@cdxgen/cdxgen 13.6.0 → 13.7.0

package/types/lib/helpers/vsixutils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vsixutils.d.ts","sourceRoot":"","sources":["../../../lib/helpers/vsixutils.js"],"names":[],"mappings":"AAmBA;;GAEG;AACH,eAAO,MAAM,0BAA0B,qBAAqB,CAAC;AAO7D;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB;;;IA8LlC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAH3B,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,CAc9C;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAwH5B;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAJnC,MAImC,EAAE,aAAa,EAHlD,MAGkD,GAFhD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CAmE5D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,eAAe,EAJzC,MAAM,GAAC,MAIkC,EAAE,OAAO,AAH1D,CACA,EADQ,MAGkD,GAFhD,MAAM,GAAC,SAAS,CAsC5B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAHrC,MAGqC,GAFnC,MAAM,CA+GlB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAJxB,MAIwB,EAAE,OAAO,AAHzC,CACA,EADQ,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAwK5B;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAmCrC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAF3B,MAE2B,QAwBrC;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAkErC;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAJtC,MAIsC,EAAE,OAAO,AAHvD,CACA,EADQ,MAG+C,GAF7C,MAAM,GAAC,SAAS,CAkC5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAJjC,MAIiC,EAAE,OAAO,AAHlD,CACA,EADQ,MAG0C,GAFxC,MAAM,GAAC,SAAS,CAyC5B;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAHvC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAGM,GAFrC,MAAM,EAAE,CA8BpB"}
+{"version":3,"file":"vsixutils.d.ts","sourceRoot":"","sources":["../../../lib/helpers/vsixutils.js"],"names":[],"mappings":"AA+BA;;GAEG;AACH,eAAO,MAAM,0BAA0B,qBAAqB,CAAC;AAO7D;;;GAGG;AACH,eAAO,MAAM,kBAAkB,eAAe,CAAC;AAE/C;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY;;;;;;QAOnB,MAAM;QACN,KAAK;QAKL,KAAK;;;;;;;;;;;;IAkLV,CAAC;AAqGF;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,AAJrC,CACA,EADQ,MAIyC,GAHvC,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CAyC3E;AAsBD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,AAJ1C,CACA,EADQ,MAI8C,GAH5C,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,CAAC,CAsBtF;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,aAAa,EAL/C,MAK+C,GAJ7C;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CA2D5E;AAwED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAL9B,MAK8B,GAJ5B,MAAM,GAAC,SAAS,CAiC5B;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAV3B;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAUE,EAAE,IAAI,AATzC,CACA,EADQ,MAS6C,EAAE,OAAO,AAR9D,CAKA,EAJA;IAA0B,SAAS,AAAnC,CAEA,EAFQ,OAAO,CAEf;IAA2B,OAAO,AAAlC,CAEA,EAFQ,MAAM,EAAE,CAEhB;CAGmE,GAHzD,MAAM,GAAC,SAAS,CAmD5B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAwH5B;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAJnC,MAImC,EAAE,aAAa,EAHlD,MAGkD,GAFhD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CAmE5D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,eAAe,EAJzC,MAAM,GAAC,MAIkC,EAAE,OAAO,AAH1D,CACA,EADQ,MAGkD,GAFhD,MAAM,GAAC,SAAS,CA2C5B;AAqBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAHrC,MAGqC,GAFnC,MAAM,CAqHlB;AAkBD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAJxB,MAIwB,EAAE,OAAO,AAHzC,CACA,EADQ,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAqK5B;AAaD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,OAAO,CAYnB;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAsCrC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAF3B,MAE2B,QAwBrC;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA+ErC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,+BAA+B,CAAC,aAAa,EALlD,MAKkD,GAJhD;IAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAC,CAwCvF;AAKD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EANnC,MAMmC,EAAE,OAAO,EAL5C;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAKY,GAH1C,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,CAAC,CAsC7E;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EALvC,MAKuC,EAAE,YAAY,EAJrD,MAIqD,EAAE,SAAS,EAHhE,MAGgE,GAF9D,MAAM,EAAE,CAMpB;AAmJD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EATG,MASH,EACN,OAAO,AATN,CACA,EADQ,MASF,EACP,aAAa,AATZ,CACA,EADQ,MASI,EACb,OAAO,AATN,CAGA,EAFA;IAA0B,QAAQ,AAAlC,CAEA,EAFQ,OAAO,CAEf;CAMW,GAND,MAAM,GAAC,SAAS,CA6D5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAJjC,MAIiC,EAAE,OAAO,AAHlD,CACA,EADQ,MAG0C,GAFxC,MAAM,GAAC,SAAS,CAuB5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAHjC,MAGiC,GAF/B,OAAO,CAUnB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAHhC,MAGgC,GAF9B,OAAO,CAenB;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EANvB;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAM9D,EAAE,WAAW,AAJ5C,CACA,EADQ,MAIoC,EAAE,cAAc,EAHpD,MAGoD,GAFlD,MAAM,CA2DlB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAXhC,KAAK,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAC,CAWjF,EAAE,OAAO,AAPjD,CAKA,EAJA;IAA0B,oBAAoB,AAA9C,CAEA,EAFQ,OAAO,CAEf;IAAyB,IAAI,AAA7B,CACA,EADQ,MAAM,CACd;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;CAEsD,GAF5C;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAqC1D;AA0JD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAHvC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAGM,GAFrC,MAAM,EAAE,CAKpB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAHxC,MAAM,EAGkC,GAFtC,MAAM,EAAE,CAoBpB;AA6CD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EATpC,MAAM,EAS8B,EAAE,OAAO,AARrD,CAMA,EALA;IAA2B,KAAK,AAAhC,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,IAAI,AAA7B,CAEA,EAFQ,MAAM,CAEd;IAAgC,OAAO,AAAvC,CAEA,EAFQ,KAAK,CAAC,MAAM,CAAC,CAErB;CAE0D,GAFhD,MAAM,EAAE,CA2CpB"}

