@cdxgen/cdxgen 13.5.0 → 13.7.0

package/types/lib/inventory/cyclonedx20RenderSections.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Render the CycloneDX 2.0 sections that sit beside the inventory:
+ * compositions, annotations, citations, vulnerabilities and formulation.
+ * Each converter restores an entry readCycloneDx20 kept as a shadow while
+ * the entry is unchanged.
+ */
+/**
+ * Render compositions (#/$defs/cyclonedx-composition-2.0/$defs/composition,
+ * required `[kind, aggregate, targets]`). The composition's own 1.x
+ * `bom-ref` (cdxgen sets it to the subject's bom-ref) is not carried, so it
+ * cannot collide with the subject's refId.
+ */
+export declare function renderCompositions(compositions: any, inventory: any, carried: any, stats: any): any[] | undefined;
+/**
+ * Render annotations (#/$defs/cyclonedx-annotation-2.0/$defs/annotation,
+ * required `[subjects, annotator, timestamp, text]`). Subjects are checked
+ * against the declared refIds once the whole document exists
+ * (see resolveAnnotationSubjects).
+ */
+export declare function renderAnnotations(annotations: any, stats: any): any[] | undefined;
+/**
+ * Render citations (#/$defs/cyclonedx-citation-2.0/$defs/citation).
+ * `attributedTo` is a refLinkType, so it names a declared object's refId; the
+ * cdxgen tool's bom-ref becomes exactly that refId. A citation may carry
+ * `attributedTo`, `process` or both, so only the ref rename and the
+ * expression rewrite are targeted.
+ */
+export declare function renderCitations(citations: any, usesInventory: any, stats: any): any[] | undefined;
+/**
+ * Render vulnerabilities: `bom-ref` → `refId`, `cwes` → `weaknesses`, the
+ * tools object, credits as 2.0 organizations and contacts and the proof of
+ * concept's attachments. Members 2.0 has no field for are counted; `affects`
+ * references are resolved once every refId is known (resolveAffectsRefs).
+ */
+export declare function renderVulnerabilities(vulnerabilities: any, stats: any): any[] | undefined;
+/**
+ * formulation → workflows/tasks/triggers with refId renames. The 2.0 formula
+ * allows only refId, properties and workflows
+ * (#/$defs/cyclonedx-formulation-2.0/$defs/formula), so the 1.x
+ * formula.components move to definitions.components (upstream's
+ * valid-formulation-2.0.json declares them there too) and are collected in
+ * `stats.formulaComponents`.
+ */
+export declare function convertFormulation(formulation: any, stats: any): any;
+//# sourceMappingURL=cyclonedx20RenderSections.d.ts.map

package/types/lib/inventory/cyclonedx20RenderSections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20RenderSections.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20RenderSections.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AAsEH;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,KAAA,EAAE,SAAS,KAAA,EAAE,OAAO,KAAA,EAAE,KAAK,KAAA,qBAwCzE;AAwBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,KAAA,EAAE,KAAK,KAAA,qBAiCnD;AA4BD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,SAAS,KAAA,EAAE,aAAa,KAAA,EAAE,KAAK,KAAA,qBAqB9D;AAkHD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,eAAe,KAAA,EAAE,KAAK,KAAA,qBA+C3D;AAgBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,KAAA,EAAE,KAAK,KAAA,OA8DpD"}

