@cdxgen/cdxgen 13.5.0 → 13.7.0

package/types/lib/ecosystems/gradleutils.d.ts

@@ -12,6 +12,15 @@ export { isProjectToolingAllowed };
  * @param {Object} [options] CLI options (`installDeps` gates wrapper use)
  */
 export declare function getGradleCommand(srcPath: string, rootPath: string | null, options?: Object): string;
+/**
+ * Read a whitespace-separated list of Gradle arguments from an environment
+ * variable such as `GRADLE_ARGS`. Repeated, leading or trailing whitespace
+ * adds no empty argument, which Gradle would read as a task path.
+ *
+ * @param {string} name Name of the environment variable
+ * @returns {string[]} The arguments, empty when the variable is unset
+ */
+export declare function gradleArgsFromEnv(name: string): string[];
 /**
  * Method to combine the general gradle arguments, the sub-commands and the sub-commands' arguments in the correct way
  *
@@ -23,6 +32,23 @@ export declare function getGradleCommand(srcPath: string, rootPath: string | nul
  * @returns {string[]} Array of arrays of arguments to be added to the gradle command
  */
 export declare function buildGradleCommandArguments(gradleArguments: string[], gradleSubCommands: string[], gradleSubCommandArguments: string[], gradleCommandLength: int): string[];
+/**
+ * List the dependency tasks to run for the root project and every module read
+ * from `gradle properties`.
+ *
+ * The root project is recognised by identity, never by purl. A module named
+ * after the root project that inherits its group and version has the root's
+ * purl (issue 4695), and it still needs its own `:module:dependencies` task.
+ * `root` in `modulesToSkip` drops the root task; any other entry is a module
+ * path.
+ *
+ * @param {Map<string, Object>} gradleModules Modules keyed by project path, and the root project by its name
+ * @param {Object} rootComponent The component built for the root project
+ * @param {string} gradleDepTask Name of the dependency task, usually `dependencies`
+ * @param {string[]} modulesToSkip Module paths, or `root`, to leave out
+ * @returns {string[]} Task paths in the order Gradle should run them
+ */
+export declare function gradleDependencyTasks(gradleModules: Map<string, Object>, rootComponent: Object, gradleDepTask: string, modulesToSkip?: string[]): string[];
 /**
  * Method to split the output produced by Gradle using parallel processing by project
  *
@@ -55,17 +81,19 @@ export declare function parseGradleProjects(rawOutput: string): {
 /**
  * Parse gradle properties output
  *
+ * `gradlePlugin` is true when the project has the `gradlePlugin` extension,
+ * which `java-gradle-plugin`, `kotlin-dsl` and `groovy-gradle-plugin` add: the
+ * project builds Gradle plugins, as a `build-logic` build does.
+ *
  * @param {string} rawOutput Raw string output
  * @param {string} gradleModuleName The name (or 'path') of the module as seen from the root of the project
+ * @returns {{rootProject: string, projects: string[], metadata: Object, gradlePlugin: boolean}} The parsed properties
  */
 export declare function parseGradleProperties(rawOutput: string, gradleModuleName?: string): {
     rootProject: string;
-    projects: any[];
-    metadata: {
-        group: string;
-        version: string;
-        properties: never[];
-    };
+    projects: string[];
+    metadata: Object;
+    gradlePlugin: boolean;
 };
 /**
  * Execute gradle properties command using multi-threading and return parsed output
@@ -110,24 +138,76 @@ export declare function recordGradleInvocationFailure(result: Object, context?:
     command?: string;
     gradleVersion?: string;
 }): void;
+/**
+ * Read the properties of every project the dependency reports name that
+ * `gradleModules` does not have yet, such as a project of an included build,
+ * and add a module for each one whose properties task printed a report. One
+ * Gradle invocation covers all of them.
+ *
+ * @param {Iterable<string>} reports Text of the `gradle dependencies` reports
+ * @param {Map} gradleModules Modules keyed by project path, updated in place
+ * @param {string} gradleRootPath Directory to run Gradle in
+ * @param {Object} options CLI options
+ * @returns {Promise<string[]>} Paths of the projects added
+ */
+export declare function loadGradleModulesForReports(reports: Iterable<string>, gradleModules: Map<any, any>, gradleRootPath: string, options?: Object): Promise<string[]>;
+/**
+ * Give the components of a build-tooling report, such as that of an included
+ * build that builds Gradle plugins, the `excluded` scope that build-tool
+ * configurations get. `reconcileGradleComponents` later keeps a stronger
+ * scope that another project's report gives the same component.
+ *
+ * @param {Object[]} pkgList Components from one project's report, updated in place
+ * @param {Map<string, Object>} gradleModules Modules, which keep their own scope
+ * @returns {Object[]} The same list
+ */
+export declare function excludeGradleBuildTooling(pkgList: Object[], gradleModules: Map<string, Object>): Object[];
+/**
+ * Reconcile the copies of a component that several Gradle projects report.
+ * Every copy gets the strongest scope any project gave it, so a library one
+ * module only tests with stays required when another module compiles against
+ * it, and a dependency one project failed to resolve loses its failure
+ * properties when another project resolved it.
+ *
+ * @param {Object[]} pkgList Components from all the projects, updated in place
+ * @returns {Object[]} The same list
+ */
+export declare function reconcileGradleComponents(pkgList: Object[]): Object[];
 /**
  * Method to resolve dependencies from a gradle output
  *
+ * A constraint line (`(c)`) adds neither a component nor an edge. Gradle
+ * prints a nested constraint under the platform or module that declares it,
+ * and only when the dependency it affects is resolved elsewhere in the tree,
+ * where that dependency gets its component and edges. A top-level
+ * `{strictly …}` constraint from consistent resolution can name a module the
+ * configuration never resolves. A dependency that failed to resolve carries
+ * `cdx:gradle:resolutionFailed`, keeps the version it was requested at when
+ * that is a concrete version, and otherwise records the request in
