@cdxgen/cdxgen 13.5.0 → 13.7.0

package/lib/validator/index.js

@@ -16,6 +16,7 @@ import {
   signatureReportReasons,
   verifyBomSignatures,
 } from "../helpers/bomSigner.js";
+import { loadBomForAnalysis } from "../inventory/cyclonedx20.js";
 import {
   validateBom,
   validateMetadata,
@@ -113,20 +114,25 @@ export async function validateGeneratedBom(bomJson) {
  * Run schema + deep validation checks from the existing validator helpers and
  * capture their boolean results without letting them blow up the process.
  *
+ * The schema check reads the document as given. The deep checks read the
+ * 1.x-shaped model, which for a CycloneDX 2.0 document is what
+ * loadBomForAnalysis reads from it.
+ *
  * An exception is not a verdict on the BOM, so it is recorded in
  * `validationErrors` instead of silently counting as a plain failure.
  *
- * @param {object} bomJson
+ * @param {object} bomJson Document as given
+ * @param {object} internalBom The 1.x-shaped model of the document
  * @param {object} opts
  * @returns {Promise<{ schemaValid: boolean, deepValid: boolean, validationErrors: Array<{ stage: string, message: string }> }>}
  */
-async function runSchemaAndDeep(bomJson, opts) {
+async function runSchemaAndDeep(bomJson, internalBom, opts) {
   let schemaValid = true;
   let deepValid = true;
   const validationErrors = [];
   if (opts.schema !== false) {
     try {
-      schemaValid = (await validateBom(bomJson)) !== false;
+      schemaValid = (await validateBom(bomJson, { deep: false })) !== false;
     } catch (err) {
       schemaValid = false;
       validationErrors.push({
@@ -139,10 +145,10 @@ async function runSchemaAndDeep(bomJson, opts) {
   if (opts.deep !== false) {
     try {
       deepValid =
-        validateMetadata(bomJson) !== false &&
-        validatePurls(bomJson) !== false &&
-        validateRefs(bomJson) !== false &&
-        validateProps(bomJson) !== false;
+        validateMetadata(internalBom) !== false &&
+        validatePurls(internalBom) !== false &&
+        validateRefs(internalBom) !== false &&
+        validateProps(internalBom) !== false;
     } catch (err) {
       deepValid = false;
       validationErrors.push({
@@ -155,9 +161,38 @@ async function runSchemaAndDeep(bomJson, opts) {
   return { schemaValid, deepValid, validationErrors };
 }
 
+/**
+ * Read a BOM into the 1.x-shaped model the deep checks and compliance rules
+ * walk. A 1.x document is used as is; a CycloneDX 2.0 document is read with
+ * loadBomForAnalysis, whose losses name the parts those checks never see.
+ * A read failure is recorded rather than thrown, and the checks then run on
+ * the document as given.
+ *
+ * @param {object} bomJson Parsed CycloneDX BOM
+ * @param {Array<{ stage: string, message: string }>} validationErrors Accumulator
+ * @returns {{ internalBom: object, readLosses: Array<{ pointer: string, reason: string }> }}
+ */
+function readForRules(bomJson, validationErrors) {
+  try {
+    const { internalBom, losses } = loadBomForAnalysis(bomJson);
+    return { internalBom, readLosses: losses };
+  } catch (err) {
+    validationErrors.push({
+      stage: "read",
+      message: err?.message || String(err),
+    });
+    return { internalBom: bomJson, readLosses: [] };
+  }
+}
+
 /**
  * Run structural + compliance validation against a parsed BOM.
  *
+ * The JSON schema check and signature verification read the document as
+ * given. The deep checks and compliance rules read the 1.x-shaped model, so
+ * the same project gives the same rule results at 1.x and at 2.0; for a 2.0
+ * document `readLosses` lists what that model could not hold.
+ *
  * @param {object} bomJson Parsed CycloneDX JSON BOM.
  * @param {object} [options]
  * @param {boolean} [options.schema]            Run JSON-Schema validation (default true).
@@ -175,6 +210,7 @@ async function runSchemaAndDeep(bomJson, opts) {
  *   schemaValid: boolean,
  *   deepValid: boolean,
  *   validationErrors: Array<{ stage: string, message: string }>,
+ *   readLosses: Array<{ pointer: string, reason: string }>,
  *   signatureVerified: boolean | null,
  *   signatureDetails: object | null,
  *   signatureEntries: Array<{ index: number, algorithm: any, keyId: any, verified: boolean }> | null,
@@ -185,11 +221,15 @@ async function runSchemaAndDeep(bomJson, opts) {
  * }}
  */
 export async function validateBomAdvanced(bomJson, options = {}) {
+  const readErrors = [];
+  const { internalBom, readLosses } = readForRules(bomJson, readErrors);
   const { schemaValid, deepValid, validationErrors } = await runSchemaAndDeep(
     bomJson,
+    internalBom,
     options,
   );
-  const allFindings = evaluateAll(bomJson, {
+  validationErrors.unshift(...readErrors);
+  const allFindings = evaluateAll(internalBom, {
     categories: options.categories,
     benchmarks: options.benchmarks,
   });
@@ -249,6 +289,7 @@ export async function validateBomAdvanced(bomJson, options = {}) {
     schemaValid,
     deepValid,
     validationErrors,
+    readLosses,
     signatureVerified,
     signatureDetails,
     signatureEntries,

