@cdxgen/cdxgen 13.6.0 → 13.7.0

package/types/lib/inventory/pqcMigration.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Post-quantum migration risk for cryptographic assets (cdxgen/cdxgen#4592).
+ *
+ * The facts come from data/pqc-migration.json: the classes of NIST IR 8547
+ * (final, October 2026) Tables 2, 4 and 8 and section 4.1.3, plus FIPS 186-5
+ * for DSA, each with its members (algorithm families, OIDs and normalised
+ * names), the transition the source states and the rationale text. This
+ * module classifies a component and builds the risk entry; it adds no fact of
+ * its own.
+ *
+ * Classification of an algorithm asset (cryptoProperties.assetType
+ * `algorithm`), first match wins. A hybrid combiner (primitive `combiner`) is
+ * not classified: IR 8547 section 3.2.1 approves a composite scheme with one
+ * approved input, so the OID of one input does not decide it.
+ *
+ * 1. `algorithmProperties.algorithmFamily`. A quantum-safe family (SHA-2,
+ *    SHA-3, AES, ML-KEM, …) is safe, except its 112-bit members (SHA-224,
+ *    SHA-512/224, SHA3-224), which are recognised by OID or name.
+ * 2. `cryptoProperties.oid` (rsaEncryption, id-ecPublicKey, the RSA, ECDSA,
+ *    EdDSA and DSA signature OIDs, X25519/X448, DH, …).
+ * 3. The component name, lower case with only letters and digits kept
+ *    ("SHA-512/224" is `sha512224`), then resolveAlgorithmFamily(name). A
+ *    name that resolves to a hash family but names a DSA, RSA or ECDSA
+ *    signature ("SHA256withDSA", "dsa-with-sha256", "RSA-SHA-512") is that
+ *    signature algorithm, not its digest.
+ *
+ * A class whose members have a key family (rsa, ff, ec) is checked against
+ * the minimum key size of IR 8547 Tables 2 and 4 (112 bits of classical
+ * strength: RSA and finite-field 2048, elliptic curve 224). An algorithm with
+ * a known smaller key, and a public or private key asset
+ * (`related-crypto-material`) whose size is smaller, is classed
+ * `below-minimum-strength` instead. The key size of an algorithm comes from
+ * the first of these that gives a plausible key size (at least 512 for rsa
+ * and ff, 160 to 571 for ec): a trailing number in its name ("RSA-1024")
+ * unless it follows a hash token ("RSASSA-PSS-SHA-512",
+ * "sha512WithRSAEncryption-512"), an RFC 7919 group name ("ffdhe2048"), its
+ * `parameterSetIdentifier` (a digest size such as "256" on an RSA signature
+ * is not a key size) or the bit size in its curve name. A key asset is
+ * checked with its own size against the base class of its algorithm, so a
+ * 4096-bit key of an algorithm named "RSA-1024" is not reported again.
+ *
+ * The likelihood and impact levels are the fixed per-class rating the data
+ * file records. No confidence is emitted (the rating is not a measurement)
+ * and no organisational fact is invented: no owner, status or responses.
+ */
+/** Prefix of every risk refId this module derives. */
+export declare const PQC_RISK_REF_ID_PREFIX = "risk-pqc-";
+/**
+ * A name in lower case with only ASCII letters and digits kept, the form the
+ * `names` tables of data/pqc-migration.json use.
+ *
+ * @param {string} name Algorithm or key name
+ * @returns {string} The compact name, empty for no name
+ */
+export declare function compactAlgorithmName(name: string): string;
+/**
+ * Classify one cryptographic-asset component. Algorithm assets get their
+ * IR 8547 class; key assets are classified only when their size is below the
+ * IR 8547 minimum (the algorithm asset carries the quantum risk).
+ *
+ * @param {object} component A component with cryptoProperties
+ * @param {Map<string, object>} [algorithmsByRef] Components by bom-ref, to
+ *   resolve a key's `algorithmRef`
+ * @returns {{className: string, keyFamily?: string, keySize?: number, minimumKeySize?: number}|undefined}
+ *   The class, or undefined when the asset is quantum-safe or unclassified
+ */
+export declare function classifyPqcCryptoAsset(component: object, algorithmsByRef?: Map<string, object>): {
+    className: string;
+    keyFamily?: string;
+    keySize?: number;
+    minimumKeySize?: number;
+} | undefined;
+/**
+ * Build the risks.risks[] entries for the quantum-vulnerable and weak
+ * cryptographic assets of a 1.x-shaped internal BOM: one per asset with a
+ * bom-ref (an asset without one could not be referenced from `affects`), in
+ * component order, unique by refId.
+ *
+ * @param {object} internalBom The internal model
+ * @returns {object[]} Risk entries shaped for the draft's
+ *   #/$defs/cyclonedx-risk-2.0/$defs/risk; empty when nothing is at risk
+ */
+export declare function collectPqcRisks(internalBom: object): object[];
+//# sourceMappingURL=pqcMigration.d.ts.map

package/types/lib/inventory/pqcMigration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pqcMigration.d.ts","sourceRoot":"","sources":["../../../lib/inventory/pqcMigration.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAQH,sDAAsD;AACtD,eAAO,MAAM,sBAAsB,cAAc,CAAC;AA0ClD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B,MAAM,CAUlB;AAuMD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EANrC,MAMqC,EAAE,eAAe,AAL9D,CAEA,EAFQ,GAAG,CAAC,MAAM,EAAE,MAAM,CAKgD,GAHhE;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAYxG;AAYD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAJhC,MAIgC,GAH9B,MAAM,EAAE,CA0BpB"}

package/types/lib/inventory/rustFormulationParser.d.ts

@@ -5,12 +5,17 @@
  * formulation components carrying build-tool, build-script capability, native
  * build dependency, and maturin metadata properties.
  *
- * @type {{id: string, patterns: string[], parse(files: string[]): {components: Object[]}}}
+ * Components record the manifest path relative to context.rootDir, the
+ * scanned project root.
+ *
+ * @type {{id: string, patterns: string[], parse(files: string[], options?: Object, context?: {rootDir?: string}): {components: Object[]}}}
  */
 export declare const rustFormulationParser: {
     id: string;
     patterns: string[];
-    parse(files: string[]): {
+    parse(files: string[], options?: Object, context?: {
+        rootDir?: string;
+    }): {
         components: Object[];
     };
 };

package/types/lib/inventory/rustFormulationParser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rustFormulationParser.d.ts","sourceRoot":"","sources":["../../../lib/inventory/rustFormulationParser.js"],"names":[],"mappings":"AAkTA;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,EAFxB;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAC,CAAA;CAwBxF,CAAC"}
+{"version":3,"file":"rustFormulationParser.d.ts","sourceRoot":"","sources":["../../../lib/inventory/rustFormulationParser.js"],"names":[],"mappings":"AA0TA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,EAFxB;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAC,GAAG;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAC,CAAA;CAwBxI,CAAC"}