package/types/lib/inventory/cyclonedx20Tables.d.ts

@@ -0,0 +1,134 @@
+/**
+ * Frozen lookup tables for the CycloneDX 2.0 renderer and reader: schema enums,
+ * the aggregate spelling table, the pinned 2.0 cryptography enums and the field
+ * lists that say which 1.x members each converter carries. Every value is
+ * quoted from the pinned draft schema
+ * (data/cyclonedx-2.0-bundled.schema.json, CycloneDX/specification 2.0-dev at
+ * ea8c3605829d1da13339a0790b6da73548e42a6b).
+ */
+/**
+ * Internal key that carries 2.0-only sections (risks, blueprints, threats,
+ * controls, perspectives, profiles, declarations and definitions.parties)
+ * through the 1.x-shaped model so a read-then-render round trip preserves
+ * them. Never serialized: renderCycloneDx20 re-emits them and
+ * applySpecVersionCompatibility strips the key for 1.x output.
+ */
+export declare const CDX20_INTERNAL_SECTIONS_KEY = "cdx20Sections";
+/**
+ * The formula property that names, as a JSON array of refIds, the
+ * definitions components of a subject-less 2.0 document that belong to the
+ * formula (2.0 has no formula member for them).
+ */
+export declare const FORMULA_COMPONENT_REFS_PROPERTY = "cdx:formulation:componentRefs";
+/** refId of the cdxgen party declared in definitions.parties. */
+export declare const CDXGEN_PARTY_REF_ID = "party-cdxgen";
+/**
+ * Message shown when a CycloneDX 2.0 document would be uploaded to
+ * Dependency-Track, which ingests CycloneDX 1.x only.
+ */
+export declare const DEPENDENCY_TRACK_CDX20_ERROR = "Dependency-Track does not ingest the CycloneDX 2.0 draft, so a 2.0 document cannot be uploaded with --server-url. Generate with --spec-version 1.7 to upload to Dependency-Track.";
+/** identityScheme enum (#/$defs/cyclonedx-component-2.0/$defs/identityScheme). */
+export declare const IDENTITY_SCHEME_ENUM: Set<string>;
+export declare const FORBIDDEN_IDENTITY_TECHNIQUES: Set<string>;
+export declare const ANALYSIS_TECHNIQUE_ENUM: Set<string>;
+export declare const AGGREGATE_1X_TO_20: Readonly<{
+    complete: "complete";
+    incomplete: "incomplete";
+    incomplete_first_party_only: "incomplete-first-party-only";
+    incomplete_first_party_proprietary_only: "incomplete-first-party-proprietary-only";
+    incomplete_first_party_opensource_only: "incomplete-first-party-opensource-only";
+    incomplete_third_party_only: "incomplete-third-party-only";
+    incomplete_third_party_proprietary_only: "incomplete-third-party-proprietary-only";
+    incomplete_third_party_opensource_only: "incomplete-third-party-opensource-only";
+    unknown: "unknown";
+    not_specified: "not-specified";
+}>;
+/** The inverse of AGGREGATE_1X_TO_20. */
+export declare const AGGREGATE_20_TO_1X: Readonly<{
+    [k: string]: string;
+}>;
+/** 2.0 algorithmFamily values (pinned 2.0 cryptography defs). */
+export declare const ALGORITHM_FAMILY_ENUM: Readonly<Set<any>>;
+/** 2.0 protocolProperties.type values (pinned 2.0 cryptography defs). */
+export declare const PROTOCOL_FAMILY_ENUM: Readonly<Set<any>>;
+export declare const COMPONENT_DATA_TYPE_ENUM: Set<string>;
+export declare const DATA_CLASSIFICATION_ENUM: Set<string>;
+export declare const POSTAL_ADDRESS_FIELDS: string[];
+export declare const COMPONENT_ENTRY_ARRAY_KEYS: Set<string>;
+export declare const LICENSE_EVIDENCE_DETAIL_FIELDS: string[];
+/** 1.x componentData members the renderer handles. */
+export declare const COMPONENT_DATA_FIELDS: Set<string>;
+export declare const COMPONENT_COPY_FIELDS: string[];
+/** 1.x component members the renderer handles; the rest are counted. */
+export declare const COMPONENT_HANDLED_FIELDS: Set<string>;
+export declare const SERVICE_COPY_FIELDS: string[];
+/**
+ * 1.x service members without a 2.0 field, carried at 2.0 as the documented
+ * cdx:service:* properties (docs/CUSTOM_PROPERTIES.md) so the mcp-server
+ * audit rules keep firing on a document read back from 2.0. Each entry is
+ * [1.x field, property name, value kind]; the renderer appends them in this
+ * order and the reader turns them back into the 1.x fields.
+ */
+export declare const CARRIED_SERVICE_PROPERTIES: readonly (readonly string[])[];
+/** 1.x service members the renderer handles; the rest are counted. */
+export declare const SERVICE_HANDLED_FIELDS: Set<string>;
+/** 1.x algorithmFamily values (cryptography-defs algorithmFamiliesEnum). */
+export declare const ALGORITHM_FAMILY_1X: Readonly<Set<any>>;
+/** 1.x ellipticCurve values (cryptography-defs ellipticCurvesEnum). */
+export declare const ELLIPTIC_CURVE_1X: Readonly<Set<any>>;
+/** 1.7 externalReference.type values. */
+export declare const EXTERNAL_REFERENCE_TYPES_1X: Readonly<Set<string>>;
+/** 1.7 component.type values. */
+export declare const COMPONENT_TYPES_1X: Readonly<Set<string>>;
+/** 1.7 componentIdentityEvidence.field values. */
+export declare const IDENTITY_FIELDS_1X: Readonly<Set<string>>;
+/** 1.7 identity-evidence method techniques. */
+export declare const IDENTITY_TECHNIQUES_1X: Readonly<Set<string>>;
+/** 1.7 vulnerability rating `method` values (scoreMethod). */
+export declare const SCORE_METHODS_1X: Readonly<Set<string>>;
+/**
+ * 1.7 cryptoProperties algorithmProperties enums, by member name. Members
+ * whose 2.0 value is a list in 1.7 too are checked entry by entry.
+ */
+export declare const ALGORITHM_PROPERTY_ENUMS_1X: Readonly<{
+    primitive: Readonly<Set<string>>;
+    executionEnvironment: Readonly<Set<string>>;
+    implementationPlatform: Readonly<Set<string>>;
+    mode: Readonly<Set<string>>;
+    padding: Readonly<Set<string>>;
+    cryptoFunctions: Readonly<Set<string>>;
+}>;
+/** 1.7 protocolProperties.type values. */
+export declare const PROTOCOL_TYPES_1X: Readonly<Set<string>>;
+/**
+ * Party roles (#/$defs/cyclonedx-party-2.0/$defs/preDefinedRole) the 1.x
+ * component and service fields can hold, with the 1.x field.
+ */
+export declare const PARTY_ROLE_FIELDS_1X: Readonly<{
+    supplier: "supplier";
+    manufacturer: "manufacturer";
+    author: "authors";
+    publisher: "publisher";
+    provider: "provider";
+}>;
+/**
+ * Identity schemes (#/$defs/cyclonedx-component-2.0/$defs/identityScheme) the
+ * 1.x identifier fields hold, with the 1.x field. `omniborid` and `swhid` are
+ * lists in 1.x; the others hold one value.
+ */
+export declare const IDENTITY_SCHEME_FIELDS_1X: Readonly<{
+    purl: "purl";
+    cpe: "cpe";
+    swid: "swid";
+    omniborid: "omniborId";
+    swhid: "swhid";
+}>;
+/** 2.0 identity-evidence scheme → 1.x field, for the predefined schemes. */
+export declare const IDENTITY_EVIDENCE_SCHEME_TO_FIELD: Readonly<{
+    purl: "purl";
+    cpe: "cpe";
+    swid: "swid";
+    swhid: "swhid";
+    omniborid: "omniborId";
+}>;
+//# sourceMappingURL=cyclonedx20Tables.d.ts.map

