@cdxgen/cdxgen 13.5.0 → 13.6.0

package/types/lib/ecosystems/rubyutils.d.ts

@@ -191,6 +191,14 @@ export declare function toGemModuleNames(name: any): string[];
  * @returns {Array<string>} List of module names
  */
 export declare function collectGemModuleNames(rubyCommand: string, bundleCommand: string, gemHome: string, gemName: string, filePath: string): Array<string>;
+/**
+ * Whether a gemspec is a default gem, one that ships with Ruby: RubyGems
+ * keeps them under `specifications/default/`.
+ *
+ * @param {string} gemspecFile path of the gemspec, either separator
+ * @returns {boolean}
+ */
+export declare function isDefaultGemspecPath(gemspecFile: string): boolean;
 /**
  * Method to parse Gemspec file contents.
  *
@@ -310,33 +318,157 @@ export declare function addRubyGemsDistributionUrls(pkgList: any[]): any[];
  */
 export declare function rubyRequirementToVers(requirements: string[]): string | null | undefined;
 /**
- * Describe the Ruby runtime the gems require as one external `platform`
+ * Read the Ruby a `.ruby-version` file selects, as rbenv, chruby, rvm, asdf
+ * and mise read it: `3.3.6`, `ruby-3.3.6`, `3.3`, `jruby-9.4.8.0`,
+ * `truffleruby-24.1.0`, `truffleruby+graalvm-24.1.0`. Only the first word
+ * counts; comments and blank lines are skipped.
+ *
+ * @param {string} text file contents
+ * @returns {{engine: string, version?: string, requirement?: string, source: string}|undefined}
+ */
+export declare function parseRubyVersionFile(text: string): {
+    engine: string;
+    version?: string;
+    requirement?: string;
+    source: string;
+} | undefined;
+/**
+ * Read the Ruby an asdf `.tool-versions` file selects: the first version on
+ * the `ruby` line, e.g. `ruby 3.3.6 3.2.2`.
+ *
+ * @param {string} text file contents
+ * @returns {{engine: string, version?: string, requirement?: string, source: string}|undefined}
+ */
+export declare function parseToolVersionsRuby(text: string): {
+    engine: string;
+    version?: string;
+    requirement?: string;
+    source: string;
+} | undefined;
+/**
+ * Read the Ruby a mise configuration selects from its `[tools]` table:
+ * `ruby = "3.3.6"`, `ruby = ["3.3.6", "3.2"]` or `ruby = { version = "3.3.6" }`.
+ *
+ * @param {string} text mise.toml contents
+ * @param {string} [source="mise.toml"] the file name, for the result
+ * @returns {{engine: string, version?: string, requirement?: string, source: string}|undefined}
+ */
+export declare function parseMiseRuby(text: string, source?: string): {
+    engine: string;
+    version?: string;
+    requirement?: string;
+    source: string;
+} | undefined;
+/**
+ * Read the `ruby` directive of a Gemfile: `ruby "3.3.6"`, `ruby "~> 3.3"`,
+ * `ruby "3.1.4", engine: "jruby", engine_version: "9.4.8.0"`, or
+ * `ruby file: ".ruby-version"`. The Gemfile is never evaluated, so a
+ * directive built from an expression, such as `ruby RUBY_VERSION`, says
+ * nothing.
+ *
+ * @param {string} text Gemfile contents
+ * @returns {{engine: string, version?: string, requirement?: string,
+ *   file?: string, source: string}|undefined}
+ */
+export declare function parseGemfileRubyDirective(text: string): {
+    engine: string;
+    version?: string;
+    requirement?: string;
+    file?: string;
+    source: string;
+} | undefined;
+/**
+ * Read the `RUBY VERSION` section of a Gemfile.lock, which Bundler writes when
+ * the Gemfile has a `ruby` directive: `ruby 3.3.6p108`, `ruby 3.4.0p-1` for a
+ * pre-release, or `ruby 3.1.4p0 (jruby 9.4.8.0)` for another engine.
+ *
+ * @param {string} text Gemfile.lock contents
+ * @returns {{engine: string, version: string, patchlevel?: string,
+ *   rubyVersion?: string, source: string}|undefined}
+ */
+export declare function parseGemfileLockRubyVersion(text: string): {
+    engine: string;
+    version: string;
+    patchlevel?: string;
+    rubyVersion?: string;
+    source: string;
+} | undefined;
+/**
+ * Collect every Ruby a project directory declares, from the Gemfile.lock
+ * `RUBY VERSION` section, `.ruby-version`, `.tool-versions`, mise.toml and the
+ * Gemfile `ruby` directive. Each declaration names its source.
+ *
+ * @param {string} projectPath project directory
+ * @param {string} [lockData] Gemfile.lock contents, when already read
+ * @returns {Array<{engine: string, version?: string, requirement?: string,
+ *   patchlevel?: string, source: string, path: string}>}
+ */
+export declare function collectProjectRubyDeclarations(projectPath: string, lockData?: string): Array<{
+    engine: string;
+    version?: string;
+    requirement?: string;
+    patchlevel?: string;
+    source: string;
+    path: string;
+}>;
+/**
+ * Settle the Ruby a project runs on from its declarations: the exact version
+ * of the most authoritative source that has one, and the requirements of the
+ * sources that only constrain it.
+ *
+ * @param {Array<Object>} declarations result of collectProjectRubyDeclarations
+ * @returns {{engine: string, version?: string, patchlevel?: string,
+ *   prerelease?: boolean, rubyVersion?: string, source?: string,
+ *   requirements: string[], conflicts: string[]}|undefined}
+ */
+export declare function resolveProjectRuby(declarations: Array<Object>): {
+    engine: string;
+    version?: string;
+    patchlevel?: string;
+    prerelease?: boolean;
+    rubyVersion?: string;
+    source?: string;
+    requirements: string[];
+    conflicts: string[];
+} | undefined;
+/**
+ * Describe the Ruby runtime of a project as one external `platform`
  * component, and make the components that declare a `required_ruby_version`
  * depend on it (discussion 4409).
  *
- * The component stands for the Ruby the bundle as a whole runs on, so its
- * `versionRange` is the intersection of every requirement that could be read,
- * in the `vers` syntax CycloneDX mandates for the field. Each component's own
- * requirement stays in its `cdx:gem:rubyVersionSpecifiers` property. One
- * runtime component per distinct requirement would describe the same
- * interpreter many times over: a modest bundle spells `>= 2.x` a dozen ways.
+ * When the project pins a Ruby (Gemfile.lock `RUBY VERSION`, `.ruby-version`,
+ * `.tool-versions`, mise or the Gemfile `ruby` directive), the component names
+ * that version, `pkg:generic/ruby@3.3.6`, with the CPE a scanner matches
+ * interpreter advisories by. The requirements of the gems then stay in the
+ * `cdx:ruby:requiredVersionRange` property, since CycloneDX allows a
+ * `versionRange` only on a component without a version.
+ *
+ * Without a pin, the component stands for the Ruby the bundle as a whole runs
+ * on, so its `versionRange` is the intersection of every requirement that
+ * could be read, in the `vers` syntax CycloneDX mandates for the field. Each
+ * component's own requirement stays in its `cdx:gem:rubyVersionSpecifiers`
+ * property. One runtime component per distinct requirement would describe the
+ * same interpreter many times over: a modest bundle spells `>= 2.x` a dozen
+ * ways.
  *
  * The type is `platform`, the CycloneDX type for a runtime environment that
  * interprets software, and the one cdxgen gives the Ruby it finds in the
- * build environment. The purl names no version, since a range is not one.
+ * build environment. A range is not a version, so an unpinned purl names none.
  *
- * `isExternal` and `versionRange` are CycloneDX 1.7 fields, and without them
- * the component would claim the product bundles its interpreter, so the caller
- * decides whether the BOM should carry it at all.
+ * `isExternal` and `versionRange` are CycloneDX 1.7 fields. A pinned runtime
+ * also carries the `cdx:ruby:isExternal` property, which says the interpreter
+ * comes with the deployment environment in a BOM of an older spec; the caller
+ * decides whether such a BOM should carry an unpinned runtime at all.
  *
  * @param {Array} pkgList Components
  * @param {object} parentComponent The metadata.component, when the project is
  *   itself a gem
  * @param {Array} dependencies Dependency edges
+ * @param {object} [projectRuby] result of resolveProjectRuby
  * @returns {{pkgList: Array, dependencies: Array}} Components and edges with
  *   the runtime component added
  */
-export declare function addRubyRuntimeComponent(pkgList: any[], parentComponent: object, dependencies: any[]): {
+export declare function addRubyRuntimeComponent(pkgList: any[], parentComponent: object, dependencies: any[], projectRuby?: object): {
     pkgList: any[];
     dependencies: any[];
 };

