@cdxgen/cdxgen 13.5.0 → 13.7.0

package/types/lib/inventory/nodeBuildInfo.d.ts

@@ -0,0 +1,95 @@
+/**
+ * The most node-named files one scan opens in search of a build version.
+ *
+ * @type {number}
+ */
+export declare const MAX_NODE_PROBES: number;
+/**
+ * Whether a file name is one the Node.js runtime is installed under.
+ *
+ * @param {string} fileName basename or path of the candidate
+ * @returns {boolean} true for `node`, `nodejs` and `node.exe`
+ */
+export declare function isNodeBinaryName(fileName: string): boolean;
+/**
+ * Parse a Node.js version in the grammar the release tooling produces:
+ * `24.22.1`, `25.0.0-rc.1`, `26.0.0-nightly20260301abcdef`.
+ *
+ * @param {string} text candidate version, without the leading `v`
+ * @returns {string|undefined} the version, or undefined
+ */
+export declare function parseNodeVersion(text: string): string | undefined;
+/**
+ * Read the Node.js version a `node` binary was built as.
+ *
+ * @param {string} absPath absolute path of the binary
+ * @param {string|undefined} rootDir extracted root, when the file came from one
+ * @returns {{version: string, source: string, channel?: string}|undefined}
+ *   source is `release-url` or `binary`
+ */
+export declare function readNodeBuildVersion(absPath: string, rootDir: string | undefined): {
+    version: string;
+    source: string;
+    channel?: string;
+} | undefined;
+/**
+ * The CPE that lets a downstream scanner match a Node.js version. NVD names the
+ * product node.js and keeps a pre-release in the update field.
+ *
+ * @param {string} version Node.js version
+ * @returns {string} CPE 2.3 string
+ */
+export declare function nodeCpe(version: string): string;
+/**
+ * A Node.js runtime is one `platform` component per distinct version, like the
+ * PHP and Go stdlib components. Its identity is `pkg:generic/node`: it is only
+ * used where no package manager owns the runtime.
+ *
+ * @param {string} version Node.js version
+ * @returns {Object} component with `purl`, `bom-ref` and `cpe`
+ */
+export declare function createNodeRuntimeComponent(version: string): Object;
+/**
+ * The properties a node file component carries once its build is known.
+ *
+ * @param {{version: string, source: string, channel?: string}} build result of readNodeBuildVersion
+ * @returns {{name: string, value: string}[]} properties to append
+ */
+export declare function nodeBuildProperties(build: {
+    version: string;
+    source: string;
+    channel?: string;
+}): {
+    name: string;
+    value: string;
+}[];
+/**
+ * Start collecting the runtime components and edges of one scan.
+ *
+ * @returns {{runtimeComponents: Object[], dependencies: Object[], runtimeRefs: Set<string>}}
+ */
+export declare function createNodeRuntimeInventory(): {
+    runtimeComponents: Object[];
+    dependencies: Object[];
+    runtimeRefs: Set<string>;
+};
+/**
+ * Tag a node file component with its build facts and link it to the runtime
+ * component of its version, creating that component on first use. Mutates the
+ * component in place.
+ *
+ * @param {{runtimeComponents: Object[], dependencies: Object[], runtimeRefs: Set<string>}} inventory
+ *   accumulator from createNodeRuntimeInventory
+ * @param {Object} component file component, with a `properties` array
+ * @param {{version: string, source: string, channel?: string}} build result of readNodeBuildVersion
+ */
+export declare function attachNodeBuild(inventory: {
+    runtimeComponents: Object[];
+    dependencies: Object[];
+    runtimeRefs: Set<string>;
+}, component: Object, build: {
+    version: string;
+    source: string;
+    channel?: string;
+}): void;
+//# sourceMappingURL=nodeBuildInfo.d.ts.map

package/types/lib/inventory/nodeBuildInfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nodeBuildInfo.d.ts","sourceRoot":"","sources":["../../../lib/inventory/nodeBuildInfo.js"],"names":[],"mappings":"AAgCA;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAFlB,MAEuB,CAAC;AAElC;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAH9B,MAG8B,GAF5B,OAAO,CAQnB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAH1B,MAG0B,GAFxB,MAAM,GAAC,SAAS,CAO5B;AA6BD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EALjC,MAKiC,EAAE,OAAO,EAJ1C,MAAM,GAAC,SAImC,GAHxC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CA+BzE;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAHpB,MAGoB,GAFlB,MAAM,CASlB;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAHvC,MAGuC,GAFrC,MAAM,CAOlB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAH9B;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAGpB,GAF5B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAW3C;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAF7B;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAC,CAI3F;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAL9B;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAKhD,EAAE,SAAS,EAHzC,MAGyC,EAAE,KAAK,EAFhD;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAEF,QAkB1D"}

