@cdxgen/cdxgen 13.5.0 → 13.7.0

package/types/lib/helpers/vsixutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vsixutils.d.ts","sourceRoot":"","sources":["../../../lib/helpers/vsixutils.js"],"names":[],"mappings":"AAmBA;;GAEG;AACH,eAAO,MAAM,0BAA0B,qBAAqB,CAAC;AAO7D;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB;;;IA8LlC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAH3B,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,CAc9C;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAwH5B;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAJnC,MAImC,EAAE,aAAa,EAHlD,MAGkD,GAFhD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CAmE5D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,eAAe,EAJzC,MAAM,GAAC,MAIkC,EAAE,OAAO,AAH1D,CACA,EADQ,MAGkD,GAFhD,MAAM,GAAC,SAAS,CAsC5B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAHrC,MAGqC,GAFnC,MAAM,CA+GlB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAJxB,MAIwB,EAAE,OAAO,AAHzC,CACA,EADQ,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAwK5B;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAmCrC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAF3B,MAE2B,QAwBrC;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAkErC;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAJtC,MAIsC,EAAE,OAAO,AAHvD,CACA,EADQ,MAG+C,GAF7C,MAAM,GAAC,SAAS,CAkC5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAJjC,MAIiC,EAAE,OAAO,AAHlD,CACA,EADQ,MAG0C,GAFxC,MAAM,GAAC,SAAS,CAyC5B;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAHvC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAGM,GAFrC,MAAM,EAAE,CA8BpB"}
+{"version":3,"file":"vsixutils.d.ts","sourceRoot":"","sources":["../../../lib/helpers/vsixutils.js"],"names":[],"mappings":"AA+BA;;GAEG;AACH,eAAO,MAAM,0BAA0B,qBAAqB,CAAC;AAO7D;;;GAGG;AACH,eAAO,MAAM,kBAAkB,eAAe,CAAC;AAE/C;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY;;;;;;QAOnB,MAAM;QACN,KAAK;QAKL,KAAK;;;;;;;;;;;;IAkLV,CAAC;AAqGF;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,AAJrC,CACA,EADQ,MAIyC,GAHvC,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CAyC3E;AAsBD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,AAJ1C,CACA,EADQ,MAI8C,GAH5C,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,CAAC,CAsBtF;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,aAAa,EAL/C,MAK+C,GAJ7C;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CA2D5E;AAwED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAL9B,MAK8B,GAJ5B,MAAM,GAAC,SAAS,CAiC5B;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAV3B;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAUE,EAAE,IAAI,AATzC,CACA,EADQ,MAS6C,EAAE,OAAO,AAR9D,CAKA,EAJA;IAA0B,SAAS,AAAnC,CAEA,EAFQ,OAAO,CAEf;IAA2B,OAAO,AAAlC,CAEA,EAFQ,MAAM,EAAE,CAEhB;CAGmE,GAHzD,MAAM,GAAC,SAAS,CAmD5B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAwH5B;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAJnC,MAImC,EAAE,aAAa,EAHlD,MAGkD,GAFhD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CAmE5D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,eAAe,EAJzC,MAAM,GAAC,MAIkC,EAAE,OAAO,AAH1D,CACA,EADQ,MAGkD,GAFhD,MAAM,GAAC,SAAS,CA2C5B;AAqBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAHrC,MAGqC,GAFnC,MAAM,CAqHlB;AAkBD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAJxB,MAIwB,EAAE,OAAO,AAHzC,CACA,EADQ,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAqK5B;AAaD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,OAAO,CAYnB;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAsCrC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAF3B,MAE2B,QAwBrC;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA+ErC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,+BAA+B,CAAC,aAAa,EALlD,MAKkD,GAJhD;IAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAC,CAwCvF;AAKD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EANnC,MAMmC,EAAE,OAAO,EAL5C;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAKY,GAH1C,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,CAAC,CAsC7E;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EALvC,MAKuC,EAAE,YAAY,EAJrD,MAIqD,EAAE,SAAS,EAHhE,MAGgE,GAF9D,MAAM,EAAE,CAMpB;AAmJD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EATG,MASH,EACN,OAAO,AATN,CACA,EADQ,MASF,EACP,aAAa,AATZ,CACA,EADQ,MASI,EACb,OAAO,AATN,CAGA,EAFA;IAA0B,QAAQ,AAAlC,CAEA,EAFQ,OAAO,CAEf;CAMW,GAND,MAAM,GAAC,SAAS,CA6D5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAJjC,MAIiC,EAAE,OAAO,AAHlD,CACA,EADQ,MAG0C,GAFxC,MAAM,GAAC,SAAS,CAuB5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAHjC,MAGiC,GAF/B,OAAO,CAUnB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAHhC,MAGgC,GAF9B,OAAO,CAenB;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EANvB;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAM9D,EAAE,WAAW,AAJ5C,CACA,EADQ,MAIoC,EAAE,cAAc,EAHpD,MAGoD,GAFlD,MAAM,CA2DlB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAXhC,KAAK,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAC,CAWjF,EAAE,OAAO,AAPjD,CAKA,EAJA;IAA0B,oBAAoB,AAA9C,CAEA,EAFQ,OAAO,CAEf;IAAyB,IAAI,AAA7B,CACA,EADQ,MAAM,CACd;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;CAEsD,GAF5C;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAqC1D;AA0JD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAHvC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAGM,GAFrC,MAAM,EAAE,CAKpB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAHxC,MAAM,EAGkC,GAFtC,MAAM,EAAE,CAoBpB;AA6CD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EATpC,MAAM,EAS8B,EAAE,OAAO,AARrD,CAMA,EALA;IAA2B,KAAK,AAAhC,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,IAAI,AAA7B,CAEA,EAFQ,MAAM,CAEd;IAAgC,OAAO,AAAvC,CAEA,EAFQ,KAAK,CAAC,MAAM,CAAC,CAErB;CAE0D,GAFhD,MAAM,EAAE,CA2CpB"}