package/types/lib/inventory/agentBlueprint.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Declared coding-agent behaviour at CycloneDX 2.0 (cdxgen/cdxgen#4593).
+ *
+ * The source is the AI inventory the 1.x parsers already produce
+ * (communityAiConfigParser: Kiro agents, Claude subagents and agent
+ * definitions). Only real agent definitions count: a component with a
+ * `cdx:agent:role`, or whose `cdx:file:kind` is `agent-definition` or
+ * `claude-subagent`. Instruction files, specs, steering documents, agent
+ * configs and plugins describe or configure agents but are not agents.
+ * At 2.0 this module derives:
+ *
+ * - one party per agent component with a bom-ref
+ *   (#/$defs/cyclonedx-party-2.0/$defs/party, role `agent`) whose `system`
+ *   (#/$defs/cyclonedx-party-2.0/$defs/system) has kind `agent`, `ref` the
+ *   agent component's refId, `label` its name and `permissions` the tool
+ *   names its config allows. The allow list is split on the commas outside
+ *   parentheses, and each entry is reduced to the tool name before any "("
+ *   (`Bash(git status:*)` is `Bash`), so arguments, paths and commands
+ *   never reach the BOM. Names that are not safe tool names are dropped
+ *   (see lib/inventory/agentToolNames.js). The list is unique and sorted.
+ *
+ * - one blueprint (#/$defs/cyclonedx-blueprint-2.0/$defs/blueprint,
+ *   modelTypes `behavioral`) whose actors reference the agent parties and
+ *   whose behaviors.instances carry `acknowledgment: ["declared"]` and a
+ *   `behavior` from data/behavior-taxonomy.schema.json:
+ *   `ai:agent:invokesTool` when the agent declares tools or MCP servers, and
+ *   `ai:agent:requestsUserApproval` when its permission policy has ask rules.
+ *   The inventory records only how many MCP servers an agent's own config
+ *   names, not which, so instances carry no `targets`: naming the project's
+ *   MCP services would claim a binding no config makes.
+ *
+ * No free text from instruction, skill or MCP files is emitted. Business
+ * objectives and use cases are free text, so they are out of scope, and so
+ * is observed behaviour.
+ */
+/** refId of the derived blueprint. */
+export declare const AGENT_BLUEPRINT_REF_ID = "blueprint-declared-agents";
+/** Prefix of every derived agent party refId. */
+export declare const AGENT_PARTY_REF_ID_PREFIX = "party-agent-";
+/**
+ * Is this internal-model component a real coding-agent definition?
+ *
+ * @param {object} component Internal-model component
+ * @returns {boolean} True for a `cdx:agent:role` component or an
+ *   agent-definition / claude-subagent file
+ */
+export declare function isDeclaredAgentComponent(component: object): boolean;
+/**
+ * The permissions of an agent: the tool names of `cdx:agent:tools` and the
+ * scopes of `cdx:agent:permissionCapabilities`, each reduced to the name
+ * before any "(", unique and sorted.
+ *
+ * @param {object} component Internal-model agent component
+ * @returns {string[]} Permission names
+ */
+export declare function declaredAgentPermissions(component: object): string[];
+/**
+ * Collect the 2.0 agent parties and the behavioral blueprint for the
+ * declared agents of an internal-model BOM. Agents without a bom-ref are
+ * skipped (their party could not point at them); parties are unique by
+ * refId.
+ *
+ * @param {object} internalBom The 1.x-shaped internal model
+ * @returns {{parties: object[], blueprint: object|undefined}}
+ */
+export declare function collectAgentBehaviour(internalBom: object): {
+    parties: object[];
+    blueprint: object | undefined;
+};
+//# sourceMappingURL=agentBlueprint.d.ts.map

package/types/lib/inventory/agentBlueprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentBlueprint.d.ts","sourceRoot":"","sources":["../../../lib/inventory/agentBlueprint.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAQH,sCAAsC;AACtC,eAAO,MAAM,sBAAsB,8BAA8B,CAAC;AAClE,iDAAiD;AACjD,eAAO,MAAM,yBAAyB,iBAAiB,CAAC;AAuBxD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAJvC,MAIuC,GAHrC,OAAO,CAcnB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,EAAE,CAYpB;AAyCD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAHtC,MAGsC,GAFpC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,GAAC,SAAS,CAAA;CAAC,CAsC5D"}

package/types/lib/inventory/agentToolNames.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Tool allow lists of coding-agent configurations, reduced to tool names.
+ *
+ * An allow list such as `Read, Bash(git status:*), Bash(curl -u user,secret)`
+ * carries commands, paths and sometimes credentials inside its parentheses.
+ * Only the tool name before any "(" is kept, so nothing an entry scopes its
+ * tool to reaches a BOM. The list is split on the commas outside parentheses,
+ * so the arguments of one entry never become entries of their own.
+ *
+ * A tool name is at most 64 characters of letters, digits and `_ - . : *`
+ * (`Read`, `mcp__github__*`, `fs_write`), optionally in the `@server/tool`
+ * form Kiro uses. A name that looks like a credential (a known token prefix
+ * such as `ghp_` or `AKIA`, or a long run of letters and digits with no
+ * separator) is dropped.
+ */
+/**
+ * Split an allow list on the commas outside parentheses. An array is taken
+ * as already split.
+ *
+ * @param {string|string[]|undefined} value Allow list
+ * @returns {string[]} Trimmed, non-empty entries
+ */
+export declare function splitAllowList(value: string | string[] | undefined): string[];
+/**
+ * The tool name of one allow-list entry, or undefined when it is not a safe
+ * tool name.
+ *
+ * @param {string} entry Allow-list entry
+ * @returns {string|undefined} Tool name
+ */
+export declare function agentToolName(entry: string): string | undefined;
+/**
+ * The unique, sorted tool names of an allow list.
+ *
+ * @param {string|string[]|undefined} value Allow list
+ * @returns {string[]} Tool names
+ */
+export declare function agentToolNames(value: string | string[] | undefined): string[];
+/**
+ * An allow list as cdxgen records it in `cdx:agent:tools` and
+ * `cdx:agent:disallowedTools`: each entry reduced to its tool name, written
+ * `Name(...)` when the entry scoped the tool with arguments, so a scoped
+ * `Bash(git status:*)` stays distinguishable from an unrestricted `Bash`
+ * without copying the scope. Unique, in the order the config lists them,
+ * comma separated.
+ *
+ * @param {string|string[]|undefined} value Allow list
+ * @returns {string|undefined} Summary, or undefined when nothing is left
+ */
+export declare function summarizeAgentToolList(value: string | string[] | undefined): string | undefined;
+//# sourceMappingURL=agentToolNames.d.ts.map

