,MAGqC,GAFnC,GAAG,CAAC,MAAM,CAAC,CAwBvB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAL5B,MAK4B,EAAE,OAAO,EAJrC,MAIqC,GAFnC,MAAM,CAmFlB;AAiCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAPC,MAOD,EACR,MAAM,EAPG,MAOH,EACN,GAAG,EAPM,MAON,EACH,YAAY,AAPX,CACA,EADQ,MAAM,EAOE,GANN,MAAM,EAAE,CAwEpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EALtC,MAKsC,EAAE,QAAQ,EAJhD,MAIgD,EAAE,KAAK,AAH/D,CACA,eAE+D,GAFrD;IAAC,eAAe,EAAE,MAAM,GAAC,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAC,CAyClE;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAwqE3B"}

package/types/lib/cli/managedBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"managedBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/managedBom.js"],"names":[],"mappings":"AAwIA;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,QAJ5B,MAAM,YACN,MAAM,KACJ,OAMZ,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAJ1B,MAAM,YACN,MAAM,KACJ,OAeZ,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,QAAA,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,GAAG,IAAI,CAsEzB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CA+rB3B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CAyBlB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CA2C3B;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CA0BlB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CA+LlB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAuU3B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAylBrC;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAJpC,MAIoC,EAAE,OAAO,EAH7C,MAG6C,GAF3C,OAAO,CAAC,MAAM,CAAC,CAmF3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAJpB,MAIoB,EAAE,OAAO,EAH7B,MAG6B,GAF3B,MAAM,CA2DlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CAmClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC,OAAO,CAAC,MAAM,CAAC,CA6B3B"}
+{"version":3,"file":"managedBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/managedBom.js"],"names":[],"mappings":"AAgLA;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,QAJ5B,MAAM,YACN,MAAM,KACJ,OAMZ,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAJ1B,MAAM,YACN,MAAM,KACJ,OAeZ,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,QAAA,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,GAAG,IAAI,CAyEzB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAitB3B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CAyBlB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CA2C3B;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CA0BlB;AAwBD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CAmOlB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAoc3B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAktBrC;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAJpC,MAIoC,EAAE,OAAO,EAH7C,MAG6C,GAF3C,OAAO,CAAC,MAAM,CAAC,CAyQ3B;AA6ND;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAJpB,MAIoB,EAAE,OAAO,EAH7B,MAG6B,GAF3B,MAAM,CA2DlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CAmClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC,OAAO,CAAC,MAAM,CAAC,CA6B3B"}

package/types/lib/cli/nativeBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nativeBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/nativeBom.js"],"names":[],"mappings":"AAwLA;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,GAAC,SAAS,CAU5B;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAoevC;AA2PD,wBAAsB,aAAa,CAAC,IAAI,KAAA,EAAE,OAAO,KAAA,+BAyLhD;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,GAAC,SAAS,CAiC5B;AAED;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAAC,SAAS,EAJ9C,MAI8C,EAAE,SAAS,AAHjE,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAyDrC;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAJnC,MAImC,EAAE,OAAO,EAH5C,MAG4C,GAF1C,OAAO,CAAC,MAAM,CAAC,CAwB3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CA0E3B;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CA4elB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CAmJlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,MAAM,EAAE,CA0BpB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CAiElB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CAiClB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA+N3B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuLvC;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CAkI3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA4D3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwD3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAsE3B;AAqBD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAyB3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA4B3B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CAoE3B;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CAuC3B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA0C3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA2D3B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwD3B"}
+{"version":3,"file":"nativeBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/nativeBom.js"],"names":[],"mappings":"AAuMA;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,GAAC,SAAS,CAU5B;AA0BD;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAygBvC;AAuQD,wBAAsB,aAAa,CAAC,IAAI,KAAA,EAAE,OAAO,KAAA,+BA2MhD;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,GAAC,SAAS,CAiC5B;AAED;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAAC,SAAS,EAJ9C,MAI8C,EAAE,SAAS,AAHjE,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAyDrC;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAJnC,MAImC,EAAE,OAAO,EAH5C,MAG4C,GAF1C,OAAO,CAAC,MAAM,CAAC,CAwB3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CA0E3B;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CAmgBlB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CAgLlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,MAAM,EAAE,CA0BpB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CAiElB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CAiClB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA+P3B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAmOvC;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CAkI3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA4D3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwD3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAsE3B;AAqBD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAyB3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA4B3B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CAoE3B;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CAuC3B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA0C3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA2D3B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwD3B"}

