@cdxgen/cdxgen 13.4.0 → 13.6.0

package/types/lib/inventory/nodeBuildInfo.d.ts

@@ -0,0 +1,95 @@
+/**
+ * The most node-named files one scan opens in search of a build version.
+ *
+ * @type {number}
+ */
+export declare const MAX_NODE_PROBES: number;
+/**
+ * Whether a file name is one the Node.js runtime is installed under.
+ *
+ * @param {string} fileName basename or path of the candidate
+ * @returns {boolean} true for `node`, `nodejs` and `node.exe`
+ */
+export declare function isNodeBinaryName(fileName: string): boolean;
+/**
+ * Parse a Node.js version in the grammar the release tooling produces:
+ * `24.22.1`, `25.0.0-rc.1`, `26.0.0-nightly20260301abcdef`.
+ *
+ * @param {string} text candidate version, without the leading `v`
+ * @returns {string|undefined} the version, or undefined
+ */
+export declare function parseNodeVersion(text: string): string | undefined;
+/**
+ * Read the Node.js version a `node` binary was built as.
+ *
+ * @param {string} absPath absolute path of the binary
+ * @param {string|undefined} rootDir extracted root, when the file came from one
+ * @returns {{version: string, source: string, channel?: string}|undefined}
+ *   source is `release-url` or `binary`
+ */
+export declare function readNodeBuildVersion(absPath: string, rootDir: string | undefined): {
+    version: string;
+    source: string;
+    channel?: string;
+} | undefined;
+/**
+ * The CPE that lets a downstream scanner match a Node.js version. NVD names the
+ * product node.js and keeps a pre-release in the update field.
+ *
+ * @param {string} version Node.js version
+ * @returns {string} CPE 2.3 string
+ */
+export declare function nodeCpe(version: string): string;
+/**
+ * A Node.js runtime is one `platform` component per distinct version, like the
+ * PHP and Go stdlib components. Its identity is `pkg:generic/node`: it is only
+ * used where no package manager owns the runtime.
+ *
+ * @param {string} version Node.js version
+ * @returns {Object} component with `purl`, `bom-ref` and `cpe`
+ */
+export declare function createNodeRuntimeComponent(version: string): Object;
+/**
+ * The properties a node file component carries once its build is known.
+ *
+ * @param {{version: string, source: string, channel?: string}} build result of readNodeBuildVersion
+ * @returns {{name: string, value: string}[]} properties to append
+ */
+export declare function nodeBuildProperties(build: {
+    version: string;
+    source: string;
+    channel?: string;
+}): {
+    name: string;
+    value: string;
+}[];
+/**
+ * Start collecting the runtime components and edges of one scan.
+ *
+ * @returns {{runtimeComponents: Object[], dependencies: Object[], runtimeRefs: Set<string>}}
+ */
+export declare function createNodeRuntimeInventory(): {
+    runtimeComponents: Object[];
+    dependencies: Object[];
+    runtimeRefs: Set<string>;
+};
+/**
+ * Tag a node file component with its build facts and link it to the runtime
+ * component of its version, creating that component on first use. Mutates the
+ * component in place.
+ *
+ * @param {{runtimeComponents: Object[], dependencies: Object[], runtimeRefs: Set<string>}} inventory
+ *   accumulator from createNodeRuntimeInventory
+ * @param {Object} component file component, with a `properties` array
+ * @param {{version: string, source: string, channel?: string}} build result of readNodeBuildVersion
+ */
+export declare function attachNodeBuild(inventory: {
+    runtimeComponents: Object[];
+    dependencies: Object[];
+    runtimeRefs: Set<string>;
+}, component: Object, build: {
+    version: string;
+    source: string;
+    channel?: string;
+}): void;
+//# sourceMappingURL=nodeBuildInfo.d.ts.map

package/types/lib/inventory/nodeBuildInfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nodeBuildInfo.d.ts","sourceRoot":"","sources":["../../../lib/inventory/nodeBuildInfo.js"],"names":[],"mappings":"AAgCA;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAFlB,MAEuB,CAAC;AAElC;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAH9B,MAG8B,GAF5B,OAAO,CAQnB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAH1B,MAG0B,GAFxB,MAAM,GAAC,SAAS,CAO5B;AA6BD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EALjC,MAKiC,EAAE,OAAO,EAJ1C,MAAM,GAAC,SAImC,GAHxC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CA+BzE;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAHpB,MAGoB,GAFlB,MAAM,CASlB;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAHvC,MAGuC,GAFrC,MAAM,CAOlB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAH9B;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAGpB,GAF5B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAW3C;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAF7B;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAC,CAI3F;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAL9B;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAKhD,EAAE,SAAS,EAHzC,MAGyC,EAAE,KAAK,EAFhD;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAEF,QAkB1D"}

