@cdxgen/cdxgen 0.0.1 → 13.0.0

package/types/lib/cli/bomAssembly.d.ts

@@ -0,0 +1,315 @@
+/**
+ * Determines whether the `node_modules` directory should be scanned for the
+ * current run. Scanning is always performed in deep mode or when no project
+ * type is selected; otherwise the selected types must include at least one of
+ * the requested base project types.
+ *
+ * @param {object} options CLI options
+ * @param {string[]} baseProjectTypes Base project types that require the scan
+ * @returns {boolean} True when `node_modules` should be included in the scan
+ */
+export declare const shouldIncludeNodeModulesDir: (options?: object, baseProjectTypes?: string[]) => boolean;
+/**
+ * Regex source string that matches hex digests of common lengths
+ * (32, 40, 64, 96, or 128 characters) used for integrity validation.
+ *
+ * @type {string}
+ */
+export declare const HASH_PATTERN: string;
+/**
+ * Creates a default parent component based on the directory name.
+ *
+ * @param {String} path Directory or file name
+ * @param {String} type Package type
+ * @param {Object} options CLI options
+ * @returns component object
+ */
+export declare const createDefaultParentComponent: (path: string, type?: string, options?: Object) => {
+    group: any;
+    name: any;
+    version: string;
+    type: string;
+};
+/**
+ * Builds the parent (metadata.component) for the BOM from the
+ * `--project-name`/`--project-version`/`--project-group` CLI options,
+ * constructing a purl and bom-ref. Returns the caller-supplied
+ * `options.parentComponent` unchanged when present.
+ *
+ * @param {object} options CLI options
+ * @returns {object|undefined} Parent component object, or undefined when no
+ *   project name/version is available
+ */
+export declare const determineParentComponent: (options: object) => object | undefined;
+/**
+ * Assembles the `metadata.tools` block, including the cdxgen tool entry and,
+ * for spec versions prior to 1.5, the legacy tools array. For spec version
+ * 1.6+ the author field is converted to the authors array.
+ *
+ * @param {object} options CLI options
+ * @param {object} [context={}] Additional context carrying existing components
+ * @returns {{ components?: object[], tools?: object[] }} Object containing the
+ *   tools array (1.4) or a components array with tool components (1.5+)
+ */
+export declare const addToolsSection: (options: object, context?: object) => {
+    components?: object[];
+    tools?: object[];
+};
+/**
+ * Renders a component's group/name@version as a simple display string.
+ *
+ * @param {object} comp Component object
+ * @returns {string} `group/name@version`, `name@version`, or `name`
+ */
+export declare const componentToSimpleFullName: (comp: object) => string;
+/**
+ * Strips transient keys (`evidence`, `_integrity`, `license`, `qualifiers`,
+ * `repository`, `homepage`) from a parent component while preserving licenses
+ * and external references (bug #1519).
+ *
+ * @param {object} comp Parent component to clean in place
+ * @returns {object} The cleaned parent component
+ */
+export declare const cleanParentComponent: (comp: object) => object;
+/**
+ * Builds the `metadata.authors` array from `options.author`, which may be a
+ * single string or an array of author strings. Entries shorter than two
+ * characters are ignored.
+ *
+ * @param {object} options CLI options
+ * @returns {object[]} Author objects of the form `{ name }`
+ */
+export declare const addAuthorsSection: (options: object) => object[];
+/**
+ * Method to generate metadata.lifecycles section. We assume that we operate during "build"
+ * most of the time and under "post-build" for containers.
+ *
+ * @param {Object} options
+ * @returns {Array} Lifecycles array
+ */
+export declare const addLifecyclesSection: (options: Object) => any[];
+/**
+ * Function to create metadata block
+ *
+ */
+export declare function addMetadata(parentComponent?: {}, options?: {}, context?: {}): {
+    timestamp: string;
+    tools: {
+        components?: object[];
+        tools?: object[];
+    };
+    authors: object[];
+    supplier: undefined;
+};
+/**
+ * Method to create external references
+ *
+ * @param {Array | Object} opkg
+ * @returns {Array}
+ */
+export declare function addExternalReferences(opkg: any[] | Object): any[];
+/**
+ * For all modules in the specified package, creates a list of
+ * component objects from each one.
+ *
+ * @param {Object} options CLI options
+ * @param {Object} allImports All imports
+ * @param {Object} pkg Package object
+ * @param {string} ptype Package type
+ * @returns {Object[]} Array of component objects
+ */
+export declare function listComponents(options: Object, allImports: Object, pkg: Object, ptype?: string): Object[];
+/**
+ * Component types that never receive an ecosystem purl.