package/lib/validator/reporters/json.js

@@ -15,6 +15,12 @@ export function render(report, _options = {}) {
     validationErrors: report.validationErrors || [],
     signatureVerified: report.signatureVerified ?? null,
     signatureEntries: report.signatureEntries ?? null,
+    // What reading a CycloneDX 2.0 input into the 1.x model behind the rules
+    // could not hold, as RFC 6901 pointers; empty for 1.x input.
+    readLosses: (report.readLosses || []).map((loss) => ({
+      pointer: loss.pointer,
+      reason: loss.reason,
+    })),
     summary: report.summary,
     benchmarks: report.benchmarks || [],
     findings: (report.findings || []).map((f) => ({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cdxgen/cdxgen",
-  "version": "13.5.0",
+  "version": "13.7.0",
   "description": "Creates CycloneDX Software Bill of Materials (SBOM) from source or container image",
   "keywords": [
     "sbom",
@@ -123,8 +123,8 @@
     "index.cjs"
   ],
   "dependencies": {
-    "@babel/parser": "8.0.7",
-    "@babel/traverse": "8.0.7",
+    "@babel/parser": "8.0.10",
+    "@babel/traverse": "8.0.10",
     "@cdxgen/cdx-purl": "0.0.6",
     "@isaacs/string-locale-compare": "1.1.0",
     "@npmcli/fs": "6.0.0",
@@ -135,7 +135,7 @@
     "ajv-formats": "3.0.1",
     "common-ancestor-path": "2.0.0",
     "edn-data": "1.2.2",
-    "glob": "13.0.6",
+    "glob": "14.0.3",
     "node-stream-zip": "1.16.0",
     "npm-package-arg": "14.0.0",
     "parse-conflict-json": "6.0.0",
@@ -150,17 +150,17 @@
     "yargs": "18.2.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.15",
-    "esmock": "2.8.0",
+    "@biomejs/biome": "2.6.4",
+    "esmock": "3.0.0",
     "poku": "4.5.0",
     "sinon": "22.1.0",
     "typescript": "^7.0.2"
   },
   "optionalDependencies": {
-    "@appthreat/atom": "3.1.1",
-    "@appthreat/atom-parsetools": "1.10.2",
+    "@appthreat/atom": "3.2.1",
+    "@appthreat/atom-parsetools": "1.10.6",
     "@bufbuild/protobuf": "2.16.0",
-    "@cdxgen/cdx-hbom": "0.7.0",
+    "@cdxgen/cdx-hbom": "0.8.0",
     "@cdxgen/cdx-proto": "2.3.0",
     "@cdxgen/cdxgen-plugins-bin": "4.2.0",
     "@cdxgen/cdxgen-plugins-bin-darwin-amd64": "4.2.0",
@@ -174,7 +174,7 @@
     "@cdxgen/cdxgen-plugins-bin-windows-amd64": "4.2.0",
     "@cdxgen/cdxgen-plugins-bin-windows-arm64": "4.2.0",
     "@cdxgen/safer-exec": "1.2.1",
-    "body-parser": "2.3.0",
+    "body-parser": "2.4.0",
     "compression": "1.8.2",
     "connect": "3.7.0",
     "jsonata": "2.2.2"
@@ -203,6 +203,7 @@
     ]
   },
   "scripts": {
+    "check:agent-plugin": "node contrib/check-agent-plugin.js",
     "check:boundaries": "node contrib/check-boundaries.js",
     "check:lib-paths": "node contrib/check-lib-paths.js",
     "check:validators": "node contrib/gen-validators.mjs --check",

package/types/bin/repl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repl.d.ts","sourceRoot":"","sources":["../../bin/repl.js"],"names":[],"mappings":";AAqaA,eAAO,MAAM,UAAU,oCAyEtB,CAAC"}
+{"version":3,"file":"repl.d.ts","sourceRoot":"","sources":["../../bin/repl.js"],"names":[],"mappings":";AAybA,eAAO,MAAM,UAAU,oCA0FtB,CAAC"}

package/types/lib/audit/index.d.ts

@@ -1,10 +1,14 @@
 /** Default predictive audit category list applied when none are explicitly requested. */
 export declare const DEFAULT_AUDIT_CATEGORIES: string[];
 /**
- * Read and validate a CycloneDX BOM file.
+ * Read and validate a CycloneDX BOM file. A CycloneDX 2.0 document is read
+ * into cdxgen's internal 1.x-shaped model, so the audit rules keep reading
+ * `components`, `bom-ref` and `metadata.component`; the number of losses
+ * the read reported is printed once on stderr, with the details in
+ * thoughtLog.
  *
  * @param {string} bomPath BOM file path
- * @returns {object} parsed CycloneDX BOM
+ * @returns {object} parsed CycloneDX BOM in the 1.x shape
  */
 export declare function loadBomFile(bomPath: string): object;
 /**

package/types/lib/audit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/audit/index.js"],"names":[],"mappings":"AA8EA,yFAAyF;AACzF,eAAO,MAAM,wBAAwB,UAKpC,CAAC;AAuCF;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAHxB,MAGwB,GAFtB,MAAM,CAclB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAHxB,MAGwB,GAFtB,MAAM,EAAE,CAoBpB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAAE,CA0BjD;AA+CD;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAAC,SAAS,EAJ9C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAIW,EAAE,OAAO,AAH/D,CACA,EADQ,MAG4D,GAF1D,OAAO,CAAC,MAAM,CAAC,CAuG3B;AAidD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAHtC,MAGsC,GAFpC,MAAM,EAAE,CAqdpB;AA4KD;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAJ1C,MAI0C,EAAE,MAAM,EAHlD,MAGkD,GAFhD;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CA0CnD;AAoCD;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAL1C,MAK0C,EAAE,MAAM,EAJlD,MAIkD,EAAE,UAAU,EAH9D,MAG8D,GAF5D;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CASnD;AAmGD;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAJ/C,MAI+C,EAAE,MAAM,EAHvD,MAGuD,GAFrD,MAAM,EAAE,CAkEpB;AAgKD;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAwQ3B;AAoVD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAAM,EAGwB,GAF5B,MAAM,EAAE,CAgDpB;AAoBD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,SAAS,EAJrC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAIE,EAAE,OAAO,EAH9C,MAG8C,GAF5C,OAAO,CAAC,MAAM,CAAC,CAuJ3B;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAH3B,MAG2B,GAFzB,OAAO,CAAC,MAAM,CAAC,CA0B3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EALnC,MAKmC,EAAE,SAAS,EAJ9C,MAAM,EAIwC,EAAE,MAAM,EAHtD,MAAM,GAAC,IAG+C,GAFpD,IAAI,CAwChB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAwChD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,GAF5B,MAAM,GAAG,SAAS,CAU9B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/audit/index.js"],"names":[],"mappings":"AAkFA,yFAAyF;AACzF,eAAO,MAAM,wBAAwB,UAKpC,CAAC;AAuCF;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAHxB,MAGwB,GAFtB,MAAM,CA4BlB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAHxB,MAGwB,GAFtB,MAAM,EAAE,CAoBpB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAAE,CA0BjD;AA+CD;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAAC,SAAS,EAJ9C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAIW,EAAE,OAAO,AAH/D,CACA,EADQ,MAG4D,GAF1D,OAAO,CAAC,MAAM,CAAC,CAuG3B;AAidD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAHtC,MAGsC,GAFpC,MAAM,EAAE,CAqdpB;AA4KD;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAJ1C,MAI0C,EAAE,MAAM,EAHlD,MAGkD,GAFhD;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CA0CnD;AAoCD;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAL1C,MAK0C,EAAE,MAAM,EAJlD,MAIkD,EAAE,UAAU,EAH9D,MAG8D,GAF5D;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CASnD;AAmGD;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAJ/C,MAI+C,EAAE,MAAM,EAHvD,MAGuD,GAFrD,MAAM,EAAE,CAkEpB;AAgKD;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAwQ3B;AAoVD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAAM,EAGwB,GAF5B,MAAM,EAAE,CAgDpB;AAoBD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,SAAS,EAJrC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAIE,EAAE,OAAO,EAH9C,MAG8C,GAF5C,OAAO,CAAC,MAAM,CAAC,CAuJ3B;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAH3B,MAG2B,GAFzB,OAAO,CAAC,MAAM,CAAC,CA0B3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EALnC,MAKmC,EAAE,SAAS,EAJ9C,MAAM,EAIwC,EAAE,MAAM,EAHtD,MAAM,GAAC,IAG+C,GAFpD,IAAI,CAwChB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAwChD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,GAF5B,MAAM,GAAG,SAAS,CAU9B"}