package/types/lib/ecosystems/rubyutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rubyutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/rubyutils.js"],"names":[],"mappings":"AAoEA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAHzB,MAGyB,GAFvB,OAAO,CAOnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAHlC,MAAM,GAAG,SAGyB,GAFhC,MAAM,GAAG,SAAS,CAO9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAHrC,MAAM,GAAG,SAG4B,GAFnC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAAC,QAAQ,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CAAC,CAe3E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CAIlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,IAAI,EALnB,MAKmB,EAAE,OAAO,EAJ5B,MAAM,GAAG,SAImB,EAAE,QAAQ,EAHtC,MAAM,GAAG,SAG6B,GAFpC,MAAM,CAclB;AA4FD;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAN/B,MAM+B,GAL7B;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAG,SAAS,CAqE/F;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAL5B,MAK4B,GAJ1B;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAC,GAAG,SAAS,CAsE7D;AAuPD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAAC,GAAG,SAAS,CAqBjE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,IAF1B,MAAM,CAWlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC,MAAM,CAiClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAHjC,MAGiC,GAF/B,MAAM,CAgClB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,OAAA,EAAE,OAAO,GAJ5D;IAAwB,OAAO,EAAvB,MAAM,CACd;IAAwB,oBAAoB,EAApC,MAAM,CACd;CAEiE,GAFvD,OAAO,OAAO,CAuJ1B;AAsJD;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,OAAA,kBAiJhD;AA8CD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,KAAA,YAsBpC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,QAAA,EACX,aAAa,QAAA,EACb,OAAO,QAAA,EACP,OAAO,QAAA,EACP,QAAQ,QAAA,GAPG,KAAK,CAAC,MAAM,CAAC,CA4IzB;AAuED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EAZvC,MAYuC,EAAE,WAAW,EAXpD,MAWoD,EAAE,OAAO,AAVrE,CASF,EARE;IAAyC,cAAc,AAAvD,CAEA,yBAAA;IAA0B,cAAc,AAAxC,CAGA,EAHQ,OAAO,CAGf;IAA0B,OAAO,AAAjC,CAGF,EAHU,OAAO,CAGjB;CAC4E,kBAua5E;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAPF,MAOE,EACX,QAAQ,EAPC,MAOD,EACR,OAAO,AAPN,CAGF,EAFE;IAAyB,OAAO,AAAhC,CACA,EADQ,MAAM,CACd;IAAyB,oBAAoB,AAA7C,CACF,EADU,MAAM,CAChB;CAIa;;;;;;;;GAqYb;AAUD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,kBAAkB,CAChC,eAAe,EAXN,MAWM,EACf,UAAU,EAXD,MAWC,EACV,OAAO,EAXE,MAAM,EAWR,EACP,YAAY,EAXH,MAAM,EAWH,EACZ,QAAQ,EAXC,MAAM,EAWP,EACR,cAAc,EAXL,MAAM,EAWD,EACd,OAAO,GAXE,MAWG,GAVD;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAC,CAkH3E;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,OAAA,SAmClD;AA8GD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EALvC,MAAM,EAKiC,GAHrC,MAAM,GAAC,IAAI,GAAC,SAAS,CAoHjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,OAAA,EACP,eAAe,EARN,MAQM,EACf,YAAY,OAAA,GAND;IAAC,OAAO,QAAQ;IAAC,YAAY,QAAO;CAAC,CAmEjD"}
+{"version":3,"file":"rubyutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/rubyutils.js"],"names":[],"mappings":"AA0EA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAHzB,MAGyB,GAFvB,OAAO,CAOnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAHlC,MAAM,GAAG,SAGyB,GAFhC,MAAM,GAAG,SAAS,CAO9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAHrC,MAAM,GAAG,SAG4B,GAFnC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAAC,QAAQ,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CAAC,CAe3E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CAIlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,IAAI,EALnB,MAKmB,EAAE,OAAO,EAJ5B,MAAM,GAAG,SAImB,EAAE,QAAQ,EAHtC,MAAM,GAAG,SAG6B,GAFpC,MAAM,CAclB;AA4FD;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAN/B,MAM+B,GAL7B;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAG,SAAS,CAqE/F;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAL5B,MAK4B,GAJ1B;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAC,GAAG,SAAS,CAsE7D;AAuPD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAAC,GAAG,SAAS,CAqBjE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,IAF1B,MAAM,CAWlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC,MAAM,CAiClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAHjC,MAGiC,GAF/B,MAAM,CAgClB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,OAAA,EAAE,OAAO,GAJ5D;IAAwB,OAAO,EAAvB,MAAM,CACd;IAAwB,oBAAoB,EAApC,MAAM,CACd;CAEiE,GAFvD,OAAO,OAAO,CAuJ1B;AAsJD;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,OAAA,kBAiJhD;AA8CD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,KAAA,YAsBpC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,QAAA,EACX,aAAa,QAAA,EACb,OAAO,QAAA,EACP,OAAO,QAAA,EACP,QAAQ,QAAA,GAPG,KAAK,CAAC,MAAM,CAAC,CA4IzB;AAwFD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAHrC,MAGqC,GAFnC,OAAO,CAUnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EAZvC,MAYuC,EAAE,WAAW,EAXpD,MAWoD,EAAE,OAAO,AAVrE,CASF,EARE;IAAyC,cAAc,AAAvD,CAEA,yBAAA;IAA0B,cAAc,AAAxC,CAGA,EAHQ,OAAO,CAGf;IAA0B,OAAO,AAAjC,CAGF,EAHU,OAAO,CAGjB;CAC4E,kBA6a5E;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAPF,MAOE,EACX,QAAQ,EAPC,MAOD,EACR,OAAO,AAPN,CAGF,EAFE;IAAyB,OAAO,AAAhC,CACA,EADQ,MAAM,CACd;IAAyB,oBAAoB,AAA7C,CACF,EADU,MAAM,CAChB;CAIa;;;;;;;;GAqYb;AAUD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,kBAAkB,CAChC,eAAe,EAXN,MAWM,EACf,UAAU,EAXD,MAWC,EACV,OAAO,EAXE,MAAM,EAWR,EACP,YAAY,EAXH,MAAM,EAWH,EACZ,QAAQ,EAXC,MAAM,EAWP,EACR,cAAc,EAXL,MAAM,EAWD,EACd,OAAO,GAXE,MAWG,GAVD;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAC,CAkH3E;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,OAAA,SAmClD;AA8GD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EALvC,MAAM,EAKiC,GAHrC,MAAM,GAAC,IAAI,GAAC,SAAS,CAoHjC;AAiCD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAsB9F;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAH/B,MAG+B,GAF7B;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAsB9F;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,EAAE,MAAM,AAHvC,CACA,EADQ,MAG6C,GAF3C;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAwB9F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAJnC,MAImC,GAHjC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CA4D5C;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAJrC,MAIqC,GAHnC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAyCnD;AASD;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAAC,WAAW,EAL/C,MAK+C,EAAE,QAAQ,AAJjE,CACA,EADQ,MAIyD,GAHvD,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,CAAC,CAsDvD;AAcD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EALpC,KAAK,CAAC,MAAM,CAKwB,GAJlC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC/D,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAC5D,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAAS,CAyD1D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,OAAA,EACP,eAAe,EATN,MASM,EACf,YAAY,OAAA,EACZ,WAAW,AARV,CACA,EADQ,MAQE,GAPA;IAAC,OAAO,QAAQ;IAAC,YAAY,QAAO;CAAC,CA4HjD"}