package/types/lib/inventory/scalaCoords.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scalaCoords.d.ts","sourceRoot":"","sources":["../../../lib/inventory/scalaCoords.js"],"names":[],"mappings":"AAWA;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAR5B,MAQ4B,GAP1B;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAC;IACjF,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CA+B9C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,IAAc,EACd,KAAU,EACV,YAAiB,EACjB,cAAmB,EACnB,OAAY,GACb,GAbE;IAAuB,IAAI,AAA3B,CACA,EADQ,MAAM,CACd;IAAuB,KAAK,AAA5B,CACA,EADQ,MAAM,CACd;IAAsB,YAAY,EAA1B,MAAM,CACd;IAAuB,cAAc,AAArC,CACA,EADQ,MAAM,CACd;IAAuB,OAAO,AAA9B,CACA,EADQ,MAAM,CACd;CAQG,GARO,MAAM,CAUlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAJrC,MAIqC,GAHnC,MAAM,GAAC,SAAS,CAK5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAJrC,MAIqC,GAHnC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,GAAC,SAAS,CA2BjE;AAQD;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAH5B,MAG4B,GAF1B,MAAM,CAWlB"}
+{"version":3,"file":"scalaCoords.d.ts","sourceRoot":"","sources":["../../../lib/inventory/scalaCoords.js"],"names":[],"mappings":"AAWA;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAR5B,MAQ4B,GAP1B;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAC;IACjF,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CA+B9C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,IAAc,EACd,KAAU,EACV,YAAiB,EACjB,cAAmB,EACnB,OAAY,GACb,GAbE;IAAuB,IAAI,AAA3B,CACA,EADQ,MAAM,CACd;IAAuB,KAAK,AAA5B,CACA,EADQ,MAAM,CACd;IAAsB,YAAY,EAA1B,MAAM,CACd;IAAuB,cAAc,AAArC,CACA,EADQ,MAAM,CACd;IAAuB,OAAO,AAA9B,CACA,EADQ,MAAM,CACd;CAQG,GARO,MAAM,CAUlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAJrC,MAIqC,GAHnC,MAAM,GAAC,SAAS,CAK5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAJrC,MAIqC,GAHnC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,GAAC,SAAS,CA2BjE;AASD;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAH5B,MAG4B,GAF1B,MAAM,CAWlB"}

package/types/lib/inventory/scalaDedupe.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Collapse the components that stand for one Scala library.
+ *
+ * A build tool such as sbt reports a library as `group:name@version` with the
+ * Scala binary suffix moved into `cdx:scala:compilerVersion`. The jars a scan
+ * finds on disk name the same library again, and not in the same way: with the
+ * suffix (`cats-core_3`), without a repository, or, for a jar without a Maven
+ * descriptor, only as the staged file name `<group>.<artifact>-<version>.jar`,
+ * which a filename-based guess splits at the wrong dot
+ * (`pkg:maven/cpg2-protos/io.appthreat.cpg2-protos_3`). Each of those is merged
+ * into the component the build tool reported. A staged jar of another version
+ * of a reported library, such as a stale build, keeps its own component but is
+ * renamed to the coordinates the reported library has.
+ *
+ * Spellings of the same coordinates merge only when they were built for the
+ * same Scala binary version, so the `_2.12` and `_2.13` artifacts of one
+ * library stay two components. Components that no reported library accounts
+ * for are left as they are.
+ *
+ * @param {Object[]} components BOM components
+ * @param {Object[]} dependencies BOM dependencies
+ * @returns {{components: Object[], dependencies: Object[], purlMap: Map<string, string>}}
+ *   The collapsed components, the dependencies with references to merged
+ *   components pointed at the component that remains, and the purl each
+ *   merged or renamed component now has, keyed by the purl it had
+ */
+export declare function mergeScalaDuplicateComponents(components: Object[], dependencies: Object[]): {
+    components: Object[];
+    dependencies: Object[];
+    purlMap: Map<string, string>;
+};
+/**
+ * Key the jar namespace map by the purls the components have after
+ * {@link mergeScalaDuplicateComponents}, so a merged or renamed jar still
+ * finds its namespaces. A purl that already has an entry keeps it, with the
+ * namespaces of the merged entry added.
+ *
+ * @param {Object} mapping Jar namespace map keyed by purl
+ * @param {Map<string, string>} purlMap New purl keyed by old purl
+ * @returns {Object} The re-keyed map
+ */
+export declare function rekeyNamespaceMapping(mapping: Object, purlMap: Map<string, string>): Object;
+//# sourceMappingURL=scalaDedupe.d.ts.map

package/types/lib/inventory/scalaDedupe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scalaDedupe.d.ts","sourceRoot":"","sources":["../../../lib/inventory/scalaDedupe.js"],"names":[],"mappings":"AAkMA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAP7C,MAAM,EAOuC,EAAE,YAAY,EAN3D,MAAM,EAMqD,GALzD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAC,CAoIxF;AAuDD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAJlC,MAIkC,EAAE,OAAO,EAH3C,GAAG,CAAC,MAAM,EAAE,MAAM,CAGyB,GAFzC,MAAM,CA6BlB"}

package/types/lib/inventory/source.d.ts

@@ -9,9 +9,24 @@ export declare const SUPPORTED_PURL_SOURCE_TYPES: string[];
  * @returns {boolean} true if safe
  */
 export declare function isSafeGitRefName(refName: string | undefined): boolean;
+/**
+ * Determine whether git must refuse HTTP redirects. A git host allowlist is
+ * checked against the URL cdxgen is given, and git would otherwise follow
+ * the server's redirect on its first request to a host the allowlist never
+ * saw. Secure mode refuses redirects in the HTTP client too.
+ *
+ * @returns {boolean} true when a git host allowlist or secure mode applies
+ */
+export declare function gitRedirectsRefused(): boolean;
 /**
  * Execute git with hardened defaults.
  *
+ * Every call runs with command-scope settings that keep the repository from
+ * running fsmonitor hooks or being opened as a bare repository. While a git
+ * host allowlist or secure mode applies, git also refuses HTTP redirects, so
+ * an allowed host cannot send a clone or ls-remote to a host the allowlist
+ * does not name.
+ *
  * @param {string[]} args git arguments
  * @param {Object} options command options
  * @param {string|undefined} options.cwd working directory

