circle-ir 3.201.0 → 3.203.0

package/dist/analysis/sbom.d.ts

@@ -0,0 +1,123 @@
+/**
+ * Software Bill of Materials (SBOM) generation.
+ *
+ * cognium-dev — deterministic SBOM emission (Pillar I). The engine never
+ * reads the filesystem (browser-safety); the caller passes raw manifest text
+ * via the same {@link DependencyContext} surface the deserialization gate
+ * uses (#258/#261). This module turns those manifests into a normalized
+ * dependency list and emits two industry formats:
+ *
+ *   - **CycloneDX 1.5** (`toCycloneDx`) — the OWASP BOM format.
+ *   - **SPDX 2.3** (`toSpdx`) — the Linux Foundation format.
+ *
+ * Both outputs are deterministic: no timestamps, UUIDs, or randomness are
+ * introduced here. Volatile document metadata (generation time, serial
+ * number, namespace) is *injected* by the caller via {@link SbomMetadata},
+ * so a given input always produces byte-identical output unless the caller
+ * chooses otherwise — which keeps SBOMs diffable in CI and tests stable.
+ *
+ * Parsing is regex/`JSON.parse`-scoped, never a full TOML/XML tree: the only
+ * runtime dependencies circle-ir permits are `web-tree-sitter` and `yaml`,
+ * and a manifest dependency list needs nothing heavier.
+ */
+import type { DependencyContext } from '../analyzer.js';
+/** Package ecosystem, aligned with Package-URL (purl) `pkg:<type>` names. */
+export type Ecosystem = 'npm' | 'pypi' | 'maven' | 'cargo' | 'golang';
+/** How a dependency is used, mapped from the manifest's declaration site. */
+export type DependencyScope = 'required' | 'optional' | 'dev';
+/** One normalized dependency, ecosystem-agnostic. */
+export interface Dependency {
+    /** Package name. For Maven this is `groupId:artifactId`. */
+    name: string;
+    /** Declared version spec verbatim (e.g. `^3.1.0`, `>=1.2`), or `'unknown'`. */
+    version: string;
+    ecosystem: Ecosystem;
+    scope: DependencyScope;
+    /** Package URL (https://github.com/package-url/purl-spec). */
+    purl: string;
+}
+/**
+ * Caller-injected document metadata. Everything here is optional; supplying
+ * it makes the output richer but non-deterministic (e.g. a real timestamp).
+ * Leaving it out yields a minimal, fully-deterministic document.
+ */
+export interface SbomMetadata {
+    /** Name of the project the SBOM describes. */
+    name?: string;
+    /** Version of the project the SBOM describes. */
+    version?: string;
+    /** ISO-8601 generation time. Injected — never read from a clock here. */
+    timestamp?: string;
+    /** CycloneDX `serialNumber` (expected form `urn:uuid:...`). */
+    serialNumber?: string;
+    /** SPDX `documentNamespace`. Defaults to a cognium.dev URI. */
+    namespace?: string;
+    /** Generating tool name recorded in the document. Defaults to `circle-ir`. */
+    tool?: string;
+}
+/**
+ * Parse an npm `package.json`. `dependencies` → required,
+ * `optionalDependencies` / `peerDependencies` → optional,
+ * `devDependencies` → dev. Malformed JSON yields an empty list rather than
+ * throwing — a bad manifest should not abort a scan.
+ */
+export declare function parseNpmDependencies(packageJson: string): Dependency[];
+/**
+ * Parse a pip `requirements.txt`. Handles `name==1.2`, `name>=1.2`, `name~=1`,
+ * bare `name`, extras (`name[x]`), and environment markers (`; marker`).
+ * Skips comments, blank lines, and option lines (`-r`, `-e`, `--hash`, URLs).
+ */
+export declare function parsePypiDependencies(requirementsTxt: string): Dependency[];
+/**
+ * Parse a `pyproject.toml`. Covers the two dominant layouts:
+ *
+ *   - **PEP 621** — `[project]` `dependencies = ["flask>=2.0", …]` (required)
+ *     and `[project.optional-dependencies]` group arrays (optional).
+ *   - **Poetry** — `[tool.poetry.dependencies]` (required, skipping the
+ *     `python` version pin) and any `dev`/`group.*` dependency table (dev).
+ *
+ * TOML is scanned with regex, not a full parser (minimal-deps guardrail).
+ */
+export declare function parsePyprojectDependencies(pyprojectToml: string): Dependency[];
+/**
+ * Parse a Gradle build script (`build.gradle` Groovy or `build.gradle.kts`
+ * Kotlin DSL) dependency block. Recognises the common configurations
+ * (`implementation` / `api` / `compileOnly` / `runtimeOnly` /
+ * `annotationProcessor` / `kapt` / `classpath` and their `test*` variants) in
+ * both `impl 'g:a:v'` and `impl("g:a:v")` forms. Coordinates are Maven, so the
+ * ecosystem is `maven` and the name is `groupId:artifactId`. `test*`
+ * configurations map to the `dev` scope. `platform(...)` BOM imports are
+ * skipped (they declare no concrete artifact).
+ */
+export declare function parseGradleDependencies(buildGradle: string): Dependency[];
+/**
+ * Parse a Maven `pom.xml` `<dependency>` blocks. Name is `groupId:artifactId`.
+ * `<scope>test|provided</scope>` → dev, `<optional>true</optional>` → optional.
+ * A `${...}` version is recorded as `unknown` (unresolved property reference).