package/types/lib/inventory/agentToolNames.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentToolNames.d.ts","sourceRoot":"","sources":["../../../lib/inventory/agentToolNames.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAyBH;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAHzB,MAAM,GAAC,MAAM,EAAE,GAAC,SAGS,GAFvB,MAAM,EAAE,CAyBpB;AAmBD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAHxB,MAGwB,GAFtB,MAAM,GAAC,SAAS,CAiB5B;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAHzB,MAAM,GAAC,MAAM,EAAE,GAAC,SAGS,GAFvB,MAAM,EAAE,CAMpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAHjC,MAAM,GAAC,MAAM,EAAE,GAAC,SAGiB,GAF/B,MAAM,GAAC,SAAS,CAW5B"}

package/types/lib/inventory/aiCollector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aiCollector.d.ts","sourceRoot":"","sources":["../../../lib/inventory/aiCollector.js"],"names":[],"mappings":"AAu8DA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAJvC,MAIuC,EAAE,OAAO,AAHxD,CACA,EADQ,MAGqD,GAFnD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CA2YhF;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAAC,aAAa,EAJpD,MAIoD,EAAE,OAAO,AAHrE,CACA,EADQ,MAGkE,GAFhE;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAiMhF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,aAAa,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,aAAa,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,aAAa,EAJjD,MAIiD,EAAE,OAAO,AAHlE,CACA,EADQ,MAG+D,GAF7D;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF"}
+{"version":3,"file":"aiCollector.d.ts","sourceRoot":"","sources":["../../../lib/inventory/aiCollector.js"],"names":[],"mappings":"AAslEA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAJvC,MAIuC,EAAE,OAAO,AAHxD,CACA,EADQ,MAGqD,GAFnD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CA8YhF;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAAC,aAAa,EAJpD,MAIoD,EAAE,OAAO,AAHrE,CACA,EADQ,MAGkE,GAFhE;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAiMhF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,aAAa,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,aAAa,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,aAAa,EAJjD,MAIiD,EAAE,OAAO,AAHlE,CACA,EADQ,MAG+D,GAF7D;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF"}

package/types/lib/inventory/aiInventory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aiInventory.d.ts","sourceRoot":"","sources":["../../../lib/inventory/aiInventory.js"],"names":[],"mappings":"AAgBA,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,UAA4B,CAAC;AACpE;;;GAGG;AACH,eAAO,MAAM,yBAAyB,aAapC,CAAC;AACH,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,eAAe,CAAC;AAC/C,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAqEjD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAJnC,MAImC,EAAE,IAAI,EAHzC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAI5B;AAYD;;;;;;GAMG;AACH,wBAAgB,oCAAoC,CAAC,WAAW,EAJrD,MAAM,GAAC,MAAM,EAAE,GAAC,SAIqC,EAAE,IAAI,EAH3D,MAG2D,GAFzD,OAAO,CAkBnB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAHrC,MAGqC,GAFnC,MAAM,EAAE,CAiCpB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAJnC,MAImC,EAAE,IAAI,EAHzC,MAGyC,GAFvC,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAJ1C,MAI0C,EAAE,IAAI,EAHhD,MAGgD,GAF9C,OAAO,CAiBnB;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAJ5C,MAAM,EAIsC,EAAE,KAAK,EAHnD,MAAM,EAG6C,GAFjD,MAAM,EAAE,CAYpB;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,YAAY,EANH,MAAM,EAMH,EACZ,UAAU,EAND,MAAM,EAML,EACV,QAAQ,EANC,MAAM,EAMP,GALG,MAAM,EAAE,CAgCpB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EALrC,MAKqC,EAAE,OAAO,EAJ9C,MAI8C,EAAE,KAAK,EAHrD,MAAM,EAG+C,GAFnD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAyFhF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EATnC;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAST,GARjC;IACR,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CA+BH"}
+{"version":3,"file":"aiInventory.d.ts","sourceRoot":"","sources":["../../../lib/inventory/aiInventory.js"],"names":[],"mappings":"AAgBA,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,UAA4B,CAAC;AACpE;;;GAGG;AACH,eAAO,MAAM,yBAAyB,aAapC,CAAC;AACH,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,eAAe,CAAC;AAC/C,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,eAAe,CAAC;AA+EjD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAJnC,MAImC,EAAE,IAAI,EAHzC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAI5B;AAYD;;;;;;GAMG;AACH,wBAAgB,oCAAoC,CAAC,WAAW,EAJrD,MAAM,GAAC,MAAM,EAAE,GAAC,SAIqC,EAAE,IAAI,EAH3D,MAG2D,GAFzD,OAAO,CAkBnB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAHrC,MAGqC,GAFnC,MAAM,EAAE,CAiCpB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAJnC,MAImC,EAAE,IAAI,EAHzC,MAGyC,GAFvC,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAJ1C,MAI0C,EAAE,IAAI,EAHhD,MAGgD,GAF9C,OAAO,CAiBnB;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAJ5C,MAAM,EAIsC,EAAE,KAAK,EAHnD,MAAM,EAG6C,GAFjD,MAAM,EAAE,CAYpB;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,YAAY,EANH,MAAM,EAMH,EACZ,UAAU,EAND,MAAM,EAML,EACV,QAAQ,EANC,MAAM,EAMP,GALG,MAAM,EAAE,CAgCpB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EALrC,MAKqC,EAAE,OAAO,EAJ9C,MAI8C,EAAE,KAAK,EAHrD,MAAM,EAG+C,GAFnD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAmHhF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EATnC;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAST,GARjC;IACR,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CA+BH"}

