@cdxgen/cdxgen 13.6.0 → 13.7.0

package/types/lib/core/processTree.d.ts

@@ -12,6 +12,14 @@
  * @returns {string} Human-readable duration
  */
 export declare function formatDuration(ms: number): string;
+/**
+ * A UTC instant as a DMTF datetime, the form WQL compares CIM_DATETIME
+ * properties such as Win32_Process.CreationDate against.
+ *
+ * @param {number} ms Epoch milliseconds
+ * @returns {string} The instant as `yyyymmddHHMMSS.mmmmmm+000`
+ */
+export declare function toDmtfUtc(ms: number): string;
 /**
  * Stop the descendants a timed-out run left behind on Windows.
  *
@@ -20,13 +28,16 @@ export declare function formatDuration(ms: number): string;
  * workers, or the build hosts a .NET analyzer starts keep running while still
  * pointing at the dead process's pid. `taskkill /T` on that pid finds nothing,
  * because the root is already gone. The live descendants are therefore found
- * by parent pid in a process snapshot and stopped, limited to processes
- * created after the run started. The root's own children must also predate
- * its end: once the root is gone its pid can be handed to an unrelated
- * process, whose children would otherwise look like the run's. Elsewhere this
+ * by parent pid in a PowerShell process snapshot, limited to processes
+ * created after the run started, and stopped from Node.js. The root's own
+ * children must also predate its end: once the root is gone its pid can be
+ * handed to an unrelated process, whose children would otherwise look like
+ * the run's. Elsewhere this
  * does nothing: an orphan is re-parented and can no longer be told apart.
  * It returns once the stopped processes have exited, or after ten seconds,
- * so the caller can remove files the run left half-written.
+ * so the caller can remove files the run left half-written. When the
+ * snapshot itself fails or runs past its time limit it warns and returns an
+ * empty list, since processes may then still be running.
  *
  * @param {number|undefined} rootPid pid of the process cdxgen spawned
  * @param {number} startedAt Epoch milliseconds at which the run started

package/types/lib/core/processTree.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"processTree.d.ts","sourceRoot":"","sources":["../../../lib/core/processTree.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAHtB,MAGsB,GAFpB,MAAM,CAQlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAPE,MAAM,GAAC,SAOT,EACP,SAAS,EAPA,MAOA,EACT,OAAO,AAPN,CACA,EADQ,MAOW,EACpB,QAAQ,AAPP,CACA,EADQ,MAOY,GANV,MAAM,EAAE,CA0DpB"}
+{"version":3,"file":"processTree.d.ts","sourceRoot":"","sources":["../../../lib/core/processTree.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAHtB,MAGsB,GAFpB,MAAM,CAQlB;AAqCD;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAHjB,MAGiB,GAFf,MAAM,CAMlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAPE,MAAM,GAAC,SAOT,EACP,SAAS,EAPA,MAOA,EACT,OAAO,AAPN,CACA,EADQ,MAOW,EACpB,QAAQ,AAPP,CACA,EADQ,MAOY,GANV,MAAM,EAAE,CA4FpB"}

package/types/lib/core/projectConfig.d.ts

@@ -2,26 +2,65 @@
  * Config file names cdxgen reads from the directory it is invoked in.
  */
 export declare const PROJECT_CONFIG_FILENAMES: string[];
+/**
+ * Options a config file may set, by their kebab-case name. A config file may
+ * also use the camelCase spelling of each, or one of the aliases in
+ * PROJECT_CONFIG_OPTION_ALIASES. Every other key is ignored: options that
+ * only library callers pass (such as `dosaiCommand` or `traceCmd`), yargs'
+ * own `extends`, and anything cdxgen does not know.
+ *
+ * Every option bin/cdxgen.js declares is either here or in
+ * OPERATOR_ONLY_OPTIONS, which projectConfig.poku.js checks.
+ */
+export declare const PROJECT_CONFIG_OPTIONS: Set<string>;
+/**
+ * Options only the operator may set, on the command line or through a
+ * CDXGEN_* environment variable. They choose an executable, start a listener,
+ * turn off certificate checks on the operator's own upload, opt into
+ * experimental tool installation, or end the run without a BOM. A config file
+ * that sets one is told so and ignored.
+ */
+export declare const OPERATOR_ONLY_OPTIONS: Set<string>;
+/**
+ * Alternate option names a config file may use, with the option each one
+ * stands for. yargs applies its aliases to config keys too, so each is
+ * checked as the option it names.
+ */
+export declare const PROJECT_CONFIG_OPTION_ALIASES: Map<string, string>;
 /**
  * Apply the trust boundary between cdxgen and the directory it is scanning.
  *
  * A config file lives in the tree under analysis, so it is attacker-controlled
- * whenever that tree is. Path options are therefore confined to the config's
- * own directory - a scanned project may choose where in itself the BOM lands,
- * but not write outside it - and options that redirect data off the host or
- * widen what cdxgen executes are announced on the console. A project may
- * describe itself with custom metadata properties, but not in the namespaces
- * cdxgen reserves for the facts it establishes, so a scanned tree cannot pass
- * its own claims off as cdxgen's.
+ * whenever that tree is. It may therefore only set the options listed in
+ * PROJECT_CONFIG_OPTIONS: options that choose an executable, start a listener
+ * or weaken the operator's own checks, and every key cdxgen does not declare
+ * as an option, are dropped. Path options are confined to the config's own
+ * directory - a scanned project may choose where in itself the BOM lands, but
+ * not write outside it - and project types that inventory the host rather
+ * than the scan path are dropped. Exclude and include patterns are kept
+ * within the bounds of boundUntrustedGlobPatterns, so a project cannot make
+ * every file match against thousands of brace-expanded patterns. Options that
+ * redirect data off the host or widen what cdxgen does are announced on the
+ * console. A project may describe itself with custom metadata properties, but
+ * not in the namespaces cdxgen reserves for the facts it establishes, so a
+ * scanned tree cannot pass its own claims off as cdxgen's.
  *
  * @param {Object} config parsed config file contents
  * @param {string} configDir directory the config file was read from
- * @returns {{config: Object, rejected: string[], announced: string[], reservedProperties: string[]}} sanitized config and what it did
+ * @returns {{config: Object, rejected: string[], announced: string[], reservedProperties: string[], ignored: string[], operatorOnly: string[], hostScopeTypes: string[], refusedPatterns: {key: string, pattern: string, reason: string}[]}} sanitized config and what it did
  */
 export declare function sanitizeProjectConfig(config: Object, configDir: string): {
     config: Object;
     rejected: string[];
     announced: string[];
     reservedProperties: string[];
+    ignored: string[];
+    operatorOnly: string[];
+    hostScopeTypes: string[];
+    refusedPatterns: {
+        key: string;
+        pattern: string;
+        reason: string;
+    }[];
 };
 //# sourceMappingURL=projectConfig.d.ts.map

