@cdxgen/cdxgen 13.4.0 → 13.6.0

package/types/lib/inventory/brotliDecoder.d.ts

@@ -0,0 +1,58 @@
+import { MAX_BROTLI_PROBE_BYTES, MAX_BROTLI_PROBES, readBrotliDecoder } from "../core/brotliProbe.js";
+export { MAX_BROTLI_PROBE_BYTES, MAX_BROTLI_PROBES, readBrotliDecoder };
+/**
+ * The properties a file component carries once it has been probed: the fix
+ * state of each decoder found in it, or why it could not be read.
+ *
+ * @param {Object} decoder result of readBrotliDecoder
+ * @returns {{name: string, value: string}[]} properties to append
+ */
+export declare function brotliDecoderProperties(decoder: Object): {
+    name: string;
+    value: string;
+}[];
+/**
+ * The library component every embedded decoder links to. It has no version:
+ * no build records one, and only the per-file cdx:brotli:*:blockSwitchFix
+ * properties say whether a copy is vulnerable. The `vcs_url` qualifier names
+ * the project and keeps the identity apart from an unpackaged `brotli`
+ * executable, which is `pkg:generic/brotli`. The purl has no namespace: a
+ * `pkg:github` purl is typed as an application and `pkg:generic/google` as a
+ * framework when the BOM is assembled, and this is neither.
+ *
+ * @returns {Object} component with `purl` and `bom-ref`
+ */
+export declare function createBrotliComponent(): Object;
+/**
+ * Start collecting the decoder copies of one scan.
+ *
+ * @returns {{component: Object|undefined, dependencies: Object[], copies: number, unpatched: number, unknown: number}}
+ */
+export declare function createBrotliInventory(): {
+    component: Object | undefined;
+    dependencies: Object[];
+    copies: number;
+    unpatched: number;
+    unknown: number;
+};
+/**
+ * Tag a probed file component and, when it holds a decoder, link it to the
+ * shared brotli component, creating that component on first use. Mutates the
+ * file component in place.
+ *
+ * @param {Object} inventory accumulator from createBrotliInventory
+ * @param {Object} fileComponent file component with a `properties` array
+ * @param {Object} decoder result of readBrotliDecoder
+ */
+export declare function attachBrotliDecoder(inventory: Object, fileComponent: Object, decoder: Object): void;
+/**
+ * Finish an inventory: record the copy counts on the brotli component.
+ *
+ * @param {Object} inventory accumulator from createBrotliInventory
+ * @returns {{components: Object[], dependencies: Object[]}} what to add to the BOM
+ */
+export declare function finishBrotliInventory(inventory: Object): {
+    components: Object[];
+    dependencies: Object[];
+};
+//# sourceMappingURL=brotliDecoder.d.ts.map

package/types/lib/inventory/brotliDecoder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brotliDecoder.d.ts","sourceRoot":"","sources":["../../../lib/inventory/brotliDecoder.js"],"names":[],"mappings":"AAIA,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,CAAC;AAExE;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAHpC,MAGoC,GAFlC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAoB3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,IAFxB,MAAM,CAiBlB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAFxB;IAAC,SAAS,EAAE,MAAM,GAAC,SAAS,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAUrH;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAJlC,MAIkC,EAAE,aAAa,EAHjD,MAGiD,EAAE,OAAO,EAF1D,MAE0D,QAyBpE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAHpC,MAGoC,GAFlC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAkB1D"}

package/types/lib/inventory/cacheDir.d.ts

@@ -21,13 +21,21 @@
  * rather than reading `isWin`/`isMac` here, or the Windows and Linux branches
  * become untestable on a macOS developer machine.
  *
+ * Every environment-derived root must be absolute by the *target* platform's
+ * rules, never the host's (`path.isAbsolute` would accept `\cache` on a
+ * Windows host): a relative value is ignored, so it cannot point inside the
+ * working directory. XDG requires this of `XDG_CACHE_HOME`; the home and
+ * `LOCALAPPDATA` roots get the same treatment for the same reason.
+ *
  * @param {Object} inputs Resolution inputs.
  * @param {"linux"|"macos"|"windows"} inputs.platform Which convention to apply.
- * @param {string} [inputs.cdxgenCacheDir] `CDXGEN_CACHE_DIR`.
+ * @param {string} [inputs.cdxgenCacheDir] `CDXGEN_CACHE_DIR`, an explicit
+ *   override taken as given.
  * @param {string} [inputs.xdgCacheHome] `XDG_CACHE_HOME`. Ignored unless
- *   absolute, per the XDG spec, so it cannot point inside the working directory.
- * @param {string} [inputs.home] Home directory.
- * @param {string} [inputs.localAppData] `LOCALAPPDATA`.
+ *   `/`-rooted.
+ * @param {string} [inputs.home] Home directory. Ignored unless absolute.
+ * @param {string} [inputs.localAppData] `LOCALAPPDATA`. Ignored unless drive-
+ *   or UNC-rooted; the home profile is the fallback.
  * @returns {string|null} Absolute path, or null when nothing resolves.
  */
 export declare function resolveCacheDirFor({ platform, cdxgenCacheDir, xdgCacheHome, home, localAppData, }: {

package/types/lib/inventory/cacheDir.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cacheDir.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cacheDir.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAQH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,QAAQ,EACR,cAAc,EACd,YAAY,EACZ,IAAI,EACJ,YAAY,GACb,EAdE;IAA0C,QAAQ,EAA1C,OAAO,GAAC,OAAO,GAAC,SAAS,CACjC;IAAwB,cAAc,AAAtC,CACA,EADQ,MAAM,CACd;IAAwB,YAAY,AAApC,CAEA,EAFQ,MAAM,CAEd;IAAwB,IAAI,AAA5B,CACA,EADQ,MAAM,CACd;IAAwB,YAAY,AAApC,CACA,EADQ,MAAM,CACd;CAQF,GARY,MAAM,GAAC,IAAI,CA2BvB;AAcD;;;;;GAKG;AACH,wBAAgB,eAAe,IAHlB,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,MAAM,CAIlB"}
+{"version":3,"file":"cacheDir.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cacheDir.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAQH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,QAAQ,EACR,cAAc,EACd,YAAY,EACZ,IAAI,EACJ,YAAY,GACb,EAhBE;IAA0C,QAAQ,EAA1C,OAAO,GAAC,OAAO,GAAC,SAAS,CACjC;IAAwB,cAAc,AAAtC,CAEA,EAFQ,MAAM,CAEd;IAAwB,YAAY,AAApC,CAEA,EAFQ,MAAM,CAEd;IAAwB,IAAI,AAA5B,CACA,EADQ,MAAM,CACd;IAAwB,YAAY,AAApC,CAEA,EAFQ,MAAM,CAEd;CAQF,GARY,MAAM,GAAC,IAAI,CA6BvB;AA+CD;;;;;GAKG;AACH,wBAAgB,eAAe,IAHlB,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,MAAM,CAIlB"}

