@cdxgen/cdxgen 13.5.0 → 13.7.0

package/types/lib/core/env.d.ts

@@ -113,6 +113,10 @@ export declare let CDXGEN_TEMP_DIR: string;
 export declare const SWIFT_CMD: string;
 /** Resolved Ruby executable command (RUBY_CMD env var, or "ruby"). */
 export declare const RUBY_CMD: string;
+/** Resolved RubyGems executable command (CDXGEN_GEM_CMD env var, or "gem"). */
+export declare const GEM_CMD: string;
+/** Resolved Bundler executable command (CDXGEN_BUNDLE_CMD env var, or "bundle"). */
+export declare const BUNDLE_CMD: string;
 /** Resolved PHP executable command (PHP_CMD env var, or "php"). */
 export declare const PHP_CMD: string;
 /** Resolved Composer executable command (COMPOSER_CMD env var, or "composer"). */
@@ -177,6 +181,16 @@ export declare const PROJECT_TYPE_ALIASES: {
     dynamic: string[];
     "ai-provenance": string[];
 };
+/**
+ * Project types, with their aliases, that inventory the host cdxgen runs on
+ * rather than the scan path: installed packages, users, shell history, IDE
+ * and browser extensions, or the Maven, Gradle, sbt, Cargo and Helm caches in
+ * the user's home directory. Only the operator may select them; neither a
+ * server request nor a config file in the scanned directory can.
+ *
+ * @type {Set<string>}
+ */
+export declare const HOST_SCOPE_PROJECT_TYPES: Set<string>;
 /** Map of base package manager to the array of accepted alias strings. */
 export declare const PACKAGE_MANAGER_ALIASES: {
     scala: string[];

package/types/lib/core/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../lib/core/env.js"],"names":[],"mappings":"AAUA,uCAAuC;AACvC,eAAO,MAAM,MAAM,SAAmD,CAAC;AACvE,mCAAmC;AACnC,eAAO,MAAM,KAAK,SAAwC,CAAC;AAC3D,oCAAoC;AACpC,eAAO,MAAM,MAAM,SAA+C,CAAC;AAEnE,yFAAyF;AACzF,eAAO,MAAM,sBAAsB,oBAElC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAIrB,CAAC;AAEX,sJAAsJ;AACtJ,eAAO,MAAM,qBAAqB,SAI/B,CAAC;AAEJ,sIAAsI;AACtI,eAAO,MAAM,sBAAsB,SAElC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAH9B,MAG8B,GAF5B,MAAM,EAAE,CAiDpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAFrB,OAAO,CAOnB;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,IAFhC,OAAO,CAMnB;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAF7B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAFjB,OAAO,CAOnB;AAED,mGAAmG;AACnG,eAAO,MAAM,aAAa,SAAuB,CAAC;AAElD,oJAAoJ;AACpJ,eAAO,MAAM,gBAAgB,SAEwC,CAAC;AAEtE,yFAAyF;AACzF,eAAO,MAAM,QAAQ,QAAmB,CAAC;AAEzC;;;;;GAKG;AACH,wBAAgB,cAAc,IAFjB,MAAM,CAclB;AAED,6FAA6F;AAC7F,eAAO,MAAM,UAAU,QAAqB,CAAC;AAsB7C;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,CAYlB;AAED,mEAAmE;AACnE,eAAO,IAAI,UAAU,QAAW,CAAC;AAIjC,yEAAyE;AACzE,eAAO,IAAI,QAAQ,QAAS,CAAC;AAI7B,mEAAmE;AACnE,eAAO,IAAI,OAAO,QAAQ,CAAC;AAI3B,sEAAsE;AACtE,eAAO,IAAI,QAAQ,QAAS,CAAC;AAI7B,mEAAmE;AACnE,eAAO,IAAI,OAAO,QAAQ,CAAC;AAI3B,yEAAyE;AACzE,eAAO,IAAI,SAAS,QAAU,CAAC;AAI/B,gEAAgE;AAChE,eAAO,IAAI,MAAM,QAAO,CAAC;AAIzB,yEAAyE;AACzE,eAAO,IAAI,SAAS,QAAU,CAAC;AAK/B;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,oBAGd,CAAC;AAEZ,2EAA2E;AAC3E,eAAO,IAAI,OAAO,QAAQ,CAAC;AAK3B,2EAA2E;AAC3E,eAAO,IAAI,QAAQ,QAAS,CAAC;AAK7B,mFAAmF;AACnF,eAAO,IAAI,eAAe,QAAS,CAAC;AAKpC,yEAAyE;AACzE,eAAO,MAAM,SAAS,QAAkD,CAAC;AAEzE,sEAAsE;AACtE,eAAO,MAAM,QAAQ,QAAgD,CAAC;AAEtE,mEAAmE;AACnE,eAAO,MAAM,OAAO,QAA8C,CAAC;AAEnE,kFAAkF;AAClF,eAAO,MAAM,YAAY,QAC8B,CAAC;AAExD,6EAA6E;AAC7E,eAAO,MAAM,0BAA0B,UAWtC,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB;IAC/B,IAAI;IAyBJ,OAAO;IACP,GAAG;IACH,cAAc;IACd,WAAW;IACX,aAAa;IACb,aAAa;IACb,EAAE;IAyCF,GAAG;IACH,UAAU;IACV,OAAO;IACP,EAAE;IAyBF,EAAE;IACF,IAAI;IACJ,GAAG;IACH,IAAI;IACJ,MAAM;IA8BN,IAAI;IACJ,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,CAAC;IACD,KAAK;IACL,GAAG;IACH,OAAO;IACP,GAAG;IACH,GAAG;IACH,IAAI;IACJ,KAAK;IACL,SAAS;IACT,CAAC;IACD,OAAO;IACP,MAAM;IACN,IAAI;IACJ,EAAE;IACF,OAAO;IACP,IAAI;IACJ,YAAY;IACZ,SAAS;IAcT,UAAU;IACV,KAAK;IAUL,MAAM;IACN,GAAG;IACH,KAAK;IACL,KAAK;IACL,GAAG;IACH,GAAG;IACH,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,kBAAkB;IASlB,kBAAkB;IAMlB,OAAO;IACP,eAAe;CAChB,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB;IAClC,KAAK;CACN,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