package/types/lib/inventory/nodeHostProbe.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Look for Node.js no package manager owns on the host. Components come back
+ * only for the files nothing owns: a `file` component for each `node` binary
+ * with the cdx:node and cdx:brotli properties, one `platform` component per
+ * Node.js version with its CPE, and the brotli component when a binary embeds
+ * a decoder.
+ *
+ * @param {Object} [options] probe options, as probeHostPhp takes them
+ * @returns {{components: Object[], dependencies: Object[]}}
+ */
+export declare function probeHostNode(options?: Object): {
+    components: Object[];
+    dependencies: Object[];
+};
+//# sourceMappingURL=nodeHostProbe.d.ts.map

package/types/lib/inventory/nodeHostProbe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nodeHostProbe.d.ts","sourceRoot":"","sources":["../../../lib/inventory/nodeHostProbe.js"],"names":[],"mappings":"AA2JA;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,OAAO,AAHlC,CACA,EADQ,MAG+B,GAF7B;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAsC1D"}

package/types/lib/inventory/occurrenceKey.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The key of a place in a purl's occurrence set (`purlLocationMap`).
+ *
+ * Every location that enters an occurrence set is keyed by this function,
+ * whatever evidence source added it: the seeding from the input BOM
+ * (`initFromSbom`), the atom `usages` and `callsites` slices, the golem, rusi,
+ * kosi, dosai and scalasem reports, the C include attribution and the Swift
+ * semantics slices. Backslashes become `/`, so a place spelled with `\` in the
+ * input BOM (Windows cdxgen output) and `/` in a slice is one occurrence, not
+ * two (issue 4726). The path is otherwise left as spelled: no resolving, no
+ * case folding, no stripping of a leading `./`.
+ *
+ * A place a line already names is keyed `file#line`; a place a callsites
+ * record names down to its column (counted from 0, as atom writes it) is keyed
+ * `file:line:offset`, so two use
+ * sites on one line are two occurrences. An occurrence with only `location`
+ * and `line` names the line as a whole: it is the same place as any use site
+ * that line carries, and it is kept as an occurrence of its own only while no
+ * `file:line:offset` key of that line exists (the writer drops the line-only
+ * key then, see `dropSubsumedOccurrenceKeys`). That rule is what keeps a
+ * re-run of evinse over its own output at the same occurrences: the first run
+ * writes the `file:line:offset` keys, and the second run seeds and re-adds
+ * exactly those.
+ *
+ * @param {string} location File path or other location text
+ * @param {number} [line] Line number; not a positive number means the location names no line
+ * @param {number} [offset] Column within the line, counted from 0 as atom writes it; a value that is not an integer of 0 or more (atom writes -1 for an unknown column) means the place is the line
+ * @returns {string|undefined} Key in the `file:line:offset`, `file#line` or plain `file` shape; undefined when the location is empty
+ */
+export declare function occurrenceLocationKey(location: string, line?: number, offset?: number): string | undefined;
+/**
+ * Drop the occurrence keys a use-site key subsumes.
+ *
+ * A `file:line:offset` key names a use site on a line; the line-only
+ * `file#line` key of the same line names no place of its own any more, so it
+ * is removed rather than counted beside the use sites (issue 4726: an
+ * occurrence seeded from an input BOM with only `location` and `line` is the
+ * same place as a callsites occurrence at that line).
+ *
+ * @param {string[]} keys Occurrence-set keys
+ * @returns {string[]} The keys without the subsumed line-only entries
+ */
+export declare function dropSubsumedOccurrenceKeys(keys: string[]): string[];
+/**
+ * The location part of an occurrence-set key: `src/a.js` for `src/a.js#3`,
+ * `src/a.js:3:14` and `src/a.js` alike.
+ *
+ * @param {string} key Key made by `occurrenceLocationKey`
+ * @returns {string} The location the key names
+ */
+export declare function occurrenceKeyLocation(key: string): string;
+//# sourceMappingURL=occurrenceKey.d.ts.map

package/types/lib/inventory/occurrenceKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"occurrenceKey.d.ts","sourceRoot":"","sources":["../../../lib/inventory/occurrenceKey.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EALnC,MAKmC,EAAE,IAAI,AAJjD,CACA,EADQ,MAIyC,EAAE,MAAM,AAHzD,CACA,EADQ,MAGiD,GAF/C,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAHpC,MAAM,EAG8B,GAFlC,MAAM,EAAE,CAiBpB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAH9B,MAG8B,GAF5B,MAAM,CAalB"}