package/types/lib/inventory/cbomutils.d.ts

@@ -30,6 +30,23 @@ export declare function collectDosaiCryptoComponents(src: string, options?: obje
 /**
  * Find crypto algorithm in the given code snippet
  *
+ * cleanStr fuses the snippet's identifiers into one lowercase string
+ * (`prepare_for_save(iv` becomes `prepareforsaveiv`), so a plain substring
+ * test reads short algorithm names inside unrelated identifiers (`rsa` in
+ * `for_save`). A name therefore matches only where a cleanStr word begins:
+ * the snippet's start, right after any character cleanStr strips or keeps as
+ * a separator, or at a lowercase-to-uppercase change in the original text
+ * (`SHA256withRSA`, `HmacSHA256`, `PBKDF2WithHmacSHA256`,
+ * `generateRsaKeyPair`). Boundaries are computed from the original string
+ * before it is lowercased, so case changes survive the cleanStr fusion.
+ * Letter/digit changes do not start a word: they added no match on any
+ * reviewed form or corpus snippet, while splitting every digit-bearing
+ * identifier (`md5`, `base64`) into false word starts. Fused forms the names
+ * themselves are written in still match: `algorithms.AES(key)` and
+ * `AESGCM(key)` yield `aes`, `AES-256-GCM` yields `aes256-GCM`,
+ * `createHash("sha256")` yields `sha-256`. All-uppercase fused forms
+ * (`HMACSHA256`) still hide every name but the run's first.
+ *
  * @param {string} code Code snippet
  * @returns {Array} Arary of crypto algorithm objects with oid and description
  */

package/types/lib/inventory/cbomutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cbomutils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cbomutils.js"],"names":[],"mappings":"AAqBA;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,EAAE,gBAAgB,KAAA,SAiC5D;AAiXD;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CAAC,GAAG,EAL5C,MAK4C,EAAE,OAAO,AAJ7D,CAEA,EADA;IAA0B,IAAI,AAA9B,CACA,EADQ,OAAO,CACf;CAEkE,GAFxD,OAAO,CAAC,MAAM,EAAE,CAAC,CAkD7B;AAED;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,CAAC,GAAG,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC,MAAM,EAAE,CAAC,CAuG7B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAHzB,MAGyB,SAanC"}
+{"version":3,"file":"cbomutils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cbomutils.js"],"names":[],"mappings":"AAqBA;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,EAAE,gBAAgB,KAAA,SAiC5D;AAiXD;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CAAC,GAAG,EAL5C,MAK4C,EAAE,OAAO,AAJ7D,CAEA,EADA;IAA0B,IAAI,AAA9B,CACA,EADQ,OAAO,CACf;CAEkE,GAFxD,OAAO,CAAC,MAAM,EAAE,CAAC,CAkD7B;AAED;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,CAAC,GAAG,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC,MAAM,EAAE,CAAC,CAuG7B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAHzB,MAGyB,SA6CnC"}

