@cdxgen/cdxgen 0.0.1 → 13.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (722) hide show
  1. package/README.md +921 -87
  2. package/bin/audit.js +239 -0
  3. package/bin/cdxgen.js +2324 -0
  4. package/bin/convert.js +213 -0
  5. package/bin/evinse.js +353 -0
  6. package/bin/hbom.js +495 -0
  7. package/bin/repl.js +2224 -0
  8. package/bin/sign.js +195 -0
  9. package/bin/tracebom.js +295 -0
  10. package/bin/validate.js +268 -0
  11. package/bin/verify.js +189 -0
  12. package/data/README.md +307 -0
  13. package/data/bom-1.4.schema.json +1605 -0
  14. package/data/bom-1.5.schema.json +3660 -0
  15. package/data/bom-1.6.schema.json +5511 -0
  16. package/data/bom-1.7.schema.json +6700 -0
  17. package/data/cbomosdb-queries.json +68 -0
  18. package/data/component-tags.json +339 -0
  19. package/data/container-knowledge-index.json +125 -0
  20. package/data/cosdb-queries.json +17 -0
  21. package/data/crypto-oid.json +1998 -0
  22. package/data/cryptography-defs.json +3793 -0
  23. package/data/cryptography-defs.schema.json +576 -0
  24. package/data/cyclonedx-2.0-bundled.schema.json +7182 -0
  25. package/data/frameworks-list.json +219 -0
  26. package/data/glibc-stdlib.json +117 -0
  27. package/data/gtfobins-index.json +6296 -0
  28. package/data/helpers/init.gradle +71 -0
  29. package/data/jsf-0.82.schema.json +211 -0
  30. package/data/known-licenses.json +82 -0
  31. package/data/lic-mapping.json +338 -0
  32. package/data/license-aliases.json +6624 -0
  33. package/data/license-db.json +39059 -0
  34. package/data/license-deprecations.json +302 -0
  35. package/data/lolbas-index.json +150 -0
  36. package/data/predictive-audit-allowlist.json +11 -0
  37. package/data/pypi-pkg-aliases.json +1199 -0
  38. package/data/python-stdlib.json +308 -0
  39. package/data/queries-darwin.json +193 -0
  40. package/data/queries-win.json +257 -0
  41. package/data/queries.json +268 -0
  42. package/data/ruby-known-modules.json +281 -0
  43. package/data/rules/ai-agent-governance.yaml +323 -0
  44. package/data/rules/ai-bom.yaml +268 -0
  45. package/data/rules/ai-oversight.yaml +186 -0
  46. package/data/rules/ai-provenance.yaml +92 -0
  47. package/data/rules/asar-archives.yaml +150 -0
  48. package/data/rules/cbom-security.yaml +165 -0
  49. package/data/rules/chrome-extensions.yaml +248 -0
  50. package/data/rules/ci-permissions.yaml +802 -0
  51. package/data/rules/container-risk.yaml +353 -0
  52. package/data/rules/dependency-sources.yaml +236 -0
  53. package/data/rules/golem-go.yaml +229 -0
  54. package/data/rules/hbom-compliance.yaml +325 -0
  55. package/data/rules/hbom-performance.yaml +307 -0
  56. package/data/rules/hbom-security.yaml +248 -0
  57. package/data/rules/host-topology.yaml +165 -0
  58. package/data/rules/mcp-servers.yaml +388 -0
  59. package/data/rules/obom-runtime.yaml +1776 -0
  60. package/data/rules/package-integrity.yaml +364 -0
  61. package/data/rules/rootfs-hardening.yaml +179 -0
  62. package/data/rules/vscode-extensions.yaml +237 -0
  63. package/data/spdx-export.schema.json +6794 -0
  64. package/data/spdx-license-list.json +7449 -0
  65. package/data/spdx-licenses.json +759 -0
  66. package/data/spdx.schema.json +819 -0
  67. package/data/templates/README.md +3 -0
  68. package/data/templates/asvs-4.0.3.cdx.json +2943 -0
  69. package/data/templates/asvs-5.0.cdx.json +3046 -0
  70. package/data/templates/bsimm-v13.cdx.json +1008 -0
  71. package/data/templates/masvs-2.0.0.cdx.json +225 -0
  72. package/data/templates/nist-ssdf-1.1.cdx.json +828 -0
  73. package/data/templates/pcissc-secure-slc-1.1.cdx.json +1027 -0
  74. package/data/templates/scvs-1.0.0.cdx.json +813 -0
  75. package/data/templates/ssaf-DRAFT-2023-11.cdx.json +127 -0
  76. package/data/vendor-alias.json +41967 -0
  77. package/data/wrapdb-releases.json +4227 -0
  78. package/index.cjs +15 -0
  79. package/lib/audit/index.js +2800 -0
  80. package/lib/audit/progress.js +114 -0
  81. package/lib/audit/reporters.js +937 -0
  82. package/lib/audit/scoring.js +560 -0
  83. package/lib/audit/targets.js +798 -0
  84. package/lib/cli/bomAssembly.js +1833 -0
  85. package/lib/cli/cliOptions.js +513 -0
  86. package/lib/cli/index.js +2759 -0
  87. package/lib/cli/jsBom.js +2087 -0
  88. package/lib/cli/jvmBom.js +1858 -0
  89. package/lib/cli/managedBom.js +2083 -0
  90. package/lib/cli/nativeBom.js +2125 -0
  91. package/lib/core/activity.js +1087 -0
  92. package/lib/core/env.js +719 -0
  93. package/lib/core/fs.js +1058 -0
  94. package/lib/core/httpClient.js +730 -0
  95. package/lib/core/logger.js +142 -0
  96. package/lib/core/parallel.js +323 -0
  97. package/lib/core/paths.js +70 -0
  98. package/lib/core/projectConfig.js +122 -0
  99. package/lib/core/propertySanitizer.js +174 -0
  100. package/lib/core/spdx.js +5 -0
  101. package/lib/core/state.js +59 -0
  102. package/lib/core/text.js +207 -0
  103. package/lib/core/ui.js +876 -0
  104. package/lib/core/urls.js +84 -0
  105. package/lib/ecosystems/asarutils.js +1636 -0
  106. package/lib/ecosystems/bunutils.js +402 -0
  107. package/lib/ecosystems/caxa.js +77 -0
  108. package/lib/ecosystems/chromextutils.js +1174 -0
  109. package/lib/ecosystems/cmakeResolver.js +587 -0
  110. package/lib/ecosystems/cppEvidence.js +305 -0
  111. package/lib/ecosystems/denoutils.js +1094 -0
  112. package/lib/ecosystems/dotnetutils.js +132 -0
  113. package/lib/ecosystems/ecosystems.js +2772 -0
  114. package/lib/ecosystems/golem.js +1807 -0
  115. package/lib/ecosystems/gradleutils.js +1048 -0
  116. package/lib/ecosystems/jsEvidence.js +317 -0
  117. package/lib/ecosystems/npmutils.js +586 -0
  118. package/lib/ecosystems/parsers-bazel.js +875 -0
  119. package/lib/ecosystems/parsers-dotnet.js +1430 -0
  120. package/lib/ecosystems/parsers-gleam.js +302 -0
  121. package/lib/ecosystems/parsers-go.js +818 -0
  122. package/lib/ecosystems/parsers-js.js +4222 -0
  123. package/lib/ecosystems/parsers-jvm.js +948 -0
  124. package/lib/ecosystems/parsers-misc.js +3191 -0
  125. package/lib/ecosystems/parsers-python.js +2070 -0
  126. package/lib/ecosystems/parsers-rust.js +1294 -0
  127. package/lib/ecosystems/parsers-zig.js +861 -0
  128. package/lib/ecosystems/pep770.js +341 -0
  129. package/lib/ecosystems/pylockutils.js +427 -0
  130. package/lib/ecosystems/pythonutils.js +1281 -0
  131. package/lib/ecosystems/registryProvenance.js +1003 -0
  132. package/lib/ecosystems/remote/huggingface.js +1343 -0
  133. package/lib/ecosystems/rubyutils.js +1629 -0
  134. package/lib/ecosystems/rusi.js +820 -0
  135. package/lib/ecosystems/sbtutils.js +972 -0
  136. package/lib/ecosystems/tea.js +607 -0
  137. package/lib/ecosystems/utils.js +575 -0
  138. package/lib/ecosystems/zigResolver.js +410 -0
  139. package/lib/evinser/db.js +145 -0
  140. package/lib/evinser/evinser.js +2362 -0
  141. package/lib/evinser/scalasem.js +65 -0
  142. package/lib/evinser/swiftsem.js +767 -0
  143. package/lib/helpers/annotationFormatter.js +84 -0
  144. package/lib/helpers/bomSigner.js +312 -0
  145. package/lib/helpers/exportUtils.js +160 -0
  146. package/lib/helpers/remote/dependency-track.js +117 -0
  147. package/lib/helpers/versutils.js +202 -0
  148. package/lib/helpers/vsixutils.js +1069 -0
  149. package/lib/inventory/agentFormulationParser.js +322 -0
  150. package/lib/inventory/aiCollector.js +2140 -0
  151. package/lib/inventory/aiInventory.js +414 -0
  152. package/lib/inventory/aiModelVariants.js +121 -0
  153. package/lib/inventory/aiOversightCollector.js +661 -0
  154. package/lib/inventory/aiProvenanceCollector.js +822 -0
  155. package/lib/inventory/analyzer.js +6089 -0
  156. package/lib/inventory/analyzerScope.js +807 -0
  157. package/lib/inventory/astWorker.js +20 -0
  158. package/lib/inventory/atomUtils.js +1092 -0
  159. package/lib/inventory/auditCategories.js +192 -0
  160. package/lib/inventory/bomUtils.js +369 -0
  161. package/lib/inventory/cacheCommands.js +182 -0
  162. package/lib/inventory/cacheDir.js +104 -0
  163. package/lib/inventory/cbomutils.js +590 -0
  164. package/lib/inventory/cdxrs.js +434 -0
  165. package/lib/inventory/ciParsers/azurePipelines.js +295 -0
  166. package/lib/inventory/ciParsers/circleCi.js +286 -0
  167. package/lib/inventory/ciParsers/common.js +24 -0
  168. package/lib/inventory/ciParsers/githubActions.js +2434 -0