+ */
+export declare function parseMavenDependencies(pomXml: string): Dependency[];
+/**
+ * Parse a Cargo `Cargo.toml`. `[dependencies]` → required,
+ * `[dev-dependencies]` → dev, `[build-dependencies]` → optional. Handles both
+ * `name = "1.2"` and `name = { version = "1.2", ... }` forms.
+ */
+export declare function parseCargoDependencies(cargoToml: string): Dependency[];
+/**
+ * Parse a Go `go.mod`. Collects `require` directives in both the grouped
+ * `require ( ... )` block and single-line `require path v1.2.3` forms.
+ * A `// indirect` marker maps to the `optional` scope. The module path is
+ * the purl name (`pkg:golang/github.com/foo/bar@v1.2.3`).
+ */
+export declare function parseGoDependencies(goMod: string): Dependency[];
+/**
+ * Parse every manifest present in a {@link DependencyContext} into one
+ * de-duplicated dependency list. De-dup key is `ecosystem|name|version|scope`,
+ * so the same package declared once stays once but a genuine dev/required
+ * split is preserved.
+ */
+export declare function collectDependencies(ctx: DependencyContext | undefined): Dependency[];
+/** Emit a CycloneDX 1.5 BOM document object (serialize with `JSON.stringify`). */
+export declare function toCycloneDx(deps: Dependency[], meta?: SbomMetadata): Record<string, unknown>;
+/** Emit an SPDX 2.3 document object (serialize with `JSON.stringify`). */
+export declare function toSpdx(deps: Dependency[], meta?: SbomMetadata): Record<string, unknown>;
+//# sourceMappingURL=sbom.d.ts.map

package/dist/analysis/sbom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom.d.ts","sourceRoot":"","sources":["../../src/analysis/sbom.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExD,6EAA6E;AAC7E,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEtE,6EAA6E;AAC7E,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,UAAU,GAAG,KAAK,CAAC;AAE9D,qDAAqD;AACrD,MAAM,WAAW,UAAU;IACzB,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,SAAS,CAAC;IACrB,KAAK,EAAE,eAAe,CAAC;IACvB,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AA+CD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,EAAE,CAyBtE;AAoBD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,eAAe,EAAE,MAAM,GAAG,UAAU,EAAE,CAa3E;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,aAAa,EAAE,MAAM,GAAG,UAAU,EAAE,CAqE9E;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,EAAE,CAgBzE;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,EAAE,CAmBnE;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,EAAE,CA+BtE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,EAAE,CA0B/D;AAMD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,iBAAiB,GAAG,SAAS,GAAG,UAAU,EAAE,CAmBpF;AAMD,kFAAkF;AAClF,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,GAAE,YAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA6BhG;AAOD,0EAA0E;AAC1E,wBAAgB,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,GAAE,YAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoC3F"}

package/dist/analysis/sbom.js

@@ -0,0 +1,482 @@
+/**
+ * Software Bill of Materials (SBOM) generation.
+ *
+ * cognium-dev — deterministic SBOM emission (Pillar I). The engine never
+ * reads the filesystem (browser-safety); the caller passes raw manifest text
+ * via the same {@link DependencyContext} surface the deserialization gate
+ * uses (#258/#261). This module turns those manifests into a normalized
+ * dependency list and emits two industry formats:
+ *
+ *   - **CycloneDX 1.5** (`toCycloneDx`) — the OWASP BOM format.
+ *   - **SPDX 2.3** (`toSpdx`) — the Linux Foundation format.
+ *
+ * Both outputs are deterministic: no timestamps, UUIDs, or randomness are
+ * introduced here. Volatile document metadata (generation time, serial
+ * number, namespace) is *injected* by the caller via {@link SbomMetadata},
+ * so a given input always produces byte-identical output unless the caller
+ * chooses otherwise — which keeps SBOMs diffable in CI and tests stable.
+ *
+ * Parsing is regex/`JSON.parse`-scoped, never a full TOML/XML tree: the only
+ * runtime dependencies circle-ir permits are `web-tree-sitter` and `yaml`,
+ * and a manifest dependency list needs nothing heavier.
+ */
+// ---------------------------------------------------------------------------
+// purl helpers
+// ---------------------------------------------------------------------------
+/**
+ * Reduce a declared version spec to a clean, exact-ish version for the purl,
+ * or `undefined` when the spec is a range/reference we should not pin. A purl
+ * without a version is valid, so omitting is preferable to guessing.
+ */
+function purlVersion(spec) {
+    // Strip range operators/whitespace but NOT a leading `v` — Go module
+    // versions (`v1.2.3`) keep it as part of the canonical version.
+    const stripped = spec.trim().replace(/^[\s^~=<>]+/, '');
+    // Accept a single concrete version token (optional Go `v` prefix); reject
+    // residual ranges (`1.0 <2.0`), commas, or unresolved `${...}` / `*`.
+    if (/^v?[0-9][\w.\-+]*$/.test(stripped))
+        return stripped;
+    return undefined;
+}
+/** Percent-encode a purl name segment, preserving the `@scope/name` shape. */
+function encodePurlName(name) {
+    return name
+        .split('/')
+        .map((seg) => encodeURIComponent(seg))
+        .join('/');
+}
+function makePurl(ecosystem, name, version) {
+    const v = purlVersion(version);
+    // Maven names are `groupId:artifactId`; the purl expresses that as the
+    // `namespace/name` path (`pkg:maven/groupId/artifactId`).