package/types/lib/inventory/osPackageResolver.d.ts

@@ -50,4 +50,42 @@ export declare function collectExecutables(basePath: any, binPaths: any, exclude
  * @return {Array[String]} List of executables
  */
 export declare function collectSharedLibs(basePath: any, libPaths: any, ldConf: string, ldConfDirPattern: string, excludePaths?: any, extraLibGlobs?: any): any;
+/**
+ * The most native extension candidates one scan returns.
+ *
+ * @type {number}
+ */
+export declare const MAX_NATIVE_EXTENSIONS: number;
+/**
+ * Collect native extension modules under a root file system that the library
+ * collector does not see, leaving out paths a package database owns and paths
+ * already collected. Symlinks are not followed, so a link pointing out of the
+ * root is never listed.
+ *
+ * @param {string} basePath extracted root file system
+ * @param {string[]} [excludePaths] root-relative paths to leave out
+ * @returns {string[]} root-relative paths, sorted, capped at MAX_NATIVE_EXTENSIONS
+ */
+export declare function collectNativeExtensions(basePath: string, excludePaths?: string[]): string[];
+/**
+ * Mark language packages that an OS package installed. Alpine's py3-brotli
+ * ships a Brotli-1.1.0.dist-info that a Python scan reports as
+ * pkg:pypi/brotli@1.1.0, but a distro fixes it by backporting under the same
+ * upstream version, so a PyPI advisory range keeps matching after the fix. The
+ * `cdx:os:installedBy` property names the OS package that owns the
+ * installation record, so a consumer can judge the component by that package
+ * instead.
+ *
+ * A component is marked only when every installation record it was read from
+ * belongs to an OS package: a copy that pip put in a virtual environment
+ * beside the distro's is not the distro's to fix. Run it after duplicates
+ * merge, so that a merged component carries all of its records.
+ *
+ * @param {Object[]} components BOM components, mutated in place
+ * @param {Map<string, string>|undefined} ownerByPath root-relative file path to
+ *   owning OS package bom-ref
+ * @param {string} [rootDir] extracted root, stripped from absolute source paths
+ * @returns {number} how many components were marked
+ */
+export declare function markOsInstalledLanguagePackages(components: Object[], ownerByPath: Map<string, string> | undefined, rootDir?: string): number;
 //# sourceMappingURL=osPackageResolver.d.ts.map

package/types/lib/inventory/osPackageResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"osPackageResolver.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osPackageResolver.js"],"names":[],"mappings":"AAwBA;;GAEG;AACH,wBAAgB,iBAAiB,SAGhC;AAsDD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA8BnH;AAuGD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAJ9B,MAI8B,EAAE,UAAU,EAH1C,MAAM,EAGoC,GAFxC,MAAM,GAAC,SAAS,CA+B5B;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,KAAA,EAAE,QAAQ,KAAA,EAAE,YAAY,MAAK,OAqEvE;AAcD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,KAAA,EACR,QAAQ,KAAA,EACR,MAAM,QAAA,EACN,gBAAgB,QAAA,EAChB,YAAY,MAAK,EACjB,aAAa,MAAK,OAiGnB"}
+{"version":3,"file":"osPackageResolver.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osPackageResolver.js"],"names":[],"mappings":"AAwBA;;GAEG;AACH,wBAAgB,iBAAiB,SAGhC;AAsDD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA8BnH;AAuGD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAJ9B,MAI8B,EAAE,UAAU,EAH1C,MAAM,EAGoC,GAFxC,MAAM,GAAC,SAAS,CA+B5B;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,KAAA,EAAE,QAAQ,KAAA,EAAE,YAAY,MAAK,OAqEvE;AAcD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,KAAA,EACR,QAAQ,KAAA,EACR,MAAM,QAAA,EACN,gBAAgB,QAAA,EAChB,YAAY,MAAK,EACjB,aAAa,MAAK,OAiGnB;AAkDD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAFxB,MAE+B,CAAC;AAE1C;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAJrC,MAIqC,EAAE,YAAY,AAH3D,CACA,EADQ,MAAM,EAGkD,GAFtD,MAAM,EAAE,CA8BpB;AAqCD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,+BAA+B,CAC7C,UAAU,EAPD,MAAM,EAOL,EACV,WAAW,EAPF,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAC,SAOlB,EACX,OAAO,AANN,CACA,EADQ,MAMF,GALI,MAAM,CAyDlB"}

package/types/lib/inventory/phpBuildInfo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"phpBuildInfo.d.ts","sourceRoot":"","sources":["../../../lib/inventory/phpBuildInfo.js"],"names":[],"mappings":"AA8CA;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAFjB,MAEsB,CAAC;AAUjC;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,GAHvB,MAAM,GAAC,SAAS,CAc5B;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAJjC,MAIiC,GAH/B;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAC,GAAC,SAAS,CAkBhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CAuB5B;AAoBD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,MAAM,GAAC,SAAS,CAa5B;AA6JD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EALhC,MAKgC,EAAE,OAAO,EAJzC,MAAM,GAAC,SAIkC,GAHvC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAwBvD;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,OAAO,EAHnB,MAGmB,GAFjB,MAAM,CAgBlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAPtC,MAOsC,EAAE,EAAE,OAAc,EAAE,AALlE,CAGA,EAFA;IAA0B,OAAO,AAAjC,CAEA,EAFQ,OAAO,CAEf;CAEuE,GAF7D,MAAM,CAWlB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,MAAM,CAIlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAJ7B;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAIH,EAAE,IAAI,EAHnC,MAGmC,GAFjC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAQ3C;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAF5B;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAC,CAI3F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAN7B;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAMjD,EAAE,SAAS,EAJxC,MAIwC,EAAE,KAAK,EAH/C;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAGe,EAAE,IAAI,EAFrD,MAEqD,QAe/D"}
+{"version":3,"file":"phpBuildInfo.d.ts","sourceRoot":"","sources":["../../../lib/inventory/phpBuildInfo.js"],"names":[],"mappings":"AAwCA;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAFjB,MAEsB,CAAC;AAUjC;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,GAHvB,MAAM,GAAC,SAAS,CAc5B;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAJjC,MAIiC,GAH/B;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAC,GAAC,SAAS,CAkBhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CAuB5B;AAoBD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,MAAM,GAAC,SAAS,CAa5B;AAkHD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EALhC,MAKgC,EAAE,OAAO,EAJzC,MAAM,GAAC,SAIkC,GAHvC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAwBvD;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,OAAO,EAHnB,MAGmB,GAFjB,MAAM,CAgBlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAPtC,MAOsC,EAAE,EAAE,OAAc,EAAE,AALlE,CAGA,EAFA;IAA0B,OAAO,AAAjC,CAEA,EAFQ,OAAO,CAEf;CAEuE,GAF7D,MAAM,CAWlB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,MAAM,CAIlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAJ7B;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAIH,EAAE,IAAI,EAHnC,MAGmC,GAFjC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAQ3C;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAF5B;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAC,CAI3F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAN7B;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAMjD,EAAE,SAAS,EAJxC,MAIwC,EAAE,KAAK,EAH/C;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAGe,EAAE,IAAI,EAFrD,MAEqD,QAe/D"}