+ * `cdx:gradle:requestedVersion`. A dependency seen in several configurations
+ * keeps the strongest scope among them. Platforms and BOMs get a `pom` type
+ * and the `excluded` scope.
+ *
+ * The parser runs no Gradle task. A project the tree names but `gradleModules`
+ * lacks gets a component built from the root project's group and version; use
+ * `loadGradleModulesForReports` first to read such projects' properties.
+ *
+ * The lines Gradle prints under another project, such as `project ':lib'` in
+ * the report of `:app`, show that project's dependencies as `:app` resolved
+ * them, after conflict resolution. When `reportedProjects` names that project,
+ * its own report supplies its edges, so these lines add no edge from it.
+ *
  * @param {string} rawOutput Text output from gradle dependencies task
- * @param {string} rootProjectName Name of the root project
- * @param {map} gradleModules Cache with all gradle modules that have already been read
- * @param {string} gradleRootPath Root path where Gradle is to be run when getting module information
- */
-export declare function parseGradleDep(rawOutput: string, rootProjectName?: string, gradleModules?: map, gradleRootPath?: string): Promise<{
-    pkgList: any[];
-    dependenciesList: {
-        ref: string;
-        dependsOn: any[];
-    }[];
-} | {
-    pkgList?: undefined;
-    dependenciesList?: undefined;
-}>;
+ * @param {string} rootProjectName Key in `gradleModules` of the project the report belongs to
+ * @param {map} gradleModules Gradle modules keyed by project path, and the root project by its name
+ * @param {string} gradleRootPath Directory Gradle ran in, recorded as `cdx:gradle:GradleRootPath`
+ * @param {Set<string>} [reportedProjects] Keys in `gradleModules` of the projects whose own reports are parsed
+ * @returns {{pkgList: Object[], dependenciesList: Object[]}|{}} The components and dependency graph
+ */
+export declare function parseGradleDep(rawOutput: string, rootProjectName?: string, gradleModules?: map, gradleRootPath?: string, reportedProjects?: Set<string>): {
+    pkgList: Object[];
+    dependenciesList: Object[];
+} | {};
 /**
  * Method that handles object creation for gradle modules.
  *
@@ -257,4 +337,198 @@ export declare function getMavenCommand(srcPath: string, rootPath: string, optio
  * @returns {Object[]} Package records for resolvable library entries
  */
 export declare function parseGradleVersionCatalog(catalogFile: string): Object[];
+/**
+ * Parse one Gradle dependency lockfile.
+ *
+ * Both layouts are read. A Gradle 6+ `gradle.lockfile` has one
+ * `group:name:version=configuration,configuration` line per module and an
+ * `empty=` line naming the configurations that resolved nothing. A legacy
+ * `gradle/dependency-locks/<configuration>.lockfile` has one
+ * `group:name:version` line per module, and the file name is the
+ * configuration.
+ *
+ * The scope of a module is the strongest that `gradleConfigurationScope`
+ * gives any of its configurations, so a module locked for both
+ * `testRuntimeClasspath` and `runtimeClasspath` is `required`. Everything in
+ * a buildscript or settings lockfile is build tooling and `excluded`.
+ *
+ * A lockfile records resolved versions, so components carry a purl identity
+ * with confidence 1 and the lockfile path as the evidence value. The purl and
+ * bom-ref match what `parseGradleDep` builds for the same coordinate, so a
+ * component reads the same whether Gradle ran or not. A lockfile is flat: it
+ * says nothing about which module depends on which, so no dependency graph is
+ * returned.
+ *
+ * The file is untrusted input. It is read only when it is a regular file no
+ * larger than 8 MiB, at most 100000 lines are read, and a malformed line
+ * costs only itself. Line content never reaches a property.
+ *
+ * @param {string} lockFile Path to the lockfile
+ * @param {Object} [options] Parse options
+ * @param {string} [options.rootDir] Directory the lockfile must resolve inside
+ * @returns {Object[]} Components, one per locked module
+ */
+export declare function parseGradleLockfile(lockFile: string, options?: {
+    rootDir?: string;
+}): Object[];
+/**
+ * Parse several Gradle lockfiles of one build and merge the result.
+ *
+ * Every project of a multi-project build has its own lockfile, so the same
+ * module often appears in several of them with different configurations. The
+ * copies collapse into one component with the strongest scope any lockfile
+ * gave it (see `reconcileGradleComponents`), and its evidence lists every
+ * lockfile that locked it. The first lockfile that locked a module stays its
+ * `internal:SrcFile`.
+ *
+ * @param {string[]} lockFiles Paths to the lockfiles
+ * @param {Object} [options] Parse options, as for `parseGradleLockfile`
+ * @returns {Object[]} Components, one per locked module
+ */
+export declare function parseGradleLockfiles(lockFiles: string[], options?: Object): Object[];
+/**
+ * Find the Gradle dependency lockfiles of one build.
+ *
+ * Both layouts are searched below `rootPath`, recursively even when
+ * `options.multiProject` is off: every subproject of a Gradle build locks its
+ * own configurations, and the subprojects belong to the same build. The
+ * Gradle 6+ names are `gradle.lockfile`, `buildscript-gradle.lockfile` and
+ * `settings-gradle.lockfile`; the Gradle 4.8 to 5.x layout is
+ * `gradle/dependency-locks/<configuration>.lockfile`.
+ *
+ * A lockfile is accepted only when the project directory that owns it holds a
+ * Gradle build file, and never when it sits under `build/`, `.gradle/`,
+ * `node_modules/` or a vendored directory. `getAllFiles` already leaves
+ * `.git`, `.hg`, `.chen` and `node_modules` out; `build/` and `.gradle/` are
+ * Gradle's own output and cache directories, which a lockfile in them cannot
+ * belong to the project's source of truth.
+ *
+ * Custom `dependencyLocking.lockFile` paths, the Nebula `dependencies.lock`
+ * and Palantir `versions.lock` formats are not looked for.
+ *
+ * @param {string} rootPath Directory to search
+ * @param {Object} [options] CLI options
+ * @returns {string[]} Lockfile paths, in a stable order
+ */
+export declare function findGradleLockfiles(rootPath: string, options?: Object): string[];
+/**