+    const path = ecosystem === 'maven' ? name.replace(':', '/') : name;
+    const base = `pkg:${ecosystem}/${encodePurlName(path)}`;
+    return v ? `${base}@${encodeURIComponent(v)}` : base;
+}
+function dep(ecosystem, name, version, scope) {
+    const v = version.trim() || 'unknown';
+    return { name, version: v, ecosystem, scope, purl: makePurl(ecosystem, name, v) };
+}
+// ---------------------------------------------------------------------------
+// per-ecosystem manifest parsers
+// ---------------------------------------------------------------------------
+/**
+ * Parse an npm `package.json`. `dependencies` → required,
+ * `optionalDependencies` / `peerDependencies` → optional,
+ * `devDependencies` → dev. Malformed JSON yields an empty list rather than
+ * throwing — a bad manifest should not abort a scan.
+ */
+export function parseNpmDependencies(packageJson) {
+    if (!packageJson)
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse(packageJson);
+    }
+    catch {
+        return [];
+    }
+    if (!parsed || typeof parsed !== 'object')
+        return [];
+    const obj = parsed;
+    const out = [];
+    const sections = [
+        ['dependencies', 'required'],
+        ['optionalDependencies', 'optional'],
+        ['peerDependencies', 'optional'],
+        ['devDependencies', 'dev'],
+    ];
+    for (const [key, scope] of sections) {
+        const block = obj[key];
+        if (!block || typeof block !== 'object')
+            continue;
+        for (const [name, spec] of Object.entries(block)) {
+            out.push(dep('npm', name, typeof spec === 'string' ? spec : 'unknown', scope));
+        }
+    }
+    return out;
+}
+/**
+ * Parse a single PEP 508 requirement string (`name[extras] (>=|==|~=…)ver ; marker`)
+ * into `{ name, version }`, or `null` when no name can be read. Shared by the
+ * `requirements.txt` and `pyproject.toml` parsers.
+ */
+function parsePep508(spec) {
+    let s = spec.trim();
+    s = s.split(';')[0].trim(); // strip environment marker
+    if (!s)
+        return null;
+    const m = s.match(/^([A-Za-z0-9._-]+)\s*(?:\[[^\]]*\])?\s*(.*)$/);
+    if (!m)
+        return null;
+    const rest = m[2].trim();
+    // First comparator clause's version (drop `,` compound ranges and `(` groups).
+    const verMatch = rest.replace(/^\(/, '').match(/^(?:==|>=|<=|~=|!=|>|<|===)?\s*([^,\s)]+)/);
+    const version = verMatch && verMatch[1] ? verMatch[1] : 'unknown';
+    return { name: m[1], version };
+}
+/**
+ * Parse a pip `requirements.txt`. Handles `name==1.2`, `name>=1.2`, `name~=1`,
+ * bare `name`, extras (`name[x]`), and environment markers (`; marker`).
+ * Skips comments, blank lines, and option lines (`-r`, `-e`, `--hash`, URLs).
+ */
+export function parsePypiDependencies(requirementsTxt) {
+    if (!requirementsTxt)
+        return [];
+    const out = [];
+    for (const raw of requirementsTxt.split(/\r?\n/)) {
+        let line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        if (line.startsWith('-') || /^[a-z]+:\/\//i.test(line))
+            continue; // options / URLs
+        line = line.split('#')[0].trim(); // strip trailing comment
+        if (!line)
+            continue;
+        const parsed = parsePep508(line);
+        if (parsed)
+            out.push(dep('pypi', parsed.name, parsed.version, 'required'));
+    }
+    return out;
+}
+/**
+ * Parse a `pyproject.toml`. Covers the two dominant layouts:
+ *
+ *   - **PEP 621** — `[project]` `dependencies = ["flask>=2.0", …]` (required)
+ *     and `[project.optional-dependencies]` group arrays (optional).
+ *   - **Poetry** — `[tool.poetry.dependencies]` (required, skipping the
+ *     `python` version pin) and any `dev`/`group.*` dependency table (dev).
+ *
+ * TOML is scanned with regex, not a full parser (minimal-deps guardrail).
+ */
+export function parsePyprojectDependencies(pyprojectToml) {
+    if (!pyprojectToml)
+        return [];
+    const out = [];
+    // Line-scan tracking the current TOML table so `dependencies = [...]` under
+    // `[project]` (required) and arrays under `[project.optional-dependencies]`
+    // (optional) are distinguished, and Poetry tables are read as key/value.
+    const lines = pyprojectToml.split(/\r?\n/);
+    let table = '';
+    let poetryScope = null;
+    let inArray = false;
+    let arrayScope = 'required';
+    const pushReq = (raw, scope) => {
+        const cleaned = raw.trim().replace(/^["']|["'],?$/g, '').replace(/,$/, '').trim();
+        if (!cleaned)
+            return;
+        const parsed = parsePep508(cleaned);
+        if (parsed && parsed.name.toLowerCase() !== 'python')
+            out.push(dep('pypi', parsed.name, parsed.version, scope));
+    };
+    for (const raw of lines) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        if (inArray) {
+            if (line.startsWith(']')) {
+                inArray = false;
+                continue;
+            }
+            pushReq(line, arrayScope);
+            continue;
+        }
+        const header = line.match(/^\[([^\]]+)\]$/);
+        if (header) {
+            table = header[1];
+            if (table === 'tool.poetry.dependencies')
+                poetryScope = 'required';
+            else if (/^tool\.poetry\.(dev-dependencies|group\..+\.dependencies)$/.test(table))
+                poetryScope = 'dev';
+            else
+                poetryScope = null;
+            continue;
+        }
+        // PEP 621 array openers.