package/types/lib/inventory/agentBlueprint.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Declared coding-agent behaviour at CycloneDX 2.0 (cdxgen/cdxgen#4593).
+ *
+ * The source is the AI inventory the 1.x parsers already produce
+ * (communityAiConfigParser: Kiro agents, Claude subagents and agent
+ * definitions). Only real agent definitions count: a component with a
+ * `cdx:agent:role`, or whose `cdx:file:kind` is `agent-definition` or
+ * `claude-subagent`. Instruction files, specs, steering documents, agent
+ * configs and plugins describe or configure agents but are not agents.
+ * At 2.0 this module derives:
+ *
+ * - one party per agent component with a bom-ref
+ *   (#/$defs/cyclonedx-party-2.0/$defs/party, role `agent`) whose `system`
+ *   (#/$defs/cyclonedx-party-2.0/$defs/system) has kind `agent`, `ref` the
+ *   agent component's refId, `label` its name and `permissions` the tool
+ *   names its config allows. The allow list is split on the commas outside
+ *   parentheses, and each entry is reduced to the tool name before any "("
+ *   (`Bash(git status:*)` is `Bash`), so arguments, paths and commands
+ *   never reach the BOM. Names that are not safe tool names are dropped
+ *   (see lib/inventory/agentToolNames.js). The list is unique and sorted.
+ *
+ * - one blueprint (#/$defs/cyclonedx-blueprint-2.0/$defs/blueprint,
+ *   modelTypes `behavioral`) whose actors reference the agent parties and
+ *   whose behaviors.instances carry `acknowledgment: ["declared"]` and a
+ *   `behavior` from data/behavior-taxonomy.schema.json:
+ *   `ai:agent:invokesTool` when the agent declares tools or MCP servers, and
+ *   `ai:agent:requestsUserApproval` when its permission policy has ask rules.
+ *   The inventory records only how many MCP servers an agent's own config
+ *   names, not which, so instances carry no `targets`: naming the project's
+ *   MCP services would claim a binding no config makes.
+ *
+ * No free text from instruction, skill or MCP files is emitted. Business
+ * objectives and use cases are free text, so they are out of scope, and so
+ * is observed behaviour.
+ */
+/** refId of the derived blueprint. */
+export declare const AGENT_BLUEPRINT_REF_ID = "blueprint-declared-agents";
+/** Prefix of every derived agent party refId. */
+export declare const AGENT_PARTY_REF_ID_PREFIX = "party-agent-";
+/**
+ * Is this internal-model component a real coding-agent definition?
+ *
+ * @param {object} component Internal-model component
+ * @returns {boolean} True for a `cdx:agent:role` component or an
+ *   agent-definition / claude-subagent file
+ */
+export declare function isDeclaredAgentComponent(component: object): boolean;
+/**
+ * The permissions of an agent: the tool names of `cdx:agent:tools` and the
+ * scopes of `cdx:agent:permissionCapabilities`, each reduced to the name
+ * before any "(", unique and sorted.
+ *
+ * @param {object} component Internal-model agent component
+ * @returns {string[]} Permission names
+ */
+export declare function declaredAgentPermissions(component: object): string[];
+/**
+ * Collect the 2.0 agent parties and the behavioral blueprint for the
+ * declared agents of an internal-model BOM. Agents without a bom-ref are
+ * skipped (their party could not point at them); parties are unique by
+ * refId.
+ *
+ * @param {object} internalBom The 1.x-shaped internal model
+ * @returns {{parties: object[], blueprint: object|undefined}}
+ */
+export declare function collectAgentBehaviour(internalBom: object): {
+    parties: object[];
+    blueprint: object | undefined;
+};
+//# sourceMappingURL=agentBlueprint.d.ts.map

package/types/lib/inventory/agentBlueprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentBlueprint.d.ts","sourceRoot":"","sources":["../../../lib/inventory/agentBlueprint.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAQH,sCAAsC;AACtC,eAAO,MAAM,sBAAsB,8BAA8B,CAAC;AAClE,iDAAiD;AACjD,eAAO,MAAM,yBAAyB,iBAAiB,CAAC;AAuBxD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAJvC,MAIuC,GAHrC,OAAO,CAcnB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,EAAE,CAYpB;AAyCD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAHtC,MAGsC,GAFpC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,GAAC,SAAS,CAAA;CAAC,CAsC5D"}

package/types/lib/inventory/agentToolNames.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Tool allow lists of coding-agent configurations, reduced to tool names.
+ *
+ * An allow list such as `Read, Bash(git status:*), Bash(curl -u user,secret)`
+ * carries commands, paths and sometimes credentials inside its parentheses.
+ * Only the tool name before any "(" is kept, so nothing an entry scopes its
+ * tool to reaches a BOM. The list is split on the commas outside parentheses,
+ * so the arguments of one entry never become entries of their own.
+ *
+ * A tool name is at most 64 characters of letters, digits and `_ - . : *`
+ * (`Read`, `mcp__github__*`, `fs_write`), optionally in the `@server/tool`
+ * form Kiro uses. A name that looks like a credential (a known token prefix
+ * such as `ghp_` or `AKIA`, or a long run of letters and digits with no
+ * separator) is dropped.
+ */
+/**
+ * Split an allow list on the commas outside parentheses. An array is taken
+ * as already split.
+ *
+ * @param {string|string[]|undefined} value Allow list
+ * @returns {string[]} Trimmed, non-empty entries
+ */
+export declare function splitAllowList(value: string | string[] | undefined): string[];
+/**
+ * The tool name of one allow-list entry, or undefined when it is not a safe
+ * tool name.
+ *
+ * @param {string} entry Allow-list entry
+ * @returns {string|undefined} Tool name
+ */
+export declare function agentToolName(entry: string): string | undefined;
+/**
+ * The unique, sorted tool names of an allow list.
+ *
+ * @param {string|string[]|undefined} value Allow list
+ * @returns {string[]} Tool names
+ */
+export declare function agentToolNames(value: string | string[] | undefined): string[];
+/**
+ * An allow list as cdxgen records it in `cdx:agent:tools` and
+ * `cdx:agent:disallowedTools`: each entry reduced to its tool name, written
+ * `Name(...)` when the entry scoped the tool with arguments, so a scoped
+ * `Bash(git status:*)` stays distinguishable from an unrestricted `Bash`
+ * without copying the scope. Unique, in the order the config lists them,
+ * comma separated.
+ *
+ * @param {string|string[]|undefined} value Allow list
+ * @returns {string|undefined} Summary, or undefined when nothing is left
+ */
+export declare function summarizeAgentToolList(value: string | string[] | undefined): string | undefined;
+//# sourceMappingURL=agentToolNames.d.ts.map