package/types/lib/core/boundedFile.d.ts

@@ -0,0 +1,70 @@
+/**
+ * The largest file scanFileMarkers reads. Larger files are skipped whole
+ * rather than read in part, so a marker past the cap is never mistaken for an
+ * absent one; the result says the file was skipped.
+ *
+ * @type {number}
+ */
+export declare const MAX_MARKER_SCAN_BYTES: number;
+/**
+ * Open a path only when it is a regular file that does not resolve outside
+ * rootDir. lstat runs first so a FIFO is rejected without opening it (an open
+ * on a FIFO blocks until a writer appears) and a symlink is never followed.
+ *
+ * @param {string} absPath absolute path
+ * @param {string|undefined} rootDir extracted root the path must stay under
+ * @returns {{fd: number, size: number}|undefined} an open descriptor the
+ *   caller closes, or undefined
+ */
+export declare function openRegularFile(absPath: string, rootDir: string | undefined): {
+    fd: number;
+    size: number;
+} | undefined;
+/**
+ * Read a small text file in full, only when it is a regular file no larger
+ * than maxBytes. A FIFO, a directory, a symlink or an oversized file reads as
+ * undefined.
+ *
+ * @param {string} absPath absolute path
+ * @param {number} maxBytes largest size read
+ * @param {string|undefined} [rootDir] root the path must stay under
+ * @returns {string|undefined} the text, or undefined
+ */
+export declare function readRegularTextFile(absPath: string, maxBytes: number, rootDir?: string | undefined): string | undefined;
+/**
+ * Find byte markers in a file with bounded chunked reads.
+ *
+ * Each hit records up to `beforeBytes` bytes before the marker and up to
+ * `contextBytes` bytes after it, so a caller can read a version that follows a
+ * marker or check what a string is part of. Consecutive reads overlap by the
+ * longest marker plus the context length, so a marker split across two reads
+ * is seen whole once. Only bytes that were read are searched.
+ *
+ * @param {string} absPath absolute path of the file
+ * @param {string|undefined} rootDir extracted root the file must stay under
+ * @param {Buffer[]} markers byte markers to look for
+ * @param {Object} [options] options
+ * @param {number} [options.maxBytes] files larger than this are not read
+ * @param {number} [options.contextBytes=64] bytes kept after each hit
+ * @param {number} [options.beforeBytes=1] bytes kept before each hit
+ * @param {number} [options.maxHits=16] hits kept per marker
+ * @returns {{hits: {before: Buffer, after: Buffer, offset: number}[][], size: number, skipped?: string}|undefined}
+ *   hits per marker, in marker order, and the file size; `skipped` is
+ *   `too-large` when the file is over the cap and was not read. Undefined when
+ *   the file cannot be opened.
+ */
+export declare function scanFileMarkers(absPath: string, rootDir: string | undefined, markers: Buffer[], { maxBytes, contextBytes, beforeBytes, maxHits, }?: {
+    maxBytes?: number;
+    contextBytes?: number;
+    beforeBytes?: number;
+    maxHits?: number;
+}): {
+    hits: {
+        before: Buffer;
+        after: Buffer;
+        offset: number;
+    }[][];
+    size: number;
+    skipped?: string;
+} | undefined;
+//# sourceMappingURL=boundedFile.d.ts.map

package/types/lib/core/boundedFile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundedFile.d.ts","sourceRoot":"","sources":["../../../lib/core/boundedFile.js"],"names":[],"mappings":"AA4BA;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAFxB,MAEiD,CAAC;AAE5D;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAL5B,MAK4B,EAAE,OAAO,EAJrC,MAAM,GAAC,SAI8B,GAHnC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAsChD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EALhC,MAKgC,EAAE,QAAQ,EAJ1C,MAI0C,EAAE,OAAO,AAH3D,CACA,EADQ,MAAM,GAAC,SAG4C,GAFjD,MAAM,GAAC,SAAS,CAoC5B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAdE,MAcF,EACP,OAAO,EAdE,MAAM,GAAC,SAcT,EACP,OAAO,EAdE,MAAM,EAcR,EACP,EACE,QAAgC,EAChC,YAAiB,EACjB,WAAe,EACf,OAAY,GACb,AAnBA,CAKA,EAJA;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,OAAO,AAAhC,CACA,EADQ,MAAM,CACd;CAcK,GAdK;IAAC,IAAI,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAC,EAAE,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAsGjH"}

package/types/lib/core/brotliProbe.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The most files of one kind (executables and libraries, or extension
+ * modules) one scan opens in search of a Brotli decoder.
+ *
+ * @type {number}
+ */
+export declare const MAX_BROTLI_PROBES: number;
+/**
+ * The most bytes one scan reads in search of Brotli decoders.
+ *
+ * @type {number}
+ */
+export declare const MAX_BROTLI_PROBE_BYTES: number;
+/**
+ * Read which Brotli decoders a native file embeds and whether each carries
+ * the CVE-2026-111497 fix.
+ *
+ * @param {string} absPath absolute path of the file
+ * @param {string|undefined} rootDir extracted root the file must stay under
+ * @returns {{c?: {blockSwitchFix: string, evidence: string}, go?: {blockSwitchFix: string}, skipped?: string, size: number}|undefined}
+ *   undefined when the file cannot be read or holds no decoder. `c` is
+ *   Google's C decoder, with blockSwitchFix `true`, `false` or `unknown` and
+ *   the evidence it rests on (`error-names`, `constant-names` or `tables`);
+ *   `go` is the Go port. `skipped` is `too-large` for a file over the read cap.
+ */
+export declare function readBrotliDecoder(absPath: string, rootDir: string | undefined): {
+    c?: {
+        blockSwitchFix: string;
+        evidence: string;
+    };
+    go?: {
+        blockSwitchFix: string;
+    };
+    skipped?: string;
+    size: number;
+} | undefined;
+//# sourceMappingURL=brotliProbe.d.ts.map

package/types/lib/core/brotliProbe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brotliProbe.d.ts","sourceRoot":"","sources":["../../../lib/core/brotliProbe.js"],"names":[],"mappings":"AAmEA;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAFpB,MAE2B,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAFzB,MAEmD,CAAC;AAgC9D;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAR9B,MAQ8B,EAAE,OAAO,EAPvC,MAAM,GAAC,SAOgC,GANrC;IAAC,CAAC,CAAC,EAAE;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IAAC,EAAE,CAAC,EAAE;QAAC,cAAc,EAAE,MAAM,CAAA;KAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CA+DrI"}