,EAF/B,MAAM,EAQf,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAH9C,MAG8C,GAF5C,OAAO,CAUnB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EALhC,MAKgC,EAAE,OAAO,QAAA,WAiBnD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,OAAA,EAAE,OAAO,EAH5C,MAG4C,EAAE,aAAa,UAAO,OA2G5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,WAAW,AAHvC,CACA,EADQ,MAG+B,GAF7B,MAAM,CAOlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAJxC,MAIwC,EAAE,WAAW,AAH7D,CACA,EADQ,MAGqD,GAFnD,OAAO,CA8BnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,QAAA,EAAE,mBAAmB,OAAA,EAAE,OAAO,EAJ/D,MAI+D,WAezE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,KAAA,OA8CvC"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../lib/core/env.js"],"names":[],"mappings":"AAUA,uCAAuC;AACvC,eAAO,MAAM,MAAM,SAAmD,CAAC;AACvE,mCAAmC;AACnC,eAAO,MAAM,KAAK,SAAwC,CAAC;AAC3D,oCAAoC;AACpC,eAAO,MAAM,MAAM,SAA+C,CAAC;AAEnE,yFAAyF;AACzF,eAAO,MAAM,sBAAsB,oBAElC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAIrB,CAAC;AAEX,sJAAsJ;AACtJ,eAAO,MAAM,qBAAqB,SAI/B,CAAC;AAEJ,sIAAsI;AACtI,eAAO,MAAM,sBAAsB,SAElC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAH9B,MAG8B,GAF5B,MAAM,EAAE,CAiDpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAFrB,OAAO,CAOnB;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,IAFhC,OAAO,CAMnB;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAF7B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAFjB,OAAO,CAOnB;AAED,mGAAmG;AACnG,eAAO,MAAM,aAAa,SAAuB,CAAC;AAElD,oJAAoJ;AACpJ,eAAO,MAAM,gBAAgB,SAEwC,CAAC;AAEtE,yFAAyF;AACzF,eAAO,MAAM,QAAQ,QAAmB,CAAC;AAEzC;;;;;GAKG;AACH,wBAAgB,cAAc,IAFjB,MAAM,CAclB;AAED,6FAA6F;AAC7F,eAAO,MAAM,UAAU,QAAqB,CAAC;AAsB7C;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,CAYlB;AAED,mEAAmE;AACnE,eAAO,IAAI,UAAU,QAAW,CAAC;AAIjC,yEAAyE;AACzE,eAAO,IAAI,QAAQ,QAAS,CAAC;AAI7B,mEAAmE;AACnE,eAAO,IAAI,OAAO,QAAQ,CAAC;AAI3B,sEAAsE;AACtE,eAAO,IAAI,QAAQ,QAAS,CAAC;AAI7B,mEAAmE;AACnE,eAAO,IAAI,OAAO,QAAQ,CAAC;AAI3B,yEAAyE;AACzE,eAAO,IAAI,SAAS,QAAU,CAAC;AAI/B,gEAAgE;AAChE,eAAO,IAAI,MAAM,QAAO,CAAC;AAIzB,yEAAyE;AACzE,eAAO,IAAI,SAAS,QAAU,CAAC;AAK/B;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,oBAGd,CAAC;AAEZ,2EAA2E;AAC3E,eAAO,IAAI,OAAO,QAAQ,CAAC;AAK3B,2EAA2E;AAC3E,eAAO,IAAI,QAAQ,QAAS,CAAC;AAK7B,mFAAmF;AACnF,eAAO,IAAI,eAAe,QAAS,CAAC;AAKpC,yEAAyE;AACzE,eAAO,MAAM,SAAS,QAAkD,CAAC;AAEzE,sEAAsE;AACtE,eAAO,MAAM,QAAQ,QAAgD,CAAC;AAEtE,+EAA+E;AAC/E,eAAO,MAAM,OAAO,QAAqD,CAAC;AAE1E,oFAAoF;AACpF,eAAO,MAAM,UAAU,QACmC,CAAC;AAE3D,mEAAmE;AACnE,eAAO,MAAM,OAAO,QAA8C,CAAC;AAEnE,kFAAkF;AAClF,eAAO,MAAM,YAAY,QAC8B,CAAC;AAExD,6EAA6E;AAC7E,eAAO,MAAM,0BAA0B,UAWtC,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB;IAC/B,IAAI;IAyBJ,OAAO;IACP,GAAG;IACH,cAAc;IACd,WAAW;IACX,aAAa;IACb,aAAa;IACb,EAAE;IAyCF,GAAG;IACH,UAAU;IACV,OAAO;IACP,EAAE;IAyBF,EAAE;IACF,IAAI;IACJ,GAAG;IACH,IAAI;IACJ,MAAM;IA8BN,IAAI;IACJ,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,CAAC;IACD,KAAK;IACL,GAAG;IACH,OAAO;IACP,GAAG;IACH,GAAG;IACH,IAAI;IACJ,KAAK;IACL,SAAS;IACT,CAAC;IACD,OAAO;IACP,MAAM;IACN,IAAI;IACJ,EAAE;IACF,OAAO;IACP,IAAI;IACJ,YAAY;IACZ,SAAS;IAcT,UAAU;IACV,KAAK;IAUL,MAAM;IACN,GAAG;IACH,KAAK;IACL,KAAK;IACL,GAAG;IACH,GAAG;IACH,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,kBAAkB;IAUlB,kBAAkB;IAMlB,OAAO;IACP,eAAe;CAChB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,EAF3B,GAAG,CAAC,MAAM,CAiBnB,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB;IAClC,KAAK;CACN,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,EAF/B,MAAM,EAQf,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAH9C,MAG8C,GAF5C,OAAO,CAUnB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EALhC,MAKgC,EAAE,OAAO,QAAA,WAiBnD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,OAAA,EAAE,OAAO,EAH5C,MAG4C,EAAE,aAAa,UAAO,OA2G5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,WAAW,AAHvC,CACA,EADQ,MAG+B,GAF7B,MAAM,CAOlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAJxC,MAIwC,EAAE,WAAW,AAH7D,CACA,EADQ,MAGqD,GAFnD,OAAO,CA8BnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,QAAA,EAAE,mBAAmB,OAAA,EAAE,OAAO,EAJ/D,MAI+D,WAezE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,KAAA,OA8CvC"}