package/types/lib/inventory/cyclonedx20Tables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20Tables.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20Tables.js"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,kBAAkB,CAAC;AAE3D;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,kCAAkC,CAAC;AAE/E,iEAAiE;AACjE,eAAO,MAAM,mBAAmB,iBAAiB,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,sLAC4I,CAAC;AAEtL,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,aA0B/B,CAAC;AAKH,eAAO,MAAM,6BAA6B,aAWxC,CAAC;AAGH,eAAO,MAAM,uBAAuB,aA6BlC,CAAC;AAKH,eAAO,MAAM,kBAAkB;;;;;;;;;;;EAe7B,CAAC;AAEH,yCAAyC;AACzC,eAAO,MAAM,kBAAkB;;EAI9B,CAAC;AAgBF,iEAAiE;AACjE,eAAO,MAAM,qBAAqB,oBAEjC,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,oBAEhC,CAAC;AAGF,eAAO,MAAM,wBAAwB,aAMnC,CAAC;AAIH,eAAO,MAAM,wBAAwB,aAMnC,CAAC;AAIH,eAAO,MAAM,qBAAqB,UAOjC,CAAC;AAKF,eAAO,MAAM,0BAA0B,aAKrC,CAAC;AAIH,eAAO,MAAM,8BAA8B,UAQ1C,CAAC;AAEF,sDAAsD;AACtD,eAAO,MAAM,qBAAqB,aAShC,CAAC;AAIH,eAAO,MAAM,qBAAqB,UAoBjC,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,wBAAwB,aAuBnC,CAAC;AAGH,eAAO,MAAM,mBAAmB,UAY/B,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,gCAIrC,CAAC;AAEH,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,aAQjC,CAAC;AAgBH,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,oBAE/B,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,oBAE7B,CAAC;AAEF,yCAAyC;AACzC,eAAO,MAAM,2BAA2B,uBAkDvC,CAAC;AAEF,iCAAiC;AACjC,eAAO,MAAM,kBAAkB,uBAgB9B,CAAC;AAEF,kDAAkD;AAClD,eAAO,MAAM,kBAAkB,uBAY9B,CAAC;AAEF,+CAA+C;AAC/C,eAAO,MAAM,sBAAsB,uBAalC,CAAC;AAEF,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB,uBAE5B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;EAkFtC,CAAC;AAEH,0CAA0C;AAC1C,eAAO,MAAM,iBAAiB,uBAiB7B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,oBAAoB;;;;;;EAM/B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB;;;;;;EAMpC,CAAC;AAEH,4EAA4E;AAC5E,eAAO,MAAM,iCAAiC;;;;;;EAM5C,CAAC"}

package/types/lib/inventory/deps.d.ts

@@ -16,14 +16,27 @@ export declare function isDocumentationJar(jarName: string): boolean;
  */
 export declare function collectMvnDependencies(mavenCmd: string, basePath: string, cleanup?: boolean, includeCacheDir?: boolean): Promise<{}>;
 /**
- * Method to collect class names from all jars in a directory
+ * Method to collect class names from all jars and Android libraries in a
+ * directory
  *
- * @param {string} jarPath Path containing jars
+ * @param {string} jarPath Path containing jars, or a single jar or aar file
  * @param {object} pomPathMap Map containing jar to pom names. Required to successfully parse gradle cache.
  *
  * @return object containing jar name and class list
  */
 export declare function collectJarNS(jarPath: string, pomPathMap?: object): Promise<{}>;
+/**
+ * The jar namespace map entries of components a jar scan produced, in the
+ * shape {@link collectJarNS} writes (`{ namespaces: string[] }`), from their
+ * `internal:Namespaces` properties. The scan reads each jar from a temporary
+ * copy, so no `jarFile` is recorded. Purls `existing` already maps keep the
+ * entry they have, which names the jar it was read from.
+ *
+ * @param {Object[]} components Components with `internal:Namespaces` properties
+ * @param {Object} [existing] Jar namespace map already collected
+ * @returns {Object} New entries keyed by purl
+ */
+export declare function namespaceMappingOfComponents(components: Object[], existing?: Object): Object;
 /**
  * Convert a JAR namespace mapping (produced by {@link collectJarNS}) into an array
  * of CycloneDX package component objects.
@@ -174,6 +187,26 @@ export declare function readZipEntriesMatching(zipFile: string, pathFragment: st
  * @returns List of classes and sources matching certain known patterns
  */
 export declare function getJarClasses(jarFile: string): Promise<any>;
+/**
+ * Method to get the classes of an Android library. An `.aar` keeps its code
+ * in `classes.jar` at its root and any number of further jars under `libs/`,
+ * each of which is read in turn.
+ *
+ * Each inner jar is unpacked to a temporary file, so in dry run mode, which
+ * blocks those writes, an aar yields no classes. An inner jar that declares
+ * more than `maxInnerJarBytes` uncompressed is skipped without being
+ * decompressed, because the whole entry is held in memory while it is copied.
+ *
+ * @param {string} aarFile Aar file to read
+ * @param {Object} [opts] Options
+ * @param {number} [opts.maxInnerJarBytes] Uncompressed size bound for each
+ *   inner jar. Defaults to 256 MiB.
+ *
+ * @returns {Promise<string[]>} Sorted class names of every jar inside
+ */
+export declare function getAarClasses(aarFile: string, { maxInnerJarBytes }?: {
+    maxInnerJarBytes?: number;
+}): Promise<string[]>;
 /**
  * Recursively flatten a Python package's transitive dependencies into the
  * dependencies map and flat package list.