package/types/lib/inventory/source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../lib/inventory/source.js"],"names":[],"mappings":"AAsCA,6FAA6F;AAC7F,eAAO,MAAM,4BAA4B,wIAC8F,CAAC;AAExI,6DAA6D;AAC7D,eAAO,MAAM,2BAA2B,UAWvC,CAAC;AAuBF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAAM,GAAC,SAGsB,GAF3B,OAAO,CAUnB;AAiBD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAR5B,MAAM,EAQsB,EAAE,OAAO,GAN7C;IAAkC,GAAG,EAA7B,MAAM,GAAC,SAAS,CACxB;IAAmC,YAAY,EAAvC,OAAO,GAAC,SAAS,CAGzB;CAEkD,GAFxC,MAAM,CA6ClB;AA+ED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAAM,GAAC,SAI+B,EAAE,OAAO,GAH/C,MAGoD,GAFlD,MAAM,GAAC,SAAS,CAiJ5B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,CASlB;AAkBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,OAAO,CAWnB;AAkBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAHvB,MAGuB,GAFrB,OAAO,CA+BnB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAHpB,MAGoB,GAFlB,OAAO,CAyBnB;AA2BD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAHxB,MAGwB,GAFtB,OAAO,CAkBnB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAHxC,MAGwC,GAFtC,MAAM,GAAC,IAAI,CA2GvB;AAuBD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CAuD5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAAM,GAAC,SAIkB,EAAE,OAAO,EAHlC,MAAM,GAAC,SAG2B,GAFhC,MAAM,GAAC,SAAS,CAiC5B;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAJrB,MAIqB,EAAE,MAAM,GAH7B,MAAM,GAAC,MAAM,EAAE,GAAC,IAGoB,GAFlC,MAAM,CAmElB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAAM,GAAC,SAGgC,GAFrC,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAJrC,MAIqC,EAAE,cAAc,EAHrD,MAAM,GAAC,SAG8C,GAFnD,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAJtC,MAIsC,EAAE,cAAc,EAHtD,MAAM,GAAC,SAG+C,GAFpD,MAAM,GAAC,SAAS,CAiF5B;AAkJD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAGkC,GAFhC;IAAC,MAAM,EAAC,MAAM,CAAC;IAAA,KAAK,EAAC,MAAM,CAAC;IAAA,OAAO,EAAC,MAAM,CAAA;CAAC,GAAC,IAAI,CA4D5D;AA6GD;;GAEG;AACH,wBAAgB,yBAAyB,SAExC;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,WAAW,EAJ5C,KAAK,CAAC,MAAM,CAIgC,GAF1C,OAAO,CAAC,IAAI,CAAC,CA6BzB;AAiDD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CA6MlI;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAF5B,MAE4B,QAkCtC"}
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../lib/inventory/source.js"],"names":[],"mappings":"AAsCA,6FAA6F;AAC7F,eAAO,MAAM,4BAA4B,wIAC8F,CAAC;AAExI,6DAA6D;AAC7D,eAAO,MAAM,2BAA2B,UAWvC,CAAC;AAuBF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAAM,GAAC,SAGsB,GAF3B,OAAO,CAUnB;AAuBD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAFtB,OAAO,CAInB;AAiBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAR5B,MAAM,EAQsB,EAAE,OAAO,GAN7C;IAAkC,GAAG,EAA7B,MAAM,GAAC,SAAS,CACxB;IAAmC,YAAY,EAAvC,OAAO,GAAC,SAAS,CAGzB;CAEkD,GAFxC,MAAM,CAiElB;AA+ED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAAM,GAAC,SAI+B,EAAE,OAAO,GAH/C,MAGoD,GAFlD,MAAM,GAAC,SAAS,CAiJ5B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,CASlB;AAkBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,OAAO,CAWnB;AAkBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAHvB,MAGuB,GAFrB,OAAO,CA+BnB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAHpB,MAGoB,GAFlB,OAAO,CAyBnB;AA2BD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAHxB,MAGwB,GAFtB,OAAO,CAkBnB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAHxC,MAGwC,GAFtC,MAAM,GAAC,IAAI,CA2GvB;AAuBD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CAuD5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAAM,GAAC,SAIkB,EAAE,OAAO,EAHlC,MAAM,GAAC,SAG2B,GAFhC,MAAM,GAAC,SAAS,CAiC5B;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAJrB,MAIqB,EAAE,MAAM,GAH7B,MAAM,GAAC,MAAM,EAAE,GAAC,IAGoB,GAFlC,MAAM,CAmElB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAAM,GAAC,SAGgC,GAFrC,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAJrC,MAIqC,EAAE,cAAc,EAHrD,MAAM,GAAC,SAG8C,GAFnD,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAJtC,MAIsC,EAAE,cAAc,EAHtD,MAAM,GAAC,SAG+C,GAFpD,MAAM,GAAC,SAAS,CAiF5B;AAkJD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAGkC,GAFhC;IAAC,MAAM,EAAC,MAAM,CAAC;IAAA,KAAK,EAAC,MAAM,CAAC;IAAA,OAAO,EAAC,MAAM,CAAA;CAAC,GAAC,IAAI,CA4D5D;AA6GD;;GAEG;AACH,wBAAgB,yBAAyB,SAExC;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,WAAW,EAJ5C,KAAK,CAAC,MAAM,CAIgC,GAF1C,OAAO,CAAC,IAAI,CAAC,CA6BzB;AAiDD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CA6MlI;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAF5B,MAE4B,QAkCtC"}

package/types/lib/parsers/huggingfaceManifest.d.ts

@@ -42,13 +42,17 @@ export declare function repoIdFromFixtureDirectory(filePath: string): string | u
  *
  * @param {string} modelRef model, dataset, or space reference
  * @param {{ includeDatasetPurl?: boolean }} [options={}] pedigree reference options
- * @returns {{ "bom-ref": string, group: string, name: string, purl?: string, type: string }|undefined} component reference
+ * @returns {{ "bom-ref": string, group: string, name: string, purl?: string, supplier?: { name: string, url?: string[] }, type: string }|undefined} component reference
  */
 export declare function createHuggingFaceComponentReference(modelRef: string, _options?: {}): {
     "bom-ref": string;
     group: string;
     name: string;
     purl?: string;
+    supplier?: {
+        name: string;
+        url?: string[];
+    };
     type: string;
 } | undefined;
 /**
@@ -75,6 +79,7 @@ export declare function createHuggingFaceComponentReference(modelRef: string, _o
  *     properties?: Array<object>,
  *     purl?: string,
  *     scope?: string,
+ *     supplier?: { name: string, url?: string[] },
  *     tags?: string[],
  *     type: "data",
  *   },
@@ -110,6 +115,10 @@ export declare function createHuggingFaceDatasetReference(dataset: object | stri
         properties?: Array<object>;
         purl?: string;
         scope?: string;
+        supplier?: {
+            name: string;
+            url?: string[];
+        };
         tags?: string[];
         type: "data";
     };