package/types/lib/core/fs.d.ts

@@ -19,6 +19,10 @@ export declare function safeIsExecutableSync(filePath: string): boolean;
  * Permission- and dry-run-aware wrapper around writeFileSync. Records the
  * activity and returns undefined when blocked.
  *
+ * The last component of the path is never followed when it is a symbolic
+ * link: the link is replaced with a regular file. Paths under /dev and /proc,
+ * such as /dev/stdout, are written through as given.
+ *
  * @param {string} filePath File path to write.
  * @param {string|Buffer} data Data to write.
  * @param {Object} [options] writeFileSync options (encoding, mode, flag).

package/types/lib/core/fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../lib/core/fs.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA8ErC;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,QAAA,OAmCtC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAHlC,MAGkC,GAFhC,OAAO,CAYnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAL3B,MAK2B,EAAE,IAAI,EAJjC,MAAM,GAAC,MAI0B,EAAE,OAAO,AAHlD,CACA,EADQ,MAG0C,GAFxC,IAAI,CAQhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAIiC,EAAE,MAAM,EAHzC,QAAQ,CAAC,MAAM,GAAC,MAAM,CAGmB,GAFvC,IAAI,CA4BhB;AA2BD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAJ9B,MAI8B,EAAE,OAAO,AAH/C,CACA,EADQ,MAAM,GAAC,MAG0C,GAF/C,MAAM,GAAC,MAAM,GAAC,SAAS,CA0BnC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,QAAA,EAAE,OAAO,EAH5B,OAG4B,aAwB9C;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAAM,GAAC,MAGyC,GAF9C,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAJxB,MAIwB,EAAE,OAAO,AAHzC,CACA,EADQ,MAG6C,GAF3C,IAAI,CAchB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,IAAI,CAchB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,IAAI,EAJ/B,MAI+B,EAAE,IAAI,AAH7C,CACA,EADQ,MAGiD,GAF/C,IAAI,CAkBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EARD,MAQC,EACV,UAAU,EARD,MAQC,EACV,SAAS,EARA,kBAQA,EACT,IAAI,AARH,CACA,EADQ,MAQK,EACd,OAAO,AARN,CACA,EADQ,MAQU,GAPR,OAAO,CAAC,OAAO,CAAC,CAwD5B;AAED,sFAAsF;AACtF,eAAO,MAAM,cAAc,UAAY,CAAC;AASxC,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,UAAY,CAAC;AAoE1C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,UAAU,AAH/C,CACA,EADQ,OAG+C,GAF7C,MAAM,CAuClB;AAkBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAL7B,MAK6B,EAAE,IAAI,EAJnC,MAAM,EAAE,GAAC,SAI0B,EAAE,YAAY,AAHzD,CACA,EADQ,OAGyD,GAFvD,MAAM,CAclB;AA0GD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAL1B,MAK0B,EAAE,IAAI,EAJhC,MAAM,EAI0B,EAAE,OAAO,EAHzC,MAGyC,GAFvC,MAAM,CAyPlB;AAED,6FAA6F;AAC7F,eAAO,MAAM,UAAU,QAEP,CAAC;AAEjB,4GAA4G;AAC5G,eAAO,MAAM,UAAU,QAEJ,CAAC;AAEpB;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,OAAO,EANxB,MAMwB,EAAE,OAAO,EALjC,MAKiC,EAAE,OAAO,GAJ1C,MAI+C,OAwCzD;AA0BD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAFhC,MAAM,GAAC,SAEyB,QAK1C;AA4BD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,SAGtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EARE,MAQF,EACP,OAAO,EARE,MAQF,EACP,UAAU,SAAA,EACV,UAAU,OAAA,OAmDX;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAFf,MAAM,CAIlB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,IAFZ,MAAM,CAYlB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAJ1B,MAI0B,EAAE,IAAI,EAHhC,MAGgC,GAF9B,OAAO,QAAQ,CAU3B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,KAAA,EAAE,IAAI,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA8B3B"}
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../lib/core/fs.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA+ErC;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,QAAA,OAmCtC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAHlC,MAGkC,GAFhC,OAAO,CAYnB;AAkHD;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAL3B,MAK2B,EAAE,IAAI,EAJjC,MAAM,GAAC,MAI0B,EAAE,OAAO,AAHlD,CACA,EADQ,MAG0C,GAFxC,IAAI,CAehB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAIiC,EAAE,MAAM,EAHzC,QAAQ,CAAC,MAAM,GAAC,MAAM,CAGmB,GAFvC,IAAI,CA4BhB;AA2BD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAJ9B,MAI8B,EAAE,OAAO,AAH/C,CACA,EADQ,MAAM,GAAC,MAG0C,GAF/C,MAAM,GAAC,MAAM,GAAC,SAAS,CA0BnC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,QAAA,EAAE,OAAO,EAH5B,OAG4B,aAwB9C;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAAM,GAAC,MAGyC,GAF9C,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAJxB,MAIwB,EAAE,OAAO,AAHzC,CACA,EADQ,MAG6C,GAF3C,IAAI,CAchB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,IAAI,CAchB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,IAAI,EAJ/B,MAI+B,EAAE,IAAI,AAH7C,CACA,EADQ,MAGiD,GAF/C,IAAI,CAkBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EARD,MAQC,EACV,UAAU,EARD,MAQC,EACV,SAAS,EARA,kBAQA,EACT,IAAI,AARH,CACA,EADQ,MAQK,EACd,OAAO,AARN,CACA,EADQ,MAQU,GAPR,OAAO,CAAC,OAAO,CAAC,CAwD5B;AAED,sFAAsF;AACtF,eAAO,MAAM,cAAc,UAAY,CAAC;AASxC,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,UAAY,CAAC;AAoE1C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,UAAU,AAH/C,CACA,EADQ,OAG+C,GAF7C,MAAM,CAuClB;AAkBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAL7B,MAK6B,EAAE,IAAI,EAJnC,MAAM,EAAE,GAAC,SAI0B,EAAE,YAAY,AAHzD,CACA,EADQ,OAGyD,GAFvD,MAAM,CAclB;AA0GD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAL1B,MAK0B,EAAE,IAAI,EAJhC,MAAM,EAI0B,EAAE,OAAO,EAHzC,MAGyC,GAFvC,MAAM,CAoQlB;AAED,6FAA6F;AAC7F,eAAO,MAAM,UAAU,QAEP,CAAC;AAEjB,4GAA4G;AAC5G,eAAO,MAAM,UAAU,QAEJ,CAAC;AAEpB;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,OAAO,EANxB,MAMwB,EAAE,OAAO,EALjC,MAKiC,EAAE,OAAO,GAJ1C,MAI+C,OAwCzD;AA0BD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAFhC,MAAM,GAAC,SAEyB,QAK1C;AA4BD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,SAGtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EARE,MAQF,EACP,OAAO,EARE,MAQF,EACP,UAAU,SAAA,EACV,UAAU,OAAA,OAmDX;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAFf,MAAM,CAIlB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,IAFZ,MAAM,CAYlB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAJ1B,MAI0B,EAAE,IAAI,EAHhC,MAGgC,GAF9B,OAAO,QAAQ,CAU3B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,KAAA,EAAE,IAAI,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA8B3B"}

package/types/lib/core/globPatterns.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Longest exclude or include pattern cdxgen accepts from an untrusted source,
+ * such as a server request or a config file in the scanned directory.
+ */
+export declare const UNTRUSTED_GLOB_PATTERN_MAX_LENGTH = 512;
+/**
+ * Most patterns a list of untrusted exclude or include patterns may stand
+ * for once brace expressions are expanded. Every expanded pattern is matched
+ * against every file the scan walks, so the total, not the length of the
+ * list as written, is what decides the cost.
+ */
+export declare const UNTRUSTED_GLOB_EXPANSION_BUDGET = 128;
+/**
+ * Count, from above, how many patterns a glob's brace expressions expand to,
+ * following the brace-expansion package that minimatch uses:
+ *
+ * - alternatives in `{a,b}` add up, and groups side by side or inside one
+ *   another multiply;
+ * - a range such as `{1..9}`, `{a..z}` or `{0..100..5}` counts its members;
+ * - a group with no comma of its own but a list inside it, such as
+ *   `{{a,b}c}`, is expanded and each result is braced and expanded again,
+ *   so it counts as its contents, unless its text holds `..` and a result
+ *   could become a range of any size.
+ *
+ * brace-expansion reads braces that form neither a list nor a range in ways
+ * that depend on the rest of the pattern, so a group that is neither, a
+ * closing brace with no group open, a group left open, and the `..` case
+ * above all count as more than `cap`. Patterns that list alternatives or
+ * ranges, such as `{test,tests}` or `*.{js,ts}`, get the exact count, or one
+ * slightly above it where a letter range such as `{Z..c}` spans the `\` that
+ * brace-expansion leaves out. `\` escapes the next character. The count stops growing at
+ * `cap + 1` and each character is read once, so a pattern that would expand
+ * to millions costs no more to count than its length.
+ *
+ * @param {string} pattern glob pattern
+ * @param {number} [cap] largest count of interest
+ * @returns {number} upper bound on the number of expanded patterns, at most
+ *   `cap + 1`
+ */
+export declare function globBraceExpansionCount(pattern: string, cap?: number): number;
+/**
+ * Split exclude or include patterns from an untrusted source into the ones
+ * cdxgen uses and the ones it refuses. Patterns are taken in order while
+ * they fit the expansion budget, so a list cannot multiply the work of a
+ * scan by brace expansion or sheer number.
+ *
+ * @param {unknown} patterns a pattern, a list of patterns, or nothing
+ * @param {Object} [options] bound options
+ * @param {boolean} [options.allowBraces=true] refuse every pattern with a
+ *   brace when false
+ * @param {number} [options.budget] expanded patterns allowed in all
+ * @param {number} [options.used=0] expanded patterns earlier lists have
+ *   already taken from the budget
+ * @returns {{accepted: string[], refused: {pattern: string, reason: string}[], expansions: number}}
+ *   the patterns to use, the ones refused with the reason, and the expanded
+ *   patterns the accepted ones use
+ */
+export declare function boundUntrustedGlobPatterns(patterns: unknown, { allowBraces, budget, used, }?: {
+    allowBraces?: boolean;
+    budget?: number;
+    used?: number;
+}): {
+    accepted: string[];
+    refused: {
+        pattern: string;
+        reason: string;
+    }[];
+    expansions: number;
+};
+//# sourceMappingURL=globPatterns.d.ts.map