+ * Read the root project name a Gradle settings script assigns with
+ * `rootProject.name = '<name>'` or `rootProject.name = "<name>"`, without
+ * running Gradle.
+ *
+ * `settings.gradle` is read before `settings.gradle.kts`, and the last
+ * assignment in the file wins, as it does in Gradle. Only a plain string
+ * literal is accepted: a value built from a variable, a template
+ * (`"${x}"`) or a method call is not something a static read can resolve.
+ *
+ * @param {string} gradleRootPath Root directory of the Gradle build
+ * @returns {string|undefined} The root project name, or undefined when no
+ *   settings script assigns one as a plain literal
+ */
+export declare function readGradleRootProjectName(gradleRootPath: string): string | undefined;
+/**
+ * Parse a `gradle/verification-metadata.xml` file.
+ *
+ * The file is untrusted input. It records what Gradle verified when
+ * `gradle --write-verification-metadata` last ran, which does not prove that
+ * the artifacts in this BOM match: the file travels with the source, and
+ * nothing here re-checks the digests. Trust rules (`trusted-artifacts`,
+ * `trusted-keys`, `ignored-keys`) may be regular expressions, so they are
+ * only counted, never evaluated, and no free text of the file (an `origin`, a
+ * `reason`, a key-server URI) reaches the result. Only checksum digests,
+ * PGP key ids and the configuration flags survive.
+ *
+ * The read is bounded: the file must be a regular file no larger than
+ * 32 MiB inside `options.rootDir`, at most 200000 components and 64
+ * artifacts per component are read, and a malformed file yields undefined
+ * rather than an error.
+ *
+ * @param {string} metadataFile Path to verification-metadata.xml
+ * @param {Object} [options] Parse options
+ * @param {string} [options.rootDir] Directory the file must resolve inside
+ * @returns {{configuration: {verifyMetadata: (boolean|undefined), verifySignatures: (boolean|undefined), trustedKeyCount: number, trustedArtifactRuleCount: number, ignoredKeyCount: number, keyServerCount: number}, components: Map<string, {group: string, name: string, version: string, artifacts: {fileName: string, classifier: string, extension: string, hashes: {alg: string, content: string}[], pgpKeyIds: string[]}[]}>}|undefined}
+ *   The parsed metadata, or undefined when the file could not be read
+ */
+export declare function parseGradleVerificationMetadata(metadataFile: string, options?: {
+    rootDir?: string;
+}): {
+    configuration: {
+        verifyMetadata: (boolean | undefined);
+        verifySignatures: (boolean | undefined);
+        trustedKeyCount: number;
+        trustedArtifactRuleCount: number;
+        ignoredKeyCount: number;
+        keyServerCount: number;
+    };
+    components: Map<string, {
+        group: string;
+        name: string;
+        version: string;
+        artifacts: {
+            fileName: string;
+            classifier: string;
+            extension: string;
+            hashes: {
+                alg: string;
+                content: string;
+            }[];
+            pgpKeyIds: string[];
+        }[];
+    }>;
+} | undefined;
+/**
+ * Find the gradle/verification-metadata.xml of one Gradle build.
+ *
+ * Gradle reads one verification file per build, from the root build's
+ * `gradle` directory; included builds' copies are ignored, so nothing is
+ * searched below the root. The file is accepted only when the directory is a
+ * Gradle project of its own, so a file copied into a nested folder is not
+ * read as an inventory source.
+ *
+ * @param {string} gradleRootPath Root directory of the Gradle build
+ * @returns {string|undefined} The metadata file path, or undefined
+ */
+export declare function findGradleVerificationMetadata(gradleRootPath: string): string | undefined;
+/**
+ * The artifact of a coordinate whose hashes describe the component itself:
+ * the `.pom` artifact for a platform or BOM component, else the main jar,
+ * else the main aar. Sources, javadoc and other classifiers, and the
+ * `.module` and `.pom` hashes of a jar component, are never used.
+ *
+ * @param {object} component Parsed verification metadata component
+ * @param {boolean} wantsPom True for a component with purl qualifier type=pom
+ * @returns {object|undefined} The artifact, or undefined
+ */
+export declare function gradleVerificationMainArtifact(component: object, wantsPom: boolean): object | undefined;
+/**
+ * Merge the checksums and PGP key ids a verification-metadata.xml records
+ * into the components of a package list.
+ *
+ * A digest of the artifact itself, computed from the jar in the local cache
+ * or found by another collector, is the stronger claim, so the recorded
+ * digests only fill the algorithms a component still lacks. Where the file
+ * records a different digest for an algorithm the component already has,
+ * the recorded digest never wins: the component keeps its own, and the
+ * component gains the cdx:gradle:verificationMismatch=true property so the
+ * disagreement is visible. A released Maven version does not change after
+ * publishing, so a stale file cannot explain a mismatch: a stale file names
+ * old versions, which match nothing. The likely causes are an artifact
+ * republished on a mirror or internal repository, or a corrupted or
+ * tampered cache. SNAPSHOT versions and digests that are not hex are not
+ * compared.
+ *
+ * Every matched component also gains two properties naming the verification
+ * methods and the PGP key ids of its artifact. The evidence of the
+ * component is left alone: a component found by a Gradle run or a lockfile
+ * keeps the identity evidence of that source, and only the components the
+ * verification-metadata fallback built carry the file as their evidence.
+ *
+ * @param {Object[]} pkgList Components to enrich in place
+ * @param {Object} metadata Parsed metadata, as parseGradleVerificationMetadata
+ *   returns
+ * @param {string} metadataFile Path to the verification-metadata.xml, named
+ *   in the debug reasoning
+ * @returns {number} The number of components this call changed
+ */
+export declare function applyGradleVerificationMetadata(pkgList: Object[], metadata: Object, metadataFile: string): number;
 //# sourceMappingURL=gradleutils.d.ts.map