  169. package/lib/inventory/ciParsers/gitlabCi.js +213 -0
  170. package/lib/inventory/ciParsers/jenkins.js +180 -0
  171. package/lib/inventory/citations.js +234 -0
  172. package/lib/inventory/communityAiConfigParser.js +756 -0
  173. package/lib/inventory/containerRisk.js +204 -0
  174. package/lib/inventory/cryptoAlgorithmFamily.js +258 -0
  175. package/lib/inventory/deps.js +807 -0
  176. package/lib/inventory/depsUtils.js +588 -0
  177. package/lib/inventory/display.js +2128 -0
  178. package/lib/inventory/dosai.js +601 -0
  179. package/lib/inventory/dosaiParsers.js +154 -0
  180. package/lib/inventory/dynamic.js +145 -0
  181. package/lib/inventory/envcontext.js +1789 -0
  182. package/lib/inventory/evidenceUtils.js +774 -0
  183. package/lib/inventory/fetchBatch.js +779 -0
  184. package/lib/inventory/fetchRate.js +255 -0
  185. package/lib/inventory/forgeEnricher.js +300 -0
  186. package/lib/inventory/formulationParsers.js +422 -0
  187. package/lib/inventory/gtfobins.js +339 -0
  188. package/lib/inventory/hbom.js +719 -0
  189. package/lib/inventory/hbomAnalysis.js +310 -0
  190. package/lib/inventory/hbomLoader.js +35 -0
  191. package/lib/inventory/hostTopology.js +835 -0
  192. package/lib/inventory/inventoryStats.js +100 -0
  193. package/lib/inventory/jsonLike.js +121 -0
  194. package/lib/inventory/licenseEnhancer.js +918 -0
  195. package/lib/inventory/lolbas.js +285 -0
  196. package/lib/inventory/mcp.js +253 -0
  197. package/lib/inventory/mcpConfigParser.js +683 -0
  198. package/lib/inventory/mcpDiscovery.js +112 -0
  199. package/lib/inventory/mcpPinning.js +209 -0
  200. package/lib/inventory/osPackageResolver.js +493 -0
  201. package/lib/inventory/osinfo.js +277 -0
  202. package/lib/inventory/osqueryTransform.js +274 -0
  203. package/lib/inventory/plugins.js +466 -0
  204. package/lib/inventory/protobom.js +231 -0
  205. package/lib/inventory/protobomLoader.js +43 -0
  206. package/lib/inventory/provenanceUtils.js +224 -0
  207. package/lib/inventory/purl.js +749 -0
  208. package/lib/inventory/rustFormulationParser.js +339 -0
  209. package/lib/inventory/sbomDocument.js +340 -0
  210. package/lib/inventory/source.js +1488 -0
  211. package/lib/inventory/spdx.js +361 -0
  212. package/lib/inventory/spdxExpression.js +512 -0
  213. package/lib/inventory/spdxUtils.js +107 -0
  214. package/lib/inventory/table.js +263 -0
  215. package/lib/inventory/traceRunner.js +439 -0
  216. package/lib/inventory/unicodeScan.js +147 -0
  217. package/lib/managers/binary.js +3307 -0
  218. package/lib/managers/containerutils.js +125 -0
  219. package/lib/managers/docker.js +2145 -0
  220. package/lib/managers/dockerConnection.js +162 -0
  221. package/lib/managers/oci.js +704 -0
  222. package/lib/managers/piptree.js +267 -0
  223. package/lib/parsers/cmakeCache.js +199 -0
  224. package/lib/parsers/gguf.js +492 -0
  225. package/lib/parsers/gitAiNotes.js +233 -0
  226. package/lib/parsers/gitmodules.js +239 -0
  227. package/lib/parsers/htmlExtract.js +610 -0
  228. package/lib/parsers/huggingfaceManifest.js +551 -0
  229. package/lib/parsers/huggingfaceUtils.js +506 -0
  230. package/lib/parsers/iri.js +618 -0
  231. package/lib/parsers/npmrc.js +99 -0
  232. package/lib/parsers/ollama.js +101 -0
  233. package/lib/parsers/xml.js +841 -0
  234. package/lib/server/openapi.yaml +433 -0
  235. package/lib/server/server.js +616 -0
  236. package/lib/stages/postgen/annotator.js +977 -0
  237. package/lib/stages/postgen/auditBom.js +468 -0
  238. package/lib/stages/postgen/postgen.js +1239 -0
  239. package/lib/stages/postgen/ruleEngine.js +731 -0
  240. package/lib/stages/postgen/sortBom.js +195 -0
  241. package/lib/stages/postgen/spdxConverter.js +796 -0
  242. package/lib/stages/postgen/specVersionCompat.js +703 -0
  243. package/lib/stages/pregen/envAudit.js +388 -0
  244. package/lib/stages/pregen/pregen.js +637 -0
  245. package/lib/third-party/README.md +9 -0
  246. package/lib/third-party/arborist/CHANGELOG.md +1109 -0
  247. package/lib/third-party/arborist/LICENSE.md +20 -0
  248. package/lib/third-party/arborist/README.md +315 -0
  249. package/lib/third-party/arborist/lib/arborist/index.js +258 -0
  250. package/lib/third-party/arborist/lib/arborist/load-actual.js +605 -0
  251. package/lib/third-party/arborist/lib/arborist/load-virtual.js +300 -0
  252. package/lib/third-party/arborist/lib/bin-links.js +120 -0
  253. package/lib/third-party/arborist/lib/calc-dep-flags.js +130 -0
  254. package/lib/third-party/arborist/lib/case-insensitive-map.js +51 -0
  255. package/lib/third-party/arborist/lib/consistent-resolve.js +42 -0
  256. package/lib/third-party/arborist/lib/debug.js +50 -0
  257. package/lib/third-party/arborist/lib/dep-valid.js +190 -0
  258. package/lib/third-party/arborist/lib/edge.js +417 -0
  259. package/lib/third-party/arborist/lib/from-path.js +36 -0
  260. package/lib/third-party/arborist/lib/gather-dep-set.js +43 -0
  261. package/lib/third-party/arborist/lib/index.js +22 -0
  262. package/lib/third-party/arborist/lib/inventory.js +138 -0
  263. package/lib/third-party/arborist/lib/link.js +169 -0
  264. package/lib/third-party/arborist/lib/node.js +1673 -0
  265. package/lib/third-party/arborist/lib/npm-extension.js +45 -0
  266. package/lib/third-party/arborist/lib/override-resolves.js +11 -0
  267. package/lib/third-party/arborist/lib/override-set.js +319 -0
  268. package/lib/third-party/arborist/lib/package-extensions.js +289 -0
  269. package/lib/third-party/arborist/lib/printable.js +210 -0
  270. package/lib/third-party/arborist/lib/proc-log.js +30 -0
  271. package/lib/third-party/arborist/lib/realpath.js +100 -0
  272. package/lib/third-party/arborist/lib/relpath.js +4 -0
  273. package/lib/third-party/arborist/lib/shrinkwrap.js +1291 -0
  274. package/lib/third-party/arborist/lib/spec-from-lock.js +34 -0
  275. package/lib/third-party/arborist/lib/tree-check.js +165 -0
  276. package/lib/third-party/arborist/lib/validate-npm-package-name.js +107 -0
  277. package/lib/third-party/arborist/lib/version-from-tgz.js +51 -0
  278. package/lib/third-party/arborist/lib/yarn-lock.js +397 -0
  279. package/lib/validator/bomValidator.js +985 -0
  280. package/lib/validator/complianceEngine.js +241 -0
  281. package/lib/validator/complianceRules.js +1680 -0
  282. package/lib/validator/generated/runtime.mjs +17 -0
  283. package/lib/validator/generated/validate-1.6.mjs +21258 -0
  284. package/lib/validator/generated/validate-1.7.mjs +24803 -0
  285. package/lib/validator/generated/validate-2.0.mjs +22931 -0
  286. package/lib/validator/index.js +246 -0
  287. package/lib/validator/reporters/annotations.js +142 -0
  288. package/lib/validator/reporters/console.js +160 -0
  289. package/lib/validator/reporters/index.js +41 -0
  290. package/lib/validator/reporters/json.js +37 -0
  291. package/lib/validator/reporters/sarif.js +184 -0
  292. package/package.json +209 -26
  293. package/types/bin/audit.d.ts +3 -0
  294. package/types/bin/audit.d.ts.map +1 -0
  295. package/types/bin/cdxgen.d.ts +3 -0
  296. package/types/bin/cdxgen.d.ts.map +1 -0
  297. package/types/bin/convert.d.ts +3 -0
  298. package/types/bin/convert.d.ts.map +1 -0
  299. package/types/bin/evinse.d.ts +3 -0
  300. package/types/bin/evinse.d.ts.map +1 -0
  301. package/types/bin/hbom.d.ts +3 -0
  302. package/types/bin/hbom.d.ts.map +1 -0
  303. package/types/bin/repl.d.ts +3 -0
  304. package/types/bin/repl.d.ts.map +1 -0
  305. package/types/bin/sign.d.ts +3 -0
  306. package/types/bin/sign.d.ts.map +1 -0
  307. package/types/bin/tracebom.d.ts +3 -0
  308. package/types/bin/tracebom.d.ts.map +1 -0
  309. package/types/bin/validate.d.ts +14 -0
  310. package/types/bin/validate.d.ts.map +1 -0
  311. package/types/bin/verify.d.ts +3 -0
  312. package/types/bin/verify.d.ts.map +1 -0
  313. package/types/lib/audit/index.d.ts +153 -0
  314. package/types/lib/audit/index.d.ts.map +1 -0
  315. package/types/lib/audit/progress.d.ts +31 -0
  316. package/types/lib/audit/progress.d.ts.map +1 -0
  317. package/types/lib/audit/reporters.d.ts +62 -0
  318. package/types/lib/audit/reporters.d.ts.map +1 -0
  319. package/types/lib/audit/scoring.d.ts +36 -0
  320. package/types/lib/audit/scoring.d.ts.map +1 -0
  321. package/types/lib/audit/targets.d.ts +77 -0
