@cdxgen/cdxgen 13.4.0 → 13.6.0

package/types/lib/inventory/rootfsCerts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rootfsCerts.d.ts","sourceRoot":"","sources":["../../../lib/inventory/rootfsCerts.js"],"names":[],"mappings":"AAqBA,eAAO,MAAM,kBAAkB;;;;;EAK7B,CAAC;AA0IH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAJtC,MAIsC,EAAE,MAAM,AAHtD,CACA,EADQ,MAGmD,GAFjD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAC,CA6N9E"}

package/types/lib/inventory/rubyBuildInfo.d.ts

@@ -0,0 +1,271 @@
+/**
+ * The most Ruby-named files one scan opens in search of a build version.
+ *
+ * @type {number}
+ */
+export declare const MAX_RUBY_PROBES: number;
+/**
+ * Parse an MRI version and normalize a pre-release to the hyphenated form the
+ * release tarballs use: `3.4.0preview2` becomes `3.4.0-preview2`.
+ *
+ * @param {string} text candidate version, without a patchlevel
+ * @returns {string|undefined} the version, or undefined
+ */
+export declare function parseRubyVersion(text: string): string | undefined;
+/**
+ * Read the first line `ruby -v` prints, or the description compiled into
+ * libruby, for MRI, JRuby and TruffleRuby:
+ * - `ruby 3.3.6 (2024-11-05 revision 75015d4c1f) [x86_64-linux]`
+ * - `ruby 2.7.8p225 (2023-03-30 revision 1f4d455848) [x86_64-linux]`
+ * - `ruby 3.4.0preview2 (2024-10-07 master 32c733f57b) +PRISM [x86_64-linux]`
+ * - `jruby 9.4.8.0 (3.1.4) 2024-07-02 4d41e55a67 OpenJDK 64-Bit ...`
+ * - `truffleruby 24.1.0, like ruby 3.2.4, Oracle GraalVM Native [x86_64-linux]`
+ *
+ * @param {string} text description line
+ * @returns {{engine: string, version: string, patchlevel?: string,
+ *   rubyVersion?: string, platform?: string}|undefined} engine is `ruby`,
+ *   `jruby` or `truffleruby`; for the last two, rubyVersion is the Ruby
+ *   language version the engine implements
+ */
+export declare function parseRubyDescription(text: string): {
+    engine: string;
+    version: string;
+    patchlevel?: string;
+    rubyVersion?: string;
+    platform?: string;
+} | undefined;
+/**
+ * Read the entries of an rbconfig.rb that identify a build. Only literal
+ * `CONFIG["KEY"] = "value"` lines are read; Ruby is never evaluated.
+ *
+ * @param {string} text rbconfig.rb contents
+ * @returns {{version: string, patchlevel?: string, abi?: string,
+ *   arch?: string, baseName?: string}|undefined}
+ */
+export declare function parseRbConfig(text: string): {
+    version: string;
+    patchlevel?: string;
+    abi?: string;
+    arch?: string;
+    baseName?: string;
+} | undefined;
+/**
+ * Whether a file name is one a Ruby interpreter is installed under: `ruby`,
+ * a versioned `ruby3.3` as distros and `--program-suffix` builds name it,
+ * `ruby.exe` and `rubyw.exe`.
+ *
+ * @param {string} fileName basename or path of the candidate
+ * @returns {boolean}
+ */
+export declare function isRubyBinaryName(fileName: string): boolean;
+/**
+ * Whether a file name is the shared Ruby library: libruby.so.3.3.6, Debian's
+ * libruby-3.1.so.3.1.2,
+ * libruby.3.3.dylib, or the RubyInstaller's x64-ucrt-ruby340.dll.
+ *
+ * @param {string} fileName basename or path of the candidate
+ * @returns {boolean}
+ */
+export declare function isLibrubyName(fileName: string): boolean;
+/**
+ * The version a libruby soname spells, libruby.so.3.3.6 -> 3.3.6.
+ *
+ * @param {string} fileName basename or path
+ * @returns {string|undefined}
+ */
+export declare function versionFromLibrubyName(fileName: string): string | undefined;
+/**
+ * The install prefix of a file under bin, sbin or lib: /usr/local/bin/ruby ->
+ * /usr/local, C:\Ruby34-x64\bin\ruby.exe -> C:\Ruby34-x64.
+ *
+ * @param {string} absPath absolute path
+ * @returns {string|undefined}
+ */
+export declare function rubyInstallPrefix(absPath: string): string | undefined;
+/**
+ * The rbconfig.rb files an install prefix holds, at most a few levels down:
+ * <prefix>/lib/ruby/<abi>/<arch>/rbconfig.rb, and the Debian layout
+ * <prefix>/lib/<triplet>/ruby/<abi>/rbconfig.rb.
+ *
+ * @param {string} prefix install prefix
+ * @returns {string[]} absolute paths
+ */
+export declare function findRbConfigFiles(prefix: string): string[];
+/**
+ * Find the description compiled into a file, `ruby 3.3.6 (2024-11-05 ...`.
+ *
+ * @param {string} absPath absolute path of a ruby binary or libruby
+ * @param {string|undefined} rootDir extracted root
+ * @returns {ReturnType<typeof parseRubyDescription>}
+ */
+export declare function readRubyDescription(absPath: string, rootDir: string | undefined): ReturnType<typeof parseRubyDescription>;
+/**
+ * Read the Ruby build version of a ruby binary or libruby.
+ *
+ * @param {string} absPath absolute path of the candidate
+ * @param {string|undefined} rootDir extracted root, when the file came from one
+ * @returns {{version: string, source: string, patchlevel?: string,
+ *   abi?: string, arch?: string}|undefined} source is `rbconfig`, `binary`
+ *   or `soname`
+ */
+export declare function readRubyBuildVersion(absPath: string, rootDir: string | undefined): {
+    version: string;
+    source: string;
+    patchlevel?: string;
+    abi?: string;
+    arch?: string;
+} | undefined;
+/**
+ * The CPE that lets a downstream scanner match an interpreter version. NVD
+ * names MRI ruby-lang:ruby and keeps a pre-release in the update field, as in
+ * cpe:2.3:a:ruby-lang:ruby:3.4.0:preview1:*:*:*:*:*:*.
+ *
+ * @param {string} version interpreter version
+ * @param {string} [engine="ruby"] `ruby` or `jruby`
+ * @returns {string|undefined} CPE 2.3 string, or undefined for an engine NVD
+ *   does not name
+ */
+export declare function rubyCpe(version: string, engine?: string): string | undefined;
+/**
+ * A Ruby runtime is one `platform` component per distinct engine and version,
+ * like the PHP and Node.js runtime components. Its identity is
+ * `pkg:generic/ruby` (or `jruby`, `truffleruby`).
+ *
+ * @param {string} version interpreter version