package/types/lib/core/projectConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"projectConfig.d.ts","sourceRoot":"","sources":["../../../lib/core/projectConfig.js"],"names":[],"mappings":"AASA;;GAEG;AACH,eAAO,MAAM,wBAAwB,UAKpC,CAAC;AAuEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAJjC,MAIiC,EAAE,SAAS,EAH5C,MAG4C,GAF1C;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,EAAE,MAAM,EAAE,CAAA;CAAC,CA+CnG"}
+{"version":3,"file":"projectConfig.d.ts","sourceRoot":"","sources":["../../../lib/core/projectConfig.js"],"names":[],"mappings":"AAYA;;GAEG;AACH,eAAO,MAAM,wBAAwB,UAKpC,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,aA2GjC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,aAQhC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,qBASxC,CAAC;AA6IH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAJjC,MAIiC,EAAE,SAAS,EAH5C,MAG4C,GAF1C;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,cAAc,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAC,EAAE,CAAA;CAAC,CA2H3O"}

package/types/lib/core/toolRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"toolRegistry.d.ts","sourceRoot":"","sources":["../../../lib/core/toolRegistry.js"],"names":[],"mappings":"AAsFA;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAH5B,MAG4B,EAAE,OAAO,EAFrC,MAAM,GAAC,SAE8B,QAoB/C;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAH3B,MAG2B,EAAE,OAAO,EAFpC,MAEoC,QAW9C;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAFnB,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAA;CAAC,CAAC,CAe9D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAFrB,IAAI,CAKhB"}
+{"version":3,"file":"toolRegistry.d.ts","sourceRoot":"","sources":["../../../lib/core/toolRegistry.js"],"names":[],"mappings":"AAgGA;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAH5B,MAG4B,EAAE,OAAO,EAFrC,MAAM,GAAC,SAE8B,QAwB/C;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAH3B,MAG2B,EAAE,OAAO,EAFpC,MAEoC,QAW9C;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAFnB,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAA;CAAC,CAAC,CAe9D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAFrB,IAAI,CAKhB"}

package/types/lib/ecosystems/golem.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"golem.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/golem.js"],"names":[],"mappings":"AA4mDA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAL/B,MAK+B,GAJ7B,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,UAAU,EAJrC,MAIqC,EAAE,OAAO,AAHtD,CACA,EADQ,MAGmD,GAFjD,OAAO,CA4DnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,EAAE,OAAO,AAH7C,CACA,EADQ,MAG0C,GAFxC,MAAM,GAAC,SAAS,CA2B5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,AAL7C,CACA,EADQ,MAK0C,EAAE,UAAU,AAJ9D,CACA,EADQ,KAAK,CAAC,MAAM,CAI+C,GAHzD;IAAC,sBAAsB,2BAAgC;IAAC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,mBAAmB,0BAA0B;IAAC,cAAc,wBAAwB;IAAC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,eAAe,wBAAuB;CAAC,CAsFpQ;AAoKD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAJtC,MAIsC,EAAE,SAAS,AAHzD,CACA,EADQ,MAGiD,GAF/C,MAAM,CAkDlB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAJrC,MAIqC,GAHnC;IAAC,MAAM,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAC;IAAC,IAAI,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAyB1F;AAgDD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CA2C5B;AA+BD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,AAJ7C,CACA,EADQ,MAAM,GAAC,IAImC,EAAE,WAAW,AAH/D,CACA,EADQ,MAG4D,GAF1D,MAAM,CAuElB"}
+{"version":3,"file":"golem.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/golem.js"],"names":[],"mappings":"AAumDA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAL/B,MAK+B,GAJ7B,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,UAAU,EAJrC,MAIqC,EAAE,OAAO,AAHtD,CACA,EADQ,MAGmD,GAFjD,OAAO,CA4DnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,EAAE,OAAO,AAH7C,CACA,EADQ,MAG0C,GAFxC,MAAM,GAAC,SAAS,CA2B5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,AAL7C,CACA,EADQ,MAK0C,EAAE,UAAU,AAJ9D,CACA,EADQ,KAAK,CAAC,MAAM,CAI+C,GAHzD;IAAC,sBAAsB,2BAAgC;IAAC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,mBAAmB,0BAA0B;IAAC,cAAc,wBAAwB;IAAC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,eAAe,wBAAuB;CAAC,CAsFpQ;AAoKD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAJtC,MAIsC,EAAE,SAAS,AAHzD,CACA,EADQ,MAGiD,GAF/C,MAAM,CAkDlB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAJrC,MAIqC,GAHnC;IAAC,MAAM,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAC;IAAC,IAAI,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAyB1F;AAgDD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CA2C5B;AA+BD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,AAJ7C,CACA,EADQ,MAAM,GAAC,IAImC,EAAE,WAAW,AAH/D,CACA,EADQ,MAG4D,GAF1D,MAAM,CAuElB"}