package/types/lib/inventory/nodeHostProbe.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Look for Node.js no package manager owns on the host. Components come back
+ * only for the files nothing owns: a `file` component for each `node` binary
+ * with the cdx:node and cdx:brotli properties, one `platform` component per
+ * Node.js version with its CPE, and the brotli component when a binary embeds
+ * a decoder.
+ *
+ * @param {Object} [options] probe options, as probeHostPhp takes them
+ * @returns {{components: Object[], dependencies: Object[]}}
+ */
+export declare function probeHostNode(options?: Object): {
+    components: Object[];
+    dependencies: Object[];
+};
+//# sourceMappingURL=nodeHostProbe.d.ts.map

package/types/lib/inventory/nodeHostProbe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nodeHostProbe.d.ts","sourceRoot":"","sources":["../../../lib/inventory/nodeHostProbe.js"],"names":[],"mappings":"AA2JA;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,OAAO,AAHlC,CACA,EADQ,MAG+B,GAF7B;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAsC1D"}

package/types/lib/inventory/osPackagePurl.d.ts

@@ -0,0 +1,99 @@
+/**
+ * The purl types an OS scan builds from what a package manager reports.
+ * deb, rpm, apk and alpm belong to a distro; brew, macports, snap and flatpak
+ * belong to none. brew, macports, snap and flatpak are not purl-spec types;
+ * cdx-purl builds them as it builds `pkg:chocolatey`.
+ */
+export declare const OS_PACKAGE_PURL_TYPES: Set<string>;
+/**
+ * Whether a purl type is one of the OS package managers handled here.
+ *
+ * @param {string|undefined} type Purl type
+ * @returns {boolean} true for the types in OS_PACKAGE_PURL_TYPES
+ */
+export declare function isOsPackagePurlType(type: string | undefined): boolean;
+/**
+ * Whether a value names an architecture. rpm says `(none)` and trivy says
+ * `None` for a package that has none, such as an rpm's `gpg-pubkey` key record;
+ * neither is an architecture, and neither belongs in a purl.
+ *
+ * @param {string|undefined|null} arch Architecture as a package manager reports it
+ * @returns {boolean} true for a real architecture
+ */
+export declare function isRealArchitecture(arch: string | undefined | null): boolean;
+/**
+ * The epoch of an OS package, as the `epoch` qualifier carries it.
+ *
+ * An rpm keeps its epoch in a field of its own. A deb keeps it in its version
+ * (`2:93`), so the version is read first. Epoch 0 and no epoch are the same,
+ * and apk and Homebrew packages have none.
+ *
+ * @param {{type: string, version?: string, epoch?: string|number}} pkg Package
+ * @returns {string|undefined} The epoch without leading zeros, or undefined
+ */
+export declare function osPackageEpoch(pkg: {
+    type: string;
+    version?: string;
+    epoch?: string | number;
+}): string | undefined;
+/**
+ * The version an OS package carries on its component and in its purl.
+ *
+ * - rpm: `[epoch:]version-release`, the form the container scan writes. The
+ *   purl spec keeps the epoch out of an rpm version, but the container scan
+ *   puts it in the version as well as in the `epoch` qualifier, and an OBOM must
+ *   name the package the same way.
+ * - deb: the version exactly as dpkg reports it, epoch included.
+ * - macports: `version_revision`, the form `port installed` prints.
+ * - apk, alpm, brew, snap and flatpak: the version as it is. A pacman version
+ *   already holds its epoch and release (`1:1.3.2-4`).
+ *
+ * @param {{type: string, version?: string, release?: string, epoch?: string|number, revision?: string|number}} pkg Package
+ * @returns {string} The version, or an empty string when the package has none
+ */
+export declare function osPackageVersion(pkg: {
+    type: string;
+    version?: string;
+    release?: string;
+    epoch?: string | number;
+    revision?: string | number;
+}): string;
+/**
+ * Build the purl of an OS package.
+ *
+ * deb, rpm and apk purls take their vendor (`ubuntu`, `almalinux`, `alpine`,
+ * `wolfi`) and the `distro` and `distro_name` qualifiers from the distro, plus
+ * `arch` and `epoch` from the package. alpm purls take the vendor (`arch`,
+ * `manjaro`) and `arch` only: that is all the alpm type defines, and an Arch
+ * system is rolling, with no release to name. A qualifier with no value is
+ * left out. brew, macports and snap purls carry neither vendor nor qualifiers;
+ * a flatpak purl carries the `arch` and `branch` of the flatpak ref.
+ *
+ * @param {Object} pkg The package
+ * @param {string} pkg.type One of OS_PACKAGE_PURL_TYPES
+ * @param {string} pkg.name Package name; a flatpak's application ID
+ * @param {string} [pkg.version] deb: the dpkg version. rpm: the version tag only. apk: version-rN. macports: the version without its revision.
+ * @param {string} [pkg.release] rpm release tag
+ * @param {string|number} [pkg.epoch] rpm epoch tag
+ * @param {string|number} [pkg.revision] MacPorts revision
+ * @param {string} [pkg.arch] Package architecture
+ * @param {string} [pkg.branch] flatpak branch (`stable`, `48`)
+ * @param {{namespace?: string, distroId?: string, distroName?: string}} [distro]
+ *   What getDistroInfo() reports; read from the host's os-release when left out
+ * @returns {string|null} The purl, or null when the parts do not form a valid one
+ */
+export declare function buildOsPackagePurl(pkg: {
+    type: string;
+    name: string;
+    version?: string;
+    release?: string;
+    epoch?: string | number;
+    revision?: string | number;
+    arch?: string;
+    branch?: string;
+}, distro?: {
+    namespace?: string;
+    distroId?: string;
+    distroName?: string;
+}): string | null;
+//# sourceMappingURL=osPackagePurl.d.ts.map