package/types/lib/cli/bomAssembly.d.ts

@@ -41,10 +41,22 @@ export declare const createDefaultParentComponent: (path: string, type?: string,
  *   project name/version is available
  */
 export declare const determineParentComponent: (options: object) => object | undefined;
+/**
+ * Builds the tool components for the external helpers and build tools this
+ * run executed, from the run-scoped registry (issue #598). Bundled plugin
+ * helpers are enriched with the manifest component of the plugin package that
+ * ships them, so the plugin package's version and identity travel with the
+ * helper. Empty when the run spawned nothing external, which keeps such BOMs
+ * byte-identical to the previous behaviour.
+ *
+ * @returns {object[]} Sorted CycloneDX tool components
+ */
+export declare const buildExternalToolComponents: () => object[];
 /**
  * Assembles the `metadata.tools` block, including the cdxgen tool entry and,
  * for spec versions prior to 1.5, the legacy tools array. For spec version
- * 1.6+ the author field is converted to the authors array.
+ * 1.6+ the author field is converted to the authors array. The tools this run
+ * executed follow the context tools, sorted by name, and cdxgen comes last.
  *
  * @param {object} options CLI options
  * @param {object} [context={}] Additional context carrying existing components
@@ -170,6 +182,22 @@ export declare function getPackageBinCommandNames(pkg: object): Set<string>;
  * @returns {boolean} True when at least one bin command is imported
  */
 export declare function hasNpmBinCommandEvidence(allImports: object, pkg: object): boolean;
+/**
+ * Return a CycloneDX organisational entity built from a collector-supplied
+ * supplier or manufacturer, or undefined when the value is not a well-formed
+ * entity.
+ *
+ * An entity needs a non-empty string name. When a url is present it must be
+ * an array of valid IRI references; any other shape (a single string, an
+ * array holding non-strings) drops the entity so the BOM stays schema
+ * valid. Each contact is reduced to its string name, email and phone, and a
+ * contact with none of them is left out. The entity bom-ref is not copied,
+ * because CycloneDX 1.4 does not allow it there.
+ *
+ * @param {Object} entity Collector-supplied organisational entity
+ * @returns {Object|undefined} Organisational entity, or undefined
+ */
+export declare function toOrganizationalEntity(entity: Object): Object | undefined;
 /**
  * Given the specified package, create a CycloneDX component and add it to the list.
  */

package/types/lib/cli/bomAssembly.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bomAssembly.d.ts","sourceRoot":"","sources":["../../../lib/cli/bomAssembly.js"],"names":[],"mappings":"AAiEA;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,aAJ7B,MAAM,qBACN,MAAM,EAAE,KACN,OAsBZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,EAFf,MAG8E,CAAC;AAEzF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,0CAH9B,MAAM;;;;;CAwChB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,YAJ1B,MAAM,KACJ,MAAM,GAAC,SAyBnB,CAAC;AA8GF;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,YALjB,MAAM,YACN,MAAM,KACJ;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CA+CrD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,SAH3B,MAAM,KACJ,MAQZ,CAAC;AAEF;;;;;;;;GAQG;AAGH,eAAO,MAAM,oBAAoB,SALtB,MAAM,KACJ,MA6BZ,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,YAHnB,MAAM,KACJ,MAAM,EAgBlB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,YAHtB,MAAM,UAwBhB,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,eAAe,AANxC,CACA,EADQ,MAMqC,EAAE,OAAO,AALtD,CACA,EADQ,MAKmD,EAAE,OAAO,AAJpE,CAGF,EAHU,MAIiE;;;qBApKhD,MAAM,EAAE;gBAAU,MAAM,EAAE;;;;EA8hBrD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAH/B,QAAQ,MAGuB,SA0CzC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAN3B,MAM2B,EAAE,UAAU,EALvC,MAKuC,EAAE,GAAG,EAJ5C,MAI4C,EAAE,KAAK,GAHnD,MAG2D,GAFzD,MAAM,EAAE,CAcpB;AAED;;;;GAIG;AAEH,eAAO,MAAM,cAAc,EAHjB,MAAM,EAGqD,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAFxB,MAEyC,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAJjC,MAIiC,EAAE,YAAY,EAH/C,MAG+C,GAF7C,MAAM,EAAE,CASpB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAOpB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAHlC,MAGkC,GAFhC,GAAG,CAAC,MAAM,CAAC,CA6BvB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAJxC,MAIwC,EAAE,GAAG,EAH7C,MAG6C,GAF3C,OAAO,CAiBnB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,OAAO,KAAA,EACP,UAAU,KAAA,EACV,GAAG,KAAA,EACH,KAAK,KAAA,EACL,OAAO,KAAA,EACP,SAAS,UAAQ,QAqRlB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,KAAA,OAkGvC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,KAAA,EAAE,SAAS,KAAA,QA6B3C;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,KAAA,EAAE,MAAM,KAAA,EAAE,SAAS,KAAA,QAMtD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAJ7B,MAI6B,EAAE,MAAM,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CAoB5B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,YAPhB,MAAM,WACN,MAAM,SACN,MAAM,WACN,MAAM,KAEJ,MA0GZ,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAI5B;AAiDD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAHzC,MAGyC,GAFvC,MAAM,EAAE,CAMpB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAHxC,MAGwC,GAFtC,MAAM,EAAE,CAMpB;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,wBAAwB,EALf,MAAM,EAKS,EACxB,wBAAwB,EALf,MAAM,EAKS,GAJb,MAAM,EAAE,CASpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAHxC,MAGwC,GAFtC,MAAM,EAAE,CAyBpB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAHpC,MAGoC,GAFlC,MAAM,GAAC,SAAS,CAS5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,wBAAwB,EAHtD,MAAM,EAGgD,GAFpD,OAAO,CAInB;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EALvC,MAAM,EAKiC,EAAE,aAAa,EAJtD,MAIsD,EAAE,OAAO,EAH/D,GAAG,CAAC,MAAM,CAGqD,GAF7D,MAAM,EAAE,CAgBpB;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,QAAQ,EAH9C,MAAM,EAGwC,GAF5C,MAAM,EAAE,CAQpB;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EALvC,MAKuC,EAAE,KAAK,EAJ9C,MAI8C,EAAE,QAAQ,EAHxD,MAAM,EAGkD,GAFtD,MAAM,CAIlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAJvC,MAIuC,EAAE,aAAa,EAHtD,MAGsD,GAFpD,IAAI,CAyDhB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,OAAO,EAVE,MAUF,EACP,UAAU,OAAA,EACV,eAAe,EAVN,MAUM,EACf,YAAY,OAAA,EACZ,kBAAkB,AAVjB,CAGA,OAOsB,GAPZ,MAAM,CAwDlB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,YAJjC,MAAM,mBACN,MAAM,KACJ,OAYZ,CAAC"}
+{"version":3,"file":"bomAssembly.d.ts","sourceRoot":"","sources":["../../../lib/cli/bomAssembly.js"],"names":[],"mappings":"AAkEA;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,aAJ7B,MAAM,qBACN,MAAM,EAAE,KACN,OAsBZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,EAFf,MAG8E,CAAC;AAEzF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,0CAH9B,MAAM;;;;;CAwChB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,YAJ1B,MAAM,KACJ,MAAM,GAAC,SAyBnB,CAAC;AA8GF;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,QAF3B,MAAM,EA6BlB,CAAC;AAqCF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,YALjB,MAAM,YACN,MAAM,KACJ;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAsDrD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,SAH3B,MAAM,KACJ,MAQZ,CAAC;AAEF;;;;;;;;GAQG;AAGH,eAAO,MAAM,oBAAoB,SALtB,MAAM,KACJ,MA6BZ,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,YAHnB,MAAM,KACJ,MAAM,EAgBlB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,YAHtB,MAAM,UAwBhB,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,eAAe,AANxC,CACA,EADQ,MAMqC,EAAE,OAAO,AALtD,CACA,EADQ,MAKmD,EAAE,OAAO,AAJpE,CAGF,EAHU,MAIiE;;;qBA3KhD,MAAM,EAAE;gBAAU,MAAM,EAAE;;;;EA2iBrD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAH/B,QAAQ,MAGuB,SA0CzC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAN3B,MAM2B,EAAE,UAAU,EALvC,MAKuC,EAAE,GAAG,EAJ5C,MAI4C,EAAE,KAAK,GAHnD,MAG2D,GAFzD,MAAM,EAAE,CAcpB;AAED;;;;GAIG;AAEH,eAAO,MAAM,cAAc,EAHjB,MAAM,EAGqD,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAFxB,MAEyC,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAJjC,MAIiC,EAAE,YAAY,EAH/C,MAG+C,GAF7C,MAAM,EAAE,CASpB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAOpB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAHlC,MAGkC,GAFhC,GAAG,CAAC,MAAM,CAAC,CA6BvB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAJxC,MAIwC,EAAE,GAAG,EAH7C,MAG6C,GAF3C,OAAO,CAiBnB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAHlC,MAGkC,GAFhC,MAAM,GAAC,SAAS,CA4C5B;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,OAAO,KAAA,EACP,UAAU,KAAA,EACV,GAAG,KAAA,EACH,KAAK,KAAA,EACL,OAAO,KAAA,EACP,SAAS,UAAQ,QAySlB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,KAAA,OAkGvC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,KAAA,EAAE,SAAS,KAAA,QA6B3C;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,KAAA,EAAE,MAAM,KAAA,EAAE,SAAS,KAAA,QAMtD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAJ7B,MAI6B,EAAE,MAAM,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CAoB5B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,YAPhB,MAAM,WACN,MAAM,SACN,MAAM,WACN,MAAM,KAEJ,MA0GZ,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAI5B;AAiDD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAHzC,MAGyC,GAFvC,MAAM,EAAE,CAMpB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAHxC,MAGwC,GAFtC,MAAM,EAAE,CAMpB;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,wBAAwB,EALf,MAAM,EAKS,EACxB,wBAAwB,EALf,MAAM,EAKS,GAJb,MAAM,EAAE,CASpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAHxC,MAGwC,GAFtC,MAAM,EAAE,CAyBpB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAHpC,MAGoC,GAFlC,MAAM,GAAC,SAAS,CAS5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,wBAAwB,EAHtD,MAAM,EAGgD,GAFpD,OAAO,CAInB;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EALvC,MAAM,EAKiC,EAAE,aAAa,EAJtD,MAIsD,EAAE,OAAO,EAH/D,GAAG,CAAC,MAAM,CAGqD,GAF7D,MAAM,EAAE,CAgBpB;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,QAAQ,EAH9C,MAAM,EAGwC,GAF5C,MAAM,EAAE,CAQpB;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EALvC,MAKuC,EAAE,KAAK,EAJ9C,MAI8C,EAAE,QAAQ,EAHxD,MAAM,EAGkD,GAFtD,MAAM,CAIlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAJvC,MAIuC,EAAE,aAAa,EAHtD,MAGsD,GAFpD,IAAI,CAyDhB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,OAAO,EAVE,MAUF,EACP,UAAU,OAAA,EACV,eAAe,EAVN,MAUM,EACf,YAAY,OAAA,EACZ,kBAAkB,AAVjB,CAGA,OAOsB,GAPZ,MAAM,CAwDlB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,YAJjC,MAAM,mBACN,MAAM,KACJ,OAYZ,CAAC"}