package/types/lib/inventory/deps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deps.d.ts","sourceRoot":"","sources":["../../../lib/inventory/deps.js"],"names":[],"mappings":"AAgCA;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B,OAAO,CAInB;AA0DD;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAPC,MAOD,EACR,QAAQ,EAPC,MAOD,EACR,OAAO,GANE,OAMK,EACd,eAAe,GANN,OAMc,eA2ExB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAL/B,MAK+B,EAAE,UAAU,GAJ3C,MAIgD,eA4I1D;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,YAAY,EAH9C,MAG8C,GAF5C,OAAO,CAAC,MAAM,EAAE,CAAC,CAgE7B;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,UAAU,KAAA,GAFzB,MAAM,CAkClB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAHjC,MAGiC,GAF/B,MAAM,CA0BlB;AAgBD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,GAH1C,MAG+C,GAF7C,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAJ7B,MAI6B,EAAE,IAAI,EAHnC,MAGmC,GAFjC,MAAM,CAqBlB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAHrC,MAGqC,GAFnC,MAAM,CAiBlB;AACD;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAL1C,MAK0C,EAAE,OAAO,AAJ3D,CAEA,EAFQ,MAI+D,UAEzE;AAqID;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CA4BpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EALzC,MAKyC,EAAE,OAAO,AAJ1D,CACA,EADQ,MAI8D,GAH5D;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAe3D;AA4BD;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAJ1C,MAI0C,EAAE,WAAW,EAHvD;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAGU,GAFrD,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAAS,CAAC,CAgFlG;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAPE,MAOF,EACP,WAAW,EAPF,MAOE,EACX,eAAe,GAPN,MAOgB,GALd,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA4CrC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EARE,MAQF,EACP,YAAY,EARH,MAQG,EACZ,EAAE,eAAyB,EAAE,aAA+B,EAAE,AAR7D,CAGA,EAFA;IAAsB,eAAe,AAArC,CACA,EADQ,MAAM,CACd;IAAsB,aAAa,AAAnC,CACA,EADQ,MAAM,CACd;CAKkE,GALxD,OAAO,CAAC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,CAAC,CAAC,CAkDxD;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAJhC,MAIgC,gBAqE1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,eAAe,EANhC,MAMgC,EAAE,OAAO,EALzC,MAAM,EAKmC,EAAE,cAAc,EAJzD,MAIyD,EAAE,CAAC,EAH5D,MAG4D,GAF1D,IAAI,CAqDhB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAJtB,MAAM,GAAC,MAIe,EAAE,CAAC,EAHzB,MAAM,GAAC,MAGkB,GAFvB,MAAM,CAWlB"}
+{"version":3,"file":"deps.d.ts","sourceRoot":"","sources":["../../../lib/inventory/deps.js"],"names":[],"mappings":"AA0CA;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B,OAAO,CAInB;AA0DD;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAPC,MAOD,EACR,QAAQ,EAPC,MAOD,EACR,OAAO,GANE,OAMK,EACd,eAAe,GANN,OAMc,eA6ExB;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAL/B,MAK+B,EAAE,UAAU,GAJ3C,MAIgD,eAuJ1D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,UAAU,EAJ5C,MAAM,EAIsC,EAAE,QAAQ,AAH9D,CACA,EADQ,MAG2D,GAFzD,MAAM,CAkBlB;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,YAAY,EAH9C,MAG8C,GAF5C,OAAO,CAAC,MAAM,EAAE,CAAC,CAgE7B;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,UAAU,KAAA,GAFzB,MAAM,CAkClB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAHjC,MAGiC,GAF/B,MAAM,CA0BlB;AAgBD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,GAH1C,MAG+C,GAF7C,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAJ7B,MAI6B,EAAE,IAAI,EAHnC,MAGmC,GAFjC,MAAM,CAqBlB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAHrC,MAGqC,GAFnC,MAAM,CAiBlB;AACD;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAL1C,MAK0C,EAAE,OAAO,AAJ3D,CAEA,EAFQ,MAI+D,UAEzE;AAqID;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CA4BpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EALzC,MAKyC,EAAE,OAAO,AAJ1D,CACA,EADQ,MAI8D,GAH5D;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAe3D;AA4BD;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAJ1C,MAI0C,EAAE,WAAW,EAHvD;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAGU,GAFrD,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAAS,CAAC,CAgFlG;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAPE,MAOF,EACP,WAAW,EAPF,MAOE,EACX,eAAe,GAPN,MAOgB,GALd,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA4CrC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EARE,MAQF,EACP,YAAY,EARH,MAQG,EACZ,EAAE,eAAyB,EAAE,aAA+B,EAAE,AAR7D,CAGA,EAFA;IAAsB,eAAe,AAArC,CACA,EADQ,MAAM,CACd;IAAsB,aAAa,AAAnC,CACA,EADQ,MAAM,CACd;CAKkE,GALxD,OAAO,CAAC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,CAAC,CAAC,CAkDxD;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAJhC,MAIgC,gBAqE1C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,aAAa,CACjC,OAAO,EARE,MAQF,EACP,EAAE,gBAA0C,EAAE,AAR7C,CAIA,EAHA;IAAsB,gBAAgB,AAAtC,CAGA,EAHQ,MAAM,CAGd;CAIkD,GAJxC,OAAO,CAAC,MAAM,EAAE,CAAC,CA0D7B;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,eAAe,EANhC,MAMgC,EAAE,OAAO,EALzC,MAAM,EAKmC,EAAE,cAAc,EAJzD,MAIyD,EAAE,CAAC,EAH5D,MAG4D,GAF1D,IAAI,CAqDhB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAJtB,MAAM,GAAC,MAIe,EAAE,CAAC,EAHzB,MAAM,GAAC,MAGkB,GAFvB,MAAM,CAWlB"}