package/types/lib/inventory/certificates.d.ts

@@ -0,0 +1,205 @@
+export declare function toLowerHex(value: any): any;
+export declare function normalizeSerialHex(value: any): string | undefined;
+export declare function serialDecimalToHex(value: any): string | undefined;
+/**
+ * Split PEM text into labelled blocks without decoding them. Only the label
+ * line and the matching END line matter; the caller decides which labels to
+ * parse. Bounded by block count and total decoded size.
+ *
+ * @param {string} text file contents
+ * @returns {{label: string, body: string}[]} blocks in file order
+ */
+export declare function splitPemBlocks(text: string): {
+    label: string;
+    body: string;
+}[];
+/**
+ * Decode the CERTIFICATE blocks of a PEM bundle (RFC 7468) into DER buffers.
+ * `TRUSTED CERTIFICATE` blocks (OpenSSL aux data after the DER) are not
+ * decoded here; the trustinspector plugin parses their trust/reject lists.
+ *
+ * @param {string} text PEM file contents
+ * @returns {Buffer[]} DER buffers in file order
+ */
+export declare function pemCertificateDerBlocks(text: string): Buffer[];
+export declare function privateKeyPemFormat(text: any): "DSA" | "EC" | "ENCRYPTED-PKCS8" | "OPENSSH" | "PKCS8" | "RSA" | undefined;
+/**
+ * A PEM public key (RFC 7468 PUBLIC KEY label) also classifies a matched
+ * file as key material rather than a certificate.
+ *
+ * @param {string} text file contents
+ * @returns {boolean} true when a PUBLIC KEY block is present
+ */
+export declare function hasPemPublicKey(text: string): boolean;
+/**
+ * Walk a certificate DER far enough to learn what the platform parsers may
+ * not report: the SubjectPublicKeyInfo (for the SPKI hash and key algorithm
+ * OID), the outer signature algorithm OID, the X.509 version, the subject and
+ * issuer name DER (byte equality = self-issued), and the SKI/AKI key
+ * identifiers (RFC 5280 sections 4.1, 4.2.1.1, 4.2.1.2). Malformed input
+ * yields undefined; nothing throws.
+ *
+ * @param {Buffer} der certificate DER, at most MAX_CERT_DER_BYTES
+ * @returns {object|undefined} parsed fields
+ */
+export declare function parseCertificateDer(der: Buffer): object | undefined;
+/**
+ * Name a key algorithm the way the BOM model requires: the post-quantum table
+ * first, then classical names derived from the SPKI OID and key size, never
+ * the platform's own name for an algorithm it may not know. Names agree with
+ * trustinspector's (`RSA-2048`, `ECDSA-P256`, `Ed25519`, `ML-DSA-65`);
+ * unknown algorithms keep their dotted OID.
+ *
+ * @param {object} context `{oid, curveOid, bits}` from the DER walk or report
+ * @returns {string|undefined} key name such as `ML-DSA-65`, `RSA-2048`, `ECDSA-P256`
+ */
+/**
+ * The family name for a key algorithm component: like
+ * {@link keyAlgorithmName} but without the key-size suffix, so every key
+ * size sharing an OID (RSA-1024 and RSA-2048, ECDSA P-256 and P-384)
+ * references the same single algorithm component. Post-quantum names are
+ * already family names (`ML-DSA-65`).
+ *
+ * @param {string} oid SPKI algorithm OID
+ * @returns {string|undefined} family name such as `RSA`, `ECDSA`, `ML-DSA-65`
+ */
+export declare function keyAlgorithmFamilyName(oid: string): string | undefined;
+export declare function keyAlgorithmName(context: any): any;
+/**
+ * Name a signature algorithm: the post-quantum table, then Go's classical
+ * names, then the dotted OID. Never "0" or "unknown".
+ *
+ * @param {object} context `{oid}` or a trusted producer name
+ * @returns {string|undefined} signature name such as `ML-DSA-65`, `SHA256-RSA`
+ */
+export declare function signatureAlgorithmName(context: object): string | undefined;
+/**
+ * Metadata for an algorithm component: primitive, parameter set and NIST
+ * quantum security level from the post-quantum table; classical algorithms
+ * carry level 0, which is a fact, not a policy.
+ *
+ * @param {string} oid dotted algorithm OID
+ * @param {string} kind `"signature"` or `"kem"`/key use
+ * @returns {object} `{primitive, parameterSetIdentifier, nistQuantumSecurityLevel}` when known
+ */
+export declare function algorithmComponentMetadata(oid: string): object;
+export declare function commonNameFromDn(dn: any): string | undefined;
+/**
+ * Normalise a trustinspector material (report-1 or report-2) into a
+ * certificate record. Returns undefined for non-certificate kinds.
+ *
+ * @param {object} material trustinspector material
+ * @param {object} [context] `{locationRoot}` to relativise container paths
+ * @returns {object|undefined} record
+ */
+export declare function certRecordFromTrustInspector(material: object, context?: object): object | undefined;
+/**
+ * Build a certificate record from a parsed certificate (Node fallback path).
+ * The DER walk supplies the SPKI, algorithm OIDs, version and key
+ * identifiers; the X509Certificate supplies names, validity and, on runtimes
+ * that expose them, the signature algorithm. Fields the platform cannot
+ * provide (key usage bits, path length) stay unset and are documented as
+ * fallback limits.
+ *
+ * @param {Buffer} der certificate DER
+ * @param {object} context `{location, sourceType, pem}`
+ * @returns {object|undefined} record
+ */
+export declare function certRecordFromDer(der: Buffer, context?: object): object | undefined;
+export declare function toWellFormedText(value: any): string | undefined;
+/**
+ * Normalise one certificate of the chain a server presented in a TLS ≤ 1.2
+ * handshake, as safer-exec's crypto result relays it (leaf first). The entry
+ * carries no DER: identity is the two SHA-256 digests, and the server's
+ * ordering is untrusted input, so the record carries no issuer edges and no
+ * SKI/AKI. Fields safer-exec already classified per PLAN section 2.5
+ * (selfSigned, keyName, signatureAlgorithm) are taken as given; `role` is
+ * re-derived from them with the same rule as the DER path.
+ *
+ * @param {object} entry safer-exec CertChainEntry
+ * @param {object} [context] `{host}` the safer-exec `host:port` the chain was
+ *   presented to; the occurrence `tls://<host>` is omitted without it
+ * @returns {object|undefined} record, or undefined when the entry has no
+ *   usable certificate hash
+ */
+export declare function certRecordFromObservedChainEntry(entry: object, context?: object): object | undefined;
+/**
+ * Pairwise issuer linking over records parsed in one collection
+ * (`certRecordFromDer` output). A verified edge needs the signature to check;
+ * an uncheckable signature over chained names and key identifiers goes to
+ * issuersUnverified. Capped at ISSUER_LINK_LIMIT certificates.
+ *
+ * @param {object[]} records records from certRecordFromDer
+ */
+export declare function linkFallbackIssuers(records: object[]): void;
+/**
+ * Relativise a host path against a scan root so producers agree on
+ * locations: `/tmp/x/rootfs/etc/ssl` with root `/tmp/x/rootfs` becomes
+ * `/etc/ssl` (PLAN section 4.4, G18).
+ *
+ * @param {string} location host or already-relative path
+ * @param {string} [root] scan root to strip
+ * @returns {string} normalised container-style path
+ */
+export declare function containerRelativePath(location: string, root?: string): string;
+/**
+ * Collects certificate records from any producer, deduplicates them by
+ * certificate SHA-256 and builds the shared component model: one certificate
+ * component per certificate, one public-key component per SPKI, algorithm
+ * components, and verified issuer `dependsOn` edges.
+ */
+export declare class CertificateCollector {
+    recordsBySha: Map<any, any>;
+    pins: any[];
+    constructor();
+    addRecord(record: any): void;
+    addRecords(records: any): void;
+    addTrustInspectorMaterials(materials: any, context: any): void;
+    addPin({ spkiSha256, location }: {
+        location: any;
+        spkiSha256: any;
+    }): void;
+    /**
+     * Build the shared model. Deterministic: components and dependency lists
+     * are sorted, and no map iteration order reaches the output.
+     *
+     * @returns {{components: object[], dependencies: object[]}}
+     */
+    build(): {
+        components: object[];
+        dependencies: object[];
+    };
+}
+/**
+ * The file a certificate occurrence lives in. A Kubernetes secret occurrence
+ * is `<file>#data.tls.crt` (or `#stringData.ca.crt`); the file path is what
+ * internal:SrcFile records.
+ *
+ * @param {string} location occurrence location
+ * @returns {string} file path without the secret key fragment
+ */
+export declare function srcFileOfLocation(location: string): string;
+/**
+ * Merge already-built certificate/public-key components that describe the
+ * same asset (same bom-ref), unioning occurrences and properties. Used at the
+ * final assembly step where producer component lists meet.
+ *
+ * @param {object[]} components component list, possibly with crypto duplicates
+ * @returns {object[]} component list with certificate duplicates merged
+ */
+export declare function mergeDuplicateCryptoComponents(components: object[]): object[];
+export declare function kubernetesTlsSecretRecords(yamlText: any, { file }?: {}): object[];
+export declare function androidNetworkSecurityConfigPins(xmlText: any, { file }?: {}): any[];
+/**
+ * Classify a matched file by its content: certificates (PEM bundle or DER),
+ * a PEM private-key header, a GPG key, a PEM public key, or a keystore
+ * container the fallback cannot read. Nothing is decoded beyond what the
+ * header lines and a bounded DER walk reveal.
+ *
+ * @param {Buffer} bytes file contents (already size-capped by the caller)
+ * @returns {object} one of `{kind:"certificates", ders}`,
+ *   `{kind:"private-key", format}`, `{kind:"gpg"}`, `{kind:"public-key"}`,
+ *   `{kind:"keystore", format}` or `{kind:"unknown"}`
+ */
+export declare function classifyCryptoFile(bytes: Buffer): object;
+//# sourceMappingURL=certificates.d.ts.map