package/types/lib/cli/cliOptions.d.ts

@@ -184,10 +184,13 @@ export declare function applyPostConstructionOverrides(options: object, context:
  * @param {object} options    The options object
  * @param {object} [context]
  * @param {boolean} [context.isSecureMode]  Whether cdxgen runs in secure mode
+ * @param {string} [context.invokedCommandName] Binary name (e.g. "cbom"),
+ *                                              which can turn on formulation
  * @returns {OptionsWarning[]} Warnings for the caller
  */
 export declare function applyAdvancedOptions(options: object, context?: {
     isSecureMode?: boolean;
+    invokedCommandName?: string;
 }): OptionsWarning[];
 /**
  * Build the complete `options` object from parsed CLI arguments.
@@ -215,6 +218,8 @@ export declare function applyAdvancedOptions(options: object, context?: {
  * @param {object} [context.projectConfig]     Sanitized config file contents,
  *                                             whose metadata properties merge
  *                                             with the other sources'
+ * @param {string[]} [context.argv]            Raw command-line arguments,
+ *                                             process.argv when absent
  * @returns {{ options: object, warnings: OptionsWarning[] }}
  */
 export declare function buildOptionsFromArgs(args: object, context: {
@@ -225,6 +230,7 @@ export declare function buildOptionsFromArgs(args: object, context: {
     isDryRun?: boolean;
     isSecureMode?: boolean;
     projectConfig?: object;
+    argv?: string[];
 }): {
     options: object;
     warnings: OptionsWarning[];