package/types/lib/ecosystems/gradleutils.d.ts

@@ -12,6 +12,15 @@ export { isProjectToolingAllowed };
  * @param {Object} [options] CLI options (`installDeps` gates wrapper use)
  */
 export declare function getGradleCommand(srcPath: string, rootPath: string | null, options?: Object): string;
+/**
+ * Read a whitespace-separated list of Gradle arguments from an environment
+ * variable such as `GRADLE_ARGS`. Repeated, leading or trailing whitespace
+ * adds no empty argument, which Gradle would read as a task path.
+ *
+ * @param {string} name Name of the environment variable
+ * @returns {string[]} The arguments, empty when the variable is unset
+ */
+export declare function gradleArgsFromEnv(name: string): string[];
 /**
  * Method to combine the general gradle arguments, the sub-commands and the sub-commands' arguments in the correct way
  *
@@ -23,6 +32,23 @@ export declare function getGradleCommand(srcPath: string, rootPath: string | nul
  * @returns {string[]} Array of arrays of arguments to be added to the gradle command
  */
 export declare function buildGradleCommandArguments(gradleArguments: string[], gradleSubCommands: string[], gradleSubCommandArguments: string[], gradleCommandLength: int): string[];
+/**
+ * List the dependency tasks to run for the root project and every module read
+ * from `gradle properties`.
+ *
+ * The root project is recognised by identity, never by purl. A module named
+ * after the root project that inherits its group and version has the root's
+ * purl (issue 4695), and it still needs its own `:module:dependencies` task.
+ * `root` in `modulesToSkip` drops the root task; any other entry is a module
+ * path.
+ *
+ * @param {Map<string, Object>} gradleModules Modules keyed by project path, and the root project by its name
+ * @param {Object} rootComponent The component built for the root project
+ * @param {string} gradleDepTask Name of the dependency task, usually `dependencies`
+ * @param {string[]} modulesToSkip Module paths, or `root`, to leave out
+ * @returns {string[]} Task paths in the order Gradle should run them
+ */
+export declare function gradleDependencyTasks(gradleModules: Map<string, Object>, rootComponent: Object, gradleDepTask: string, modulesToSkip?: string[]): string[];
 /**
  * Method to split the output produced by Gradle using parallel processing by project
  *
@@ -55,17 +81,19 @@ export declare function parseGradleProjects(rawOutput: string): {
 /**
  * Parse gradle properties output
  *
+ * `gradlePlugin` is true when the project has the `gradlePlugin` extension,
+ * which `java-gradle-plugin`, `kotlin-dsl` and `groovy-gradle-plugin` add: the
+ * project builds Gradle plugins, as a `build-logic` build does.
+ *
  * @param {string} rawOutput Raw string output
  * @param {string} gradleModuleName The name (or 'path') of the module as seen from the root of the project
+ * @returns {{rootProject: string, projects: string[], metadata: Object, gradlePlugin: boolean}} The parsed properties
  */
 export declare function parseGradleProperties(rawOutput: string, gradleModuleName?: string): {
     rootProject: string;
-    projects: any[];
-    metadata: {
-        group: string;
-        version: string;
-        properties: never[];
-    };
+    projects: string[];
+    metadata: Object;
+    gradlePlugin: boolean;
 };
 /**
  * Execute gradle properties command using multi-threading and return parsed output
@@ -123,6 +151,17 @@ export declare function recordGradleInvocationFailure(result: Object, context?:
  * @returns {Promise<string[]>} Paths of the projects added
  */
 export declare function loadGradleModulesForReports(reports: Iterable<string>, gradleModules: Map<any, any>, gradleRootPath: string, options?: Object): Promise<string[]>;
+/**
+ * Give the components of a build-tooling report, such as that of an included
+ * build that builds Gradle plugins, the `excluded` scope that build-tool
+ * configurations get. `reconcileGradleComponents` later keeps a stronger
+ * scope that another project's report gives the same component.
+ *
+ * @param {Object[]} pkgList Components from one project's report, updated in place
+ * @param {Map<string, Object>} gradleModules Modules, which keep their own scope
+ * @returns {Object[]} The same list
+ */
+export declare function excludeGradleBuildTooling(pkgList: Object[], gradleModules: Map<string, Object>): Object[];
 /**
  * Reconcile the copies of a component that several Gradle projects report.
  * Every copy gets the strongest scope any project gave it, so a library one
@@ -146,19 +185,26 @@ export declare function reconcileGradleComponents(pkgList: Object[]): Object[];
  * `cdx:gradle:resolutionFailed`, keeps the version it was requested at when
  * that is a concrete version, and otherwise records the request in
  * `cdx:gradle:requestedVersion`. A dependency seen in several configurations
- * keeps the strongest scope among them.
+ * keeps the strongest scope among them. Platforms and BOMs get a `pom` type
+ * and the `excluded` scope.
  *
  * The parser runs no Gradle task. A project the tree names but `gradleModules`
  * lacks gets a component built from the root project's group and version; use
  * `loadGradleModulesForReports` first to read such projects' properties.
  *
+ * The lines Gradle prints under another project, such as `project ':lib'` in
+ * the report of `:app`, show that project's dependencies as `:app` resolved
+ * them, after conflict resolution. When `reportedProjects` names that project,
+ * its own report supplies its edges, so these lines add no edge from it.
+ *
  * @param {string} rawOutput Text output from gradle dependencies task
  * @param {string} rootProjectName Key in `gradleModules` of the project the report belongs to
  * @param {map} gradleModules Gradle modules keyed by project path, and the root project by its name
  * @param {string} gradleRootPath Directory Gradle ran in, recorded as `cdx:gradle:GradleRootPath`
+ * @param {Set<string>} [reportedProjects] Keys in `gradleModules` of the projects whose own reports are parsed
  * @returns {{pkgList: Object[], dependenciesList: Object[]}|{}} The components and dependency graph
  */
-export declare function parseGradleDep(rawOutput: string, rootProjectName?: string, gradleModules?: map, gradleRootPath?: string): {
+export declare function parseGradleDep(rawOutput: string, rootProjectName?: string, gradleModules?: map, gradleRootPath?: string, reportedProjects?: Set<string>): {
     pkgList: Object[];
     dependenciesList: Object[];
 } | {};
@@ -291,4 +337,198 @@ export declare function getMavenCommand(srcPath: string, rootPath: string, optio
  * @returns {Object[]} Package records for resolvable library entries
  */
 export declare function parseGradleVersionCatalog(catalogFile: string): Object[];
+/**
+ * Parse one Gradle dependency lockfile.
+ *
+ * Both layouts are read. A Gradle 6+ `gradle.lockfile` has one
+ * `group:name:version=configuration,configuration` line per module and an
+ * `empty=` line naming the configurations that resolved nothing. A legacy
+ * `gradle/dependency-locks/<configuration>.lockfile` has one
+ * `group:name:version` line per module, and the file name is the
+ * configuration.
+ *
+ * The scope of a module is the strongest that `gradleConfigurationScope`
+ * gives any of its configurations, so a module locked for both
+ * `testRuntimeClasspath` and `runtimeClasspath` is `required`. Everything in
+ * a buildscript or settings lockfile is build tooling and `excluded`.
+ *
+ * A lockfile records resolved versions, so components carry a purl identity
+ * with confidence 1 and the lockfile path as the evidence value. The purl and
+ * bom-ref match what `parseGradleDep` builds for the same coordinate, so a
+ * component reads the same whether Gradle ran or not. A lockfile is flat: it
+ * says nothing about which module depends on which, so no dependency graph is
+ * returned.
+ *
+ * The file is untrusted input. It is read only when it is a regular file no
+ * larger than 8 MiB, at most 100000 lines are read, and a malformed line
+ * costs only itself. Line content never reaches a property.
+ *
+ * @param {string} lockFile Path to the lockfile
+ * @param {Object} [options] Parse options
+ * @param {string} [options.rootDir] Directory the lockfile must resolve inside
+ * @returns {Object[]} Components, one per locked module
+ */
+export declare function parseGradleLockfile(lockFile: string, options?: {