package/types/lib/core/globPatterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"globPatterns.d.ts","sourceRoot":"","sources":["../../../lib/core/globPatterns.js"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,iCAAiC,MAAM,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,MAAM,CAAC;AA0DnD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EANE,MAMF,EACP,GAAG,AANF,CACA,EADQ,MAMwB,GALtB,MAAM,CAmDlB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAZC,OAYD,EACR,EACE,WAAkB,EAClB,MAAwC,EACxC,IAAQ,GACT,AAhBA,CAMA,EALA;IAA0B,WAAW,AAArC,CAEA,EAFQ,OAAO,CAEf;IAAyB,MAAM,AAA/B,CACA,EADQ,MAAM,CACd;IAAyB,IAAI,AAA7B,CAEA,EAFQ,MAAM,CAEd;CAUK,GAVK;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAC,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAC,CAyDlG"}

package/types/lib/core/httpClient.d.ts

@@ -84,6 +84,30 @@ export declare function getDefaultHttpTimeoutMs(): number;
  * @returns {number|undefined} Total timeout in milliseconds, or `undefined`.
  */
 export declare function resolveTimeout(timeout?: number | Object): number | undefined;
+/**
+ * Set or clear the cached runtime Brotli verdict. Exported for unit tests only.
+ *
+ * @param {boolean|undefined} verdict verdict to use, or undefined to re-check
+ */
+export declare function _setRuntimeBrotliVerdict(verdict: boolean | undefined): void;
+/**
+ * Whether the Brotli decoder of the runtime cdxgen runs on carries the
+ * CVE-2026-111497 fix, read once from the decoder itself: the node binary, or
+ * the shared libbrotlidec a `--shared-brotli` build (Homebrew, distro
+ * packages) loads; under Bun, the bun binary, which carries its own copy.
+ * process.versions.brotli cannot answer this, since Node.js backports the fix
+ * without changing it. Deno decodes Brotli in Rust, which was never affected.
+ *
+ * On Node.js cdxgen never asks for `br`, so a Brotli response comes only from
+ * a server that sends it unasked. When the decoder cannot be shown to be
+ * patched, such a body is left undecoded rather than handed to a decoder an
+ * attacker can write past. Bun decodes in its transport, so there the client
+ * stops asking for `br` instead.
+ *
+ * @param {Object} [runtime] the runtime to judge, for tests
+ * @returns {boolean} true when Brotli bodies may be decoded
+ */
+export declare function runtimeBrotliDecoderIsPatched(runtime?: Object): boolean;
 /**
  * Override the response cache bounds. Returns the previous bounds so tests can
  * restore them. Not part of the public API.

package/types/lib/core/httpClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"httpClient.d.ts","sourceRoot":"","sources":["../../../lib/core/httpClient.js"],"names":[],"mappings":"AAaA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH;;;;;GAKG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAU3B,QAAQ;IACR,OAAO;IACP,IAAI;IAXX;;;OAGG;IACH,YAAY,QAAQ,EAHT,MAGS,EAAE,OAAO,EAFlB,MAEkB,EAQ5B;CACF;AAED;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,KAAK;IAQ9B,OAAO;IACP,IAAI;IACJ,KAAK;IATZ;;;OAGG;IACH,YAAY,KAAK,EAHN,KAGM,EAAE,OAAO,EAFf,MAEe,EAMzB;CACF;AAmED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAF1B,MAAM,CAYlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,AAHnC,CACA,EADQ,MAAM,GAAC,MAGoB,GAFzB,MAAM,GAAC,SAAS,CAyB5B;AAsMD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAH/B;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAGH,GAF7B;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,CAM7C;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAFjB,IAAI,CAKhB;AAoBD;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAUnC,MAAM;IACN,GAAG;IAVV;;;OAGG;IACH,YAAY,MAAM,EAHP,MAGO,EAAE,GAAG,EAFZ,MAEY,EAOtB;CACF;AASD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAJ1B,CAAC,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,GAAC,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,MAAM,GAAC,IAAI,CAIlG,GAFxB,IAAI,CAIhB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAFvB,IAAI,CAIhB;AA8VD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,AAJtC,CACA,EADQ,MAImC,YAwC7C"}
+{"version":3,"file":"httpClient.d.ts","sourceRoot":"","sources":["../../../lib/core/httpClient.js"],"names":[],"mappings":"AAcA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH;;;;;GAKG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAU3B,QAAQ;IACR,OAAO;IACP,IAAI;IAXX;;;OAGG;IACH,YAAY,QAAQ,EAHT,MAGS,EAAE,OAAO,EAFlB,MAEkB,EAQ5B;CACF;AAED;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,KAAK;IAQ9B,OAAO;IACP,IAAI;IACJ,KAAK;IATZ;;;OAGG;IACH,YAAY,KAAK,EAHN,KAGM,EAAE,OAAO,EAFf,MAEe,EAMzB;CACF;AAmED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAF1B,MAAM,CAYlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,AAHnC,CACA,EADQ,MAAM,GAAC,MAGoB,GAFzB,MAAM,GAAC,SAAS,CAyB5B;AAID;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAFrC,OAAO,GAAC,SAE6B,QAE/C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,AAHlD,CACA,EADQ,MAGsD,GAFpD,OAAO,CAyCnB;AAiOD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAH/B;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAGH,GAF7B;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,CAM7C;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAFjB,IAAI,CAKhB;AAoBD;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAUnC,MAAM;IACN,GAAG;IAVV;;;OAGG;IACH,YAAY,MAAM,EAHP,MAGO,EAAE,GAAG,EAFZ,MAEY,EAOtB;CACF;AASD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAJ1B,CAAC,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,GAAC,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,MAAM,GAAC,IAAI,CAIlG,GAFxB,IAAI,CAIhB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAFvB,IAAI,CAIhB;AA8VD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,AAJtC,CACA,EADQ,MAImC,YAwC7C"}

package/types/lib/core/lockPaths.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Containment check for a path taken from a lockfile (issue #3816). A crafted
+ * npm lockfile can name `file:`/`link:` specifiers or link targets built from
+ * `..` chains or absolute paths, so a parser that is about to list such an
+ * entry checks the resolved path against the project root first.
+ *
+ * The candidate is resolved against `projectRoot`, so both relative values
+ * and the absolute paths arborist already normalised are accepted. The root
+ * itself counts as inside: a lockfile may legitimately link the project to
+ * its own directory.
+ *
+ * @param {string} candidate Path to check, absolute or relative to projectRoot
+ * @param {string} projectRoot Project root the path must stay inside; a falsy
+ *   root means the current working directory, mirroring `node:path`
+ *
+ * @returns {Boolean} True when the path is inside projectRoot
+ */
+export declare function isPathInsideProject(candidate: string, projectRoot: string): boolean;
+//# sourceMappingURL=lockPaths.d.ts.map

package/types/lib/core/lockPaths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockPaths.d.ts","sourceRoot":"","sources":["../../../lib/core/lockPaths.js"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EANlC,MAMkC,EAAE,WAAW,EAL/C,MAK+C,WAkBzD"}