+        const arrayOpen = line.match(/^(dependencies|[A-Za-z0-9._-]+)\s*=\s*\[(.*)$/);
+        if (arrayOpen && (arrayOpen[1] === 'dependencies' || table === 'project.optional-dependencies')) {
+            arrayScope = arrayOpen[1] === 'dependencies' ? 'required' : 'optional';
+            const inline = arrayOpen[2];
+            if (inline.includes(']')) {
+                // single-line array
+                for (const item of inline.slice(0, inline.indexOf(']')).split(','))
+                    pushReq(item, arrayScope);
+            }
+            else {
+                inArray = true;
+                if (inline.trim())
+                    pushReq(inline, arrayScope);
+            }
+            continue;
+        }
+        // Poetry table entries: `name = "^1.0"` or `name = { version = "1.0" }`.
+        if (poetryScope) {
+            const kv = line.match(/^([A-Za-z0-9._-]+)\s*=\s*(.+)$/);
+            if (!kv || kv[1].toLowerCase() === 'python')
+                continue;
+            let version = 'unknown';
+            const strv = kv[2].match(/^["']([^"']+)["']/);
+            if (strv)
+                version = strv[1];
+            else {
+                const inlinev = kv[2].match(/version\s*=\s*["']([^"']+)["']/);
+                if (inlinev)
+                    version = inlinev[1];
+            }
+            out.push(dep('pypi', kv[1], version, poetryScope));
+        }
+    }
+    return out;
+}
+/**
+ * Parse a Gradle build script (`build.gradle` Groovy or `build.gradle.kts`
+ * Kotlin DSL) dependency block. Recognises the common configurations
+ * (`implementation` / `api` / `compileOnly` / `runtimeOnly` /
+ * `annotationProcessor` / `kapt` / `classpath` and their `test*` variants) in
+ * both `impl 'g:a:v'` and `impl("g:a:v")` forms. Coordinates are Maven, so the
+ * ecosystem is `maven` and the name is `groupId:artifactId`. `test*`
+ * configurations map to the `dev` scope. `platform(...)` BOM imports are
+ * skipped (they declare no concrete artifact).
+ */
+export function parseGradleDependencies(buildGradle) {
+    if (!buildGradle)
+        return [];
+    const out = [];
+    const re = /\b(implementation|api|compileOnly|compileOnlyApi|runtimeOnly|testImplementation|testCompileOnly|testRuntimeOnly|annotationProcessor|kapt|classpath)\s*[(\s]\s*['"]([\w.-]+:[\w.-]+(?::[\w.\-+]+)?)['"]/g;
+    let m;
+    while ((m = re.exec(buildGradle)) !== null) {
+        const config = m[1];
+        const coord = m[2].split(':');
+        if (coord.length < 2)
+            continue;
+        const name = `${coord[0]}:${coord[1]}`;
+        const version = coord[2] ?? 'unknown';
+        const scope = config.startsWith('test') ? 'dev' : 'required';
+        out.push(dep('maven', name, version, scope));
+    }
+    return out;
+}
+/**
+ * Parse a Maven `pom.xml` `<dependency>` blocks. Name is `groupId:artifactId`.
+ * `<scope>test|provided</scope>` → dev, `<optional>true</optional>` → optional.
+ * A `${...}` version is recorded as `unknown` (unresolved property reference).
+ */
+export function parseMavenDependencies(pomXml) {
+    if (!pomXml)
+        return [];
+    const out = [];
+    const depRe = /<dependency>([\s\S]*?)<\/dependency>/g;
+    let m;
+    while ((m = depRe.exec(pomXml)) !== null) {
+        const block = m[1];
+        const gid = block.match(/<groupId>\s*([^<\s]+)\s*<\/groupId>/)?.[1];
+        const aid = block.match(/<artifactId>\s*([^<\s]+)\s*<\/artifactId>/)?.[1];
+        if (!gid || !aid)
+            continue;
+        let version = block.match(/<version>\s*([^<\s]+)\s*<\/version>/)?.[1] ?? 'unknown';
+        if (version.startsWith('${'))
+            version = 'unknown';
+        const mvnScope = block.match(/<scope>\s*([^<\s]+)\s*<\/scope>/)?.[1];
+        const optional = /<optional>\s*true\s*<\/optional>/.test(block);
+        const scope = mvnScope === 'test' || mvnScope === 'provided' ? 'dev' : optional ? 'optional' : 'required';
+        out.push(dep('maven', `${gid}:${aid}`, version, scope));
+    }
+    return out;
+}
+/**
+ * Parse a Cargo `Cargo.toml`. `[dependencies]` → required,
+ * `[dev-dependencies]` → dev, `[build-dependencies]` → optional. Handles both
+ * `name = "1.2"` and `name = { version = "1.2", ... }` forms.