+ * @param {Object} [options] options
+ * @param {boolean} [options.withCpe=true] false for a Ruby a distro packaged,
+ *   which backports fixes under its old upstream version
+ * @param {string} [options.engine="ruby"] `ruby`, `jruby` or `truffleruby`
+ * @returns {Object} component with `purl`, `bom-ref` and, when one applies, `cpe`
+ */
+export declare function createRubyRuntimeComponent(version: string, { withCpe, engine }?: {
+    withCpe?: boolean;
+    engine?: string;
+}): Object;
+/**
+ * The bom-ref of the runtime component for a version.
+ *
+ * @param {string} version interpreter version
+ * @param {string} [engine="ruby"] engine
+ * @returns {string|undefined} bom-ref, which is the runtime's purl
+ */
+export declare function rubyRuntimeRef(version: string, engine?: string): string | undefined;
+/**
+ * The properties a Ruby file component carries once its build is known. They
+ * belong on unpackaged `file` components only: a package-owned Ruby is
+ * identified by its package.
+ *
+ * @param {{version: string, source: string, patchlevel?: string, abi?: string, arch?: string}} build
+ *   result of readRubyBuildVersion
+ * @returns {{name: string, value: string}[]} properties to append
+ */
+export declare function rubyBuildProperties(build: {
+    version: string;
+    source: string;
+    patchlevel?: string;
+    abi?: string;
+    arch?: string;
+}): {
+    name: string;
+    value: string;
+}[];
+/**
+ * Start collecting the runtime components and edges of one scan.
+ *
+ * @returns {{runtimeComponents: Object[], dependencies: Object[], runtimeRefs: Set<string>}}
+ */
+export declare function createRubyRuntimeInventory(): {
+    runtimeComponents: Object[];
+    dependencies: Object[];
+    runtimeRefs: Set<string>;
+};
+/**
+ * Tag a Ruby file component with its build facts and link it to the runtime
+ * component of its version, creating that component on first use. Mutates the
+ * component in place.
+ *
+ * @param {{runtimeComponents: Object[], dependencies: Object[], runtimeRefs: Set<string>}} inventory
+ *   accumulator from createRubyRuntimeInventory
+ * @param {Object} component file component, with a `properties` array
+ * @param {{version: string, source: string, patchlevel?: string, abi?: string, arch?: string}} build
+ *   result of readRubyBuildVersion
+ */
+export declare function attachRubyBuild(inventory: {
+    runtimeComponents: Object[];
+    dependencies: Object[];
+    runtimeRefs: Set<string>;
+}, component: Object, build: {
+    version: string;
+    source: string;
+    patchlevel?: string;
+    abi?: string;
+    arch?: string;
+}): void;
+/**
+ * The upstream Ruby version an OS package carries: 1:3.1.2-7+deb12u1 -> 3.1.2,
+ * 3.3.10-r0 -> 3.3.10, 3.0.7-168.el9_8 -> 3.0.7, 3.4.8_1 -> 3.4.8, and the
+ * Chocolatey 3.4.10.1 -> 3.4.10.
+ *
+ * @param {string} version package version
+ * @param {string} [purlType] purl type of the package
+ * @returns {string|undefined}
+ */
+export declare function upstreamRubyVersion(version: string, purlType?: string): string | undefined;
+/**
+ * Describe the Ruby an OS package installed with its upstream identity,
+ * `pkg:generic/ruby@<upstream>`, so a BOM names the interpreter both ways. The
+ * component of a distro package carries no CPE, since distros backport fixes
+ * under their old upstream version; Homebrew and Chocolatey ship the upstream
+ * release, so theirs does. `cdx:os:installedBy` names the package to judge it
+ * by.
+ *
+ * @param {Object[]} components BOM components, OS packages among them
+ * @returns {Object[]} runtime components to add, one per distinct version
+ */
+export declare function deriveOsPackagedRubyRuntimes(components: Object[]): Object[];
+/**
+ * Where the default gems of an install live: the gemspec paths
+ * <prefix>/lib/ruby/gems/<abi>/specifications/default/*.gemspec.
+ *
+ * @param {string} gemspecPath path of a gemspec, either separator
+ * @returns {{prefix: string, abi: string}|undefined} the install prefix and
+ *   ABI, when the gemspec is a default gem of a lib/ruby/gems tree
+ */
+export declare function defaultGemInstall(gemspecPath: string): {
+    prefix: string;
+    abi: string;
+} | undefined;
+/**
+ * Whether a path lies inside an installed gem's own directory,
+ * <gem home>/gems/<name>-<version>/..., beside the specifications directory of
+ * that gem home. The lockfiles, manifests and nested gemspecs there belong to
+ * the gem's own development, not to anything installed.
+ *
+ * Only the part of the path from the scanned directory down counts, so a scan
+ * of one installed gem (`cdxgen /usr/local/bundle/gems/rails-7.1.0`) still
+ * reads that gem's files. The scanned directory may itself be the `gems`
+ * directory, as when an image scan reads each gem home on its own.
+ *
+ * @param {string} filePath absolute path, either separator
+ * @param {function(string): boolean} exists existence check
+ * @param {string} [scanRoot] the directory the scan started from
+ * @returns {boolean}
+ */
+export declare function isInsideInstalledGem(filePath: string, exists: Function, scanRoot?: string): boolean;
+/**
+ * Link the default gems of an unpackaged Ruby to the runtime they ship with.
+ * The runtime is known from its `file` components, which carry the build
+ * version and the path they were found at; a default gem belongs to the
+ * runtime installed under the same prefix. Gems an OS package installed are
+ * left to that package, as is any gem whose install has no unpackaged runtime.
+ *
+ * @param {Object[]} components BOM components
+ * @param {string} [rootDir] extracted root the source paths may start with
+ * @returns {{ref: string, dependsOn: string[]}[]} edges from each runtime to
+ *   its default gems
+ */
+export declare function linkDefaultGemsToRuntimes(components: Object[], rootDir?: string): {
+    ref: string;
+    dependsOn: string[];
+}[];
+//# sourceMappingURL=rubyBuildInfo.d.ts.map