package/types/lib/core/paths.d.ts

@@ -33,4 +33,13 @@ export declare function isValidDriveRoot(root: string): boolean;
  * @returns {string} camelCase representation of the input.
  */
 export declare function toCamel(str: string): string;
+/**
+ * Rewrite an absolute path under the user's home directory to a `~`-relative
+ * form so the emitted BOM does not carry the local username.
+ *
+ * @param {string} filePath Absolute path
+ * @param {string} [home] Home directory, defaulting to the current user's
+ * @returns {string} Home-relative path when applicable, else the input
+ */
+export declare function redactHomePath(filePath: string, home?: string): string;
 //# sourceMappingURL=paths.d.ts.map

package/types/lib/core/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../lib/core/paths.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAYH,iFAAiF;AACjF,eAAO,MAAM,UAAU,KAEV,CAAC;AAEd,oCAAoC;AACpC,eAAO,MAAM,KAAK,SAAyB,CAAC;AAC5C,kCAAkC;AAClC,eAAO,MAAM,KAAK,SAA0B,CAAC;AAE7C;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAH1B,MAG0B,GAFxB,OAAO,CAmBnB;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAHhB,MAGgB,GAFd,MAAM,CAIlB"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../lib/core/paths.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAYH,iFAAiF;AACjF,eAAO,MAAM,UAAU,KAEV,CAAC;AAEd,oCAAoC;AACpC,eAAO,MAAM,KAAK,SAAyB,CAAC;AAC5C,kCAAkC;AAClC,eAAO,MAAM,KAAK,SAA0B,CAAC;AAE7C;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAH1B,MAG0B,GAFxB,OAAO,CAmBnB;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAHhB,MAGgB,GAFd,MAAM,CAIlB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAJ5B,MAI4B,EAAE,IAAI,AAH1C,CACA,EADQ,MAG8C,GAF5C,MAAM,CAelB"}

package/types/lib/core/processTree.d.ts

@@ -12,6 +12,14 @@
  * @returns {string} Human-readable duration
  */
 export declare function formatDuration(ms: number): string;
+/**
+ * A UTC instant as a DMTF datetime, the form WQL compares CIM_DATETIME
+ * properties such as Win32_Process.CreationDate against.
+ *
+ * @param {number} ms Epoch milliseconds
+ * @returns {string} The instant as `yyyymmddHHMMSS.mmmmmm+000`
+ */
+export declare function toDmtfUtc(ms: number): string;
 /**
  * Stop the descendants a timed-out run left behind on Windows.
  *
@@ -20,11 +28,16 @@ export declare function formatDuration(ms: number): string;
  * workers, or the build hosts a .NET analyzer starts keep running while still
  * pointing at the dead process's pid. `taskkill /T` on that pid finds nothing,
  * because the root is already gone. The live descendants are therefore found
- * by parent pid in a process snapshot and stopped, limited to processes
- * created after the run started. The root's own children must also predate
- * its end: once the root is gone its pid can be handed to an unrelated
- * process, whose children would otherwise look like the run's. Elsewhere this
+ * by parent pid in a PowerShell process snapshot, limited to processes
+ * created after the run started, and stopped from Node.js. The root's own
+ * children must also predate its end: once the root is gone its pid can be
+ * handed to an unrelated process, whose children would otherwise look like
+ * the run's. Elsewhere this
  * does nothing: an orphan is re-parented and can no longer be told apart.
+ * It returns once the stopped processes have exited, or after ten seconds,
+ * so the caller can remove files the run left half-written. When the
+ * snapshot itself fails or runs past its time limit it warns and returns an
+ * empty list, since processes may then still be running.
  *
  * @param {number|undefined} rootPid pid of the process cdxgen spawned
  * @param {number} startedAt Epoch milliseconds at which the run started

package/types/lib/core/processTree.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"processTree.d.ts","sourceRoot":"","sources":["../../../lib/core/processTree.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAHtB,MAGsB,GAFpB,MAAM,CAQlB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAPE,MAAM,GAAC,SAOT,EACP,SAAS,EAPA,MAOA,EACT,OAAO,AAPN,CACA,EADQ,MAOW,EACpB,QAAQ,AAPP,CACA,EADQ,MAOY,GANV,MAAM,EAAE,CAuDpB"}
+{"version":3,"file":"processTree.d.ts","sourceRoot":"","sources":["../../../lib/core/processTree.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAHtB,MAGsB,GAFpB,MAAM,CAQlB;AAqCD;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAHjB,MAGiB,GAFf,MAAM,CAMlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAPE,MAAM,GAAC,SAOT,EACP,SAAS,EAPA,MAOA,EACT,OAAO,AAPN,CACA,EADQ,MAOW,EACpB,QAAQ,AAPP,CACA,EADQ,MAOY,GANV,MAAM,EAAE,CA4FpB"}

package/types/lib/core/projectConfig.d.ts

@@ -2,26 +2,65 @@
  * Config file names cdxgen reads from the directory it is invoked in.
  */
 export declare const PROJECT_CONFIG_FILENAMES: string[];
+/**
+ * Options a config file may set, by their kebab-case name. A config file may
+ * also use the camelCase spelling of each, or one of the aliases in
+ * PROJECT_CONFIG_OPTION_ALIASES. Every other key is ignored: options that
+ * only library callers pass (such as `dosaiCommand` or `traceCmd`), yargs'
+ * own `extends`, and anything cdxgen does not know.
+ *
+ * Every option bin/cdxgen.js declares is either here or in
+ * OPERATOR_ONLY_OPTIONS, which projectConfig.poku.js checks.
+ */
+export declare const PROJECT_CONFIG_OPTIONS: Set<string>;
+/**
+ * Options only the operator may set, on the command line or through a
+ * CDXGEN_* environment variable. They choose an executable, start a listener,
+ * turn off certificate checks on the operator's own upload, opt into
+ * experimental tool installation, or end the run without a BOM. A config file
+ * that sets one is told so and ignored.
+ */
+export declare const OPERATOR_ONLY_OPTIONS: Set<string>;
+/**
+ * Alternate option names a config file may use, with the option each one
+ * stands for. yargs applies its aliases to config keys too, so each is
+ * checked as the option it names.
+ */
+export declare const PROJECT_CONFIG_OPTION_ALIASES: Map<string, string>;
 /**
  * Apply the trust boundary between cdxgen and the directory it is scanning.
  *
  * A config file lives in the tree under analysis, so it is attacker-controlled
- * whenever that tree is. Path options are therefore confined to the config's
- * own directory - a scanned project may choose where in itself the BOM lands,
- * but not write outside it - and options that redirect data off the host or
- * widen what cdxgen executes are announced on the console. A project may
- * describe itself with custom metadata properties, but not in the namespaces
- * cdxgen reserves for the facts it establishes, so a scanned tree cannot pass
- * its own claims off as cdxgen's.
+ * whenever that tree is. It may therefore only set the options listed in
+ * PROJECT_CONFIG_OPTIONS: options that choose an executable, start a listener
+ * or weaken the operator's own checks, and every key cdxgen does not declare
+ * as an option, are dropped. Path options are confined to the config's own
+ * directory - a scanned project may choose where in itself the BOM lands, but
+ * not write outside it - and project types that inventory the host rather
+ * than the scan path are dropped. Exclude and include patterns are kept
+ * within the bounds of boundUntrustedGlobPatterns, so a project cannot make
+ * every file match against thousands of brace-expanded patterns. Options that
+ * redirect data off the host or widen what cdxgen does are announced on the
+ * console. A project may describe itself with custom metadata properties, but
+ * not in the namespaces cdxgen reserves for the facts it establishes, so a
+ * scanned tree cannot pass its own claims off as cdxgen's.
  *
  * @param {Object} config parsed config file contents
  * @param {string} configDir directory the config file was read from
- * @returns {{config: Object, rejected: string[], announced: string[], reservedProperties: string[]}} sanitized config and what it did
+ * @returns {{config: Object, rejected: string[], announced: string[], reservedProperties: string[], ignored: string[], operatorOnly: string[], hostScopeTypes: string[], refusedPatterns: {key: string, pattern: string, reason: string}[]}} sanitized config and what it did
  */
 export declare function sanitizeProjectConfig(config: Object, configDir: string): {
     config: Object;
     rejected: string[];
     announced: string[];
     reservedProperties: string[];
+    ignored: string[];
+    operatorOnly: string[];
+    hostScopeTypes: string[];
+    refusedPatterns: {
+        key: string;
+        pattern: string;
+        reason: string;
+    }[];
 };
 //# sourceMappingURL=projectConfig.d.ts.map