  322. package/types/lib/audit/targets.d.ts.map +1 -0
  323. package/types/lib/cli/bomAssembly.d.ts +315 -0
  324. package/types/lib/cli/bomAssembly.d.ts.map +1 -0
  325. package/types/lib/cli/cliOptions.d.ts +156 -0
  326. package/types/lib/cli/cliOptions.d.ts.map +1 -0
  327. package/types/lib/cli/index.d.ts +107 -0
  328. package/types/lib/cli/index.d.ts.map +1 -0
  329. package/types/lib/cli/jsBom.d.ts +94 -0
  330. package/types/lib/cli/jsBom.d.ts.map +1 -0
  331. package/types/lib/cli/jvmBom.d.ts +54 -0
  332. package/types/lib/cli/jvmBom.d.ts.map +1 -0
  333. package/types/lib/cli/managedBom.d.ts +105 -0
  334. package/types/lib/cli/managedBom.d.ts.map +1 -0
  335. package/types/lib/cli/nativeBom.d.ts +143 -0
  336. package/types/lib/cli/nativeBom.d.ts.map +1 -0
  337. package/types/lib/core/activity.d.ts +178 -0
  338. package/types/lib/core/activity.d.ts.map +1 -0
  339. package/types/lib/core/env.d.ts +192 -0
  340. package/types/lib/core/env.d.ts.map +1 -0
  341. package/types/lib/core/fs.d.ts +158 -0
  342. package/types/lib/core/fs.d.ts.map +1 -0
  343. package/types/lib/core/httpClient.d.ts +149 -0
  344. package/types/lib/core/httpClient.d.ts.map +1 -0
  345. package/types/lib/core/logger.d.ts +28 -0
  346. package/types/lib/core/logger.d.ts.map +1 -0
  347. package/types/lib/core/parallel.d.ts +95 -0
  348. package/types/lib/core/parallel.d.ts.map +1 -0
  349. package/types/lib/core/paths.d.ts +36 -0
  350. package/types/lib/core/paths.d.ts.map +1 -0
  351. package/types/lib/core/projectConfig.d.ts +23 -0
  352. package/types/lib/core/projectConfig.d.ts.map +1 -0
  353. package/types/lib/core/propertySanitizer.d.ts +23 -0
  354. package/types/lib/core/propertySanitizer.d.ts.map +1 -0
  355. package/types/lib/core/spdx.d.ts +5 -0
  356. package/types/lib/core/spdx.d.ts.map +1 -0
  357. package/types/lib/core/state.d.ts +20 -0
  358. package/types/lib/core/state.d.ts.map +1 -0
  359. package/types/lib/core/text.d.ts +78 -0
  360. package/types/lib/core/text.d.ts.map +1 -0
  361. package/types/lib/core/ui.d.ts +87 -0
  362. package/types/lib/core/ui.d.ts.map +1 -0
  363. package/types/lib/core/urls.d.ts +43 -0
  364. package/types/lib/core/urls.d.ts.map +1 -0
  365. package/types/lib/ecosystems/asarutils.d.ts +71 -0
  366. package/types/lib/ecosystems/asarutils.d.ts.map +1 -0
  367. package/types/lib/ecosystems/bunutils.d.ts +38 -0
  368. package/types/lib/ecosystems/bunutils.d.ts.map +1 -0
  369. package/types/lib/ecosystems/caxa.d.ts +8 -0
  370. package/types/lib/ecosystems/caxa.d.ts.map +1 -0
  371. package/types/lib/ecosystems/chromextutils.d.ts +97 -0
  372. package/types/lib/ecosystems/chromextutils.d.ts.map +1 -0
  373. package/types/lib/ecosystems/cmakeResolver.d.ts +176 -0
  374. package/types/lib/ecosystems/cmakeResolver.d.ts.map +1 -0
  375. package/types/lib/ecosystems/cppEvidence.d.ts +35 -0
  376. package/types/lib/ecosystems/cppEvidence.d.ts.map +1 -0
  377. package/types/lib/ecosystems/denoutils.d.ts +76 -0
  378. package/types/lib/ecosystems/denoutils.d.ts.map +1 -0
  379. package/types/lib/ecosystems/dotnetutils.d.ts +45 -0
  380. package/types/lib/ecosystems/dotnetutils.d.ts.map +1 -0
  381. package/types/lib/ecosystems/ecosystems.d.ts +279 -0
  382. package/types/lib/ecosystems/ecosystems.d.ts.map +1 -0
  383. package/types/lib/ecosystems/golem.d.ts +60 -0
  384. package/types/lib/ecosystems/golem.d.ts.map +1 -0
  385. package/types/lib/ecosystems/gradleutils.d.ts +139 -0
  386. package/types/lib/ecosystems/gradleutils.d.ts.map +1 -0
  387. package/types/lib/ecosystems/jsEvidence.d.ts +17 -0
  388. package/types/lib/ecosystems/jsEvidence.d.ts.map +1 -0
  389. package/types/lib/ecosystems/npmutils.d.ts +183 -0
  390. package/types/lib/ecosystems/npmutils.d.ts.map +1 -0
  391. package/types/lib/ecosystems/parsers-bazel.d.ts +36 -0
  392. package/types/lib/ecosystems/parsers-bazel.d.ts.map +1 -0
  393. package/types/lib/ecosystems/parsers-dotnet.d.ts +116 -0
  394. package/types/lib/ecosystems/parsers-dotnet.d.ts.map +1 -0
  395. package/types/lib/ecosystems/parsers-gleam.d.ts +33 -0
  396. package/types/lib/ecosystems/parsers-gleam.d.ts.map +1 -0
  397. package/types/lib/ecosystems/parsers-go.d.ts +92 -0
  398. package/types/lib/ecosystems/parsers-go.d.ts.map +1 -0
  399. package/types/lib/ecosystems/parsers-js.d.ts +242 -0
  400. package/types/lib/ecosystems/parsers-js.d.ts.map +1 -0
  401. package/types/lib/ecosystems/parsers-jvm.d.ts +100 -0
  402. package/types/lib/ecosystems/parsers-jvm.d.ts.map +1 -0
  403. package/types/lib/ecosystems/parsers-misc.d.ts +450 -0
  404. package/types/lib/ecosystems/parsers-misc.d.ts.map +1 -0
  405. package/types/lib/ecosystems/parsers-python.d.ts +145 -0
  406. package/types/lib/ecosystems/parsers-python.d.ts.map +1 -0
  407. package/types/lib/ecosystems/parsers-rust.d.ts +56 -0
  408. package/types/lib/ecosystems/parsers-rust.d.ts.map +1 -0
  409. package/types/lib/ecosystems/parsers-zig.d.ts +83 -0
  410. package/types/lib/ecosystems/parsers-zig.d.ts.map +1 -0
  411. package/types/lib/ecosystems/pep770.d.ts +38 -0
  412. package/types/lib/ecosystems/pep770.d.ts.map +1 -0
  413. package/types/lib/ecosystems/pylockutils.d.ts +68 -0
  414. package/types/lib/ecosystems/pylockutils.d.ts.map +1 -0
  415. package/types/lib/ecosystems/pythonutils.d.ts +70 -0
  416. package/types/lib/ecosystems/pythonutils.d.ts.map +1 -0
  417. package/types/lib/ecosystems/registryProvenance.d.ts +26 -0
  418. package/types/lib/ecosystems/registryProvenance.d.ts.map +1 -0
  419. package/types/lib/ecosystems/remote/huggingface.d.ts +31 -0
  420. package/types/lib/ecosystems/remote/huggingface.d.ts.map +1 -0
  421. package/types/lib/ecosystems/rubyutils.d.ts +182 -0
  422. package/types/lib/ecosystems/rubyutils.d.ts.map +1 -0
  423. package/types/lib/ecosystems/rusi.d.ts +40 -0
  424. package/types/lib/ecosystems/rusi.d.ts.map +1 -0
  425. package/types/lib/ecosystems/sbtutils.d.ts +179 -0
  426. package/types/lib/ecosystems/sbtutils.d.ts.map +1 -0
  427. package/types/lib/ecosystems/tea.d.ts +180 -0
  428. package/types/lib/ecosystems/tea.d.ts.map +1 -0
  429. package/types/lib/ecosystems/utils.d.ts +41 -0
  430. package/types/lib/ecosystems/utils.d.ts.map +1 -0
  431. package/types/lib/ecosystems/zigResolver.d.ts +70 -0
  432. package/types/lib/ecosystems/zigResolver.d.ts.map +1 -0
  433. package/types/lib/evinser/db.d.ts +17 -0
  434. package/types/lib/evinser/db.d.ts.map +1 -0
  435. package/types/lib/evinser/evinser.d.ts +354 -0
  436. package/types/lib/evinser/evinser.d.ts.map +1 -0
  437. package/types/lib/evinser/scalasem.d.ts +15 -0
  438. package/types/lib/evinser/scalasem.d.ts.map +1 -0
  439. package/types/lib/evinser/swiftsem.d.ts +103 -0
  440. package/types/lib/evinser/swiftsem.d.ts.map +1 -0
  441. package/types/lib/helpers/annotationFormatter.d.ts +23 -0
  442. package/types/lib/helpers/annotationFormatter.d.ts.map +1 -0
  443. package/types/lib/helpers/bomSigner.d.ts +28 -0
  444. package/types/lib/helpers/bomSigner.d.ts.map +1 -0
  445. package/types/lib/helpers/exportUtils.d.ts +52 -0
  446. package/types/lib/helpers/exportUtils.d.ts.map +1 -0
  447. package/types/lib/helpers/remote/dependency-track.d.ts +23 -0
  448. package/types/lib/helpers/remote/dependency-track.d.ts.map +1 -0
  449. package/types/lib/helpers/versutils.d.ts +8 -0
  450. package/types/lib/helpers/versutils.d.ts.map +1 -0
  451. package/types/lib/helpers/vsixutils.d.ts +130 -0
  452. package/types/lib/helpers/vsixutils.d.ts.map +1 -0
  453. package/types/lib/inventory/agentFormulationParser.d.ts +21 -0
  454. package/types/lib/inventory/agentFormulationParser.d.ts.map +1 -0
  455. package/types/lib/inventory/aiCollector.d.ts +61 -0
  456. package/types/lib/inventory/aiCollector.d.ts.map +1 -0
  457. package/types/lib/inventory/aiInventory.d.ts +103 -0
  458. package/types/lib/inventory/aiInventory.d.ts.map +1 -0
  459. package/types/lib/inventory/aiModelVariants.d.ts +31 -0
  460. package/types/lib/inventory/aiModelVariants.d.ts.map +1 -0
  461. package/types/lib/inventory/aiOversightCollector.d.ts +28 -0
  462. package/types/lib/inventory/aiOversightCollector.d.ts.map +1 -0
  463. package/types/lib/inventory/aiProvenanceCollector.d.ts +13 -0
  464. package/types/lib/inventory/aiProvenanceCollector.d.ts.map +1 -0
  465. package/types/lib/inventory/analyzer.d.ts +157 -0