package/types/lib/inventory/certificates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificates.d.ts","sourceRoot":"","sources":["../../../lib/inventory/certificates.js"],"names":[],"mappings":"AAsIA,wBAAgB,UAAU,CAAC,KAAK,KAAA,OAE/B;AAWD,wBAAgB,kBAAkB,CAAC,KAAK,KAAA,sBASvC;AAED,wBAAgB,kBAAkB,CAAC,KAAK,KAAA,sBASvC;AAMD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAHxB,MAGwB,GAFtB;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,EAAE,CA+B3C;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAHjC,MAGiC,GAF/B,MAAM,EAAE,CAqBpB;AAcD,wBAAgB,mBAAmB,CAAC,IAAI,KAAA,8EAqBvC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAHzB,MAGyB,GAFvB,OAAO,CAInB;AA+FD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CA0H5B;AA4GD;;;;;;;;;GASG;AACH;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAmB5B;AAED,wBAAgB,gBAAgB,CAAC,OAAO,KAAA,OA6BvC;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAY5B;AAUD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAJnC,MAImC,GAFjC,MAAM,CAelB;AAwCD,wBAAgB,gBAAgB,CAAC,EAAE,KAAA,sBAoBlC;AA0FD;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAJ1C,MAI0C,EAAE,OAAO,AAH3D,CACA,EADQ,MAGwD,GAFtD,MAAM,GAAC,SAAS,CA0H5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAJ1B,MAI0B,EAAE,OAAO,GAHnC,MAGwC,GAFtC,MAAM,GAAC,SAAS,CA6F5B;AAMD,wBAAgB,gBAAgB,CAAC,KAAK,KAAA,sBAErC;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,EAN3C,MAM2C,EAAE,OAAO,AAL5D,CAEA,EAFQ,MAKyD,GAHvD,MAAM,GAAC,SAAS,CAkE5B;AAqDD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAFhC,MAAM,EAE0B,QA0C1C;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAJnC,MAImC,EAAE,IAAI,AAHjD,CACA,EADQ,MAGyC,GAFvC,MAAM,CAuBlB;AAqaD;;;;;GAKG;AACH,qBAAa,oBAAoB;IAExB,YAAY;IACZ,IAAI;IAFX,cAGC;IAED,SAAS,CAAC,MAAM,KAAA,QAUf;IAED,UAAU,CAAC,OAAO,KAAA,QAIjB;IAED,0BAA0B,CAAC,SAAS,KAAA,EAAE,OAAO,KAAA,QAI5C;IAED,MAAM,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE;;;KAAA,QAK9B;IAED;;;;;OAKG;IACH,KAAK,IAFQ;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAA;KAAC,CA8J1D;CACF;AAYD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,CASlB;AAsCD;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,EAH9C,MAAM,EAGwC,GAF5C,MAAM,EAAE,CAyEpB;AA6BD,wBAAgB,0BAA0B,CAAC,QAAQ,KAAA,EAAE,EAAE,IAAI,EAAE,KAAK,YAwDjE;AAKD,wBAAgB,gCAAgC,CAAC,OAAO,KAAA,EAAE,EAAE,IAAI,EAAE,KAAK,SAuDtE;AA+CD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAL7B,MAK6B,GAJ3B,MAAM,CAoDlB"}

package/types/lib/inventory/communityAiConfigParser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"communityAiConfigParser.d.ts","sourceRoot":"","sources":["../../../lib/inventory/communityAiConfigParser.js"],"names":[],"mappings":"AA21BA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,EAL1B,MAsGT,CAAC"}
+{"version":3,"file":"communityAiConfigParser.d.ts","sourceRoot":"","sources":["../../../lib/inventory/communityAiConfigParser.js"],"names":[],"mappings":"AAs1BA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,EAL1B,MAsGT,CAAC"}

package/types/lib/inventory/deps.d.ts

@@ -9,7 +9,8 @@ export declare function isDocumentationJar(jarName: string): boolean;
  * Collect maven dependencies
  *
  * @param {string} mavenCmd Maven command to use
- * @param {string} basePath Path to the maven project
+ * @param {string} basePath Path to the maven project. Without it Maven is not
+ *   run, and only the local repository is read when includeCacheDir is set.
  * @param {boolean} cleanup Remove temporary directories
  * @param {boolean} includeCacheDir Include maven and gradle cache directories
  */