package/types/lib/inventory/phpHostProbe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"phpHostProbe.d.ts","sourceRoot":"","sources":["../../../lib/inventory/phpHostProbe.js"],"names":[],"mappings":"AAmjBA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAAC,OAAO,AAfjC,CAQA,EAPA;IAAyB,QAAQ,AAAjC,CAEA,EAFQ,MAAM,CAEd;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;IAAyB,GAAG,AAA5B,CAEA,EAFQ,MAAM,CAEd;IAA6G,gBAAgB,AAA7H,CAEA,EAFQ;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;KAAC,CAElG;CAOsC,GAF5B;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CA0D1D"}
+{"version":3,"file":"phpHostProbe.d.ts","sourceRoot":"","sources":["../../../lib/inventory/phpHostProbe.js"],"names":[],"mappings":"AAqIA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAAC,OAAO,AAfjC,CAQA,EAPA;IAAyB,QAAQ,AAAjC,CAEA,EAFQ,MAAM,CAEd;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;IAAyB,GAAG,AAA5B,CAEA,EAFQ,MAAM,CAEd;IAA6G,gBAAgB,AAA7H,CAEA,EAFQ;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;KAAC,CAElG;CAOsC,GAF5B;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAgC1D"}

package/types/lib/inventory/pqcMigration.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Post-quantum migration risk for cryptographic assets (cdxgen/cdxgen#4592).
+ *
+ * The facts come from data/pqc-migration.json: the classes of NIST IR 8547
+ * (final, October 2026) Tables 2, 4 and 8 and section 4.1.3, plus FIPS 186-5
+ * for DSA, each with its members (algorithm families, OIDs and normalised
+ * names), the transition the source states and the rationale text. This
+ * module classifies a component and builds the risk entry; it adds no fact of
+ * its own.
+ *
+ * Classification of an algorithm asset (cryptoProperties.assetType
+ * `algorithm`), first match wins. A hybrid combiner (primitive `combiner`) is
+ * not classified: IR 8547 section 3.2.1 approves a composite scheme with one
+ * approved input, so the OID of one input does not decide it.
+ *
+ * 1. `algorithmProperties.algorithmFamily`. A quantum-safe family (SHA-2,
+ *    SHA-3, AES, ML-KEM, …) is safe, except its 112-bit members (SHA-224,
+ *    SHA-512/224, SHA3-224), which are recognised by OID or name.
+ * 2. `cryptoProperties.oid` (rsaEncryption, id-ecPublicKey, the RSA, ECDSA,
+ *    EdDSA and DSA signature OIDs, X25519/X448, DH, …).
+ * 3. The component name, lower case with only letters and digits kept
+ *    ("SHA-512/224" is `sha512224`), then resolveAlgorithmFamily(name). A
+ *    name that resolves to a hash family but names a DSA, RSA or ECDSA
+ *    signature ("SHA256withDSA", "dsa-with-sha256", "RSA-SHA-512") is that
+ *    signature algorithm, not its digest.
+ *
+ * A class whose members have a key family (rsa, ff, ec) is checked against
+ * the minimum key size of IR 8547 Tables 2 and 4 (112 bits of classical
+ * strength: RSA and finite-field 2048, elliptic curve 224). An algorithm with
+ * a known smaller key, and a public or private key asset
+ * (`related-crypto-material`) whose size is smaller, is classed
+ * `below-minimum-strength` instead. The key size of an algorithm comes from
+ * the first of these that gives a plausible key size (at least 512 for rsa
+ * and ff, 160 to 571 for ec): a trailing number in its name ("RSA-1024")
+ * unless it follows a hash token ("RSASSA-PSS-SHA-512",
+ * "sha512WithRSAEncryption-512"), an RFC 7919 group name ("ffdhe2048"), its
+ * `parameterSetIdentifier` (a digest size such as "256" on an RSA signature
+ * is not a key size) or the bit size in its curve name. A key asset is
+ * checked with its own size against the base class of its algorithm, so a
+ * 4096-bit key of an algorithm named "RSA-1024" is not reported again.
+ *
+ * The likelihood and impact levels are the fixed per-class rating the data
+ * file records. No confidence is emitted (the rating is not a measurement)
+ * and no organisational fact is invented: no owner, status or responses.
+ */
+/** Prefix of every risk refId this module derives. */
+export declare const PQC_RISK_REF_ID_PREFIX = "risk-pqc-";
+/**
+ * A name in lower case with only ASCII letters and digits kept, the form the
+ * `names` tables of data/pqc-migration.json use.
+ *
+ * @param {string} name Algorithm or key name
+ * @returns {string} The compact name, empty for no name
+ */
+export declare function compactAlgorithmName(name: string): string;
+/**
+ * Classify one cryptographic-asset component. Algorithm assets get their
+ * IR 8547 class; key assets are classified only when their size is below the
+ * IR 8547 minimum (the algorithm asset carries the quantum risk).
+ *
+ * @param {object} component A component with cryptoProperties
+ * @param {Map<string, object>} [algorithmsByRef] Components by bom-ref, to
+ *   resolve a key's `algorithmRef`
+ * @returns {{className: string, keyFamily?: string, keySize?: number, minimumKeySize?: number}|undefined}
+ *   The class, or undefined when the asset is quantum-safe or unclassified
+ */
+export declare function classifyPqcCryptoAsset(component: object, algorithmsByRef?: Map<string, object>): {
+    className: string;
+    keyFamily?: string;
+    keySize?: number;
+    minimumKeySize?: number;
+} | undefined;
+/**
+ * Build the risks.risks[] entries for the quantum-vulnerable and weak
+ * cryptographic assets of a 1.x-shaped internal BOM: one per asset with a
+ * bom-ref (an asset without one could not be referenced from `affects`), in
+ * component order, unique by refId.
+ *
+ * @param {object} internalBom The internal model
+ * @returns {object[]} Risk entries shaped for the draft's
+ *   #/$defs/cyclonedx-risk-2.0/$defs/risk; empty when nothing is at risk
+ */
+export declare function collectPqcRisks(internalBom: object): object[];
+//# sourceMappingURL=pqcMigration.d.ts.map