package/types/lib/inventory/aiProviders.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Organisations that create AI models, keyed by the short creator id cdxgen
+ * uses internally. The value is the full organisation name written to the
+ * `manufacturer` of a model component, since the minimum elements guidance
+ * asks for full names rather than acronyms or product names.
+ */
+export declare const MODEL_CREATOR_NAMES: Map<string, string>;
+/**
+ * Local runtimes and inference servers. They serve whatever tag or served
+ * model name the user chose, so a model they run names no creator.
+ */
+export declare const LOCAL_MODEL_RUNTIMES: Set<string>;
+/**
+ * Split a model reference written in source code into the route provider it
+ * names, if any, and the model name a creator lookup should read.
+ *
+ * `groq/llama3-8b-8192` names the groq route and the model `llama3-8b-8192`.
+ * `models/gemini-1.5-flash`, `tunedModels/x` and
+ * `projects/p/locations/l/publishers/google/models/gemini-1.5-pro` are Google
+ * API resource names, and the model is the part after the last `models`
+ * segment. Neither form is a Hugging Face repository id.
+ *
+ * @param {string} modelId Model reference as written in the source
+ * @returns {{ name: string, nonHub: boolean, route?: string, routeProvider?: string }}
+ *   The model name, whether the reference is not a Hub repository id, and the
+ *   route and its provider when one is named
+ */
+export declare function splitModelReference(modelId: string): {
+    name: string;
+    nonHub: boolean;
+    route?: string;
+    routeProvider?: string;
+};
+/**
+ * Name the creator of a model from its name alone, when only one creator
+ * publishes under that name.
+ *
+ * @param {string} modelName Model name without route or namespace
+ * @returns {string|undefined} Creator id
+ */
+export declare function modelCreatorFromName(modelName: string): string | undefined;
+/**
+ * Resolve a creator spelling, such as a Hugging Face organisation or a
+ * GGUF general.organization value, to a known creator id.
+ *
+ * @param {string} name Organisation name or namespace
+ * @returns {string|undefined} Creator id, or undefined when unknown
+ */
+export declare function modelCreatorFromOrganization(name: string): string | undefined;
+/**
+ * Pick the creator of a model that source code calls by name.
+ *
+ * The provider of such a model is the SDK, AI host or route the code uses,
+ * which names the client rather than the model: the openai SDK is the usual
+ * client for self-hosted Llama or DeepSeek servers, and a file may use
+ * several SDKs. So the creator is the one the model name names, when the
+ * provider is that creator, is a hosting or routing service, or the file
+ * also uses the creator's own SDK or host. A different creator's SDK leaves
+ * it unset. A model name that names no creator is credited only to a
+ * provider whose own API serves nothing but its own models. A local runtime
+ * serves whatever tag the user created, so it names no creator, and neither
+ * does a file that only uses a local runtime.
+ *
+ * @param {string} modelId Model reference as written in the source
+ * @param {{ provider?: string, fileProviders?: Iterable<string>, runtimes?: Iterable<string> }} [context]
+ *   The provider the code declares through an SDK import, AI host or dosai
+ *   report (never a guess from the model name), every provider the file
+ *   references, and the runtimes it uses
+ * @returns {string|undefined} Creator id
+ */
+export declare function resolveModelCreator(modelId: string, context?: {
+    provider?: string;
+    fileProviders?: Iterable<string>;
+    runtimes?: Iterable<string>;
+}): string | undefined;
+/**
+ * Build the CycloneDX organisational entity for a creator id.
+ *
+ * @param {string} creator Creator id
+ * @returns {{ name: string }|undefined} Manufacturer entity
+ */
+export declare function modelCreatorEntity(creator: string): {
+    name: string;
+} | undefined;
+//# sourceMappingURL=aiProviders.d.ts.map

package/types/lib/inventory/aiProviders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aiProviders.d.ts","sourceRoot":"","sources":["../../../lib/inventory/aiProviders.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,qBAW9B,CAAC;AAmCH;;;GAGG;AACH,eAAO,MAAM,oBAAoB,aAY/B,CAAC;AAqHH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EALhC,MAKgC,GAJ9B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,CA4BrF;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAHtC,MAGsC,GAFpC,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAPhC,MAOgC,EAAE,OAAO,AANjD,CAIA,EAJQ;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;CAMpC,GAF5C,MAAM,GAAC,SAAS,CAqC5B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAC,SAAS,CAKtC"}

package/types/lib/inventory/bomUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bomUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/bomUtils.js"],"names":[],"mappings":"AAGA;;;GAGG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAuC5C;;;GAGG;AACH,eAAO,MAAM,yCAAyC;;;;;;EAMpD,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,YAAY,YAHd,MAAM,KACJ,OAOV,CAAC;AAgBJ;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,gBAH/B,MAAM,GAAC,MAAM,KACX,MAAM,GAAC,SAQnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,gBAH9B,MAAM,GAAC,MAAM,KACX,MAAM,GAAC,SAWnB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,gBAJ/B,MAAM,GAAC,MAAM,kBACb,MAAM,GAAC,MAAM,KACX,OAYZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,gBAH1B,MAAM,GAAC,MAAM,KACX,OAGkC,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,iBAHrC,MAAM,GAAC,MAAM,KACX,MAAM,EAQlB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qCAAqC,kBAHvC,MAAM,GAAC,MAAM,EAAE,KACb,MAAM,EAYlB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,kBANjC,MAAM,YAEd;IAAkC,aAAa,AAA/C,CACA,EADQ,MAAM,GAAC,MAAM,EAAE,CACvB;IAAgC,WAAW,AAA3C,CACA,EADQ,MAAM,GAAC,MAAM,CACrB;CAAA,KAAU,OAkBZ,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,qBAH3B,MAAM,GAAC,MAAM,GAAC,MAAM,KAClB,MAUZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,YAHpB,MAAM,KACJ,MAAM,GAAC,SAGuB,CAAC;AAE5C;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,YAHpB,MAAM,KACJ,OAGqC,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,YAHhB,MAAM,KACJ,OAIsD,CAAC;AAoCpE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,YALpB,MAAM,eACN,MAAM,GAAC,MAAM,gCACb,MAAM,KACJ,MAkCZ,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,YAHjB,MAAM,KACJ,MAUZ,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,YAJ7B,MAAM,gBACN,MAAM,KACJ,MAWZ,CAAC"}
+{"version":3,"file":"bomUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/bomUtils.js"],"names":[],"mappings":"AAGA;;;GAGG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AA8C5C;;;GAGG;AACH,eAAO,MAAM,yCAAyC;;;;;;EAMpD,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,YAAY,YAHd,MAAM,KACJ,OAOV,CAAC;AAgBJ;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,gBAH/B,MAAM,GAAC,MAAM,KACX,MAAM,GAAC,SAQnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,gBAH9B,MAAM,GAAC,MAAM,KACX,MAAM,GAAC,SAWnB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,gBAJ/B,MAAM,GAAC,MAAM,kBACb,MAAM,GAAC,MAAM,KACX,OAYZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,gBAH1B,MAAM,GAAC,MAAM,KACX,OAGkC,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,iBAHrC,MAAM,GAAC,MAAM,KACX,MAAM,EAQlB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qCAAqC,kBAHvC,MAAM,GAAC,MAAM,EAAE,KACb,MAAM,EAYlB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,kBANjC,MAAM,YAEd;IAAkC,aAAa,AAA/C,CACA,EADQ,MAAM,GAAC,MAAM,EAAE,CACvB;IAAgC,WAAW,AAA3C,CACA,EADQ,MAAM,GAAC,MAAM,CACrB;CAAA,KAAU,OAkBZ,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,qBAH3B,MAAM,GAAC,MAAM,GAAC,MAAM,KAClB,MAUZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,YAHpB,MAAM,KACJ,MAAM,GAAC,SAGuB,CAAC;AAE5C;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,YAHpB,MAAM,KACJ,OAGqC,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,YAHhB,MAAM,KACJ,OAIsD,CAAC;AAoCpE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,YALpB,MAAM,eACN,MAAM,GAAC,MAAM,gCACb,MAAM,KACJ,MAkCZ,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,YAHjB,MAAM,KACJ,MAUZ,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,YAJ7B,MAAM,gBACN,MAAM,KACJ,MAWZ,CAAC"}