package/types/lib/ecosystems/scalacliutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scalacliutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/scalacliutils.js"],"names":[],"mappings":"AAyCA;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EANvC,MAMuC,GALrC;IAAE,YAAY,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAyD5G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAL1B,MAK0B,EAAE,OAAO,EAJnC,MAImC,EAAE,UAAU,EAH/C,MAG+C,GAF7C,MAAM,GAAC,IAAI,CAuDvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAHxC,MAGwC,GAFtC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAC,IAAI,CAkCjE;AAsBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EALtC,MAKsC,EAAE,OAAO,GAJ/C,MAIoD,GAHlD,MAAM,EAAE,CAmGpB"}
+{"version":3,"file":"scalacliutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/scalacliutils.js"],"names":[],"mappings":"AA0CA;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EANvC,MAMuC,GALrC;IAAE,YAAY,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAyD5G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAL1B,MAK0B,EAAE,OAAO,EAJnC,MAImC,EAAE,UAAU,EAH/C,MAG+C,GAF7C,MAAM,GAAC,IAAI,CAuDvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAHxC,MAGwC,GAFtC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAC,IAAI,CAkCjE;AAsBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EALtC,MAKsC,EAAE,OAAO,GAJ/C,MAIoD,GAHlD,MAAM,EAAE,CAoGpB"}

package/types/lib/ecosystems/vendoredCode.d.ts

@@ -14,6 +14,32 @@
  * @returns {boolean}
  */
 export declare function isLicenseFileName(name: string): boolean;
+/**
+ * Read the version of a vendored directory from the library's own version
+ * header, else from its CMake project() call.
+ *
+ * @param {string} dir Absolute path of the vendored directory
+ * @returns {{version?: string, source?: string, cpe?: string, properties: Object[]}|undefined}
+ *   undefined when nothing is known, and without a version when only the fix
+ *   marker could be read
+ */
+export declare function vendoredVersionOf(dir: string): {
+    version?: string;
+    source?: string;
+    cpe?: string;
+    properties: Object[];
+} | undefined;
+/**
+ * Whether a file lies under a directory conventionally holding another
+ * project's code (`third_party/`, `vendor/`, `external/`) below the scan root.
+ * Build files there belong to the copied project: building them runs that
+ * project's build, and their dependencies are its build tooling.
+ *
+ * @param {string} root Project scan root
+ * @param {string} file File path
+ * @returns {boolean}
+ */
+export declare function isInVendoredDir(root: string, file: string): boolean;
 /**
  * Find the directories of a project that carry code under a license other
  * than the project's.

package/types/lib/ecosystems/vendoredCode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vendoredCode.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/vendoredCode.js"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA2BH;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAH3B,MAG2B,GAFzB,OAAO,CAkBnB;AAkBD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAP1B,MAO0B,EAAE,OAAO,GANnC,MAMwC,EAAE,WAAW,AAL7D,CAEA,EAFQ,MAAM,EAKoD,GAHxD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,CAwElD"}
+{"version":3,"file":"vendoredCode.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/vendoredCode.js"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA2BH;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAH3B,MAG2B,GAFzB,OAAO,CAkBnB;AAuJD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAL1B,MAK0B,GAJxB;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAAS,CAuC7F;AAcD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,IAAI,EAH/B,MAG+B,GAF7B,OAAO,CAWnB;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAP1B,MAO0B,EAAE,OAAO,GANnC,MAMwC,EAAE,WAAW,AAL7D,CAEA,EAFQ,MAAM,EAKoD,GAHxD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,CA0FlD"}

package/types/lib/ecosystems/venvProbe.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Find the virtual environments and pyenv interpreters under the fixed
+ * places of a root.
+ *
+ * @param {string} rootPath root directory
+ * @param {string} platform `linux` or `darwin`
+ * @returns {{path: string, kind: string}[]} environments, at most MAX_ENVIRONMENTS
+ */
+export declare function findPythonEnvironments(rootPath: string, platform: string): {
+    path: string;
+    kind: string;
+}[];
+/**
+ * Inventory the packages installed in the virtual environments and pyenv
+ * interpreters of a host. One component per distinct name and version, with
+ * an occurrence for each dist-info directory it was found in, so no host path
+ * reaches a purl.
+ *
+ * @param {Object} [options] options
+ * @param {string} [options.rootPath="/"] root directory; tests point it at a built tree
+ * @param {string} [options.platform] `linux` or `darwin`
+ * @returns {Object[]} pypi components
+ */
+export declare function probeHostPythonEnvironments(options?: {
+    rootPath?: string;
+    platform?: string;
+}): Object[];
+/**
+ * Add the packages of the host's Python environments to an OBOM's component
+ * list. A package osquery already listed from the interpreter's own
+ * site-packages keeps its component; the environment's dist-info becomes one
+ * more occurrence of it, and its cdx:python:environment property says where
+ * else it is installed.
+ *
+ * @param {Object[]} components OBOM components
+ * @param {Object[]} envPackages result of probeHostPythonEnvironments
+ * @returns {Object[]} the components, with the environment packages merged in
+ */
+export declare function mergeHostPythonEnvironmentPackages(components: Object[], envPackages: Object[]): Object[];
+//# sourceMappingURL=venvProbe.d.ts.map

package/types/lib/ecosystems/venvProbe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"venvProbe.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/venvProbe.js"],"names":[],"mappings":"AAoHA;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAJpC,MAIoC,EAAE,QAAQ,EAH9C,MAG8C,GAF5C;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,EAAE,CAkD1C;AA8BD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,AALhD,CAGA,EAFA;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;CAEqD,GAF3C,MAAM,EAAE,CAkGpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kCAAkC,CAAC,UAAU,EAJlD,MAAM,EAI4C,EAAE,WAAW,EAH/D,MAAM,EAGyD,GAF7D,MAAM,EAAE,CAuCpB"}