+ */
+export function parseCargoDependencies(cargoToml) {
+    if (!cargoToml)
+        return [];
+    const out = [];
+    let scope = null;
+    for (const raw of cargoToml.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const section = line.match(/^\[([^\]]+)\]$/);
+        if (section) {
+            const s = section[1];
+            if (s === 'dependencies')
+                scope = 'required';
+            else if (s === 'dev-dependencies')
+                scope = 'dev';
+            else if (s === 'build-dependencies')
+                scope = 'optional';
+            else
+                scope = null; // some other table — stop collecting until next dep table
+            continue;
+        }
+        if (!scope)
+            continue;
+        const kv = line.match(/^([A-Za-z0-9._-]+)\s*=\s*(.+)$/);
+        if (!kv)
+            continue;
+        const name = kv[1];
+        const value = kv[2].trim();
+        let version = 'unknown';
+        if (value.startsWith('"') || value.startsWith("'")) {
+            version = value.replace(/^["']|["'].*$/g, '');
+        }
+        else {
+            const inline = value.match(/version\s*=\s*["']([^"']+)["']/);
+            if (inline)
+                version = inline[1];
+        }
+        out.push(dep('cargo', name, version, scope));
+    }
+    return out;
+}
+/**
+ * Parse a Go `go.mod`. Collects `require` directives in both the grouped
+ * `require ( ... )` block and single-line `require path v1.2.3` forms.
+ * A `// indirect` marker maps to the `optional` scope. The module path is
+ * the purl name (`pkg:golang/github.com/foo/bar@v1.2.3`).
+ */
+export function parseGoDependencies(goMod) {
+    if (!goMod)
+        return [];
+    const out = [];
+    let inBlock = false;
+    for (const raw of goMod.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith('//'))
+            continue;
+        if (!inBlock && /^require\s*\($/.test(line)) {
+            inBlock = true;
+            continue;
+        }
+        if (inBlock && line === ')') {
+            inBlock = false;
+            continue;
+        }
+        let spec;
+        if (inBlock)
+            spec = line;
+        else if (/^require\s+/.test(line))
+            spec = line.replace(/^require\s+/, '');
+        else
+            continue;
+        const indirect = /\/\/\s*indirect/.test(spec);
+        spec = spec.replace(/\/\/.*$/, '').trim();
+        const m = spec.match(/^(\S+)\s+(\S+)$/);
+        if (!m)
+            continue;
+        out.push(dep('golang', m[1], m[2], indirect ? 'optional' : 'required'));
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// aggregation
+// ---------------------------------------------------------------------------
+/**
+ * Parse every manifest present in a {@link DependencyContext} into one
+ * de-duplicated dependency list. De-dup key is `ecosystem|name|version|scope`,
+ * so the same package declared once stays once but a genuine dev/required
+ * split is preserved.
+ */
+export function collectDependencies(ctx) {
+    if (!ctx)
+        return [];
+    const all = [];
+    if (ctx.js?.packageJson)
+        all.push(...parseNpmDependencies(ctx.js.packageJson));
+    if (ctx.python?.requirementsTxt)
+        all.push(...parsePypiDependencies(ctx.python.requirementsTxt));
+    if (ctx.python?.pyprojectToml)
+        all.push(...parsePyprojectDependencies(ctx.python.pyprojectToml));
+    if (ctx.java?.pomXml)
+        all.push(...parseMavenDependencies(ctx.java.pomXml));
+    if (ctx.java?.buildGradle)
+        all.push(...parseGradleDependencies(ctx.java.buildGradle));
+    if (ctx.rust?.cargoToml)
+        all.push(...parseCargoDependencies(ctx.rust.cargoToml));
+    const seen = new Set();
+    const deduped = [];
+    for (const d of all) {
+        const key = `${d.ecosystem}|${d.name}|${d.version}|${d.scope}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        deduped.push(d);
+    }
+    return deduped;
+}
+// ---------------------------------------------------------------------------
+// emitters
+// ---------------------------------------------------------------------------
+/** Emit a CycloneDX 1.5 BOM document object (serialize with `JSON.stringify`). */
+export function toCycloneDx(deps, meta = {}) {
+    const bom = {
+        bomFormat: 'CycloneDX',
+        specVersion: '1.5',
+        version: 1,
+    };
+    if (meta.serialNumber)
+        bom.serialNumber = meta.serialNumber;
+    const metadata = {};
+    if (meta.timestamp)
+        metadata.timestamp = meta.timestamp;
+    metadata.tools = [{ vendor: 'Cognium', name: meta.tool ?? 'circle-ir' }];
+    if (meta.name) {
+        metadata.component = {
+            type: 'application',
+            name: meta.name,
+            ...(meta.version ? { version: meta.version } : {}),
+        };
+    }
+    bom.metadata = metadata;
+    bom.components = deps.map((d) => ({
+        type: 'library',
+        name: d.name,
+        version: d.version,
+        purl: d.purl,
+        scope: d.scope === 'dev' ? 'excluded' : d.scope === 'optional' ? 'optional' : 'required',
+        'bom-ref': d.purl,
+    }));
+    return bom;
+}
+/** SPDX identifiers allow only `[a-zA-Z0-9.-]`; sanitize everything else. */
+function spdxId(raw) {
+    return raw.replace(/[^a-zA-Z0-9.-]/g, '-');
+}
+/** Emit an SPDX 2.3 document object (serialize with `JSON.stringify`). */
+export function toSpdx(deps, meta = {}) {
+    const docName = meta.name ?? 'document';
+    const packages = deps.map((d, i) => ({
+        SPDXID: `SPDXRef-Package-${spdxId(d.ecosystem)}-${spdxId(d.name)}-${i}`,