package/types/lib/inventory/ciParsers/githubActionsLock.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Maximum accepted lockfile size. `gh actions-lock` writes files that stay
+ * far below this; anything larger is treated as corrupt rather than parsed.
+ * @type {number}
+ */
+export declare const MAX_ACTIONS_LOCKFILE_BYTES: number;
+export type ActionsLockDependency = {
+    /**
+     * Owner name, lower case.
+     */
+    owner: string;
+    /**
+     * Repository name, lower case.
+     */
+    repo: string;
+    /**
+     * Ref the commit was resolved from, with its case
+     * preserved. For a v0.0.1 entry this is the tag, else the branch. It can
+     * differ from the ref in the pin key: the key keeps the ref the workflow
+     * wrote (for example `v4`) while this field records the resolved one (for
+     * example `v4.3.1`).
+     */
+    ref: string;
+    /**
+     * "sha1" or "sha256".
+     */
+    hashAlgo: string;
+    /**
+     * Hex digest without the algorithm prefix.
+     */
+    commit: string;
+    /**
+     * Numeric id of the action's owner.
+     */
+    ownerId: number;
+    /**
+     * Numeric id of the action's repository.
+     */
+    repoId: number;
+    /**
+     * Set only when the entry records one
+     * (v0.0.3); undefined means the home host.
+     */
+    hostname: string | undefined;
+    /**
+     * Normalised pin keys of the direct dependencies;
+     * empty for leaf actions.
+     */
+    uses: string[];
+};
+export type ActionsLockfile = {
+    /**
+     * Version as written in the file; null for an
+     * empty result.
+     */
+    version: string | null;
+    /**
+     * Set only when an older version
+     * was normalised.
+     */
+    sourceVersion: string | undefined;
+    /**
+     * Map of repository-relative
+     * workflow path (always with "/" separators) to its flat pin list.
+     */
+    workflows: Record<string, string[]>;
+    /**
+     * Map of
+     * normalised pin key to the resolved entry.
+     */
+    dependencies: Record<string, ActionsLockDependency>;
+    /**
+     * Human-readable problems found while reading.
+     */
+    warnings: string[];
+};
+/**
+ * Parse an actions lockfile from its text content.
+ *
+ * Every problem, including a file that cannot be parsed at all, is reported
+ * as a warning and collapses the result to the empty shape; the function
+ * never throws.
+ *
+ * @param {string} text Lockfile content
+ * @param {string} [filePath] Path the content came from, used in warnings
+ * @returns {ActionsLockfile} Parsed lockfile, or the empty shape
+ */
+export declare function parseActionsLockfileString(text: string, filePath?: string): ActionsLockfile;
+/**
+ * Read and parse an actions lockfile such as
+ * `.github/workflows/actions.lock`.
+ *
+ * The file is size-checked before it is read, and every problem is reported
+ * as a warning and collapses the result to the empty shape; the function
+ * never throws.
+ *
+ * @param {string} filePath Path to the lockfile
+ * @returns {ActionsLockfile} Parsed lockfile, or the empty shape
+ */
+export declare function parseActionsLockfile(filePath: string): ActionsLockfile;
+//# sourceMappingURL=githubActionsLock.d.ts.map

package/types/lib/inventory/ciParsers/githubActionsLock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"githubActionsLock.d.ts","sourceRoot":"","sources":["../../../../lib/inventory/ciParsers/githubActionsLock.js"],"names":[],"mappings":"AA2BA;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAF7B,MAE2C,CAAC;AAyCnD,YAAkB,qBAAqB,GACvC;;;;IAAmB,KAAK,EAAb,MAAM,CACjB;;;;IAAmB,IAAI,EAAZ,MAAM,CACjB;;;;;;;;IAAmB,GAAG,EAAX,MAAM,CAKjB;;;;IAAmB,QAAQ,EAAhB,MAAM,CACjB;;;;IAAmB,MAAM,EAAd,MAAM,CACjB;;;;IAAmB,OAAO,EAAf,MAAM,CACjB;;;;IAAmB,MAAM,EAAd,MAAM,CACjB;;;;;IAA6B,QAAQ,EAA1B,MAAM,GAAC,SAAS,CAE3B;;;;;IAAqB,IAAI,EAAd,MAAM,EAAE,CAErB;CAAA,CAAA;AAKE,YAAkB,eAAe,GACjC;;;;;IAAwB,OAAO,EAApB,MAAM,GAAC,IAAI,CAEtB;;;;;IAA6B,aAAa,EAA/B,MAAM,GAAC,SAAS,CAE3B;;;;;IAAqC,SAAS,2BAE9C;;;;;IAAkD,YAAY,wCAE9D;;;;IAAqB,QAAQ,EAAlB,MAAM,EAAE,CACrB;CAAA,CAAA;AAyjBD;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAJpC,MAIoC,EAAE,QAAQ,AAHtD,CACA,EADQ,MAG8C,GAF5C,eAAe,CA2F3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAHlC,MAGkC,GAFhC,eAAe,CAoC3B"}