package/types/lib/inventory/osPackagePurl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"osPackagePurl.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osPackagePurl.js"],"names":[],"mappings":"AAiBA;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,aAShC,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAH7B,MAAM,GAAC,SAGsB,GAF3B,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAH5B,MAAM,GAAC,SAAS,GAAC,IAGW,GAF1B,OAAO,CAKnB;AAqCD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAC,MAAM,CAAA;CAG/B,GAFrB,MAAM,GAAC,SAAS,CAe5B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAHzB;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAC,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,GAAC,MAAM,CAAA;CAGzE,GAFvB,MAAM,CA6BlB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAZnC;IAAoB,IAAI,EAAhB,MAAM,CACd;IAAoB,IAAI,EAAhB,MAAM,CACd;IAAqB,OAAO,AAA5B,CACA,EADQ,MAAM,CACd;IAAqB,OAAO,AAA5B,CACA,EADQ,MAAM,CACd;IAA4B,KAAK,AAAjC,CACA,EADQ,MAAM,GAAC,MAAM,CACrB;IAA4B,QAAQ,AAApC,CACA,EADQ,MAAM,GAAC,MAAM,CACrB;IAAqB,IAAI,AAAzB,CACA,EADQ,MAAM,CACd;IAAqB,MAAM,AAA3B,CACA,EADQ,MAAM,CACd;CAImC,EAAE,MAAM,AAJ3C,CAEA,EAFQ;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAIxB,GAFjC,MAAM,GAAC,IAAI,CA4DvB"}

package/types/lib/inventory/osPackageResolver.d.ts

@@ -7,13 +7,14 @@ export declare function _resetOsInfoCache(): void;
  * correctly computed purl with distro qualifiers derived from /etc/os-release.
  *
  * @param {string} filePath - Absolute path to the library file
- * @returns {{ name: string, version: string, arch: string, type: string, purl: string } | undefined}
+ * @returns {{ name: string, version: string, arch: string, type: string, epoch?: string, purl: string } | undefined}
  */
 export declare function resolvePackageForFile(filePath: string): {
     name: string;
     version: string;
     arch: string;
     type: string;
+    epoch?: string;
     purl: string;
 } | undefined;
 /**
@@ -42,8 +43,49 @@ export declare function collectExecutables(basePath: any, binPaths: any, exclude
  * @param ldConf {String} Config file used by ldconfig to locate additional paths
  * @param ldConfDirPattern {String} Config directory that can contain more .conf files for ldconfig
  * @param excludePaths {Array[String]} Container-relative paths that should be excluded from the result set
+ * @param extraLibGlobs {Array[String]} Extra container-relative globs for files
+ *   the default paths miss, such as libphp*.so under Apache's modules
+ *   directory. The existing globs are unchanged; this adds candidates only.
  *
  * @return {Array[String]} List of executables
  */
-export declare function collectSharedLibs(basePath: any, libPaths: any, ldConf: string, ldConfDirPattern: string, excludePaths?: any): any;
+export declare function collectSharedLibs(basePath: any, libPaths: any, ldConf: string, ldConfDirPattern: string, excludePaths?: any, extraLibGlobs?: any): any;
+/**
+ * The most native extension candidates one scan returns.
+ *
+ * @type {number}
+ */
+export declare const MAX_NATIVE_EXTENSIONS: number;
+/**
+ * Collect native extension modules under a root file system that the library
+ * collector does not see, leaving out paths a package database owns and paths
+ * already collected. Symlinks are not followed, so a link pointing out of the
+ * root is never listed.
+ *
+ * @param {string} basePath extracted root file system
+ * @param {string[]} [excludePaths] root-relative paths to leave out
+ * @returns {string[]} root-relative paths, sorted, capped at MAX_NATIVE_EXTENSIONS
+ */
+export declare function collectNativeExtensions(basePath: string, excludePaths?: string[]): string[];
+/**
+ * Mark language packages that an OS package installed. Alpine's py3-brotli
+ * ships a Brotli-1.1.0.dist-info that a Python scan reports as
+ * pkg:pypi/brotli@1.1.0, but a distro fixes it by backporting under the same
+ * upstream version, so a PyPI advisory range keeps matching after the fix. The
+ * `cdx:os:installedBy` property names the OS package that owns the
+ * installation record, so a consumer can judge the component by that package
+ * instead.
+ *
+ * A component is marked only when every installation record it was read from
+ * belongs to an OS package: a copy that pip put in a virtual environment
+ * beside the distro's is not the distro's to fix. Run it after duplicates
+ * merge, so that a merged component carries all of its records.
+ *
+ * @param {Object[]} components BOM components, mutated in place
+ * @param {Map<string, string>|undefined} ownerByPath root-relative file path to
+ *   owning OS package bom-ref
+ * @param {string} [rootDir] extracted root, stripped from absolute source paths
+ * @returns {number} how many components were marked
+ */
+export declare function markOsInstalledLanguagePackages(components: Object[], ownerByPath: Map<string, string> | undefined, rootDir?: string): number;
 //# sourceMappingURL=osPackageResolver.d.ts.map