package/types/lib/inventory/rubyBuildInfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rubyBuildInfo.d.ts","sourceRoot":"","sources":["../../../lib/inventory/rubyBuildInfo.js"],"names":[],"mappings":"AAkCA;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAFlB,MAEuB,CAAC;AA0BlC;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAH1B,MAG0B,GAFxB,MAAM,GAAC,SAAS,CAc5B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAN9B,MAM8B,GAL5B;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CA2DtD;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,GAHrB;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAwC/C;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAH9B,MAG8B,GAF5B,OAAO,CAanB;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,OAAO,CAYnB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAHpC,MAGoC,GAFlC,MAAM,GAAC,SAAS,CAU5B;AAyCD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,GAF5B,MAAM,GAAC,SAAS,CAkB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAH7B,MAG6B,GAF3B,MAAM,EAAE,CAqCpB;AAwBD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAAM,GAAC,SAGkC,GAFvC,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAyBnD;AAeD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EANjC,MAMiC,EAAE,OAAO,EAL1C,MAAM,GAAC,SAKmC,GAJxC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAyE1C;AAQD;;;;;;;;;GASG;AACH,wBAAgB,OAAO,CAAC,OAAO,EALpB,MAKoB,EAAE,MAAM,AAJpC,CACA,EADQ,MAIqC,GAHnC,MAAM,GAAC,SAAS,CAwB5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EARE,MAQF,EACP,EAAE,OAAc,EAAE,MAAe,EAAE,AARlC,CAIA,EAHA;IAA0B,OAAO,AAAjC,CAEA,EAFQ,OAAO,CAEf;IAAyB,MAAM,AAA/B,CACA,EADQ,MAAM,CACd;CAIuC,GAJ7B,MAAM,CAelB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAJ3B,MAI2B,EAAE,MAAM,AAH3C,CACA,EADQ,MAG4C,GAF1C,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAJ9B;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAIpD,GAF5B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAiB3C;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAF7B;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAC,CAI3F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAN9B;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAMhD,EAAE,SAAS,EAJzC,MAIyC,EAAE,KAAK,EAHhD;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAGlC,QA6B1D;AA2CD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAJhC,MAIgC,EAAE,QAAQ,AAHlD,CACA,EADQ,MAG0C,GAFxC,MAAM,GAAC,SAAS,CAwB5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,UAAU,EAH5C,MAAM,EAGsC,GAF1C,MAAM,EAAE,CAgEpB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAJlC,MAIkC,GAHhC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAqBnD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EALlC,MAKkC,EAAE,MAAM,UAAA,EAAE,QAAQ,AAH5D,CACA,EADQ,MAGoD,GAFlD,OAAO,CA6BnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EALzC,MAAM,EAKmC,EAAE,OAAO,AAJ1D,CACA,EADQ,MAIkD,GAHhD;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,EAAE,CAkEhD"}

package/types/lib/inventory/rubyHostProbe.d.ts

@@ -0,0 +1,47 @@
+export declare const RUBY_VERSION_MANAGER_DIRECTORIES: string[];
+export declare const HOME_PARENTS: {
+    linux: string[];
+    darwin: string[];
+};
+/**
+ * Expand a relative directory pattern whose `*` segments match one directory
+ * name each.
+ *
+ * @param {string} base absolute directory the pattern hangs off
+ * @param {string} pattern `/`-separated relative pattern
+ * @returns {string[]} existing directories, at most MAX_EXPANDED_DIRECTORIES
+ */
+export declare function expandDirectories(base: string, pattern: string): string[];
+/**
+ * The home directories of a host: /root and /home/* on Linux, /Users/* on
+ * macOS.
+ *
+ * @param {{rootPath: string, platform: string}} context probe context
+ * @returns {string[]}
+ */
+export declare function homeDirectories(context: {
+    rootPath: string;
+    platform: string;
+}): string[];
+/**
+ * The directories a Windows Ruby lives in: the RubyInstaller's C:\Ruby34-x64,
+ * Chocolatey's C:\tools\ruby34, and the hosted toolcache.
+ *
+ * @param {Object} context probe context
+ * @returns {string[]} install roots, each with a `bin` directory
+ */
+export declare function windowsRubyRoots(context: Object): string[];
+/**
+ * Look for Ruby no package manager owns on the host. Components come back
+ * only for the files nothing owns: a `file` component for each `ruby` binary
+ * with the cdx:ruby properties, and one `platform` component per Ruby version
+ * with its CPE.
+ *
+ * @param {Object} [options] probe options, as probeHostPhp takes them
+ * @returns {{components: Object[], dependencies: Object[]}}
+ */
+export declare function probeHostRuby(options?: Object): {
+    components: Object[];
+    dependencies: Object[];
+};
+//# sourceMappingURL=rubyHostProbe.d.ts.map

package/types/lib/inventory/rubyHostProbe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rubyHostProbe.d.ts","sourceRoot":"","sources":["../../../lib/inventory/rubyHostProbe.js"],"names":[],"mappings":"AAwDA,eAAO,MAAM,gCAAgC,UAQ5C,CAAC;AAEF,eAAO,MAAM,YAAY;IACvB,KAAK;IACL,MAAM;CACP,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,MAAM,EAAE,CAwBpB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAGP,GAF1B,MAAM,EAAE,CAiBpB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,MAAM,EAAE,CAiBpB;AA0BD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,AAHlC,CACA,EADQ,MAG+B,GAF7B;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAmC1D"}