package/types/lib/core/env.d.ts

@@ -113,6 +113,14 @@ export declare let CDXGEN_TEMP_DIR: string;
 export declare const SWIFT_CMD: string;
 /** Resolved Ruby executable command (RUBY_CMD env var, or "ruby"). */
 export declare const RUBY_CMD: string;
+/** Resolved RubyGems executable command (CDXGEN_GEM_CMD env var, or "gem"). */
+export declare const GEM_CMD: string;
+/** Resolved Bundler executable command (CDXGEN_BUNDLE_CMD env var, or "bundle"). */
+export declare const BUNDLE_CMD: string;
+/** Resolved PHP executable command (PHP_CMD env var, or "php"). */
+export declare const PHP_CMD: string;
+/** Resolved Composer executable command (COMPOSER_CMD env var, or "composer"). */
+export declare const COMPOSER_CMD: string;
 /** Python package components that can be excluded from the generated BOM. */
 export declare const PYTHON_EXCLUDED_COMPONENTS: string[];
 /** Map of base cdxgen project type to the array of accepted alias strings. */
@@ -211,12 +219,24 @@ export declare function isFeatureEnabled(cliOptions: Object, feature: string): b
  * @param {Boolean} defaultStatus Default return value if there are no types provided
  */
 export declare function hasAnyProjectType(projectTypes: any[], options: Object, defaultStatus?: boolean): any;
+/**
+ * Extract the lowercase command name from an invoked command path, without
+ * directories or a trailing `.js`, `.cjs`, `.mjs` or `.exe` extension. Both
+ * `/` and `\\` separators are handled, so a Windows path is inspected the
+ * same way on any host.
+ *
+ * @param {string} [commandPath] Invoked command path or name
+ * @returns {string} Lowercase command name
+ */
+export declare function getCommandName(commandPath?: string): string;
 /**
  * Determine whether the predictive dependency audit should run for the current
  * CLI invocation.
  *
- * OBOM-focused runs (`obom` or explicit `-t os` / OS aliases only) should keep
- * the direct BOM audit findings but skip the predictive dependency audit.
+ * OBOM and HBOM runs (commands named `obom` or `hbom`, including `hbom-slim`)
+ * and explicit `-t os` / OS / hardware project types alone keep the direct BOM
+ * audit findings but skip the predictive dependency audit. Only the command
+ * name is tested, never the directories leading to it.
  *
  * @param {object} options CLI options
  * @param {string} [commandPath] Invoked command path or name