+ *
+ * @type {string[]}
+ */
+export declare const NON_PURL_TYPES: string[];
+/**
+ * Property-name prefix used to key npm bin-command import evidence
+ * (`cdx:npm:bin/`).
+ *
+ * @type {string}
+ */
+export declare const NPM_BIN_IMPORT_PREFIX: string;
+/**
+ * Returns all non-empty property values for a given property name on a package.
+ *
+ * @param {object} pkg Package/component object with an optional `properties` array
+ * @param {string} propertyName Property name to match
+ * @returns {string[]} Matching property values as strings
+ */
+export declare function getPackagePropertyValues(pkg: object, propertyName: string): string[];
+/**
+ * Splits a comma-separated property value into a trimmed, non-empty string array.
+ *
+ * @param {string} value Comma-separated value
+ * @returns {string[]} Trimmed list entries
+ */
+export declare function splitPackagePropertyList(value: string): string[];
+/**
+ * Collects the set of bin command names an npm package exposes, derived from
+ * the `bin` field and the `cdx:npm:bin` / `cdx:npm:binPaths` properties.
+ *
+ * @param {object} pkg Package object
+ * @returns {Set<string>} Bin command names
+ */
+export declare function getPackageBinCommandNames(pkg: object): Set<string>;
+/**
+ * Checks whether any bin command of a package appears in the analyzer import
+ * evidence (keyed under `cdx:npm:bin/`).
+ *
+ * @param {object} allImports Map of import names to usage counts
+ * @param {object} pkg Package object
+ * @returns {boolean} True when at least one bin command is imported
+ */
+export declare function hasNpmBinCommandEvidence(allImports: object, pkg: object): boolean;
+/**
+ * Given the specified package, create a CycloneDX component and add it to the list.
+ */
+export declare function addComponent(options: any, allImports: any, pkg: any, ptype: any, compMap: any, isRootPkg?: boolean): void;
+/**
+ * If the author has described the module as a 'framework', the take their
+ * word for it, otherwise, identify the module as a 'library'.
+ */
+export declare function determinePackageType(pkg: any): any;
+/**
+ * Uses the SHA1 shasum (if present) otherwise utilizes Subresource Integrity
+ * of the package with support for multiple hashing algorithms.
+ */
+export declare function processHashes(pkg: any, component: any): void;
+/**
+ * Adds a hash to component.
+ */
+export declare function addComponentHash(alg: any, digest: any, component: any): void;
+/**
+ * Return the BOM in json format including any namespace mapping
+ *
+ * @param {Object} options Options
+ * @param {Object} pkgInfo Package information
+ * @param {string} ptype Package type
+ * @param {Object} context Context
+ *
+ * @returns {Object} BOM with namespace mapping
+ */
+export declare const buildBomNSData: (options: Object, pkgInfo: Object, ptype: string, context: Object) => Object;
+/**
+ * Function to create bom string for Android apps using blint
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Object|undefined} BOM object
+ */
+export declare function createAndroidBom(path: string, options: Object): Object | undefined;
+/**
+ * Function to create bom string for binaries using blint
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Object|undefined} BOM object
+ */
+export declare function createBinaryBom(path: string, options: Object): Object | undefined;
+/**
+ * Identify the requested AI inventory project types.
+ *
+ * @param {Object} options Parse options from the cli
+ * @returns {string[]} Requested AI inventory types
+ */
+export declare function getRequestedAiInventoryTypes(options: Object): string[];
+/**
+ * Returns the AI inventory types excluded via `--exclude-type`.
+ *
+ * @param {object} options CLI options
+ * @returns {string[]} Excluded AI inventory types
+ */
+export declare function getExcludedAiInventoryTypes(options: object): string[];
+/**
+ * Removes the excluded AI inventory types from the included list.
+ *
+ * @param {string[]} includedAiInventoryTypes Types selected for collection
+ * @param {string[]} excludedAiInventoryTypes Types excluded by the user
+ * @returns {string[]} Filtered list of AI inventory types
+ */
+export declare function filterIncludedAiInventoryTypes(includedAiInventoryTypes: string[], excludedAiInventoryTypes: string[]): string[];
+/**
+ * Determine which AI inventory types should be collected for a scan.
+ *
+ * This combines explicit project-type opt-ins with BOM audit category-driven
+ * opt-ins, then removes any explicitly excluded inventory types.