package/types/lib/parsers/huggingfaceManifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"huggingfaceManifest.d.ts","sourceRoot":"","sources":["../../../lib/parsers/huggingfaceManifest.js"],"names":[],"mappings":"AAmBA;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAFnC,MAAM,EAE6D,CAAC;AAC9E;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAF/B,MAAM,EAE6D,CAAC;AAC9E;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAFhC,MAAM,EAKf,CAAC;AA0LF;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAAC,GAAG,EAH1C,MAG0C,GAFxC,MAAM,GAAC,SAAS,CAc5B;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAHvC,MAAM,GAAC,SAGgC,GAFrC,OAAO,CAOnB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAHxC,MAGwC,GAFtC,MAAM,GAAC,SAAS,CAW5B;AAED;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CAAC,QAAQ,EAJjD,MAIiD,EAAE,QAAQ,KAAK,GAF9D;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAC,SAAS,CAyBrG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,iCAAiC,CAAC,OAAO,EAlC9C,MAAM,GAAC,MAkCuC,EAAE,OAAO,AAjC/D,CAOA,EAPQ;IACN,mBAAmB,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAC,SAAS,KAAK,MAAM,GAAC,SAAS,CAAC;CA4BO,GA1B1D;IACR,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE;QACf,SAAe,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,kBAAkB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CACtB,GAAC,SAAS,CAqDb;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,AAPP,CACA,EADQ,MAOI,EACb,MAAM,AAPL,CACA,EADQ,MAOE,EACX,mBAAmB,AAPlB,CACA,EADQ,CAAC,OAAO,EAAE,MAAM,GAAC,MAAM,KAAK,MAAM,GAAC,SAOb,EAC/B,OAAO,AAPN,CACA,EADQ;IAAE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAC,SAAS,KAAK,MAAM,GAAC,SAAS,CAAA;CAOzD,GAND,MAAM,GAAC,SAAS,CAsF5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,AATP,CACA,EADQ,MASD,EACR,aAAa,AATZ,CACA,EADQ,MASI,EACb,YAAY,EATH,MAAM,GAAC,SASJ,EACZ,OAAO,AATN,CAGA,EAHQ;IACN,4BAA4B,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAC,SAAS,CAAC;CAQ7D,GAND,MAAM,GAAC,SAAS,CAiD5B"}
+{"version":3,"file":"huggingfaceManifest.d.ts","sourceRoot":"","sources":["../../../lib/parsers/huggingfaceManifest.js"],"names":[],"mappings":"AAoBA;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAFnC,MAAM,EAE6D,CAAC;AAC9E;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAF/B,MAAM,EAE6D,CAAC;AAC9E;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAFhC,MAAM,EAKf,CAAC;AA0LF;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAAC,GAAG,EAH1C,MAG0C,GAFxC,MAAM,GAAC,SAAS,CAc5B;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAHvC,MAAM,GAAC,SAGgC,GAFrC,OAAO,CAOnB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAHxC,MAGwC,GAFtC,MAAM,GAAC,SAAS,CAW5B;AAED;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CAAC,QAAQ,EAJjD,MAIiD,EAAE,QAAQ,KAAK,GAF9D;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAC,SAAS,CA4BlJ;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,iCAAiC,CAAC,OAAO,EAnC9C,MAAM,GAAC,MAmCuC,EAAE,OAAO,AAlC/D,CAOA,EAPQ;IACN,mBAAmB,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAC,SAAS,KAAK,MAAM,GAAC,SAAS,CAAC;CA6BO,GA3B1D;IACR,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE;QACf,SAAe,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,kBAAkB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;QAC5C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CACtB,GAAC,SAAS,CAwDb;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,AAPP,CACA,EADQ,MAOI,EACb,MAAM,AAPL,CACA,EADQ,MAOE,EACX,mBAAmB,AAPlB,CACA,EADQ,CAAC,OAAO,EAAE,MAAM,GAAC,MAAM,KAAK,MAAM,GAAC,SAOb,EAC/B,OAAO,AAPN,CACA,EADQ;IAAE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAC,SAAS,KAAK,MAAM,GAAC,SAAS,CAAA;CAOzD,GAND,MAAM,GAAC,SAAS,CAsF5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,AATP,CACA,EADQ,MASD,EACR,aAAa,AATZ,CACA,EADQ,MASI,EACb,YAAY,EATH,MAAM,GAAC,SASJ,EACZ,OAAO,AATN,CAGA,EAHQ;IACN,4BAA4B,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAC,SAAS,CAAC;CAQ7D,GAND,MAAM,GAAC,SAAS,CAiD5B"}

package/types/lib/parsers/huggingfaceUtils.d.ts

@@ -71,6 +71,18 @@ export declare function toHuggingFaceAssetPath(assetType: string, repoId: string
  * @returns {string|undefined} canonical URL under huggingface.co
  */
 export declare function toHuggingFaceAssetUrl(assetType: string, repoId: string): string | undefined;
+/**
+ * Build the supplier entity for a Hugging Face namespace: the namespace as
+ * the name and its organisation or user page as the url. The url is left
+ * out when the namespace has characters a Hub account name cannot have.
+ *
+ * @param {string} namespace Hugging Face organisation or user name
+ * @returns {{ name: string, url?: string[] }|undefined} supplier entity
+ */
+export declare function toHuggingFaceSupplier(namespace: string): {
+    name: string;
+    url?: string[];
+} | undefined;
 /**
  * Convert a Hugging Face repo reference to a package URL.
  *

package/types/lib/parsers/huggingfaceUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"huggingfaceUtils.d.ts","sourceRoot":"","sources":["../../../lib/parsers/huggingfaceUtils.js"],"names":[],"mappings":"AAiBA;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAFd,MAEyC,CAAC;AACpD;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,EAFlC,GAAG,CAAC,MAAM,CAYlB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,EAFtC,MAEkE,CAAC;AAC7E;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAFpC,MAE8D,CAAC;AAEzE;;;;;;GAMG;AACH,wBAAgB,oCAAoC,CAAC,SAAS,EAJnD,MAImD,GAHjD,MAAM,GAAC,SAAS,CAW5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CAAC,aAAa,EAJxD,MAIwD,GAHtD,MAAM,GAAC,SAAS,CAiB5B;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CAoC5B;AAYD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAHxC,MAGwC,GAFtC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAJrC,MAIqC,EAAE,MAAM,EAH7C,MAG6C,GAF3C,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAJpC,MAIoC,EAAE,MAAM,EAH5C,MAG4C,GAF1C,MAAM,GAAC,SAAS,CAK5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAL7B,MAK6B,EAAE,OAAO,AAJ9C,CACA,EADQ,MAIsC,EAAE,aAAa,AAH7D,CACA,EADQ,MAGqD,GAFnD,MAAM,GAAC,SAAS,CA8B5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EARxC,MAQwC,EAAE,YAAY,AAP9D,CAKA,EAJA;IAA+B,YAAY,AAA3C,CAIA,EAJQ,OAAO,CAIf;CAEmE,GAFzD;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAC,SAAS,CAgH7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAZxC,MAAM,GAAC,MAYiC,EAAE,OAAO,AAXzD,CACA,EADQ;IAAE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAC,SAAS,KAAK,MAAM,GAAC,SAAS,CAAA;CAWN,GAVpD;IACR,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb,GAAC,SAAS,CAqDb;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAJ3C,MAAM,GAAC,MAIoC,EAAE,OAAO,AAH5D,CACA,EADQ;IAAE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAC,SAAS,KAAK,MAAM,GAAC,SAAS,CAAA;CAGH,GAFvD;IAAE,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAC,SAAS,CAyBtG;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,AAHhD,CACA,EADQ,KAAK,CAAC,MAAM,CAGiC,GAF3C,KAAK,CAAC;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAyBlE;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,kBAAkB,EAHnD,MAAM,GAAC,MAG4C,GAFjD,MAAM,GAAC,SAAS,CAoB5B"}
+{"version":3,"file":"huggingfaceUtils.d.ts","sourceRoot":"","sources":["../../../lib/parsers/huggingfaceUtils.js"],"names":[],"mappings":"AAiBA;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAFd,MAEyC,CAAC;AACpD;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,EAFlC,GAAG,CAAC,MAAM,CAYlB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,EAFtC,MAEkE,CAAC;AAC7E;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAFpC,MAE8D,CAAC;AAEzE;;;;;;GAMG;AACH,wBAAgB,oCAAoC,CAAC,SAAS,EAJnD,MAImD,GAHjD,MAAM,GAAC,SAAS,CAW5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CAAC,aAAa,EAJxD,MAIwD,GAHtD,MAAM,GAAC,SAAS,CAiB5B;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CAoC5B;AAYD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAHxC,MAGwC,GAFtC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAJrC,MAIqC,EAAE,MAAM,EAH7C,MAG6C,GAF3C,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAJpC,MAIoC,EAAE,MAAM,EAH5C,MAG4C,GAF1C,MAAM,GAAC,SAAS,CAK5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAHpC,MAGoC,GAFlC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAAC,SAAS,CAUtD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAL7B,MAK6B,EAAE,OAAO,AAJ9C,CACA,EADQ,MAIsC,EAAE,aAAa,AAH7D,CACA,EADQ,MAGqD,GAFnD,MAAM,GAAC,SAAS,CA8B5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EARxC,MAQwC,EAAE,YAAY,AAP9D,CAKA,EAJA;IAA+B,YAAY,AAA3C,CAIA,EAJQ,OAAO,CAIf;CAEmE,GAFzD;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAC,SAAS,CAgH7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAZxC,MAAM,GAAC,MAYiC,EAAE,OAAO,AAXzD,CACA,EADQ;IAAE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAC,SAAS,KAAK,MAAM,GAAC,SAAS,CAAA;CAWN,GAVpD;IACR,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb,GAAC,SAAS,CAqDb;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAJ3C,MAAM,GAAC,MAIoC,EAAE,OAAO,AAH5D,CACA,EADQ;IAAE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAC,SAAS,KAAK,MAAM,GAAC,SAAS,CAAA;CAGH,GAFvD;IAAE,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAC,SAAS,CAyBtG;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,AAHhD,CACA,EADQ,KAAK,CAAC,MAAM,CAGiC,GAF3C,KAAK,CAAC;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAyBlE;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,kBAAkB,EAHnD,MAAM,GAAC,MAG4C,GAFjD,MAAM,GAAC,SAAS,CAoB5B"}