package/types/lib/core/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../lib/core/env.js"],"names":[],"mappings":"AAUA,uCAAuC;AACvC,eAAO,MAAM,MAAM,SAAmD,CAAC;AACvE,mCAAmC;AACnC,eAAO,MAAM,KAAK,SAAwC,CAAC;AAC3D,oCAAoC;AACpC,eAAO,MAAM,MAAM,SAA+C,CAAC;AAEnE,yFAAyF;AACzF,eAAO,MAAM,sBAAsB,oBAElC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAIrB,CAAC;AAEX,sJAAsJ;AACtJ,eAAO,MAAM,qBAAqB,SAI/B,CAAC;AAEJ,sIAAsI;AACtI,eAAO,MAAM,sBAAsB,SAElC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAH9B,MAG8B,GAF5B,MAAM,EAAE,CAiDpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAFrB,OAAO,CAOnB;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,IAFhC,OAAO,CAMnB;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAF7B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAFjB,OAAO,CAOnB;AAED,mGAAmG;AACnG,eAAO,MAAM,aAAa,SAAuB,CAAC;AAElD,oJAAoJ;AACpJ,eAAO,MAAM,gBAAgB,SAEwC,CAAC;AAEtE,yFAAyF;AACzF,eAAO,MAAM,QAAQ,QAAmB,CAAC;AAEzC;;;;;GAKG;AACH,wBAAgB,cAAc,IAFjB,MAAM,CAclB;AAED,6FAA6F;AAC7F,eAAO,MAAM,UAAU,QAAqB,CAAC;AAsB7C;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,CAYlB;AAED,mEAAmE;AACnE,eAAO,IAAI,UAAU,QAAW,CAAC;AAIjC,yEAAyE;AACzE,eAAO,IAAI,QAAQ,QAAS,CAAC;AAI7B,mEAAmE;AACnE,eAAO,IAAI,OAAO,QAAQ,CAAC;AAI3B,sEAAsE;AACtE,eAAO,IAAI,QAAQ,QAAS,CAAC;AAI7B,mEAAmE;AACnE,eAAO,IAAI,OAAO,QAAQ,CAAC;AAI3B,yEAAyE;AACzE,eAAO,IAAI,SAAS,QAAU,CAAC;AAI/B,gEAAgE;AAChE,eAAO,IAAI,MAAM,QAAO,CAAC;AAIzB,yEAAyE;AACzE,eAAO,IAAI,SAAS,QAAU,CAAC;AAK/B;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,oBAGd,CAAC;AAEZ,2EAA2E;AAC3E,eAAO,IAAI,OAAO,QAAQ,CAAC;AAK3B,2EAA2E;AAC3E,eAAO,IAAI,QAAQ,QAAS,CAAC;AAK7B,mFAAmF;AACnF,eAAO,IAAI,eAAe,QAAS,CAAC;AAKpC,yEAAyE;AACzE,eAAO,MAAM,SAAS,QAAkD,CAAC;AAEzE,sEAAsE;AACtE,eAAO,MAAM,QAAQ,QAAgD,CAAC;AAEtE,6EAA6E;AAC7E,eAAO,MAAM,0BAA0B,UAWtC,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB;IAC/B,IAAI;IAyBJ,OAAO;IACP,GAAG;IACH,cAAc;IACd,WAAW;IACX,aAAa;IACb,aAAa;IACb,EAAE;IAyCF,GAAG;IACH,UAAU;IACV,OAAO;IACP,EAAE;IAyBF,EAAE;IACF,IAAI;IACJ,GAAG;IACH,IAAI;IACJ,MAAM;IA8BN,IAAI;IACJ,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,CAAC;IACD,KAAK;IACL,GAAG;IACH,OAAO;IACP,GAAG;IACH,GAAG;IACH,IAAI;IACJ,KAAK;IACL,SAAS;IACT,CAAC;IACD,OAAO;IACP,MAAM;IACN,IAAI;IACJ,EAAE;IACF,OAAO;IACP,IAAI;IACJ,YAAY;IACZ,SAAS;IAcT,UAAU;IACV,KAAK;IAUL,MAAM;IACN,GAAG;IACH,KAAK;IACL,KAAK;IACL,GAAG;IACH,GAAG;IACH,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,kBAAkB;IASlB,kBAAkB;IAMlB,OAAO;IACP,eAAe;CAChB,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB;IAClC,KAAK;CACN,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,EAF/B,MAAM,EAQf,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAH9C,MAG8C,GAF5C,OAAO,CAUnB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EALhC,MAKgC,EAAE,OAAO,QAAA,WAiBnD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,OAAA,EAAE,OAAO,EAH5C,MAG4C,EAAE,aAAa,UAAO,OA2G5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAJxC,MAIwC,EAAE,WAAW,AAH7D,CACA,EADQ,MAGqD,GAFnD,OAAO,CAiCnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,QAAA,EAAE,mBAAmB,OAAA,EAAE,OAAO,EAJ/D,MAI+D,WAezE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,KAAA,OA8CvC"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../lib/core/env.js"],"names":[],"mappings":"AAUA,uCAAuC;AACvC,eAAO,MAAM,MAAM,SAAmD,CAAC;AACvE,mCAAmC;AACnC,eAAO,MAAM,KAAK,SAAwC,CAAC;AAC3D,oCAAoC;AACpC,eAAO,MAAM,MAAM,SAA+C,CAAC;AAEnE,yFAAyF;AACzF,eAAO,MAAM,sBAAsB,oBAElC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAIrB,CAAC;AAEX,sJAAsJ;AACtJ,eAAO,MAAM,qBAAqB,SAI/B,CAAC;AAEJ,sIAAsI;AACtI,eAAO,MAAM,sBAAsB,SAElC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAH9B,MAG8B,GAF5B,MAAM,EAAE,CAiDpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAFrB,OAAO,CAOnB;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,IAFhC,OAAO,CAMnB;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAF7B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAFjB,OAAO,CAOnB;AAED,mGAAmG;AACnG,eAAO,MAAM,aAAa,SAAuB,CAAC;AAElD,oJAAoJ;AACpJ,eAAO,MAAM,gBAAgB,SAEwC,CAAC;AAEtE,yFAAyF;AACzF,eAAO,MAAM,QAAQ,QAAmB,CAAC;AAEzC;;;;;GAKG;AACH,wBAAgB,cAAc,IAFjB,MAAM,CAclB;AAED,6FAA6F;AAC7F,eAAO,MAAM,UAAU,QAAqB,CAAC;AAsB7C;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,CAYlB;AAED,mEAAmE;AACnE,eAAO,IAAI,UAAU,QAAW,CAAC;AAIjC,yEAAyE;AACzE,eAAO,IAAI,QAAQ,QAAS,CAAC;AAI7B,mEAAmE;AACnE,eAAO,IAAI,OAAO,QAAQ,CAAC;AAI3B,sEAAsE;AACtE,eAAO,IAAI,QAAQ,QAAS,CAAC;AAI7B,mEAAmE;AACnE,eAAO,IAAI,OAAO,QAAQ,CAAC;AAI3B,yEAAyE;AACzE,eAAO,IAAI,SAAS,QAAU,CAAC;AAI/B,gEAAgE;AAChE,eAAO,IAAI,MAAM,QAAO,CAAC;AAIzB,yEAAyE;AACzE,eAAO,IAAI,SAAS,QAAU,CAAC;AAK/B;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,oBAGd,CAAC;AAEZ,2EAA2E;AAC3E,eAAO,IAAI,OAAO,QAAQ,CAAC;AAK3B,2EAA2E;AAC3E,eAAO,IAAI,QAAQ,QAAS,CAAC;AAK7B,mFAAmF;AACnF,eAAO,IAAI,eAAe,QAAS,CAAC;AAKpC,yEAAyE;AACzE,eAAO,MAAM,SAAS,QAAkD,CAAC;AAEzE,sEAAsE;AACtE,eAAO,MAAM,QAAQ,QAAgD,CAAC;AAEtE,+EAA+E;AAC/E,eAAO,MAAM,OAAO,QAAqD,CAAC;AAE1E,oFAAoF;AACpF,eAAO,MAAM,UAAU,QACmC,CAAC;AAE3D,mEAAmE;AACnE,eAAO,MAAM,OAAO,QAA8C,CAAC;AAEnE,kFAAkF;AAClF,eAAO,MAAM,YAAY,QAC8B,CAAC;AAExD,6EAA6E;AAC7E,eAAO,MAAM,0BAA0B,UAWtC,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB;IAC/B,IAAI;IAyBJ,OAAO;IACP,GAAG;IACH,cAAc;IACd,WAAW;IACX,aAAa;IACb,aAAa;IACb,EAAE;IAyCF,GAAG;IACH,UAAU;IACV,OAAO;IACP,EAAE;IAyBF,EAAE;IACF,IAAI;IACJ,GAAG;IACH,IAAI;IACJ,MAAM;IA8BN,IAAI;IACJ,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,CAAC;IACD,KAAK;IACL,GAAG;IACH,OAAO;IACP,GAAG;IACH,GAAG;IACH,IAAI;IACJ,KAAK;IACL,SAAS;IACT,CAAC;IACD,OAAO;IACP,MAAM;IACN,IAAI;IACJ,EAAE;IACF,OAAO;IACP,IAAI;IACJ,YAAY;IACZ,SAAS;IAcT,UAAU;IACV,KAAK;IAUL,MAAM;IACN,GAAG;IACH,KAAK;IACL,KAAK;IACL,GAAG;IACH,GAAG;IACH,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,kBAAkB;IASlB,kBAAkB;IAMlB,OAAO;IACP,eAAe;CAChB,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB;IAClC,KAAK;CACN,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,EAF/B,MAAM,EAQf,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAH9C,MAG8C,GAF5C,OAAO,CAUnB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EALhC,MAKgC,EAAE,OAAO,QAAA,WAiBnD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,OAAA,EAAE,OAAO,EAH5C,MAG4C,EAAE,aAAa,UAAO,OA2G5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,WAAW,AAHvC,CACA,EADQ,MAG+B,GAF7B,MAAM,CAOlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAJxC,MAIwC,EAAE,WAAW,AAH7D,CACA,EADQ,MAGqD,GAFnD,OAAO,CA8BnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,QAAA,EAAE,mBAAmB,OAAA,EAAE,OAAO,EAJ/D,MAI+D,WAezE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,KAAA,OA8CvC"}