package/types/lib/evinser/evinser.d.ts

@@ -417,14 +417,7 @@ export declare function isFilterableType(language: string, userDefinedTypesMap:
  * @returns {void}
  */
 export declare function detectServicesFromOpenAPI(_language: string, openapiSpecFile: string, servicesMap: Object): void;
-/**
- * Method to detect services from annotation objects in the usage slice
- *
- * @param {string} language Application language
- * @param {Array} slice Usages array for each objectSlice
- * @param {Object} servicesMap Existing service map
- */
-export declare function detectServicesFromUsages(language: string, slice: any[], servicesMap?: Object): never[] | undefined;
+export declare function detectServicesFromUsages(language: any, slice: any, servicesMap?: {}): never[] | undefined;
 /**
  * Method to detect services from user defined types in the usage slice
  *
@@ -457,6 +450,35 @@ export declare function constructServiceName(_language: string, slice: Object):
  * @returns {string[]|undefined} Array of endpoint paths or `undefined` when none are found
  */
 export declare function extractEndpoints(language: string, code: string): string[] | undefined;
+/**
+ * Key naming the package a purl refers to, independent of its version,
+ * qualifiers and subpath. Namespace and name are the decoded purl segments,
+ * so an encoded scope (`%40angular/common`) keys like a plain one.
+ *
+ * @param {string} purl Purl string
+ * @returns {string|undefined} `type/namespace/name`, or undefined for a non-purl
+ */
+export declare function versionlessPurlKey(purl: string): string | undefined;
+/**
+ * Index the data-flow frames recorded under versionless flow purls by
+ * {@link versionlessPurlKey}. A flow purl without a version attaches to every
+ * BOM component of the same package name, whatever its version (maintainer
+ * decision, 2026-10-27); chen leaves the version off exactly when it cannot
+ * pick one between apps that pin the package differently.
+ *
+ * @param {Object} dataFlowFrames Frames keyed by flow purl
+ * @returns {Object} Frames keyed by versionless purl key
+ */
+export declare function indexVersionlessPurls(dataFlowFrames: Object): Object;
+/**
+ * Index the crypto generate pools recorded under versionless flow purls by
+ * {@link versionlessPurlKey}, the crypto counterpart of
+ * {@link indexVersionlessPurls}.
+ *
+ * @param {Object} cryptoGeneratePurls Algorithm bom-refs keyed by flow purl
+ * @returns {Object} Algorithm bom-ref sets keyed by versionless purl key
+ */
+export declare function indexVersionlessCrypto(cryptoGeneratePurls: Object): Object;
 /**
  * Method to create the SBOM with evidence file called evinse file.
  *
@@ -526,4 +548,37 @@ export declare function simplifyType(typeFullName: string): string;
  * @returns {string|undefined} Enclosing class type or `undefined` when it cannot be resolved
  */
 export declare function getClassTypeFromSignature(language: string, typeFullName: string): string | undefined;
+/**
+ * npm package name of a JavaScript module specifier: `@scope/pkg/sub` -> `@scope/pkg`,
+ * `lodash/fp` -> `lodash`. Node.js builtins (`node:fs`, `fs`) are not packages.
+ *
+ * @param {string} module module specifier
+ * @returns {string|undefined} package name
+ */
+export declare function jsPackageOfModule(module: string): string | undefined;
+/**
+ * Attribute a JavaScript usage's module-qualified entries to the packages providing them.
+ *
+ * Each call entry with a `module` is a use of that module's package at the call's line. When
+ * the slice's object is an import binding (defined by a require/import naming the module),
+ * every call the object takes part in is a use of that package too.
+ *
+ * @param {Object} ausage usage entry of an object slice
+ * @param {string} fileName file of the slice
+ * @param {Object} purlImportsMap purl -> imported modules and symbols
+ * @param {Object} purlLocationMap purl -> Set of `file#line`
+ */
+export declare function attributeJsModules(ausage: Object, fileName: string, purlImportsMap: Object, purlLocationMap: Object): void;
+/**
+ * Attribute a callsites slice's records to the packages providing their modules.
+ *
+ * Each record of `{"callsites": [...]}` (atom `callsites` command) is one external use site
+ * carrying its own file and line; the record is an occurrence of every purl whose package
+ * matches the record's module.
+ *
+ * @param {Object} callsitesSlice callsites slice with a `callsites` array
+ * @param {Object} purlImportsMap purl -> imported modules and symbols
+ * @param {Object} purlLocationMap purl -> Set of `file#line`
+ */
+export declare function attributeJsCallsites(callsitesSlice: Object, purlImportsMap: Object, purlLocationMap: Object): void;
 //# sourceMappingURL=evinser.d.ts.map