package/types/lib/inventory/source.d.ts

@@ -15,10 +15,14 @@ export declare function isSafeGitRefName(refName: string | undefined): boolean;
  * @param {string[]} args git arguments
  * @param {Object} options command options
  * @param {string|undefined} options.cwd working directory
+ * @param {boolean|undefined} options.noRepository run outside any repository,
+ *   so the config of a repository in the working directory, such as url.*.insteadOf
+ *   or core.sshCommand, cannot change where a remote command connects
  * @returns {Object} spawn result
  */
 export declare function hardenedGitCommand(args: string[], options?: {
     cwd: string | undefined;
+    noRepository: boolean | undefined;
 }): Object;
 /**
  * Build CycloneDX release notes from git tags and commits.
@@ -55,6 +59,17 @@ export declare function isAllowedWinPath(p: string): boolean;
  * @returns {boolean} true if the path is present in the allowed paths. false otherwise.
  */
 export declare function isAllowedPath(p: string): boolean;
+/**
+ * Checks where the given path really points, after following symlinks, against
+ * where the allowed paths really point. Both sides are resolved, so an allowed
+ * directory that is itself reached through a link (such as /tmp on macOS) still
+ * matches, while a link inside an allowed directory that leads outside it does
+ * not.
+ *
+ * @param {string} p Path string to check
+ * @returns {boolean} true if the real path is inside a real allowed path
+ */
+export declare function isAllowedRealPath(p: string): boolean;
 /**
  * Determine if the path could be a package URL.
  *
@@ -76,6 +91,29 @@ export declare function maybeRemotePath(filePath: string): boolean;
  * @returns {Object|null} Error object if invalid, or null if valid
  */
 export declare function validateAndRejectGitSource(filePath: string): Object | null;
+/**
+ * Return the host a git client connects to for a remote, read the way git,
+ * libcurl and OpenSSH read it rather than the way new URL() does. git ends the
+ * authority of ssh:// and git:// URLs only at the first slash, percent-decodes
+ * it before splitting off the host, and reads a leading "[...]" as the host.
+ * OpenSSH takes the host after the last "@". So a "?" or "#" before the first
+ * slash, a second "@", brackets in the user name, or a percent sign in an
+ * ssh:// or git:// authority make the host ambiguous.
+ *
+ * @param {string} remote Git URL or SCP-like address
+ * @returns {string|undefined} lower-cased host, or undefined when it is ambiguous
+ */
+export declare function getGitRemoteHost(remote: string): string | undefined;
+/**
+ * Remove credentials from git output before it is logged. Every URL in the
+ * text loses its user name and password, which git copies into its error
+ * messages from the remote it was given.
+ *
+ * @param {string|undefined} text Output of a git command
+ * @param {string|undefined} repoUrl Remote the command was given
+ * @returns {string|undefined} Output with credentials replaced by ***
+ */
+export declare function redactGitOutput(text: string | undefined, repoUrl: string | undefined): string | undefined;
 /**
  * Clone a git repository into a temporary directory.
  *

package/types/lib/inventory/source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../lib/inventory/source.js"],"names":[],"mappings":"AAqCA,6FAA6F;AAC7F,eAAO,MAAM,4BAA4B,wIAC8F,CAAC;AAExI,6DAA6D;AAC7D,eAAO,MAAM,2BAA2B,UAWvC,CAAC;AAuBF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAAM,GAAC,SAGsB,GAF3B,OAAO,CAUnB;AAiBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAL5B,MAAM,EAKsB,EAAE,OAAO,GAH7C;IAAkC,GAAG,EAA7B,MAAM,GAAC,SAAS,CACxB;CAEkD,GAFxC,MAAM,CAuClB;AA+ED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAAM,GAAC,SAI+B,EAAE,OAAO,GAH/C,MAGoD,GAFlD,MAAM,GAAC,SAAS,CA6I5B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,CASlB;AAkBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,OAAO,CAWnB;AAkBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAHvB,MAGuB,GAFrB,OAAO,CA+BnB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAHpB,MAGoB,GAFlB,OAAO,CAyBnB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAHxC,MAGwC,GAFtC,MAAM,GAAC,IAAI,CAgEvB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAJrB,MAIqB,EAAE,MAAM,GAH7B,MAAM,GAAC,MAAM,EAAE,GAAC,IAGoB,GAFlC,MAAM,CAyDlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAAM,GAAC,SAGgC,GAFrC,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAJrC,MAIqC,EAAE,cAAc,EAHrD,MAAM,GAAC,SAG8C,GAFnD,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAJtC,MAIsC,EAAE,cAAc,EAHtD,MAAM,GAAC,SAG+C,GAFpD,MAAM,GAAC,SAAS,CAiF5B;AAkJD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAGkC,GAFhC;IAAC,MAAM,EAAC,MAAM,CAAC;IAAA,KAAK,EAAC,MAAM,CAAC;IAAA,OAAO,EAAC,MAAM,CAAA;CAAC,GAAC,IAAI,CA4D5D;AA6GD;;GAEG;AACH,wBAAgB,yBAAyB,SAExC;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,WAAW,EAJ5C,KAAK,CAAC,MAAM,CAIgC,GAF1C,OAAO,CAAC,IAAI,CAAC,CA6BzB;AAiDD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CA4MlI;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAF5B,MAE4B,QAkCtC"}
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../lib/inventory/source.js"],"names":[],"mappings":"AAsCA,6FAA6F;AAC7F,eAAO,MAAM,4BAA4B,wIAC8F,CAAC;AAExI,6DAA6D;AAC7D,eAAO,MAAM,2BAA2B,UAWvC,CAAC;AAuBF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAAM,GAAC,SAGsB,GAF3B,OAAO,CAUnB;AAiBD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAR5B,MAAM,EAQsB,EAAE,OAAO,GAN7C;IAAkC,GAAG,EAA7B,MAAM,GAAC,SAAS,CACxB;IAAmC,YAAY,EAAvC,OAAO,GAAC,SAAS,CAGzB;CAEkD,GAFxC,MAAM,CA6ClB;AA+ED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAAM,GAAC,SAI+B,EAAE,OAAO,GAH/C,MAGoD,GAFlD,MAAM,GAAC,SAAS,CAiJ5B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,CASlB;AAkBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,OAAO,CAWnB;AAkBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAHvB,MAGuB,GAFrB,OAAO,CA+BnB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAHpB,MAGoB,GAFlB,OAAO,CAyBnB;AA2BD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAHxB,MAGwB,GAFtB,OAAO,CAkBnB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAHxC,MAGwC,GAFtC,MAAM,GAAC,IAAI,CA2GvB;AAuBD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CAuD5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAAM,GAAC,SAIkB,EAAE,OAAO,EAHlC,MAAM,GAAC,SAG2B,GAFhC,MAAM,GAAC,SAAS,CAiC5B;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAJrB,MAIqB,EAAE,MAAM,GAH7B,MAAM,GAAC,MAAM,EAAE,GAAC,IAGoB,GAFlC,MAAM,CAmElB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAAM,GAAC,SAGgC,GAFrC,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAJrC,MAIqC,EAAE,cAAc,EAHrD,MAAM,GAAC,SAG8C,GAFnD,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAJtC,MAIsC,EAAE,cAAc,EAHtD,MAAM,GAAC,SAG+C,GAFpD,MAAM,GAAC,SAAS,CAiF5B;AAkJD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAGkC,GAFhC;IAAC,MAAM,EAAC,MAAM,CAAC;IAAA,KAAK,EAAC,MAAM,CAAC;IAAA,OAAO,EAAC,MAAM,CAAA;CAAC,GAAC,IAAI,CA4D5D;AA6GD;;GAEG;AACH,wBAAgB,yBAAyB,SAExC;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,WAAW,EAJ5C,KAAK,CAAC,MAAM,CAIgC,GAF1C,OAAO,CAAC,IAAI,CAAC,CA6BzB;AAiDD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CA6MlI;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAF5B,MAE4B,QAkCtC"}