package/types/lib/ecosystems/gradleutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gradleutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/gradleutils.js"],"names":[],"mappings":"AAyBA,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAwBpE,OAAO,EAAE,uBAAuB,EAAE,CAAC;AAEnC;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAJ7B,MAI6B,EAAE,QAAQ,EAHvC,MAAM,GAAC,IAGgC,EAAE,OAAO,AAFxD,CACF,EADU,MAEqD,UAiG/D;AA6DD;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,eAAe,EARN,MAAM,EAQA,EACf,iBAAiB,EARR,MAAM,EAQE,EACjB,yBAAyB,EARhB,MAAM,EAQU,EACzB,mBAAmB,EARV,GAQU,GANR,MAAM,EAAE,CA4CpB;AAqCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAJ1C,MAI0C,EAAE,aAAa,EAHzD,MAAM,EAGmD,GAFvD,GAAG,CA0Cf;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAFlC,MAEkC;;;EAsD5C;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAHpC,MAGoC,EAAE,gBAAgB,GAFtD,MAE6D;;;;;;;;EAoDvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAPM,MAON,EACH,cAAc,EAPL,KAOK,EACd,SAAS,GAPA,KAOK,EACd,OAAO,KAAK,GAND,MAAM,CA6GlB;AAiBD;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAF3B,IAAI,CAKhB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAF7B,OAAO,CAInB;AAiGD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EANzC,MAMyC,EAAE,OAAO,GAJ1D;IAAyB,OAAO,AAAhC,CACA,EADQ,MAAM,CACd;IAAyB,aAAa,AAAtC,CACA,EADQ,MAAM,CACd;CAE+D,GAFrD,IAAI,CA+HhB;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,SAAS,EANA,MAMA,EACT,eAAe,GANN,MAMe,EACxB,aAAa,GANJ,GAMgB,EACzB,cAAc,GANL,MAMU;;;;;;;;;GAkPpB;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,QAAQ,EAHpD,MAGoD,GAFlD,MAAM,CAkDlB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,gBAAgB,EAHjD,MAGiD,GAF/C,MAAM,CAkBlB;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAH5C,MAG4C,GAF1C,MAAM,CAuBlB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAHtC,MAGsC,GAFpC,MAAM,CA8ClB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAPD,MAOC,EACV,SAAS,EAPA,MAOA,EACT,QAAQ,GAPC,OAOM,EAAE,qCAAqC;AACtD,gBAAgB,GAPP,OAOe,GANb,OAAO,CAAC,MAAM,CAAC,CAgC3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,EAAE,OAAO,AAF5C,CACF,EADU,MAEyC,UAiBnD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,YAAY,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,MAAM,GAAC,IAAI,CA4BvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAJ7B,MAI6B,GAH3B,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CA2DpC;AAqBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EANC,MAMD,EACR,aAAa,AANZ,CAEA,EAFQ,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAMP,EACzB,OAAO,AALN,CACF,EADU,MAKG,QAoBb;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAJ5B,MAI4B,EAAE,QAAQ,EAHtC,MAGsC,EAAE,OAAO,AAFvD,CACF,EADU,MAEoD,UAmK9D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAH1C,MAG0C,GAFxC,MAAM,EAAE,CAoEpB"}
+{"version":3,"file":"gradleutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/gradleutils.js"],"names":[],"mappings":"AA0BA,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AA4BpE,OAAO,EAAE,uBAAuB,EAAE,CAAC;AAEnC;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAJ7B,MAI6B,EAAE,QAAQ,EAHvC,MAAM,GAAC,IAGgC,EAAE,OAAO,AAFxD,CACF,EADU,MAEqD,UAiG/D;AA4FD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAH3B,MAG2B,GAFzB,MAAM,EAAE,CAKpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,eAAe,EARN,MAAM,EAQA,EACf,iBAAiB,EARR,MAAM,EAQE,EACjB,yBAAyB,EARhB,MAAM,EAQU,EACzB,mBAAmB,EARV,GAQU,GANR,MAAM,EAAE,CAoDpB;AAuCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EAPJ,GAAG,CAAC,MAAM,EAAE,MAAM,CAOd,EACb,aAAa,EAPJ,MAOI,EACb,aAAa,EAPJ,MAOI,EACb,aAAa,GAPJ,MAAM,EAOG,GANP,MAAM,EAAE,CAkBpB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAJ1C,MAI0C,EAAE,aAAa,EAHzD,MAAM,EAGmD,GAFvD,GAAG,CA0Cf;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAFlC,MAEkC;;;EA8C5C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAJpC,MAIoC,EAAE,gBAAgB,GAHtD,MAG6D,GAF3D;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAA;CAAC,CA0D9F;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAPM,MAON,EACH,cAAc,EAPL,KAOK,EACd,SAAS,GAPA,KAOK,EACd,OAAO,KAAK,GAND,MAAM,CAuGlB;AAiBD;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAF3B,IAAI,CAKhB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAF7B,OAAO,CAInB;AAiGD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EANzC,MAMyC,EAAE,OAAO,GAJ1D;IAAyB,OAAO,AAAhC,CACA,EADQ,MAAM,CACd;IAAyB,aAAa,AAAtC,CACA,EADQ,MAAM,CACd;CAE+D,GAFrD,IAAI,CA+HhB;AAgTD;;;;;;;;;;;GAWG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAPE,QAAQ,CAAC,MAAM,CAOjB,EACP,aAAa,eAAA,EACb,cAAc,EAPL,MAOK,EACd,OAAO,GAPE,MAOG,GAND,OAAO,CAAC,MAAM,EAAE,CAAC,CAoD7B;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAJtC,MAAM,EAIgC,EAAE,aAAa,EAHrD,GAAG,CAAC,MAAM,EAAE,MAAM,CAGmC,GAFnD,MAAM,EAAE,CAUpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAHtC,MAAM,EAGgC,GAFpC,MAAM,EAAE,CA0CpB;AA4DD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,cAAc,CAClC,SAAS,EARA,MAQA,EACT,eAAe,GARN,MAQe,EACxB,aAAa,GARJ,GAQgB,EACzB,cAAc,GARL,MAQU,EACnB,gBAAgB,AARf,CACA,EADQ,GAAG,CAAC,MAAM,CAQS,GAPjB;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,EAAE,CAsQ9D;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,QAAQ,EAHpD,MAGoD,GAFlD,MAAM,CAkDlB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,gBAAgB,EAHjD,MAGiD,GAF/C,MAAM,CAkBlB;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAH5C,MAG4C,GAF1C,MAAM,CAuBlB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAHtC,MAGsC,GAFpC,MAAM,CA8ClB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAPD,MAOC,EACV,SAAS,EAPA,MAOA,EACT,QAAQ,GAPC,OAOM,EAAE,qCAAqC;AACtD,gBAAgB,GAPP,OAOe,GANb,OAAO,CAAC,MAAM,CAAC,CAgC3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,EAAE,OAAO,AAF5C,CACF,EADU,MAEyC,UAiBnD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,YAAY,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,MAAM,GAAC,IAAI,CA4BvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAJ7B,MAI6B,GAH3B,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CA2DpC;AAqBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EANC,MAMD,EACR,aAAa,AANZ,CAEA,EAFQ,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAMP,EACzB,OAAO,AALN,CACF,EADU,MAKG,QAoBb;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAJ5B,MAI4B,EAAE,QAAQ,EAHtC,MAGsC,EAAE,OAAO,AAFvD,CACF,EADU,MAEoD,UAmK9D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAH1C,MAG0C,GAFxC,MAAM,EAAE,CAoEpB;AAoKD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EALjC,MAKiC,EAAE,OAAO,AAJlD,CAEA,EADA;IAAyB,OAAO,AAAhC,CACA,EADQ,MAAM,CACd;CAEuD,GAF7C,MAAM,EAAE,CA0HpB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAJnC,MAAM,EAI6B,EAAE,OAAO,AAHpD,CACA,EADQ,MAGiD,GAF/C,MAAM,EAAE,CAuBpB;AAcD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAIiC,EAAE,OAAO,AAHlD,CACA,EADQ,MAG+C,GAF7C,MAAM,EAAE,CA0CpB;AAQD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,cAAc,EAJ7C,MAI6C,GAH3C,MAAM,GAAC,SAAS,CA0D5B;AA8KD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,+BAA+B,CAAC,YAAY,EANjD,MAMiD,EAAE,OAAO,AALlE,CAEA,EADA;IAAyB,OAAO,AAAhC,CACA,EADQ,MAAM,CACd;CAGuE,GAH7D;IAAC,aAAa,EAAE;QAAC,cAAc,EAAE,CAAC,OAAO,GAAC,SAAS,CAAC,CAAC;QAAC,gBAAgB,EAAE,CAAC,OAAO,GAAC,SAAS,CAAC,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,wBAAwB,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAC,CAAC;IAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE;gBAAC,GAAG,EAAE,MAAM,CAAC;gBAAC,OAAO,EAAE,MAAM,CAAA;aAAC,EAAE,CAAC;YAAC,SAAS,EAAE,MAAM,EAAE,CAAA;SAAC,EAAE,CAAA;KAAC,CAAC,CAAA;CAAC,GAAC,SAAS,CA4N/a;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAAC,cAAc,EAHlD,MAGkD,GAFhD,MAAM,GAAC,SAAS,CAmB5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAJ7C,MAI6C,EAAE,QAAQ,EAHvD,OAGuD,GAFrD,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EARE,MAAM,EAQR,EACP,QAAQ,EARC,MAQD,EACR,YAAY,EAPH,MAOG,GALD,MAAM,CA2GlB"}