package/types/lib/inventory/osPackageResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"osPackageResolver.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osPackageResolver.js"],"names":[],"mappings":"AAwBA;;GAEG;AACH,wBAAgB,iBAAiB,SAGhC;AA8ED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA8BnG;AAoGD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAJ9B,MAI8B,EAAE,UAAU,EAH1C,MAAM,EAGoC,GAFxC,MAAM,GAAC,SAAS,CA+B5B;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,KAAA,EAAE,QAAQ,KAAA,EAAE,YAAY,MAAK,OAqEvE;AAcD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,KAAA,EACR,QAAQ,KAAA,EACR,MAAM,QAAA,EACN,gBAAgB,QAAA,EAChB,YAAY,MAAK,OA8ElB"}
+{"version":3,"file":"osPackageResolver.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osPackageResolver.js"],"names":[],"mappings":"AAwBA;;GAEG;AACH,wBAAgB,iBAAiB,SAGhC;AAsDD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA8BnH;AAuGD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAJ9B,MAI8B,EAAE,UAAU,EAH1C,MAAM,EAGoC,GAFxC,MAAM,GAAC,SAAS,CA+B5B;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,KAAA,EAAE,QAAQ,KAAA,EAAE,YAAY,MAAK,OAqEvE;AAcD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,KAAA,EACR,QAAQ,KAAA,EACR,MAAM,QAAA,EACN,gBAAgB,QAAA,EAChB,YAAY,MAAK,EACjB,aAAa,MAAK,OAiGnB;AAkDD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAFxB,MAE+B,CAAC;AAE1C;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAJrC,MAIqC,EAAE,YAAY,AAH3D,CACA,EADQ,MAAM,EAGkD,GAFtD,MAAM,EAAE,CA8BpB;AAqCD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,+BAA+B,CAC7C,UAAU,EAPD,MAAM,EAOL,EACV,WAAW,EAPF,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAC,SAOlB,EACX,OAAO,AANN,CACA,EADQ,MAMF,GALI,MAAM,CAyDlB"}

package/types/lib/inventory/osinfo.d.ts

@@ -46,14 +46,34 @@ export declare const OS_DISTRO_ALIAS: {
     "ubuntu-24.10": string;
     "ubuntu-25.04": string;
     "ubuntu-25.10": string;
+    "ubuntu-26.04": string;
+    "ubuntu-26.10": string;
     "debian-15": string;
     "debian-14": string;
     "debian-14.5": string;
     "debian-13": string;
+    "debian-13.7": string;
+    "debian-13.6": string;
     "debian-13.5": string;
+    "debian-13.4": string;
+    "debian-13.3": string;
+    "debian-13.2": string;
+    "debian-13.1": string;
     "debian-12": string;
-    "debian-12.5": string;
+    "debian-12.15": string;
+    "debian-12.14": string;
+    "debian-12.13": string;
+    "debian-12.12": string;
+    "debian-12.11": string;
+    "debian-12.10": string;
+    "debian-12.9": string;
+    "debian-12.8": string;
+    "debian-12.7": string;
     "debian-12.6": string;
+    "debian-12.5": string;
+    "debian-12.4": string;
+    "debian-12.2": string;
+    "debian-12.1": string;
     "debian-11": string;
     "debian-11.5": string;
     "debian-10": string;
@@ -179,15 +199,20 @@ export declare function _resetOsReleaseCache(): void;
  * Derive structured distro information from an os-release file.
  *
  * Returns an object with:
- *   - purlType    {string}  "deb" | "apk" | "rpm"
+ *   - purlType    {string}  "deb" | "apk" | "rpm" | "alpm" (Arch and the
+ *                           distros built on it)
  *   - namespace   {string}  canonical purl namespace (e.g. "ubuntu", "alpine",
  *                           "azure-linux" for both Azure Linux and CBL-Mariner)
  *   - distroId    {string}  ID + "-" + VERSION_ID with a canonical vendor
- *                           prefix (e.g. "ubuntu-22.04", "azure-linux-3.0")
- *   - distroName  {string}  codename/alias          (e.g. "jammy")
+ *                           prefix (e.g. "ubuntu-22.04", "azure-linux-3.0",
+ *                           "alpine-3.24.3")
+ *   - distroName  {string}  release codename, or a token OS_DISTRO_ALIAS knows
+ *                           (e.g. "jammy", "rhel", "alpine-3.24"); empty when
+ *                           the distro has neither
  *
- * Mirrors the logic in lib/managers/binary.js getOSPackages() so that both
- * callers share a single implementation.
+ * lib/managers/binary.js getOSPackages() reads its distro from here, so a
+ * container scan and an OBOM run on the same system give a package the same
+ * `distro` and `distro_name` qualifiers.
  *
  * @param {string} [root="/"] - Filesystem root to look for os-release.
  * @returns {{ purlType: string, namespace: string, distroId: string, distroName: string }}