package/types/lib/evinser/evinser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evinser.d.ts","sourceRoot":"","sources":["../../../lib/evinser/evinser.js"],"names":[],"mappings":"AA8HA;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC7C,SAAS,EAJA,MAIA,EACT,kBAAkB,GAJT,MAAM,EAIQ,QAkBxB;AAyBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EALpC,MAKoC,EAAE,OAAO,AAJrD,CACA,EADQ,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,MAAM,GAAC,SAAS,CAyC5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAL/B,MAK+B,EAAE,IAAI,EAJrC,MAIqC,EAAE,KAAK,EAH5C,MAG4C,GAF1C,MAAM,CA2ClB;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAF5B,MAE4B;;;;;;;eAuDtC;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAJ7B,MAI6B,EAAE,OAAO,AAH9C,CACA,EADQ,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAqB5B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAPE,MAOF,EACP,SAAS,wBAAA,EACT,UAAU,EAPD,MAOC,EACV,OAAO,GAPE,MAOG,GAND,OAAO,CAAC,IAAI,CAAC,CAuDzB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EANE,MAMF,EACP,SAAS,wBAAA,EACT,UAAU,EAND,MAMC,EACV,OAAO,KAAK,GAND,OAAO,CAAC,IAAI,CAAC,CA8CzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAPK,MAOL,EACJ,SAAS,wBAAA,EACT,MAAM,EAPG,MAOH,EACN,OAAO,GAPE,MAOG,GAND,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAuBrC;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAH9B,MAG8B,GAF5B,MAAM,CAOlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAC/B,eAAe,EAPN,MAAM,GAAC,MAAM,EAOP,EACf,QAAQ,EAPC,MAOD,EACR,SAAS,AAPR,CACA,EADQ,MAOW,EACpB,OAAO,AAPN,CACA,EADQ,MAOG,GAND,OAAO,CAAC,MAAM,CAAC,CA0N3B;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAJxB,MAIwB,EAAE,QAAQ,AAH1C,CACA,EADQ,MAGkC,GAFhC,MAAM,GAAC,SAAS,CA4B5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAJ5B,MAAM,EAIsB,EAAE,QAAQ,EAHtC,MAGsC,GAFpC;IAAE,eAAe,2BAAsB;IAAC,cAAc,2BAA0B;CAAE,CAiD9F;AAcD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAPC,MAOD,EACR,UAAU,EAPD,MAOC,EACV,OAAO,EAPE,MAOF,EACP,OAAO,EAPE,MAOF,GANI,SAAS,GAAC,MAAM,CAqC5B;AA4KD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAJnC,MAImC,EAAE,MAAM,EAH3C,MAG2C,GAFzC,MAAM,CAgClB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EARF,MAAM,GAAC,IAAI,GAAC,SAQV,EACX,OAAO,EAPE,MAOF,EACP,OAAO,GAPE,MAOG,EACZ,WAAW,AAPV,CACA,EADQ,MAOO,GANL,MAAM,CAmBlB;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAHlC,MAGkC,EAAE,OAAO,EAF3C,MAE2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0gBrD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EARD,MAQC,EACV,UAAU,EARD,MAAM,EAQL,EACV,OAAO,EARE,MAQF,EACP,OAAO,GARE,MAQG,GAPD;IAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;CAAC,CA0EpF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EARD,MAQC,EACV,UAAU,EARD,MAAM,EAQL,EACV,OAAO,EARE,MAQF,EACP,cAAc,GARL,MAQU,EACnB,OAAO,GARE,MAQG,GAPD,MAAM,CAqBlB;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,KAAA,EACR,UAAU,KAAA,EACV,QAAQ,KAAA,EACR,WAAW,KAAK,EAChB,eAAe,KAAK,EACpB,cAAc,KAAK,EACnB,eAAe,YAAY,eAuD5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EATC,MASD,EACR,mBAAmB,EATV,MASU,EACnB,KAAK,OAAA,EACL,QAAQ,EATC,MASD,EACR,eAAe,EATN,MASM,EACf,cAAc,EATL,MASK,iBA4Nf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,KAAA,EAAE,UAAU,OAAA,EAAE,cAAc,EAH9D,MAG8D,GAF5D,MAAM,CAsDlB;AA2LD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAL9B,MAK8B,EAAE,mBAAmB,yBAAA,EAAE,YAAY,EAHjE,MAGiE,GAF/D,OAAO,CA2EnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EANA,MAMA,EACT,eAAe,EANN,MAMM,EACf,WAAW,EANF,MAME,GALA,IAAI,CAqChB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,KAAK,OAAA,EAAE,WAAW,GAF1D,MAE+D,uBA2DzE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAJnC,MAImC,EAAE,gBAAgB,OAAA,EAAE,WAAW,EAFlE,MAEkE,QAgD5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAJnC,MAImC,EAAE,KAAK,EAH1C,MAG0C,GAFxC,MAAM,CAalB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAJ9B,MAI8B,EAAE,IAAI,EAHpC,MAGoC,GAFlC,MAAM,EAAE,GAAC,SAAS,CAwF9B;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,cAAc,EAJ1C,MAI0C,EAAE,OAAO,EAHnD,MAGmD,gBA8M7D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EARC,MAQD,EACR,mBAAmB,EARV,MAQU,EACnB,aAAa,EARJ,MAQI,EACb,QAAQ,EARC,MAQD,EACR,gBAAgB,EARP,MAQO,EAChB,cAAc,EARL,MAQK,eA4Gf;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAHrC,MAGqC,EAAE,eAAe,EAFtD,MAEsD;;;;;;;;YAgFzD,SAAS;YACT,GAAG;;;;EASV;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,OAAA,qBA4DnC;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,YAAY,EAH9B,MAG8B,UAExC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAJvC,MAIuC,EAAE,YAAY,EAHrD,MAGqD,GAFnD,MAAM,GAAC,SAAS,CAmD5B"}
+{"version":3,"file":"evinser.d.ts","sourceRoot":"","sources":["../../../lib/evinser/evinser.js"],"names":[],"mappings":"AAkIA;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC7C,SAAS,EAJA,MAIA,EACT,kBAAkB,GAJT,MAAM,EAIQ,QAkBxB;AAyBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EALpC,MAKoC,EAAE,OAAO,AAJrD,CACA,EADQ,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,MAAM,GAAC,SAAS,CAyC5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAL/B,MAK+B,EAAE,IAAI,EAJrC,MAIqC,EAAE,KAAK,EAH5C,MAG4C,GAF1C,MAAM,CA4ClB;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAF5B,MAE4B;;;;;;;eAuDtC;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAJ7B,MAI6B,EAAE,OAAO,AAH9C,CACA,EADQ,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAqB5B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAPE,MAOF,EACP,SAAS,wBAAA,EACT,UAAU,EAPD,MAOC,EACV,OAAO,GAPE,MAOG,GAND,OAAO,CAAC,IAAI,CAAC,CAuDzB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EANE,MAMF,EACP,SAAS,wBAAA,EACT,UAAU,EAND,MAMC,EACV,OAAO,KAAK,GAND,OAAO,CAAC,IAAI,CAAC,CA8CzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAPK,MAOL,EACJ,SAAS,wBAAA,EACT,MAAM,EAPG,MAOH,EACN,OAAO,GAPE,MAOG,GAND,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAuBrC;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAH9B,MAG8B,GAF5B,MAAM,CAOlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAC/B,eAAe,EAPN,MAAM,GAAC,MAAM,EAOP,EACf,QAAQ,EAPC,MAOD,EACR,SAAS,AAPR,CACA,EADQ,MAOW,EACpB,OAAO,AAPN,CACA,EADQ,MAOG,GAND,OAAO,CAAC,MAAM,CAAC,CA2N3B;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAJxB,MAIwB,EAAE,QAAQ,AAH1C,CACA,EADQ,MAGkC,GAFhC,MAAM,GAAC,SAAS,CA4B5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAJ5B,MAAM,EAIsB,EAAE,QAAQ,EAHtC,MAGsC,GAFpC;IAAE,eAAe,2BAAsB;IAAC,cAAc,2BAA0B;CAAE,CAiD9F;AAcD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAPC,MAOD,EACR,UAAU,EAPD,MAOC,EACV,OAAO,EAPE,MAOF,EACP,OAAO,EAPE,MAOF,GANI,SAAS,GAAC,MAAM,CAqC5B;AA4KD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAJnC,MAImC,EAAE,MAAM,EAH3C,MAG2C,GAFzC,MAAM,CAgClB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EARF,MAAM,GAAC,IAAI,GAAC,SAQV,EACX,OAAO,EAPE,MAOF,EACP,OAAO,GAPE,MAOG,EACZ,WAAW,AAPV,CACA,EADQ,MAOO,GANL,MAAM,CAmBlB;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAHlC,MAGkC,EAAE,OAAO,EAF3C,MAE2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyiBrD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EARD,MAQC,EACV,UAAU,EARD,MAAM,EAQL,EACV,OAAO,EARE,MAQF,EACP,OAAO,GARE,MAQG,GAPD;IAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;CAAC,CA0EpF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EARD,MAQC,EACV,UAAU,EARD,MAAM,EAQL,EACV,OAAO,EARE,MAQF,EACP,cAAc,GARL,MAQU,EACnB,OAAO,GARE,MAQG,GAPD,MAAM,CAqBlB;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,KAAA,EACR,UAAU,KAAA,EACV,QAAQ,KAAA,EACR,WAAW,KAAK,EAChB,eAAe,KAAK,EACpB,cAAc,KAAK,EACnB,eAAe,YAAY,eAuD5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EATC,MASD,EACR,mBAAmB,EATV,MASU,EACnB,KAAK,OAAA,EACL,QAAQ,EATC,MASD,EACR,eAAe,EATN,MASM,EACf,cAAc,EATL,MASK,iBA4Of;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,KAAA,EAAE,UAAU,OAAA,EAAE,cAAc,EAH9D,MAG8D,GAF5D,MAAM,CAsDlB;AA2LD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAL9B,MAK8B,EAAE,mBAAmB,yBAAA,EAAE,YAAY,EAHjE,MAGiE,GAF/D,OAAO,CA2EnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EANA,MAMA,EACT,eAAe,EANN,MAMM,EACf,WAAW,EANF,MAME,GALA,IAAI,CAqChB;AAoBD,wBAAgB,wBAAwB,CAAC,QAAQ,KAAA,EAAE,KAAK,KAAA,EAAE,WAAW,KAAK,uBA2DzE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAJnC,MAImC,EAAE,gBAAgB,OAAA,EAAE,WAAW,EAFlE,MAEkE,QAgD5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAJnC,MAImC,EAAE,KAAK,EAH1C,MAG0C,GAFxC,MAAM,CAalB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAJ9B,MAI8B,EAAE,IAAI,EAHpC,MAGoC,GAFlC,MAAM,EAAE,GAAC,SAAS,CAwF9B;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CAQ5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,cAAc,EAHzC,MAGyC,GAFvC,MAAM,CAelB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,mBAAmB,EAH/C,MAG+C,GAF7C,MAAM,CAiBlB;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,cAAc,EAJ1C,MAI0C,EAAE,OAAO,EAHnD,MAGmD,gBAsO7D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EARC,MAQD,EACR,mBAAmB,EARV,MAQU,EACnB,aAAa,EARJ,MAQI,EACb,QAAQ,EARC,MAQD,EACR,gBAAgB,EARP,MAQO,EAChB,cAAc,EARL,MAQK,eA4Gf;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAHrC,MAGqC,EAAE,eAAe,EAFtD,MAEsD;;;;;;;;YAgFzD,SAAS;YACT,GAAG;;;;EASV;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,OAAA,qBA4DnC;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,YAAY,EAH9B,MAG8B,UAExC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAJvC,MAIuC,EAAE,YAAY,EAHrD,MAGqD,GAFnD,MAAM,GAAC,SAAS,CAmD5B;AAgBD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAH7B,MAG6B,GAF3B,MAAM,GAAC,SAAS,CAY5B;AAiCD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EANG,MAMH,EACN,QAAQ,EANC,MAMD,EACR,cAAc,EANL,MAMK,EACd,eAAe,EANN,MAMM,QAoChB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,cAAc,EALL,MAKK,EACd,cAAc,EALL,MAKK,EACd,eAAe,EALN,MAKM,QAehB"}