  466. package/types/lib/inventory/analyzer.d.ts.map +1 -0
  467. package/types/lib/inventory/analyzerScope.d.ts +106 -0
  468. package/types/lib/inventory/analyzerScope.d.ts.map +1 -0
  469. package/types/lib/inventory/astWorker.d.ts +9 -0
  470. package/types/lib/inventory/astWorker.d.ts.map +1 -0
  471. package/types/lib/inventory/atomUtils.d.ts +159 -0
  472. package/types/lib/inventory/atomUtils.d.ts.map +1 -0
  473. package/types/lib/inventory/auditCategories.d.ts +80 -0
  474. package/types/lib/inventory/auditCategories.d.ts.map +1 -0
  475. package/types/lib/inventory/bomUtils.d.ts +145 -0
  476. package/types/lib/inventory/bomUtils.d.ts.map +1 -0
  477. package/types/lib/inventory/cacheCommands.d.ts +28 -0
  478. package/types/lib/inventory/cacheCommands.d.ts.map +1 -0
  479. package/types/lib/inventory/cacheDir.d.ts +55 -0
  480. package/types/lib/inventory/cacheDir.d.ts.map +1 -0
  481. package/types/lib/inventory/cbomutils.d.ts +37 -0
  482. package/types/lib/inventory/cbomutils.d.ts.map +1 -0
  483. package/types/lib/inventory/cdxrs.d.ts +90 -0
  484. package/types/lib/inventory/cdxrs.d.ts.map +1 -0
  485. package/types/lib/inventory/ciParsers/azurePipelines.d.ts +27 -0
  486. package/types/lib/inventory/ciParsers/azurePipelines.d.ts.map +1 -0
  487. package/types/lib/inventory/ciParsers/circleCi.d.ts +27 -0
  488. package/types/lib/inventory/ciParsers/circleCi.d.ts.map +1 -0
  489. package/types/lib/inventory/ciParsers/common.d.ts +11 -0
  490. package/types/lib/inventory/ciParsers/common.d.ts.map +1 -0
  491. package/types/lib/inventory/ciParsers/githubActions.d.ts +38 -0
  492. package/types/lib/inventory/ciParsers/githubActions.d.ts.map +1 -0
  493. package/types/lib/inventory/ciParsers/gitlabCi.d.ts +26 -0
  494. package/types/lib/inventory/ciParsers/gitlabCi.d.ts.map +1 -0
  495. package/types/lib/inventory/ciParsers/jenkins.d.ts +26 -0
  496. package/types/lib/inventory/ciParsers/jenkins.d.ts.map +1 -0
  497. package/types/lib/inventory/citations.d.ts +90 -0
  498. package/types/lib/inventory/citations.d.ts.map +1 -0
  499. package/types/lib/inventory/communityAiConfigParser.d.ts +14 -0
  500. package/types/lib/inventory/communityAiConfigParser.d.ts.map +1 -0
  501. package/types/lib/inventory/containerRisk.d.ts +20 -0
  502. package/types/lib/inventory/containerRisk.d.ts.map +1 -0
  503. package/types/lib/inventory/cryptoAlgorithmFamily.d.ts +37 -0
  504. package/types/lib/inventory/cryptoAlgorithmFamily.d.ts.map +1 -0
  505. package/types/lib/inventory/deps.d.ts +140 -0
  506. package/types/lib/inventory/deps.d.ts.map +1 -0
  507. package/types/lib/inventory/depsUtils.d.ts +74 -0
  508. package/types/lib/inventory/depsUtils.d.ts.map +1 -0
  509. package/types/lib/inventory/display.d.ts +227 -0
  510. package/types/lib/inventory/display.d.ts.map +1 -0
  511. package/types/lib/inventory/dosai.d.ts +130 -0
  512. package/types/lib/inventory/dosai.d.ts.map +1 -0
  513. package/types/lib/inventory/dosaiParsers.d.ts +59 -0
  514. package/types/lib/inventory/dosaiParsers.d.ts.map +1 -0
  515. package/types/lib/inventory/dynamic.d.ts +25 -0
  516. package/types/lib/inventory/dynamic.d.ts.map +1 -0
  517. package/types/lib/inventory/envcontext.d.ts +377 -0
  518. package/types/lib/inventory/envcontext.d.ts.map +1 -0
  519. package/types/lib/inventory/evidenceUtils.d.ts +74 -0
  520. package/types/lib/inventory/evidenceUtils.d.ts.map +1 -0
  521. package/types/lib/inventory/fetchBatch.d.ts +127 -0
  522. package/types/lib/inventory/fetchBatch.d.ts.map +1 -0
  523. package/types/lib/inventory/fetchRate.d.ts +118 -0
  524. package/types/lib/inventory/fetchRate.d.ts.map +1 -0
  525. package/types/lib/inventory/forgeEnricher.d.ts +31 -0
  526. package/types/lib/inventory/forgeEnricher.d.ts.map +1 -0
  527. package/types/lib/inventory/formulationParsers.d.ts +50 -0
  528. package/types/lib/inventory/formulationParsers.d.ts.map +1 -0
  529. package/types/lib/inventory/gtfobins.d.ts +27 -0
  530. package/types/lib/inventory/gtfobins.d.ts.map +1 -0
  531. package/types/lib/inventory/hbom.d.ts +58 -0
  532. package/types/lib/inventory/hbom.d.ts.map +1 -0
  533. package/types/lib/inventory/hbomAnalysis.d.ts +56 -0
  534. package/types/lib/inventory/hbomAnalysis.d.ts.map +1 -0
  535. package/types/lib/inventory/hbomLoader.d.ts +7 -0
  536. package/types/lib/inventory/hbomLoader.d.ts.map +1 -0
  537. package/types/lib/inventory/hostTopology.d.ts +47 -0
  538. package/types/lib/inventory/hostTopology.d.ts.map +1 -0
  539. package/types/lib/inventory/inventoryStats.d.ts +42 -0
  540. package/types/lib/inventory/inventoryStats.d.ts.map +1 -0
  541. package/types/lib/inventory/jsonLike.d.ts +23 -0
  542. package/types/lib/inventory/jsonLike.d.ts.map +1 -0
  543. package/types/lib/inventory/licenseEnhancer.d.ts +70 -0
  544. package/types/lib/inventory/licenseEnhancer.d.ts.map +1 -0
  545. package/types/lib/inventory/lolbas.d.ts +16 -0
  546. package/types/lib/inventory/lolbas.d.ts.map +1 -0
  547. package/types/lib/inventory/mcp.d.ts +29 -0
  548. package/types/lib/inventory/mcp.d.ts.map +1 -0
  549. package/types/lib/inventory/mcpConfigParser.d.ts +20 -0
  550. package/types/lib/inventory/mcpConfigParser.d.ts.map +1 -0
  551. package/types/lib/inventory/mcpDiscovery.d.ts +33 -0
  552. package/types/lib/inventory/mcpDiscovery.d.ts.map +1 -0
  553. package/types/lib/inventory/mcpPinning.d.ts +11 -0
  554. package/types/lib/inventory/mcpPinning.d.ts.map +1 -0
  555. package/types/lib/inventory/osPackageResolver.d.ts +49 -0
  556. package/types/lib/inventory/osPackageResolver.d.ts.map +1 -0
  557. package/types/lib/inventory/osinfo.d.ts +120 -0
  558. package/types/lib/inventory/osinfo.d.ts.map +1 -0
  559. package/types/lib/inventory/osqueryTransform.d.ts +84 -0
  560. package/types/lib/inventory/osqueryTransform.d.ts.map +1 -0
  561. package/types/lib/inventory/plugins.d.ts +58 -0
  562. package/types/lib/inventory/plugins.d.ts.map +1 -0
  563. package/types/lib/inventory/protobom.d.ts +71 -0
  564. package/types/lib/inventory/protobom.d.ts.map +1 -0
  565. package/types/lib/inventory/protobomLoader.d.ts +17 -0
  566. package/types/lib/inventory/protobomLoader.d.ts.map +1 -0
  567. package/types/lib/inventory/provenanceUtils.d.ts +98 -0
  568. package/types/lib/inventory/provenanceUtils.d.ts.map +1 -0
  569. package/types/lib/inventory/purl.d.ts +313 -0
  570. package/types/lib/inventory/purl.d.ts.map +1 -0
  571. package/types/lib/inventory/rustFormulationParser.d.ts +17 -0
  572. package/types/lib/inventory/rustFormulationParser.d.ts.map +1 -0
  573. package/types/lib/inventory/sbomDocument.d.ts +59 -0
  574. package/types/lib/inventory/sbomDocument.d.ts.map +1 -0
  575. package/types/lib/inventory/source.d.ts +163 -0
  576. package/types/lib/inventory/source.d.ts.map +1 -0
  577. package/types/lib/inventory/spdx.d.ts +66 -0
  578. package/types/lib/inventory/spdx.d.ts.map +1 -0
  579. package/types/lib/inventory/spdxExpression.d.ts +58 -0
  580. package/types/lib/inventory/spdxExpression.d.ts.map +1 -0
  581. package/types/lib/inventory/spdxUtils.d.ts +12 -0
  582. package/types/lib/inventory/spdxUtils.d.ts.map +1 -0
  583. package/types/lib/inventory/table.d.ts +19 -0
  584. package/types/lib/inventory/table.d.ts.map +1 -0
  585. package/types/lib/inventory/traceRunner.d.ts +80 -0
  586. package/types/lib/inventory/traceRunner.d.ts.map +1 -0
  587. package/types/lib/inventory/unicodeScan.d.ts +46 -0
  588. package/types/lib/inventory/unicodeScan.d.ts.map +1 -0
  589. package/types/lib/managers/binary.d.ts +76 -0
  590. package/types/lib/managers/binary.d.ts.map +1 -0
  591. package/types/lib/managers/containerutils.d.ts +30 -0
  592. package/types/lib/managers/containerutils.d.ts.map +1 -0
  593. package/types/lib/managers/docker.d.ts +157 -0
  594. package/types/lib/managers/docker.d.ts.map +1 -0
  595. package/types/lib/managers/dockerConnection.d.ts +42 -0
  596. package/types/lib/managers/dockerConnection.d.ts.map +1 -0
  597. package/types/lib/managers/oci.d.ts +21 -0
  598. package/types/lib/managers/oci.d.ts.map +1 -0
  599. package/types/lib/managers/piptree.d.ts +13 -0
  600. package/types/lib/managers/piptree.d.ts.map +1 -0
  601. package/types/lib/parsers/cmakeCache.d.ts +70 -0
  602. package/types/lib/parsers/cmakeCache.d.ts.map +1 -0
  603. package/types/lib/parsers/gguf.d.ts +39 -0