package/types/lib/cli/cliOptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cliOptions.d.ts","sourceRoot":"","sources":["../../../lib/cli/cliOptions.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAyBH;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAJpC,MAIoC,EAAE,WAAW,AAHzD,CACA,EADQ,MAG4D,GAF1D,MAAM,GAAC,IAAI,CAoBvB;AA4CD;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAJzB,GAIyB,EAAE,SAAS,EAHpC,GAGoC,GAFlC,OAAO,CAInB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EARG,MAQH,EACN,EAAE,IAA4B,EAAE,GAAiB,EAAE,OAAe,EAAE,AARnE,CAIA,EAHA;IAA2B,IAAI,AAA/B,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,GAAG,AAA5B,CACA,EADQ,MAAM,CACd;IAA0B,OAAO,AAAjC,CACA,EADQ,OAAO,CACf;CAIwE,GAJ9D,MAAM,GAAC,OAAO,GAAC,SAAS,CA4CpC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EARvC,MAQuC,EAAE,OAAO,AAPxD,CAKA,EAJA;IAAyB,aAAa,AAAtC,CACA,EADQ,MAAM,CACd;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;IAA2B,IAAI,AAA/B,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,GAAG,AAA5B,CACA,EADQ,MAAM,CACd;CAE6D,GAFnD,IAAI,CAwBhB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EATK,MASL,EACJ,EAAE,IAAmB,EAAE,aAAa,EAAE,AATrC,CAKA,EAJA;IAA2B,IAAI,AAA/B,CAEA,EAFQ,MAAM,EAAE,CAEhB;IAAyB,aAAa,AAAtC,CAEA,EAFQ,MAAM,CAEd;CAI0C,GAJhC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAsD3C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,kBAAkB,EAHtD,MAGsD,GAFpD,MAAM,CAoBlB;AAuED,wBAAgB,mBAAmB,CACjC,IAAI,KAAA,EACJ,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAmB,EAAE,aAAa,EAAE;;;;;CAAA,OAqDjE;AAqBE,YAAkB,cAAc,GAChC;;;;IAAkC,KAAK,EAA5B,MAAM,GAAC,MAAM,GAAC,OAAO,CAChC;;;;IAAkC,OAAO,EAA9B,MAAM,CACnB;CAAA,CAAA;AAJD;;;;GAIG;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAR3C,MAQ2C,EAAE,OAAO,EAN5D;IAAwB,kBAAkB,EAAlC,MAAM,CACd;IAAyB,kBAAkB,EAAnC,OAAO,CAEf;IAA0B,QAAQ,AAAlC,CACA,EADQ,OAAO,CACf;CAE4D,GAFlD,cAAc,EAAE,CA6G5B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EALjC,MAKiC,EAAE,OAAO,AAJlD,CAEA,EADA;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;CAEuD,GAF7C,cAAc,EAAE,CA2I5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAd9B,MAc8B,EAAE,OAAO,EAZ/C;IAAwB,kBAAkB,EAAlC,MAAM,CACd;IAAwB,QAAQ,EAAxB,MAAM,CACd;IAAyB,cAAc,EAA/B,OAAO,CACf;IAAyB,kBAAkB,EAAnC,OAAO,CAEf;IAA0B,QAAQ,AAAlC,CACA,EADQ,OAAO,CACf;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;IAAyB,aAAa,AAAtC,CAGA,EAHQ,MAAM,CAGd;CAE+C,GAFrC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;CAAE,CA+B3D"}
+{"version":3,"file":"cliOptions.d.ts","sourceRoot":"","sources":["../../../lib/cli/cliOptions.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAyBH;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAJpC,MAIoC,EAAE,WAAW,AAHzD,CACA,EADQ,MAG4D,GAF1D,MAAM,GAAC,IAAI,CAoBvB;AA2DD;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAJzB,GAIyB,EAAE,SAAS,EAHpC,GAGoC,GAFlC,OAAO,CAInB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EARG,MAQH,EACN,EAAE,IAA4B,EAAE,GAAiB,EAAE,OAAe,EAAE,AARnE,CAIA,EAHA;IAA2B,IAAI,AAA/B,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,GAAG,AAA5B,CACA,EADQ,MAAM,CACd;IAA0B,OAAO,AAAjC,CACA,EADQ,OAAO,CACf;CAIwE,GAJ9D,MAAM,GAAC,OAAO,GAAC,SAAS,CA4CpC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EARvC,MAQuC,EAAE,OAAO,AAPxD,CAKA,EAJA;IAAyB,aAAa,AAAtC,CACA,EADQ,MAAM,CACd;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;IAA2B,IAAI,AAA/B,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,GAAG,AAA5B,CACA,EADQ,MAAM,CACd;CAE6D,GAFnD,IAAI,CAwBhB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EATK,MASL,EACJ,EAAE,IAAmB,EAAE,aAAa,EAAE,AATrC,CAKA,EAJA;IAA2B,IAAI,AAA/B,CAEA,EAFQ,MAAM,EAAE,CAEhB;IAAyB,aAAa,AAAtC,CAEA,EAFQ,MAAM,CAEd;CAI0C,GAJhC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAsD3C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,kBAAkB,EAHtD,MAGsD,GAFpD,MAAM,CAoBlB;AA6FD,wBAAgB,mBAAmB,CACjC,IAAI,KAAA,EACJ,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAmB,EAAE,aAAa,EAAE;;;;;CAAA,OA8DjE;AAqBE,YAAkB,cAAc,GAChC;;;;IAAkC,KAAK,EAA5B,MAAM,GAAC,MAAM,GAAC,OAAO,CAChC;;;;IAAkC,OAAO,EAA9B,MAAM,CACnB;CAAA,CAAA;AAJD;;;;GAIG;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAR3C,MAQ2C,EAAE,OAAO,EAN5D;IAAwB,kBAAkB,EAAlC,MAAM,CACd;IAAyB,kBAAkB,EAAnC,OAAO,CAEf;IAA0B,QAAQ,AAAlC,CACA,EADQ,OAAO,CACf;CAE4D,GAFlD,cAAc,EAAE,CA6G5B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAPjC,MAOiC,EAAE,OAAO,AANlD,CAIA,EAHA;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;IAAyB,kBAAkB,AAA3C,CAEA,EAFQ,MAAM,CAEd;CAEuD,GAF7C,cAAc,EAAE,CA8L5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAhB9B,MAgB8B,EAAE,OAAO,EAd/C;IAAwB,kBAAkB,EAAlC,MAAM,CACd;IAAwB,QAAQ,EAAxB,MAAM,CACd;IAAyB,cAAc,EAA/B,OAAO,CACf;IAAyB,kBAAkB,EAAnC,OAAO,CAEf;IAA0B,QAAQ,AAAlC,CACA,EADQ,OAAO,CACf;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;IAAyB,aAAa,AAAtC,CAGA,EAHQ,MAAM,CAGd;IAA2B,IAAI,AAA/B,CAEA,EAFQ,MAAM,EAAE,CAEhB;CAE+C,GAFrC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;CAAE,CAkC3D"}

package/types/lib/cli/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/cli/index.js"],"names":[],"mappings":"AAgFA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAyCnE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,aAAa,EACb,wBAAwB,EACxB,eAAe,EACf,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA0C1D,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,eAAe,EACf,UAAU,EACV,aAAa,EACb,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,YAAY,EACZ,eAAe,EACf,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,aAAa,EACb,cAAc,EACd,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AA8BxB;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,OAAO,CAAC,MAAM,CAAC,CAuG3B;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,OAAO,EAHnD,MAGmD,GAFjD,OAAO,CAAC,MAAM,CAAC,CAqU3B;AAgCD;;;;;;GAMG;AACH;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAGF,GAF1B,MAAM,CAUlB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAAM,EAG4B,GAFhC,MAAM,CAalB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EALnC,MAAM,GAAC,MAAM,EAKsB,EAAE,OAAO,EAJ5C,MAI4C,GAH1C,OAAO,CAAC,MAAM,CAAC,CA6rC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CAsF3B;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAsgBrC;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,CAAC,CAsB3B;AAED;;;;;;GAMG;AACH;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,OAAO,CAAC,MAAM,CAAC,CAa3B;AAgYD;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,IAAI,EALzB,MAKyB,EAAE,WAAW,EAJtC,MAIsC,GAHrC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CA+FjD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/cli/index.js"],"names":[],"mappings":"AA4FA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AA8CnE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,aAAa,EACb,wBAAwB,EACxB,eAAe,EACf,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA0C1D,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,eAAe,EACf,UAAU,EACV,aAAa,EACb,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,YAAY,EACZ,eAAe,EACf,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,aAAa,EACb,cAAc,EACd,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AAoDxB;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CAsJ3B;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,OAAO,EAHnD,MAGmD,GAFjD,OAAO,CAAC,MAAM,CAAC,CAqU3B;AAgCD;;;;;;GAMG;AACH;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAGF,GAF1B,MAAM,CAUlB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAAM,EAG4B,GAFhC,MAAM,CAalB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EALnC,MAAM,GAAC,MAAM,EAKsB,EAAE,OAAO,EAJ5C,MAI4C,GAH1C,OAAO,CAAC,MAAM,CAAC,CAu6B3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CAsF3B;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAsgBrC;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,CAAC,CAsB3B;AAED;;;;;;GAMG;AACH;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,OAAO,CAAC,MAAM,CAAC,CAa3B;AAgYD;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,IAAI,EALzB,MAKyB,EAAE,WAAW,EAJtC,MAIsC,GAHrC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAyGjD"}