package/types/lib/core/projectConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"projectConfig.d.ts","sourceRoot":"","sources":["../../../lib/core/projectConfig.js"],"names":[],"mappings":"AASA;;GAEG;AACH,eAAO,MAAM,wBAAwB,UAKpC,CAAC;AAuEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAJjC,MAIiC,EAAE,SAAS,EAH5C,MAG4C,GAF1C;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,EAAE,MAAM,EAAE,CAAA;CAAC,CA+CnG"}
+{"version":3,"file":"projectConfig.d.ts","sourceRoot":"","sources":["../../../lib/core/projectConfig.js"],"names":[],"mappings":"AAYA;;GAEG;AACH,eAAO,MAAM,wBAAwB,UAKpC,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,aA2GjC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,aAQhC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,qBASxC,CAAC;AA6IH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAJjC,MAIiC,EAAE,SAAS,EAH5C,MAG4C,GAF1C;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,cAAc,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAC,EAAE,CAAA;CAAC,CA2H3O"}

package/types/lib/core/toolRegistry.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Record an external tool cdxgen executed. The first version seen wins unless
+ * it was unknown, so an enriched probe never overwrites a concrete version
+ * with `undefined` and a later concrete version fills an earlier gap.
+ *
+ * @param {string} name Tool name as invoked (a bare name or a path)
+ * @param {string|undefined} version Version when cheaply known
+ */
+export declare function recordExecutedTool(name: string, version: string | undefined): void;
+/**
+ * Remember the version a stage already resolved for a tool, such as the JVM
+ * build tool pregen provisioned. The version shows in `metadata.tools` only if
+ * the tool is executed; the first version recorded wins.
+ *
+ * @param {string} name Tool name as it will be invoked (a bare name or a path)
+ * @param {string} version Resolved version
+ */
+export declare function recordToolVersion(name: string, version: string): void;
+/**
+ * Snapshot of the tools recorded so far, sorted by name so the assembled
+ * `metadata.tools` diff stays stable between runs.
+ *
+ * @returns {Array<{name: string, version: (string|undefined)}>} Sorted tool records
+ */
+export declare function getExecutedTools(): Array<{
+    name: string;
+    version: (string | undefined);
+}>;
+/**
+ * Clear the registry. The server calls it between scans through the run-state
+ * reset; tests call it directly.
+ *
+ * @returns {void}
+ */
+export declare function resetExecutedTools(): void;
+//# sourceMappingURL=toolRegistry.d.ts.map

package/types/lib/core/toolRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolRegistry.d.ts","sourceRoot":"","sources":["../../../lib/core/toolRegistry.js"],"names":[],"mappings":"AAgGA;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAH5B,MAG4B,EAAE,OAAO,EAFrC,MAAM,GAAC,SAE8B,QAwB/C;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAH3B,MAG2B,EAAE,OAAO,EAFpC,MAEoC,QAW9C;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAFnB,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAA;CAAC,CAAC,CAe9D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAFrB,IAAI,CAKhB"}

package/types/lib/ecosystems/cppEvidence.d.ts

@@ -10,6 +10,46 @@
  * @returns {boolean} true when the directory holds at least one C or C++ file
  */
 export declare function hasCppSources(src: string, options?: Object): boolean;
+/**
+ * The ports vcpkg installed into the `vcpkg_installed` directories of a
+ * project and its build trees, by lower-case port name.
+ *
+ * @param {string} src project directory
+ * @param {Object} options CLI options, for the build-directory candidates
+ * @returns {Map<string, {version: string, triplet: string}>}
+ */
+export declare function installedVcpkgPorts(src: string, options?: Object): Map<string, {
+    version: string;
+    triplet: string;
+}>;
+/**
+ * Read a vcpkg manifest (vcpkg.json) in a directory: the project it describes
+ * and the ports it declares. A port's version comes from what vcpkg installed
+ * in the build tree when that is known, otherwise from the manifest's
+ * `overrides`, which pin it exactly. A `version>=` constraint is only a
+ * minimum, so it is kept as a property, never as the version.
+ * https://learn.microsoft.com/vcpkg/reference/vcpkg-json
+ *
+ * The read is cheap and runs no tool, so it does not wait for the atom-based
+ * analysis that getCppModules adds.
+ *
+ * @param {string} src directory that may hold vcpkg.json
+ * @param {Object} [options] options
+ * @param {Map<string, {version: string, triplet: string}>} [options.installedPorts]
+ *   ports vcpkg installed, by lower-case name
+ * @param {function(string): boolean} [options.isListed] whether another source
+ *   already lists a port by that name
+ * @returns {{parentComponent: Object|undefined, pkgList: Object[]}}
+ */
+export declare function parseVcpkgManifest(src: string, options?: {
+    installedPorts?: Map<string, {
+        version: string;
+        triplet: string;
+    }>;
+}): {
+    parentComponent: Object | undefined;
+    pkgList: Object[];
+};
 /**
  * Method to find c/c++ modules by collecting usages with atom
  *
@@ -24,19 +64,6 @@ export declare function hasCppSources(src: string, options?: Object): boolean;
  */
 export declare function getCppModules(src: string, options: object, osPkgsList: array, epkgList: array, isFirstPartyHeader?: Function): {
     parentComponent: Object | {
-        name: any;
-        version: any;
-        description: any;
-        license: any;
-        purl: any;
-        type: string;
-        "bom-ref": string;
-        group?: undefined;
-    } | {
-        description?: undefined;
-        license?: undefined;
-        purl?: undefined;
-        "bom-ref"?: undefined;
         group: any;
         name: any;
         version: string;

package/types/lib/ecosystems/cppEvidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cppEvidence.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cppEvidence.js"],"names":[],"mappings":"AA0MA;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAJtB,MAIsB,EAAE,OAAO,GAH/B,MAGoC,GAFlC,OAAO,CAOnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAVM,MAUN,EACH,OAAO,EAVE,MAUF,EACP,UAAU,EAVD,KAUC,EACV,QAAQ,EAVC,KAUD,EACR,kBAAkB,WAAY;;;;;;;;;;;;;;;;;;;;;;;;;EAqc/B"}
+{"version":3,"file":"cppEvidence.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cppEvidence.js"],"names":[],"mappings":"AA4MA;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAJtB,MAIsB,EAAE,OAAO,GAH/B,MAGoC,GAFlC,OAAO,CAOnB;AAID;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,EAAE,OAAO,GAHrC,MAG0C,GAFxC,GAAG,CAAC,MAAM,EAAE;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CAsB3D;AAgCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAR3B,MAQ2B,EAAE,OAAO,AAP5C,CAGA,EAFA;IAAkE,cAAc,AAAhF,CAEA,EAFQ,GAAG,CAAC,MAAM,EAAE;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAC,CAAC,CAEvD;CAIiD,GAFvC;IAAC,eAAe,EAAE,MAAM,GAAC,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAC,CA4JlE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAVM,MAUN,EACH,OAAO,EAVE,MAUF,EACP,UAAU,EAVD,KAUC,EACV,QAAQ,EAVC,KAUD,EACR,kBAAkB,WAAY;;;;;;;;;;;;EAmX/B"}