package/types/lib/parsers/kiroPermissions.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Summarize Kiro CLI V3 permission documents into policy-safe posture facts.
+ *
+ * Kiro V3 describes what an agent may do with `capability`/`effect` rules that
+ * live in an agent definition's `permissions` object, in the user-scope
+ * `~/.kiro/settings/permissions.yaml`, and in the per-workspace
+ * `~/.kiro/workspace-roots/<hash>/permissions.yaml`. The rules carry `match`
+ * pattern lists, free-text reasons, and paths, none of which belong in a BOM.
+ * This module reduces a document to counts, allowlisted effect counts,
+ * validated capability names, and booleans, and never returns the patterns or
+ * any other free text.
+ */
+/**
+ * Summarize a Kiro V3 permission document.
+ *
+ * Accepts the parsed `permissions` object of an agent definition or a parsed
+ * `permissions.yaml` document. A bare rules array is accepted as well. The
+ * result carries only counts, booleans, and validated token lists; `match`
+ * patterns, `exclude` lists, reasons, and paths are never returned.
+ *
+ * @param {Object|Array|undefined} rulesOrDoc Parsed permissions object, YAML
+ *   document, or rules array
+ * @returns {{
+ *   ruleCount: number,
+ *   allowRuleCount: number,
+ *   denyRuleCount: number,
+ *   askRuleCount: number,
+ *   evaluateRuleCount: number,
+ *   capabilities: string[],
+ *   allowsAllCapabilities: boolean,
+ *   unrestrictedAllowCapabilities: string[],
+ *   workspaceTrusted: boolean|undefined,
+ *   policyPresets: string[],
+ *   unknownPolicyPresetCount: number,
+ * }} Permission posture summary
+ */
+export declare function summarizeKiroPermissions(rulesOrDoc: Object | any[] | undefined): {
+    ruleCount: number;
+    allowRuleCount: number;
+    denyRuleCount: number;
+    askRuleCount: number;
+    evaluateRuleCount: number;
+    capabilities: string[];
+    allowsAllCapabilities: boolean;
+    unrestrictedAllowCapabilities: string[];
+    workspaceTrusted: boolean | undefined;
+    policyPresets: string[];
+    unknownPolicyPresetCount: number;
+};
+/**
+ * Flatten a permission summary into property suffix/value pairs.
+ *
+ * Both scans that consume Kiro permission documents emit the same suffixes;
+ * the host scan prefixes them with `cdx:agentic:` and the project scan with
+ * `cdx:agent:`. Values are numbers, booleans, or comma-separated validated
+ * tokens, so no free text reaches a BOM through this mapping.
+ *
+ * @param {ReturnType<summarizeKiroPermissions>} summary Permission posture summary
+ * @returns {Record<string, number|boolean|string>} Property suffix mapped to its value
+ */
+export declare function kiroPermissionSummaryEntries(summary: ReturnType<summarizeKiroPermissions>): Record<string, number | boolean | string>;
+//# sourceMappingURL=kiroPermissions.d.ts.map

package/types/lib/parsers/kiroPermissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kiroPermissions.d.ts","sourceRoot":"","sources":["../../../lib/parsers/kiroPermissions.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA+BH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAhBxC,MAAM,WAAO,SAgB2B,GAdtC;IACR,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,6BAA6B,EAAE,MAAM,EAAE,CAAC;IACxC,gBAAgB,EAAE,OAAO,GAAC,SAAS,CAAC;IACpC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,wBAAwB,EAAE,MAAM,CAAC;CAClC,CAyDH;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAHzC,UAAU,CAAC,wBAAwB,CAGM,GAFvC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAC,OAAO,GAAC,MAAM,CAAC,CAiCjD"}

package/types/lib/parsers/vscodeExtensionId.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Target platforms a VS Code-family marketplace publishes an extension for.
+ * `universal` and `web` builds are the same artefact on every platform and are
+ * not part of the extension's identity.
+ */
+export declare const VSCODE_TARGET_PLATFORMS: Set<string>;
+/**
+ * Normalize a target platform value from a manifest, an `extensions.json`
+ * record, or a folder name. Values that do not name a specific platform, such
+ * as `universal`, `web`, `undefined`, or an empty string, return an empty
+ * string.
+ *
+ * @param {string} value Raw target platform
+ * @returns {string} A value from VSCODE_TARGET_PLATFORMS, or an empty string
+ */
+export declare function normalizeVscodeTargetPlatform(value: string): string;
+/**
+ * Split an installed extension folder name into its publisher, name, version
+ * and target platform.
+ *
+ * @param {string} dirName Folder name, such as `ms-python.python-2025.4.0` or
+ *   `anthropic.claude-code-2.1.313-darwin-arm64`
+ * @returns {{publisher: string, name: string, version: string, platform: string}|undefined}
+ *   The parts, or undefined when the name does not follow the pattern
+ */
+export declare function parseVscodeExtensionDirName(dirName: string): {
+    publisher: string;
+    name: string;
+    version: string;
+    platform: string;
+} | undefined;
+/**
+ * Check a string is a semantic version: three numeric parts, then an optional
+ * `-prerelease` and `+build`.
+ *
+ * @param {string} text Candidate version
+ * @returns {boolean} true for a semver
+ */
+export declare function isSemver(text: string): boolean;
+/**
+ * Read the target platform from the path of an installed extension folder.
+ *
+ * @param {string} extensionPath Path to the extension folder, with either
+ *   separator
+ * @returns {string} The target platform, or an empty string
+ */
+export declare function vscodeExtensionPlatformFromPath(extensionPath: string): string;
+//# sourceMappingURL=vscodeExtensionId.d.ts.map