package/types/lib/cli/jsBom.d.ts

@@ -1,20 +1,4 @@
-/**
- * Detects an exact AI inventory type from a direct HuggingFace reference or a
- * local Modelfile/`.gguf` file input. Returns the explicit selection from
- * `getExactAiInventoryType` when one is present.
- *
- * Direct HuggingFace interpretation of the source path is opt-in: only
- * unambiguous references (`pkg:huggingface/...` purls and huggingface.co
- * URLs) are recognized on their own. Bare `owner/repo`-shaped values are
- * ordinary relative paths (eg: `repotests/sveltejs-realworld`) unless an AI
- * inventory type such as `-t ai` is explicitly selected, in which case
- * `getExactAiInventoryType` already returned it above.
- *
- * @param {string} path Project or file path
- * @param {object} options CLI options
- * @returns {string|undefined} The detected AI inventory type (`"ai"`) or undefined
- */
-export declare function getDirectAiInventoryType(path: string, options: object): string | undefined;
+export declare function getDirectAiInventoryType(path: any, options: any): string | undefined;
 /**
  * Main Node.js/npm BOM generator. Parses manifests, lockfiles, and import
  * evidence to assemble components, dependencies, formulation data, AI inventory,
@@ -112,6 +96,7 @@ export declare function analyzeExtensionDir(extDir: string, options: Object): Pr
  * @param {Object} options CLI options
  * @param {Object[]} pkgList Mutable array to push discovered components into
  * @param {Object[]} dependencies Mutable array to merge dependencies into
+ * @param {string} [onlyEntry] Analyze only this extension folder
  */
-export declare function analyzeInstalledExtensionDirs(extensionsDir: string, options: Object, pkgList: Object[], dependencies: Object[]): Promise<void>;
+export declare function analyzeInstalledExtensionDirs(extensionsDir: string, options: Object, pkgList: Object[], dependencies: Object[], onlyEntry?: string): Promise<void>;
 //# sourceMappingURL=jsBom.d.ts.map

package/types/lib/cli/jsBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jsBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jsBom.js"],"names":[],"mappings":"AAiHA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAwB5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAq3C3B;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAE4C,CAAC;AAEvD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,YAJ9B,KAAK,CAAC,MAAM,CAAC,cACb,MAAM,KACJ,KAAK,CAAC,MAAM,CAwExB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAmD3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CA+F3B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EANhC,MAMgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CA6B3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAoN3B;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CAoD3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CA2ChE;AAED;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CACjD,aAAa,EANJ,MAMI,EACb,OAAO,EANE,MAMF,EACP,OAAO,EANE,MAAM,EAMR,EACP,YAAY,EANH,MAAM,EAMH,iBAsBb"}
+{"version":3,"file":"jsBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jsBom.js"],"names":[],"mappings":"AA6IA,wBAAgB,wBAAwB,CAAC,IAAI,KAAA,EAAE,OAAO,KAAA,sBAsBrD;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAy5C3B;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAE4C,CAAC;AAEvD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,YAJ9B,KAAK,CAAC,MAAM,CAAC,cACb,MAAM,KACJ,KAAK,CAAC,MAAM,CAwExB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAmD3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CAsI3B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EANhC,MAMgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CA6B3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAoN3B;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CAoD3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CA2ChE;AAED;;;;;;;;;GASG;AACH,wBAAsB,6BAA6B,CACjD,aAAa,EAPJ,MAOI,EACb,OAAO,EAPE,MAOF,EACP,OAAO,EAPE,MAAM,EAOR,EACP,YAAY,EAPH,MAAM,EAOH,EACZ,SAAS,AAPR,CACF,EADU,MAOA,iBAyBV"}

package/types/lib/cli/jvmBom.d.ts

@@ -29,6 +29,21 @@ export declare const SBT_CACHE_DIR: string;
  * @returns {Promise<Object>} Jar namespace mapping keyed by package purl.
  */
 export declare function collectSbtDependencyJars(pkgList: Object[], known?: Object): Promise<Object>;
+/**
+ * Keep apart two independent Maven projects that declare the same
+ * coordinates, such as sample projects in `one/` and `two/` that both call
+ * themselves `com.example:demo:0.0.1-SNAPSHOT`. When `component` has the
+ * bom-ref of the parent or of a module already collected but comes from a
+ * different pom.xml, it gets the directory of its pom, relative to the scan
+ * root, as the purl subpath, and the dependency entries that name it follow.
+ *
+ * @param {Object} component Root component of a Maven tree, updated in place
+ * @param {Object} parentComponent Parent component and the modules under it
+ * @param {string} rootPath Directory being scanned
+ * @param {Object[]} dependenciesList Dependency entries of the tree, updated in place
+ * @returns {boolean} True when the component got a distinct identity
+ */
+export declare function separateDuplicateMavenProject(component: Object, parentComponent: Object, rootPath: string, dependenciesList?: Object[]): boolean;
 /**
  * The purls and bom-refs of a parent component and the module components
  * nested under it.