package/types/lib/ecosystems/jsEvidence.d.ts

@@ -9,12 +9,25 @@
  * from configuration, bundler entrypoints, stylesheets, or plugins, so a
  * missing import is not evidence that a package is optional.
  *
+ * When the lock file holds several versions of a package, an import is
+ * evidence only for the version the importing file resolves to (see
+ * `createNpmVersionChooser`), so a copy nested under another package is not
+ * credited with, or promoted to required by, the project's own imports.
+ *
  * @param {Array<object>} pkgList Package components to enrich.
  * @param {object} allImports Map of import specifier to usage evidence objects.
  * @param {object} allExports Map of export specifier to export evidence objects.
  * @param {boolean} deep When true, fill in missing description/author/license
  *   metadata from the local node_modules copy of each package.
+ * @param {object} [context] Project facts that pick the version a file uses.
+ * @param {string} [context.srcDir] Directory the evidence file names are relative to.
+ * @param {Array<object>} [context.dependencies] Dependency tree of the packages.
+ * @param {object} [context.parentComponent] Project component, with any workspace members as its components.
  * @returns {Promise<Array<object>>} The enriched package list (same reference as pkgList).
  */
-export declare function addEvidenceForImports(pkgList: Array<object>, allImports: object, allExports: object, deep: boolean): Promise<Array<object>>;
+export declare function addEvidenceForImports(pkgList: Array<object>, allImports: object, allExports: object, deep: boolean, context?: {
+    srcDir?: string;
+    dependencies?: Array<object>;
+    parentComponent?: object;
+}): Promise<Array<object>>;
 //# sourceMappingURL=jsEvidence.d.ts.map

package/types/lib/ecosystems/jsEvidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jsEvidence.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/jsEvidence.js"],"names":[],"mappings":"AAyLA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EARE,KAAK,CAAC,MAAM,CAQd,EACP,UAAU,EARD,MAQC,EACV,UAAU,EARD,MAQC,EACV,IAAI,EARK,OAQL,GANO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CA+KlC"}
+{"version":3,"file":"jsEvidence.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/jsEvidence.js"],"names":[],"mappings":"AAsMA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAZE,KAAK,CAAC,MAAM,CAYd,EACP,UAAU,EAZD,MAYC,EACV,UAAU,EAZD,MAYC,EACV,IAAI,EAZK,OAYL,EACJ,OAAO,AAXN,CAIA,EAHA;IAAyB,MAAM,AAA/B,CACA,EADQ,MAAM,CACd;IAAgC,YAAY,AAA5C,CACA,EADQ,KAAK,CAAC,MAAM,CAAC,CACrB;IAAyB,eAAe,AAAxC,CACA,EADQ,MAAM,CACd;CAOW,GAPD,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CA6MlC"}

package/types/lib/ecosystems/kosi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kosi.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/kosi.js"],"names":[],"mappings":"AAqCA;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,eAAe,EAH3C,MAAM,GAAC,SAGoC,GAFzC,MAAM,GAAC,SAAS,CAwB5B;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,KAAA,WAE5C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,QAQ3B;AA6DD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,GAHpC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAkE5B;AA0BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,KAAA,EAAE,SAAS,KAAA,OA4B/C;AAusBD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,KAAK,EAAE,WAAW,KAAK,MAsEpE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,GAJvC,MAI4C,EAAE,WAAW,GAHzD,MAG8D,GAF5D,MAAM,CAoFlB;AAiCD,wBAAgB,mBAAmB,CAAC,UAAU,KAAK,EAAE,UAAU,QAAK;;;;;;;EA2DnE"}
+{"version":3,"file":"kosi.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/kosi.js"],"names":[],"mappings":"AAsCA;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,eAAe,EAH3C,MAAM,GAAC,SAGoC,GAFzC,MAAM,GAAC,SAAS,CAwB5B;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,KAAA,WAE5C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,QAQ3B;AA6DD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,GAHpC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAkE5B;AA0BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,KAAA,EAAE,SAAS,KAAA,OA4B/C;AAosBD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,KAAK,EAAE,WAAW,KAAK,MAsEpE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,GAJvC,MAI4C,EAAE,WAAW,GAHzD,MAG8D,GAF5D,MAAM,CAoFlB;AAiCD,wBAAgB,mBAAmB,CAAC,UAAU,KAAK,EAAE,UAAU,QAAK;;;;;;;EA2DnE"}