package/types/lib/inventory/spdx.d.ts

@@ -66,6 +66,21 @@ export declare function findLicenseId(name: string): any;
  * @returns {string|undefined} SPDX license id or expression
  */
 export declare function licenseIdFromText(content: string): string | undefined;
+/**
+ * Identify every license a notice grants, in the order the notice grants
+ * them. A notice can grant several: one LICENSE file holding an MIT grant and
+ * an Apache-2.0 grant (gopkg.in/yaml.v3), or a choice of licenses followed by
+ * each full text (github.com/spdx/tools-golang). A license text quotes others
+ * (the GNU GPL names the GNU Lesser GPL, the MPL names the GNU licenses), so
+ * only phrases that a grant carries count: a GNU license is found by its title
+ * standing on a line of its own, the others by a sentence of their grant.
+ * A notice none of these phrases match falls back to {@link guessLicenseId}.
+ *
+ * @param {string} content License file contents
+ * @returns {string[]} SPDX license ids or expressions; empty when none is
+ *   recognized
+ */
+export declare function guessLicenseIds(content: string): string[];
 /**
  * Method to guess the spdx license id from license contents
  *

package/types/lib/inventory/spdx.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spdx.d.ts","sourceRoot":"","sources":["../../../lib/inventory/spdx.js"],"names":[],"mappings":"AAeA;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAFf,MAAM,EAIf,CAAC;AAMF;;;;;;IAMI;AACJ,wBAAgB,uBAAuB,CAAC,OAAO,EAJpC,MAIoC,GAHlC,OAAO,CA0BnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,OAAA,SA2BhD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,KAAA,qBAqG9B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,UAAU,QAAA,EAAE,GAAG,QAAA,GAFnC,MAAM,CAoDjB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,KAAA,EAAE,CAAC,KAAA,EAAE,cAAc,KAAA,QAoCpD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,eAAe,KAAA,EAAE,kBAAkB,KAAA;;SAUlE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAFvB,MAEuB,OAYjC;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,GAF5B,MAAM,GAAC,SAAS,CAyF5B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAF3B,MAE2B,OAcrC"}
+{"version":3,"file":"spdx.d.ts","sourceRoot":"","sources":["../../../lib/inventory/spdx.js"],"names":[],"mappings":"AAeA;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAFf,MAAM,EAIf,CAAC;AAMF;;;;;;IAMI;AACJ,wBAAgB,uBAAuB,CAAC,OAAO,EAJpC,MAIoC,GAHlC,OAAO,CA0BnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,OAAA,SA2BhD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,KAAA,qBAqG9B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,UAAU,QAAA,EAAE,GAAG,QAAA,GAFnC,MAAM,CAoDjB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,KAAA,EAAE,CAAC,KAAA,EAAE,cAAc,KAAA,QAoCpD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,eAAe,KAAA,EAAE,kBAAkB,KAAA;;SAUlE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAFvB,MAEuB,OAYjC;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,GAF5B,MAAM,GAAC,SAAS,CAyF5B;AAqDD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAJ5B,MAI4B,GAH1B,MAAM,EAAE,CAgFpB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAF3B,MAE2B,OAcrC"}

package/types/lib/inventory/traceRunner.d.ts

@@ -57,7 +57,7 @@ export declare function resolveSaferExecBinary(): string | undefined;
  * @param {boolean} [options.denyPersistenceWrites] - Deny writes to auto-execution and persistence locations
  * @param {boolean} [options.privateTmp] - Private tmpfs /tmp and /var/tmp (Linux)
  * @param {string} [options.protectHome] - Home isolation: read-only, tmpfs, or off (Linux)
- * @returns {Promise<{libPaths: string[], httpAccessEntries: Object[], egressEntries?: Object[], dryRunSummary?: Object}>} Collected libraries, HTTP URLs, proxy egress decisions, and the dry-run summary
+ * @returns {Promise<{libPaths: string[], httpAccessEntries: Object[], cryptoEntries?: Object[], cryptoComponents?: Object[], cryptoResult?: Object, egressEntries?: Object[], dryRunSummary?: Object}>} Collected libraries, HTTP URLs, crypto observations, proxy egress decisions, and the dry-run summary
  * @throws {Error} When the @cdxgen/safer-exec tracing runtime is not installed
  *   (for example after pruning it from a standalone payload), since the traced
  *   command could never run and the BOM would silently be empty
@@ -94,6 +94,9 @@ export declare function executeAndTrace(commandStr: string, workingDir?: string,
 }): Promise<{
     libPaths: string[];
     httpAccessEntries: Object[];
+    cryptoEntries?: Object[];
+    cryptoComponents?: Object[];
+    cryptoResult?: Object;
     egressEntries?: Object[];
     dryRunSummary?: Object;
 }>;