  604. package/types/lib/parsers/gguf.d.ts.map +1 -0
  605. package/types/lib/parsers/gitAiNotes.d.ts +15 -0
  606. package/types/lib/parsers/gitAiNotes.d.ts.map +1 -0
  607. package/types/lib/parsers/gitmodules.d.ts +88 -0
  608. package/types/lib/parsers/gitmodules.d.ts.map +1 -0
  609. package/types/lib/parsers/htmlExtract.d.ts +34 -0
  610. package/types/lib/parsers/htmlExtract.d.ts.map +1 -0
  611. package/types/lib/parsers/huggingfaceManifest.d.ts +153 -0
  612. package/types/lib/parsers/huggingfaceManifest.d.ts.map +1 -0
  613. package/types/lib/parsers/huggingfaceUtils.d.ts +155 -0
  614. package/types/lib/parsers/huggingfaceUtils.d.ts.map +1 -0
  615. package/types/lib/parsers/iri.d.ts +68 -0
  616. package/types/lib/parsers/iri.d.ts.map +1 -0
  617. package/types/lib/parsers/npmrc.d.ts +33 -0
  618. package/types/lib/parsers/npmrc.d.ts.map +1 -0
  619. package/types/lib/parsers/ollama.d.ts +22 -0
  620. package/types/lib/parsers/ollama.d.ts.map +1 -0
  621. package/types/lib/parsers/xml.d.ts +47 -0
  622. package/types/lib/parsers/xml.d.ts.map +1 -0
  623. package/types/lib/server/server.d.ts +51 -0
  624. package/types/lib/server/server.d.ts.map +1 -0
  625. package/types/lib/stages/postgen/annotator.d.ts +36 -0
  626. package/types/lib/stages/postgen/annotator.d.ts.map +1 -0
  627. package/types/lib/stages/postgen/auditBom.d.ts +92 -0
  628. package/types/lib/stages/postgen/auditBom.d.ts.map +1 -0
  629. package/types/lib/stages/postgen/postgen.d.ts +59 -0
  630. package/types/lib/stages/postgen/postgen.d.ts.map +1 -0
  631. package/types/lib/stages/postgen/ruleEngine.d.ts +18 -0
  632. package/types/lib/stages/postgen/ruleEngine.d.ts.map +1 -0
  633. package/types/lib/stages/postgen/sortBom.d.ts +34 -0
  634. package/types/lib/stages/postgen/sortBom.d.ts.map +1 -0
  635. package/types/lib/stages/postgen/spdxConverter.d.ts +11 -0
  636. package/types/lib/stages/postgen/spdxConverter.d.ts.map +1 -0
  637. package/types/lib/stages/postgen/specVersionCompat.d.ts +71 -0
  638. package/types/lib/stages/postgen/specVersionCompat.d.ts.map +1 -0
  639. package/types/lib/stages/pregen/envAudit.d.ts +14 -0
  640. package/types/lib/stages/pregen/envAudit.d.ts.map +1 -0
  641. package/types/lib/stages/pregen/pregen.d.ts +59 -0
  642. package/types/lib/stages/pregen/pregen.d.ts.map +1 -0
  643. package/types/lib/third-party/arborist/lib/arborist/index.d.ts +47 -0
  644. package/types/lib/third-party/arborist/lib/arborist/index.d.ts.map +1 -0
  645. package/types/lib/third-party/arborist/lib/arborist/load-actual.d.ts +4 -0
  646. package/types/lib/third-party/arborist/lib/arborist/load-actual.d.ts.map +1 -0
  647. package/types/lib/third-party/arborist/lib/arborist/load-virtual.d.ts +4 -0
  648. package/types/lib/third-party/arborist/lib/arborist/load-virtual.d.ts.map +1 -0
  649. package/types/lib/third-party/arborist/lib/bin-links.d.ts +18 -0
  650. package/types/lib/third-party/arborist/lib/bin-links.d.ts.map +1 -0
  651. package/types/lib/third-party/arborist/lib/calc-dep-flags.d.ts +3 -0
  652. package/types/lib/third-party/arborist/lib/calc-dep-flags.d.ts.map +1 -0
  653. package/types/lib/third-party/arborist/lib/case-insensitive-map.d.ts +9 -0
  654. package/types/lib/third-party/arborist/lib/case-insensitive-map.d.ts.map +1 -0
  655. package/types/lib/third-party/arborist/lib/consistent-resolve.d.ts +3 -0
  656. package/types/lib/third-party/arborist/lib/consistent-resolve.d.ts.map +1 -0
  657. package/types/lib/third-party/arborist/lib/debug.d.ts +3 -0
  658. package/types/lib/third-party/arborist/lib/debug.d.ts.map +1 -0
  659. package/types/lib/third-party/arborist/lib/dep-valid.d.ts +3 -0
  660. package/types/lib/third-party/arborist/lib/dep-valid.d.ts.map +1 -0
  661. package/types/lib/third-party/arborist/lib/edge.d.ts +46 -0
  662. package/types/lib/third-party/arborist/lib/edge.d.ts.map +1 -0
  663. package/types/lib/third-party/arborist/lib/from-path.d.ts +3 -0
  664. package/types/lib/third-party/arborist/lib/from-path.d.ts.map +1 -0
  665. package/types/lib/third-party/arborist/lib/gather-dep-set.d.ts +3 -0
  666. package/types/lib/third-party/arborist/lib/gather-dep-set.d.ts.map +1 -0
  667. package/types/lib/third-party/arborist/lib/index.d.ts +3 -0
  668. package/types/lib/third-party/arborist/lib/index.d.ts.map +1 -0
  669. package/types/lib/third-party/arborist/lib/inventory.d.ts +14 -0
  670. package/types/lib/third-party/arborist/lib/inventory.d.ts.map +1 -0
  671. package/types/lib/third-party/arborist/lib/link.d.ts +18 -0
  672. package/types/lib/third-party/arborist/lib/link.d.ts.map +1 -0
  673. package/types/lib/third-party/arborist/lib/node.d.ts +112 -0
  674. package/types/lib/third-party/arborist/lib/node.d.ts.map +1 -0
  675. package/types/lib/third-party/arborist/lib/npm-extension.d.ts +18 -0
  676. package/types/lib/third-party/arborist/lib/npm-extension.d.ts.map +1 -0
  677. package/types/lib/third-party/arborist/lib/override-resolves.d.ts +3 -0
  678. package/types/lib/third-party/arborist/lib/override-resolves.d.ts.map +1 -0
  679. package/types/lib/third-party/arborist/lib/override-set.d.ts +27 -0
  680. package/types/lib/third-party/arborist/lib/override-set.d.ts.map +1 -0
  681. package/types/lib/third-party/arborist/lib/package-extensions.d.ts +36 -0
  682. package/types/lib/third-party/arborist/lib/package-extensions.d.ts.map +1 -0
  683. package/types/lib/third-party/arborist/lib/printable.d.ts +3 -0
  684. package/types/lib/third-party/arborist/lib/printable.d.ts.map +1 -0
  685. package/types/lib/third-party/arborist/lib/proc-log.d.ts +20 -0
  686. package/types/lib/third-party/arborist/lib/proc-log.d.ts.map +1 -0
  687. package/types/lib/third-party/arborist/lib/realpath.d.ts +3 -0
  688. package/types/lib/third-party/arborist/lib/realpath.d.ts.map +1 -0
  689. package/types/lib/third-party/arborist/lib/relpath.d.ts +3 -0
  690. package/types/lib/third-party/arborist/lib/relpath.d.ts.map +1 -0
  691. package/types/lib/third-party/arborist/lib/shrinkwrap.d.ts +54 -0
  692. package/types/lib/third-party/arborist/lib/shrinkwrap.d.ts.map +1 -0
  693. package/types/lib/third-party/arborist/lib/spec-from-lock.d.ts +3 -0
  694. package/types/lib/third-party/arborist/lib/spec-from-lock.d.ts.map +1 -0
  695. package/types/lib/third-party/arborist/lib/tree-check.d.ts +3 -0
  696. package/types/lib/third-party/arborist/lib/tree-check.d.ts.map +1 -0
  697. package/types/lib/third-party/arborist/lib/validate-npm-package-name.d.ts +13 -0
  698. package/types/lib/third-party/arborist/lib/validate-npm-package-name.d.ts.map +1 -0
  699. package/types/lib/third-party/arborist/lib/version-from-tgz.d.ts +6 -0
  700. package/types/lib/third-party/arborist/lib/version-from-tgz.d.ts.map +1 -0
  701. package/types/lib/third-party/arborist/lib/yarn-lock.d.ts +35 -0
  702. package/types/lib/third-party/arborist/lib/yarn-lock.d.ts.map +1 -0
  703. package/types/lib/validator/bomValidator.d.ts +40 -0
  704. package/types/lib/validator/bomValidator.d.ts.map +1 -0
  705. package/types/lib/validator/complianceEngine.d.ts +72 -0
  706. package/types/lib/validator/complianceEngine.d.ts.map +1 -0
  707. package/types/lib/validator/complianceRules.d.ts +61 -0
  708. package/types/lib/validator/complianceRules.d.ts.map +1 -0
  709. package/types/lib/validator/index.d.ts +101 -0
  710. package/types/lib/validator/index.d.ts.map +1 -0
  711. package/types/lib/validator/reporters/annotations.d.ts +37 -0
  712. package/types/lib/validator/reporters/annotations.d.ts.map +1 -0
  713. package/types/lib/validator/reporters/console.d.ts +34 -0
  714. package/types/lib/validator/reporters/console.d.ts.map +1 -0
  715. package/types/lib/validator/reporters/index.d.ts +30 -0
  716. package/types/lib/validator/reporters/index.d.ts.map +1 -0
  717. package/types/lib/validator/reporters/json.d.ts +11 -0
  718. package/types/lib/validator/reporters/json.d.ts.map +1 -0
  719. package/types/lib/validator/reporters/sarif.d.ts +22 -0
  720. package/types/lib/validator/reporters/sarif.d.ts.map +1 -0
  721. package/mod.d.ts +0 -7
  722. package/mod.js +0 -22
@@ -0,0 +1,841 @@
1
+ /**
2
+ * Non-validating XML parser for the manifest formats cdxgen reads: Maven poms,
3
+ * NuGet nuspec and packages.config, MSBuild project and props files, VSIX
4
+ * manifests and Apple plists.