package/types/lib/core/fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../lib/core/fs.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA8ErC;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,QAAA,OAmCtC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAHlC,MAGkC,GAFhC,OAAO,CAYnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAL3B,MAK2B,EAAE,IAAI,EAJjC,MAAM,GAAC,MAI0B,EAAE,OAAO,AAHlD,CACA,EADQ,MAG0C,GAFxC,IAAI,CAQhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAIiC,EAAE,MAAM,EAHzC,QAAQ,CAAC,MAAM,GAAC,MAAM,CAGmB,GAFvC,IAAI,CA4BhB;AA2BD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAJ9B,MAI8B,EAAE,OAAO,AAH/C,CACA,EADQ,MAAM,GAAC,MAG0C,GAF/C,MAAM,GAAC,MAAM,GAAC,SAAS,CA0BnC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,QAAA,EAAE,OAAO,EAH5B,OAG4B,aAwB9C;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAAM,GAAC,MAGyC,GAF9C,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAJxB,MAIwB,EAAE,OAAO,AAHzC,CACA,EADQ,MAG6C,GAF3C,IAAI,CAchB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,IAAI,CAchB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,IAAI,EAJ/B,MAI+B,EAAE,IAAI,AAH7C,CACA,EADQ,MAGiD,GAF/C,IAAI,CAkBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EARD,MAQC,EACV,UAAU,EARD,MAQC,EACV,SAAS,EARA,kBAQA,EACT,IAAI,AARH,CACA,EADQ,MAQK,EACd,OAAO,AARN,CACA,EADQ,MAQU,GAPR,OAAO,CAAC,OAAO,CAAC,CAwD5B;AAED,sFAAsF;AACtF,eAAO,MAAM,cAAc,UAAY,CAAC;AASxC,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,UAAY,CAAC;AA+D1C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,UAAU,AAH/C,CACA,EADQ,OAG+C,GAF7C,MAAM,CAuClB;AAkBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAL7B,MAK6B,EAAE,IAAI,EAJnC,MAAM,EAAE,GAAC,SAI0B,EAAE,YAAY,AAHzD,CACA,EADQ,OAGyD,GAFvD,MAAM,CAclB;AA0GD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAL1B,MAK0B,EAAE,IAAI,EAJhC,MAAM,EAI0B,EAAE,OAAO,EAHzC,MAGyC,GAFvC,MAAM,CAqPlB;AAED,6FAA6F;AAC7F,eAAO,MAAM,UAAU,QAEP,CAAC;AAEjB,4GAA4G;AAC5G,eAAO,MAAM,UAAU,QAEJ,CAAC;AAEpB;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,OAAO,EANxB,MAMwB,EAAE,OAAO,EALjC,MAKiC,EAAE,OAAO,GAJ1C,MAI+C,OAwCzD;AA0BD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAFhC,MAAM,GAAC,SAEyB,QAK1C;AA4BD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,SAGtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EARE,MAQF,EACP,OAAO,EARE,MAQF,EACP,UAAU,SAAA,EACV,UAAU,OAAA,OAmDX;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAFf,MAAM,CAIlB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,IAFZ,MAAM,CAYlB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAJ1B,MAI0B,EAAE,IAAI,EAHhC,MAGgC,GAF9B,OAAO,QAAQ,CAU3B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,KAAA,EAAE,IAAI,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA8B3B"}
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../lib/core/fs.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA+ErC;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,QAAA,OAmCtC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAHlC,MAGkC,GAFhC,OAAO,CAYnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAL3B,MAK2B,EAAE,IAAI,EAJjC,MAAM,GAAC,MAI0B,EAAE,OAAO,AAHlD,CACA,EADQ,MAG0C,GAFxC,IAAI,CAQhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAIiC,EAAE,MAAM,EAHzC,QAAQ,CAAC,MAAM,GAAC,MAAM,CAGmB,GAFvC,IAAI,CA4BhB;AA2BD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAJ9B,MAI8B,EAAE,OAAO,AAH/C,CACA,EADQ,MAAM,GAAC,MAG0C,GAF/C,MAAM,GAAC,MAAM,GAAC,SAAS,CA0BnC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,QAAA,EAAE,OAAO,EAH5B,OAG4B,aAwB9C;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAAM,GAAC,MAGyC,GAF9C,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAJxB,MAIwB,EAAE,OAAO,AAHzC,CACA,EADQ,MAG6C,GAF3C,IAAI,CAchB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,IAAI,CAchB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,IAAI,EAJ/B,MAI+B,EAAE,IAAI,AAH7C,CACA,EADQ,MAGiD,GAF/C,IAAI,CAkBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EARD,MAQC,EACV,UAAU,EARD,MAQC,EACV,SAAS,EARA,kBAQA,EACT,IAAI,AARH,CACA,EADQ,MAQK,EACd,OAAO,AARN,CACA,EADQ,MAQU,GAPR,OAAO,CAAC,OAAO,CAAC,CAwD5B;AAED,sFAAsF;AACtF,eAAO,MAAM,cAAc,UAAY,CAAC;AASxC,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,UAAY,CAAC;AAoE1C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,UAAU,AAH/C,CACA,EADQ,OAG+C,GAF7C,MAAM,CAuClB;AAkBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAL7B,MAK6B,EAAE,IAAI,EAJnC,MAAM,EAAE,GAAC,SAI0B,EAAE,YAAY,AAHzD,CACA,EADQ,OAGyD,GAFvD,MAAM,CAclB;AA0GD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAL1B,MAK0B,EAAE,IAAI,EAJhC,MAAM,EAI0B,EAAE,OAAO,EAHzC,MAGyC,GAFvC,MAAM,CAoQlB;AAED,6FAA6F;AAC7F,eAAO,MAAM,UAAU,QAEP,CAAC;AAEjB,4GAA4G;AAC5G,eAAO,MAAM,UAAU,QAEJ,CAAC;AAEpB;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,OAAO,EANxB,MAMwB,EAAE,OAAO,EALjC,MAKiC,EAAE,OAAO,GAJ1C,MAI+C,OAwCzD;AA0BD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAFhC,MAAM,GAAC,SAEyB,QAK1C;AA4BD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,SAGtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EARE,MAQF,EACP,OAAO,EARE,MAQF,EACP,UAAU,SAAA,EACV,UAAU,OAAA,OAmDX;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAFf,MAAM,CAIlB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,IAFZ,MAAM,CAYlB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAJ1B,MAI0B,EAAE,IAAI,EAHhC,MAGgC,GAF9B,OAAO,QAAQ,CAU3B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,KAAA,EAAE,IAAI,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA8B3B"}