package/types/lib/inventory/agentToolNames.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentToolNames.d.ts","sourceRoot":"","sources":["../../../lib/inventory/agentToolNames.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAyBH;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAHzB,MAAM,GAAC,MAAM,EAAE,GAAC,SAGS,GAFvB,MAAM,EAAE,CAyBpB;AAmBD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAHxB,MAGwB,GAFtB,MAAM,GAAC,SAAS,CAiB5B;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAHzB,MAAM,GAAC,MAAM,EAAE,GAAC,SAGS,GAFvB,MAAM,EAAE,CAMpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAHjC,MAAM,GAAC,MAAM,EAAE,GAAC,SAGiB,GAF/B,MAAM,GAAC,SAAS,CAW5B"}

package/types/lib/inventory/aiCollector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aiCollector.d.ts","sourceRoot":"","sources":["../../../lib/inventory/aiCollector.js"],"names":[],"mappings":"AAu8DA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAJvC,MAIuC,EAAE,OAAO,AAHxD,CACA,EADQ,MAGqD,GAFnD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CA2YhF;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAAC,aAAa,EAJpD,MAIoD,EAAE,OAAO,AAHrE,CACA,EADQ,MAGkE,GAFhE;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAiMhF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,aAAa,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,aAAa,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,aAAa,EAJjD,MAIiD,EAAE,OAAO,AAHlE,CACA,EADQ,MAG+D,GAF7D;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF"}
+{"version":3,"file":"aiCollector.d.ts","sourceRoot":"","sources":["../../../lib/inventory/aiCollector.js"],"names":[],"mappings":"AAslEA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAJvC,MAIuC,EAAE,OAAO,AAHxD,CACA,EADQ,MAGqD,GAFnD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CA8YhF;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAAC,aAAa,EAJpD,MAIoD,EAAE,OAAO,AAHrE,CACA,EADQ,MAGkE,GAFhE;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAiMhF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,aAAa,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,aAAa,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,aAAa,EAJjD,MAIiD,EAAE,OAAO,AAHlE,CACA,EADQ,MAG+D,GAF7D;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF"}

package/types/lib/inventory/aiInventory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aiInventory.d.ts","sourceRoot":"","sources":["../../../lib/inventory/aiInventory.js"],"names":[],"mappings":"AAgBA,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,UAA4B,CAAC;AACpE;;;GAGG;AACH,eAAO,MAAM,yBAAyB,aAapC,CAAC;AACH,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,eAAe,CAAC;AAC/C,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAqEjD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAJnC,MAImC,EAAE,IAAI,EAHzC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAI5B;AAYD;;;;;;GAMG;AACH,wBAAgB,oCAAoC,CAAC,WAAW,EAJrD,MAAM,GAAC,MAAM,EAAE,GAAC,SAIqC,EAAE,IAAI,EAH3D,MAG2D,GAFzD,OAAO,CAkBnB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAHrC,MAGqC,GAFnC,MAAM,EAAE,CAiCpB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAJnC,MAImC,EAAE,IAAI,EAHzC,MAGyC,GAFvC,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAJ1C,MAI0C,EAAE,IAAI,EAHhD,MAGgD,GAF9C,OAAO,CAiBnB;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAJ5C,MAAM,EAIsC,EAAE,KAAK,EAHnD,MAAM,EAG6C,GAFjD,MAAM,EAAE,CAYpB;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,YAAY,EANH,MAAM,EAMH,EACZ,UAAU,EAND,MAAM,EAML,EACV,QAAQ,EANC,MAAM,EAMP,GALG,MAAM,EAAE,CAgCpB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EALrC,MAKqC,EAAE,OAAO,EAJ9C,MAI8C,EAAE,KAAK,EAHrD,MAAM,EAG+C,GAFnD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAyFhF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EATnC;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAST,GARjC;IACR,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CA+BH"}
+{"version":3,"file":"aiInventory.d.ts","sourceRoot":"","sources":["../../../lib/inventory/aiInventory.js"],"names":[],"mappings":"AAgBA,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,UAA4B,CAAC;AACpE;;;GAGG;AACH,eAAO,MAAM,yBAAyB,aAapC,CAAC;AACH,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,eAAe,CAAC;AAC/C,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,eAAe,CAAC;AA+EjD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAJnC,MAImC,EAAE,IAAI,EAHzC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAI5B;AAYD;;;;;;GAMG;AACH,wBAAgB,oCAAoC,CAAC,WAAW,EAJrD,MAAM,GAAC,MAAM,EAAE,GAAC,SAIqC,EAAE,IAAI,EAH3D,MAG2D,GAFzD,OAAO,CAkBnB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAHrC,MAGqC,GAFnC,MAAM,EAAE,CAiCpB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAJnC,MAImC,EAAE,IAAI,EAHzC,MAGyC,GAFvC,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAJ1C,MAI0C,EAAE,IAAI,EAHhD,MAGgD,GAF9C,OAAO,CAiBnB;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAJ5C,MAAM,EAIsC,EAAE,KAAK,EAHnD,MAAM,EAG6C,GAFjD,MAAM,EAAE,CAYpB;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,YAAY,EANH,MAAM,EAMH,EACZ,UAAU,EAND,MAAM,EAML,EACV,QAAQ,EANC,MAAM,EAMP,GALG,MAAM,EAAE,CAgCpB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EALrC,MAKqC,EAAE,OAAO,EAJ9C,MAI8C,EAAE,KAAK,EAHrD,MAAM,EAG+C,GAFnD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAmHhF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EATnC;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAST,GARjC;IACR,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CA+BH"}