package/types/lib/inventory/pqcMigration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pqcMigration.d.ts","sourceRoot":"","sources":["../../../lib/inventory/pqcMigration.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAQH,sDAAsD;AACtD,eAAO,MAAM,sBAAsB,cAAc,CAAC;AA0ClD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B,MAAM,CAUlB;AAuMD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EANrC,MAMqC,EAAE,eAAe,AAL9D,CAEA,EAFQ,GAAG,CAAC,MAAM,EAAE,MAAM,CAKgD,GAHhE;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAYxG;AAYD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAJhC,MAIgC,GAH9B,MAAM,EAAE,CA0BpB"}

package/types/lib/inventory/rubyBuildInfo.d.ts

@@ -0,0 +1,271 @@
+/**
+ * The most Ruby-named files one scan opens in search of a build version.
+ *
+ * @type {number}
+ */
+export declare const MAX_RUBY_PROBES: number;
+/**
+ * Parse an MRI version and normalize a pre-release to the hyphenated form the
+ * release tarballs use: `3.4.0preview2` becomes `3.4.0-preview2`.
+ *
+ * @param {string} text candidate version, without a patchlevel
+ * @returns {string|undefined} the version, or undefined
+ */
+export declare function parseRubyVersion(text: string): string | undefined;
+/**
+ * Read the first line `ruby -v` prints, or the description compiled into
+ * libruby, for MRI, JRuby and TruffleRuby:
+ * - `ruby 3.3.6 (2024-11-05 revision 75015d4c1f) [x86_64-linux]`
+ * - `ruby 2.7.8p225 (2023-03-30 revision 1f4d455848) [x86_64-linux]`
+ * - `ruby 3.4.0preview2 (2024-10-07 master 32c733f57b) +PRISM [x86_64-linux]`
+ * - `jruby 9.4.8.0 (3.1.4) 2024-07-02 4d41e55a67 OpenJDK 64-Bit ...`
+ * - `truffleruby 24.1.0, like ruby 3.2.4, Oracle GraalVM Native [x86_64-linux]`
+ *
+ * @param {string} text description line
+ * @returns {{engine: string, version: string, patchlevel?: string,
+ *   rubyVersion?: string, platform?: string}|undefined} engine is `ruby`,
+ *   `jruby` or `truffleruby`; for the last two, rubyVersion is the Ruby
+ *   language version the engine implements
+ */
+export declare function parseRubyDescription(text: string): {
+    engine: string;
+    version: string;
+    patchlevel?: string;
+    rubyVersion?: string;
+    platform?: string;
+} | undefined;
+/**
+ * Read the entries of an rbconfig.rb that identify a build. Only literal
+ * `CONFIG["KEY"] = "value"` lines are read; Ruby is never evaluated.
+ *
+ * @param {string} text rbconfig.rb contents
+ * @returns {{version: string, patchlevel?: string, abi?: string,
+ *   arch?: string, baseName?: string}|undefined}
+ */
+export declare function parseRbConfig(text: string): {
+    version: string;
+    patchlevel?: string;
+    abi?: string;
+    arch?: string;
+    baseName?: string;
+} | undefined;
+/**
+ * Whether a file name is one a Ruby interpreter is installed under: `ruby`,
+ * a versioned `ruby3.3` as distros and `--program-suffix` builds name it,
+ * `ruby.exe` and `rubyw.exe`.
+ *
+ * @param {string} fileName basename or path of the candidate
+ * @returns {boolean}
+ */
+export declare function isRubyBinaryName(fileName: string): boolean;
+/**
+ * Whether a file name is the shared Ruby library: libruby.so.3.3.6, Debian's
+ * libruby-3.1.so.3.1.2,
+ * libruby.3.3.dylib, or the RubyInstaller's x64-ucrt-ruby340.dll.
+ *
+ * @param {string} fileName basename or path of the candidate
+ * @returns {boolean}
+ */
+export declare function isLibrubyName(fileName: string): boolean;
+/**
+ * The version a libruby soname spells, libruby.so.3.3.6 -> 3.3.6.
+ *
+ * @param {string} fileName basename or path
+ * @returns {string|undefined}
+ */
+export declare function versionFromLibrubyName(fileName: string): string | undefined;
+/**
+ * The install prefix of a file under bin, sbin or lib: /usr/local/bin/ruby ->
+ * /usr/local, C:\Ruby34-x64\bin\ruby.exe -> C:\Ruby34-x64.
+ *
+ * @param {string} absPath absolute path
+ * @returns {string|undefined}
+ */
+export declare function rubyInstallPrefix(absPath: string): string | undefined;
+/**
+ * The rbconfig.rb files an install prefix holds, at most a few levels down:
+ * <prefix>/lib/ruby/<abi>/<arch>/rbconfig.rb, and the Debian layout
+ * <prefix>/lib/<triplet>/ruby/<abi>/rbconfig.rb.
+ *
+ * @param {string} prefix install prefix
+ * @returns {string[]} absolute paths
+ */
+export declare function findRbConfigFiles(prefix: string): string[];
+/**
+ * Find the description compiled into a file, `ruby 3.3.6 (2024-11-05 ...`.
+ *
+ * @param {string} absPath absolute path of a ruby binary or libruby
+ * @param {string|undefined} rootDir extracted root
+ * @returns {ReturnType<typeof parseRubyDescription>}
+ */
+export declare function readRubyDescription(absPath: string, rootDir: string | undefined): ReturnType<typeof parseRubyDescription>;
+/**
+ * Read the Ruby build version of a ruby binary or libruby.
+ *
+ * @param {string} absPath absolute path of the candidate
+ * @param {string|undefined} rootDir extracted root, when the file came from one
+ * @returns {{version: string, source: string, patchlevel?: string,
+ *   abi?: string, arch?: string}|undefined} source is `rbconfig`, `binary`
+ *   or `soname`
+ */
+export declare function readRubyBuildVersion(absPath: string, rootDir: string | undefined): {
+    version: string;
+    source: string;
+    patchlevel?: string;
+    abi?: string;
+    arch?: string;
+} | undefined;
+/**
+ * The CPE that lets a downstream scanner match an interpreter version. NVD
+ * names MRI ruby-lang:ruby and keeps a pre-release in the update field, as in
+ * cpe:2.3:a:ruby-lang:ruby:3.4.0:preview1:*:*:*:*:*:*.
+ *
+ * @param {string} version interpreter version
+ * @param {string} [engine="ruby"] `ruby` or `jruby`
+ * @returns {string|undefined} CPE 2.3 string, or undefined for an engine NVD
+ *   does not name
+ */
+export declare function rubyCpe(version: string, engine?: string): string | undefined;
+/**
+ * A Ruby runtime is one `platform` component per distinct engine and version,
+ * like the PHP and Node.js runtime components. Its identity is