+    rootDir?: string;
+}): Object[];
+/**
+ * Parse several Gradle lockfiles of one build and merge the result.
+ *
+ * Every project of a multi-project build has its own lockfile, so the same
+ * module often appears in several of them with different configurations. The
+ * copies collapse into one component with the strongest scope any lockfile
+ * gave it (see `reconcileGradleComponents`), and its evidence lists every
+ * lockfile that locked it. The first lockfile that locked a module stays its
+ * `internal:SrcFile`.
+ *
+ * @param {string[]} lockFiles Paths to the lockfiles
+ * @param {Object} [options] Parse options, as for `parseGradleLockfile`
+ * @returns {Object[]} Components, one per locked module
+ */
+export declare function parseGradleLockfiles(lockFiles: string[], options?: Object): Object[];
+/**
+ * Find the Gradle dependency lockfiles of one build.
+ *
+ * Both layouts are searched below `rootPath`, recursively even when
+ * `options.multiProject` is off: every subproject of a Gradle build locks its
+ * own configurations, and the subprojects belong to the same build. The
+ * Gradle 6+ names are `gradle.lockfile`, `buildscript-gradle.lockfile` and
+ * `settings-gradle.lockfile`; the Gradle 4.8 to 5.x layout is
+ * `gradle/dependency-locks/<configuration>.lockfile`.
+ *
+ * A lockfile is accepted only when the project directory that owns it holds a
+ * Gradle build file, and never when it sits under `build/`, `.gradle/`,
+ * `node_modules/` or a vendored directory. `getAllFiles` already leaves
+ * `.git`, `.hg`, `.chen` and `node_modules` out; `build/` and `.gradle/` are
+ * Gradle's own output and cache directories, which a lockfile in them cannot
+ * belong to the project's source of truth.
+ *
+ * Custom `dependencyLocking.lockFile` paths, the Nebula `dependencies.lock`
+ * and Palantir `versions.lock` formats are not looked for.
+ *
+ * @param {string} rootPath Directory to search
+ * @param {Object} [options] CLI options
+ * @returns {string[]} Lockfile paths, in a stable order
+ */
+export declare function findGradleLockfiles(rootPath: string, options?: Object): string[];
+/**
+ * Read the root project name a Gradle settings script assigns with
+ * `rootProject.name = '<name>'` or `rootProject.name = "<name>"`, without
+ * running Gradle.
+ *
+ * `settings.gradle` is read before `settings.gradle.kts`, and the last
+ * assignment in the file wins, as it does in Gradle. Only a plain string
+ * literal is accepted: a value built from a variable, a template
+ * (`"${x}"`) or a method call is not something a static read can resolve.
+ *
+ * @param {string} gradleRootPath Root directory of the Gradle build
+ * @returns {string|undefined} The root project name, or undefined when no
+ *   settings script assigns one as a plain literal
+ */
+export declare function readGradleRootProjectName(gradleRootPath: string): string | undefined;
+/**
+ * Parse a `gradle/verification-metadata.xml` file.
+ *
+ * The file is untrusted input. It records what Gradle verified when
+ * `gradle --write-verification-metadata` last ran, which does not prove that
+ * the artifacts in this BOM match: the file travels with the source, and
+ * nothing here re-checks the digests. Trust rules (`trusted-artifacts`,
+ * `trusted-keys`, `ignored-keys`) may be regular expressions, so they are
+ * only counted, never evaluated, and no free text of the file (an `origin`, a
+ * `reason`, a key-server URI) reaches the result. Only checksum digests,
+ * PGP key ids and the configuration flags survive.
+ *
+ * The read is bounded: the file must be a regular file no larger than
+ * 32 MiB inside `options.rootDir`, at most 200000 components and 64
+ * artifacts per component are read, and a malformed file yields undefined
+ * rather than an error.
+ *
+ * @param {string} metadataFile Path to verification-metadata.xml
+ * @param {Object} [options] Parse options
+ * @param {string} [options.rootDir] Directory the file must resolve inside
+ * @returns {{configuration: {verifyMetadata: (boolean|undefined), verifySignatures: (boolean|undefined), trustedKeyCount: number, trustedArtifactRuleCount: number, ignoredKeyCount: number, keyServerCount: number}, components: Map<string, {group: string, name: string, version: string, artifacts: {fileName: string, classifier: string, extension: string, hashes: {alg: string, content: string}[], pgpKeyIds: string[]}[]}>}|undefined}
+ *   The parsed metadata, or undefined when the file could not be read
+ */
+export declare function parseGradleVerificationMetadata(metadataFile: string, options?: {
+    rootDir?: string;
+}): {
+    configuration: {
+        verifyMetadata: (boolean | undefined);
+        verifySignatures: (boolean | undefined);
+        trustedKeyCount: number;
+        trustedArtifactRuleCount: number;
+        ignoredKeyCount: number;
+        keyServerCount: number;
+    };
+    components: Map<string, {
+        group: string;
+        name: string;
+        version: string;
+        artifacts: {
+            fileName: string;
+            classifier: string;
+            extension: string;
+            hashes: {
+                alg: string;
+                content: string;
+            }[];
+            pgpKeyIds: string[];
+        }[];
+    }>;
+} | undefined;
+/**
+ * Find the gradle/verification-metadata.xml of one Gradle build.
+ *
+ * Gradle reads one verification file per build, from the root build's
+ * `gradle` directory; included builds' copies are ignored, so nothing is
+ * searched below the root. The file is accepted only when the directory is a
+ * Gradle project of its own, so a file copied into a nested folder is not
+ * read as an inventory source.
+ *
+ * @param {string} gradleRootPath Root directory of the Gradle build
+ * @returns {string|undefined} The metadata file path, or undefined
+ */
+export declare function findGradleVerificationMetadata(gradleRootPath: string): string | undefined;
+/**
+ * The artifact of a coordinate whose hashes describe the component itself:
+ * the `.pom` artifact for a platform or BOM component, else the main jar,
+ * else the main aar. Sources, javadoc and other classifiers, and the
+ * `.module` and `.pom` hashes of a jar component, are never used.
+ *
+ * @param {object} component Parsed verification metadata component
+ * @param {boolean} wantsPom True for a component with purl qualifier type=pom
+ * @returns {object|undefined} The artifact, or undefined
+ */
+export declare function gradleVerificationMainArtifact(component: object, wantsPom: boolean): object | undefined;
+/**
+ * Merge the checksums and PGP key ids a verification-metadata.xml records
+ * into the components of a package list.
+ *
+ * A digest of the artifact itself, computed from the jar in the local cache
+ * or found by another collector, is the stronger claim, so the recorded
+ * digests only fill the algorithms a component still lacks. Where the file
+ * records a different digest for an algorithm the component already has,
+ * the recorded digest never wins: the component keeps its own, and the
+ * component gains the cdx:gradle:verificationMismatch=true property so the
+ * disagreement is visible. A released Maven version does not change after
+ * publishing, so a stale file cannot explain a mismatch: a stale file names
+ * old versions, which match nothing. The likely causes are an artifact
+ * republished on a mirror or internal repository, or a corrupted or
+ * tampered cache. SNAPSHOT versions and digests that are not hex are not
+ * compared.
+ *
+ * Every matched component also gains two properties naming the verification
+ * methods and the PGP key ids of its artifact. The evidence of the
+ * component is left alone: a component found by a Gradle run or a lockfile
+ * keeps the identity evidence of that source, and only the components the
+ * verification-metadata fallback built carry the file as their evidence.
+ *
+ * @param {Object[]} pkgList Components to enrich in place
+ * @param {Object} metadata Parsed metadata, as parseGradleVerificationMetadata
+ *   returns
+ * @param {string} metadataFile Path to the verification-metadata.xml, named
+ *   in the debug reasoning
+ * @returns {number} The number of components this call changed
+ */
+export declare function applyGradleVerificationMetadata(pkgList: Object[], metadata: Object, metadataFile: string): number;
 //# sourceMappingURL=gradleutils.d.ts.map