package/types/lib/parsers/vscodeExtensionId.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vscodeExtensionId.d.ts","sourceRoot":"","sources":["../../../lib/parsers/vscodeExtensionId.js"],"names":[],"mappings":"AAUA;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,aAWlC,CAAC;AAKH;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAHxC,MAGwC,GAFtC,MAAM,CAKlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EALxC,MAKwC,GAHtC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAyD1F;AA+BD;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAHlB,MAGkB,GAFhB,OAAO,CAuBnB;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,aAAa,EAJlD,MAIkD,GAFhD,MAAM,CAQlB"}

package/types/lib/server/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../lib/server/server.js"],"names":[],"mappings":"AAWA,OAAO,EACL,iBAAiB,EAGlB,MAAM,qBAAqB,CAAC;AA+E7B,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAc7B;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAJnB,MAAM,GAAC,MAAM,GAAC,KAAK,CAAC,MAAM,GAAC,MAAM,CAId,GAHjB,MAAM,GAAC,MAAM,GAAC,OAAO,GAAC,KAAK,CAAC,MAAM,GAAC,MAAM,GAAC,OAAO,CAAC,CAwC9D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EALvB,MAKuB,EAAE,IAAI,AAJrC,CACA,EADQ,MAIkC,EAAE,OAAO,AAHnD,CACA,EADQ,MAGgD,GAF9C,MAAM,CAwBlB;AA+DD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAJtC,MAIsC,EAAE,eAAe,GAHvD,MAG4D,GAF1D,MAAM,GAAC,IAAI,CAiFvB;AAUD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB,MAAM,CAiClB;AAiBD;;;;;GAKG;AACH,QAAA,MAAM,eAAe,iBAHV,OAAO,WAAW,EAAE,MAAM,KACxB,IAOZ,CAAC;AAwBF;;;;;;;;;GASG;AACH,QAAA,MAAM,KAAK,YAHA,MAAM,KACJ,IAmYZ,CAAC;AAEF,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../lib/server/server.js"],"names":[],"mappings":"AAWA,OAAO,EACL,iBAAiB,EAGlB,MAAM,qBAAqB,CAAC;AAwF7B,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAc7B;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAJnB,MAAM,GAAC,MAAM,GAAC,KAAK,CAAC,MAAM,GAAC,MAAM,CAId,GAHjB,MAAM,GAAC,MAAM,GAAC,OAAO,GAAC,KAAK,CAAC,MAAM,GAAC,MAAM,GAAC,OAAO,CAAC,CAwC9D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EALvB,MAKuB,EAAE,IAAI,AAJrC,CACA,EADQ,MAIkC,EAAE,OAAO,AAHnD,CACA,EADQ,MAGgD,GAF9C,MAAM,CAwBlB;AA0CD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAJtC,MAIsC,EAAE,eAAe,GAHvD,MAG4D,GAF1D,MAAM,GAAC,IAAI,CA0FvB;AAUD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB,MAAM,CAiClB;AAiBD;;;;;GAKG;AACH,QAAA,MAAM,eAAe,iBAHV,OAAO,WAAW,EAAE,MAAM,KACxB,IAOZ,CAAC;AAwBF;;;;;;;;;GASG;AACH,QAAA,MAAM,KAAK,YAHA,MAAM,KACJ,IAwYZ,CAAC;AAEF,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC"}

package/types/lib/stages/postgen/postgen.d.ts

@@ -1,6 +1,13 @@
 /**
  * Filter and enhance BOM post generation.
  *
+ * At CycloneDX 2.0 the returned `bomNSData` carries two documents:
+ * `bomJson` is the rendered 2.0 document (what library users, the server and
+ * the writer see), and `internalBomJson` is the 1.x-shaped model the audit,
+ * evinse, display and SPDX-export readers use. `internalBomJson` is never
+ * serialized; `refreshRenderedBom` re-renders `bomJson` from it after any
+ * later mutation. At 1.x `internalBomJson` is unset.
+ *
  * @param {Object} bomNSData BOM with namespaces object
  * @param {Object} options CLI options
  * @param {string} [filePath] Source path used for formulation and metadata context

package/types/lib/stages/postgen/postgen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postgen.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/postgen.js"],"names":[],"mappings":"AAiiBA;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,SAAS,EANhC,MAMgC,EAAE,OAAO,EALzC,MAKyC,EAAE,QAAQ,AAJ3D,CAEA,EAFQ,MAImD,GAFjD,OAAO,CAAC,MAAM,CAAC,CAsE3B;AAgHD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAL1B,MAK0B,EAAE,OAAO,EAJnC,MAImC,GAFjC,MAAM,CA2JlB;AAuCD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAL3B,MAK2B,EAAE,OAAO,EAJpC,MAIoC,GAFlC,MAAM,CAqClB;AAqHD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EALvC,MAKuC,EAAE,OAAO,EAJhD,MAIgD,GAF9C,MAAM,EAAE,CAmBpB;AAgBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EALrC,MAKqC,EAAE,OAAO,EAJ9C,MAI8C,GAF5C,MAAM,CAiClB;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,EALtB,MAKsB,EAAE,OAAO,EAJ/B,MAI+B,GAF7B,MAAM,CAoNlB;AAUD;;GAEG;AACH,wBAAgB,UAAU,CAAC,QAAQ,KAAA,QAUlC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,IAFhB,IAAI,CAYhB;AAMD;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EALrB,MAKqB,EAAE,OAAO,EAJ9B,MAI8B,GAF5B,MAAM,CA2HlB"}
+{"version":3,"file":"postgen.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/postgen.js"],"names":[],"mappings":"AAuiBA;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,WAAW,CAAC,SAAS,EANhC,MAMgC,EAAE,OAAO,EALzC,MAKyC,EAAE,QAAQ,AAJ3D,CAEA,EAFQ,MAImD,GAFjD,OAAO,CAAC,MAAM,CAAC,CAiG3B;AAgHD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAL1B,MAK0B,EAAE,OAAO,EAJnC,MAImC,GAFjC,MAAM,CA2JlB;AAuCD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAL3B,MAK2B,EAAE,OAAO,EAJpC,MAIoC,GAFlC,MAAM,CAqClB;AAqHD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EALvC,MAKuC,EAAE,OAAO,EAJhD,MAIgD,GAF9C,MAAM,EAAE,CAmBpB;AAgBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EALrC,MAKqC,EAAE,OAAO,EAJ9C,MAI8C,GAF5C,MAAM,CAiClB;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,EALtB,MAKsB,EAAE,OAAO,EAJ/B,MAI+B,GAF7B,MAAM,CAoNlB;AAUD;;GAEG;AACH,wBAAgB,UAAU,CAAC,QAAQ,KAAA,QAUlC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,IAFhB,IAAI,CAYhB;AAMD;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EALrB,MAKqB,EAAE,OAAO,EAJ9B,MAI8B,GAF5B,MAAM,CA2HlB"}

package/types/lib/stages/postgen/ruleEngine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ruleEngine.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/ruleEngine.js"],"names":[],"mappings":"AAkiBA;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAJpC,GAIoC,GAHlC,MAAM,GAAC,SAAS,CA0B5B;AAED,wBAAsB,SAAS,CAAC,QAAQ,KAAA,kBAqFvC;AAiCD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,EAAE,OAAO,KAAK,GAFjD,OAAO,OAAO,CAuF1B;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,KAAK,KAAA,EAAE,OAAO,KAAA,EAAE,OAAO,KAAK,kBAY/D"}
+{"version":3,"file":"ruleEngine.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/ruleEngine.js"],"names":[],"mappings":"AAkiBA;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAJpC,GAIoC,GAHlC,MAAM,GAAC,SAAS,CA0B5B;AAED,wBAAsB,SAAS,CAAC,QAAQ,KAAA,kBAqFvC;AAyCD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,EAAE,OAAO,KAAK,GAFjD,OAAO,OAAO,CAuF1B;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,KAAK,KAAA,EAAE,OAAO,KAAA,EAAE,OAAO,KAAK,kBAY/D"}