package/types/lib/inventory/traceRunner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"traceRunner.d.ts","sourceRoot":"","sources":["../../../lib/inventory/traceRunner.js"],"names":[],"mappings":"AAsBA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAFvB,OAAO,CAInB;AAKD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAHxB,MAGwB,GAFtB;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,CA6BzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAFzB,MAAM,GAAC,SAAS,CAsF5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAsB,eAAe,CAAC,UAAU,EApCrC,MAoCqC,EAAE,UAAU,AAnCzD,CACA,EADQ,MAmCiD,EAAE,OAAO,AAlClE,CA6BA,EA5BA;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;IAA0B,cAAc,AAAxC,CACA,EADQ,OAAO,CACf;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAAyB,MAAM,AAA/B,CACA,EADQ,MAAM,CACd;IAAyB,UAAU,AAAnC,CACA,EADQ,MAAM,CACd;IAA0B,iBAAiB,AAA3C,CACA,EADQ,OAAO,CACf;IAA0B,qBAAqB,AAA/C,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;CAKuE,GAL7D,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAC,CAAC,CAoWxH;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAH1B,MAG0B,GAFxB;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,GAAC,SAAS,CAAA;CAAC,CAazD;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAHhC,MAAM,EAG0B,GAF9B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,EAAE,CAkD9E;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,iBAAiB,EAHjD,MAAM,EAG2C;eAFlB,GAAG,CAAC,MAAM,CAAC;gBAAc,MAAM,EAAE;GA+C1E"}
+{"version":3,"file":"traceRunner.d.ts","sourceRoot":"","sources":["../../../lib/inventory/traceRunner.js"],"names":[],"mappings":"AAsBA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAFvB,OAAO,CAInB;AAKD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAHxB,MAGwB,GAFtB;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,CA6BzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAFzB,MAAM,GAAC,SAAS,CAsF5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAsB,eAAe,CAAC,UAAU,EApCrC,MAoCqC,EAAE,UAAU,AAnCzD,CACA,EADQ,MAmCiD,EAAE,OAAO,AAlClE,CA6BA,EA5BA;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;IAA0B,cAAc,AAAxC,CACA,EADQ,OAAO,CACf;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAAyB,MAAM,AAA/B,CACA,EADQ,MAAM,CACd;IAAyB,UAAU,AAAnC,CACA,EADQ,MAAM,CACd;IAA0B,iBAAiB,AAA3C,CACA,EADQ,OAAO,CACf;IAA0B,qBAAqB,AAA/C,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;CAKuE,GAL7D,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAC,CAAC,CAwWtM;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAH1B,MAG0B,GAFxB;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,GAAC,SAAS,CAAA;CAAC,CAazD;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAHhC,MAAM,EAG0B,GAF9B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,EAAE,CAkD9E;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,iBAAiB,EAHjD,MAAM,EAG2C;eAFlB,GAAG,CAAC,MAAM,CAAC;gBAAc,MAAM,EAAE;GA+C1E"}

package/types/lib/inventory/tracedCrypto.d.ts

@@ -28,6 +28,28 @@ export declare function suiteCipher(suiteName: string): {
  * @returns {Object[]} Normalized cryptographic-asset components
  */
 export declare function normalizeTracedCryptoComponents(cbomComponents: Object[]): Object[];
+/**
+ * Builds the shared certificate model for the chains servers presented in TLS
+ * ≤ 1.2 handshakes, from the `chain` arrays of safer-exec's crypto result
+ * (report channel, safer-exec ≥ 1.2.0; earlier releases and TLS 1.3 entries
+ * carry no chain and yield nothing). The records go through the shared
+ * certificate collector, so bom-refs, properties and dedup match certificates
+ * found on disk. A presented chain is untrusted server input: no issuer edges
+ * are inferred from it, and the certificate and public-key components link
+ * through the collector as every producer's do. Each TLS protocol component
+ * provides the certificates and keys presented under it — the edge safer-
+ * exec's own CBOM records — which answers which servers presented a key.
+ *
+ * @param {Object} cryptoResult safer-exec CRYPTO result (`result.crypto`)
+ * @param {Set<string>} protocolRefs bom-refs of the protocol components in the BOM;
+ *   a provides edge is only emitted for a protocol that is actually present
+ * @returns {{components: Object[], dependencies: Object[]}} certificate,
+ *   public-key and algorithm components, and the protocol provides edges
+ */
+export declare function observedChainComponents(cryptoResult: Object, protocolRefs?: Set<string>): {
+    components: Object[];
+    dependencies: Object[];
+};
 /**
  * Maps the crypto libraries safer-exec reported to the paths they were loaded
  * from.

package/types/lib/inventory/tracedCrypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tracedCrypto.d.ts","sourceRoot":"","sources":["../../../lib/inventory/tracedCrypto.js"],"names":[],"mappings":"AAqDA;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAH1B,MAG0B,GAFxB;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAC,SAAS,CAAA;CAAC,GAAC,SAAS,CAuB1E;AA+DD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,+BAA+B,CAAC,cAAc,EAHnD,MAAM,EAG6C,GAFjD,MAAM,EAAE,CA+GpB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAHxC,MAAM,EAGkC,GAFtC,GAAG,CAAC,MAAM,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CAgBxD"}
+{"version":3,"file":"tracedCrypto.d.ts","sourceRoot":"","sources":["../../../lib/inventory/tracedCrypto.js"],"names":[],"mappings":"AA0DA;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAH1B,MAG0B,GAFxB;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAC,SAAS,CAAA;CAAC,GAAC,SAAS,CAuB1E;AA+DD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,+BAA+B,CAAC,cAAc,EAHnD,MAAM,EAG6C,GAFjD,MAAM,EAAE,CA+GpB;AAqBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAPH,MAOG,EACZ,YAAY,GAPH,GAAG,CAAC,MAAM,CAOK,GALb;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAwF1D;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAHxC,MAAM,EAGkC,GAFtC,GAAG,CAAC,MAAM,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CAgBxD"}

package/types/lib/managers/binary.d.ts

@@ -115,6 +115,16 @@ export declare function dropRedundantSourceComponents(pkgList: any[]): any[];
  * @returns {Object} Metadata containing packages, dependencies, etc
  */
 export declare function getOSPackages(src: string, imageConfig: Object, options?: {}): Object;
+/**
+ * Split a `Name <address>` maintainer string into an `organizationalContact`.
+ *
+ * @param {string} value Maintainer or supplier string
+ * @returns {{name: string, email?: string}|undefined} The contact, if any
+ */
+export declare function parseOrganizationalContact(value: string): {
+    name: string;
+    email?: string;
+} | undefined;
 /**
  * Collect the dependency edges trivy recorded for one OS package component.
  *