package/types/lib/inventory/aiProviders.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Organisations that create AI models, keyed by the short creator id cdxgen
+ * uses internally. The value is the full organisation name written to the
+ * `manufacturer` of a model component, since the minimum elements guidance
+ * asks for full names rather than acronyms or product names.
+ */
+export declare const MODEL_CREATOR_NAMES: Map<string, string>;
+/**
+ * Local runtimes and inference servers. They serve whatever tag or served
+ * model name the user chose, so a model they run names no creator.
+ */
+export declare const LOCAL_MODEL_RUNTIMES: Set<string>;
+/**
+ * Split a model reference written in source code into the route provider it
+ * names, if any, and the model name a creator lookup should read.
+ *
+ * `groq/llama3-8b-8192` names the groq route and the model `llama3-8b-8192`.
+ * `models/gemini-1.5-flash`, `tunedModels/x` and
+ * `projects/p/locations/l/publishers/google/models/gemini-1.5-pro` are Google
+ * API resource names, and the model is the part after the last `models`
+ * segment. Neither form is a Hugging Face repository id.
+ *
+ * @param {string} modelId Model reference as written in the source
+ * @returns {{ name: string, nonHub: boolean, route?: string, routeProvider?: string }}
+ *   The model name, whether the reference is not a Hub repository id, and the
+ *   route and its provider when one is named
+ */
+export declare function splitModelReference(modelId: string): {
+    name: string;
+    nonHub: boolean;
+    route?: string;
+    routeProvider?: string;
+};
+/**
+ * Name the creator of a model from its name alone, when only one creator
+ * publishes under that name.
+ *
+ * @param {string} modelName Model name without route or namespace
+ * @returns {string|undefined} Creator id
+ */
+export declare function modelCreatorFromName(modelName: string): string | undefined;
+/**
+ * Resolve a creator spelling, such as a Hugging Face organisation or a
+ * GGUF general.organization value, to a known creator id.
+ *
+ * @param {string} name Organisation name or namespace
+ * @returns {string|undefined} Creator id, or undefined when unknown
+ */
+export declare function modelCreatorFromOrganization(name: string): string | undefined;
+/**
+ * Pick the creator of a model that source code calls by name.
+ *
+ * The provider of such a model is the SDK, AI host or route the code uses,
+ * which names the client rather than the model: the openai SDK is the usual
+ * client for self-hosted Llama or DeepSeek servers, and a file may use
+ * several SDKs. So the creator is the one the model name names, when the
+ * provider is that creator, is a hosting or routing service, or the file
+ * also uses the creator's own SDK or host. A different creator's SDK leaves
+ * it unset. A model name that names no creator is credited only to a
+ * provider whose own API serves nothing but its own models. A local runtime
+ * serves whatever tag the user created, so it names no creator, and neither
+ * does a file that only uses a local runtime.
+ *
+ * @param {string} modelId Model reference as written in the source
+ * @param {{ provider?: string, fileProviders?: Iterable<string>, runtimes?: Iterable<string> }} [context]
+ *   The provider the code declares through an SDK import, AI host or dosai
+ *   report (never a guess from the model name), every provider the file
+ *   references, and the runtimes it uses
+ * @returns {string|undefined} Creator id
+ */
+export declare function resolveModelCreator(modelId: string, context?: {
+    provider?: string;
+    fileProviders?: Iterable<string>;
+    runtimes?: Iterable<string>;
+}): string | undefined;
+/**
+ * Build the CycloneDX organisational entity for a creator id.
+ *
+ * @param {string} creator Creator id
+ * @returns {{ name: string }|undefined} Manufacturer entity
+ */
+export declare function modelCreatorEntity(creator: string): {
+    name: string;
+} | undefined;
+//# sourceMappingURL=aiProviders.d.ts.map

package/types/lib/inventory/aiProviders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aiProviders.d.ts","sourceRoot":"","sources":["../../../lib/inventory/aiProviders.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,qBAW9B,CAAC;AAmCH;;;GAGG;AACH,eAAO,MAAM,oBAAoB,aAY/B,CAAC;AAqHH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EALhC,MAKgC,GAJ9B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,CA4BrF;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAHtC,MAGsC,GAFpC,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAPhC,MAOgC,EAAE,OAAO,AANjD,CAIA,EAJQ;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;CAMpC,GAF5C,MAAM,GAAC,SAAS,CAqC5B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAC,SAAS,CAKtC"}

package/types/lib/inventory/atomUtils.d.ts

@@ -49,6 +49,13 @@ export declare function splitAtomCommand(command: string): [string, string | und
  * @returns {Set<string>} Supported keys
  */
 export declare function atomFrontendArgKeys(language: string): Set<string>;
+/**
+ * The options the installed atom accepts, as `atom --help` lists them. Asked
+ * once per atom command. An atom that fails to start accepts none.
+ *
+ * @returns {Set<string>} Supported options, such as `--bom-file`
+ */
+export declare function atomOptions(): Set<string>;
 /**
  * The `--frontend-args` atom takes for a C/C++ language: the project's
  * compilation database, when there is one and the installed atom reads it
@@ -61,6 +68,18 @@ export declare function atomFrontendArgKeys(language: string): Set<string>;
  * @returns {string[]} Arguments to add to the atom command
  */
 export declare function atomCompileCommandsArgs(src: string, language: string, options?: Object): string[];
+/**
+ * The `--bom-file` a reachables slice takes package purls from: the BOM evinse
+ * annotates. atom would otherwise only find a BOM saved as `bom.json` inside
+ * the scanned directory, so a BOM written anywhere else gave every reachable
+ * flow no purl. An atom without `--bom-file` is given the arguments it has
+ * always been given, and still reads a `bom.json` in the scanned directory.
+ *
+ * @param {string} sliceType atom slice command
+ * @param {Object} options CLI options, for `input`
+ * @returns {string[]} Arguments to add to the atom command
+ */
+export declare function atomBomFileArgs(sliceType: string, options?: Object): string[];
 /**
  * The arguments that stop atom's Java frontend from running the scanned
  * project's build. In its default delombok mode, atom runs