package/types/lib/inventory/citations.d.ts

@@ -49,6 +49,11 @@ export declare function collectToolBomRefs(bomJson: Object): string[];
  * Resolve the bom-ref of the cdxgen tool component, if present. This is the
  * canonical attribution target for inventory that cdxgen collected itself.
  *
+ * The tool component named "cdxgen" wins; a bare bom-ref (legacy array-style
+ * tools) counts when it is cdxgen's own npm purl. A helper whose bom-ref only
+ * mentions cdxgen, such as a cdxgen-plugins-bin tool like trustinspector, is
+ * never the cdxgen tool.
+ *
  * @param {Object} bomJson CycloneDX BOM
  * @returns {string|undefined} bom-ref of the cdxgen tool, or undefined
  */

package/types/lib/inventory/citations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"citations.d.ts","sourceRoot":"","sources":["../../../lib/inventory/citations.js"],"names":[],"mappings":"AAyBA;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,OAAO,EACP,MAAM,EACN,IAAI,EACJ,SAAS,GACV,GAlBE;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAAuB,YAAY,AAAnC,CACA,EADQ,MAAM,CACd;IAAuB,OAAO,AAA9B,CACA,EADQ,MAAM,CACd;IAAuB,MAAM,AAA7B,CACA,EADQ,MAAM,CACd;IAAuB,IAAI,AAA3B,CACA,EADQ,MAAM,CACd;IAAuB,SAAS,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAUG,GAVO,MAAM,GAAC,IAAI,CA0CvB;AAmBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,GAJ5B,MAAM,EAI2B,EAAE,SAAS,GAH5C,MAAM,EAG2C,GAF/C,MAAM,EAAE,CAiBpB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B,MAAM,EAAE,CAgBpB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAHjC,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAK5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,GAF5B,MAAM,CAIlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAL5B,MAK4B,EAAE,SAAS,EAJvC,MAAM,EAIiC,EAAE,OAAO,GAHhD,MAGqD,GAFnD,MAAM,CAuBlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EALnC,MAKmC,EAAE,OAAO,AAJpD,CAEA,EADA;IAAyB,IAAI,AAA7B,CACA,EADQ,MAAM,CACd;CAEyD,GAF/C,MAAM,GAAC,IAAI,CAcvB"}
+{"version":3,"file":"citations.d.ts","sourceRoot":"","sources":["../../../lib/inventory/citations.js"],"names":[],"mappings":"AAyBA;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,OAAO,EACP,MAAM,EACN,IAAI,EACJ,SAAS,GACV,GAlBE;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAAuB,YAAY,AAAnC,CACA,EADQ,MAAM,CACd;IAAuB,OAAO,AAA9B,CACA,EADQ,MAAM,CACd;IAAuB,MAAM,AAA7B,CACA,EADQ,MAAM,CACd;IAAuB,IAAI,AAA3B,CACA,EADQ,MAAM,CACd;IAAuB,SAAS,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAUG,GAVO,MAAM,GAAC,IAAI,CA0CvB;AAmBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,GAJ5B,MAAM,EAI2B,EAAE,SAAS,GAH5C,MAAM,EAG2C,GAF/C,MAAM,EAAE,CAiBpB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B,MAAM,EAAE,CAgBpB;AAUD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAHjC,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAqB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,GAF5B,MAAM,CAIlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAL5B,MAK4B,EAAE,SAAS,EAJvC,MAAM,EAIiC,EAAE,OAAO,GAHhD,MAGqD,GAFnD,MAAM,CAuBlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EALnC,MAKmC,EAAE,OAAO,AAJpD,CAEA,EADA;IAAyB,IAAI,AAA7B,CACA,EADQ,MAAM,CACd;CAEyD,GAF/C,MAAM,GAAC,IAAI,CAcvB"}

package/types/lib/inventory/communityAiConfigParser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"communityAiConfigParser.d.ts","sourceRoot":"","sources":["../../../lib/inventory/communityAiConfigParser.js"],"names":[],"mappings":"AAs1BA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,EAL1B,MAsGT,CAAC"}
+{"version":3,"file":"communityAiConfigParser.d.ts","sourceRoot":"","sources":["../../../lib/inventory/communityAiConfigParser.js"],"names":[],"mappings":"AA0rDA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,EAL1B,MAoIT,CAAC"}