package/types/lib/inventory/deps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deps.d.ts","sourceRoot":"","sources":["../../../lib/inventory/deps.js"],"names":[],"mappings":"AA+BA;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B,OAAO,CAInB;AA0DD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EANC,MAMD,EACR,QAAQ,EANC,MAMD,EACR,OAAO,GANE,OAMK,EACd,eAAe,GANN,OAMc,eA2ExB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAL/B,MAK+B,EAAE,UAAU,GAJ3C,MAIgD,eA4I1D;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,YAAY,EAH9C,MAG8C,GAF5C,OAAO,CAAC,MAAM,EAAE,CAAC,CAgE7B;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,UAAU,KAAA,GAFzB,MAAM,CAkClB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAHjC,MAGiC,GAF/B,MAAM,CA0BlB;AAgBD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,GAH1C,MAG+C,GAF7C,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAJ7B,MAI6B,EAAE,IAAI,EAHnC,MAGmC,GAFjC,MAAM,CAqBlB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAHrC,MAGqC,GAFnC,MAAM,CAiBlB;AACD;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAL1C,MAK0C,EAAE,OAAO,AAJ3D,CAEA,EAFQ,MAI+D,UAEzE;AAqID;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CA4BpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EALzC,MAKyC,EAAE,OAAO,AAJ1D,CACA,EADQ,MAI8D,GAH5D;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAe3D;AA4BD;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAJ1C,MAI0C,EAAE,WAAW,EAHvD;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAGU,GAFrD,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAAS,CAAC,CAgFlG;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAPE,MAOF,EACP,WAAW,EAPF,MAOE,EACX,eAAe,GAPN,MAOgB,GALd,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA4CrC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EARE,MAQF,EACP,YAAY,EARH,MAQG,EACZ,EAAE,eAAyB,EAAE,aAA+B,EAAE,AAR7D,CAGA,EAFA;IAAsB,eAAe,AAArC,CACA,EADQ,MAAM,CACd;IAAsB,aAAa,AAAnC,CACA,EADQ,MAAM,CACd;CAKkE,GALxD,OAAO,CAAC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,CAAC,CAAC,CAkDxD;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAJhC,MAIgC,gBAqE1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,eAAe,EANhC,MAMgC,EAAE,OAAO,EALzC,MAAM,EAKmC,EAAE,cAAc,EAJzD,MAIyD,EAAE,CAAC,EAH5D,MAG4D,GAF1D,IAAI,CAqDhB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAJtB,MAAM,GAAC,MAIe,EAAE,CAAC,EAHzB,MAAM,GAAC,MAGkB,GAFvB,MAAM,CAWlB"}
+{"version":3,"file":"deps.d.ts","sourceRoot":"","sources":["../../../lib/inventory/deps.js"],"names":[],"mappings":"AAoCA;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B,OAAO,CAInB;AA0DD;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAPC,MAOD,EACR,QAAQ,EAPC,MAOD,EACR,OAAO,GANE,OAMK,EACd,eAAe,GANN,OAMc,eA6ExB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAL/B,MAK+B,EAAE,UAAU,GAJ3C,MAIgD,eA4I1D;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,YAAY,EAH9C,MAG8C,GAF5C,OAAO,CAAC,MAAM,EAAE,CAAC,CAgE7B;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,UAAU,KAAA,GAFzB,MAAM,CAkClB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAHjC,MAGiC,GAF/B,MAAM,CA0BlB;AAgBD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,GAH1C,MAG+C,GAF7C,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAJ7B,MAI6B,EAAE,IAAI,EAHnC,MAGmC,GAFjC,MAAM,CAqBlB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAHrC,MAGqC,GAFnC,MAAM,CAiBlB;AACD;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAL1C,MAK0C,EAAE,OAAO,AAJ3D,CAEA,EAFQ,MAI+D,UAEzE;AAqID;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CA4BpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EALzC,MAKyC,EAAE,OAAO,AAJ1D,CACA,EADQ,MAI8D,GAH5D;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAe3D;AA4BD;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAJ1C,MAI0C,EAAE,WAAW,EAHvD;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAGU,GAFrD,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAAS,CAAC,CAgFlG;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAPE,MAOF,EACP,WAAW,EAPF,MAOE,EACX,eAAe,GAPN,MAOgB,GALd,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA4CrC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EARE,MAQF,EACP,YAAY,EARH,MAQG,EACZ,EAAE,eAAyB,EAAE,aAA+B,EAAE,AAR7D,CAGA,EAFA;IAAsB,eAAe,AAArC,CACA,EADQ,MAAM,CACd;IAAsB,aAAa,AAAnC,CACA,EADQ,MAAM,CACd;CAKkE,GALxD,OAAO,CAAC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,CAAC,CAAC,CAkDxD;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAJhC,MAIgC,gBAqE1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,eAAe,EANhC,MAMgC,EAAE,OAAO,EALzC,MAAM,EAKmC,EAAE,cAAc,EAJzD,MAIyD,EAAE,CAAC,EAH5D,MAG4D,GAF1D,IAAI,CAqDhB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAJtB,MAAM,GAAC,MAIe,EAAE,CAAC,EAHzB,MAAM,GAAC,MAGkB,GAFvB,MAAM,CAWlB"}

package/types/lib/inventory/display.d.ts

@@ -224,4 +224,22 @@ export declare function printEnvironmentAuditFindings(envAuditFindings?: EnvAudi
  * @param {EnvAuditFinding[]} envAuditFindings Audit findings to display
  */
 export declare function displaySelfThreatModel(filePath: string, config: Object, options: Object, envAuditFindings: EnvAuditFinding[]): void;
+/**
+ * Print a table of the BOM's certificate components: role, name, issuer,
+ * expiry, the SPKI prefix and how many locations each certificate appears
+ * in, with a marker when the audit flagged it.
+ *
+ * @param {Object} bomJson CycloneDX BOM JSON object
+ * @returns {void}
+ */
+export declare function printCertificatesTable(bomJson: Object): void;
+/**
+ * Print the issuer chain above a certificate and the certificates issued
+ * under it, walking the verified `dependsOn` edges.
+ *
+ * @param {Object} bomJson CycloneDX BOM JSON object
+ * @param {string} selector bom-ref, SPKI hex prefix or certificate ref prefix
+ * @returns {void}
+ */
+export declare function printCertificateChain(bomJson: Object, selector: string): void;
 //# sourceMappingURL=display.d.ts.map