package/types/lib/inventory/atomUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"atomUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/atomUtils.js"],"names":[],"mappings":"AAkEA;;;GAGG;AACH,eAAO,MAAM,oBAAoB,aAM/B,CAAC;AA2CH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,EAAE,OAAO,GAHrC,MAG0C,GAFxC,MAAM,GAAC,SAAS,CA6C5B;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAwBtC;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,GAAG,CAAC,MAAM,CAAC,CAwCvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,QAAQ,EAJ1C,MAI0C,EAAE,OAAO,GAHnD,MAGwD,GAFtD,MAAM,EAAE,CAiCpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAL/B,MAK+B,EAAE,OAAO,GAJxC,MAI6C,GAH3C,MAAM,EAAE,GAAC,SAAS,CAoB9B;AA0RD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,GAH3C,MAAM,EAG0C,GAF9C,MAAM,GAAC,SAAS,CAU5B;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAJ1C,MAI0C,EAAE,QAAQ,AAH5D,CACA,EADQ,MAAM,EAGmD,GAFvD,OAAO,CAkBnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAAC,SAAS,EAJhD,MAAM,QAI0C,EAAE,QAAQ,AAHlE,CACA,EADQ,MAAM,EAGyD,GAF7D,MAAM,QAAM,CA2DxB;AA4BD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAJhC,MAIqC,EAAE,QAAQ,GAH/C,MAGoD,GAFlD,MAAM,CA6DlB;AAgBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,AANrC,CAIA,EAHA;IAAsB,QAAQ,AAA9B,CACA,EADQ,MAAM,CACd;IAAsB,IAAI,AAA1B,CACA,EADQ,MAAM,CACd;IAAsB,IAAI,AAA1B,CACA,EADQ,MAAM,CACd;CAE0C,GAFhC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,GAAC,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,CA6CvG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,qBAqB/B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAJ5B,MAI4B,EAAE,YAAY,EAH1C,QAAQ,GAAC,KAGiC,GAFxC,QAAQ,GAAC,KAAK,CAkC1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,IAFrB,MAAM,GAAC,SAAS,CAO5B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,GAAC,SAAS,CAO5B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,QAAQ,EAH5B,MAAM,EAGsB,GAF7B,MAAM,GAAC,SAAS,CAoB5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,IAF9B,MAAM,GAAC,SAAS,CAgB5B;AAmED;;GAEG;AACH,wBAAgB,cAAc,QAwB7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,GAAC,SAAS,CA0B5B;AAgED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,IAFf;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAC,CAkB3D;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EALhC,MAAM,GAAC,SAKyB,EAAE,SAAS,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGiE,GAF/D,MAAM,EAAE,CAIpB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAL3B,MAK2B,EAAE,SAAS,EAJtC,MAIsC,EAAE,aAAa,EAHrD,MAGqD,GAFnD,OAAO,CAiBnB;AAeD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,GAAG,EALpB,MAKoB,EAAE,IAAI,EAJ1B,MAAM,EAIoB,EAAE,SAAS,GAHrC,MAG0C,GAFxC,OAAO,CA0KnB;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAHpC,MAGoC,GAFlC,MAAM,EAAE,CAwBpB;AAcD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAF1C,MAE0C,QAQpD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAJ9B,MAI8B,EAAE,SAAS,EAHzC,MAGyC,GAFvC,GAAC,CAcb;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAHpC,MAGoC,GAFlC,MAAM,EAAE,GAAC,MAAM,GAAC,SAAS,CAwBrC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EARM,MAQN,EACH,QAAQ,EARC,MAQD,EACR,WAAW,GARF,MAQa,EACtB,UAAU,GARD,MAQa,EACtB,OAAO,GARE,MAQG,OA8Cb"}
+{"version":3,"file":"atomUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/atomUtils.js"],"names":[],"mappings":"AAkEA;;;GAGG;AACH,eAAO,MAAM,oBAAoB,aAM/B,CAAC;AA2CH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,EAAE,OAAO,GAHrC,MAG0C,GAFxC,MAAM,GAAC,SAAS,CA6C5B;AAKD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAwBtC;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,GAAG,CAAC,MAAM,CAAC,CAwCvB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,IAFd,GAAG,CAAC,MAAM,CAAC,CA+BvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,QAAQ,EAJ1C,MAI0C,EAAE,OAAO,GAHnD,MAGwD,GAFtD,MAAM,EAAE,CAiCpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAJ9B,MAI8B,EAAE,OAAO,GAHvC,MAG4C,GAF1C,MAAM,EAAE,CA4BpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAL/B,MAK+B,EAAE,OAAO,GAJxC,MAI6C,GAH3C,MAAM,EAAE,GAAC,SAAS,CAoB9B;AA0RD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,GAH3C,MAAM,EAG0C,GAF9C,MAAM,GAAC,SAAS,CAU5B;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAJ1C,MAI0C,EAAE,QAAQ,AAH5D,CACA,EADQ,MAAM,EAGmD,GAFvD,OAAO,CAkBnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAAC,SAAS,EAJhD,MAAM,QAI0C,EAAE,QAAQ,AAHlE,CACA,EADQ,MAAM,EAGyD,GAF7D,MAAM,QAAM,CA2DxB;AA4BD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAJhC,MAIqC,EAAE,QAAQ,GAH/C,MAGoD,GAFlD,MAAM,CA6DlB;AAgBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,AANrC,CAIA,EAHA;IAAsB,QAAQ,AAA9B,CACA,EADQ,MAAM,CACd;IAAsB,IAAI,AAA1B,CACA,EADQ,MAAM,CACd;IAAsB,IAAI,AAA1B,CACA,EADQ,MAAM,CACd;CAE0C,GAFhC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,GAAC,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,CA6CvG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,qBAqB/B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAJ5B,MAI4B,EAAE,YAAY,EAH1C,QAAQ,GAAC,KAGiC,GAFxC,QAAQ,GAAC,KAAK,CAkC1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,IAFrB,MAAM,GAAC,SAAS,CAO5B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,GAAC,SAAS,CAO5B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,QAAQ,EAH5B,MAAM,EAGsB,GAF7B,MAAM,GAAC,SAAS,CAoB5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,IAF9B,MAAM,GAAC,SAAS,CAgB5B;AAmED;;GAEG;AACH,wBAAgB,cAAc,QAwB7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,GAAC,SAAS,CA0B5B;AAgED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,IAFf;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAC,CAkB3D;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EALhC,MAAM,GAAC,SAKyB,EAAE,SAAS,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGiE,GAF/D,MAAM,EAAE,CAIpB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAL3B,MAK2B,EAAE,SAAS,EAJtC,MAIsC,EAAE,aAAa,EAHrD,MAGqD,GAFnD,OAAO,CAiBnB;AAeD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,GAAG,EALpB,MAKoB,EAAE,IAAI,EAJ1B,MAAM,EAIoB,EAAE,SAAS,GAHrC,MAG0C,GAFxC,OAAO,CA0KnB;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAHpC,MAGoC,GAFlC,MAAM,EAAE,CAwBpB;AAcD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAF1C,MAE0C,QAQpD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAJ9B,MAI8B,EAAE,SAAS,EAHzC,MAGyC,GAFvC,GAAC,CAcb;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAHpC,MAGoC,GAFlC,MAAM,EAAE,GAAC,MAAM,GAAC,SAAS,CAwBrC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EARM,MAQN,EACH,QAAQ,EARC,MAQD,EACR,WAAW,GARF,MAQa,EACtB,UAAU,GARD,MAQa,EACtB,OAAO,GARE,MAQG,OA8Cb"}