package/types/lib/inventory/osinfo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"osinfo.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osinfo.js"],"names":[],"mappings":"AAGA;;;GAGG;AACH,eAAO,MAAM,eAAe;IAC1B,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,WAAW;IACX,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,UAAU;IACV,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,0BAA0B;IAC1B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,6BAA6B;CAC9B,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB;IAC7B,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,EAAE;IACF,eAAe;IACf,qBAAqB;IACrB,IAAI;IACJ,aAAa;CACd,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,yBAAyB;IACpC,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,EAAE;IACF,IAAI;IACJ,aAAa;CACd,CAAC;AASF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAHrC,MAGqC,GAFnC,OAAO,CAInB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,CAYlB;AAQD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAJ/B,CAEA,EAFQ,MAI6B,GAF3B,MAAM,CAqClB;AAGD;;GAEG;AACH,wBAAgB,oBAAoB,SAEnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAH/B,CACA,EADQ,MAG6B,GAF3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAkHzF"}
+{"version":3,"file":"osinfo.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osinfo.js"],"names":[],"mappings":"AAGA;;;GAGG;AACH,eAAO,MAAM,eAAe;IAC1B,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,WAAW;IACX,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,WAAW;IACX,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,UAAU;IACV,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,0BAA0B;IAC1B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,6BAA6B;CAC9B,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB;IAC7B,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,EAAE;IACF,eAAe;IACf,qBAAqB;IACrB,IAAI;IACJ,aAAa;CACd,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,yBAAyB;IACpC,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,EAAE;IACF,IAAI;IACJ,aAAa;CACd,CAAC;AASF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAHrC,MAGqC,GAFnC,OAAO,CAInB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,CAYlB;AAQD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAJ/B,CAEA,EAFQ,MAI6B,GAF3B,MAAM,CAqClB;AAGD;;GAEG;AACH,wBAAgB,oBAAoB,SAEnC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAH/B,CACA,EADQ,MAG6B,GAF3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAyIzF"}

package/types/lib/inventory/osqueryTransform.d.ts

@@ -81,4 +81,55 @@ export declare function shouldCreateOsQueryPurl(componentType: string): boolean;
  * @returns {string|null} Canonical purl string, or `null` when the parts do not form a valid purl
  */
 export declare function createOsQueryPurl(purlType: string, group: string | null, name: string, version: string, qualifiers: Object | null, subpath: string | null): string | null;
+/**
+ * The version and purl of a row from an OS package table: `deb_packages`,
+ * `rpm_packages`, `pacman_packages`, `homebrew_packages`, `macports_packages`,
+ * `snap_packages`, `flatpak_packages` or the rows of the apk database.
+ *
+ * Such a row is named the way the package manager's own scan names it: deb,
+ * rpm and apk with the vendor and the `arch`, `distro`, `distro_name` and
+ * `epoch` qualifiers of the container scan, an rpm version joined to its
+ * release, a MacPorts version joined to its revision, a flatpak by its
+ * application ID with the `arch` and `branch` of its ref. A row's `path`,
+ * `admindir` or source file is not a path inside the package, so none of them
+ * becomes a subpath.
+ *
+ * @param {string} purlType One of OS_PACKAGE_PURL_TYPES
+ * @param {Object} res osquery row
+ * @param {string} name Component name derived from the row
+ * @param {Object} [distro] What getDistroInfo() reports; the host's by default
+ * @returns {{version: string, purl: string|null}} The component version and the purl, which is null when the row cannot be expressed as one
+ */
+export declare function createOsQueryPackageIdentity(purlType: string, res: Object, name: string, distro?: Object): {
+    version: string;
+    purl: string | null;
+};
+/**
+ * The columns of an OS package row that give its licence and its home page.
+ * They become the component's `licenses` and a `website` reference rather than
+ * properties. `separator` splits a licence column that lists several: pacman
+ * keeps one licence per entry, which osquery joins with commas.
+ */
+export declare const OS_PACKAGE_LICENSE_COLUMNS: {
+    alpm: {
+        license: string;
+        separator: string;
+        website: string;
+    };
+    snap: {
+        license: string;
+    };
+    flatpak: {
+        license: string;
+        website: string;
+    };
+};
+/**
+ * The property name an OS package table column is emitted under.
+ *
+ * @param {string|undefined} purlType Purl type of the table
+ * @param {string} column Column name
+ * @returns {string|undefined} The property name, or undefined when the column is not emitted
+ */
+export declare function osPackagePropertyName(purlType: string | undefined, column: string): string | undefined;
 //# sourceMappingURL=osqueryTransform.d.ts.map