package/types/lib/ecosystems/npmVersionResolution.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Full npm package name (`@scope/name` or `name`) of a component or manifest.
+ *
+ * @param {{group?: string, name?: string}} pkg Component or parsed manifest
+ * @returns {string} The package name npm installs it under
+ */
+export declare function npmPackageName({ group, name }: {
+    group?: string;
+    name?: string;
+}): string;
+/**
+ * Full npm package name of an npm purl.
+ *
+ * @param {string} purl Package URL
+ * @returns {string|undefined} `@scope/name` or `name`; undefined for a purl that is not npm or does not parse
+ */
+export declare function npmPackageNameOfPurl(purl: string): string | undefined;
+/**
+ * Directory a package-lock component is installed in.
+ *
+ * `internal:LocalNodeModulesPath` holds the arborist location, relative to the
+ * root of the tree: `node_modules/a/node_modules/b` for a nested copy and
+ * `packages/web/node_modules/b` for a copy under a workspace member. The
+ * component's `internal:SrcFile` names a `package-lock.json` in the directory
+ * that holds the location's first `node_modules` segment, so the install
+ * directory is that location's `node_modules/...` part resolved against the
+ * SrcFile's directory. A location without a `node_modules` segment (a
+ * workspace member itself) and an absolute location (pnpm metadata found by
+ * searching node_modules) name no install a file resolves to.
+ *
+ * @param {Object} pkg Package component
+ * @returns {string|undefined} Absolute install directory
+ */
+export declare function npmInstallDirectory(pkg: Object): string | undefined;
+/**
+ * References the given root components depend on directly.
+ *
+ * @param {Array<{ref: string, dependsOn?: string[]}>} dependencies Dependency tree
+ * @param {Iterable<string>} rootRefs bom-refs of the project and its workspace members
+ * @returns {Set<string>} bom-refs of their direct dependencies
+ */
+export declare function directDependencyRefs(dependencies: Array<{
+    ref: string;
+    dependsOn?: string[];
+}>, rootRefs: Iterable<string>): Set<string>;
+/**
+ * The direct dependencies that apply to a project file, nearest first.
+ *
+ * A file inside an npm workspace member (a component with
+ * `cdx:npm:isWorkspace=true` and its directory in `cdx:npm:resolvedPath`,
+ * relative to the project) depends first on what that member declares, then
+ * on what the project root declares, since Node.js finds the root's hoisted
+ * copies from inside a member too. Any other file depends on the root's.
+ *
+ * @param {Object[]} components Components or package list
+ * @param {Object[]} dependencies Dependency tree
+ * @param {string[]} rootRefs bom-refs of the project and the sub-components it lists
+ * @returns {function(string): Set<string>[]} Lookup from a file name, relative to the project, to sets of bom-refs
+ */
+export declare function createDirectDependencyLookup(components: Object[], dependencies: Object[], rootRefs: string[]): Function;
+/**
+ * bom-refs of a parent component and the sub-components it lists, which are
+ * the roots whose direct dependencies a project's own files use.
+ *
+ * @param {Object} parentComponent Parent (metadata) component
+ * @returns {string[]} bom-refs
+ */
+export declare function projectRootRefs(parentComponent: Object): string[];
+/**
+ * Decide which installed versions of an npm package a project file uses.
+ *
+ * Only package names with more than one version in `pkgList` are decided; a
+ * file uses the single version of any other package. For the rest, the file
+ * uses:
+ *
+ * 1. the copy Node.js resolves from the file's directory, when the lock file
+ *    records install locations (package-lock.json): the first
+ *    `<dir>/node_modules/<name>` holding one of the versions, walking up from
+ *    the file;
+ * 2. otherwise the versions the file's workspace member, or else the project,
+ *    depends on directly (see `createDirectDependencyLookup`);
+ * 3. otherwise every version, since nothing tells them apart.
+ *
+ * @param {Object[]} pkgList Package components, duplicates per install location included
+ * @param {Object} [context] Project facts
+ * @param {string} [context.srcDir] Directory the file names are relative to
+ * @param {Object[]} [context.dependencies] Dependency tree
+ * @param {string[]} [context.rootRefs] bom-refs of the project and the sub-components it lists
+ * @returns {{isAmbiguous: function(Object): boolean, allows: function(Object, string): boolean}} Chooser
+ */
+export declare function createNpmVersionChooser(pkgList: Object[], context?: {
+    srcDir?: string;
+    dependencies?: Object[];
+    rootRefs?: string[];
+}): {
+    isAmbiguous: Function;
+    (Object: any): boolean;
+    allows: Function;
+    (Object: any, string: any): boolean;
+};
+/**
+ * Keep each npm occurrence only on the versions the project file uses.
+ *
+ * evinse credits a slice record to every component of the record's package,
+ * one per installed version. For a package with several versions in the BOM,
+ * an occurrence in file F stays on a version when the input BOM's own import
+ * evidence (seeded before any slice is read) puts that version in F; when the
+ * BOM credits none of the versions in F, or several, the versions F's
+ * workspace member or else the project depends on directly are kept (see
+ * `createDirectDependencyLookup`); failing both, all stay.
+ *
+ * @param {Object} purlLocationMap purl -> Set of occurrence keys, changed in place
+ * @param {Object} purlSymbolMap purl -> occurrence key -> symbol, changed in place
+ * @param {Object} seededLocationMap purl -> Set of occurrence keys the input BOM carried
+ * @param {Object} bomJson Input BOM, for its components, dependencies and metadata component
+ * @returns {Set<string>} purls left with no occurrence, whose input occurrences belong to another version
+ */
+export declare function keepResolvedNpmVersions(purlLocationMap: Object, purlSymbolMap: Object, seededLocationMap: Object, bomJson: Object): Set<string>;
+//# sourceMappingURL=npmVersionResolution.d.ts.map