5
+ *
6
+ * Namespace prefixes are kept verbatim in element and attribute names rather
7
+ * than resolved, so `<PackageManifest:Metadata>` stays under that literal key.
8
+ * Doctypes are recorded but never interpreted: no internal subset is read and
9
+ * no external entity is fetched, so a declared entity reference is an unknown
10
+ * entity and is rejected like any other.
11
+ */
12
+
13
+ /**
14
+ * Named character entities resolved without a declaration: the five XML
15
+ * built-ins plus the HTML set, which Maven poms in the wild rely on for
16
+ * accented author names such as `Laugst&oslash;l`.
17
+ */
18
+ const NAMED_ENTITIES = {
19
+ AElig: "\u00c6",
20
+ Aacute: "\u00c1",
21
+ Acirc: "\u00c2",
22
+ Agrave: "\u00c0",
23
+ Alpha: "\u0391",
24
+ Aring: "\u00c5",
25
+ Atilde: "\u00c3",
26
+ Auml: "\u00c4",
27
+ Beta: "\u0392",
28
+ Ccedil: "\u00c7",
29
+ Chi: "\u03a7",
30
+ Dagger: "\u2021",
31
+ Delta: "\u0394",
32
+ ETH: "\u00d0",
33
+ Eacute: "\u00c9",
34
+ Ecirc: "\u00ca",
35
+ Egrave: "\u00c8",
36
+ Epsilon: "\u0395",
37
+ Eta: "\u0397",
38
+ Euml: "\u00cb",
39
+ Gamma: "\u0393",
40
+ Iacute: "\u00cd",
41
+ Icirc: "\u00ce",
42
+ Igrave: "\u00cc",
43
+ Iota: "\u0399",
44
+ Iuml: "\u00cf",
45
+ Kappa: "\u039a",
46
+ Lambda: "\u039b",
47
+ Mu: "\u039c",
48
+ Ntilde: "\u00d1",
49
+ Nu: "\u039d",
50
+ OElig: "\u0152",
51
+ Oacute: "\u00d3",
52
+ Ocirc: "\u00d4",
53
+ Ograve: "\u00d2",
54
+ Omega: "\u03a9",
55
+ Omicron: "\u039f",
56
+ Oslash: "\u00d8",
57
+ Otilde: "\u00d5",
58
+ Ouml: "\u00d6",
59
+ Phi: "\u03a6",
60
+ Pi: "\u03a0",
61
+ Prime: "\u2033",
62
+ Psi: "\u03a8",
63
+ Rho: "\u03a1",
64
+ Scaron: "\u0160",
65
+ Sigma: "\u03a3",
66
+ THORN: "\u00de",
67
+ Tau: "\u03a4",
68
+ Theta: "\u0398",
69
+ Uacute: "\u00da",
70
+ Ucirc: "\u00db",
71
+ Ugrave: "\u00d9",
72
+ Upsilon: "\u03a5",
73
+ Uuml: "\u00dc",
74
+ Xi: "\u039e",
75
+ Yacute: "\u00dd",
76
+ Yuml: "\u0178",
77
+ Zeta: "\u0396",
78
+ aacute: "\u00e1",
79
+ acirc: "\u00e2",
80
+ acute: "\u00b4",
81
+ aelig: "\u00e6",
82
+ agrave: "\u00e0",
83
+ alefsym: "\u2135",
84
+ alpha: "\u03b1",
85
+ amp: "&",
86
+ and: "\u2227",
87
+ ang: "\u2220",
88
+ apos: "'",
89
+ aring: "\u00e5",
90
+ asymp: "\u2248",
91
+ atilde: "\u00e3",
92
+ auml: "\u00e4",
93
+ bdquo: "\u201e",
94
+ beta: "\u03b2",
95
+ brvbar: "\u00a6",
96
+ bull: "\u2022",
97
+ cap: "\u2229",
98
+ ccedil: "\u00e7",
99
+ cedil: "\u00b8",
100
+ cent: "\u00a2",
101
+ chi: "\u03c7",
102
+ circ: "\u02c6",
103
+ clubs: "\u2663",
104
+ cong: "\u2245",
105
+ copy: "\u00a9",
106
+ crarr: "\u21b5",
107
+ cup: "\u222a",
108
+ curren: "\u00a4",
109
+ dArr: "\u21d3",
110
+ dagger: "\u2020",
111
+ darr: "\u2193",
112
+ deg: "\u00b0",
113
+ delta: "\u03b4",
114
+ diams: "\u2666",
115
+ divide: "\u00f7",
116
+ eacute: "\u00e9",
117
+ ecirc: "\u00ea",
118
+ egrave: "\u00e8",
119
+ empty: "\u2205",
120
+ emsp: "\u2003",
121
+ ensp: "\u2002",
122
+ epsilon: "\u03b5",
123
+ equiv: "\u2261",
124
+ eta: "\u03b7",
125
+ eth: "\u00f0",
126
+ euml: "\u00eb",
127
+ euro: "\u20ac",
128
+ exist: "\u2203",
129
+ fnof: "\u0192",
130
+ forall: "\u2200",
131
+ frac12: "\u00bd",
132
+ frac14: "\u00bc",
133
+ frac34: "\u00be",
134
+ frasl: "\u2044",
135
+ gamma: "\u03b3",
136
+ ge: "\u2265",
137
+ gt: ">",
138
+ hArr: "\u21d4",
139
+ harr: "\u2194",
140
+ hearts: "\u2665",
141
+ hellip: "\u2026",
142
+ iacute: "\u00ed",
143
+ icirc: "\u00ee",
144
+ iexcl: "\u00a1",
145
+ igrave: "\u00ec",
146
+ image: "\u2111",
147
+ infin: "\u221e",
148
+ int: "\u222b",
149
+ iota: "\u03b9",
150
+ iquest: "\u00bf",
151
+ isin: "\u2208",
152
+ iuml: "\u00ef",
153
+ kappa: "\u03ba",
154
+ lArr: "\u21d0",
155
+ lambda: "\u03bb",
156
+ lang: "\u2329",
157
+ laquo: "\u00ab",
158
+ larr: "\u2190",
159
+ lceil: "\u2308",
160
+ ldquo: "\u201c",
161
+ le: "\u2264",
162
+ lfloor: "\u230a",
163
+ lowast: "\u2217",
164
+ loz: "\u25ca",
165
+ lrm: "\u200e",
166
+ lsaquo: "\u2039",
167
+ lsquo: "\u2018",
168
+ lt: "<",
169
+ macr: "\u00af",
170
+ mdash: "\u2014",
171
+ micro: "\u00b5",
172
+ middot: "\u00b7",
173
+ minus: "\u2212",
174
+ mu: "\u03bc",
175
+ nabla: "\u2207",
176
+ nbsp: "\u00a0",
177
+ ndash: "\u2013",
178
+ ne: "\u2260",
179
+ ni: "\u220b",
180
+ not: "\u00ac",
181
+ notin: "\u2209",
182
+ nsub: "\u2284",
183
+ ntilde: "\u00f1",
184
+ nu: "\u03bd",
185
+ oacute: "\u00f3",
186
+ ocirc: "\u00f4",
187
+ oelig: "\u0153",
188
+ ograve: "\u00f2",
189
+ oline: "\u203e",
190
+ omega: "\u03c9",
191
+ omicron: "\u03bf",
192
+ oplus: "\u2295",
193
+ or: "\u2228",
194
+ ordf: "\u00aa",
195
+ ordm: "\u00ba",
196
+ oslash: "\u00f8",
197
+ otilde: "\u00f5",
198
+ otimes: "\u2297",
199
+ ouml: "\u00f6",
200
+ para: "\u00b6",
201
+ part: "\u2202",
202
+ permil: "\u2030",
203
+ perp: "\u22a5",
204
+ phi: "\u03c6",
205
+ pi: "\u03c0",
206
+ piv: "\u03d6",
207
+ plusmn: "\u00b1",
208
+ pound: "\u00a3",
209
+ prime: "\u2032",
210
+ prod: "\u220f",
211
+ prop: "\u221d",
212
+ psi: "\u03c8",
213
+ quot: '"',
214
+ rArr: "\u21d2",
215
+ radic: "\u221a",
216
+ rang: "\u232a",
217
+ raquo: "\u00bb",
218
+ rarr: "\u2192",
219
+ rceil: "\u2309",
220
+ rdquo: "\u201d",
221
+ real: "\u211c",
222
+ reg: "\u00ae",
223
+ rfloor: "\u230b",
224
+ rho: "\u03c1",
225
+ rlm: "\u200f",
226
+ rsaquo: "\u203a",
227
+ rsquo: "\u2019",
228
+ sbquo: "\u201a",
229
+ scaron: "\u0161",
230
+ sdot: "\u22c5",
231
+ sect: "\u00a7",
232
+ shy: "\u00ad",
233
+ sigma: "\u03c3",
234
+ sigmaf: "\u03c2",
235
+ sim: "\u223c",
236
+ spades: "\u2660",
237
+ sub: "\u2282",
238
+ sube: "\u2286",
239
+ sum: "\u2211",
240
+ sup: "\u2283",
241
+ sup1: "\u00b9",
242
+ sup2: "\u00b2",
243
+ sup3: "\u00b3",
244
+ supe: "\u2287",
245
+ szlig: "\u00df",
246
+ tau: "\u03c4",
247
+ there4: "\u2234",
248
+ theta: "\u03b8",
249
+ thetasym: "\u03d1",
250
+ thinsp: "\u2009",
251
+ thorn: "\u00fe",
252
+ tilde: "\u02dc",
253
+ times: "\u00d7",
254
+ trade: "\u2122",
255
+ uArr: "\u21d1",
256
+ uacute: "\u00fa",
257
+ uarr: "\u2191",
258
+ ucirc: "\u00fb",
259
+ ugrave: "\u00f9",
260
+ uml: "\u00a8",
261
+ upsih: "\u03d2",
262
+ upsilon: "\u03c5",
263
+ uuml: "\u00fc",
264
+ weierp: "\u2118",
265
+ xi: "\u03be",
266
+ yacute: "\u00fd",
267
+ yen: "\u00a5",
268
+ yuml: "\u00ff",
269
+ zeta: "\u03b6",
270
+ zwj: "\u200d",
271
+ zwnj: "\u200c",
272
+ };
273
+
274
+ const ENTITY_REGEX = /&(#x[0-9a-fA-F]+|#[0-9]+|[^;&<\s]*);/g;
275
+
276
+ /**
277
+ * Resolve the character entities in a text run.