package/types/lib/inventory/osqueryTransform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"osqueryTransform.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osqueryTransform.js"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAH7B,MAG6B,GAF3B,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAL1B,MAK0B,EAAE,YAAY,EAJxC,OAIwC,EAAE,SAAS,EAHnD,MAGmD,GAFjD,MAAM,GAAC,SAAS,CAkB5B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,MAG+B,GAF7B,MAAM,CAWlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAHjC,MAGiC,GAF/B,MAAM,CAelB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAHlC,MAGkC,GAFhC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAJrC,MAIqC,EAAE,QAAQ,AAHvD,CACA,EADQ,MAG2D,GAFzD,MAAM,CAWlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,aAAa,EATJ,MASI,EACb,aAAa,EATJ,MASI,EACb,IAAI,EATK,MAAM,GAAC,SASZ,EACJ,OAAO,EATE,MAAM,GAAC,SAST,EACP,aAAa,EATJ,MAAM,GAAC,SASH,EACb,aAAa,EATJ,MAAM,GAAC,SASH,GARF,MAAM,CA8BlB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAH1C,MAG0C,GAFxC,OAAO,CAMnB;AAaD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EATC,MASD,EACR,KAAK,EATI,MAAM,GAAC,IASX,EACL,IAAI,EATK,MASL,EACJ,OAAO,EATE,MASF,EACP,UAAU,EATD,MAAM,GAAC,IASN,EACV,OAAO,EATE,MAAM,GAAC,IAST,GARI,MAAM,GAAC,IAAI,CAuCvB"}
+{"version":3,"file":"osqueryTransform.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osqueryTransform.js"],"names":[],"mappings":"AAIA;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAH7B,MAG6B,GAF3B,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAL1B,MAK0B,EAAE,YAAY,EAJxC,OAIwC,EAAE,SAAS,EAHnD,MAGmD,GAFjD,MAAM,GAAC,SAAS,CAkB5B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,MAG+B,GAF7B,MAAM,CAalB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAHjC,MAGiC,GAF/B,MAAM,CAelB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAHlC,MAGkC,GAFhC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAJrC,MAIqC,EAAE,QAAQ,AAHvD,CACA,EADQ,MAG2D,GAFzD,MAAM,CAWlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,aAAa,EATJ,MASI,EACb,aAAa,EATJ,MASI,EACb,IAAI,EATK,MAAM,GAAC,SASZ,EACJ,OAAO,EATE,MAAM,GAAC,SAST,EACP,aAAa,EATJ,MAAM,GAAC,SASH,EACb,aAAa,EATJ,MAAM,GAAC,SASH,GARF,MAAM,CA8BlB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAH1C,MAG0C,GAFxC,OAAO,CAMnB;AAgBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EATC,MASD,EACR,KAAK,EATI,MAAM,GAAC,IASX,EACL,IAAI,EATK,MASL,EACJ,OAAO,EATE,MASF,EACP,UAAU,EATD,MAAM,GAAC,IASN,EACV,OAAO,EATE,MAAM,GAAC,IAST,GARI,MAAM,GAAC,IAAI,CAsCvB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAN1C,MAM0C,EAAE,GAAG,EAL/C,MAK+C,EAAE,IAAI,EAJrD,MAIqD,EAAE,MAAM,AAHrE,CACA,EADQ,MAG6D,GAF3D;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAC,IAAI,CAAA;CAAC,CAqBhD;AAmCD;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B;IACrC,IAAI;QAAI,OAAO;QAAc,SAAS;QAAO,OAAO;;IACpD,IAAI;QAAI,OAAO;;IACf,OAAO;QAAI,OAAO;QAAa,OAAO;;CACvC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAJnC,MAAM,GAAC,SAI4B,EAAE,MAAM,EAH3C,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAY5B"}