package/types/lib/ecosystems/cppIncludeResolver.d.ts

@@ -33,12 +33,13 @@ export declare function parseCIncludeSlices(sliceData: Object): Map<string, {
  * line relative to the installed directory.
  *
  * @param {string[]} installedDirs `vcpkg_installed` directories
- * @returns {Map<string, {port: string, version: string, triplet: string}>}
+ * @returns {Map<string, {port: string, version: string, triplet: string, portVersion?: string}>}
  */
 export declare function readVcpkgInstalledIndex(installedDirs: string[]): Map<string, {
     port: string;
     version: string;
     triplet: string;
+    portVersion?: string;
 }>;
 /**
  * The package folders of a Conan 2 cache, from its database

package/types/lib/ecosystems/cppIncludeResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cppIncludeResolver.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cppIncludeResolver.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAYH;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAHlC,MAGkC,GAFhC,GAAG,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAC,CAAC,CA+BpF;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAH1C,MAAM,EAGoC,GAFxC,GAAG,CAAC,MAAM,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CAsCzE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAH7B,MAG6B,GAF3B,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CAuC/D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAJxB,MAIwB,EAAE,MAAM,EAHhC,MAAM,EAG0B,GAF9B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAgBrD;AAMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAd5C;IAAwB,GAAG,EAAnB,MAAM,CACd;IAA2B,UAAU,AAArC,CAGA,EAHQ,MAAM,EAAE,CAGhB;IAA2B,SAAS,AAApC,CAEA,EAFQ,MAAM,EAAE,CAEhB;CAQ4C,YAuF9C"}
+{"version":3,"file":"cppIncludeResolver.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cppIncludeResolver.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAYH;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAHlC,MAGkC,GAFhC,GAAG,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAC,CAAC,CA+BpF;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAH1C,MAAM,EAGoC,GAFxC,GAAG,CAAC,MAAM,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAC,CAAC,CA6C/F;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAH7B,MAG6B,GAF3B,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CAuC/D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAJxB,MAIwB,EAAE,MAAM,EAHhC,MAAM,EAG0B,GAF9B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAgBrD;AAMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAd5C;IAAwB,GAAG,EAAnB,MAAM,CACd;IAA2B,UAAU,AAArC,CAGA,EAHQ,MAAM,EAAE,CAGhB;IAA2B,SAAS,AAApC,CAEA,EAFQ,MAAM,EAAE,CAEhB;CAQ4C,YA2F9C"}

package/types/lib/ecosystems/ecosystems.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ecosystems.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/ecosystems.js"],"names":[],"mappings":"AAiHA;;;;;GAKG;AACH,eAAO,MAAM,cAAc,IAAK,CAAC;AAqDjC;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAH1C,MAAM,EAGoC,GAFxC,OAAO,CAAC,MAAM,EAAE,CAAC,CAmC7B;AA8LD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,cAAc,CAAC,OAAO,OAAA,EAAE,WAAW,AAPtD,CACA,EADQ,MAO8C,EAAE,OAAO,AAN/D,CAKF,EAJE;IAAyB,WAAW,AAApC,CAEA,EAFQ,MAAM,CAEd;IAA0B,UAAU,AAApC,CAEF,EAFU,OAAO,CAEjB;CACsE,kBAgItE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAL/B,MAK+B,EAAE,IAAI,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,MAAM,GAAC,IAAI,CAYvB;AAscD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,cAAc,CAClC,OAAO,OAAA,EACP,YAAY,GATH,MASQ,EACjB,KAAK,UAAQ,EACb,OAAO,AATN,CAGA,EAHQ;IAAC,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CASrB,SAkHb;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,UAGnE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,GAF/D,MAAM,GAAC,SAAS,CAa3B;AA+DD;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,GAFzD,OAAO,QAAQ,CAY1B;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAF/C,MAAM,QAEyC,qBAUzD;AAED;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CAAC,EACpD,SAAS,EACT,KAAK,EACL,IAAI,EACJ,OAAO,GACR,QAAA,GAPW,OAAO,QAAQ,CAW1B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,OAAA,EAAE,iBAAiB,EAF7D,GAE6D,OAwBvE;AAwHD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,OAAA,EAAE,aAAa,SAAA,kBA6QzD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAJjC,MAIiC,EAAE,WAAW,GAH9C,MAG0D;;;;;;;;IAiIpE;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAHzC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAGH,GAFvC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAJtC,MAIsC,EAAE,UAAU,EAHlD,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAGD,GAFhD,IAAI,CAuBhB;AAiBD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,YAAY,EAH5C,MAG4C,GAF3C,SAAO,SAAS,CAqB3B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,QAAA,GAF7B,QAAQ,CAQnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,QAAA,EAAE,YAAY,EAHzC,MAGyC,GAFxC,SAAO,SAAS,CAc3B;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAJxC,KAAK,CAAC,MAAM,GAAC,SAAS,CAIkB,GAFtC,OAAO,CAAC,IAAI,CAAC,CAoDzB;AAED;;GAEG;AACH,wBAAgB,wBAAwB,SAEvC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,OAAO,EALjC,MAKiC,EAAE,YAAY,AAJvD,CACA,EADQ,MAI+C,GAH7C,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CAgExE;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAJxC,KAAK,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,CAIG,GAFtC,OAAO,CAAC,IAAI,CAAC,CAiDzB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,SAEjC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,YAAY,EAFvC,MAEuC,gBAiDjD;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,KAAK,QAAA,EAAE,IAAI,QAAA,EAAE,OAAO,AAFtD,CACF,QACwD,gBA6BxD;AAiND;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,OAAA,EAAE,OAAO,AAJrD,CAGF,EAFE;IAA0B,gBAAgB,AAA1C,CAEF,EAFU,OAAO,CAEjB;CAC4D,kBAmK5D;AA8GD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CAAC,OAAO,OAAA,EAAE,OAAO,AAJnD,CAGF,EAFE;IAA0B,UAAU,AAApC,CAEF,EAFU,OAAO,CAEjB;CAC0D,kBAwF1D;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAHtC,MAGsC,GAFpC,MAAM,GAAC,SAAS,CA6B5B;AAwDD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EANpC,MAMoC,EAAE,OAAO,EAL7C,MAK6C,EAAE,YAAY,GAJ3D,MAIgE,kBAoe1E;AAkbD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,OAAA,EAAE,YAAY,QAAY;;;GA4IvE"}
+{"version":3,"file":"ecosystems.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/ecosystems.js"],"names":[],"mappings":"AAmHA;;;;;GAKG;AACH,eAAO,MAAM,cAAc,IAAK,CAAC;AAqDjC;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAH1C,MAAM,EAGoC,GAFxC,OAAO,CAAC,MAAM,EAAE,CAAC,CAmC7B;AA8LD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,cAAc,CAAC,OAAO,OAAA,EAAE,WAAW,AAPtD,CACA,EADQ,MAO8C,EAAE,OAAO,AAN/D,CAKF,EAJE;IAAyB,WAAW,AAApC,CAEA,EAFQ,MAAM,CAEd;IAA0B,UAAU,AAApC,CAEF,EAFU,OAAO,CAEjB;CACsE,kBAgItE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAL/B,MAK+B,EAAE,IAAI,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,MAAM,GAAC,IAAI,CAYvB;AAscD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,cAAc,CAClC,OAAO,OAAA,EACP,YAAY,GATH,MASQ,EACjB,KAAK,UAAQ,EACb,OAAO,AATN,CAGA,EAHQ;IAAC,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CASrB,SAmHb;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,UAGnE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,GAF/D,MAAM,GAAC,SAAS,CAa3B;AA+DD;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,GAFzD,OAAO,QAAQ,CAY1B;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAF/C,MAAM,QAEyC,qBAUzD;AAED;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CAAC,EACpD,SAAS,EACT,KAAK,EACL,IAAI,EACJ,OAAO,GACR,QAAA,GAPW,OAAO,QAAQ,CAW1B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,OAAA,EAAE,iBAAiB,EAF7D,GAE6D,OAwBvE;AAwHD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,OAAA,EAAE,aAAa,SAAA,kBA6QzD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAJjC,MAIiC,EAAE,WAAW,GAH9C,MAG0D;;;;;;;;IA6IpE;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAHzC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAGH,GAFvC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAJtC,MAIsC,EAAE,UAAU,EAHlD,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAGD,GAFhD,IAAI,CAuBhB;AAiBD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,YAAY,EAH5C,MAG4C,GAF3C,SAAO,SAAS,CAqB3B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,QAAA,GAF7B,QAAQ,CAQnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,QAAA,EAAE,YAAY,EAHzC,MAGyC,GAFxC,SAAO,SAAS,CAc3B;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAJxC,KAAK,CAAC,MAAM,GAAC,SAAS,CAIkB,GAFtC,OAAO,CAAC,IAAI,CAAC,CAoDzB;AAED;;GAEG;AACH,wBAAgB,wBAAwB,SAEvC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,OAAO,EALjC,MAKiC,EAAE,YAAY,AAJvD,CACA,EADQ,MAI+C,GAH7C,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CAgExE;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAJxC,KAAK,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,CAIG,GAFtC,OAAO,CAAC,IAAI,CAAC,CAiDzB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,SAEjC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,YAAY,EAFvC,MAEuC,gBAiDjD;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,KAAK,QAAA,EAAE,IAAI,QAAA,EAAE,OAAO,AAFtD,CACF,QACwD,gBA6BxD;AAiND;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,OAAA,EAAE,OAAO,AAJrD,CAGF,EAFE;IAA0B,gBAAgB,AAA1C,CAEF,EAFU,OAAO,CAEjB;CAC4D,kBAmK5D;AA8GD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CAAC,OAAO,OAAA,EAAE,OAAO,AAJnD,CAGF,EAFE;IAA0B,UAAU,AAApC,CAEF,EAFU,OAAO,CAEjB;CAC0D,kBAwF1D;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAHtC,MAGsC,GAFpC,MAAM,GAAC,SAAS,CA6B5B;AAwDD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EANpC,MAMoC,EAAE,OAAO,EAL7C,MAK6C,EAAE,YAAY,GAJ3D,MAIgE,kBAoe1E;AAkbD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,OAAA,EAAE,YAAY,QAAY;;;GA4IvE"}