package/types/lib/inventory/atomUtils.d.ts

@@ -49,6 +49,13 @@ export declare function splitAtomCommand(command: string): [string, string | und
  * @returns {Set<string>} Supported keys
  */
 export declare function atomFrontendArgKeys(language: string): Set<string>;
+/**
+ * The options the installed atom accepts, as `atom --help` lists them. Asked
+ * once per atom command. An atom that fails to start accepts none.
+ *
+ * @returns {Set<string>} Supported options, such as `--bom-file`
+ */
+export declare function atomOptions(): Set<string>;
 /**
  * The `--frontend-args` atom takes for a C/C++ language: the project's
  * compilation database, when there is one and the installed atom reads it
@@ -61,6 +68,18 @@ export declare function atomFrontendArgKeys(language: string): Set<string>;
  * @returns {string[]} Arguments to add to the atom command
  */
 export declare function atomCompileCommandsArgs(src: string, language: string, options?: Object): string[];
+/**
+ * The `--bom-file` a reachables slice takes package purls from: the BOM evinse
+ * annotates. atom would otherwise only find a BOM saved as `bom.json` inside
+ * the scanned directory, so a BOM written anywhere else gave every reachable
+ * flow no purl. An atom without `--bom-file` is given the arguments it has
+ * always been given, and still reads a `bom.json` in the scanned directory.
+ *
+ * @param {string} sliceType atom slice command
+ * @param {Object} options CLI options, for `input`
+ * @returns {string[]} Arguments to add to the atom command
+ */
+export declare function atomBomFileArgs(sliceType: string, options?: Object): string[];
 /**
  * The arguments that stop atom's Java frontend from running the scanned
  * project's build. In its default delombok mode, atom runs

package/types/lib/inventory/atomUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"atomUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/atomUtils.js"],"names":[],"mappings":"AAkEA;;;GAGG;AACH,eAAO,MAAM,oBAAoB,aAM/B,CAAC;AA2CH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,EAAE,OAAO,GAHrC,MAG0C,GAFxC,MAAM,GAAC,SAAS,CA6C5B;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAwBtC;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,GAAG,CAAC,MAAM,CAAC,CAwCvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,QAAQ,EAJ1C,MAI0C,EAAE,OAAO,GAHnD,MAGwD,GAFtD,MAAM,EAAE,CAiCpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAL/B,MAK+B,EAAE,OAAO,GAJxC,MAI6C,GAH3C,MAAM,EAAE,GAAC,SAAS,CAoB9B;AA0RD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,GAH3C,MAAM,EAG0C,GAF9C,MAAM,GAAC,SAAS,CAU5B;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAJ1C,MAI0C,EAAE,QAAQ,AAH5D,CACA,EADQ,MAAM,EAGmD,GAFvD,OAAO,CAkBnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAAC,SAAS,EAJhD,MAAM,QAI0C,EAAE,QAAQ,AAHlE,CACA,EADQ,MAAM,EAGyD,GAF7D,MAAM,QAAM,CA2DxB;AA4BD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAJhC,MAIqC,EAAE,QAAQ,GAH/C,MAGoD,GAFlD,MAAM,CA6DlB;AAgBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,AANrC,CAIA,EAHA;IAAsB,QAAQ,AAA9B,CACA,EADQ,MAAM,CACd;IAAsB,IAAI,AAA1B,CACA,EADQ,MAAM,CACd;IAAsB,IAAI,AAA1B,CACA,EADQ,MAAM,CACd;CAE0C,GAFhC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,GAAC,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,CA6CvG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,qBAqB/B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAJ5B,MAI4B,EAAE,YAAY,EAH1C,QAAQ,GAAC,KAGiC,GAFxC,QAAQ,GAAC,KAAK,CAkC1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,IAFrB,MAAM,GAAC,SAAS,CAO5B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,GAAC,SAAS,CAO5B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,QAAQ,EAH5B,MAAM,EAGsB,GAF7B,MAAM,GAAC,SAAS,CAoB5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,IAF9B,MAAM,GAAC,SAAS,CAgB5B;AAmED;;GAEG;AACH,wBAAgB,cAAc,QAwB7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,GAAC,SAAS,CA0B5B;AAgED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,IAFf;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAC,CAkB3D;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EALhC,MAAM,GAAC,SAKyB,EAAE,SAAS,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGiE,GAF/D,MAAM,EAAE,CAIpB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAL3B,MAK2B,EAAE,SAAS,EAJtC,MAIsC,EAAE,aAAa,EAHrD,MAGqD,GAFnD,OAAO,CAiBnB;AAeD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,GAAG,EALpB,MAKoB,EAAE,IAAI,EAJ1B,MAAM,EAIoB,EAAE,SAAS,GAHrC,MAG0C,GAFxC,OAAO,CA0KnB;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAHpC,MAGoC,GAFlC,MAAM,EAAE,CAwBpB;AAcD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAF1C,MAE0C,QAQpD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAJ9B,MAI8B,EAAE,SAAS,EAHzC,MAGyC,GAFvC,GAAC,CAcb;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAHpC,MAGoC,GAFlC,MAAM,EAAE,GAAC,MAAM,GAAC,SAAS,CAwBrC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EARM,MAQN,EACH,QAAQ,EARC,MAQD,EACR,WAAW,GARF,MAQa,EACtB,UAAU,GARD,MAQa,EACtB,OAAO,GARE,MAQG,OA8Cb"}
+{"version":3,"file":"atomUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/atomUtils.js"],"names":[],"mappings":"AAkEA;;;GAGG;AACH,eAAO,MAAM,oBAAoB,aAM/B,CAAC;AA2CH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,EAAE,OAAO,GAHrC,MAG0C,GAFxC,MAAM,GAAC,SAAS,CA6C5B;AAKD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAwBtC;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,GAAG,CAAC,MAAM,CAAC,CAwCvB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,IAFd,GAAG,CAAC,MAAM,CAAC,CA+BvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,QAAQ,EAJ1C,MAI0C,EAAE,OAAO,GAHnD,MAGwD,GAFtD,MAAM,EAAE,CAiCpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAJ9B,MAI8B,EAAE,OAAO,GAHvC,MAG4C,GAF1C,MAAM,EAAE,CA4BpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAL/B,MAK+B,EAAE,OAAO,GAJxC,MAI6C,GAH3C,MAAM,EAAE,GAAC,SAAS,CAoB9B;AA0RD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,GAH3C,MAAM,EAG0C,GAF9C,MAAM,GAAC,SAAS,CAU5B;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAJ1C,MAI0C,EAAE,QAAQ,AAH5D,CACA,EADQ,MAAM,EAGmD,GAFvD,OAAO,CAkBnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAAC,SAAS,EAJhD,MAAM,QAI0C,EAAE,QAAQ,AAHlE,CACA,EADQ,MAAM,EAGyD,GAF7D,MAAM,QAAM,CA2DxB;AA4BD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAJhC,MAIqC,EAAE,QAAQ,GAH/C,MAGoD,GAFlD,MAAM,CA6DlB;AAgBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,AANrC,CAIA,EAHA;IAAsB,QAAQ,AAA9B,CACA,EADQ,MAAM,CACd;IAAsB,IAAI,AAA1B,CACA,EADQ,MAAM,CACd;IAAsB,IAAI,AAA1B,CACA,EADQ,MAAM,CACd;CAE0C,GAFhC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,GAAC,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,CA6CvG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,qBAqB/B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAJ5B,MAI4B,EAAE,YAAY,EAH1C,QAAQ,GAAC,KAGiC,GAFxC,QAAQ,GAAC,KAAK,CAkC1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,IAFrB,MAAM,GAAC,SAAS,CAO5B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,GAAC,SAAS,CAO5B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,QAAQ,EAH5B,MAAM,EAGsB,GAF7B,MAAM,GAAC,SAAS,CAoB5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,IAF9B,MAAM,GAAC,SAAS,CAgB5B;AAmED;;GAEG;AACH,wBAAgB,cAAc,QAwB7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,GAAC,SAAS,CA0B5B;AAgED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,IAFf;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAC,CAkB3D;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EALhC,MAAM,GAAC,SAKyB,EAAE,SAAS,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGiE,GAF/D,MAAM,EAAE,CAIpB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAL3B,MAK2B,EAAE,SAAS,EAJtC,MAIsC,EAAE,aAAa,EAHrD,MAGqD,GAFnD,OAAO,CAiBnB;AAeD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,GAAG,EALpB,MAKoB,EAAE,IAAI,EAJ1B,MAAM,EAIoB,EAAE,SAAS,GAHrC,MAG0C,GAFxC,OAAO,CA0KnB;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAHpC,MAGoC,GAFlC,MAAM,EAAE,CAwBpB;AAcD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAF1C,MAE0C,QAQpD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAJ9B,MAI8B,EAAE,SAAS,EAHzC,MAGyC,GAFvC,GAAC,CAcb;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAHpC,MAGoC,GAFlC,MAAM,EAAE,GAAC,MAAM,GAAC,SAAS,CAwBrC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EARM,MAQN,EACH,QAAQ,EARC,MAQD,EACR,WAAW,GARF,MAQa,EACtB,UAAU,GARD,MAQa,EACtB,OAAO,GARE,MAQG,OA8Cb"}