package/types/lib/ecosystems/gradleutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gradleutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/gradleutils.js"],"names":[],"mappings":"AAyBA,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAyBpE,OAAO,EAAE,uBAAuB,EAAE,CAAC;AAEnC;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAJ7B,MAI6B,EAAE,QAAQ,EAHvC,MAAM,GAAC,IAGgC,EAAE,OAAO,AAFxD,CACF,EADU,MAEqD,UAiG/D;AA6DD;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,eAAe,EARN,MAAM,EAQA,EACf,iBAAiB,EARR,MAAM,EAQE,EACjB,yBAAyB,EARhB,MAAM,EAQU,EACzB,mBAAmB,EARV,GAQU,GANR,MAAM,EAAE,CA6CpB;AAqCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAJ1C,MAI0C,EAAE,aAAa,EAHzD,MAAM,EAGmD,GAFvD,GAAG,CA0Cf;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAFlC,MAEkC;;;EA8C5C;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAHpC,MAGoC,EAAE,gBAAgB,GAFtD,MAE6D;;;;;;;;EAoDvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAPM,MAON,EACH,cAAc,EAPL,KAOK,EACd,SAAS,GAPA,KAOK,EACd,OAAO,KAAK,GAND,MAAM,CA6GlB;AAiBD;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAF3B,IAAI,CAKhB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAF7B,OAAO,CAInB;AAiGD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EANzC,MAMyC,EAAE,OAAO,GAJ1D;IAAyB,OAAO,AAAhC,CACA,EADQ,MAAM,CACd;IAAyB,aAAa,AAAtC,CACA,EADQ,MAAM,CACd;CAE+D,GAFrD,IAAI,CA+HhB;AA2QD;;;;;;;;;;;GAWG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAPE,QAAQ,CAAC,MAAM,CAOjB,EACP,aAAa,eAAA,EACb,cAAc,EAPL,MAOK,EACd,OAAO,GAPE,MAOG,GAND,OAAO,CAAC,MAAM,EAAE,CAAC,CAoD7B;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAHtC,MAAM,EAGgC,GAFpC,MAAM,EAAE,CA0CpB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAPA,MAOA,EACT,eAAe,GAPN,MAOe,EACxB,aAAa,GAPJ,GAOgB,EACzB,cAAc,GAPL,MAOU,GANR;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,EAAE,CAsP9D;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,QAAQ,EAHpD,MAGoD,GAFlD,MAAM,CAkDlB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,gBAAgB,EAHjD,MAGiD,GAF/C,MAAM,CAkBlB;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAH5C,MAG4C,GAF1C,MAAM,CAuBlB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAHtC,MAGsC,GAFpC,MAAM,CA8ClB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAPD,MAOC,EACV,SAAS,EAPA,MAOA,EACT,QAAQ,GAPC,OAOM,EAAE,qCAAqC;AACtD,gBAAgB,GAPP,OAOe,GANb,OAAO,CAAC,MAAM,CAAC,CAgC3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,EAAE,OAAO,AAF5C,CACF,EADU,MAEyC,UAiBnD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,YAAY,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,MAAM,GAAC,IAAI,CA4BvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAJ7B,MAI6B,GAH3B,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CA2DpC;AAqBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EANC,MAMD,EACR,aAAa,AANZ,CAEA,EAFQ,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAMP,EACzB,OAAO,AALN,CACF,EADU,MAKG,QAoBb;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAJ5B,MAI4B,EAAE,QAAQ,EAHtC,MAGsC,EAAE,OAAO,AAFvD,CACF,EADU,MAEoD,UAmK9D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAH1C,MAG0C,GAFxC,MAAM,EAAE,CAoEpB"}
+{"version":3,"file":"gradleutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/gradleutils.js"],"names":[],"mappings":"AA0BA,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AA4BpE,OAAO,EAAE,uBAAuB,EAAE,CAAC;AAEnC;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAJ7B,MAI6B,EAAE,QAAQ,EAHvC,MAAM,GAAC,IAGgC,EAAE,OAAO,AAFxD,CACF,EADU,MAEqD,UAiG/D;AA4FD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAH3B,MAG2B,GAFzB,MAAM,EAAE,CAKpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,eAAe,EARN,MAAM,EAQA,EACf,iBAAiB,EARR,MAAM,EAQE,EACjB,yBAAyB,EARhB,MAAM,EAQU,EACzB,mBAAmB,EARV,GAQU,GANR,MAAM,EAAE,CAoDpB;AAuCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EAPJ,GAAG,CAAC,MAAM,EAAE,MAAM,CAOd,EACb,aAAa,EAPJ,MAOI,EACb,aAAa,EAPJ,MAOI,EACb,aAAa,GAPJ,MAAM,EAOG,GANP,MAAM,EAAE,CAkBpB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAJ1C,MAI0C,EAAE,aAAa,EAHzD,MAAM,EAGmD,GAFvD,GAAG,CA0Cf;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAFlC,MAEkC;;;EA8C5C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAJpC,MAIoC,EAAE,gBAAgB,GAHtD,MAG6D,GAF3D;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAA;CAAC,CA0D9F;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAPM,MAON,EACH,cAAc,EAPL,KAOK,EACd,SAAS,GAPA,KAOK,EACd,OAAO,KAAK,GAND,MAAM,CAuGlB;AAiBD;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAF3B,IAAI,CAKhB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAF7B,OAAO,CAInB;AAiGD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EANzC,MAMyC,EAAE,OAAO,GAJ1D;IAAyB,OAAO,AAAhC,CACA,EADQ,MAAM,CACd;IAAyB,aAAa,AAAtC,CACA,EADQ,MAAM,CACd;CAE+D,GAFrD,IAAI,CA+HhB;AAgTD;;;;;;;;;;;GAWG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAPE,QAAQ,CAAC,MAAM,CAOjB,EACP,aAAa,eAAA,EACb,cAAc,EAPL,MAOK,EACd,OAAO,GAPE,MAOG,GAND,OAAO,CAAC,MAAM,EAAE,CAAC,CAoD7B;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAJtC,MAAM,EAIgC,EAAE,aAAa,EAHrD,GAAG,CAAC,MAAM,EAAE,MAAM,CAGmC,GAFnD,MAAM,EAAE,CAUpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAHtC,MAAM,EAGgC,GAFpC,MAAM,EAAE,CA0CpB;AA4DD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,cAAc,CAClC,SAAS,EARA,MAQA,EACT,eAAe,GARN,MAQe,EACxB,aAAa,GARJ,GAQgB,EACzB,cAAc,GARL,MAQU,EACnB,gBAAgB,AARf,CACA,EADQ,GAAG,CAAC,MAAM,CAQS,GAPjB;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,EAAE,CAsQ9D;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,QAAQ,EAHpD,MAGoD,GAFlD,MAAM,CAkDlB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,gBAAgB,EAHjD,MAGiD,GAF/C,MAAM,CAkBlB;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAH5C,MAG4C,GAF1C,MAAM,CAuBlB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAHtC,MAGsC,GAFpC,MAAM,CA8ClB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAPD,MAOC,EACV,SAAS,EAPA,MAOA,EACT,QAAQ,GAPC,OAOM,EAAE,qCAAqC;AACtD,gBAAgB,GAPP,OAOe,GANb,OAAO,CAAC,MAAM,CAAC,CAgC3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,EAAE,OAAO,AAF5C,CACF,EADU,MAEyC,UAiBnD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,YAAY,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,MAAM,GAAC,IAAI,CA4BvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAJ7B,MAI6B,GAH3B,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CA2DpC;AAqBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EANC,MAMD,EACR,aAAa,AANZ,CAEA,EAFQ,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAMP,EACzB,OAAO,AALN,CACF,EADU,MAKG,QAoBb;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAJ5B,MAI4B,EAAE,QAAQ,EAHtC,MAGsC,EAAE,OAAO,AAFvD,CACF,EADU,MAEoD,UAmK9D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAH1C,MAG0C,GAFxC,MAAM,EAAE,CAoEpB;AAoKD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EALjC,MAKiC,EAAE,OAAO,AAJlD,CAEA,EADA;IAAyB,OAAO,AAAhC,CACA,EADQ,MAAM,CACd;CAEuD,GAF7C,MAAM,EAAE,CA0HpB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAJnC,MAAM,EAI6B,EAAE,OAAO,AAHpD,CACA,EADQ,MAGiD,GAF/C,MAAM,EAAE,CAuBpB;AAcD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAIiC,EAAE,OAAO,AAHlD,CACA,EADQ,MAG+C,GAF7C,MAAM,EAAE,CA0CpB;AAQD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,cAAc,EAJ7C,MAI6C,GAH3C,MAAM,GAAC,SAAS,CA0D5B;AA8KD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,+BAA+B,CAAC,YAAY,EANjD,MAMiD,EAAE,OAAO,AALlE,CAEA,EADA;IAAyB,OAAO,AAAhC,CACA,EADQ,MAAM,CACd;CAGuE,GAH7D;IAAC,aAAa,EAAE;QAAC,cAAc,EAAE,CAAC,OAAO,GAAC,SAAS,CAAC,CAAC;QAAC,gBAAgB,EAAE,CAAC,OAAO,GAAC,SAAS,CAAC,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,wBAAwB,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAC,CAAC;IAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE;gBAAC,GAAG,EAAE,MAAM,CAAC;gBAAC,OAAO,EAAE,MAAM,CAAA;aAAC,EAAE,CAAC;YAAC,SAAS,EAAE,MAAM,EAAE,CAAA;SAAC,EAAE,CAAA;KAAC,CAAC,CAAA;CAAC,GAAC,SAAS,CA4N/a;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAAC,cAAc,EAHlD,MAGkD,GAFhD,MAAM,GAAC,SAAS,CAmB5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAJ7C,MAI6C,EAAE,QAAQ,EAHvD,OAGuD,GAFrD,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EARE,MAAM,EAQR,EACP,QAAQ,EARC,MAQD,EACR,YAAY,EAPH,MAOG,GALD,MAAM,CA2GlB"}