package/types/lib/inventory/bomUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bomUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/bomUtils.js"],"names":[],"mappings":"AAGA;;;GAGG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAuC5C;;;GAGG;AACH,eAAO,MAAM,yCAAyC;;;;;;EAMpD,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,YAAY,YAHd,MAAM,KACJ,OAOV,CAAC;AAgBJ;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,gBAH/B,MAAM,GAAC,MAAM,KACX,MAAM,GAAC,SAQnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,gBAH9B,MAAM,GAAC,MAAM,KACX,MAAM,GAAC,SAWnB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,gBAJ/B,MAAM,GAAC,MAAM,kBACb,MAAM,GAAC,MAAM,KACX,OAYZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,gBAH1B,MAAM,GAAC,MAAM,KACX,OAGkC,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,iBAHrC,MAAM,GAAC,MAAM,KACX,MAAM,EAQlB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qCAAqC,kBAHvC,MAAM,GAAC,MAAM,EAAE,KACb,MAAM,EAYlB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,kBANjC,MAAM,YAEd;IAAkC,aAAa,AAA/C,CACA,EADQ,MAAM,GAAC,MAAM,EAAE,CACvB;IAAgC,WAAW,AAA3C,CACA,EADQ,MAAM,GAAC,MAAM,CACrB;CAAA,KAAU,OAkBZ,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,qBAH3B,MAAM,GAAC,MAAM,GAAC,MAAM,KAClB,MAUZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,YAHpB,MAAM,KACJ,MAAM,GAAC,SAGuB,CAAC;AAE5C;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,YAHpB,MAAM,KACJ,OAGqC,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,YAHhB,MAAM,KACJ,OAIsD,CAAC;AAoCpE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,YALpB,MAAM,eACN,MAAM,GAAC,MAAM,gCACb,MAAM,KACJ,MAkCZ,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,YAHjB,MAAM,KACJ,MAUZ,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,YAJ7B,MAAM,gBACN,MAAM,KACJ,MAWZ,CAAC"}
+{"version":3,"file":"bomUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/bomUtils.js"],"names":[],"mappings":"AAGA;;;GAGG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AA8C5C;;;GAGG;AACH,eAAO,MAAM,yCAAyC;;;;;;EAMpD,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,YAAY,YAHd,MAAM,KACJ,OAOV,CAAC;AAgBJ;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,gBAH/B,MAAM,GAAC,MAAM,KACX,MAAM,GAAC,SAQnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,gBAH9B,MAAM,GAAC,MAAM,KACX,MAAM,GAAC,SAWnB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,gBAJ/B,MAAM,GAAC,MAAM,kBACb,MAAM,GAAC,MAAM,KACX,OAYZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,gBAH1B,MAAM,GAAC,MAAM,KACX,OAGkC,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,iBAHrC,MAAM,GAAC,MAAM,KACX,MAAM,EAQlB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qCAAqC,kBAHvC,MAAM,GAAC,MAAM,EAAE,KACb,MAAM,EAYlB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,kBANjC,MAAM,YAEd;IAAkC,aAAa,AAA/C,CACA,EADQ,MAAM,GAAC,MAAM,EAAE,CACvB;IAAgC,WAAW,AAA3C,CACA,EADQ,MAAM,GAAC,MAAM,CACrB;CAAA,KAAU,OAkBZ,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,qBAH3B,MAAM,GAAC,MAAM,GAAC,MAAM,KAClB,MAUZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,YAHpB,MAAM,KACJ,MAAM,GAAC,SAGuB,CAAC;AAE5C;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,YAHpB,MAAM,KACJ,OAGqC,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,YAHhB,MAAM,KACJ,OAIsD,CAAC;AAoCpE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,YALpB,MAAM,eACN,MAAM,GAAC,MAAM,gCACb,MAAM,KACJ,MAkCZ,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,YAHjB,MAAM,KACJ,MAUZ,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,YAJ7B,MAAM,gBACN,MAAM,KACJ,MAWZ,CAAC"}

package/types/lib/inventory/brotliDecoder.d.ts

@@ -0,0 +1,58 @@
+import { MAX_BROTLI_PROBE_BYTES, MAX_BROTLI_PROBES, readBrotliDecoder } from "../core/brotliProbe.js";
+export { MAX_BROTLI_PROBE_BYTES, MAX_BROTLI_PROBES, readBrotliDecoder };
+/**
+ * The properties a file component carries once it has been probed: the fix
+ * state of each decoder found in it, or why it could not be read.
+ *
+ * @param {Object} decoder result of readBrotliDecoder
+ * @returns {{name: string, value: string}[]} properties to append
+ */
+export declare function brotliDecoderProperties(decoder: Object): {
+    name: string;
+    value: string;
+}[];
+/**
+ * The library component every embedded decoder links to. It has no version:
+ * no build records one, and only the per-file cdx:brotli:*:blockSwitchFix
+ * properties say whether a copy is vulnerable. The `vcs_url` qualifier names
+ * the project and keeps the identity apart from an unpackaged `brotli`
+ * executable, which is `pkg:generic/brotli`. The purl has no namespace: a
+ * `pkg:github` purl is typed as an application and `pkg:generic/google` as a
+ * framework when the BOM is assembled, and this is neither.
+ *
+ * @returns {Object} component with `purl` and `bom-ref`
+ */
+export declare function createBrotliComponent(): Object;
+/**
+ * Start collecting the decoder copies of one scan.
+ *
+ * @returns {{component: Object|undefined, dependencies: Object[], copies: number, unpatched: number, unknown: number}}
+ */
+export declare function createBrotliInventory(): {
+    component: Object | undefined;
+    dependencies: Object[];
+    copies: number;
+    unpatched: number;
+    unknown: number;
+};
+/**
+ * Tag a probed file component and, when it holds a decoder, link it to the
+ * shared brotli component, creating that component on first use. Mutates the
+ * file component in place.
+ *
+ * @param {Object} inventory accumulator from createBrotliInventory
+ * @param {Object} fileComponent file component with a `properties` array
+ * @param {Object} decoder result of readBrotliDecoder
+ */
+export declare function attachBrotliDecoder(inventory: Object, fileComponent: Object, decoder: Object): void;
+/**
+ * Finish an inventory: record the copy counts on the brotli component.
+ *
+ * @param {Object} inventory accumulator from createBrotliInventory
+ * @returns {{components: Object[], dependencies: Object[]}} what to add to the BOM
+ */
+export declare function finishBrotliInventory(inventory: Object): {
+    components: Object[];
+    dependencies: Object[];
+};
+//# sourceMappingURL=brotliDecoder.d.ts.map