package/types/lib/inventory/brotliDecoder.d.ts

@@ -0,0 +1,58 @@
+import { MAX_BROTLI_PROBE_BYTES, MAX_BROTLI_PROBES, readBrotliDecoder } from "../core/brotliProbe.js";
+export { MAX_BROTLI_PROBE_BYTES, MAX_BROTLI_PROBES, readBrotliDecoder };
+/**
+ * The properties a file component carries once it has been probed: the fix
+ * state of each decoder found in it, or why it could not be read.
+ *
+ * @param {Object} decoder result of readBrotliDecoder
+ * @returns {{name: string, value: string}[]} properties to append
+ */
+export declare function brotliDecoderProperties(decoder: Object): {
+    name: string;
+    value: string;
+}[];
+/**
+ * The library component every embedded decoder links to. It has no version:
+ * no build records one, and only the per-file cdx:brotli:*:blockSwitchFix
+ * properties say whether a copy is vulnerable. The `vcs_url` qualifier names
+ * the project and keeps the identity apart from an unpackaged `brotli`
+ * executable, which is `pkg:generic/brotli`. The purl has no namespace: a
+ * `pkg:github` purl is typed as an application and `pkg:generic/google` as a
+ * framework when the BOM is assembled, and this is neither.
+ *
+ * @returns {Object} component with `purl` and `bom-ref`
+ */
+export declare function createBrotliComponent(): Object;
+/**
+ * Start collecting the decoder copies of one scan.
+ *
+ * @returns {{component: Object|undefined, dependencies: Object[], copies: number, unpatched: number, unknown: number}}
+ */
+export declare function createBrotliInventory(): {
+    component: Object | undefined;
+    dependencies: Object[];
+    copies: number;
+    unpatched: number;
+    unknown: number;
+};
+/**
+ * Tag a probed file component and, when it holds a decoder, link it to the
+ * shared brotli component, creating that component on first use. Mutates the
+ * file component in place.
+ *
+ * @param {Object} inventory accumulator from createBrotliInventory
+ * @param {Object} fileComponent file component with a `properties` array
+ * @param {Object} decoder result of readBrotliDecoder
+ */
+export declare function attachBrotliDecoder(inventory: Object, fileComponent: Object, decoder: Object): void;
+/**
+ * Finish an inventory: record the copy counts on the brotli component.
+ *
+ * @param {Object} inventory accumulator from createBrotliInventory
+ * @returns {{components: Object[], dependencies: Object[]}} what to add to the BOM
+ */
+export declare function finishBrotliInventory(inventory: Object): {
+    components: Object[];
+    dependencies: Object[];
+};
+//# sourceMappingURL=brotliDecoder.d.ts.map

package/types/lib/inventory/brotliDecoder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brotliDecoder.d.ts","sourceRoot":"","sources":["../../../lib/inventory/brotliDecoder.js"],"names":[],"mappings":"AAIA,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,CAAC;AAExE;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAHpC,MAGoC,GAFlC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAoB3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,IAFxB,MAAM,CAiBlB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAFxB;IAAC,SAAS,EAAE,MAAM,GAAC,SAAS,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAUrH;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAJlC,MAIkC,EAAE,aAAa,EAHjD,MAGiD,EAAE,OAAO,EAF1D,MAE0D,QAyBpE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAHpC,MAGoC,GAFlC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAkB1D"}

package/types/lib/inventory/cbomutils.d.ts

@@ -30,6 +30,23 @@ export declare function collectDosaiCryptoComponents(src: string, options?: obje
 /**
  * Find crypto algorithm in the given code snippet
  *
+ * cleanStr fuses the snippet's identifiers into one lowercase string
+ * (`prepare_for_save(iv` becomes `prepareforsaveiv`), so a plain substring
+ * test reads short algorithm names inside unrelated identifiers (`rsa` in
+ * `for_save`). A name therefore matches only where a cleanStr word begins:
+ * the snippet's start, right after any character cleanStr strips or keeps as
+ * a separator, or at a lowercase-to-uppercase change in the original text
+ * (`SHA256withRSA`, `HmacSHA256`, `PBKDF2WithHmacSHA256`,
+ * `generateRsaKeyPair`). Boundaries are computed from the original string
+ * before it is lowercased, so case changes survive the cleanStr fusion.
+ * Letter/digit changes do not start a word: they added no match on any
+ * reviewed form or corpus snippet, while splitting every digit-bearing
+ * identifier (`md5`, `base64`) into false word starts. Fused forms the names
+ * themselves are written in still match: `algorithms.AES(key)` and
+ * `AESGCM(key)` yield `aes`, `AES-256-GCM` yields `aes256-GCM`,
+ * `createHash("sha256")` yields `sha-256`. All-uppercase fused forms
+ * (`HMACSHA256`) still hide every name but the run's first.
+ *
  * @param {string} code Code snippet
  * @returns {Array} Arary of crypto algorithm objects with oid and description
  */

package/types/lib/inventory/cbomutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cbomutils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cbomutils.js"],"names":[],"mappings":"AAqBA;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,EAAE,gBAAgB,KAAA,SAiC5D;AAiXD;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CAAC,GAAG,EAL5C,MAK4C,EAAE,OAAO,AAJ7D,CAEA,EADA;IAA0B,IAAI,AAA9B,CACA,EADQ,OAAO,CACf;CAEkE,GAFxD,OAAO,CAAC,MAAM,EAAE,CAAC,CAkD7B;AAED;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,CAAC,GAAG,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC,MAAM,EAAE,CAAC,CAuG7B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAHzB,MAGyB,SAanC"}
+{"version":3,"file":"cbomutils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cbomutils.js"],"names":[],"mappings":"AAqBA;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,EAAE,gBAAgB,KAAA,SAiC5D;AAiXD;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CAAC,GAAG,EAL5C,MAK4C,EAAE,OAAO,AAJ7D,CAEA,EADA;IAA0B,IAAI,AAA9B,CACA,EADQ,OAAO,CACf;CAEkE,GAFxD,OAAO,CAAC,MAAM,EAAE,CAAC,CAkD7B;AAED;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,CAAC,GAAG,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC,MAAM,EAAE,CAAC,CAuG7B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAHzB,MAGyB,SA6CnC"}