+ *
+ * @param {Object} options Parse options from the CLI
+ * @returns {string[]} AI inventory types to collect
+ */
+export declare function getIncludedAiInventoryTypes(options: Object): string[];
+/**
+ * Returns the single AI inventory type when exactly one project type alias is
+ * selected, otherwise undefined.
+ *
+ * @param {object} options CLI options
+ * @returns {string|undefined} The exact AI inventory type or undefined
+ */
+export declare function getExactAiInventoryType(options: object): string | undefined;
+/**
+ * Determine whether MCP source-code analysis should run for the current scan.
+ *
+ * @param {string[]} includedAiInventoryTypes AI inventory types selected for collection
+ * @returns {boolean} True when MCP inventory collection is enabled
+ */
+export declare function shouldDetectMcpInventory(includedAiInventoryTypes: string[]): boolean;
+/**
+ * Collects sorted, unique relative file names for AI inventory subjects whose
+ * `cdx:file:kind` property matches one of the given kinds.
+ *
+ * @param {object[]} subjects Component or service subjects to inspect
+ * @param {string} discoveryPath Base path used to compute relative file names
+ * @param {Set<string>} kindSet Accepted kind values
+ * @returns {string[]} Sorted unique relative file names
+ */
+export declare function summarizeAiInventoryNames(subjects: object[], discoveryPath: string, kindSet: Set<string>): string[];
+/**
+ * Collects sorted unique service names from an AI inventory services list.
+ *
+ * @param {object[]} services Services with a `name` property
+ * @returns {string[]} Sorted unique service names
+ */
+export declare function summarizeAiInventoryServiceNames(services: object[]): string[];
+/**
+ * Formats one padded summary line for the AI inventory console output.
+ *
+ * @param {string} label Left-aligned label (padded to 20 chars)
+ * @param {number} count Item count
+ * @param {string[]} nameList Optional list of names to append in parentheses
+ * @returns {string} The formatted summary line
+ */
+export declare function formatAiInventorySummaryLine(label: string, count: number, nameList: string[]): string;
+/**
+ * Prints a human-readable AI inventory summary to stderr, including counts and
+ * names for instruction files, skill files, MCP configs, and MCP services.
+ * Returns without printing when the inventory is empty.
+ *
+ * @param {object} aiInventory AI inventory object with components and services
+ * @param {string} discoveryPath Base path used to compute relative file names
+ * @returns {void}
+ */
+export declare function emitAiInventorySummary(aiInventory: object, discoveryPath: string): void;
+/**
+ * Dedupe components
+ *
+ * @param {Object} options Options
+ * @param {Array} components Components
+ * @param {Object} parentComponent Parent component
+ * @param {Array} dependencies Dependencies
+ *
+ * @returns {Object} Object including BOM Json
+ */
+export declare function dedupeBom(options: Object, components: any[], parentComponent: Object, dependencies: any[]): Object;
+/**
+ * Checks whether the user explicitly selected a project type alias that
+ * belongs to the given base project type.
+ *
+ * @param {object} options CLI options
+ * @param {string} baseProjectType Base project type to check against
+ * @returns {boolean} True when an explicit alias selection matches
+ */
+export declare const hasExplicitProjectTypeSelection: (options: object, baseProjectType: string) => boolean;
+//# sourceMappingURL=bomAssembly.d.ts.map

package/types/lib/cli/bomAssembly.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bomAssembly.d.ts","sourceRoot":"","sources":["../../../lib/cli/bomAssembly.js"],"names":[],"mappings":"AA8DA;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,aAJ7B,MAAM,qBACN,MAAM,EAAE,KACN,OAsBZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,EAFf,MAG8E,CAAC;AAEzF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,0CAH9B,MAAM;;;;;CAwChB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,YAJ1B,MAAM,KACJ,MAAM,GAAC,SAyBnB,CAAC;AA+DF;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,YALjB,MAAM,YACN,MAAM,KACJ;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CA+CrD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,SAH