package/types/lib/core/httpClient.d.ts

@@ -84,6 +84,30 @@ export declare function getDefaultHttpTimeoutMs(): number;
  * @returns {number|undefined} Total timeout in milliseconds, or `undefined`.
  */
 export declare function resolveTimeout(timeout?: number | Object): number | undefined;
+/**
+ * Set or clear the cached runtime Brotli verdict. Exported for unit tests only.
+ *
+ * @param {boolean|undefined} verdict verdict to use, or undefined to re-check
+ */
+export declare function _setRuntimeBrotliVerdict(verdict: boolean | undefined): void;
+/**
+ * Whether the Brotli decoder of the runtime cdxgen runs on carries the
+ * CVE-2026-111497 fix, read once from the decoder itself: the node binary, or
+ * the shared libbrotlidec a `--shared-brotli` build (Homebrew, distro
+ * packages) loads; under Bun, the bun binary, which carries its own copy.
+ * process.versions.brotli cannot answer this, since Node.js backports the fix
+ * without changing it. Deno decodes Brotli in Rust, which was never affected.
+ *
+ * On Node.js cdxgen never asks for `br`, so a Brotli response comes only from
+ * a server that sends it unasked. When the decoder cannot be shown to be
+ * patched, such a body is left undecoded rather than handed to a decoder an
+ * attacker can write past. Bun decodes in its transport, so there the client
+ * stops asking for `br` instead.
+ *
+ * @param {Object} [runtime] the runtime to judge, for tests
+ * @returns {boolean} true when Brotli bodies may be decoded
+ */
+export declare function runtimeBrotliDecoderIsPatched(runtime?: Object): boolean;
 /**
  * Override the response cache bounds. Returns the previous bounds so tests can
  * restore them. Not part of the public API.

package/types/lib/core/httpClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"httpClient.d.ts","sourceRoot":"","sources":["../../../lib/core/httpClient.js"],"names":[],"mappings":"AAkBA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH;;;;;GAKG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAU3B,QAAQ;IACR,OAAO;IACP,IAAI;IAXX;;;OAGG;IACH,YAAY,QAAQ,EAHT,MAGS,EAAE,OAAO,EAFlB,MAEkB,EAQ5B;CACF;AAED;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,KAAK;IAQ9B,OAAO;IACP,IAAI;IACJ,KAAK;IATZ;;;OAGG;IACH,YAAY,KAAK,EAHN,KAGM,EAAE,OAAO,EAFf,MAEe,EAMzB;CACF;AAmED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAF1B,MAAM,CAYlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,AAHnC,CACA,EADQ,MAAM,GAAC,MAGoB,GAFzB,MAAM,GAAC,SAAS,CAyB5B;AAsMD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAH/B;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAGH,GAF7B;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,CAM7C;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAFjB,IAAI,CAKhB;AAoBD;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAUnC,MAAM;IACN,GAAG;IAVV;;;OAGG;IACH,YAAY,MAAM,EAHP,MAGO,EAAE,GAAG,EAFZ,MAEY,EAOtB;CACF;AASD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAJ1B,CAAC,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,GAAC,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,MAAM,GAAC,IAAI,CAIlG,GAFxB,IAAI,CAIhB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAFvB,IAAI,CAIhB;AA4TD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,AAJtC,CACA,EADQ,MAImC,YAwC7C"}
+{"version":3,"file":"httpClient.d.ts","sourceRoot":"","sources":["../../../lib/core/httpClient.js"],"names":[],"mappings":"AAcA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH;;;;;GAKG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAU3B,QAAQ;IACR,OAAO;IACP,IAAI;IAXX;;;OAGG;IACH,YAAY,QAAQ,EAHT,MAGS,EAAE,OAAO,EAFlB,MAEkB,EAQ5B;CACF;AAED;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,KAAK;IAQ9B,OAAO;IACP,IAAI;IACJ,KAAK;IATZ;;;OAGG;IACH,YAAY,KAAK,EAHN,KAGM,EAAE,OAAO,EAFf,MAEe,EAMzB;CACF;AAmED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAF1B,MAAM,CAYlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,AAHnC,CACA,EADQ,MAAM,GAAC,MAGoB,GAFzB,MAAM,GAAC,SAAS,CAyB5B;AAID;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAFrC,OAAO,GAAC,SAE6B,QAE/C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,AAHlD,CACA,EADQ,MAGsD,GAFpD,OAAO,CAyCnB;AAiOD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAH/B;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAGH,GAF7B;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,CAM7C;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAFjB,IAAI,CAKhB;AAoBD;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAUnC,MAAM;IACN,GAAG;IAVV;;;OAGG;IACH,YAAY,MAAM,EAHP,MAGO,EAAE,GAAG,EAFZ,MAEY,EAOtB;CACF;AASD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAJ1B,CAAC,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,GAAC,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,MAAM,GAAC,IAAI,CAIlG,GAFxB,IAAI,CAIhB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAFvB,IAAI,CAIhB;AA8VD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,AAJtC,CACA,EADQ,MAImC,YAwC7C"}