package/types/lib/inventory/cyclonedx20.d.ts

@@ -0,0 +1,99 @@
+/**
+ * CycloneDX 2.0 rendering and reading.
+ *
+ * cdxgen assembles every BOM in the CycloneDX 1.x shape and converts to the
+ * requested spec version at the end of the pipeline (see
+ * lib/stages/postgen/specVersionCompat.js). The 2.0 draft is a structural
+ * rewrite rather than an additive change, so the conversion lives here, as two
+ * pure functions plus small helpers, instead of inside the compat walker:
+ *
+ * - `renderCycloneDx20(internalBom, context)` turns the 1.x-shaped internal
+ *   model into a 2.0 document. It never mutates its input, and its output
+ *   depends only on the model and the optional context (the cdx-hbom
+ *   hardware mapper, see hbomLoader.js: hardwareRenderContext).
+ *   `renderCycloneDx20WithReport(internalBom, context)` does the same and
+ *   also returns the counts of everything the render could not carry.
+ * - `readCycloneDx20(bom20)` turns a 2.0 document into the internal 1.x-shaped
+ *   model, reporting everything it could not carry in `losses`.
+ * - `loadBomForAnalysis(bomJson)` is the single entry point every BOM reader
+ *   uses; it returns the document as is for 1.x and calls readCycloneDx20 for
+ *   2.0, so no reader learns the 2.0 shape.
+ * - `getInternalBom(bomNSData)` and `refreshRenderedBom(bomNSData, options)`
+ *   are the generation-side half: postProcess keeps the 1.x model on
+ *   `bomNSData.internalBomJson` at 2.0, and the writer re-renders once after
+ *   the last mutation.
+ *
+ * Every field name below is quoted from the pinned draft schema
+ * (data/cyclonedx-2.0-bundled.schema.json, CycloneDX/specification 2.0-dev at
+ * ea8c3605829d1da13339a0790b6da73548e42a6b); citations give the `$defs` path.
+ */
+export { readCycloneDx20 } from "./cyclonedx20Read.js";
+export { renderCycloneDx20, renderCycloneDx20WithReport, } from "./cyclonedx20Render.js";
+export { CDX20_INTERNAL_SECTIONS_KEY, CDXGEN_PARTY_REF_ID, DEPENDENCY_TRACK_CDX20_ERROR, } from "./cyclonedx20Tables.js";
+/**
+ * Load any CycloneDX BOM for analysis: the document as is for 1.x, the
+ * internal 1.x-shaped model for 2.0.
+ *
+ * A document whose specVersion is 2.0 or later, or which has a specFormat, is
+ * read as 2.0, and the reader reports stray 1.x members such as
+ * `components` as losses. A model the 2.0 reader or the 2.0 compatibility
+ * pass produced carries the internal model mark (markInternalModel) and is
+ * returned as is; cdxgen hands that model to the evidence analysis in memory
+ * (evinse's `inputBomJson`), because the mark does not survive JSON. The
+ * internal sections key is never trusted on a 1.x document: the returned
+ * copy leaves it out, so it cannot reach a 2.0 render.
+ *
+ * @param {object} bomJson Parsed CycloneDX BOM
+ * @returns {{internalBom: object, specVersion: string, losses: Array<{pointer: string, reason: string}>}}
+ * @throws {Error} With a short message when the 2.0 reader fails on the
+ *   document
+ */
+export declare function loadBomForAnalysis(bomJson: object): {
+    internalBom: object;
+    specVersion: string;
+    losses: Array<{
+        pointer: string;
+        reason: string;
+    }>;
+};
+/**
+ * The one-line notice a reader prints when loading a 2.0 document lost
+ * data: the number of losses, with the details left to thoughtLog.
+ *
+ * @param {Array<{pointer: string, reason: string}>} losses Reader losses
+ * @returns {string} The notice
+ */
+export declare function formatReadLossNotice(losses: Array<{
+    pointer: string;
+    reason: string;
+}>): string;
+/**
+ * Return the 1.x-shaped model of a generation run. At 1.x the rendered BOM is
+ * the internal model, so this always yields something readers can walk.
+ *
+ * @param {{bomJson?: object, internalBomJson?: object}} bomNSData
+ * @returns {object} The 1.x-shaped BOM
+ */
+export declare function getInternalBom(bomNSData: {
+    bomJson?: object;
+    internalBomJson?: object;
+}): object;
+/**
+ * Re-render the 2.0 document after a post-postProcess mutation of the
+ * internal model, with the render context postProcess used
+ * (`bomNSData.renderContext`). A no-op at 1.x, which keeps those versions
+ * byte-identical.
+ *
+ * @param {{bomJson?: object, internalBomJson?: object, renderContext?: object}} bomNSData
+ * @param {object} options CLI options carrying `specVersion`
+ * @returns {{bomJson?: object, internalBomJson?: object}} The same bomNSData
+ */
+export declare function refreshRenderedBom(bomNSData: {
+    bomJson?: object;
+    internalBomJson?: object;
+    renderContext?: object;
+}, options: object): {
+    bomJson?: object;
+    internalBomJson?: object;
+};
+//# sourceMappingURL=cyclonedx20.d.ts.map

package/types/lib/inventory/cyclonedx20.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAUH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,iBAAiB,EACjB,2BAA2B,GAC5B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAEhC;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAL/B,MAK+B,GAJ7B;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAC,CAAC,CAAA;CAAC,CAuCxG;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAHhC,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,CAGP,GAF9B,MAAM,CAKlB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAH7B;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAGd,GAF3B,MAAM,CAIlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAJjC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAIlC,EAAE,OAAO,EAH1C,MAG0C,GAFxC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAC,CAgBxD"}