3B,MAAM,KACJ,MAQZ,CAAC;AAEF;;;;;;;GAOG;AAGH,eAAO,MAAM,oBAAoB,SALtB,MAAM,KACJ,MAwBZ,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,YAHnB,MAAM,KACJ,MAAM,EAgBlB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,YAHtB,MAAM,UAwBhB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,eAAe,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;;;qBAzJhD,MAAM,EAAE;gBAAU,MAAM,EAAE;;;;EA0gBrD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAH/B,QAAQ,MAGuB,SAyCzC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAN3B,MAM2B,EAAE,UAAU,EALvC,MAKuC,EAAE,GAAG,EAJ5C,MAI4C,EAAE,KAAK,GAHnD,MAG2D,GAFzD,MAAM,EAAE,CAcpB;AAED;;;;GAIG;AAEH,eAAO,MAAM,cAAc,EAHjB,MAAM,EAGqD,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAFxB,MAEyC,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAJjC,MAIiC,EAAE,YAAY,EAH/C,MAG+C,GAF7C,MAAM,EAAE,CASpB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAOpB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAHlC,MAGkC,GAFhC,GAAG,CAAC,MAAM,CAAC,CA6BvB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAJxC,MAIwC,EAAE,GAAG,EAH7C,MAG6C,GAF3C,OAAO,CAiBnB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,OAAO,KAAA,EACP,UAAU,KAAA,EACV,GAAG,KAAA,EACH,KAAK,KAAA,EACL,OAAO,KAAA,EACP,SAAS,UAAQ,QAiPlB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,KAAA,OA+EvC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,KAAA,EAAE,SAAS,KAAA,QA8B3C;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,KAAA,EAAE,MAAM,KAAA,EAAE,SAAS,KAAA,QAetD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,YAPhB,MAAM,WACN,MAAM,SACN,MAAM,WACN,MAAM,KAEJ,MA6FZ,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAI5B;AAiDD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAHzC,MAGyC,GAFvC,MAAM,EAAE,CAMpB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAHxC,MAGwC,GAFtC,MAAM,EAAE,CAMpB;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,wBAAwB,EALf,MAAM,EAKS,EACxB,wBAAwB,EALf,MAAM,EAKS,GAJb,MAAM,EAAE,CASpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAHxC,MAGwC,GAFtC,MAAM,EAAE,CAyBpB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAHpC,MAGoC,GAFlC,MAAM,GAAC,SAAS,CAS5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,wBAAwB,EAHtD,MAAM,EAGgD,GAFpD,OAAO,CAInB;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EALvC,MAAM,EAKiC,EAAE,aAAa,EAJtD,MAIsD,EAAE,OAAO,EAH/D,GAAG,CAAC,MAAM,CAGqD,GAF7D,MAAM,EAAE,CAgBpB;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,QAAQ,EAH9C,MAAM,EAGwC,GAF5C,MAAM,EAAE,CAQpB;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EALvC,MAKuC,EAAE,KAAK,EAJ9C,MAI8C,EAAE,QAAQ,EAHxD,MAAM,EAGkD,GAFtD,MAAM,CAIlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAJvC,MAIuC,EAAE,aAAa,EAHtD,MAGsD,GAFpD,IAAI,CAyDhB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAPtB,MAOsB,EAAE,UAAU,OAAA,EAAE,eAAe,EALnD,MAKmD,EAAE,YAAY,OAAA,GAF/D,MAAM,CA8ClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,YAJjC,MAAM,mBACN,MAAM,KACJ,OAYZ,CAAC"}

package/types/lib/cli/cliOptions.d.ts

@@ -0,0 +1,156 @@
+/**
+ * CLI argument → options conversion for cdxgen.
+ *
+ * Extracts the complex arg-to-options mapping from `bin/cdxgen.js` into
+ * pure, testable functions with no side-effects (no process.exit, no
+ * console output).
+ *
+ * Architecture note: This module is a helper and must NOT import from
+ * `lib/cli/index.js` or `lib/stages/`. See AGENTS.md "Module layering
+ * rules".
+ *
+ */
+/**
+ * Validate the `--spec-version` value against the v13 spec floor (1.6).
+ *
+ * Returns `null` when the value is an accepted generation target, or an
+ * actionable error string when it is rejected. The error message for
+ * sub-floor versions (1.4 / 1.5) explains that output downgrade still
+ * exists, so users are not left without a migration path.
+ *
+ * @param {number} specVersion  The parsed `--spec-version` value.
+ * @param {string} [commandName]  The invoked binary name for the message.
+ * @returns {string|null}  Error message, or `null` when valid.
+ */
+export declare function validateSpecVersion(specVersion: number, commandName?: string): string | null;
+/**
+ * Check whether a value was explicitly provided by the user (i.e., is not
+ * the yargs default). Yargs always populates default values, so we cannot
+ * simply check for truthiness.