package/types/lib/core/lockPaths.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Containment check for a path taken from a lockfile (issue #3816). A crafted
+ * npm lockfile can name `file:`/`link:` specifiers or link targets built from
+ * `..` chains or absolute paths, so a parser that is about to list such an
+ * entry checks the resolved path against the project root first.
+ *
+ * The candidate is resolved against `projectRoot`, so both relative values
+ * and the absolute paths arborist already normalised are accepted. The root
+ * itself counts as inside: a lockfile may legitimately link the project to
+ * its own directory.
+ *
+ * @param {string} candidate Path to check, absolute or relative to projectRoot
+ * @param {string} projectRoot Project root the path must stay inside; a falsy
+ *   root means the current working directory, mirroring `node:path`
+ *
+ * @returns {Boolean} True when the path is inside projectRoot
+ */
+export declare function isPathInsideProject(candidate: string, projectRoot: string): boolean;
+//# sourceMappingURL=lockPaths.d.ts.map

package/types/lib/core/lockPaths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockPaths.d.ts","sourceRoot":"","sources":["../../../lib/core/lockPaths.js"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EANlC,MAMkC,EAAE,WAAW,EAL/C,MAK+C,WAkBzD"}

package/types/lib/core/processTree.d.ts

@@ -25,6 +25,8 @@ export declare function formatDuration(ms: number): string;
  * its end: once the root is gone its pid can be handed to an unrelated
  * process, whose children would otherwise look like the run's. Elsewhere this
  * does nothing: an orphan is re-parented and can no longer be told apart.
+ * It returns once the stopped processes have exited, or after ten seconds,
+ * so the caller can remove files the run left half-written.
  *
  * @param {number|undefined} rootPid pid of the process cdxgen spawned
  * @param {number} startedAt Epoch milliseconds at which the run started

package/types/lib/core/processTree.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"processTree.d.ts","sourceRoot":"","sources":["../../../lib/core/processTree.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAHtB,MAGsB,GAFpB,MAAM,CAQlB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAPE,MAAM,GAAC,SAOT,EACP,SAAS,EAPA,MAOA,EACT,OAAO,AAPN,CACA,EADQ,MAOW,EACpB,QAAQ,AAPP,CACA,EADQ,MAOY,GANV,MAAM,EAAE,CAuDpB"}
+{"version":3,"file":"processTree.d.ts","sourceRoot":"","sources":["../../../lib/core/processTree.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAHtB,MAGsB,GAFpB,MAAM,CAQlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAPE,MAAM,GAAC,SAOT,EACP,SAAS,EAPA,MAOA,EACT,OAAO,AAPN,CACA,EADQ,MAOW,EACpB,QAAQ,AAPP,CACA,EADQ,MAOY,GANV,MAAM,EAAE,CA0DpB"}

package/types/lib/core/projectConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"projectConfig.d.ts","sourceRoot":"","sources":["../../../lib/core/projectConfig.js"],"names":[],"mappings":"AASA;;GAEG;AACH,eAAO,MAAM,wBAAwB,UAKpC,CAAC;AAsEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAJjC,MAIiC,EAAE,SAAS,EAH5C,MAG4C,GAF1C;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,EAAE,MAAM,EAAE,CAAA;CAAC,CA+CnG"}
+{"version":3,"file":"projectConfig.d.ts","sourceRoot":"","sources":["../../../lib/core/projectConfig.js"],"names":[],"mappings":"AASA;;GAEG;AACH,eAAO,MAAM,wBAAwB,UAKpC,CAAC;AAuEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAJjC,MAIiC,EAAE,SAAS,EAH5C,MAG4C,GAF1C;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,EAAE,MAAM,EAAE,CAAA;CAAC,CA+CnG"}

package/types/lib/core/projectTooling.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Whether secure mode is on right now. `isSecureMode` is read once when the
+ * modules load, but the `cdxgen-secure` command turns secure mode on later,
+ * by setting CDXGEN_SECURE_MODE before the scan starts.
+ *
+ * @returns {boolean} true when secure mode is on
+ */
+export declare function isSecureModeActive(): boolean;
+/**
+ * Whether the scan may run the scanned project's own build tooling, such as
+ * wrapper scripts or build definitions that Maven, Gradle, sbt, Mill, Poetry,
+ * PDM, MSBuild, SwiftPM, Leiningen and CocoaPods evaluate.
+ *
+ * Tooling follows `options.installDeps`, which defaults to off in secure mode
+ * when a caller does not set it. Introspection mode exists to observe the
+ * project's own toolchain, so it keeps that tooling on even when dependency
+ * installation is disabled, as long as the operator asked for it rather than
+ * a config file in the scanned project. Secure mode still wins:
+ * CDXGEN_INTROSPECT alone must not make a secure-mode scan run the scanned
+ * project's code.
+ *
+ * @param {Object} [options] CLI options
+ * @returns {boolean} true when project tooling may run
+ */
+export declare function isProjectToolingAllowed(options?: Object): boolean;
+/**
+ * Tell the user that a tool was skipped because project tooling is not
+ * allowed, and record the matching degradation for the fidelity report.
+ * Each skip is reported once per scan, however many manifests it applies to.
+ * A skip that only costs evidence, not BOM content, passes no remediation id
+ * and is only shown.
+ *
+ * @param {Object} options CLI options of the scan
+ * @param {string|null} remediationId Remediation id from
+ *   data/remediations.json, or null for a message only
+ * @param {string} message Console message shown to the user
+ * @param {Object} [fields] Degradation fields (ecosystem, tool, impact, detail)
+ * @returns {void}
+ */
+export declare function reportProjectToolingSkipped(options: Object, remediationId: string | null, message: string, fields?: Object): void;
+//# sourceMappingURL=projectTooling.d.ts.map