package/types/lib/cli/jvmBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jvmBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jvmBom.js"],"names":[],"mappings":"AA4HA;;;;;GAKG;AACH,eAAO,IAAI,gBAAgB,EAFjB,MAIsD,CAAC;AAUjE;;;;GAIG;AAEH,eAAO,MAAM,kBAAkB,EAHrB,MAQT,CAAC;AAEF;;;;;GAKG;AAEH,eAAO,MAAM,aAAa,EAHhB,MAIqE,CAAC;AAuDhF;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAL3C,MAAM,EAKqC,EAAE,KAAK,AAJ1D,CAEA,EAFQ,MAIuD,GAFrD,OAAO,CAAC,MAAM,CAAC,CA2B3B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,eAAe,EAHrC,MAGqC,GAFnC,GAAG,CAAC,MAAM,CAAC,CAwBvB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAL5B,MAK4B,EAAE,OAAO,EAJrC,MAIqC,GAFnC,MAAM,CAmFlB;AAiCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAPC,MAOD,EACR,MAAM,EAPG,MAOH,EACN,GAAG,EAPM,MAON,EACH,YAAY,AAPX,CACA,EADQ,MAAM,EAOE,GANN,MAAM,EAAE,CAwEpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EALtC,MAKsC,EAAE,QAAQ,EAJhD,MAIgD,EAAE,KAAK,AAH/D,CACA,eAE+D,GAFrD;IAAC,eAAe,EAAE,MAAM,GAAC,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAC,CAyClE;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAonE3B"}
+{"version":3,"file":"jvmBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jvmBom.js"],"names":[],"mappings":"AAsJA;;;;;GAKG;AACH,eAAO,IAAI,gBAAgB,EAFjB,MAIsD,CAAC;AAUjE;;;;GAIG;AAEH,eAAO,MAAM,kBAAkB,EAHrB,MAQT,CAAC;AAEF;;;;;GAKG;AAEH,eAAO,MAAM,aAAa,EAHhB,MAIqE,CAAC;AAuDhF;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAL3C,MAAM,EAKqC,EAAE,KAAK,AAJ1D,CAEA,EAFQ,MAIuD,GAFrD,OAAO,CAAC,MAAM,CAAC,CA2B3B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,EAPA,MAOA,EACT,eAAe,EAPN,MAOM,EACf,QAAQ,EAPC,MAOD,EACR,gBAAgB,GAPP,MAAM,EAOM,GANV,OAAO,CA+CnB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,eAAe,EAHrC,MAGqC,GAFnC,GAAG,CAAC,MAAM,CAAC,CAwBvB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAL5B,MAK4B,EAAE,OAAO,EAJrC,MAIqC,GAFnC,MAAM,CAmFlB;AAiCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAPC,MAOD,EACR,MAAM,EAPG,MAOH,EACN,GAAG,EAPM,MAON,EACH,YAAY,AAPX,CACA,EADQ,MAAM,EAOE,GANN,MAAM,EAAE,CAwEpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EALtC,MAKsC,EAAE,QAAQ,EAJhD,MAIgD,EAAE,KAAK,AAH/D,CACA,eAE+D,GAFrD;IAAC,eAAe,EAAE,MAAM,GAAC,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAC,CAyClE;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAiiF3B"}

package/types/lib/cli/managedBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"managedBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/managedBom.js"],"names":[],"mappings":"AAwKA;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,QAJ5B,MAAM,YACN,MAAM,KACJ,OAMZ,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAJ1B,MAAM,YACN,MAAM,KACJ,OAeZ,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,QAAA,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,GAAG,IAAI,CAyEzB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAitB3B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CAyBlB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CA2C3B;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CA0BlB;AAwBD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CAmOlB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CA8U3B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAktBrC;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAJpC,MAIoC,EAAE,OAAO,EAH7C,MAG6C,GAF3C,OAAO,CAAC,MAAM,CAAC,CAyQ3B;AA6ND;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAJpB,MAIoB,EAAE,OAAO,EAH7B,MAG6B,GAF3B,MAAM,CA2DlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CAmClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC,OAAO,CAAC,MAAM,CAAC,CA6B3B"}
+{"version":3,"file":"managedBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/managedBom.js"],"names":[],"mappings":"AAiLA;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,QAJ5B,MAAM,YACN,MAAM,KACJ,OAMZ,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAJ1B,MAAM,YACN,MAAM,KACJ,OAeZ,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,QAAA,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,GAAG,IAAI,CAyEzB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAitB3B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CAyBlB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CA2C3B;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CA0BlB;AAwBD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CAmOlB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAoc3B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAiuBrC;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAJpC,MAIoC,EAAE,OAAO,EAH7C,MAG6C,GAF3C,OAAO,CAAC,MAAM,CAAC,CAyQ3B;AA6ND;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAJpB,MAIoB,EAAE,OAAO,EAH7B,MAG6B,GAF3B,MAAM,CA2DlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CAmClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC,OAAO,CAAC,MAAM,CAAC,CA6B3B"}

package/types/lib/cli/nativeBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nativeBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/nativeBom.js"],"names":[],"mappings":"AA8LA;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,GAAC,SAAS,CAU5B;AA0BD;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAygBvC;AAuQD,wBAAsB,aAAa,CAAC,IAAI,KAAA,EAAE,OAAO,KAAA,+BA2MhD;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,GAAC,SAAS,CAiC5B;AAED;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAAC,SAAS,EAJ9C,MAI8C,EAAE,SAAS,AAHjE,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAyDrC;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAJnC,MAImC,EAAE,OAAO,EAH5C,MAG4C,GAF1C,OAAO,CAAC,MAAM,CAAC,CAwB3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CA0E3B;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CA4elB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CA2KlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,MAAM,EAAE,CA0BpB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CAiElB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CAiClB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA+P3B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAmOvC;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CAkI3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA4D3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwD3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAsE3B;AAqBD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAyB3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA4B3B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CAoE3B;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CAuC3B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA0C3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA2D3B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwD3B"}
+{"version":3,"file":"nativeBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/nativeBom.js"],"names":[],"mappings":"AAuMA;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,GAAC,SAAS,CAU5B;AA0BD;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAygBvC;AAuQD,wBAAsB,aAAa,CAAC,IAAI,KAAA,EAAE,OAAO,KAAA,+BA2MhD;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,GAAC,SAAS,CAiC5B;AAED;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAAC,SAAS,EAJ9C,MAI8C,EAAE,SAAS,AAHjE,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAyDrC;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAJnC,MAImC,EAAE,OAAO,EAH5C,MAG4C,GAF1C,OAAO,CAAC,MAAM,CAAC,CAwB3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAoF3B;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CAmgBlB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CAgLlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,MAAM,EAAE,CA0BpB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CAiElB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CAiClB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA+P3B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAmOvC;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CAkI3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA4D3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwD3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAsE3B;AAqBD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAyB3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA4B3B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CAoE3B;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CAuC3B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA0C3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA2D3B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwD3B"}