+        name: d.name,
+        versionInfo: d.version,
+        downloadLocation: 'NOASSERTION',
+        filesAnalyzed: false,
+        externalRefs: [
+            {
+                referenceCategory: 'PACKAGE-MANAGER',
+                referenceType: 'purl',
+                referenceLocator: d.purl,
+            },
+        ],
+    }));
+    const relationships = packages.map((p) => ({
+        spdxElementId: 'SPDXRef-DOCUMENT',
+        relatedSpdxElement: p.SPDXID,
+        relationshipType: 'DESCRIBES',
+    }));
+    return {
+        spdxVersion: 'SPDX-2.3',
+        dataLicense: 'CC0-1.0',
+        SPDXID: 'SPDXRef-DOCUMENT',
+        name: docName,
+        documentNamespace: meta.namespace ?? `https://cognium.dev/spdxdocs/${spdxId(docName)}`,
+        creationInfo: {
+            created: meta.timestamp ?? '1970-01-01T00:00:00Z',
+            creators: [`Tool: ${meta.tool ?? 'circle-ir'}`],
+        },
+        packages,
+        relationships,
+    };
+}
+//# sourceMappingURL=sbom.js.map

package/dist/analysis/sbom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom.js","sourceRoot":"","sources":["../../src/analysis/sbom.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA0CH,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,qEAAqE;IACrE,gEAAgE;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACxD,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;SACrC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,SAAoB,EAAE,IAAY,EAAE,OAAe;IACnE,MAAM,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAC/B,uEAAuE;IACvE,0DAA0D;IAC1D,MAAM,IAAI,GAAG,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,MAAM,IAAI,GAAG,OAAO,SAAS,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;IACxD,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED,SAAS,GAAG,CAAC,SAAoB,EAAE,IAAY,EAAE,OAAe,EAAE,KAAsB;IACtF,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACtC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAC5B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAqC;QACjD,CAAC,cAAc,EAAE,UAAU,CAAC;QAC5B,CAAC,sBAAsB,EAAE,UAAU,CAAC;QACpC,CAAC,kBAAkB,EAAE,UAAU,CAAC;QAChC,CAAC,iBAAiB,EAAE,KAAK,CAAC;KAC3B,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,2BAA2B;IACvD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,eAAuB;IAC3D,IAAI,CAAC,eAAe;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,IAAI,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,iBAAiB;QACnF,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,yBAAyB;QAC3D,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CAAC,aAAqB;IAC9D,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAiB,EAAE,CAAC;IAE7B,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,WAAW,GAA2B,IAAI,CAAC;IAC/C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,UAAU,GAAoB,UAAU,CAAC;IAE7C,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,KAAsB,EAAQ,EAAE;QAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClF,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAClH,CAAC,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAE5C,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAC,OAAO,GAAG,KAAK,CAAC;gBAAC,SAAS;YAAC,CAAC;YACxD,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YAClB,IAAI,KAAK,KAAK,0BAA0B;gBAAE,WAAW,GAAG,UAAU,CAAC;iBAC9D,IAAI,4DAA4D,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,WAAW,GAAG,KAAK,CAAC;;gBAClG,WAAW,GAAG,IAAI,CAAC;YACxB,SAAS;QACX,CAAC;QAED,yBAAyB;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC9E,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,cAAc,IAAI,KAAK,KAAK,+BAA+B,CAAC,EAAE,CAAC;YAChG,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;YACvE,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,oBAAoB;gBACpB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;oBAAE,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAChG,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,MAAM,CAAC,IAAI,EAAE;oBAAE,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACjD,CAAC;YACD,SAAS;QACX,CAAC;QAED,yEAAyE;QACzE,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACxD,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ;gBAAE,SAAS;YACtD,IAAI,OAAO,GAAG,SAAS,CAAC;YACxB,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAC9C,IAAI,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;iBACvB,CAAC;gBACJ,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBAC9D,IAAI,OAAO;oBAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACpC,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAAmB;IACzD,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,MAAM,EAAE,GACN,yMAAyM,CAAC;IAC5M,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC/B,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;QACtC,MAAM,KAAK,GAAoB,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;QAC9E,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,uCAAuC,CAAC;IACtD,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,2CAA2C,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;YAAE,SAAS;QAC3B,IAAI,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;QACnF,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,GAAG,SAAS,CAAC;QAClD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChE,MAAM,KAAK,GACT,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;QAC9F,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,IAAI,KAAK,GAA2B,IAAI,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,KAAK,cAAc;gBAAE,KAAK,GAAG,UAAU,CAAC;iBACxC,IAAI,CAAC,KAAK,kBAAkB;gBAAE,KAAK,GAAG,KAAK,CAAC;iBAC5C,IAAI,CAAC,KAAK,oBAAoB;gBAAE,KAAK,GAAG,UAAU,CAAC;;gBACnD,KAAK,GAAG,IAAI,CAAC,CAAC,0DAA0D;YAC7E,