+ * `pkg:generic/ruby` (or `jruby`, `truffleruby`).
+ *
+ * @param {string} version interpreter version
+ * @param {Object} [options] options
+ * @param {boolean} [options.withCpe=true] false for a Ruby a distro packaged,
+ *   which backports fixes under its old upstream version
+ * @param {string} [options.engine="ruby"] `ruby`, `jruby` or `truffleruby`
+ * @returns {Object} component with `purl`, `bom-ref` and, when one applies, `cpe`
+ */
+export declare function createRubyRuntimeComponent(version: string, { withCpe, engine }?: {
+    withCpe?: boolean;
+    engine?: string;
+}): Object;
+/**
+ * The bom-ref of the runtime component for a version.
+ *
+ * @param {string} version interpreter version
+ * @param {string} [engine="ruby"] engine
+ * @returns {string|undefined} bom-ref, which is the runtime's purl
+ */
+export declare function rubyRuntimeRef(version: string, engine?: string): string | undefined;
+/**
+ * The properties a Ruby file component carries once its build is known. They
+ * belong on unpackaged `file` components only: a package-owned Ruby is
+ * identified by its package.
+ *
+ * @param {{version: string, source: string, patchlevel?: string, abi?: string, arch?: string}} build
+ *   result of readRubyBuildVersion
+ * @returns {{name: string, value: string}[]} properties to append
+ */
+export declare function rubyBuildProperties(build: {
+    version: string;
+    source: string;
+    patchlevel?: string;
+    abi?: string;
+    arch?: string;
+}): {
+    name: string;
+    value: string;
+}[];
+/**
+ * Start collecting the runtime components and edges of one scan.
+ *
+ * @returns {{runtimeComponents: Object[], dependencies: Object[], runtimeRefs: Set<string>}}
+ */
+export declare function createRubyRuntimeInventory(): {
+    runtimeComponents: Object[];
+    dependencies: Object[];
+    runtimeRefs: Set<string>;
+};
+/**
+ * Tag a Ruby file component with its build facts and link it to the runtime
+ * component of its version, creating that component on first use. Mutates the
+ * component in place.
+ *
+ * @param {{runtimeComponents: Object[], dependencies: Object[], runtimeRefs: Set<string>}} inventory
+ *   accumulator from createRubyRuntimeInventory
+ * @param {Object} component file component, with a `properties` array
+ * @param {{version: string, source: string, patchlevel?: string, abi?: string, arch?: string}} build
+ *   result of readRubyBuildVersion
+ */
+export declare function attachRubyBuild(inventory: {
+    runtimeComponents: Object[];
+    dependencies: Object[];
+    runtimeRefs: Set<string>;
+}, component: Object, build: {
+    version: string;
+    source: string;
+    patchlevel?: string;
+    abi?: string;
+    arch?: string;
+}): void;
+/**
+ * The upstream Ruby version an OS package carries: 1:3.1.2-7+deb12u1 -> 3.1.2,
+ * 3.3.10-r0 -> 3.3.10, 3.0.7-168.el9_8 -> 3.0.7, 3.4.8_1 -> 3.4.8, and the
+ * Chocolatey 3.4.10.1 -> 3.4.10.
+ *
+ * @param {string} version package version
+ * @param {string} [purlType] purl type of the package
+ * @returns {string|undefined}
+ */
+export declare function upstreamRubyVersion(version: string, purlType?: string): string | undefined;
+/**
+ * Describe the Ruby an OS package installed with its upstream identity,
+ * `pkg:generic/ruby@<upstream>`, so a BOM names the interpreter both ways. The
+ * component of a distro package carries no CPE, since distros backport fixes
+ * under their old upstream version; Homebrew and Chocolatey ship the upstream
+ * release, so theirs does. `cdx:os:installedBy` names the package to judge it
+ * by.
+ *
+ * @param {Object[]} components BOM components, OS packages among them
+ * @returns {Object[]} runtime components to add, one per distinct version
+ */
+export declare function deriveOsPackagedRubyRuntimes(components: Object[]): Object[];
+/**
+ * Where the default gems of an install live: the gemspec paths
+ * <prefix>/lib/ruby/gems/<abi>/specifications/default/*.gemspec.
+ *
+ * @param {string} gemspecPath path of a gemspec, either separator
+ * @returns {{prefix: string, abi: string}|undefined} the install prefix and
+ *   ABI, when the gemspec is a default gem of a lib/ruby/gems tree
+ */
+export declare function defaultGemInstall(gemspecPath: string): {
+    prefix: string;
+    abi: string;
+} | undefined;
+/**
+ * Whether a path lies inside an installed gem's own directory,
+ * <gem home>/gems/<name>-<version>/..., beside the specifications directory of
+ * that gem home. The lockfiles, manifests and nested gemspecs there belong to
+ * the gem's own development, not to anything installed.
+ *
+ * Only the part of the path from the scanned directory down counts, so a scan
+ * of one installed gem (`cdxgen /usr/local/bundle/gems/rails-7.1.0`) still
+ * reads that gem's files. The scanned directory may itself be the `gems`
+ * directory, as when an image scan reads each gem home on its own.
+ *
+ * @param {string} filePath absolute path, either separator
+ * @param {function(string): boolean} exists existence check
+ * @param {string} [scanRoot] the directory the scan started from
+ * @returns {boolean}
+ */
+export declare function isInsideInstalledGem(filePath: string, exists: Function, scanRoot?: string): boolean;
+/**
+ * Link the default gems of an unpackaged Ruby to the runtime they ship with.
+ * The runtime is known from its `file` components, which carry the build
+ * version and the path they were found at; a default gem belongs to the
+ * runtime installed under the same prefix. Gems an OS package installed are
+ * left to that package, as is any gem whose install has no unpackaged runtime.
+ *
+ * @param {Object[]} components BOM components
+ * @param {string} [rootDir] extracted root the source paths may start with
+ * @returns {{ref: string, dependsOn: string[]}[]} edges from each runtime to
+ *   its default gems
+ */
+export declare function linkDefaultGemsToRuntimes(components: Object[], rootDir?: string): {
+    ref: string;
+    dependsOn: string[];
+}[];
+//# sourceMappingURL=rubyBuildInfo.d.ts.map