package/types/lib/inventory/dosai.d.ts

@@ -128,24 +128,59 @@ export declare function dosaiReportFileOmittedSections(reportFile: string): stri
  * @returns {string[]} The ones cdxgen reads
  */
 export declare function dosaiSectionsCdxgenReads(omittedSections: string[]): string[];
+/**
+ * Whether an existing dosai methods slice is newer than the sources it
+ * describes.
+ *
+ * A slice written by an earlier scan holds the occurrences of the sources as
+ * they were then, so a slice that predates an edit must be regenerated rather
+ * than reused: reusing one keeps occurrences of call sites that no longer
+ * exist (issue 4675). The slice is fresh only when its mtime is not older
+ * than the newest mtime among the files dosai analyses under the directory.
+ * A missing slice, a slice whose mtime cannot be read, a source that cannot
+ * be stat-ed, and a tree that exceeds the walk bounds all count as stale: the
+ * callers regenerate the slice, which is the run a fresh scan pays anyway.
+ *
+ * @param {string} slicesFile Candidate dosai methods slice
+ * @param {string} projectDir Directory dosai analyses
+ * @param {Object} [options] Scan options; options.exclude prunes the walk
+ * @returns {boolean} True when the slice is newer than every source it describes
+ */
+export declare function dosaiSlicesFileIsFresh(slicesFile: string, projectDir: string, options?: Object): boolean;
+/**
+ * The largest number of distinct method calls cdxgen keeps from one report.
+ *
+ * Reports in the millions of calls repeat the same call sites heavily, so the
+ * aggregated rows stay far below this; the cap exists so a report whose calls
+ * are all distinct degrades the occurrence evidence instead of the process.
+ *
+ * @returns {number} Cap on distinct kept rows
+ */
+export declare function maxDosaiMethodCalls(): number;
 /**
  * Read a dosai methods report of any size.
  *
  * A report that fits in one JavaScript string is parsed whole. A larger one is
  * read in bounded runs, keeping the requested sections, the CallGraph nodes and
  * edges that PackageReachability references, and the MethodCalls accepted by
- * `keepMethodCall` (none when it is omitted). Nothing cdxgen reads is lost.
+ * `keepMethodCall` (none when it is omitted). A kept MethodCalls row is
+ * reduced to the fields cdxgen reads and aggregated by them, so a call site
+ * reached many times is held once with a `CallCount`; distinct rows past
+ * {@link maxDosaiMethodCalls} are dropped with one warning. Nothing cdxgen
+ * reads is lost.
  *
  * @param {string} reportFile Path to the dosai methods JSON
  * @param {Object} [options] Options
  * @param {string[]} [options.sections] Sections to keep from a large report (default: every section cdxgen reads)
  * @param {Function} [options.keepMethodCall] Predicate choosing the MethodCalls to keep from a large report
+ * @param {number} [options.maxMethodCalls] Cap on distinct kept MethodCalls, for tests
  * @param {number} [options.maxTextBytes] Largest report parsed whole, for tests
  * @returns {Object|undefined} Parsed report, or undefined when missing or invalid
  */
 export declare function readDosaiMethodsReport(reportFile: string, options?: {
     sections?: string[];
     keepMethodCall?: Function;
+    maxMethodCalls?: number;
     maxTextBytes?: number;
 }): Object | undefined;
 /**