package/types/lib/managers/binary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"binary.d.ts","sourceRoot":"","sources":["../../../lib/managers/binary.js"],"names":[],"mappings":"AA+YA;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,AAH9C,CACA,EADQ,MAAM,EAGqC,GAFzC,MAAM,EAAE,CAgBpB;AA4FD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,GAH5B,MAAM,GAAC,SAAS,CAmB5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EALtB,MAKsB,UA+BpC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,OAAA,EAAE,GAAG,EAJ9B,MAI8B,GAFhC,SAAS,GAAC,MAAM,CAmC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EARK,MAQL,EACJ,OAAO,EARE,MAQF,EACP,IAAI,EARK,MAQL,EACJ,KAAK,EARI,MAQJ,EACL,QAAQ,AARP,CACA,EADQ,MAQD,GAPG,MAAM,CAgDlB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAJ/B,MAI+B,EAAE,QAAQ,AAHjD,CACA,EADQ,MAGyC,GAFvC,MAAM,CA6BlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,OAAA,SAoBpD;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,GAAG,QAAA,EAAE,WAAW,EAL7B,MAK6B,EAAE,OAAO,KAAK,GAFrD,MAAM,CAinBlB;AA4lDD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,0DAJtB,MAAM,QACN,MAAM,KACJ;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAsD/C,CAAC;AAyHF;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,AALvD,CACA,EADQ,MAAM,EAK8C,GAJlD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAC,CAmEnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EALzB,MAKyB,GAJvB,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAJxB,MAIwB,EAAE,UAAU,EAHpC,MAGoC,WA6C9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EANrB,MAMqB,EAAE,aAAa,EALpC,MAKoC,EAAE,QAAQ,EAJ9C,OAI8C,GAF7C,OAAO,CAiClB"}
+{"version":3,"file":"binary.d.ts","sourceRoot":"","sources":["../../../lib/managers/binary.js"],"names":[],"mappings":"AAscA;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,AAH9C,CACA,EADQ,MAAM,EAGqC,GAFzC,MAAM,EAAE,CAgBpB;AAqGD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,GAH5B,MAAM,GAAC,SAAS,CAmB5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EALtB,MAKsB,UA+BpC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,OAAA,EAAE,GAAG,EAJ9B,MAI8B,GAFhC,SAAS,GAAC,MAAM,CAmC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EARK,MAQL,EACJ,OAAO,EARE,MAQF,EACP,IAAI,EARK,MAQL,EACJ,KAAK,EARI,MAQJ,EACL,QAAQ,AARP,CACA,EADQ,MAQD,GAPG,MAAM,CA4ElB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAJ/B,MAI+B,EAAE,QAAQ,AAHjD,CACA,EADQ,MAGyC,GAFvC,MAAM,CA6BlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,OAAA,SAuBpD;AAmBD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,GAAG,QAAA,EAAE,WAAW,EAL7B,MAK6B,EAAE,OAAO,KAAK,GAFrD,MAAM,CAsqBlB;AA6HD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAHrC,MAGqC,GAFnC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAgBpD;AA8lDD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,0DAJtB,MAAM,QACN,MAAM,KACJ;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAsD/C,CAAC;AAyHF;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,AALvD,CACA,EADQ,MAAM,EAK8C,GAJlD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAC,CA8FnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EALzB,MAKyB,GAJvB,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAJxB,MAIwB,EAAE,UAAU,EAHpC,MAGoC,WA6C9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EANrB,MAMqB,EAAE,aAAa,EALpC,MAKoC,EAAE,QAAQ,EAJ9C,OAI8C,GAF7C,OAAO,CAiClB"}

package/types/lib/managers/docker.d.ts

@@ -74,6 +74,18 @@ export declare const makeRequest: (path: string, method: string, forRegistry?: s
  * @returns {boolean} true when the string is a plausible image reference
  */
 export declare const isImageReference: (fullImageName: string) => boolean;
+/**
+ * Whether an image named in a scanned manifest, such as a docker-compose file
+ * or a Kubernetes spec, may be pulled and inventoried. The name comes from the
+ * scanned project, so a local archive path would read files outside the
+ * allowed paths and a registry outside CDXGEN_ALLOWED_HOSTS would bypass the
+ * host allowlist.
+ *
+ * @param {string} fullImageName Image name from the manifest
+ * @param {Object} [imageObj] Result of parseImageName for the same name
+ * @returns {boolean} true when the image may be followed
+ */
+export declare const isFollowableManifestImage: (fullImageName: string, imageObj?: Object) => boolean;
 /**
  * Parse image name
  *
@@ -145,6 +157,18 @@ export declare const extractFromManifest: (manifestFile: string, localData: Obje
  * Returns the location of the layers with additional packages related metadata
  */
 export declare const exportImage: (fullImageName: any, options: any) => Promise<any>;
+/**
+ * The gem directories an image's environment names in GEM_HOME, GEM_PATH and
+ * BUNDLE_PATH. Only absolute paths without `..` segments are kept, so an image
+ * cannot steer the scan outside its own root, and each is normalized; the root
+ * and broad system directories such as /usr or /var are refused, so an image
+ * cannot turn the gem scan into a scan of the whole tree.
+ *
+ * @param {string[]|undefined} env image config Env entries, `NAME=value`
+ * @returns {string[]} absolute in-image directories, deduplicated, at most
+ *   MAX_IMAGE_GEM_DIRS
+ */
+export declare function imageGemDirs(env: string[] | undefined): string[];
 /**
  * Method to retrieve path list for system-level packages
  */