package/types/lib/stages/postgen/specVersionCompat.d.ts

@@ -68,4 +68,29 @@ export declare function collectFieldPaths(subject: Object, prefix?: string, path
  * @returns {string[]} Sorted field paths that no longer appear
  */
 export declare function diffRemovedFieldPaths(sourceBomJson: Object, normalizedBomJson: Object): string[];
+/**
+ * Count the leaf values of a JSON document as `path=value` strings, using
+ * the dotted, index-free paths of collectFieldPaths. Array order is ignored,
+ * so two documents that differ only in member order give the same counts,
+ * but a repeated entry counts once per occurrence. Empty arrays and objects
+ * count as leaves.
+ *
+ * @param {*} subject JSON value
+ * @param {string} [prefix] Path so far
+ * @param {Map<string, number>} [leaves] Accumulator
+ * @returns {Map<string, number>} Occurrences of each `path=value` string
+ */
+export declare function collectLeafValues(subject: any, prefix?: string, leaves?: Map<string, number>): Map<string, number>;
+/**
+ * Report the leaf values of `sourceBomJson` that `convertedBomJson` lacks,
+ * ignoring member order (see collectLeafValues). A value the source holds
+ * more often than the output is reported once for every missing occurrence,
+ * so dropping one of two identical entries counts.
+ *
+ * @param {Object} sourceBomJson BOM before conversion
+ * @param {Object} convertedBomJson BOM after conversion
+ * @returns {string[]} Sorted `path=value` strings missing from the output,
+ *   repeated per missing occurrence
+ */
+export declare function diffMissingLeafValues(sourceBomJson: Object, convertedBomJson: Object): string[];
 //# sourceMappingURL=specVersionCompat.d.ts.map

package/types/lib/stages/postgen/specVersionCompat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"specVersionCompat.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/specVersionCompat.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAqTH;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,MAAM,CAclB;AAsUD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAJ1C,MAI0C,EAAE,OAAO,EAHnD,MAGmD,GAFjD,MAAM,CA6BlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAL9B,MAK8B,EAAE,MAAM,AAJ9C,CACA,EADQ,MAI2C,EAAE,KAAK,AAH1D,CACA,EADQ,GAAG,CAAC,MAAM,CAGoD,GAF5D,GAAG,CAAC,MAAM,CAAC,CAkBvB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAJxC,MAIwC,EAAE,iBAAiB,EAH3D,MAG2D,GAFzD,MAAM,EAAE,CAOpB"}
+{"version":3,"file":"specVersionCompat.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/specVersionCompat.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA+TH;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,MAAM,CAclB;AAsUD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAJ1C,MAI0C,EAAE,OAAO,EAHnD,MAGmD,GAFjD,MAAM,CAgClB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAL9B,MAK8B,EAAE,MAAM,AAJ9C,CACA,EADQ,MAI2C,EAAE,KAAK,AAH1D,CACA,EADQ,GAAG,CAAC,MAAM,CAGoD,GAF5D,GAAG,CAAC,MAAM,CAAC,CAkBvB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAJxC,MAIwC,EAAE,iBAAiB,EAH3D,MAG2D,GAFzD,MAAM,EAAE,CAOpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAL9B,GAK8B,EAAE,MAAM,AAJ9C,CACA,EADQ,MAI2C,EAAE,MAAM,AAH3D,CACA,EADQ,GAAG,CAAC,MAAM,EAAE,MAAM,CAG6C,GAF7D,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CA6B/B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EALxC,MAKwC,EAAE,gBAAgB,EAJ1D,MAI0D,GAHxD,MAAM,EAAE,CAYpB"}

package/types/lib/validator/bomValidator.d.ts

@@ -2,10 +2,14 @@
  * Validate the generated bom using jsonschema
  *
  * @param {object} bomJson content
+ * @param {object} [options] Validation options
+ * @param {boolean} [options.deep] Run the deep validators after the schema check. Defaults to true.
  *
  * @returns {Promise<Boolean>} true if the BOM is valid. false otherwise.
  */
-export declare const validateBom: (bomJson: object) => Promise<boolean>;
+export declare const validateBom: (bomJson: object, options?: {
+    deep?: boolean;
+}) => Promise<boolean>;
 /**
  * Validate the generated SPDX export.
  *

package/types/lib/validator/bomValidator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bomValidator.d.ts","sourceRoot":"","sources":["../../../lib/validator/bomValidator.js"],"names":[],"mappings":"AAqQA;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAJb,MAAM,KAEJ,OAAO,SAmCnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,aAHd,MAAM,GAAC,MAAM,KACX,OAyLZ,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,YAFlB,MAAM,YAmEhB,CAAC;AA4CF;;;;GAIG;AACH,eAAO,MAAM,aAAa,YAFf,MAAM,YA+HhB,CAAC;AA2CF;;;;GAIG;AACH,eAAO,MAAM,YAAY,YAFd,MAAM,YAmFhB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAF1B,MAE0B,WAkIpC"}
+{"version":3,"file":"bomValidator.d.ts","sourceRoot":"","sources":["../../../lib/validator/bomValidator.js"],"names":[],"mappings":"AA4QA;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,YANb,MAAM,YAEd;IAA0B,IAAI,AAA9B,CAEA,EAFQ,OAAO,CAEf;CAAA,KAAU,OAAO,SAsCnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,aAHd,MAAM,GAAC,MAAM,KACX,OAyLZ,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,YAFlB,MAAM,YAmEhB,CAAC;AA4CF;;;;GAIG;AACH,eAAO,MAAM,aAAa,YAFf,MAAM,YA+HhB,CAAC;AA2CF;;;;GAIG;AACH,eAAO,MAAM,YAAY,YAFd,MAAM,YAmFhB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAF1B,MAE0B,WAkIpC"}

package/types/lib/validator/complianceEngine.d.ts

@@ -1,12 +1,12 @@
 /**
- * Orchestrates evaluation of internal compliance rule packs (SCVS + CRA) and
- * aggregates results into per-benchmark scorecards.
+ * Orchestrates evaluation of internal compliance rule packs (SCVS + CRA + CISA)
+ * and aggregates results into per-benchmark scorecards.
  *
  * This module is deliberately independent of the CycloneDX BOM audit engine
  * (lib/stages/postgen/auditBom.js). The two engines share similar *Finding*
  * output shape so reporters can consume either source uniformly.
  */
-import { getAllComplianceRules, getCraRules, getScvsRules } from "./complianceRules.js";
+import { getAllComplianceRules, getCisaAiRules, getCisaRules, getCraRules, getScvsRules } from "./complianceRules.js";
 /**
  * Resolve a benchmark alias (case-insensitive). Returns null when unknown.
  *
@@ -68,5 +68,5 @@ export declare function scoreBenchmark(benchmark: object, findings: Array<object
  * @returns {Array<object>}
  */
 export declare function buildBenchmarkReports(findings: Array<object>, requestedAliases?: Array<string>): Array<object>;
-export { getAllComplianceRules, getCraRules, getScvsRules };
+export { getAllComplianceRules, getCisaAiRules, getCisaRules, getCraRules, getScvsRules, };
 //# sourceMappingURL=complianceEngine.d.ts.map