package/types/lib/inventory/display.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"display.d.ts","sourceRoot":"","sources":["../../../lib/inventory/display.js"],"names":[],"mappings":"AAwKA;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAkFpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAHpC,MAGoC,GAFlC,MAAM,EAAE,CA2CpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAyBpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAwBpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,YANxB,MAAM,eACN,MAAM,EAAE,GAAC,SAAS,eAClB,MAAM,GAAC,SAAS,6BAChB,MAAM,KACJ,MAAM,EAkGlB,CAAC;AAqNF;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,iBAHhC,MAAM,EAAE,KACN,MAAM,EAclB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAJ3C,MAAM,EAIqC,EAAE,UAAU,AAH/D,CACA,EADQ,OAGkE,GAFhE,MAAM,CAsBlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAND,MAAM,EAML,EACV,UAAU,AANT,CACA,EADQ,MAMU,EACnB,UAAU,AANT,CACA,EADQ,OAMY,GALV,MAAM,EAAE,CA8BpB;AA6BD;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAPE,MAOF,EACP,WAAW,AAPV,CACA,EADQ,MAAM,EAOQ,EACvB,SAAS,AAPR,CACA,EADQ,MAOY,EACrB,WAAW,AAPV,CACA,EADQ,MAOc,GANZ,IAAI,CA+EhB;AAQD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAHzB,MAGyB,GAFvB,IAAI,CAsBhB;AACD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,IAAI,CAwBhB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,IAAI,CAuBhB;AA0BD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,IAAI,CAwChB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,GAFzB,IAAI,CA+ChB;AACD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EANE,MAMF,EACP,IAAI,AANH,CACA,EADQ,MAMS,EAClB,SAAS,AANR,CACA,EADQ,MAMY,GALV,IAAI,CAoChB;AAkJD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,iBAJ1B,MAAM,EAAE,SACR,MAAM,KACJ,MAAM,EAyClB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,cAAc,EAHnC,MAGmC,GAFjC,IAAI,CAmChB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,eAAe,EAHzC,MAAM,EAGmC,GAFvC,IAAI,CA4BhB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B,IAAI,CAwBhB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAHzB,MAGyB,GAFvB,IAAI,CAsDhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,AAH5C,CACA,EADQ,MAGgD,GAF9C,IAAI,CAwHhB;AAGE,YAAmG,eAAe,GAAxG;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAC,CAAiB;AA6DrH;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,gBAAgB,GAHnD,eAAe,EAGyC,GAFtD,IAAI,CA+BhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EANC,MAMD,EACR,MAAM,EANG,MAMH,EACN,OAAO,EANE,MAMF,EACP,gBAAgB,EANP,eAAe,EAMR,QAgUjB"}
+{"version":3,"file":"display.d.ts","sourceRoot":"","sources":["../../../lib/inventory/display.js"],"names":[],"mappings":"AAyKA;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAkFpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAHpC,MAGoC,GAFlC,MAAM,EAAE,CA2CpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAyBpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAwBpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,YANxB,MAAM,eACN,MAAM,EAAE,GAAC,SAAS,eAClB,MAAM,GAAC,SAAS,6BAChB,MAAM,KACJ,MAAM,EAoGlB,CAAC;AAyNF;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,iBAHhC,MAAM,EAAE,KACN,MAAM,EAclB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAJ3C,MAAM,EAIqC,EAAE,UAAU,AAH/D,CACA,EADQ,OAGkE,GAFhE,MAAM,CAsBlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAND,MAAM,EAML,EACV,UAAU,AANT,CACA,EADQ,MAMU,EACnB,UAAU,AANT,CACA,EADQ,OAMY,GALV,MAAM,EAAE,CA8BpB;AA6BD;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAPE,MAOF,EACP,WAAW,AAPV,CACA,EADQ,MAAM,EAOQ,EACvB,SAAS,AAPR,CACA,EADQ,MAOY,EACrB,WAAW,AAPV,CACA,EADQ,MAOc,GANZ,IAAI,CAoFhB;AAQD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAHzB,MAGyB,GAFvB,IAAI,CAsBhB;AACD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,IAAI,CAwBhB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,IAAI,CAuBhB;AAgCD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,IAAI,CAwChB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,GAFzB,IAAI,CA+ChB;AACD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EANE,MAMF,EACP,IAAI,AANH,CACA,EADQ,MAMS,EAClB,SAAS,AANR,CACA,EADQ,MAMY,GALV,IAAI,CAoChB;AAkJD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,iBAJ1B,MAAM,EAAE,SACR,MAAM,KACJ,MAAM,EAyClB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,cAAc,EAHnC,MAGmC,GAFjC,IAAI,CAmChB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,eAAe,EAHzC,MAAM,EAGmC,GAFvC,IAAI,CA4BhB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B,IAAI,CAwBhB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAHzB,MAGyB,GAFvB,IAAI,CAsDhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,AAH5C,CACA,EADQ,MAGgD,GAF9C,IAAI,CAwHhB;AAGE,YAAmG,eAAe,GAAxG;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAC,CAAiB;AA6DrH;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,gBAAgB,GAHnD,eAAe,EAGyC,GAFtD,IAAI,CA+BhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EANC,MAMD,EACR,MAAM,EANG,MAMH,EACN,OAAO,EANE,MAMF,EACP,gBAAgB,EANP,eAAe,EAMR,QAgUjB;AAiCD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,IAAI,CAkDhB;AAUD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAJlC,MAIkC,EAAE,QAAQ,EAH5C,MAG4C,GAF1C,IAAI,CA0EhB"}