278
+ *
279
+ * @param {string} text Raw text, which may contain entity references
280
+ *
281
+ * @returns {string} Text with entity references replaced
282
+ *
283
+ * @throws {Error} When a reference names an entity that was never declared
284
+ */
285
+ function decodeEntities(text) {
286
+ if (!text.includes("&")) {
287
+ return text;
288
+ }
289
+ return text.replace(ENTITY_REGEX, (_match, body) => {
290
+ if (body.startsWith("#x") || body.startsWith("#X")) {
291
+ const code = Number.parseInt(body.slice(2), 16);
292
+ if (Number.isNaN(code)) {
293
+ throw new Error("Invalid character entity");
294
+ }
295
+ return String.fromCodePoint(code);
296
+ }
297
+ if (body.startsWith("#")) {
298
+ const code = Number.parseInt(body.slice(1), 10);
299
+ if (Number.isNaN(code)) {
300
+ throw new Error("Invalid character entity");
301
+ }
302
+ return String.fromCodePoint(code);
303
+ }
304
+ if (Object.hasOwn(NAMED_ENTITIES, body)) {
305
+ return NAMED_ENTITIES[body];
306
+ }
307
+ throw new Error("Invalid character entity");
308
+ });
309
+ }
310
+
311
+ /** Characters that may not begin an element or attribute name. */
312
+ const NAME_START = /[^\s"'<>/=]/;
313
+
314
+ /**
315
+ * Nesting depth beyond which a document is refused.
316
+ *
317
+ * The tree is converted to objects by recursion, so unbounded nesting would
318
+ * exhaust the stack. The deepest manifest observed across a corpus of Maven
319
+ * poms, nuspecs and MSBuild targets nests 26 elements, so this ceiling is far
320
+ * above any real document while keeping a hostile one from reaching the limit.
321
+ */
322
+ const MAX_DEPTH = 1000;
323
+
324
+ /**
325
+ * Read the attributes of a start tag.
326
+ *
327
+ * @param {string} source Full document
328
+ * @param {number} start Offset of the first character after the element name
329
+ * @param {number} end Offset of the closing angle bracket
330
+ *
331
+ * @returns {Object.<string, string>|undefined} Attribute map, or undefined when the tag declares none
332
+ */
333
+ function readAttributes(source, start, end) {
334
+ let attributes;
335
+ let pos = start;
336
+ while (pos < end) {
337
+ while (pos < end && /\s/.test(source[pos])) {
338
+ pos++;
339
+ }
340
+ if (pos >= end || !NAME_START.test(source[pos])) {
341
+ break;
342
+ }
343
+ const nameStart = pos;
344
+ while (pos < end && !/[\s=]/.test(source[pos])) {
345
+ pos++;
346
+ }
347
+ const name = source.slice(nameStart, pos);
348
+ while (pos < end && /\s/.test(source[pos])) {
349
+ pos++;
350
+ }
351
+ let value = "";
352
+ if (source[pos] === "=") {
353
+ pos++;
354
+ while (pos < end && /\s/.test(source[pos])) {
355
+ pos++;
356
+ }
357
+ const quote = source[pos];
358
+ if (quote === '"' || quote === "'") {
359
+ pos++;
360
+ const valueStart = pos;
361
+ while (pos < end && source[pos] !== quote) {
362
+ pos++;
363
+ }
364
+ value = decodeEntities(source.slice(valueStart, pos));
365
+ pos++;
366
+ } else {
367
+ const valueStart = pos;
368
+ while (pos < end && !/\s/.test(source[pos])) {
369
+ pos++;
370
+ }
371
+ value = decodeEntities(source.slice(valueStart, pos));
372
+ }
373
+ }
374
+ attributes ??= {};
375
+ define(attributes, name, value);
376
+ }
377
+ return attributes;
378
+ }
379
+
380
+ /**
381
+ * Split a processing instruction into its target and remaining body.
382
+ *
383
+ * @param {string} body Instruction content between `<?` and `?>`
384
+ *
385
+ * @returns {{target: string, content: string}} Instruction target and the text following it
386
+ */
387
+ function splitInstruction(body) {
388
+ const match = body.match(/^([^\s]+)\s*([\s\S]*)$/);
389
+ return match
390
+ ? { target: match[1], content: match[2] }
391
+ : { target: body, content: "" };
392
+ }
393
+
394
+ /**
395
+ * Parse a document into a tree of nodes.
396
+ *
397
+ * Each node is `{type}` plus the payload for that type: elements carry `name`,
398
+ * optional `attributes` and optional `children`; text, cdata and comment nodes
399
+ * carry `value`.
400
+ *
401
+ * @param {string} source XML document
402
+ *
403
+ * @returns {{roots: Array<object>, declaration: Object.<string, string>|undefined, doctype: string|undefined}} Parsed tree and prolog
404
+ *
405
+ * @throws {Error} When the document is not well formed
406
+ */
407
+ function parseDocument(source) {
408
+ const roots = [];
409
+ const stack = [];
410
+ let declaration;
411
+ let doctype;
412
+ let pos = 0;
413
+
414
+ const push = (node) => {
415
+ const parent = stack[stack.length - 1];
416
+ if (parent) {
417
+ (parent.children ??= []).push(node);
418
+ } else {
419
+ // A licence header sits outside the root element in most poms, so
420
+ // top-level comments are kept rather than discarded with the prolog.
421
+ roots.push(node);
422
+ }
423
+ };
424
+
425
+ while (pos < source.length) {
426
+ const lt = source.indexOf("<", pos);
427
+ if (lt === -1) {
428
+ const tail = source.slice(pos);
429
+ if (tail.trim()) {
430
+ push({ type: "text", value: decodeEntities(tail) });
431
+ }
432
+ break;
433
+ }
434
+ if (lt > pos) {
435
+ const text = source.slice(pos, lt);
436
+ if (text.trim()) {
437
+ push({ type: "text", value: decodeEntities(text) });
438
+ }
439
+ }
440
+
441
+ if (source.startsWith("<!--", lt)) {
442
+ const end = source.indexOf("-->", lt + 4);
443
+ if (end === -1) {
444
+ throw new Error("Unclosed comment");
445
+ }
446
+ push({ type: "comment", value: source.slice(lt + 4, end) });
447
+ pos = end + 3;
448
+ continue;
449
+ }
450
+
451
+ if (source.startsWith("<![CDATA[", lt)) {
452
+ const end = source.indexOf("]]>", lt + 9);
453
+ if (end === -1) {
454
+ throw new Error("Unclosed CDATA section");
455
+ }
456
+ push({ type: "cdata", value: source.slice(lt + 9, end) });
457
+ pos = end + 3;
458
+ continue;
459
+ }
460
+
461
+ if (source.startsWith("<?", lt)) {
462
+ const end = source.indexOf("?>", lt + 2);
463
+ if (end === -1) {
464
+ throw new Error("Unclosed processing instruction");
465
+ }
466
+ const body = source.slice(lt + 2, end);
467
+ const { target, content } = splitInstruction(body);
468
+ if (target === "xml") {
469
+ declaration = readAttributes(content, 0, content.length);
470
+ } else {
471
+ push({ type: "instruction", target, content });
472
+ }
473
+ pos = end + 2;
474
+ continue;
475
+ }
476
+
477
+ if (source.startsWith("<!", lt)) {
478
+ // A doctype may carry an internal subset in brackets, which can itself
479
+ // contain angle brackets, so the closing bracket is found before the
480
+ // closing angle bracket is looked for.
481
+ let scan = lt + 2;
482
+ const subset = source.indexOf("[", scan);
483
+ const firstGt = source.indexOf(">", scan);
484
+ if (subset !== -1 && (firstGt === -1 || subset < firstGt)) {
485
+ const subsetEnd = source.indexOf("]", subset);
486
+ if (subsetEnd === -1) {
487
+ throw new Error("Unclosed doctype subset");
488
+ }
489
+ scan = subsetEnd;
490
+ }
491
+ const end = source.indexOf(">", scan);
492
+ if (end === -1) {
493
+ throw new Error("Unclosed declaration");
494
+ }
495
+ const body = source.slice(lt + 2, end);
496
+ if (/^DOCTYPE/i.test(body)) {
497
+ doctype = body.replace(/^DOCTYPE\s*/i, "");
498
+ }
499
+ pos = end + 1;
500
+ continue;
501
+ }
502
+
503
+ if (source.startsWith("</", lt)) {
504
+ const end = source.indexOf(">", lt + 2);
505
+ if (end === -1) {
506
+ throw new Error("Unclosed end tag");
507
+ }
508
+ const name = source.slice(lt + 2, end).trim();
509
+ const open = stack.pop();
510
+ if (!open) {
511
+ throw new Error(`Unexpected close tag ${name}`);
512
+ }
513
+ if (open.name !== name) {
514
+ throw new Error(`Unexpected close tag ${name}`);
515
+ }
516
+ pos = end + 1;
517
+ continue;
518
+ }
519
+
520
+ let end = lt + 1;
521
+ let quote;
522
+ while (end < source.length) {
523
+ const ch = source[end];
524
+ if (quote) {
525
+ if (ch === quote) {
526
+ quote = undefined;
527
+ }
528
+ } else if (ch === '"' || ch === "'") {
529
+ quote = ch;
530
+ } else if (ch === ">") {
531
+ break;
532
+ }
533
+ end++;
534
+ }
535
+ if (end >= source.length) {
536
+ throw new Error("Unclosed start tag");
537
+ }
538
+ const selfClosing = source[end - 1] === "/";
539
+ const inner = end - (selfClosing ? 1 : 0);
540
+ let nameEnd = lt + 1;
541
+ while (nameEnd < inner && !/\s/.test(source[nameEnd])) {
542
+ nameEnd++;
543
+ }
544
+ const name = source.slice(lt + 1, nameEnd);
545
+ if (!name) {
546
+ throw new Error("Malformed start tag");
547
+ }
548
+ const node = { type: "element", name };
549
+ const attributes = readAttributes(source, nameEnd, inner);
550
+ if (attributes) {
551
+ node.attributes = attributes;
552
+ }
553
+ push(node);
554
+ if (!selfClosing) {
555
+ if (stack.length >= MAX_DEPTH) {
556
+ throw new Error(`Element nesting deeper than ${MAX_DEPTH}`);
557
+ }
558
+ stack.push(node);
559
+ }
560
+ pos = end + 1;
561
+ }
562
+
563
+ if (stack.length) {
564
+ throw new Error(`Unclosed tag ${stack[stack.length - 1].name}`);
565
+ }
566
+ return { roots, declaration, doctype };
567
+ }
568
+
569
+ /**
570
+ * Write an own, enumerable property.