package/types/lib/inventory/rubyBuildInfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rubyBuildInfo.d.ts","sourceRoot":"","sources":["../../../lib/inventory/rubyBuildInfo.js"],"names":[],"mappings":"AAkCA;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAFlB,MAEuB,CAAC;AA0BlC;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAH1B,MAG0B,GAFxB,MAAM,GAAC,SAAS,CAc5B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAN9B,MAM8B,GAL5B;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CA2DtD;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,GAHrB;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAwC/C;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAH9B,MAG8B,GAF5B,OAAO,CAanB;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,OAAO,CAYnB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAHpC,MAGoC,GAFlC,MAAM,GAAC,SAAS,CAU5B;AAyCD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,GAF5B,MAAM,GAAC,SAAS,CAkB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAH7B,MAG6B,GAF3B,MAAM,EAAE,CAqCpB;AAwBD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAAM,GAAC,SAGkC,GAFvC,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAyBnD;AAeD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EANjC,MAMiC,EAAE,OAAO,EAL1C,MAAM,GAAC,SAKmC,GAJxC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAyE1C;AAQD;;;;;;;;;GASG;AACH,wBAAgB,OAAO,CAAC,OAAO,EALpB,MAKoB,EAAE,MAAM,AAJpC,CACA,EADQ,MAIqC,GAHnC,MAAM,GAAC,SAAS,CAwB5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EARE,MAQF,EACP,EAAE,OAAc,EAAE,MAAe,EAAE,AARlC,CAIA,EAHA;IAA0B,OAAO,AAAjC,CAEA,EAFQ,OAAO,CAEf;IAAyB,MAAM,AAA/B,CACA,EADQ,MAAM,CACd;CAIuC,GAJ7B,MAAM,CAelB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAJ3B,MAI2B,EAAE,MAAM,AAH3C,CACA,EADQ,MAG4C,GAF1C,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAJ9B;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAIpD,GAF5B;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAiB3C;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAF7B;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAC,CAI3F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAN9B;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAMhD,EAAE,SAAS,EAJzC,MAIyC,EAAE,KAAK,EAHhD;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAGlC,QA6B1D;AA2CD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAJhC,MAIgC,EAAE,QAAQ,AAHlD,CACA,EADQ,MAG0C,GAFxC,MAAM,GAAC,SAAS,CAwB5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,UAAU,EAH5C,MAAM,EAGsC,GAF1C,MAAM,EAAE,CAgEpB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAJlC,MAIkC,GAHhC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAqBnD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EALlC,MAKkC,EAAE,MAAM,UAAA,EAAE,QAAQ,AAH5D,CACA,EADQ,MAGoD,GAFlD,OAAO,CA6BnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EALzC,MAAM,EAKmC,EAAE,OAAO,AAJ1D,CACA,EADQ,MAIkD,GAHhD;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,EAAE,CAkEhD"}