package/types/lib/inventory/dosai.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dosai.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dosai.js"],"names":[],"mappings":"AA+KA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,cAAc,EAL1C,MAAM,GAAC,MAKmC,GAJxC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAA;CAAC,GAAC,SAAS,CAmB9E;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,WAAW,AAHrD,CACA,EADQ;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAA;CAGV,GAF3C,MAAM,CAUlB;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,WAAW,AAHrD,CACA,EADQ;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAA;CAGV,GAF3C,MAAM,CAIlB;AAwMD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAJpC,MAAM,EAI8B,EAAE,OAAO,EAH7C,MAG6C,GAF3C;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAC,CAyFtE;AAoDD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAW5B;AAkBD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,IAF/B,MAAM,CAIlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAHjC,MAGiC,GAF/B,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,AAHxC,CACA,EADQ,MAGgC,GAF9B,MAAM,EAAE,CAOpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,EAH9C,MAG8C,GAF5C,MAAM,EAAE,CAapB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,eAAe,EAH7C,MAAM,EAGuC,GAF3C,MAAM,EAAE,CAMpB;AA4DD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAPtC,MAOsC,EAAE,OAAO,AANvD,CAIA,EAHA;IAA2B,QAAQ,AAAnC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,cAAc,AAAzC,CACA,WAAA;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;CAE4D,GAFlD,MAAM,GAAC,SAAS,CA0B5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EALvC,MAKuC,EAAE,OAAO,AAJxD,CAEA,EADA;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;CAE6D,GAFnD,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAH5B,MAG4B,GAF1B,OAAO,CAInB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAH9B,MAG8B,GAF5B,SAAS,GAAC,QAAQ,GAAC,QAAQ,GAAC,SAAS,CAajD;AAeD;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,EAF9C,MAE8C,QAKxD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAGkC,GAFhC,OAAO,CAKnB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAHpC,MAGoC,GAFlC,OAAO,CASnB;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAN5B,MAM4B,EAAE,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAmLnB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,UAAU,EAJ5C,MAI4C,EAAE,OAAO,AAH7D,CACA,EADQ,MAG0D,GAFxD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EALlC,MAKkC,EAAE,UAAU,EAJ9C,MAI8C,EAAE,OAAO,AAH/D,CACA,EADQ,MAG4D,GAF1D,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAe5B;AAiFD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EALnC,MAKmC,EAAE,MAAM,AAJnD,CACA,EADQ,MAI2C,EAAE,iBAAiB,AAHtE,CACA,EADQ,MAG8D,GAF5D,MAAM,EAAE,CAoCpB;AAuDD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,KAAA,EACP,YAAY,KAAA,EACZ,aAAa,KAAA,OAsEd;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,AAJzC,CACA,EADQ,MAAM,EAIgC,EAAE,OAAO,AAHvD,CACA,EADQ,MAGoD,GAFlD,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/B;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAN9B,MAM8B,EAAE,YAAY,EAL5C,GAAG,CAAC,MAAM,EAAE,MAAM,CAK0B,EAAE,QAAQ,AAJ9D,CACA,EADQ,MAIsD,GAHpD,MAAM,GAAC,SAAS,CAK5B;AAwCD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAH7C,MAG6C,EAAE,YAAY,EAF3D,MAE2D,QAyBrE;AAED;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAC5C,YAAY,EARH,MAQG,EACZ,UAAU,AART,CACA,EADQ,MAAM,EAQA,EACf,OAAO,AARN,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAKW,GALD,MAAM,CA4ClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EARH,MAQG,EACZ,UAAU,AART,CACA,EADQ,MAAM,EAQA,EACf,OAAO,AARN,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAKW,GALD,MAAM,CA8FlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,cAAc,EARL,MAQK,EACd,UAAU,AART,CACA,EADQ,MAAM,EAQA,EACf,OAAO,AARN,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAKW,GALD,MAAM,CAwDlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAJ1C,MAI0C,EAAE,UAAU,AAH9D,CACA,OAEmE,SA6FrE;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,YAAY,EAJ/C,MAI+C,EAAE,WAAW,AAHpE,CACA,EADQ,MAGiE,GAF/D,MAAM,CAyKlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC7C,YAAY,EALH,MAKG,EACZ,WAAW,AALV,CACA,EADQ,MAKO,GAJL,MAAM,CA+GlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,AAHjD,CACA,EADQ,MAG8C,GAF5C,MAAM,EAAE,CAmDpB"}
+{"version":3,"file":"dosai.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dosai.js"],"names":[],"mappings":"AAkMA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,cAAc,EAL1C,MAAM,GAAC,MAKmC,GAJxC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAA;CAAC,GAAC,SAAS,CAmB9E;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,WAAW,AAHrD,CACA,EADQ;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAA;CAGV,GAF3C,MAAM,CAUlB;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,WAAW,AAHrD,CACA,EADQ;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAA;CAGV,GAF3C,MAAM,CAIlB;AAwMD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAJpC,MAAM,EAI8B,EAAE,OAAO,EAH7C,MAG6C,GAF3C;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAC,CAyFtE;AAoDD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAW5B;AAkBD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,IAF/B,MAAM,CAIlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAHjC,MAGiC,GAF/B,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,AAHxC,CACA,EADQ,MAGgC,GAF9B,MAAM,EAAE,CAOpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,EAH9C,MAG8C,GAF5C,MAAM,EAAE,CAapB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,eAAe,EAH7C,MAAM,EAGuC,GAF3C,MAAM,EAAE,CAMpB;AAsJD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EALtC,MAKsC,EAAE,UAAU,EAJlD,MAIkD,EAAE,OAAO,AAHnE,CACA,EADQ,MAGgE,GAF9D,OAAO,CA0BnB;AAgCD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,CAWlB;AAmHD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EARtC,MAQsC,EAAE,OAAO,AAPvD,CAKA,EAJA;IAA2B,QAAQ,AAAnC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,cAAc,AAAzC,CACA,WAAA;IAAyB,cAAc,AAAvC,CACA,EADQ,MAAM,CACd;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;CAE4D,GAFlD,MAAM,GAAC,SAAS,CAkD5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EALvC,MAKuC,EAAE,OAAO,AAJxD,CAEA,EADA;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;CAE6D,GAFnD,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAH5B,MAG4B,GAF1B,OAAO,CAInB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAH9B,MAG8B,GAF5B,SAAS,GAAC,QAAQ,GAAC,QAAQ,GAAC,SAAS,CAajD;AAeD;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,EAF9C,MAE8C,QAKxD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAGkC,GAFhC,OAAO,CAKnB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAHpC,MAGoC,GAFlC,OAAO,CASnB;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAN5B,MAM4B,EAAE,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAmLnB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,UAAU,EAJ5C,MAI4C,EAAE,OAAO,AAH7D,CACA,EADQ,MAG0D,GAFxD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EALlC,MAKkC,EAAE,UAAU,EAJ9C,MAI8C,EAAE,OAAO,AAH/D,CACA,EADQ,MAG4D,GAF1D,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAe5B;AAiFD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EALnC,MAKmC,EAAE,MAAM,AAJnD,CACA,EADQ,MAI2C,EAAE,iBAAiB,AAHtE,CACA,EADQ,MAG8D,GAF5D,MAAM,EAAE,CAoCpB;AAuDD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,KAAA,EACP,YAAY,KAAA,EACZ,aAAa,KAAA,OAsEd;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,AAJzC,CACA,EADQ,MAAM,EAIgC,EAAE,OAAO,AAHvD,CACA,EADQ,MAGoD,GAFlD,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/B;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAN9B,MAM8B,EAAE,YAAY,EAL5C,GAAG,CAAC,MAAM,EAAE,MAAM,CAK0B,EAAE,QAAQ,AAJ9D,CACA,EADQ,MAIsD,GAHpD,MAAM,GAAC,SAAS,CAK5B;AAwCD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAH7C,MAG6C,EAAE,YAAY,EAF3D,MAE2D,QAyBrE;AAED;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAC5C,YAAY,EARH,MAQG,EACZ,UAAU,AART,CACA,EADQ,MAAM,EAQA,EACf,OAAO,AARN,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAKW,GALD,MAAM,CA4ClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EARH,MAQG,EACZ,UAAU,AART,CACA,EADQ,MAAM,EAQA,EACf,OAAO,AARN,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAKW,GALD,MAAM,CA8FlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,cAAc,EARL,MAQK,EACd,UAAU,AART,CACA,EADQ,MAAM,EAQA,EACf,OAAO,AARN,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAKW,GALD,MAAM,CAwDlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAJ1C,MAI0C,EAAE,UAAU,AAH9D,CACA,OAEmE,SAqHrE;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,YAAY,EAJ/C,MAI+C,EAAE,WAAW,AAHpE,CACA,EADQ,MAGiE,GAF/D,MAAM,CAyKlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC7C,YAAY,EALH,MAKG,EACZ,WAAW,AALV,CACA,EADQ,MAKO,GAJL,MAAM,CA+GlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,AAHjD,CACA,EADQ,MAG8C,GAF5C,MAAM,EAAE,CAmDpB"}