571
+ *
572
+ * Element names come from the document, so a document may name an element
573
+ * `__proto__`. Plain assignment would reach the prototype setter and lose the
574
+ * value instead of recording it, so the property is always defined outright.
575
+ *
576
+ * @param {object} target Object being built
577
+ * @param {string} key Key to write
578
+ * @param {*} value Value to write
579
+ */
580
+ function define(target, key, value) {
581
+ Object.defineProperty(target, key, {
582
+ value,
583
+ writable: true,
584
+ enumerable: true,
585
+ configurable: true,
586
+ });
587
+ }
588
+
589
+ /**
590
+ * Attach a value to a key, promoting the slot to an array once a second value
591
+ * arrives so that repeated element names and repeated text runs both survive.
592
+ *
593
+ * @param {object} target Object being built
594
+ * @param {string} key Key to write
595
+ * @param {*} value Value to attach
596
+ * @param {Boolean} alwaysArray Whether every slot is an array regardless of count
597
+ */
598
+ function attach(target, key, value, alwaysArray) {
599
+ if (alwaysArray) {
600
+ if (!Object.hasOwn(target, key)) {
601
+ define(target, key, []);
602
+ }
603
+ target[key].push(value);
604
+ return;
605
+ }
606
+ if (!Object.hasOwn(target, key)) {
607
+ define(target, key, value);
608
+ return;
609
+ }
610
+ if (Array.isArray(target[key])) {
611
+ target[key].push(value);
612
+ return;
613
+ }
614
+ define(target, key, [target[key], value]);
615
+ }
616
+
617
+ /**
618
+ * Present a text run, trimming it when the caller asked for trimmed text.
619
+ *
620
+ * @param {string} value Raw text, CDATA or comment content
621
+ * @param {object} keys Resolved option keys
622
+ *
623
+ * @returns {string} Text to emit
624
+ */
625
+ function present(value, keys) {
626
+ return keys.trim ? value.trim() : value;
627
+ }
628
+
629
+ /**
630
+ * Present an element's attributes, trimming the values when the caller asked
631
+ * for trimmed text. MSBuild conditions are routinely padded for readability,
632
+ * so the padding is noise rather than data.
633
+ *
634
+ * @param {Object.<string, string>} attributes Attribute map
635
+ * @param {object} keys Resolved option keys
636
+ *
637
+ * @returns {Object.<string, string>} Attribute map to emit
638
+ */
639
+ function presentAttributes(attributes, keys) {
640
+ if (!keys.trim) {
641
+ return attributes;
642
+ }
643
+ const out = {};
644
+ for (const [name, value] of Object.entries(attributes)) {
645
+ define(out, name, value.trim());
646
+ }
647
+ return out;
648
+ }
649
+
650
+ /**
651
+ * Convert an element node into its compact-form object.
652
+ *
653
+ * @param {object} node Element node from {@link parseDocument}
654
+ * @param {object} keys Resolved option keys
655
+ *
656
+ * @returns {object} Compact representation of the element
657
+ */
658
+ function compactElement(node, keys) {
659
+ const out = {};
660
+ if (node.attributes) {
661
+ out[keys.attributes] = presentAttributes(node.attributes, keys);
662
+ }
663
+ compactChildren(node.children, out, keys);
664
+ return out;
665
+ }
666
+
667
+ /**
668
+ * Add a list of nodes to a compact-form object.
669
+ *
670
+ * Shared by elements and by the document itself, so that a comment outside the
671
+ * root element lands under the same key it would inside one.
672
+ *
673
+ * @param {Array<object>|undefined} children Nodes to add
674
+ * @param {object} out Compact-form object being built
675
+ * @param {object} keys Resolved option keys
676
+ */
677
+ function compactChildren(children, out, keys) {
678
+ for (const child of children || []) {
679
+ switch (child.type) {
680
+ case "element":
681
+ attach(out, child.name, compactElement(child, keys), keys.alwaysArray);
682
+ break;
683
+ case "text":
684
+ attach(out, keys.text, present(child.value, keys), keys.alwaysArray);
685
+ break;
686
+ case "cdata":
687
+ if (!keys.ignoreCdata) {
688
+ attach(out, keys.cdata, present(child.value, keys), keys.alwaysArray);
689
+ }
690
+ break;
691
+ case "comment":
692
+ if (!keys.ignoreComment) {
693
+ attach(
694
+ out,
695
+ keys.comment,
696
+ present(child.value, keys),
697
+ keys.alwaysArray,
698
+ );
699
+ }
700
+ break;
701
+ case "instruction":
702
+ if (!keys.ignoreInstruction) {
703
+ attach(
704
+ out,
705
+ "_instruction",
706
+ { [child.target]: child.content },
707
+ keys.alwaysArray,
708
+ );
709
+ }
710
+ break;
711
+ }
712
+ }
713
+ }
714
+
715
+ /**
716
+ * Convert an element node into its verbose-form object.
717
+ *
718
+ * @param {object} node Element node from {@link parseDocument}
719
+ * @param {object} keys Resolved option keys
720
+ *
721
+ * @returns {object} Verbose representation of the element
722
+ */
723
+ function verboseElement(node, keys) {
724
+ const out = { type: "element", name: node.name };
725
+ if (node.attributes) {
726
+ out.attributes = presentAttributes(node.attributes, keys);
727
+ }
728
+ const elements = verboseChildren(node.children, keys);
729
+ if (elements.length) {
730
+ out.elements = elements;
731
+ }
732
+ return out;
733
+ }
734
+
735
+ /**
736
+ * Convert a list of nodes into verbose-form nodes.
737
+ *
738
+ * @param {Array<object>|undefined} children Nodes to convert
739
+ * @param {object} keys Resolved option keys
740
+ *
741
+ * @returns {Array<object>} Verbose-form nodes
742
+ */
743
+ function verboseChildren(children, keys) {
744
+ const elements = [];
745
+ for (const child of children || []) {
746
+ switch (child.type) {
747
+ case "element":
748
+ elements.push(verboseElement(child, keys));
749
+ break;
750
+ case "text":
751
+ elements.push({ type: "text", text: present(child.value, keys) });
752
+ break;
753
+ case "cdata":
754
+ if (!keys.ignoreCdata) {
755
+ elements.push({ type: "cdata", cdata: present(child.value, keys) });
756
+ }
757
+ break;
758
+ case "comment":
759
+ if (!keys.ignoreComment) {
760
+ elements.push({
761
+ type: "comment",
762
+ comment: present(child.value, keys),
763
+ });
764
+ }
765
+ break;
766
+ case "instruction":
767
+ if (!keys.ignoreInstruction) {
768
+ elements.push({
769
+ type: "instruction",
770
+ name: child.target,
771
+ instruction: child.content,
772
+ });
773
+ }
774
+ break;
775
+ }
776
+ }
777
+ return elements;
778
+ }
779
+
780
+ /**
781
+ * Parse an XML document into a plain object.
782
+ *
783
+ * In compact form each element becomes a key on its parent, with text under
784
+ * `textKey`, attributes under `attributesKey` and comments under `commentKey`;
785
+ * a name that repeats becomes an array. In verbose form the document becomes a
786
+ * list of typed nodes under `elements`.
787
+ *
788
+ * @param {string} source XML document
789
+ * @param {object} [options] Parse options
790
+ * @param {Boolean} [options.compact] Emit the compact form
791
+ * @param {Boolean} [options.alwaysArray] Wrap every compact-form value in an array
792
+ * @param {string} [options.textKey] Key holding element text
793
+ * @param {string} [options.attributesKey] Key holding element attributes
794
+ * @param {string} [options.commentKey] Key holding comment text
795
+ * @param {string} [options.cdataKey] Key holding CDATA text
796
+ * @param {Boolean} [options.ignoreComment] Drop comments
797
+ * @param {Boolean} [options.ignoreCdata] Drop CDATA sections
798
+ * @param {Boolean} [options.trim] Trim text in the verbose form
799
+ *
800
+ * @returns {object} Parsed document
801
+ *
802
+ * @throws {Error} When the document is not well formed
803
+ */
804
+ export function xml2js(source, options = {}) {
805
+ const keys = {
806
+ text: options.textKey ?? "_text",
807
+ attributes: options.attributesKey ?? "_attributes",
808
+ comment: options.commentKey ?? "_comment",
809
+ cdata: options.cdataKey ?? "_cdata",
810
+ alwaysArray: options.alwaysArray === true,
811
+ ignoreComment: options.ignoreComment === true,
812
+ ignoreCdata: options.ignoreCdata === true,
813
+ ignoreDoctype: options.ignoreDoctype === true,
814
+ ignoreInstruction: options.ignoreInstruction === true,
815
+ ignoreDeclaration: options.ignoreDeclaration === true,
816
+ trim: options.trim === true,
817
+ };
818
+ const { roots, declaration, doctype } = parseDocument(String(source));
819
+
820
+ if (options.compact) {
821
+ const out = {};
822
+ if (declaration && !keys.ignoreDeclaration) {
823
+ out._declaration = { [keys.attributes]: declaration };
824
+ }
825
+ if (doctype !== undefined && !keys.ignoreDoctype) {
826
+ out._doctype = doctype;
827
+ }
828
+ compactChildren(roots, out, keys);
829
+ return out;
830
+ }
831
+
832
+ const out = {};
833
+ if (declaration && !keys.ignoreDeclaration) {
834
+ out.declaration = { attributes: declaration };
835
+ }
836
+ if (doctype !== undefined && !keys.ignoreDoctype) {
837
+ out.doctype = doctype;
838
+ }
839
+ out.elements = verboseChildren(roots, keys);
840
+ return out;
841
+ }