package/types/lib/core/projectTooling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectTooling.d.ts","sourceRoot":"","sources":["../../../lib/core/projectTooling.js"],"names":[],"mappings":"AAaA;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAFrB,OAAO,CAOnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,AAH5C,CACA,EADQ,MAGoC,GAFlC,OAAO,CAanB;AAOD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EARE,MAQF,EACP,aAAa,EARJ,MAAM,GAAC,IAQH,EACb,OAAO,EAPE,MAOF,EACP,MAAM,AAPL,CACA,EADQ,MAOH,GANK,IAAI,CAuBhB"}

package/types/lib/core/propertySanitizer.d.ts

@@ -12,6 +12,32 @@ export declare function sanitizeStructuredValueForBom(value: unknown): unknown;
  * @returns {string} sanitized URL
  */
 export declare function sanitizeBomUrl(value: string): string;
+/**
+ * Percent-encode what an RFC 3986 URI reference cannot hold as it is, so a
+ * route template or URL can be emitted where CycloneDX expects an
+ * iri-reference, such as `services[].endpoints[]`. The braces of a route
+ * template, spaces, `<>`, `[]` outside an IPv6 host, `|`, `^`, non-ASCII
+ * characters and a `%` that starts no escape are encoded:
+ * `/users/{id}` becomes `/users/%7Bid%7D`. The scheme and authority of an
+ * absolute URL are kept as written, the query and fragment stay a query and
+ * fragment, and existing escapes are kept, so encoding twice changes
+ * nothing. Nothing is removed; strip credentials with {@link sanitizeBomUrl}
+ * first.
+ *
+ * @param {unknown} value Route template, path or URL
+ * @returns {string} The encoded reference
+ */
+export declare function encodeUriReference(value: unknown): string;
+/**
+ * Whether a value carries a token shape the BOM sanitizer redacts: cloud
+ * access keys, bearer tokens, GitHub, Slack and npm tokens, JWTs and the
+ * like. Callers that cannot splice a `[redacted]` marker into the value, such
+ * as a URL path segment, use it to drop the value instead.
+ *
+ * @param {unknown} value Value to check
+ * @returns {boolean} true when the value holds an inline credential
+ */
+export declare function hasInlineCredential(value: unknown): boolean;
 /**
  * Sanitize a property value before serializing it into BOM properties.
  *

package/types/lib/core/propertySanitizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"propertySanitizer.d.ts","sourceRoot":"","sources":["../../../lib/core/propertySanitizer.js"],"names":[],"mappings":"AAyDA;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAHxC,OAGwC,GAFtC,OAAO,CAInB;AAyED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAHzB,MAGyB,GAFvB,MAAM,CAIlB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,KAAK,EAHzC,OAGyC,GAFvC,MAAM,GAAC,OAAO,CAoB1B"}
+{"version":3,"file":"propertySanitizer.d.ts","sourceRoot":"","sources":["../../../lib/core/propertySanitizer.js"],"names":[],"mappings":"AAkEA;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAHxC,OAGwC,GAFtC,OAAO,CAInB;AAyED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAHzB,MAGyB,GAFvB,MAAM,CAIlB;AAWD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAH7B,OAG6B,GAF3B,MAAM,CAsBlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAH9B,OAG8B,GAF5B,OAAO,CAQnB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,KAAK,EAHzC,OAGyC,GAFvC,MAAM,GAAC,OAAO,CAoB1B"}

package/types/lib/core/toolRegistry.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Record an external tool cdxgen executed. The first version seen wins unless
+ * it was unknown, so an enriched probe never overwrites a concrete version
+ * with `undefined` and a later concrete version fills an earlier gap.
+ *
+ * @param {string} name Tool name as invoked (a bare name or a path)
+ * @param {string|undefined} version Version when cheaply known
+ */
+export declare function recordExecutedTool(name: string, version: string | undefined): void;
+/**
+ * Remember the version a stage already resolved for a tool, such as the JVM
+ * build tool pregen provisioned. The version shows in `metadata.tools` only if
+ * the tool is executed; the first version recorded wins.
+ *
+ * @param {string} name Tool name as it will be invoked (a bare name or a path)
+ * @param {string} version Resolved version
+ */
+export declare function recordToolVersion(name: string, version: string): void;
+/**
+ * Snapshot of the tools recorded so far, sorted by name so the assembled
+ * `metadata.tools` diff stays stable between runs.
+ *
+ * @returns {Array<{name: string, version: (string|undefined)}>} Sorted tool records
+ */
+export declare function getExecutedTools(): Array<{
+    name: string;
+    version: (string | undefined);
+}>;
+/**
+ * Clear the registry. The server calls it between scans through the run-state
+ * reset; tests call it directly.
+ *
+ * @returns {void}
+ */
+export declare function resetExecutedTools(): void;
+//# sourceMappingURL=toolRegistry.d.ts.map

package/types/lib/core/toolRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolRegistry.d.ts","sourceRoot":"","sources":["../../../lib/core/toolRegistry.js"],"names":[],"mappings":"AAsFA;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAH5B,MAG4B,EAAE,OAAO,EAFrC,MAAM,GAAC,SAE8B,QAoB/C;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAH3B,MAG2B,EAAE,OAAO,EAFpC,MAEoC,QAW9C;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAFnB,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAA;CAAC,CAAC,CAe9D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAFrB,IAAI,CAKhB"}