package/types/lib/inventory/deps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deps.d.ts","sourceRoot":"","sources":["../../../lib/inventory/deps.js"],"names":[],"mappings":"AAgCA;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B,OAAO,CAInB;AA0DD;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAPC,MAOD,EACR,QAAQ,EAPC,MAOD,EACR,OAAO,GANE,OAMK,EACd,eAAe,GANN,OAMc,eA2ExB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAL/B,MAK+B,EAAE,UAAU,GAJ3C,MAIgD,eA4I1D;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,YAAY,EAH9C,MAG8C,GAF5C,OAAO,CAAC,MAAM,EAAE,CAAC,CAgE7B;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,UAAU,KAAA,GAFzB,MAAM,CAkClB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAHjC,MAGiC,GAF/B,MAAM,CA0BlB;AAgBD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,GAH1C,MAG+C,GAF7C,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAJ7B,MAI6B,EAAE,IAAI,EAHnC,MAGmC,GAFjC,MAAM,CAqBlB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAHrC,MAGqC,GAFnC,MAAM,CAiBlB;AACD;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAL1C,MAK0C,EAAE,OAAO,AAJ3D,CAEA,EAFQ,MAI+D,UAEzE;AAqID;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CA4BpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EALzC,MAKyC,EAAE,OAAO,AAJ1D,CACA,EADQ,MAI8D,GAH5D;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAe3D;AA4BD;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAJ1C,MAI0C,EAAE,WAAW,EAHvD;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAGU,GAFrD,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAAS,CAAC,CAgFlG;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAPE,MAOF,EACP,WAAW,EAPF,MAOE,EACX,eAAe,GAPN,MAOgB,GALd,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA4CrC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EARE,MAQF,EACP,YAAY,EARH,MAQG,EACZ,EAAE,eAAyB,EAAE,aAA+B,EAAE,AAR7D,CAGA,EAFA;IAAsB,eAAe,AAArC,CACA,EADQ,MAAM,CACd;IAAsB,aAAa,AAAnC,CACA,EADQ,MAAM,CACd;CAKkE,GALxD,OAAO,CAAC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,CAAC,CAAC,CAkDxD;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAJhC,MAIgC,gBAqE1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,eAAe,EANhC,MAMgC,EAAE,OAAO,EALzC,MAAM,EAKmC,EAAE,cAAc,EAJzD,MAIyD,EAAE,CAAC,EAH5D,MAG4D,GAF1D,IAAI,CAqDhB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAJtB,MAAM,GAAC,MAIe,EAAE,CAAC,EAHzB,MAAM,GAAC,MAGkB,GAFvB,MAAM,CAWlB"}
+{"version":3,"file":"deps.d.ts","sourceRoot":"","sources":["../../../lib/inventory/deps.js"],"names":[],"mappings":"AAoCA;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B,OAAO,CAInB;AA0DD;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAPC,MAOD,EACR,QAAQ,EAPC,MAOD,EACR,OAAO,GANE,OAMK,EACd,eAAe,GANN,OAMc,eA6ExB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAL/B,MAK+B,EAAE,UAAU,GAJ3C,MAIgD,eA4I1D;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,YAAY,EAH9C,MAG8C,GAF5C,OAAO,CAAC,MAAM,EAAE,CAAC,CAgE7B;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,UAAU,KAAA,GAFzB,MAAM,CAkClB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAHjC,MAGiC,GAF/B,MAAM,CA0BlB;AAgBD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,GAH1C,MAG+C,GAF7C,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAJ7B,MAI6B,EAAE,IAAI,EAHnC,MAGmC,GAFjC,MAAM,CAqBlB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAHrC,MAGqC,GAFnC,MAAM,CAiBlB;AACD;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAL1C,MAK0C,EAAE,OAAO,AAJ3D,CAEA,EAFQ,MAI+D,UAEzE;AAqID;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CA4BpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EALzC,MAKyC,EAAE,OAAO,AAJ1D,CACA,EADQ,MAI8D,GAH5D;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAe3D;AA4BD;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAJ1C,MAI0C,EAAE,WAAW,EAHvD;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAGU,GAFrD,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAAS,CAAC,CAgFlG;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAPE,MAOF,EACP,WAAW,EAPF,MAOE,EACX,eAAe,GAPN,MAOgB,GALd,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA4CrC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EARE,MAQF,EACP,YAAY,EARH,MAQG,EACZ,EAAE,eAAyB,EAAE,aAA+B,EAAE,AAR7D,CAGA,EAFA;IAAsB,eAAe,AAArC,CACA,EADQ,MAAM,CACd;IAAsB,aAAa,AAAnC,CACA,EADQ,MAAM,CACd;CAKkE,GALxD,OAAO,CAAC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,CAAC,CAAC,CAkDxD;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAJhC,MAIgC,gBAqE1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,eAAe,EANhC,MAMgC,EAAE,OAAO,EALzC,MAAM,EAKmC,EAAE,cAAc,EAJzD,MAIyD,EAAE,CAAC,EAH5D,MAG4D,GAF1D,IAAI,CAqDhB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAJtB,MAAM,GAAC,MAIe,EAAE,CAAC,EAHzB,MAAM,GAAC,MAGkB,GAFvB,MAAM,CAWlB"}

package/types/lib/inventory/dosai.d.ts

@@ -128,24 +128,40 @@ export declare function dosaiReportFileOmittedSections(reportFile: string): stri
  * @returns {string[]} The ones cdxgen reads
  */
 export declare function dosaiSectionsCdxgenReads(omittedSections: string[]): string[];
+/**
+ * The largest number of distinct method calls cdxgen keeps from one report.
+ *
+ * Reports in the millions of calls repeat the same call sites heavily, so the
+ * aggregated rows stay far below this; the cap exists so a report whose calls
+ * are all distinct degrades the occurrence evidence instead of the process.
+ *
+ * @returns {number} Cap on distinct kept rows
+ */
+export declare function maxDosaiMethodCalls(): number;
 /**
  * Read a dosai methods report of any size.
  *
  * A report that fits in one JavaScript string is parsed whole. A larger one is
  * read in bounded runs, keeping the requested sections, the CallGraph nodes and
  * edges that PackageReachability references, and the MethodCalls accepted by
- * `keepMethodCall` (none when it is omitted). Nothing cdxgen reads is lost.
+ * `keepMethodCall` (none when it is omitted). A kept MethodCalls row is
+ * reduced to the fields cdxgen reads and aggregated by them, so a call site
+ * reached many times is held once with a `CallCount`; distinct rows past
+ * {@link maxDosaiMethodCalls} are dropped with one warning. Nothing cdxgen
+ * reads is lost.
  *
  * @param {string} reportFile Path to the dosai methods JSON
  * @param {Object} [options] Options
  * @param {string[]} [options.sections] Sections to keep from a large report (default: every section cdxgen reads)
  * @param {Function} [options.keepMethodCall] Predicate choosing the MethodCalls to keep from a large report
+ * @param {number} [options.maxMethodCalls] Cap on distinct kept MethodCalls, for tests
  * @param {number} [options.maxTextBytes] Largest report parsed whole, for tests
  * @returns {Object|undefined} Parsed report, or undefined when missing or invalid
  */
 export declare function readDosaiMethodsReport(reportFile: string, options?: {
     sections?: string[];
     keepMethodCall?: Function;
+    maxMethodCalls?: number;
     maxTextBytes?: number;
 }): Object | undefined;
 /**