package/types/lib/inventory/dosaiParsers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dosaiParsers.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dosaiParsers.js"],"names":[],"mappings":"AAeA;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,GAAG,EAJ9B,MAI8B,EAAE,KAAK,EAHrC,MAGqC,GAFnC,IAAI,CAQhB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAHvB,MAGuB,GAFrB,MAAM,GAAC,SAAS,CAc5B;AAcD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAJrC,MAIqC,EAAE,OAAO,AAHtD,CACA,EADQ,MAG8C,GAF5C,MAAM,GAAC,SAAS,CAU5B;AA8BD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAa5B;AAiHD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,AAN9C,CACA,EADQ,MAAM,EAMqC,EAAE,OAAO,AAL5D,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAEiE,GAFvD,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAqC/B;AAsCD;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EALvC,QAAQ,CAAC,MAAM,CAKwB,EAAE,YAAY,EAJrD,GAAG,CAAC,MAAM,EAAE,MAAM,CAImC,EAAE,QAAQ,AAHvE,CACA,EADQ,MAG+D,GAF7D,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EANnC,MAMmC,EAAE,YAAY,EALjD,GAAG,CAAC,MAAM,EAAE,MAAM,CAK+B,EAAE,QAAQ,AAJnE,CACA,EADQ,MAI2D,GAHzD,MAAM,GAAC,SAAS,CA6B5B"}
+{"version":3,"file":"dosaiParsers.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dosaiParsers.js"],"names":[],"mappings":"AAgBA;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,GAAG,EAJ9B,MAI8B,EAAE,KAAK,EAHrC,MAGqC,GAFnC,IAAI,CAQhB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAHvB,MAGuB,GAFrB,MAAM,GAAC,SAAS,CAW5B;AAcD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAJrC,MAIqC,EAAE,OAAO,AAHtD,CACA,EADQ,MAG8C,GAF5C,MAAM,GAAC,SAAS,CAS5B;AA8BD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAa5B;AAiHD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,AAN9C,CACA,EADQ,MAAM,EAMqC,EAAE,OAAO,AAL5D,CAGA,EAFA;IAAyB,OAAO,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAEiE,GAFvD,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAqC/B;AAsCD;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EALvC,QAAQ,CAAC,MAAM,CAKwB,EAAE,YAAY,EAJrD,GAAG,CAAC,MAAM,EAAE,MAAM,CAImC,EAAE,QAAQ,AAHvE,CACA,EADQ,MAG+D,GAF7D,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EANnC,MAMmC,EAAE,YAAY,EALjD,GAAG,CAAC,MAAM,EAAE,MAAM,CAK+B,EAAE,QAAQ,AAJnE,CACA,EADQ,MAI2D,GAHzD,MAAM,GAAC,SAAS,CA6B5B"}

package/types/lib/inventory/dotnetRuntime.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Read the runtime pack a shared framework's deps.json was built from.
+ *
+ * @param {Object} depsJson parsed <framework>.deps.json
+ * @param {string} framework framework directory name
+ * @returns {{pack: string, version: string, rid: string}|undefined}
+ */
+export declare function runtimePackFromDepsJson(depsJson: Object, framework: string): {
+    pack: string;
+    version: string;
+    rid: string;
+} | undefined;
+/**
+ * The CPE NVD uses for a shared framework version, with the version and update
+ * fields spelled the way the NVD CPE dictionary spells them.
+ *
+ * The product is `.net` from 5.0 on, `.net_core` before it, and `asp.net_core`
+ * for ASP.NET Core. NVD names a .NET Core x.y.0 release and its pre-releases
+ * with two version parts (`.net_core:3.1`, `.net_core:3.0:preview9`), and the
+ * .NET 5.0 pre-releases the same way (`.net:5.0:rc1`); every other version
+ * keeps three. A release candidate is `rc<N>`, and a preview is
+ * `preview.<N>` for .NET 7, 8 and 10 and `preview<N>` otherwise. A release
+ * keeps the `*` update, which is the only one NVD lists for some releases. A
+ * pre-release of any other kind names no version NVD has, so it gets no CPE.
+ *
+ * @param {string} framework framework directory name
+ * @param {string} version runtime version
+ * @returns {string|undefined} CPE 2.3 string
+ */
+export declare function dotnetCpe(framework: string, version: string): string | undefined;
+/**
+ * Create the platform component for one installed shared framework.
+ *
+ * @param {string} framework framework directory name
+ * @param {{pack: string, version: string, rid: string}} runtime runtime pack
+ * @param {string} [location] root-relative path of the deps.json. A runtime
+ *   found on the scanning host gets none, since host paths can name the user's
+ *   home directory.
+ * @returns {Object|undefined} component, or undefined when no purl can be built
+ */
+export declare function createDotnetRuntimeComponent(framework: string, runtime: {
+    pack: string;
+    version: string;
+    rid: string;
+}, location?: string): Object | undefined;
+/**
+ * Parse the output of `dotnet --list-runtimes`, one `<framework> <version>
+ * [<directory>]` line per installed runtime. Warnings, update notices, blank
+ * lines, unknown frameworks and versions of a shape no runtime pack names are
+ * left out, and no more than MAX_FRAMEWORKS runtimes are kept.
+ *
+ * https://learn.microsoft.com/dotnet/core/install/how-to-detect-installed-versions
+ *
+ * @param {string} output output of `dotnet --list-runtimes`
+ * @returns {{framework: string, version: string, frameworkDir: string}[]} one
+ *   entry per installed runtime
+ */
+export declare function parseDotnetListRuntimes(output: string): {
+    framework: string;
+    version: string;
+    frameworkDir: string;
+}[];
+/**
+ * Create the platform component for one runtime the host install reports.
+ *
+ * The identity comes from the deps.json in the runtime's own directory, read
+ * with the directory as the root so the read cannot leave it and a symlink is
+ * not followed. Only an absolute directory is read, which is what the dotnet
+ * host prints. A runtime whose deps.json is missing, unreadable or names
+ * another version keeps its name, its version and its CPE, without a purl:
+ * without the runtime identifier of the pack there is no correct nuget purl.
+ *
+ * @param {{framework: string, version: string, frameworkDir: string}} entry
+ *   one entry of parseDotnetListRuntimes
+ * @returns {Object} platform component
+ */
+export declare function createHostDotnetRuntimeComponent(entry: {
+    framework: string;
+    version: string;
+    frameworkDir: string;
+}): Object;
+/**
+ * Find the .NET shared frameworks installed under a root that no package
+ * manager owns, and return one platform component per runtime pack.
+ *
+ * @param {string} rootDir extracted root file system
+ * @param {string[]} [ownedPaths] root-relative paths a package database owns
+ * @returns {Object[]} platform components
+ */
+export declare function collectDotnetRuntimes(rootDir: string, ownedPaths?: string[]): Object[];
+//# sourceMappingURL=dotnetRuntime.d.ts.map