package/types/lib/inventory/phpBuildInfo.d.ts

@@ -0,0 +1,142 @@
+/**
+ * The most PHP-named files one scan opens in search of a build version.
+ *
+ * @type {number}
+ */
+export declare const MAX_PHP_PROBES: number;
+/**
+ * Read the version a text starts with, in the grammar the build-version reader
+ * accepts: `8.4.27`, `8.5.0-dev`, `8.6.0RC3`. What follows the version must not
+ * continue it, so `8.4.26.1` and `8.4.26foo` parse to nothing. A distro
+ * revision such as Ubuntu's `8.1.2-1ubuntu2.14` is not an upstream version
+ * either, and parses to nothing rather than to a guess.
+ *
+ * @param {string} text text that begins with the version
+ * @returns {string|undefined} the version, or undefined when the text does not
+ *   begin with one
+ */
+export declare function parsePhpVersion(text: string): string | undefined;
+/**
+ * Read the version a PHP reports about itself, as `php -v` prints it. An
+ * upstream version parses as parsePhpVersion does. A version with a distro
+ * revision, such as Ubuntu's `8.1.2-1ubuntu2.14`, is kept whole and marked: it
+ * is what that PHP reports, but the distro backports fixes without changing the
+ * upstream part, so it must not be matched against upstream advisories.
+ *
+ * @param {string} text text that begins with the version
+ * @returns {{version: string, distroRevision: boolean}|undefined} the version,
+ *   or undefined when the text does not begin with one
+ */
+export declare function parsePhpReportedVersion(text: string): {
+    version: string;
+    distroRevision: boolean;
+} | undefined;
+/**
+ * The package manager whose store a path lies in. Homebrew (`Cellar/<formula>/
+ * <version>/`), Nix (`nix/store/`) and Guix (`gnu/store/`) own everything under
+ * their stores, whatever links lead there, and a PHP they own is identified by
+ * their package, never as an unpackaged build.
+ *
+ * @param {string} filePath absolute or root-relative path, either separator
+ * @returns {string|undefined} `homebrew`, `nix` or `guix`, or undefined
+ */
+export declare function packageStoreOf(filePath: string): string | undefined;
+/**
+ * Classify a file by its basename into a PHP SAPI, or undefined when the name
+ * is not one php-src installs.
+ *
+ * @param {string} fileName basename or path of the candidate
+ * @returns {string|undefined} cli, fpm, cgi, phpdbg, libphp or frankenphp
+ */
+export declare function classifyPhpSapi(fileName: string): string | undefined;
+/**
+ * Read the PHP build version of a binary or shared library.
+ *
+ * @param {string} absPath absolute path
+ * @param {string|undefined} rootDir extracted root, when the file came from one
+ * @returns {{version: string, source: string}|undefined} source is `binary`
+ *   or `php_version.h`
+ */
+export declare function readPhpBuildVersion(absPath: string, rootDir: string | undefined): {
+    version: string;
+    source: string;
+} | undefined;
+/**
+ * The CPE that lets a downstream scanner match a PHP version. NVD puts a
+ * pre-release suffix in the update field, e.g.
+ * cpe:2.3:a:php:php:8.5.0:rc1:*:*:*:*:*:* (NVD CPE dictionary).
+ *
+ * @param {string} version PHP version in the build-version grammar
+ * @returns {string} CPE 2.3 string
+ */
+export declare function phpCpe(version: string): string;
+/**
+ * A PHP runtime is one `platform` component per distinct version, like the Go
+ * stdlib component. Its identity is `pkg:generic/php`: it is only used where no
+ * package manager owns PHP, or where a PATH probe cannot tell which one does.
+ *
+ * @param {string} version PHP version in the build-version grammar, or as a
+ *   distro build reports it
+ * @param {Object} [options] options
+ * @param {boolean} [options.withCpe=true] false for a version with a distro
+ *   revision, which no upstream CPE describes
+ * @returns {Object} component with `purl`, `bom-ref` and, unless left out, `cpe`
+ */
+export declare function createPhpRuntimeComponent(version: string, { withCpe }?: {
+    withCpe?: boolean;
+}): Object;
+/**
+ * The bom-ref of the runtime component for a version.
+ *
+ * @param {string} version PHP version in the build-version grammar
+ * @returns {string} bom-ref, which is the runtime's purl
+ */
+export declare function phpRuntimeRef(version: string): string;
+/**
+ * The properties a PHP file component carries once its build version is known.
+ * They belong on unpackaged `file` components only: a package-owned PHP is
+ * identified by its package, and distro builds carry backported fixes under
+ * old version numbers, so the PHP-RCE audit rules that match these properties
+ * would raise false positives there.
+ *
+ * @param {{version: string, source: string}} build result of readPhpBuildVersion
+ * @param {string} sapi result of classifyPhpSapi
+ * @returns {{name: string, value: string}[]} properties to append
+ */
+export declare function phpBuildProperties(build: {
+    version: string;
+    source: string;
+}, sapi: string): {
+    name: string;
+    value: string;
+}[];
+/**
+ * Start collecting the runtime components and edges of one scan.
+ *
+ * @returns {{runtimeComponents: Object[], dependencies: Object[], runtimeRefs: Set<string>}}
+ */
+export declare function createPhpRuntimeInventory(): {
+    runtimeComponents: Object[];
+    dependencies: Object[];
+    runtimeRefs: Set<string>;
+};
+/**
+ * Tag a PHP file component with its build facts and link it to the runtime
+ * component of its version, creating that component on first use. Mutates the
+ * component in place, as the Go collector does.
+ *
+ * @param {{runtimeComponents: Object[], dependencies: Object[], runtimeRefs: Set<string>}} inventory
+ *   accumulator from createPhpRuntimeInventory
+ * @param {Object} component file component, with a `properties` array
+ * @param {{version: string, source: string}} build result of readPhpBuildVersion
+ * @param {string} sapi result of classifyPhpSapi
+ */
+export declare function attachPhpBuild(inventory: {
+    runtimeComponents: Object[];
+    dependencies: Object[];
+    runtimeRefs: Set<string>;
+}, component: Object, build: {
+    version: string;
+    source: string;
+}, sapi: string): void;
+//# sourceMappingURL=phpBuildInfo.d.ts.map