package/types/lib/inventory/rubyHostProbe.d.ts

@@ -0,0 +1,47 @@
+export declare const RUBY_VERSION_MANAGER_DIRECTORIES: string[];
+export declare const HOME_PARENTS: {
+    linux: string[];
+    darwin: string[];
+};
+/**
+ * Expand a relative directory pattern whose `*` segments match one directory
+ * name each.
+ *
+ * @param {string} base absolute directory the pattern hangs off
+ * @param {string} pattern `/`-separated relative pattern
+ * @returns {string[]} existing directories, at most MAX_EXPANDED_DIRECTORIES
+ */
+export declare function expandDirectories(base: string, pattern: string): string[];
+/**
+ * The home directories of a host: /root and /home/* on Linux, /Users/* on
+ * macOS.
+ *
+ * @param {{rootPath: string, platform: string}} context probe context
+ * @returns {string[]}
+ */
+export declare function homeDirectories(context: {
+    rootPath: string;
+    platform: string;
+}): string[];
+/**
+ * The directories a Windows Ruby lives in: the RubyInstaller's C:\Ruby34-x64,
+ * Chocolatey's C:\tools\ruby34, and the hosted toolcache.
+ *
+ * @param {Object} context probe context
+ * @returns {string[]} install roots, each with a `bin` directory
+ */
+export declare function windowsRubyRoots(context: Object): string[];
+/**
+ * Look for Ruby no package manager owns on the host. Components come back
+ * only for the files nothing owns: a `file` component for each `ruby` binary
+ * with the cdx:ruby properties, and one `platform` component per Ruby version
+ * with its CPE.
+ *
+ * @param {Object} [options] probe options, as probeHostPhp takes them
+ * @returns {{components: Object[], dependencies: Object[]}}
+ */
+export declare function probeHostRuby(options?: Object): {
+    components: Object[];
+    dependencies: Object[];
+};
+//# sourceMappingURL=rubyHostProbe.d.ts.map