package/types/lib/inventory/dosai.d.ts

@@ -1,3 +1,41 @@
+/**
+ * The .NET runtime a framework-dependent dosai needs, read from the error the
+ * .NET host prints when it refuses to start dosai.
+ *
+ * When an older runtime is installed, the host names the exact framework
+ * version it looked for. When it finds no .NET at all, it names only its own
+ * version. The app host comes from the pack of the runtime the app targets, so
+ * its major version is still the .NET release to install.
+ *
+ * @param {Object|string} resultOrOutput spawnSync result, or the text it printed
+ * @returns {{version: (string|undefined), major: (string|undefined)}|undefined}
+ *   The framework version, when the host named it, and the .NET major version;
+ *   undefined when the output is not a .NET host launch failure
+ */
+export declare function dosaiDotnetRequirement(resultOrOutput: Object | string): {
+    version: (string | undefined);
+    major: (string | undefined);
+} | undefined;
+/**
+ * What stopped dosai from starting, for warnings and ledger details.
+ *
+ * @param {{version: (string|undefined), major: (string|undefined)}} [requirement] Result of dosaiDotnetRequirement
+ * @returns {string} A clause naming the missing .NET runtime when it is known
+ */
+export declare function dosaiDotnetRequirementDetail(requirement?: {
+    version: (string | undefined);
+    major: (string | undefined);
+}): string;
+/**
+ * How to get dosai running when the .NET host refused to start it.
+ *
+ * @param {{version: (string|undefined), major: (string|undefined)}} [requirement] Result of dosaiDotnetRequirement
+ * @returns {string} Install instructions, naming the .NET major version when it is known
+ */
+export declare function dosaiDotnetRequirementAdvice(requirement?: {
+    version: (string | undefined);
+    major: (string | undefined);
+}): string;
 /**
  * Translate cdxgen --exclude globs into dosai --exclude globs.
  *
@@ -41,24 +79,89 @@ export declare function isDosaiDotnetLanguage(language: string): boolean;
  * @returns {Object|undefined} Parsed JSON content, or undefined when missing or invalid
  */
 export declare function readDosaiJsonFile(jsonFile: string): Object | undefined;
+/**
+ * The `--sections` value that writes exactly the sections cdxgen reads.
+ *
+ * Passed as `dosaiMethodsSections` by callers that know their run will not
+ * need the whole report (see {@link runsEvidenceAnalysis}); an older dosai
+ * that rejects `--sections` falls back to the full report on its own.
+ *
+ * @returns {string} Comma-separated section list for dosai `--sections`
+ */
+export declare function dosaiMethodsSectionsArgument(): string;
+/**
+ * Whether this scan will run the evidence (evinse) analysis.
+ *
+ * One place answers for both the trim decision in `createCsharpBom` and the
+ * evinse gate in `bin/cdxgen.js`: `--evidence` alone runs it, and so does
+ * `--include-crypto` alone, after profiles are applied (`--profile research`
+ * turns on both). Testing `options.evidence` alone would trim a report that
+ * `--include-crypto` then needs full.
+ *
+ * @param {Object} options Scan options after profile expansion
+ * @returns {boolean} True when the scan will run evinse
+ */
+export declare function runsEvidenceAnalysis(options: Object): boolean;
+/**
+ * The top-level sections a dosai methods report left out, empty for a full
+ * report. dosai v4 reports have no `OmittedSections`, so they count as full.
+ *
+ * @param {Object} [report] A dosai methods report as read by readDosaiMethodsReport
+ * @returns {string[]} The omitted section names
+ */
+export declare function dosaiOmittedSections(report?: Object): string[];
+/**
+ * The top-level sections a dosai methods report file left out, read from its
+ * Metadata alone. dosai writes Metadata first, so this reads only the head of
+ * the file, however large the report is. A missing or unreadable file counts
+ * as full: the read that follows reports it.
+ *
+ * @param {string} reportFile Path to the dosai methods JSON
+ * @returns {string[]} The omitted section names
+ */
+export declare function dosaiReportFileOmittedSections(reportFile: string): string[];
+/**
+ * The omitted sections of a dosai methods report that cdxgen reads, so the
+ * evidence built from the report lacks their input.
+ *
+ * @param {string[]} omittedSections Sections the report left out
+ * @returns {string[]} The ones cdxgen reads
+ */
+export declare function dosaiSectionsCdxgenReads(omittedSections: string[]): string[];
+/**
+ * The largest number of distinct method calls cdxgen keeps from one report.
+ *
+ * Reports in the millions of calls repeat the same call sites heavily, so the
+ * aggregated rows stay far below this; the cap exists so a report whose calls
+ * are all distinct degrades the occurrence evidence instead of the process.
+ *
+ * @returns {number} Cap on distinct kept rows
+ */
+export declare function maxDosaiMethodCalls(): number;
 /**
  * Read a dosai methods report of any size.
  *
  * A report that fits in one JavaScript string is parsed whole. A larger one is
  * read in bounded runs, keeping the requested sections, the CallGraph nodes and
  * edges that PackageReachability references, and the MethodCalls accepted by
- * `keepMethodCall` (none when it is omitted). Nothing cdxgen reads is lost.
+ * `keepMethodCall` (none when it is omitted). A kept MethodCalls row is
+ * reduced to the fields cdxgen reads and aggregated by them, so a call site
+ * reached many times is held once with a `CallCount`; distinct rows past
+ * {@link maxDosaiMethodCalls} are dropped with one warning. Nothing cdxgen
+ * reads is lost.
  *
  * @param {string} reportFile Path to the dosai methods JSON
  * @param {Object} [options] Options
  * @param {string[]} [options.sections] Sections to keep from a large report (default: every section cdxgen reads)
  * @param {Function} [options.keepMethodCall] Predicate choosing the MethodCalls to keep from a large report
+ * @param {number} [options.maxMethodCalls] Cap on distinct kept MethodCalls, for tests
  * @param {number} [options.maxTextBytes] Largest report parsed whole, for tests
  * @returns {Object|undefined} Parsed report, or undefined when missing or invalid
  */
 export declare function readDosaiMethodsReport(reportFile: string, options?: {
     sections?: string[];
     keepMethodCall?: Function;
+    maxMethodCalls?: number;
     maxTextBytes?: number;
 }): Object | undefined;
 /**
@@ -97,6 +200,13 @@ export declare function dosaiRunTimedOut(result: Object): boolean;
  * @returns {"timeout"|"buffer"|"signal"|undefined} Why the run was stopped, or undefined when it ended by itself
  */