package/types/lib/ecosystems/npmVersionResolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npmVersionResolution.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/npmVersionResolution.js"],"names":[],"mappings":"AAeA;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAHnC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAGK,GAFjC,MAAM,CAKlB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B,MAAM,GAAC,SAAS,CAc5B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CAuB5B;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAJtC,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CAAC,CAIH,EAAE,QAAQ,EAHhD,QAAQ,CAAC,MAAM,CAGiC,GAF9C,GAAG,CAAC,MAAM,CAAC,CAavB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAC1C,UAAU,EAND,MAAM,EAML,EACV,YAAY,EANH,MAAM,EAMH,EACZ,QAAQ,EANC,MAAM,EAMP,YAqCT;AAqBD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,eAAe,EAHpC,MAGoC,GAFlC,MAAM,EAAE,CAMpB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAPpC,MAAM,EAO8B,EAAE,OAAO,AANrD,CAIA,EAHA;IAAyB,MAAM,AAA/B,CACA,EADQ,MAAM,CACd;IAA2B,YAAY,AAAvC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,QAAQ,AAAnC,CACA,EADQ,MAAM,EAAE,CAChB;CAE0D,GAFhD;IAAC,WAAW,WAAU;IAAA,CAAC,MAAM,KAAA,GAAG,OAAO,CAAC;IAAC,MAAM,WAAU;IAAA,CAAC,MAAM,KAAA,EAAE,MAAM,KAAA,GAAG,OAAO,CAAA;CAAC,CAwE/F;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CACrC,eAAe,EAPN,MAOM,EACf,aAAa,EAPJ,MAOI,EACb,iBAAiB,EAPR,MAOQ,EACjB,OAAO,EAPE,MAOF,GANI,GAAG,CAAC,MAAM,CAAC,CAyEvB"}

package/types/lib/ecosystems/parsers-bazel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsers-bazel.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-bazel.js"],"names":[],"mappings":"AAgDA;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAHhC,MAGgC,GAF9B;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAiDhF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAHlC,MAGkC,GAFhC;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CAiDzD;AA4aD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAJrB,MAIqB,EAAE,IAAI,EAH3B,MAG2B,GAFzB,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,GAAC,MAAM,EAAE,CAAC,CAAC,CA2B/C"}
+{"version":3,"file":"parsers-bazel.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-bazel.js"],"names":[],"mappings":"AAgDA;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAHhC,MAGgC,GAF9B;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAmGhF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAHlC,MAGkC,GAFhC;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CAiDzD;AA+dD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAJrB,MAIqB,EAAE,IAAI,EAH3B,MAG2B,GAFzB,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,GAAC,MAAM,EAAE,CAAC,CAAC,CA2B/C"}

package/types/lib/ecosystems/parsers-js.d.ts

@@ -186,6 +186,22 @@ export declare function pnpmMetadata(pkgList: any[], lockFilePath: string): any[
  *          plain version and not an alias
  */
 export declare function parsePnpmAliasRef(value: string): Object | undefined;
+/**
+ * Decide whether a parsed pnpm lockfile document is a boot document.
+ *
+ * Since pnpm 12 a lockfile can hold two YAML documents. The first, the boot
+ * document, records the project's config dependencies and the resolved pnpm
+ * version under its importers, and the last is the project lockfile. The
+ * boot document is recognised by these keys rather than by its position
+ * alone, and tolerates either key missing.
+ *
+ * See: https://pnpm.io/lockfile
+ *
+ * @param {Object} docObj Parsed YAML document
+ *
+ * @returns {boolean} true when the document looks like a boot document
+ */
+export declare function isPnpmBootDocument(docObj: Object): boolean;
 /**
  * Parse nodejs pnpm lock file
  *
@@ -193,30 +209,11 @@ export declare function parsePnpmAliasRef(value: string): Object | undefined;
  * @param {Object} parentComponent parent component
  * @param {Array[String]} workspacePackages Workspace packages
  * @param {Object} workspaceSrcFiles Workspace package.json files
- * @param {Object} _workspaceCatalogs Workspace catalogs
  * @param {Object} _workspaceDirectDeps Direct dependencies of each workspace
  * @param {Object} depsWorkspaceRefs Workspace references for each dependency
  * @param {string} projectRoot Root path used to relativize pnpm-lock evidence paths
  */
-export declare function parsePnpmLock(pnpmLock: string, parentComponent?: Object, workspacePackages?: any, workspaceSrcFiles?: Object, _workspaceCatalogs?: Object, _workspaceDirectDeps?: Object, depsWorkspaceRefs?: Object, projectRoot?: string): Promise<{
-    pkgList?: undefined;
-    dependenciesList?: undefined;
-    parentSubComponents?: undefined;
-} | {
-    pkgList: any[];
-    dependenciesList: {
-        ref: string;
-        dependsOn: any[];
-    }[];
-    parentSubComponents: {
-        group: any;
-        name: any;
-        version: any;
-        type: string;
-        purl: any;
-        "bom-ref": string;
-    }[];
-}>;
+export declare function parsePnpmLock(pnpmLock: string, parentComponent?: Object, workspacePackages?: any, workspaceSrcFiles?: Object, _workspaceDirectDeps?: Object, depsWorkspaceRefs?: Object, projectRoot?: string): Promise<{}>;
 /**
  * Parse bower json file
  *