package/types/lib/inventory/phpBuildInfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"phpBuildInfo.d.ts","sourceRoot":"","sources":["../../../lib/inventory/phpBuildInfo.js"],"names":[],"mappings":"AAwCA;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAFjB,MAEsB,CAAC;AAUjC;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,GAHvB,MAAM,GAAC,SAAS,CAc5B;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAJjC,MAIiC,GAH/B;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAC,GAAC,SAAS,CAkBhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CAuB5B;AAoBD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,MAAM,GAAC,SAAS,CAa5B;AAkHD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EALhC,MAKgC,EAAE,OAAO,EAJzC,MAAM,GAAC,SAIkC,GAHvC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAwBvD;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,OAAO,EAHnB,MAGmB,GAFjB,MAAM,CAgBlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAPtC,MAOsC,EAAE,EAAE,OAAc,EAAE,AALlE,CAGA,EAFA;IAA0B,OAAO,AAAjC,CAEA,EAFQ,OAAO,CAEf;CAEuE,GAF7D,MAAM,CAWlB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,MAAM,CAIlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAJ7B;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAIH,EAAE,IAAI,EAHnC,MAGmC,GAFjC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAQ3C;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAF5B;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAC,CAI3F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAN7B;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAMjD,EAAE,SAAS,EAJxC,MAIwC,EAAE,KAAK,EAH/C;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAGe,EAAE,IAAI,EAFrD,MAEqD,QAe/D"}

package/types/lib/inventory/phpHostProbe.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Look for PHP no package manager owns, in the fixed directories of the host.
+ * Components come back only for the files nothing owns: a `file` component for
+ * each PHP binary or library with the cdx:php properties, one `platform`
+ * component per version with its CPE, and the edges between them.
+ *
+ * @param {Object} [options] probe options
+ * @param {string} [options.rootPath] directory the fixed directories hang off:
+ *   `/`, or the system drive on Windows. Tests point it at a built tree.
+ * @param {string} [options.platform] `linux`, `darwin` or `win32`
+ * @param {Object} [options.env] environment read for ProgramFiles, SystemDrive
+ *   and ChocolateyInstall, instead of the process's
+ * @param {{dpkgInfoDirectory?: string, apkInstalledFile?: string, rpmDatabaseDirectories?: string[]}} [options.packageDatabases]
+ *   where the package databases are, instead of under `rootPath`
+ * @param {function(string): (Object[]|undefined)} [options.executeOsQuery] runs
+ *   an osquery query; the rpm database is only asked through it
+ * @param {Object[]} [options.packageComponents] the packages the OS scan has
+ *   inventoried, from which Chocolatey's are known
+ * @param {number} [options.maxProbes] most candidate files to look at
+ * @returns {{components: Object[], dependencies: Object[]}}
+ */
+export declare function probeHostPhp(options?: {
+    rootPath?: string;
+    platform?: string;
+    env?: Object;
+    packageDatabases?: {
+        dpkgInfoDirectory?: string;
+        apkInstalledFile?: string;
+        rpmDatabaseDirectories?: string[];
+    };
+}): {
+    components: Object[];
+    dependencies: Object[];
+};
+//# sourceMappingURL=phpHostProbe.d.ts.map

package/types/lib/inventory/phpHostProbe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"phpHostProbe.d.ts","sourceRoot":"","sources":["../../../lib/inventory/phpHostProbe.js"],"names":[],"mappings":"AAqIA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAAC,OAAO,AAfjC,CAQA,EAPA;IAAyB,QAAQ,AAAjC,CAEA,EAFQ,MAAM,CAEd;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;IAAyB,GAAG,AAA5B,CAEA,EAFQ,MAAM,CAEd;IAA6G,gBAAgB,AAA7H,CAEA,EAFQ;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;KAAC,CAElG;CAOsC,GAF5B;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAgC1D"}

package/types/lib/inventory/rootfsCerts.d.ts

@@ -0,0 +1,27 @@
+export declare const ROOTFS_CERT_LIMITS: Readonly<{
+    maxFileBytes: number;
+    maxFiles: 20000;
+    maxEntries: 500000;
+    maxDepth: 12;
+}>;
+/**
+ * Pure-JS inventory of the certificate locations trustinspector's rootfs
+ * mode covers, plus Kubernetes TLS secrets and Android pins. Used when the
+ * plugin is not available. Produces components through the shared
+ * CertificateCollector, so bom-refs, names and deduplication match the other
+ * producers; locations are root-relative ("/etc/ssl/certs/x.crt").
+ *
+ * Every access stays inside the root: symlinks (files or directories) are
+ * skipped, only regular files are opened, and the walk is bounded by entry,
+ * file, size and depth limits.
+ *
+ * @param {string} rootDir extracted root filesystem
+ * @param {object} [limits] overrides for ROOTFS_CERT_LIMITS (tests)
+ * @returns {{components: object[], dependencies: object[], warnings: string[]}}
+ */
+export declare function collectRootfsCertificates(rootDir: string, limits?: object): {
+    components: object[];
+    dependencies: object[];
+    warnings: string[];
+};
+//# sourceMappingURL=rootfsCerts.d.ts.map