package/types/lib/inventory/dotnetRuntime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dotnetRuntime.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dotnetRuntime.js"],"names":[],"mappings":"AAsEA;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAJrC,MAIqC,EAAE,SAAS,EAHhD,MAGgD,GAF9C;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAuBlE;AA0BD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAJxB,MAIwB,EAAE,OAAO,EAHjC,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAmC5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,EAP3C,MAO2C,EAAE,OAAO,EANpD;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAMS,EAAE,QAAQ,AALtE,CAGA,EAHQ,MAK8D,GAF5D,MAAM,GAAC,SAAS,CA8B5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAJnC,MAImC,GAHjC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAC,EAAE,CAiCxE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,EAJ3C;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAId,GAFzC,MAAM,CA8BlB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAJlC,MAIkC,EAAE,UAAU,AAHtD,CACA,EADQ,MAAM,EAG6C,GAFjD,MAAM,EAAE,CAwDpB"}

package/types/lib/inventory/ecosystemFormulationParsers.d.ts

@@ -0,0 +1,73 @@
+export declare const MAX_READ_BYTES: number;
+export declare const MAX_ASSETS_READ_BYTES: number;
+/**
+ * The path of a build input relative to the scanned project root, with
+ * forward slashes, as recorded in bom-refs and `internal:SrcFile`. A file
+ * outside the root, or a call without a root, records only its file name,
+ * so no path of the scanning machine reaches the BOM.
+ *
+ * @param {string} filePath file the component describes
+ * @param {string} [rootDir] scanned project root
+ * @returns {string} project-relative path, or the file name
+ */
+export declare function formulationSourcePath(filePath: string, rootDir?: string): string;
+/**
+ * Parser for make and CMake build inputs (C/C++ and friends).
+ *
+ * @type {{id: string, patterns: string[], parse(files: string[], options?: Object, context?: {rootDir?: string}): {components: Object[]}}}
+ */
+export declare const makefileFormulationParser: {
+    id: string;
+    patterns: string[];
+    parse(files: string[], options?: Object, context?: {
+        rootDir?: string;
+    }): {
+        components: Object[];
+    };
+};
+/**
+ * Parser for go.mod build inputs. The compiled binaries are read by the
+ * binary/OBOM path through the bounded Go buildinfo reader, not here.
+ *
+ * @type {{id: string, patterns: string[], parse(files: string[], options?: Object, context?: {rootDir?: string}): {components: Object[]}}}
+ */
+export declare const goModuleFormulationParser: {
+    id: string;
+    patterns: string[];
+    parse(files: string[], options?: Object, context?: {
+        rootDir?: string;
+    }): {
+        components: Object[];
+    };
+};
+/**
+ * Parser for pip requirements and constraints files.
+ *
+ * @type {{id: string, patterns: string[], parse(files: string[], options?: Object, context?: {rootDir?: string}): {components: Object[]}}}
+ */
+export declare const pythonRequirementsFormulationParser: {
+    id: string;
+    patterns: string[];
+    parse(files: string[], options?: Object, context?: {
+        rootDir?: string;
+    }): {
+        components: Object[];
+    };
+};
+/**
+ * Parser for .NET build inputs: project.assets.json (the file `dotnet
+ * restore` writes; some projects call it packages.assets.json) and the
+ * SDK-style .csproj project files.
+ *
+ * @type {{id: string, patterns: string[], parse(files: string[], options?: Object, context?: {rootDir?: string}): {components: Object[]}}}
+ */
+export declare const dotnetProjectFormulationParser: {
+    id: string;
+    patterns: string[];
+    parse(files: string[], options?: Object, context?: {
+        rootDir?: string;
+    }): {
+        components: Object[];
+    };
+};
+//# sourceMappingURL=ecosystemFormulationParsers.d.ts.map

package/types/lib/inventory/ecosystemFormulationParsers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecosystemFormulationParsers.d.ts","sourceRoot":"","sources":["../../../lib/inventory/ecosystemFormulationParsers.js"],"names":[],"mappings":"AAiBA,eAAO,MAAM,cAAc,QAAkB,CAAC;AAI9C,eAAO,MAAM,qBAAqB,QAAmB,CAAC;AAOtD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAJnC,MAImC,EAAE,OAAO,AAHpD,CACA,EADQ,MAG4C,GAF1C,MAAM,CAalB;AA2gBD;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAF5B;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAC,GAAG;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAC,CAAA;CAwBxI,CAAC;AA+FF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAF5B;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAC,GAAG;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAC,CAAA;CAexI,CAAC;AAmIF;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,EAFtC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAC,GAAG;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAC,CAAA;CAoBxI,CAAC;AAoFF;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,EAFjC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAC,GAAG;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAC,CAAA;CAsBxI,CAAC"}