 export declare function dosaiRunStopReason(result: Object): "timeout" | "buffer" | "signal" | undefined;
+/**
+ * Note that the .NET host's refusal to start a dosai executable has been
+ * reported, so dosai runs of the same executable do not repeat the warning.
+ *
+ * @param {string} executable dosai executable
+ */
+export declare function markDosaiLaunchFailureReported(executable: string): void;
 /**
  * Whether the dosai run that should have written a file was stopped (by the
  * time limit, the output buffer limit, or a signal) and already reported so.
@@ -105,14 +215,30 @@ export declare function dosaiRunStopReason(result: Object): "timeout" | "buffer"
  * @returns {boolean} true when the run was stopped
  */
 export declare function dosaiRunWasStopped(outputFile: string): boolean;
+/**
+ * Whether the dosai run that should have written a file failed in a way it has
+ * already reported: it was stopped (see dosaiRunWasStopped), or the .NET host
+ * refused to start dosai and the warning named the missing runtime.
+ *
+ * @param {string} outputFile Output file passed to the dosai run
+ * @returns {boolean} true when the failure has been reported
+ */
+export declare function dosaiFailureReported(outputFile: string): boolean;
 /**
  * Run a dosai subcommand ("methods", "dataflows", or "crypto") against a source
  * tree and write its JSON output to the given file.
  *
+ * Flags cdxgen adds for its own benefit that an older dosai may not know
+ * (--exclude, --sections, --crypto-dataflows) are optional: when dosai reports
+ * them as unknown, every rejected one is dropped in a single retry, later runs
+ * of the same executable skip them up front, and dropping is reported once
+ * (a warning for --exclude, whose loss changes results; a debug line for the
+ * size-only flags). A run that rejects anything else has simply failed.
+ *
  * @param {string} command Dosai subcommand to execute
  * @param {string} src Source directory to analyze
  * @param {string} outputFile Path where the dosai JSON output is written
- * @param {Object} [options] Options carrying dosaiCommand, dataFlowPatterns, patternPacks, or exclude globs
+ * @param {Object} [options] Options carrying dosaiCommand, dataFlowPatterns, patternPacks, exclude globs, or dosaiMethodsSections
  * @returns {boolean} True when the command succeeded and produced the output file, false otherwise
  */
 export declare function runDosaiCommand(command: string, src: string, outputFile: string, options?: Object): boolean;
@@ -121,7 +247,7 @@ export declare function runDosaiCommand(command: string, src: string, outputFile
  *
  * @param {string} src Source directory to analyze
  * @param {string} outputFile Path where the methods slice JSON is written
- * @param {Object} [options] Options forwarded to runDosaiCommand
+ * @param {Object} [options] Options forwarded to runDosaiCommand; `dosaiMethodsSections` names the top-level sections to write (see dosaiMethodsSectionsArgument), omitted for the full report
  * @returns {boolean} True when the slice was produced successfully
  */
 export declare function createDosaiMethodsSlice(src: string, outputFile: string, options?: Object): boolean;
@@ -151,6 +277,27 @@ export declare function createDosaiCryptoAnalysis(src: string, outputFile: strin
  * @returns {Object|undefined} Parsed crypto analysis JSON, or undefined when the analysis fails
  */
 export declare function analyzeDosaiCrypto(src: string, options?: Object): Object | undefined;
+/**
+ * The tool component naming the dosai behind a methods report.
+ *
+ * A report that a dosai run of this process wrote names the executable that
+ * wrote it, with the version that executable reports. A report reused from an
+ * earlier run names the version recorded in its Metadata, or the configured
+ * dosai's own version when that is a build of the same release. No component
+ * is returned for a report that is missing or that no dosai wrote, such as
+ * when the .NET host refused to start dosai.
+ *
+ * The cdxgen-plugins-bin manifest component is returned as-is only for its
+ * own binary at its own version. Any other dosai gets a component built from
+ * the manifest's project fields (description, licenses, references), without
+ * the bundled binary's hashes or path.
+ *
+ * @param {string} reportFile Path of the dosai methods report
+ * @param {Object} [report] The report as read, for its Metadata
+ * @param {Object} [manifestComponent] dosai component of the cdxgen-plugins-bin manifest
+ * @returns {Object[]} The dosai tool component, or an empty array
+ */
+export declare function dosaiToolComponents(reportFile: string, report?: Object, manifestComponent?: Object): Object[];
 /**
  * Persist the combined native dosai report to options.semanticsSlicesFile.
  *
@@ -158,10 +305,12 @@ export declare function analyzeDosaiCrypto(src: string, options?: Object): Objec
  * analyzeGolemProject on branch feat/rusi-persist-report): when a semantics-
  * slices path is provided, the FULL native report is written there and kept so
  * downstream tools (depscan) can consume the complete methods + data-flow
- * facts that cdxgen only projects a subset of into the SBOM evidence. dotnet
- * does not otherwise use the semantics slice (atom is never run for dotnet),
- * so the path is free to carry the combined dosai report. Returns the resolved
- * durable path when something was persisted, otherwise undefined.
+ * facts that cdxgen only projects a subset of into the SBOM evidence. A
+ * methods report the user supplied with --usages-slices-file is written as
+ * given, with a recorded degradation when it was trimmed with --sections.
+ * dotnet does not otherwise use the semantics slice (atom is never run for
+ * dotnet), so the path is free to carry the combined dosai report. Returns the
+ * resolved durable path when something was persisted, otherwise undefined.
  */
 export declare function persistDosaiSemanticsReport(options: any, methodsSlice: any, dataFlowSlice: any): any;
 /**
@@ -278,6 +427,12 @@ export declare function collectDosaiServicesFromMethods(methodsSlice: Object, se
 /**
  * Normalize a services map into a sorted array of CycloneDX service objects.
  *
+ * This is where evinse's service maps — dosai, golem, kosi, scalasem, an
+ * OpenAPI document, and the atom usage and type detectors — become
+ * `services[]`, so it is also where every endpoint is percent-encoded into the
+ * iri-reference CycloneDX requires. The collectors keep the readable template
+ * (`/users/{id}`); the BOM gets `/users/%7Bid%7D`.
+ *
  * @param {Object} [servicesMap] Map of service name to service definition with Set-backed endpoints
  * @returns {Object[]} Array of service objects with sorted endpoint arrays and properties
  */