package/types/lib/inventory/brotliDecoder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brotliDecoder.d.ts","sourceRoot":"","sources":["../../../lib/inventory/brotliDecoder.js"],"names":[],"mappings":"AAIA,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,CAAC;AAExE;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAHpC,MAGoC,GAFlC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAoB3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,IAFxB,MAAM,CAiBlB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAFxB;IAAC,SAAS,EAAE,MAAM,GAAC,SAAS,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAUrH;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAJlC,MAIkC,EAAE,aAAa,EAHjD,MAGiD,EAAE,OAAO,EAF1D,MAE0D,QAyBpE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAHpC,MAGoC,GAFlC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAkB1D"}

package/types/lib/inventory/cbomutils.d.ts

@@ -30,6 +30,23 @@ export declare function collectDosaiCryptoComponents(src: string, options?: obje
 /**
  * Find crypto algorithm in the given code snippet
  *
+ * cleanStr fuses the snippet's identifiers into one lowercase string
+ * (`prepare_for_save(iv` becomes `prepareforsaveiv`), so a plain substring
+ * test reads short algorithm names inside unrelated identifiers (`rsa` in
+ * `for_save`). A name therefore matches only where a cleanStr word begins:
+ * the snippet's start, right after any character cleanStr strips or keeps as
+ * a separator, or at a lowercase-to-uppercase change in the original text
+ * (`SHA256withRSA`, `HmacSHA256`, `PBKDF2WithHmacSHA256`,
+ * `generateRsaKeyPair`). Boundaries are computed from the original string
+ * before it is lowercased, so case changes survive the cleanStr fusion.
+ * Letter/digit changes do not start a word: they added no match on any
+ * reviewed form or corpus snippet, while splitting every digit-bearing
+ * identifier (`md5`, `base64`) into false word starts. Fused forms the names
+ * themselves are written in still match: `algorithms.AES(key)` and
+ * `AESGCM(key)` yield `aes`, `AES-256-GCM` yields `aes256-GCM`,
+ * `createHash("sha256")` yields `sha-256`. All-uppercase fused forms
+ * (`HMACSHA256`) still hide every name but the run's first.
+ *
  * @param {string} code Code snippet
  * @returns {Array} Arary of crypto algorithm objects with oid and description
  */

package/types/lib/inventory/cbomutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cbomutils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cbomutils.js"],"names":[],"mappings":"AAqBA;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,EAAE,gBAAgB,KAAA,SAiC5D;AAiXD;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CAAC,GAAG,EAL5C,MAK4C,EAAE,OAAO,AAJ7D,CAEA,EADA;IAA0B,IAAI,AAA9B,CACA,EADQ,OAAO,CACf;CAEkE,GAFxD,OAAO,CAAC,MAAM,EAAE,CAAC,CAkD7B;AAED;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,CAAC,GAAG,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC,MAAM,EAAE,CAAC,CAuG7B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAHzB,MAGyB,SAanC"}
+{"version":3,"file":"cbomutils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cbomutils.js"],"names":[],"mappings":"AAqBA;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,EAAE,gBAAgB,KAAA,SAiC5D;AAiXD;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CAAC,GAAG,EAL5C,MAK4C,EAAE,OAAO,AAJ7D,CAEA,EADA;IAA0B,IAAI,AAA9B,CACA,EADQ,OAAO,CACf;CAEkE,GAFxD,OAAO,CAAC,MAAM,EAAE,CAAC,CAkD7B;AAED;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,CAAC,GAAG,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC,MAAM,EAAE,CAAC,CAuG7B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAHzB,MAGyB,SA6CnC"}

package/types/lib/inventory/ciParsers/githubActionsLock.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Maximum accepted lockfile size. `gh actions-lock` writes files that stay
+ * far below this; anything larger is treated as corrupt rather than parsed.
+ * @type {number}
+ */
+export declare const MAX_ACTIONS_LOCKFILE_BYTES: number;
+export type ActionsLockDependency = {
+    /**
+     * Owner name, lower case.
+     */
+    owner: string;
+    /**
+     * Repository name, lower case.
+     */
+    repo: string;
+    /**
+     * Ref the commit was resolved from, with its case
+     * preserved. For a v0.0.1 entry this is the tag, else the branch. It can
+     * differ from the ref in the pin key: the key keeps the ref the workflow
+     * wrote (for example `v4`) while this field records the resolved one (for
+     * example `v4.3.1`).
+     */
+    ref: string;
+    /**
+     * "sha1" or "sha256".
+     */
+    hashAlgo: string;
+    /**
+     * Hex digest without the algorithm prefix.
+     */
+    commit: string;
+    /**
+     * Numeric id of the action's owner.
+     */
+    ownerId: number;
+    /**
+     * Numeric id of the action's repository.
+     */
+    repoId: number;
+    /**
+     * Set only when the entry records one
+     * (v0.0.3); undefined means the home host.
+     */
+    hostname: string | undefined;
+    /**
+     * Normalised pin keys of the direct dependencies;
+     * empty for leaf actions.
+     */
+    uses: string[];
+};
+export type ActionsLockfile = {
+    /**
+     * Version as written in the file; null for an
+     * empty result.
+     */
+    version: string | null;
+    /**
+     * Set only when an older version
+     * was normalised.
+     */
+    sourceVersion: string | undefined;
+    /**
+     * Map of repository-relative
+     * workflow path (always with "/" separators) to its flat pin list.
+     */
+    workflows: Record<string, string[]>;
+    /**
+     * Map of
+     * normalised pin key to the resolved entry.
+     */
+    dependencies: Record<string, ActionsLockDependency>;
+    /**
+     * Human-readable problems found while reading.
+     */
+    warnings: string[];
+};
+/**
+ * Parse an actions lockfile from its text content.
+ *
+ * Every problem, including a file that cannot be parsed at all, is reported
+ * as a warning and collapses the result to the empty shape; the function
+ * never throws.
+ *
+ * @param {string} text Lockfile content
+ * @param {string} [filePath] Path the content came from, used in warnings
+ * @returns {ActionsLockfile} Parsed lockfile, or the empty shape
+ */
+export declare function parseActionsLockfileString(text: string, filePath?: string): ActionsLockfile;
+/**
+ * Read and parse an actions lockfile such as
+ * `.github/workflows/actions.lock`.
+ *
+ * The file is size-checked before it is read, and every problem is reported
+ * as a warning and collapses the result to the empty shape; the function
+ * never throws.
+ *
+ * @param {string} filePath Path to the lockfile
+ * @returns {ActionsLockfile} Parsed lockfile, or the empty shape
+ */
+export declare function parseActionsLockfile(filePath: string): ActionsLockfile;
+//# sourceMappingURL=githubActionsLock.d.ts.map