package/types/lib/managers/docker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../lib/managers/docker.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA+CrC,yDAAyD;AACzD,eAAO,MAAM,KAAK,SAA0B,CAAC;AAC7C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAEoC,CAAC;AAkS/C;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,SAHnB,MAAM,KACJ,MAiBZ,CAAC;AAEF;;GAEG;AACH,wBAAgB,YAAY,QAoB3B;AAED;;GAEG;AACH,wBAAgB,oBAAoB,QA2CnC;AAyTD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,aANf,MAAM,gBAEN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,SAAS,CA6HpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,SANb,MAAM,UACN,MAAM,gBACN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,MAAM,GAAC,SAAS,CAgC3C,CAAC;AA8CF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,gBAAgB,kBAHlB,MAAM,KACJ,OAsEZ,CAAC;AAgBF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;;;;;;CA2E1B,CAAC;AAyFF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,QAFlB,MAgCZ,CAAC;AAkBF;;GAEG;AACH,eAAO,MAAM,QAAQ,sCA6MpB,CAAC;AAkBC,YAA4B,gBAAgB,GAAlC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAkB;AAiH/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,kBANZ,MAAM,OACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,OAAO,CAqF3B,CAAC;AAiGF;;;GAGG;AACH,eAAO,MAAM,aAAa,mEAqGzB,CAAC;AAmDF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,iBATrB,MAAM,aACN,MAAM,WACN,MAAM,wBACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,MAAM,CAuK1B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,oDAyJvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,iDAkJ1B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,kBALb,MAAM,UACN,OAAO,KACL,OAAO,CAAC,MAAM,GAAC,SAAS,CAKpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,cALpB,MAAM,iBACN,MAAM,KACJ,MAAM,GAAC,SA2CnB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,qBAHpB,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,cACnC,KAAK,CAAC,MAAM,CAAC,SA4BvB,CAAC"}
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../lib/managers/docker.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAiDrC,yDAAyD;AACzD,eAAO,MAAM,KAAK,SAA0B,CAAC;AAC7C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAEoC,CAAC;AAkS/C;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,SAHnB,MAAM,KACJ,MAiBZ,CAAC;AAEF;;GAEG;AACH,wBAAgB,YAAY,QAoB3B;AAED;;GAEG;AACH,wBAAgB,oBAAoB,QA2CnC;AAyTD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,aANf,MAAM,gBAEN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,SAAS,CA6HpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,SANb,MAAM,UACN,MAAM,gBACN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,MAAM,GAAC,SAAS,CAgC3C,CAAC;AA8CF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,gBAAgB,kBAHlB,MAAM,KACJ,OAsEZ,CAAC;AAgBF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,kBAJ3B,MAAM,aACN,MAAM,KACJ,OAmBZ,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;;;;;;CA2E1B,CAAC;AAyFF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,QAFlB,MAgCZ,CAAC;AAkBF;;GAEG;AACH,eAAO,MAAM,QAAQ,sCA6MpB,CAAC;AAkBC,YAA4B,gBAAgB,GAAlC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAkB;AAmH/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,kBANZ,MAAM,OACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,OAAO,CAqF3B,CAAC;AAiGF;;;GAGG;AACH,eAAO,MAAM,aAAa,mEAqGzB,CAAC;AA2KF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,iBATrB,MAAM,aACN,MAAM,WACN,MAAM,wBACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,MAAM,CAwK1B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,oDAyJvB,CAAC;AAgCF;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAJrB,MAAM,EAAE,GAAC,SAIY,GAHnB,MAAM,EAAE,CA+BpB;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,iDAyJ1B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,kBALb,MAAM,UACN,OAAO,KACL,OAAO,CAAC,MAAM,GAAC,SAAS,CAKpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,cALpB,MAAM,iBACN,MAAM,KACJ,MAAM,GAAC,SA2CnB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,qBAHpB,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,cACnC,KAAK,CAAC,MAAM,CAAC,SA4BvB,CAAC"}

package/types/lib/parsers/email.d.ts

@@ -0,0 +1,19 @@
+/**
+ * An internationalized hostname: mapped to its A-label form with UTS #46
+ * processing, held to the ASCII hostname rules, and every A-label decoded
+ * back and checked for the characters IDNA allows.
+ *
+ * @param {string} hostname Hostname, possibly holding non-ASCII labels
+ * @returns {boolean} Whether it is a valid IDN hostname
+ */
+export declare const isValidIdnHostname: (hostname: string) => boolean;
+/**
+ * Whether a value is a valid RFC 6531 email address (`idn-email`): a dot-atom
+ * or quoted local part, where non-ASCII characters are allowed, then `@` and
+ * an internationalized hostname or a bracketed IPv4/IPv6 literal.
+ *
+ * @param {string} value Candidate email address
+ * @returns {boolean} true when the value is a valid address
+ */
+export declare const isValidIdnEmail: (value: string) => boolean;
+//# sourceMappingURL=email.d.ts.map

package/types/lib/parsers/email.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../../lib/parsers/email.js"],"names":[],"mappings":"AA8LA;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,aAHpB,MAAM,KACJ,OAyCZ,CAAC;AAkBF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,UAHjB,MAAM,KACJ,OAeZ,CAAC"}

package/types/lib/parsers/largeJson.d.ts

@@ -17,14 +17,28 @@ export declare function indexJsonObject(filePath: string, options?: Object): Map
     start: number;
     end: number;
 }>;
+/**
+ * Decode one member of the top-level object in a JSON file, reading the file
+ * only up to the end of that member. A member near the start of a large file
+ * costs a few bounded reads, however large the rest of the file is; the rest
+ * is not checked for well-formedness.
+ *
+ * @param {string} filePath JSON file whose top-level value is an object
+ * @param {string} name Member to decode
+ * @param {Object} [options] Batch and chunk size overrides, for tests
+ * @returns {*} The decoded value, or undefined when the object has no such member
+ * @throws {SyntaxError} When the object is malformed before the member ends
+ */
+export declare function readJsonMember(filePath: string, name: string, options?: Object): any;
 /**
  * Decode the JSON value stored in a byte range of a file, without ever holding
  * more than a bounded run of it in one string.
  *
  * `spec` narrows what is kept. `{ members: { name: spec } }` keeps only the
- * named members of an object, each narrowed by its own spec. `{ filter }`
- * keeps the elements of an array that `filter(element)` accepts. Anything else
- * keeps the whole value.
+ * named members of an object, each narrowed by its own spec. `{ map }`
+ * transforms each element of an array, an undefined result dropping it, and
+ * `{ filter }` keeps the mapped elements that `filter(element)` accepts.
+ * Anything else keeps the whole value.
  *
  * @param {string} filePath JSON file
  * @param {{start: number, end: number}} range Byte range of the value, such as one returned by indexJsonObject