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACxD,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,OAAO,GAAG,SAAS,CAAC;QACxB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAC7D,IAAI,MAAM;gBAAE,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7C,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,OAAO,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,IAAY,CAAC;QACjB,IAAI,OAAO;YAAE,IAAI,GAAG,IAAI,CAAC;aACpB,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;;YACrE,SAAS;QACd,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACxC,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAkC;IACpE,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,IAAI,GAAG,CAAC,EAAE,EAAE,WAAW;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC/E,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IAChG,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IACjG,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,IAAI,GAAG,CAAC,IAAI,EAAE,WAAW;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACtF,IAAI,GAAG,CAAC,IAAI,EAAE,SAAS;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAEjF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAC/D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,kFAAkF;AAClF,MAAM,UAAU,WAAW,CAAC,IAAkB,EAAE,OAAqB,EAAE;IACrE,MAAM,GAAG,GAA4B;QACnC,SAAS,EAAE,WAAW;QACtB,WAAW,EAAE,KAAK;QAClB,OAAO,EAAE,CAAC;KACX,CAAC;IACF,IAAI,IAAI,CAAC,YAAY;QAAE,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IAE5D,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,IAAI,CAAC,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACxD,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;IACzE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,QAAQ,CAAC,SAAS,GAAG;YACnB,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnD,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAExB,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChC,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;QACxF,SAAS,EAAE,CAAC,CAAC,IAAI;KAClB,CAAC,CAAC,CAAC;IACJ,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6EAA6E;AAC7E,SAAS,MAAM,CAAC,GAAW;IACzB,OAAO,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,MAAM,CAAC,IAAkB,EAAE,OAAqB,EAAE;IAChE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,EAAE,mBAAmB,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACvE,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,OAAO;QACtB,gBAAgB,EAAE,aAAa;QAC/B,aAAa,EAAE,KAAK;QACpB,YAAY,EAAE;YACZ;gBACE,iBAAiB,EAAE,iBAAiB;gBACpC,aAAa,EAAE,MAAM;gBACrB,gBAAgB,EAAE,CAAC,CAAC,IAAI;aACzB;SACF;KACF,CAAC,CAAC,CAAC;IAEJ,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,aAAa,EAAE,kBAAkB;QACjC,kBAAkB,EAAE,CAAC,CAAC,MAAM;QAC5B,gBAAgB,EAAE,WAAW;KAC9B,CAAC,CAAC,CAAC;IAEJ,OAAO;QACL,WAAW,EAAE,UAAU;QACvB,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE,kBAAkB;QAC1B,IAAI,EAAE,OAAO;QACb,iBAAiB,EAAE,IAAI,CAAC,SAAS,IAAI,gCAAgC,MAAM,CAAC,OAAO,CAAC,EAAE;QACtF,YAAY,EAAE;YACZ,OAAO,EAAE,IAAI,CAAC,SAAS,IAAI,sBAAsB;YACjD,QAAQ,EAAE,CAAC,SAAS,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;SAChD;QACD,QAAQ;QACR,aAAa;KACd,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -4,6 +4,8 @@
  * A universal library for static analysis and taint tracking.
  */
 export { initAnalyzer, analyze, analyzeForAPI, analyzeProject, isAnalyzerInitialized, resetAnalyzer, type AnalyzerOptions, } from './analyzer.js';
+export { parseNpmDependencies, parsePypiDependencies, parsePyprojectDependencies, parseMavenDependencies, parseGradleDependencies, parseCargoDependencies, parseGoDependencies, collectDependencies, toCycloneDx, toSpdx, } from './analysis/sbom.js';
+export type { Dependency, Ecosystem, DependencyScope, SbomMetadata, } from './analysis/sbom.js';
 export type { NamingConventionOptions } from './analysis/passes/naming-convention-pass.js';
 export type { DependencyFanOutOptions } from './analysis/passes/dependency-fan-out-pass.js';
 export type { UnboundedCollectionOptions } from './analysis/passes/unbounded-collection-pass.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,YAAY,EACZ,OAAO,EACP,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,aAAa,EACb,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AAGvB,YAAY,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AAC3F,YAAY,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAC5F,YAAY,EAAE,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AACjG,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,YAAY,EAEV,QAAQ,EACR,IAAI,EACJ,QAAQ,EACR,UAAU,EACV,aAAa,EACb,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,GAAG,EACH,QAAQ,EACR,OAAO,EACP,GAAG,EACH,MAAM,EACN,MAAM,EACN,QAAQ,EACR,KAAK,EACL,WAAW,EACX,SAAS,EACT,cAAc,EACd,UAAU,EACV,UAAU,EACV,cAAc,EACd,QAAQ,EACR,gBAAgB,EAChB,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,aAAa,EACb,gBAAgB,EAGhB,UAAU,EACV,QAAQ,EACR,QAAQ,EAGR,YAAY,EACZ,UAAU,EACV,cAAc,EACd,qBAAqB,EAGrB,YAAY,EACZ,UAAU,EACV,WAAW,EACX,cAAc,EACd,WAAW,EACX,WAAW,EAGX,eAAe,EACf,WAAW,EACX,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,aAAa,EACb,UAAU,EACV,SAAS,GACV,MAAM,kBAAkB,CAAC;AAU1B,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG5D,YAAY,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,UAAU,EACV,KAAK,EACL,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,WAAW,EACX,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,IAAI,EACT,KAAK,SAAS,EACd,KAAK,IAAI,GACV,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,cAAc,EACd,QAAQ,EACR,QAAQ,GACT,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,EAC1B,gCAAgC,EAChC,0BAA0B,EAC1B,kBAAkB,EAClB,OAAO,EACP,aAAa,EACb,WAAW,EACX,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,SAAS,GACf,