package/types/lib/ecosystems/jsEvidence.d.ts

@@ -9,12 +9,25 @@
  * from configuration, bundler entrypoints, stylesheets, or plugins, so a
  * missing import is not evidence that a package is optional.
  *
+ * When the lock file holds several versions of a package, an import is
+ * evidence only for the version the importing file resolves to (see
+ * `createNpmVersionChooser`), so a copy nested under another package is not
+ * credited with, or promoted to required by, the project's own imports.
+ *
  * @param {Array<object>} pkgList Package components to enrich.
  * @param {object} allImports Map of import specifier to usage evidence objects.
  * @param {object} allExports Map of export specifier to export evidence objects.
  * @param {boolean} deep When true, fill in missing description/author/license
  *   metadata from the local node_modules copy of each package.
+ * @param {object} [context] Project facts that pick the version a file uses.
+ * @param {string} [context.srcDir] Directory the evidence file names are relative to.
+ * @param {Array<object>} [context.dependencies] Dependency tree of the packages.
+ * @param {object} [context.parentComponent] Project component, with any workspace members as its components.
  * @returns {Promise<Array<object>>} The enriched package list (same reference as pkgList).
  */
-export declare function addEvidenceForImports(pkgList: Array<object>, allImports: object, allExports: object, deep: boolean): Promise<Array<object>>;
+export declare function addEvidenceForImports(pkgList: Array<object>, allImports: object, allExports: object, deep: boolean, context?: {
+    srcDir?: string;
+    dependencies?: Array<object>;
+    parentComponent?: object;
+}): Promise<Array<object>>;
 //# sourceMappingURL=jsEvidence.d.ts.map

package/types/lib/ecosystems/jsEvidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jsEvidence.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/jsEvidence.js"],"names":[],"mappings":"AAyLA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EARE,KAAK,CAAC,MAAM,CAQd,EACP,UAAU,EARD,MAQC,EACV,UAAU,EARD,MAQC,EACV,IAAI,EARK,OAQL,GANO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CA+KlC"}
+{"version":3,"file":"jsEvidence.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/jsEvidence.js"],"names":[],"mappings":"AAsMA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAZE,KAAK,CAAC,MAAM,CAYd,EACP,UAAU,EAZD,MAYC,EACV,UAAU,EAZD,MAYC,EACV,IAAI,EAZK,OAYL,EACJ,OAAO,AAXN,CAIA,EAHA;IAAyB,MAAM,AAA/B,CACA,EADQ,MAAM,CACd;IAAgC,YAAY,AAA5C,CACA,EADQ,KAAK,CAAC,MAAM,CAAC,CACrB;IAAyB,eAAe,AAAxC,CACA,EADQ,MAAM,CACd;CAOW,GAPD,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CA6MlC"}

package/types/lib/ecosystems/kosi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kosi.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/kosi.js"],"names":[],"mappings":"AAqCA;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,eAAe,EAH3C,MAAM,GAAC,SAGoC,GAFzC,MAAM,GAAC,SAAS,CAwB5B;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,KAAA,WAE5C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,QAQ3B;AA6DD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,GAHpC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAkE5B;AA0BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,KAAA,EAAE,SAAS,KAAA,OA4B/C;AAusBD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,KAAK,EAAE,WAAW,KAAK,MAsEpE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,GAJvC,MAI4C,EAAE,WAAW,GAHzD,MAG8D,GAF5D,MAAM,CAoFlB;AAiCD,wBAAgB,mBAAmB,CAAC,UAAU,KAAK,EAAE,UAAU,QAAK;;;;;;;EA2DnE"}
+{"version":3,"file":"kosi.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/kosi.js"],"names":[],"mappings":"AAsCA;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,eAAe,EAH3C,MAAM,GAAC,SAGoC,GAFzC,MAAM,GAAC,SAAS,CAwB5B;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,KAAA,WAE5C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,QAQ3B;AA6DD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,GAHpC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAkE5B;AA0BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,KAAA,EAAE,SAAS,KAAA,OA4B/C;AAosBD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,KAAK,EAAE,WAAW,KAAK,MAsEpE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,GAJvC,MAI4C,EAAE,WAAW,GAHzD,MAG8D,GAF5D,MAAM,CAoFlB;AAiCD,wBAAgB,mBAAmB,CAAC,UAAU,KAAK,EAAE,UAAU,QAAK;;;;;;;EA2DnE"}