package/types/lib/ecosystems/gemHostProbe.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The gem homes of a host, each a directory with a `specifications` directory.
+ *
+ * @param {string} rootPath root directory
+ * @param {string} platform `linux`, `darwin` or `win32`
+ * @returns {string[]} absolute gem home directories
+ */
+export declare function findGemHomes(rootPath: string, platform: string): string[];
+/**
+ * Inventory the gems of a host's gem homes. One component per distinct gem
+ * and version, with an occurrence for each gemspec it was read from, so no
+ * host path reaches a purl.
+ *
+ * @param {Object} [options] options
+ * @param {string} [options.rootPath="/"] root directory; tests point it at a built tree
+ * @param {string} [options.platform] `linux`, `darwin` or `win32`
+ * @param {function(string): (Object[]|undefined)} [options.executeOsQuery] runs
+ *   an osquery query, for rpm ownership
+ * @param {Object[]} [options.packageComponents] the OS packages the scan has
+ *   inventoried, which name the owners
+ * @param {Object} [options.packageDatabases] where the package databases are
+ * @returns {Promise<Object[]>} gem components
+ */
+export declare function probeHostRubyGems(options?: {
+    rootPath?: string;
+    platform?: string;
+}): Promise<Object[]>;
+//# sourceMappingURL=gemHostProbe.d.ts.map

package/types/lib/ecosystems/gemHostProbe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemHostProbe.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/gemHostProbe.js"],"names":[],"mappings":"AA+FA;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAJ1B,MAI0B,EAAE,QAAQ,EAHpC,MAGoC,GAFlC,MAAM,EAAE,CAmCpB;AAWD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,AAV5C,CAGA,EAFA;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;CAOiD,GAFvC,OAAO,CAAC,MAAM,EAAE,CAAC,CA6I7B"}

package/types/lib/ecosystems/golem.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"golem.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/golem.js"],"names":[],"mappings":"AA4mDA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAL/B,MAK+B,GAJ7B,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,UAAU,EAJrC,MAIqC,EAAE,OAAO,AAHtD,CACA,EADQ,MAGmD,GAFjD,OAAO,CA4DnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,EAAE,OAAO,AAH7C,CACA,EADQ,MAG0C,GAFxC,MAAM,GAAC,SAAS,CA2B5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,AAL7C,CACA,EADQ,MAK0C,EAAE,UAAU,AAJ9D,CACA,EADQ,KAAK,CAAC,MAAM,CAI+C,GAHzD;IAAC,sBAAsB,2BAAgC;IAAC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,mBAAmB,0BAA0B;IAAC,cAAc,wBAAwB;IAAC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,eAAe,wBAAuB;CAAC,CAsFpQ;AAoKD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAJtC,MAIsC,EAAE,SAAS,AAHzD,CACA,EADQ,MAGiD,GAF/C,MAAM,CAkDlB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAJrC,MAIqC,GAHnC;IAAC,MAAM,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAC;IAAC,IAAI,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAyB1F;AAgDD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CA2C5B;AA+BD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,AAJ7C,CACA,EADQ,MAAM,GAAC,IAImC,EAAE,WAAW,AAH/D,CACA,EADQ,MAG4D,GAF1D,MAAM,CAuElB"}
+{"version":3,"file":"golem.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/golem.js"],"names":[],"mappings":"AAumDA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAL/B,MAK+B,GAJ7B,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,UAAU,EAJrC,MAIqC,EAAE,OAAO,AAHtD,CACA,EADQ,MAGmD,GAFjD,OAAO,CA4DnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,EAAE,OAAO,AAH7C,CACA,EADQ,MAG0C,GAFxC,MAAM,GAAC,SAAS,CA2B5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,AAL7C,CACA,EADQ,MAK0C,EAAE,UAAU,AAJ9D,CACA,EADQ,KAAK,CAAC,MAAM,CAI+C,GAHzD;IAAC,sBAAsB,2BAAgC;IAAC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,mBAAmB,0BAA0B;IAAC,cAAc,wBAAwB;IAAC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,eAAe,wBAAuB;CAAC,CAsFpQ;AAoKD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAJtC,MAIsC,EAAE,SAAS,AAHzD,CACA,EADQ,MAGiD,GAF/C,MAAM,CAkDlB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAJrC,MAIqC,GAHnC;IAAC,MAAM,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAC;IAAC,IAAI,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAyB1F;AAgDD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CA2C5B;AA+BD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,AAJ7C,CACA,EADQ,MAAM,GAAC,IAImC,EAAE,WAAW,AAH/D,CACA,EADQ,MAG4D,GAF1D,MAAM,CAuElB"}