package/types/lib/core/boundedFile.d.ts

@@ -0,0 +1,100 @@
+/**
+ * The largest file scanFileMarkers reads. Larger files are skipped whole
+ * rather than read in part, so a marker past the cap is never mistaken for an
+ * absent one; the result says the file was skipped.
+ *
+ * @type {number}
+ */
+export declare const MAX_MARKER_SCAN_BYTES: number;
+/**
+ * Open a path only when it is a regular file that does not resolve outside
+ * rootDir. lstat runs first so a FIFO is rejected without opening it (an open
+ * on a FIFO blocks until a writer appears) and a symlink is never followed.
+ *
+ * @param {string} absPath absolute path
+ * @param {string|undefined} rootDir extracted root the path must stay under
+ * @returns {{fd: number, size: number}|undefined} an open descriptor the
+ *   caller closes, or undefined
+ */
+export declare function openRegularFile(absPath: string, rootDir: string | undefined): {
+    fd: number;
+    size: number;
+} | undefined;
+/**
+ * Read a small text file in full, only when it is a regular file no larger
+ * than maxBytes. A FIFO, a directory, a symlink or an oversized file reads as
+ * undefined.
+ *
+ * @param {string} absPath absolute path
+ * @param {number} maxBytes largest size read
+ * @param {string|undefined} [rootDir] root the path must stay under
+ * @returns {string|undefined} the text, or undefined
+ */
+export declare function readRegularTextFile(absPath: string, maxBytes: number, rootDir?: string | undefined): string | undefined;
+/**
+ * Find byte markers in a file with bounded chunked reads.
+ *
+ * Each hit records up to `beforeBytes` bytes before the marker and up to
+ * `contextBytes` bytes after it, so a caller can read a version that follows a
+ * marker or check what a string is part of. Consecutive reads overlap by the
+ * longest marker plus the context length, so a marker split across two reads
+ * is seen whole once. Only bytes that were read are searched.
+ *
+ * @param {string} absPath absolute path of the file
+ * @param {string|undefined} rootDir extracted root the file must stay under
+ * @param {Buffer[]} markers byte markers to look for
+ * @param {Object} [options] options
+ * @param {number} [options.maxBytes] files larger than this are not read
+ * @param {number} [options.contextBytes=64] bytes kept after each hit
+ * @param {number} [options.beforeBytes=1] bytes kept before each hit
+ * @param {number} [options.maxHits=16] hits kept per marker
+ * @returns {{hits: {before: Buffer, after: Buffer, offset: number}[][], size: number, skipped?: string}|undefined}
+ *   hits per marker, in marker order, and the file size; `skipped` is
+ *   `too-large` when the file is over the cap and was not read. Undefined when
+ *   the file cannot be opened.
+ */
+export declare function scanFileMarkers(absPath: string, rootDir: string | undefined, markers: Buffer[], { maxBytes, contextBytes, beforeBytes, maxHits, }?: {
+    maxBytes?: number;
+    contextBytes?: number;
+    beforeBytes?: number;
+    maxHits?: number;
+}): {
+    hits: {
+        before: Buffer;
+        after: Buffer;
+        offset: number;
+    }[][];
+    size: number;
+    skipped?: string;
+} | undefined;
+/**
+ * Compute the digest of a regular file with bounded chunked reads, under the
+ * same rules as readRegularTextFile: a FIFO, a directory, a symlink, a file
+ * that resolves outside rootDir or one larger than maxBytes yields undefined.
+ *
+ * @param {string} absPath absolute path
+ * @param {number} maxBytes largest size hashed
+ * @param {string|undefined} [rootDir] root the path must stay under
+ * @param {string} [algorithm="sha256"] node:crypto hash algorithm
+ * @returns {string|undefined} the hex digest, or undefined
+ */
+export declare function hashRegularFile(absPath: string, maxBytes: number, rootDir?: string | undefined, algorithm?: string): string | undefined;
+/**
+ * True when the process runs as root, where a symlink planted in a user's
+ * home could point a scan at files only root can read.
+ *
+ * @returns {boolean} true for uid 0
+ */
+export declare function isRunningAsRoot(): boolean;
+/**
+ * Read a small text file a user keeps in their home, such as an editor's or an
+ * agent's configuration. Dotfile managers often make these symlinks, so a
+ * symlink to a regular file is followed, except when the process runs as root.
+ * The target must still be a regular file no larger than maxBytes.
+ *
+ * @param {string} absPath absolute path
+ * @param {number} maxBytes largest size read
+ * @returns {string|undefined} the text, or undefined
+ */
+export declare function readUserFileText(absPath: string, maxBytes: number): string | undefined;
+//# sourceMappingURL=boundedFile.d.ts.map

package/types/lib/core/boundedFile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundedFile.d.ts","sourceRoot":"","sources":["../../../lib/core/boundedFile.js"],"names":[],"mappings":"AA8BA;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAFxB,MAEiD,CAAC;AAE5D;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAL5B,MAK4B,EAAE,OAAO,EAJrC,MAAM,GAAC,SAI8B,GAHnC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAsChD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EALhC,MAKgC,EAAE,QAAQ,EAJ1C,MAI0C,EAAE,OAAO,AAH3D,CACA,EADQ,MAAM,GAAC,SAG4C,GAFjD,MAAM,GAAC,SAAS,CAoC5B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAdE,MAcF,EACP,OAAO,EAdE,MAAM,GAAC,SAcT,EACP,OAAO,EAdE,MAAM,EAcR,EACP,EACE,QAAgC,EAChC,YAAiB,EACjB,WAAe,EACf,OAAY,GACb,AAnBA,CAKA,EAJA;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,OAAO,AAAhC,CACA,EADQ,MAAM,CACd;CAcK,GAdK;IAAC,IAAI,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAC,EAAE,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAsGjH;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAPE,MAOF,EACP,QAAQ,EAPC,MAOD,EACR,OAAO,AAPN,CACA,EADQ,MAAM,GAAC,SAOT,EACP,SAAS,AAPR,CACA,EADQ,MAOW,GANT,MAAM,GAAC,SAAS,CA2C5B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAFlB,OAAO,CAInB;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAJ7B,MAI6B,EAAE,QAAQ,EAHvC,MAGuC,GAFrC,MAAM,GAAC,SAAS,CAkB5B"}

package/types/lib/core/brotliProbe.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The most files of one kind (executables and libraries, or extension
+ * modules) one scan opens in search of a Brotli decoder.
+ *
+ * @type {number}
+ */
+export declare const MAX_BROTLI_PROBES: number;
+/**
+ * The most bytes one scan reads in search of Brotli decoders.
+ *
+ * @type {number}
+ */
+export declare const MAX_BROTLI_PROBE_BYTES: number;
+/**
+ * Read which Brotli decoders a native file embeds and whether each carries
+ * the CVE-2026-111497 fix.
+ *
+ * @param {string} absPath absolute path of the file
+ * @param {string|undefined} rootDir extracted root the file must stay under
+ * @returns {{c?: {blockSwitchFix: string, evidence: string}, go?: {blockSwitchFix: string}, skipped?: string, size: number}|undefined}
+ *   undefined when the file cannot be read or holds no decoder. `c` is
+ *   Google's C decoder, with blockSwitchFix `true`, `false` or `unknown` and
+ *   the evidence it rests on (`error-names`, `constant-names` or `tables`);
+ *   `go` is the Go port. `skipped` is `too-large` for a file over the read cap.
+ */
+export declare function readBrotliDecoder(absPath: string, rootDir: string | undefined): {
+    c?: {
+        blockSwitchFix: string;
+        evidence: string;
+    };
+    go?: {
+        blockSwitchFix: string;
+    };
+    skipped?: string;
+    size: number;
+} | undefined;
+//# sourceMappingURL=brotliProbe.d.ts.map

package/types/lib/core/brotliProbe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brotliProbe.d.ts","sourceRoot":"","sources":["../../../lib/core/brotliProbe.js"],"names":[],"mappings":"AAmEA;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAFpB,MAE2B,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAFzB,MAEmD,CAAC;AAgC9D;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAR9B,MAQ8B,EAAE,OAAO,EAPvC,MAAM,GAAC,SAOgC,GANrC;IAAC,CAAC,CAAC,EAAE;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IAAC,EAAE,CAAC,EAAE;QAAC,cAAc,EAAE,MAAM,CAAA;KAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CA+DrI"}