package/types/lib/ecosystems/npmVersionResolution.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Full npm package name (`@scope/name` or `name`) of a component or manifest.
+ *
+ * @param {{group?: string, name?: string}} pkg Component or parsed manifest
+ * @returns {string} The package name npm installs it under
+ */
+export declare function npmPackageName({ group, name }: {
+    group?: string;
+    name?: string;
+}): string;
+/**
+ * Full npm package name of an npm purl.
+ *
+ * @param {string} purl Package URL
+ * @returns {string|undefined} `@scope/name` or `name`; undefined for a purl that is not npm or does not parse
+ */
+export declare function npmPackageNameOfPurl(purl: string): string | undefined;
+/**
+ * Directory a package-lock component is installed in.
+ *
+ * `internal:LocalNodeModulesPath` holds the arborist location, relative to the
+ * root of the tree: `node_modules/a/node_modules/b` for a nested copy and
+ * `packages/web/node_modules/b` for a copy under a workspace member. The
+ * component's `internal:SrcFile` names a `package-lock.json` in the directory
+ * that holds the location's first `node_modules` segment, so the install
+ * directory is that location's `node_modules/...` part resolved against the
+ * SrcFile's directory. A location without a `node_modules` segment (a
+ * workspace member itself) and an absolute location (pnpm metadata found by
+ * searching node_modules) name no install a file resolves to.
+ *
+ * @param {Object} pkg Package component
+ * @returns {string|undefined} Absolute install directory
+ */
+export declare function npmInstallDirectory(pkg: Object): string | undefined;
+/**
+ * References the given root components depend on directly.
+ *
+ * @param {Array<{ref: string, dependsOn?: string[]}>} dependencies Dependency tree
+ * @param {Iterable<string>} rootRefs bom-refs of the project and its workspace members
+ * @returns {Set<string>} bom-refs of their direct dependencies
+ */
+export declare function directDependencyRefs(dependencies: Array<{
+    ref: string;
+    dependsOn?: string[];
+}>, rootRefs: Iterable<string>): Set<string>;
+/**
+ * The direct dependencies that apply to a project file, nearest first.
+ *
+ * A file inside an npm workspace member (a component with
+ * `cdx:npm:isWorkspace=true` and its directory in `cdx:npm:resolvedPath`,
+ * relative to the project) depends first on what that member declares, then
+ * on what the project root declares, since Node.js finds the root's hoisted
+ * copies from inside a member too. Any other file depends on the root's.
+ *
+ * @param {Object[]} components Components or package list
+ * @param {Object[]} dependencies Dependency tree
+ * @param {string[]} rootRefs bom-refs of the project and the sub-components it lists
+ * @returns {function(string): Set<string>[]} Lookup from a file name, relative to the project, to sets of bom-refs
+ */
+export declare function createDirectDependencyLookup(components: Object[], dependencies: Object[], rootRefs: string[]): Function;
+/**
+ * bom-refs of a parent component and the sub-components it lists, which are
+ * the roots whose direct dependencies a project's own files use.
+ *
+ * @param {Object} parentComponent Parent (metadata) component
+ * @returns {string[]} bom-refs
+ */
+export declare function projectRootRefs(parentComponent: Object): string[];
+/**
+ * Decide which installed versions of an npm package a project file uses.
+ *
+ * Only package names with more than one version in `pkgList` are decided; a
+ * file uses the single version of any other package. For the rest, the file
+ * uses:
+ *
+ * 1. the copy Node.js resolves from the file's directory, when the lock file
+ *    records install locations (package-lock.json): the first
+ *    `<dir>/node_modules/<name>` holding one of the versions, walking up from
+ *    the file;
+ * 2. otherwise the versions the file's workspace member, or else the project,
+ *    depends on directly (see `createDirectDependencyLookup`);
+ * 3. otherwise every version, since nothing tells them apart.
+ *
+ * @param {Object[]} pkgList Package components, duplicates per install location included
+ * @param {Object} [context] Project facts
+ * @param {string} [context.srcDir] Directory the file names are relative to
+ * @param {Object[]} [context.dependencies] Dependency tree
+ * @param {string[]} [context.rootRefs] bom-refs of the project and the sub-components it lists
+ * @returns {{isAmbiguous: function(Object): boolean, allows: function(Object, string): boolean}} Chooser
+ */
+export declare function createNpmVersionChooser(pkgList: Object[], context?: {
+    srcDir?: string;
+    dependencies?: Object[];
+    rootRefs?: string[];
+}): {
+    isAmbiguous: Function;
+    (Object: any): boolean;
+    allows: Function;
+    (Object: any, string: any): boolean;
+};
+/**
+ * Keep each npm occurrence only on the versions the project file uses.
+ *
+ * evinse credits a slice record to every component of the record's package,
+ * one per installed version. For a package with several versions in the BOM,
+ * an occurrence in file F stays on a version when the input BOM's own import
+ * evidence (seeded before any slice is read) puts that version in F; when the
+ * BOM credits none of the versions in F, or several, the versions F's
+ * workspace member or else the project depends on directly are kept (see
+ * `createDirectDependencyLookup`); failing both, all stay.
+ *
+ * @param {Object} purlLocationMap purl -> Set of occurrence keys, changed in place
+ * @param {Object} purlSymbolMap purl -> occurrence key -> symbol, changed in place
+ * @param {Object} seededLocationMap purl -> Set of occurrence keys the input BOM carried
+ * @param {Object} bomJson Input BOM, for its components, dependencies and metadata component
+ * @returns {Set<string>} purls left with no occurrence, whose input occurrences belong to another version
+ */
+export declare function keepResolvedNpmVersions(purlLocationMap: Object, purlSymbolMap: Object, seededLocationMap: Object, bomJson: Object): Set<string>;
+//# sourceMappingURL=npmVersionResolution.d.ts.map

package/types/lib/ecosystems/npmVersionResolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npmVersionResolution.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/npmVersionResolution.js"],"names":[],"mappings":"AAeA;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAHnC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAGK,GAFjC,MAAM,CAKlB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B,MAAM,GAAC,SAAS,CAc5B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CAuB5B;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAJtC,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CAAC,CAIH,EAAE,QAAQ,EAHhD,QAAQ,CAAC,MAAM,CAGiC,GAF9C,GAAG,CAAC,MAAM,CAAC,CAavB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAC1C,UAAU,EAND,MAAM,EAML,EACV,YAAY,EANH,MAAM,EAMH,EACZ,QAAQ,EANC,MAAM,EAMP,YAqCT;AAqBD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,eAAe,EAHpC,MAGoC,GAFlC,MAAM,EAAE,CAMpB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAPpC,MAAM,EAO8B,EAAE,OAAO,AANrD,CAIA,EAHA;IAAyB,MAAM,AAA/B,CACA,EADQ,MAAM,CACd;IAA2B,YAAY,AAAvC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,QAAQ,AAAnC,CACA,EADQ,MAAM,EAAE,CAChB;CAE0D,GAFhD;IAAC,WAAW,WAAU;IAAA,CAAC,MAAM,KAAA,GAAG,OAAO,CAAC;IAAC,MAAM,WAAU;IAAA,CAAC,MAAM,KAAA,EAAE,MAAM,KAAA,GAAG,OAAO,CAAA;CAAC,CAwE/F;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CACrC,eAAe,EAPN,MAOM,EACf,aAAa,EAPJ,MAOI,EACb,iBAAiB,EAPR,MAOQ,EACjB,OAAO,EAPE,MAOF,GANI,GAAG,CAAC,MAAM,CAAC,CAyEvB"}