package/types/lib/inventory/cyclonedx20Common.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Small shared helpers for the CycloneDX 2.0 renderer and reader: type
+ * guards, cloning, render counters and the environment-variable shape change.
+ */
+/** True for a plain object (not null, not an array). */
+export declare const isObjectRecord: (value: any) => boolean;
+/** True for a string with at least one character. */
+export declare const isNonEmptyString: (value: any) => boolean;
+/** structuredClone that passes `undefined` through. */
+export declare const clone: (value: any) => any;
+export declare const isBomLink: (value: any) => boolean;
+/**
+ * A fresh, empty set of render counters.
+ *
+ * @param {object} [shadows] 2.0 originals kept by readCycloneDx20 (see
+ *   takeShadow)
+ * @param {{toolRefId?: string, timestamp?: string}} [claims] What identity
+ *   claims are attributed with (see identityClaimContext)
+ * @returns {object} Render counters
+ */
+export declare function createRenderStats(shadows?: object, claims?: {
+    toolRefId?: string;
+    timestamp?: string;
+}): object;
+/**
+ * The key a 1.x value is shadowed under: the SHA-256 of its JSON. The
+ * reader and the renderer serialize the same object the same way, so an
+ * unchanged value finds its 2.0 original again.
+ *
+ * @param {*} value 1.x value
+ * @returns {string} Hex digest
+ */
+export declare function shadowKey(value: any): string;
+/**
+ * The 2.0 original readCycloneDx20 kept for this unchanged 1.x value, as a
+ * fresh clone, or undefined. Identical 1.x values kept for several originals
+ * get them back in document order. Never mutates the stored shadows.
+ *
+ * @param {object} stats Render counters from createRenderStats
+ * @param {string} kind Shadow namespace (component, metadata, …)
+ * @param {*} value 1.x value about to be rendered
+ * @returns {*} The 2.0 original or undefined
+ */
+export declare function takeShadow(stats: object, kind: string, value: any): any;
+/**
+ * The single 2.0 original readCycloneDx20 kept for this unchanged 1.x value,
+ * as a fresh clone, or undefined. Unlike takeShadow nothing is consumed: the
+ * reader registers a key here only when every entry it read under that key
+ * had the same original, so the lookup does not depend on render order.
+ *
+ * @param {object} stats Render counters from createRenderStats
+ * @param {string} kind Shadow namespace (identity)
+ * @param {*} value 1.x value about to be rendered
+ * @returns {*} The 2.0 original or undefined
+ */
+export declare function peekShadow(stats: object, kind: string, value: any): any;
+/** Count one dropped or rewritten value under a stable label. */
+export declare function countDrop(stats: any, label: any, count?: number): void;
+/**
+ * Count one value the render rewrote without losing data (a duplicate refId
+ * turned into a reference, a retargeted annotation subject).
+ */
+export declare function countRewrite(stats: any, label: any, count?: number): void;
+/**
+ * Count a 1.x JSF `signature` the render leaves out: it signs the 1.x
+ * serialization, so it cannot verify over the re-rendered 2.0 document, and
+ * 2.0 `signatures` hold JSS signatures
+ * (#/$defs/cyclonedx-common-2.0/$defs/signatures).
+ */
+export declare function countSignatureDrop(stats: any, path: any): void;
+/** Count every defined key of `source` that `handled` does not list. */
+export declare function countUnmapped(stats: any, prefix: any, source: any, handled: any): void;
+/** Clone the listed fields of `source` that are defined onto `target`. */
+export declare function copyDefined(target: any, source: any, fields: any): void;
+/** Remove duplicate entries (by JSON value) for `uniqueItems` arrays. */
+export declare function uniqueByValue(values: any): any[];
+/** Split a 1.x `author` string the way specVersionCompat does. */
+export declare function authorStringToNames(authorValue: any): string[];
+/** A 1.x scalar-or-array identifier field as a list of strings. */
+export declare function identifierValues(value: any): any[];
+/** Assign `value` to `out[key]` unless it is undefined. */
+export declare function setDefined(out: any, key: any, value: any): void;
+/**
+ * Convert a 1.x `environmentVars` array of {name, value} entries into the 2.0
+ * map of names to values
+ * (#/$defs/cyclonedx-formulation-2.0/$defs/environmentVars). Reverse for read.
+ * Entries the map cannot hold are counted when `stats` is given.
+ */
+export declare function convertEnvironmentVars(value: any, stats: any): any;
+/** Turn a 2.0 environmentVars map back into the 1.x {name, value} array. */
+export declare function reverseEnvironmentVars(value: any): any;
+/** Every refId string declared anywhere under the given roots. */
+export declare function collectDeclaredRefIds(roots: any): Set<any>;
+/**
+ * True when any `party` member (a refId string or a partyReference) or any
+ * `ref` member below `node` names `refId`. Restored 2.0 originals reference
+ * a derived party (see derivedPartyDeclarations) without passing through the
+ * converters, so its declaration follows the rendered document rather than a
+ * render flag.
+ */
+export declare function referencesParty(node: any, refId: any): any;
+//# sourceMappingURL=cyclonedx20Common.d.ts.map

package/types/lib/inventory/cyclonedx20Common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20Common.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20Common.js"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,wDAAwD;AACxD,eAAO,MAAM,cAAc,yBAC2C,CAAC;AAEvE,qDAAqD;AACrD,eAAO,MAAM,gBAAgB,yBACkB,CAAC;AAEhD,uDAAuD;AACvD,eAAO,MAAM,KAAK,qBACwC,CAAC;AAI3D,eAAO,MAAM,SAAS,yBACqC,CAAC;AAE5D;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,AANtC,CAEA,EAFQ,MAM8B,EAAE,MAAM,AAJ9C,CAEA,EAFQ;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAID,GAFpC,MAAM,CAclB;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAHpB,GAGoB,GAFlB,MAAM,CAIlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,KAAK,EALrB,MAKqB,EAAE,IAAI,EAJ3B,MAI2B,EAAE,KAAK,EAHlC,GAGkC,GAFhC,GAAC,CAmBb;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,KAAK,EALrB,MAKqB,EAAE,IAAI,EAJ3B,MAI2B,EAAE,KAAK,EAHlC,GAGkC,GAFhC,GAAC,CAWb;AAED,iEAAiE;AACjE,wBAAgB,SAAS,CAAC,KAAK,KAAA,EAAE,KAAK,KAAA,EAAE,KAAK,SAAI,QAEhD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,KAAA,EAAE,KAAK,KAAA,EAAE,KAAK,SAAI,QAEnD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,KAAA,EAAE,IAAI,KAAA,QAK7C;AAED,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,KAAK,KAAA,EAAE,MAAM,KAAA,EAAE,MAAM,KAAA,EAAE,OAAO,KAAA,QAM3D;AAED,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,MAAM,KAAA,EAAE,MAAM,KAAA,EAAE,MAAM,KAAA,QAMjD;AAED,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,MAAM,KAAA,SAWnC;AAED,kEAAkE;AAClE,wBAAgB,mBAAmB,CAAC,WAAW,KAAA,YAQ9C;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,KAAK,KAAA,SAKrC;AAED,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,GAAG,KAAA,EAAE,GAAG,KAAA,EAAE,KAAK,KAAA,QAIzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,KAAA,EAAE,KAAK,KAAA,OAoBlD;AAQD,4EAA4E;AAC5E,wBAAgB,sBAAsB,CAAC,KAAK,KAAA,OAQ3C;AAED,kEAAkE;AAClE,wBAAgB,qBAAqB,CAAC,KAAK,KAAA,YAmB1C;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,KAAA,EAAE,KAAK,KAAA,OAiB1C"}