package/types/lib/validator/complianceEngine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"complianceEngine.d.ts","sourceRoot":"","sources":["../../../lib/validator/complianceEngine.js"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,qBAAqB,EACrB,WAAW,EACX,YAAY,EACb,MAAM,sBAAsB,CAAC;AAsD9B;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAH3B,MAG2B,GAFzB,MAAM,GAAG,IAAI,CAKzB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAFjB,KAAK,CAAC,MAAM,CAAC,CAIzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CA6ClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,OAAO,EANxB,MAMwB,EAAE,IAAI,AALtC,CAGA,EAFA;IAA6B,UAAU,AAAvC,CACA,EADQ,KAAK,CAAC,MAAM,CAAC,CACrB;IAA6B,UAAU,AAAvC,CACA,EADQ,KAAK,CAAC,MAAM,CAAC,CACrB;CAE2C,GAFjC,KAAK,CAAC,MAAM,CAAC,CAqBzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAJ7B,MAI6B,EAAE,QAAQ,EAHvC,KAAK,CAAC,MAAM,CAG2B,GAFrC,MAAM,CAuClB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAJnC,KAAK,CAAC,MAAM,CAIuB,EAAE,gBAAgB,AAH7D,CACA,EADQ,KAAK,CAAC,MAAM,CAGyC,GAFnD,KAAK,CAAC,MAAM,CAAC,CAOzB;AAED,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"complianceEngine.d.ts","sourceRoot":"","sources":["../../../lib/validator/complianceEngine.js"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,YAAY,EACZ,WAAW,EACX,YAAY,EACb,MAAM,sBAAsB,CAAC;AAyE9B;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAH3B,MAG2B,GAFzB,MAAM,GAAG,IAAI,CAKzB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAFjB,KAAK,CAAC,MAAM,CAAC,CAIzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CA6ClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,OAAO,EANxB,MAMwB,EAAE,IAAI,AALtC,CAGA,EAFA;IAA6B,UAAU,AAAvC,CACA,EADQ,KAAK,CAAC,MAAM,CAAC,CACrB;IAA6B,UAAU,AAAvC,CACA,EADQ,KAAK,CAAC,MAAM,CAAC,CACrB;CAE2C,GAFjC,KAAK,CAAC,MAAM,CAAC,CAqBzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAJ7B,MAI6B,EAAE,QAAQ,EAHvC,KAAK,CAAC,MAAM,CAG2B,GAFrC,MAAM,CAuClB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAJnC,KAAK,CAAC,MAAM,CAIuB,EAAE,gBAAgB,AAH7D,CACA,EADQ,KAAK,CAAC,MAAM,CAGyC,GAFnD,KAAK,CAAC,MAAM,CAAC,CAOzB;AAED,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,YAAY,EACZ,WAAW,EACX,YAAY,GACb,CAAC"}

package/types/lib/validator/complianceRules.d.ts

@@ -12,7 +12,7 @@
  *   id            - Stable short identifier (e.g. "SCVS-1.1").
  *   name          - Human readable short name.
  *   description   - Long description (wording taken from the source standard).
- *   standard      - Source standard key: "SCVS" or "CRA".
+ *   standard      - Source standard key: "SCVS", "CRA" or "CISA".
  *   standardRefs  - Array of canonical control identifiers.
  *   category      - Grouping used by --categories.
  *   severity      - Severity emitted for a failing automatable rule.
@@ -34,7 +34,7 @@
  *   }
  */
 /**
- * Returns the full catalog of compliance rules (SCVS + CRA).
+ * Returns the full catalog of compliance rules (SCVS + CRA + CISA).
  *
  * @returns {Array<object>}
  */
@@ -51,6 +51,18 @@ export declare function getScvsRules(): Array<object>;
  * @returns {Array<object>}
  */
 export declare function getCraRules(): Array<object>;
+/**
+ * Returns only CISA 2026 minimum elements rules.
+ *
+ * @returns {Array<object>}
+ */
+export declare function getCisaRules(): Array<object>;
+/**
+ * Returns only the CISA and G7 AI SBOM element rules.
+ *
+ * @returns {Array<object>}
+ */
+export declare function getCisaAiRules(): Array<object>;
 /**
  * Test-only export exposing internal helper functions for unit tests.
  * Double-underscore prefixed to discourage external use.

package/types/lib/validator/complianceRules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"complianceRules.d.ts","sourceRoot":"","sources":["../../../lib/validator/complianceRules.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAskDH;;;;GAIG;AACH,wBAAgB,qBAAqB,IAFxB,KAAK,CAAC,MAAM,CAAC,CAIzB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAFf,KAAK,CAAC,MAAM,CAAC,CAIzB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,IAFd,KAAK,CAAC,MAAM,CAAC,CAIzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,MAAM,EAFT,MAQT,CAAC"}
+{"version":3,"file":"complianceRules.d.ts","sourceRoot":"","sources":["../../../lib/validator/complianceRules.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAw7FH;;;;GAIG;AACH,wBAAgB,qBAAqB,IAFxB,KAAK,CAAC,MAAM,CAAC,CAIzB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAFf,KAAK,CAAC,MAAM,CAAC,CAIzB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,IAFd,KAAK,CAAC,MAAM,CAAC,CAIzB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAFf,KAAK,CAAC,MAAM,CAAC,CAIzB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAFjB,KAAK,CAAC,MAAM,CAAC,CAIzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,MAAM,EAFT,MAQT,CAAC"}

package/types/lib/validator/index.d.ts

@@ -38,6 +38,11 @@ export declare function validateGeneratedBom(bomJson: object): Promise<{
 /**
  * Run structural + compliance validation against a parsed BOM.
  *
+ * The JSON schema check and signature verification read the document as
+ * given. The deep checks and compliance rules read the 1.x-shaped model, so
+ * the same project gives the same rule results at 1.x and at 2.0; for a 2.0
+ * document `readLosses` lists what that model could not hold.
+ *
  * @param {object} bomJson Parsed CycloneDX JSON BOM.
  * @param {object} [options]
  * @param {boolean} [options.schema]            Run JSON-Schema validation (default true).
@@ -55,6 +60,7 @@ export declare function validateGeneratedBom(bomJson: object): Promise<{
  *   schemaValid: boolean,
  *   deepValid: boolean,
  *   validationErrors: Array<{ stage: string, message: string }>,
+ *   readLosses: Array<{ pointer: string, reason: string }>,
  *   signatureVerified: boolean | null,
  *   signatureDetails: object | null,
  *   signatureEntries: Array<{ index: number, algorithm: any, keyId: any, verified: boolean }> | null,
@@ -82,6 +88,10 @@ export declare function validateBomAdvanced(bomJson: object, options?: {
         stage: string;
         message: string;
     }>;
+    readLosses: Array<{
+        pointer: string;
+        reason: string;
+    }>;
     signatureVerified: boolean | null;
     signatureDetails: object | null;
     signatureEntries: Array<{