package/types/lib/inventory/ciParsers/githubActionsLock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"githubActionsLock.d.ts","sourceRoot":"","sources":["../../../../lib/inventory/ciParsers/githubActionsLock.js"],"names":[],"mappings":"AA2BA;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAF7B,MAE2C,CAAC;AAyCnD,YAAkB,qBAAqB,GACvC;;;;IAAmB,KAAK,EAAb,MAAM,CACjB;;;;IAAmB,IAAI,EAAZ,MAAM,CACjB;;;;;;;;IAAmB,GAAG,EAAX,MAAM,CAKjB;;;;IAAmB,QAAQ,EAAhB,MAAM,CACjB;;;;IAAmB,MAAM,EAAd,MAAM,CACjB;;;;IAAmB,OAAO,EAAf,MAAM,CACjB;;;;IAAmB,MAAM,EAAd,MAAM,CACjB;;;;;IAA6B,QAAQ,EAA1B,MAAM,GAAC,SAAS,CAE3B;;;;;IAAqB,IAAI,EAAd,MAAM,EAAE,CAErB;CAAA,CAAA;AAKE,YAAkB,eAAe,GACjC;;;;;IAAwB,OAAO,EAApB,MAAM,GAAC,IAAI,CAEtB;;;;;IAA6B,aAAa,EAA/B,MAAM,GAAC,SAAS,CAE3B;;;;;IAAqC,SAAS,2BAE9C;;;;;IAAkD,YAAY,wCAE9D;;;;IAAqB,QAAQ,EAAlB,MAAM,EAAE,CACrB;CAAA,CAAA;AAyjBD;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAJpC,MAIoC,EAAE,QAAQ,AAHtD,CACA,EADQ,MAG8C,GAF5C,eAAe,CA2F3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAHlC,MAGkC,GAFhC,eAAe,CAoC3B"}

package/types/lib/inventory/citations.d.ts

@@ -49,6 +49,11 @@ export declare function collectToolBomRefs(bomJson: Object): string[];
  * Resolve the bom-ref of the cdxgen tool component, if present. This is the
  * canonical attribution target for inventory that cdxgen collected itself.
  *
+ * The tool component named "cdxgen" wins; a bare bom-ref (legacy array-style
+ * tools) counts when it is cdxgen's own npm purl. A helper whose bom-ref only
+ * mentions cdxgen, such as a cdxgen-plugins-bin tool like trustinspector, is
+ * never the cdxgen tool.
+ *
  * @param {Object} bomJson CycloneDX BOM
  * @returns {string|undefined} bom-ref of the cdxgen tool, or undefined
  */

package/types/lib/inventory/citations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"citations.d.ts","sourceRoot":"","sources":["../../../lib/inventory/citations.js"],"names":[],"mappings":"AAyBA;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,OAAO,EACP,MAAM,EACN,IAAI,EACJ,SAAS,GACV,GAlBE;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAAuB,YAAY,AAAnC,CACA,EADQ,MAAM,CACd;IAAuB,OAAO,AAA9B,CACA,EADQ,MAAM,CACd;IAAuB,MAAM,AAA7B,CACA,EADQ,MAAM,CACd;IAAuB,IAAI,AAA3B,CACA,EADQ,MAAM,CACd;IAAuB,SAAS,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAUG,GAVO,MAAM,GAAC,IAAI,CA0CvB;AAmBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,GAJ5B,MAAM,EAI2B,EAAE,SAAS,GAH5C,MAAM,EAG2C,GAF/C,MAAM,EAAE,CAiBpB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B,MAAM,EAAE,CAgBpB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAHjC,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAK5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,GAF5B,MAAM,CAIlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAL5B,MAK4B,EAAE,SAAS,EAJvC,MAAM,EAIiC,EAAE,OAAO,GAHhD,MAGqD,GAFnD,MAAM,CAuBlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EALnC,MAKmC,EAAE,OAAO,AAJpD,CAEA,EADA;IAAyB,IAAI,AAA7B,CACA,EADQ,MAAM,CACd;CAEyD,GAF/C,MAAM,GAAC,IAAI,CAcvB"}
+{"version":3,"file":"citations.d.ts","sourceRoot":"","sources":["../../../lib/inventory/citations.js"],"names":[],"mappings":"AAyBA;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,OAAO,EACP,MAAM,EACN,IAAI,EACJ,SAAS,GACV,GAlBE;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAAuB,YAAY,AAAnC,CACA,EADQ,MAAM,CACd;IAAuB,OAAO,AAA9B,CACA,EADQ,MAAM,CACd;IAAuB,MAAM,AAA7B,CACA,EADQ,MAAM,CACd;IAAuB,IAAI,AAA3B,CACA,EADQ,MAAM,CACd;IAAuB,SAAS,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAUG,GAVO,MAAM,GAAC,IAAI,CA0CvB;AAmBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,GAJ5B,MAAM,EAI2B,EAAE,SAAS,GAH5C,MAAM,EAG2C,GAF/C,MAAM,EAAE,CAiBpB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B,MAAM,EAAE,CAgBpB;AAUD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAHjC,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAqB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,GAF5B,MAAM,CAIlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAL5B,MAK4B,EAAE,SAAS,EAJvC,MAAM,EAIiC,EAAE,OAAO,GAHhD,MAGqD,GAFnD,MAAM,CAuBlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EALnC,MAKmC,EAAE,OAAO,AAJpD,CAEA,EADA;IAAyB,IAAI,AAA7B,CACA,EADQ,MAAM,CACd;CAEyD,GAF/C,MAAM,GAAC,IAAI,CAcvB"}

package/types/lib/inventory/communityAiConfigParser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"communityAiConfigParser.d.ts","sourceRoot":"","sources":["../../../lib/inventory/communityAiConfigParser.js"],"names":[],"mappings":"AAs1BA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,EAL1B,MAsGT,CAAC"}
+{"version":3,"file":"communityAiConfigParser.d.ts","sourceRoot":"","sources":["../../../lib/inventory/communityAiConfigParser.js"],"names":[],"mappings":"AA0rDA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,EAL1B,MAoIT,CAAC"}