package/types/lib/ecosystems/parsers-js.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsers-js.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-js.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAgbrC;;;;;;;;;;;;;GAaG;AACH,wBAAsB,YAAY,CAChC,WAAW,EAZF,MAYE,EACX,MAAM,AAZL,CAEA,EAFQ,OAYK,EACd,aAAa,AAXZ,CAEA,EAFQ,OAWY,EACrB,OAAO,AAVN,CAGA,EAFA;IAA0B,aAAa,AAAvC,CAEA,EAFQ,OAAO,CAEf;CAOW,GAPD,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAwPlC;AA0CD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAJhC,MAIgC,EAAE,KAAK,EAHvC,MAGuC,GAFrC,MAAM,CASlB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAHpC,MAGoC,GAFlC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAC,GAAC,IAAI,CA6BjF;AA+ED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,WAAW,EAHnC,MAGmC,EAAE,OAAO,GAF5C,MAEiD;;;GAyyB3D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAFhC,MAEgC,MA2E1C;AAwND;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,YAAY,EARH,MAQG,EACZ,eAAe,GARN,MAQa,EACtB,iBAAiB,MAAK,EACtB,iBAAiB,GARR,MAQa,EACtB,mBAAmB,GARV,MAQe,EACxB,iBAAiB,GARR,MAQa;;;;;;GAwhBvB;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAFrC,MAEqC,kBAgE/C;AA6GD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,QAAA,UAQ1C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAPnC,MAAM,GAAC,MAO4B,EAAE,YAAY,EANjD,MAMiD,GAF/C,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAoCrC;AAqBD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,cAAc,CAClC,MAAM,EATG,MAAM,GAAC,MASV,EACN,WAAW,EATF,MASE,EACX,UAAU,EATD,MASC,EACV,YAAY,EATH,MASG,EACZ,gBAAgB,EATP,MASO,EAChB,WAAW,AATV,CACA,EADQ,MASO,GARL,OAAO,CAAC,MAAM,CAAC,CA8D3B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAHrC,MAGqC,GAFnC,MAAM,CAoClB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,eAAe,EAHvC,MAGuC,GAFrC,MAAM,CA2BlB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EALhC,MAKgC,EAAE,WAAW,EAJ7C,MAI6C,EAAE,OAAO,EAHtD,MAGsD,GAFpD,MAAM,GAAC,IAAI,CA4DvB;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,OAAA,EAAE,YAAY,EAH7C,MAG6C,SAsFvD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,QAAA,GAH1B,MAAM,GAAC,SAAS,CAkC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAVC,MAUD,EACR,eAAe,GAVN,MAUa,EACtB,iBAAiB,MAAK,EACtB,iBAAiB,GAVR,MAUa,EACtB,kBAAkB,GAVT,MAUc,EACvB,oBAAoB,GAVX,MAUgB,EACzB,iBAAiB,GAVR,MAUa,EACtB,WAAW,GAVF,MAUc;;;;;;;;;;;;;;;;;;GA6+BxB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,aAAa,EAFvC,MAEuC,kBA6CjD;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,SAAS,EAF/B,MAE+B,kBA2FzC;AAGD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAAM,GAAC,MAGuB,GAF5B;IAAE,KAAK,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,CAoBvG;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,aAAa,QAAA,GAFjC,KAAK,QAAQ,CA4CzB"}
+{"version":3,"file":"parsers-js.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-js.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAubrC;;;;;;;;;;;;;GAaG;AACH,wBAAsB,YAAY,CAChC,WAAW,EAZF,MAYE,EACX,MAAM,AAZL,CAEA,EAFQ,OAYK,EACd,aAAa,AAXZ,CAEA,EAFQ,OAWY,EACrB,OAAO,AAVN,CAGA,EAFA;IAA0B,aAAa,AAAvC,CAEA,EAFQ,OAAO,CAEf;CAOW,GAPD,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAwPlC;AA0CD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAJhC,MAIgC,EAAE,KAAK,EAHvC,MAGuC,GAFrC,MAAM,CASlB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAHpC,MAGoC,GAFlC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAC,GAAC,IAAI,CA6BjF;AAwKD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,WAAW,EAHnC,MAGmC,EAAE,OAAO,GAF5C,MAEiD;;;GAs2B3D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAFhC,MAEgC,MAsF1C;AAwOD;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,YAAY,EARH,MAQG,EACZ,eAAe,GARN,MAQa,EACtB,iBAAiB,MAAK,EACtB,iBAAiB,GARR,MAQa,EACtB,mBAAmB,GARV,MAQe,EACxB,iBAAiB,GARR,MAQa;;;;;;GAwhBvB;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAFrC,MAEqC,kBAgE/C;AA6GD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,QAAA,UAQ1C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAPnC,MAAM,GAAC,MAO4B,EAAE,YAAY,EANjD,MAMiD,GAF/C,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAoCrC;AAqBD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,cAAc,CAClC,MAAM,EATG,MAAM,GAAC,MASV,EACN,WAAW,EATF,MASE,EACX,UAAU,EATD,MASC,EACV,YAAY,EATH,MASG,EACZ,gBAAgB,EATP,MASO,EAChB,WAAW,AATV,CACA,EADQ,MASO,GARL,OAAO,CAAC,MAAM,CAAC,CA8D3B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAHrC,MAGqC,GAFnC,MAAM,CAoClB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,eAAe,EAHvC,MAGuC,GAFrC,MAAM,CA2BlB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EALhC,MAKgC,EAAE,WAAW,EAJ7C,MAI6C,EAAE,OAAO,EAHtD,MAGsD,GAFpD,MAAM,GAAC,IAAI,CA4DvB;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,OAAA,EAAE,YAAY,EAH7C,MAG6C,SAsFvD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,QAAA,GAH1B,MAAM,GAAC,SAAS,CAkC5B;AA2CD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAJ9B,MAI8B,GAF5B,OAAO,CAkBnB;AAgDD;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EATC,MASD,EACR,eAAe,GATN,MASa,EACtB,iBAAiB,MAAK,EACtB,iBAAiB,GATR,MASa,EACtB,oBAAoB,GATX,MASgB,EACzB,iBAAiB,GATR,MASa,EACtB,WAAW,GATF,MASc,eAkqCxB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,aAAa,EAFvC,MAEuC,kBA6CjD;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,SAAS,EAF/B,MAE+B,kBA2FzC;AAGD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAAM,GAAC,MAGuB,GAF5B;IAAE,KAAK,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,CAoBvG;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,aAAa,QAAA,GAFjC,KAAK,QAAQ,CA4CzB"}

package/types/lib/ecosystems/parsers-misc.d.ts

@@ -369,6 +369,25 @@ export declare function parseCmakeDotFile(dotFile: string, pkgType: string, opti
  * @returns {Object} The component
  */
 export declare function cmakeFetchDependencyComponent(dep: Object, srcFile: string): Object;
+/**
+ * Read the wrap files of a meson project's subprojects directory: which
+ * dependency names each wrap provides, and the version it pins.
+ * https://mesonbuild.com/Wrap-dependency-system-manual.html
+ *
+ * A WrapDB wrap records `wrapdb_version = <upstream>-<wrap revision>`; any wrap
+ * names its unpacked `directory` and its archive, which carry the upstream
+ * version; a git wrap pins a `revision` that is often a version tag.
+ *
+ * @param {string} subprojectsDir path of the subprojects directory
+ * @returns {Map<string, {wrap: string, version: string, source: string, revision?: string}>}
+ *   by provided dependency name, lower-case
+ */
+export declare function readMesonWraps(subprojectsDir: string): Map<string, {
+    wrap: string;
+    version: string;
+    source: string;
+    revision?: string;
+}>;
 /**
  * Parse a CMake-like build file (CMakeLists.txt, meson.build, etc.) and extract the
  * parent component and list of dependency packages.