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,KAAK,QAAQ,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAGxF,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,MAAM,EACN,SAAS,EACT,eAAe,EACf,WAAW,EACX,WAAW,EACX,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,cAAc,GACpB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,YAAY,EACZ,OAAO,EACP,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,aAAa,EACb,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACX,MAAM,GACP,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,UAAU,EACV,SAAS,EACT,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AAC3F,YAAY,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAC5F,YAAY,EAAE,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AACjG,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,YAAY,EAEV,QAAQ,EACR,IAAI,EACJ,QAAQ,EACR,UAAU,EACV,aAAa,EACb,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,GAAG,EACH,QAAQ,EACR,OAAO,EACP,GAAG,EACH,MAAM,EACN,MAAM,EACN,QAAQ,EACR,KAAK,EACL,WAAW,EACX,SAAS,EACT,cAAc,EACd,UAAU,EACV,UAAU,EACV,cAAc,EACd,QAAQ,EACR,gBAAgB,EAChB,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,aAAa,EACb,gBAAgB,EAGhB,UAAU,EACV,QAAQ,EACR,QAAQ,EAGR,YAAY,EACZ,UAAU,EACV,cAAc,EACd,qBAAqB,EAGrB,YAAY,EACZ,UAAU,EACV,WAAW,EACX,cAAc,EACd,WAAW,EACX,WAAW,EAGX,eAAe,EACf,WAAW,EACX,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,aAAa,EACb,UAAU,EACV,SAAS,GACV,MAAM,kBAAkB,CAAC;AAU1B,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG5D,YAAY,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,UAAU,EACV,KAAK,EACL,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,WAAW,EACX,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,IAAI,EACT,KAAK,SAAS,EACd,KAAK,IAAI,GACV,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,cAAc,EACd,QAAQ,EACR,QAAQ,GACT,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,EAC1B,gCAAgC,EAChC,0BAA0B,EAC1B,kBAAkB,EAClB,OAAO,EACP,aAAa,EACb,WAAW,EACX,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,SAAS,GACf,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,KAAK,QAAQ,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAGxF,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,MAAM,EACN,SAAS,EACT,eAAe,EACf,WAAW,EACX,WAAW,EACX,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,cAAc,GACpB,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -5,6 +5,8 @@
  */
 // Main analyzer
 export { initAnalyzer, analyze, analyzeForAPI, analyzeProject, isAnalyzerInitialized, resetAnalyzer, } from './analyzer.js';
+// SBOM generation (deterministic — CycloneDX 1.5 / SPDX 2.3 from manifests)
+export { parseNpmDependencies, parsePypiDependencies, parsePyprojectDependencies, parseMavenDependencies, parseGradleDependencies, parseCargoDependencies, parseGoDependencies, collectDependencies, toCycloneDx, toSpdx, } from './analysis/sbom.js';
 // Runtime values, not just types. `SourceType` / `SinkType` above are
 // `export type`, so re-exporting the unions alone gives consumers nothing to
 // import at runtime — which is exactly what happened in 3.197.0, where the

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,gBAAgB;AAChB,OAAO,EACL,YAAY,EACZ,OAAO,EACP,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,aAAa,GAEd,MAAM,eAAe,CAAC;AAyEvB,sEAAsE;AACtE,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,qEAAqE;AACrE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAY5D,sCAAsC;AACtC,OAAO,EACL,UAAU,EACV,KAAK,EACL,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,WAAW,EACX,eAAe,GAMhB,MAAM,iBAAiB,CAAC;AAEzB,kBAAkB;AAClB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,cAAc,EACd,QAAQ,EACR,QAAQ,GACT,MAAM,iBAAiB,CAAC;AAEzB,qBAAqB;AACrB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,EAC1B,gCAAgC,EAChC,0BAA0B,EAC1B,kBAAkB,EAClB,OAAO,EACP,aAAa,EACb,WAAW,EACX,eAAe,EACf,aAAa,EACb,kBAAkB,GAMnB,MAAM,qBAAqB,CAAC;AAE7B,mBAAmB;AACnB,OAAO,EACL,WAAW,EACX,gBAAgB,GAEjB,MAAM,qBAAqB,CAAC;AAE7B,kBAAkB;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAqB,MAAM,iCAAiC,CAAC;AAExF,uBAAuB;AACvB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,mBAAmB;AACnB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAY9B,gCAAgC;AAChC,OAAO,EACL,MAAM,EACN,SAAS,EACT,eAAe,EACf,WAAW,EACX,WAAW,GAIZ,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,gBAAgB;AAChB,OAAO,EACL,YAAY,EACZ,OAAO,EACP,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,aAAa,GAEd,MAAM,eAAe,CAAC;AAEvB,4EAA4E;AAC5E,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACX,MAAM,GACP,MAAM,oBAAoB,CAAC;AA+E5B,sEAAsE;AACtE,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,qEAAqE;AACrE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAY5D,sCAAsC;AACtC,OAAO,EACL,UAAU,EACV,KAAK,EACL,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,WAAW,EACX,eAAe,GAMhB,MAAM,iBAAiB,CAAC;AAEzB,kBAAkB;AAClB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,cAAc,EACd,QAAQ,EACR,QAAQ,GACT,MAAM,iBAAiB,CAAC;AAEzB,qBAAqB;AACrB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,EAC1B,gCAAgC,EAChC,0BAA0B,EAC1B,kBAAkB,EAClB,OAAO,EACP,aAAa,EACb,WAAW,EACX,eAAe,EACf,aAAa,EACb,kBAAkB,GAMnB,MAAM,qBAAqB,CAAC;AAE7B,mBAAmB;AACnB,OAAO,EACL,WAAW,EACX,gBAAgB,GAEjB,MAAM,qBAAqB,CAAC;AAE7B,kBAAkB;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAqB,MAAM,iCAAiC,CAAC;AAExF,uBAAuB;AACvB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,mBAAmB;AACnB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAY9B,gCAAgC;AAChC,OAAO,EACL,MAAM,EACN,SAAS,EACT,eAAe,EACf,WAAW,EACX,WAAW,GAIZ,MAAM,mBAAmB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.201.0",
+  "version": "3.203.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",