+ *
+ * We detect "user-provided" by checking whether the actual value differs
+ * from the declared yargs default. This is robust for primitive types
+ * (number, string, boolean) which is the case for all cdxgen CLI flags.
+ *
+ * @param {*} value    The value from the parsed args
+ * @param {*} yaDefault The default declared in yargs `.option()`
+ * @returns {boolean}  True when the user explicitly set this flag
+ */
+export declare function isUserProvided(value: any, yaDefault: any): boolean;
+/**
+ * Apply command-name-based defaults to the raw parsed args. When cdxgen is
+ * invoked via a symlink or alias (e.g. `obom`, `cbom`, `spdxgen`, `aibom`),
+ * certain args receive implicit values.
+ *
+ * **Pure function** — returns a shallow copy of `args` with mutations; the
+ * original `args` object is not modified.
+ *
+ * @param {object} args               Parsed yargs argv
+ * @param {string} invokedCommandName Binary name without extension
+ * @returns {object} A shallow copy of args with alias-based defaults applied
+ */
+export declare function applyCommandNameDefaults(args: object, invokedCommandName: string): object;
+export declare function buildInitialOptions(args: any, { filePath, isRemoteOrPurl }: {
+    filePath: any;
+    isRemoteOrPurl: any;
+}): any;
+export type OptionsWarning = {
+    /**
+     * Severity level
+     */
+    level: "info" | "warn" | "error";
+    /**
+     * Human-readable description
+     */
+    message: string;
+};
+/**
+ * @typedef {object} OptionsWarning
+ * @property {"info"|"warn"|"error"} level   Severity level
+ * @property {string}                message Human-readable description
+ */
+/**
+ * Apply command-specific, standard, and security overrides to the options
+ * object. This covers:
+ *
+ * - Dedup of `projectType`
+ * - `cbom` / `saasbom` command overrides
+ * - `cdxgen-secure` mode
+ * - Dry-run mode
+ * - Standards-driven specVersion default
+ * - HBOM formulation suppression
+ *
+ * **Mutates `options` in place** and returns a list of warnings that the
+ * caller should surface to the user (e.g. via `console.warn`).
+ *
+ * @param {object} options               The options object from Phase 2
+ * @param {object} context
+ * @param {string} context.invokedCommandName  Binary name (e.g. "cbom")
+ * @param {boolean} context.userSetSpecVersion True when the user explicitly
+ *                                             passed `--spec-version`
+ * @param {boolean} [context.isDryRun=false]   Current dry-run state
+ * @returns {OptionsWarning[]} Warnings to surface to the user
+ */
+export declare function applyPostConstructionOverrides(options: object, context: {
+    invokedCommandName: string;
+    userSetSpecVersion: boolean;
+    isDryRun?: boolean;
+}): OptionsWarning[];
+/**
+ * Apply advanced option expansion based on `profile`, `lifecycle`, and
+ * `technique` settings. This is the extracted form of the
+ * `applyAdvancedOptions()` function that was previously inline in
+ * `bin/cdxgen.js`.
+ *
+ * **Mutates `options` in place.**
+ *
+ * Design note: Several profiles unconditionally override user flags like
+ * `deep`, `evidence`, and `installDeps`. This is intentional — the profile
+ * is a "meta-flag" that sets a curated combination. When users select a
+ * profile, they opt into its opinionated defaults.
+ *
+ * @param {object} options    The options object
+ * @param {object} [context]
+ * @param {boolean} [context.isSecureMode]  Whether cdxgen runs in secure mode
+ * @returns {OptionsWarning[]} Warnings for the caller
+ */
+export declare function applyAdvancedOptions(options: object, context?: {
+    isSecureMode?: boolean;
+}): OptionsWarning[];
+/**
+ * Build the complete `options` object from parsed CLI arguments.
+ *
+ * This is the single entry point that replaces the ~330 lines of inline
+ * imperative code in `bin/cdxgen.js`. It orchestrates all four phases:
+ *
+ * 1. Command-name alias expansion
+ * 2. Initial options construction (field renames, derived values)
+ * 3. Post-construction overrides (dedup, command flags, specVersion)
+ * 4. Advanced options (profile, lifecycle, technique)
+ *
+ * Returns both the options object and a list of warnings that the caller
+ * (typically `bin/cdxgen.js`) should surface to the user.
+ *
+ * @param {object} args               Raw parsed yargs argv
+ * @param {object} context
+ * @param {string} context.invokedCommandName  Binary name without extension
+ * @param {string} context.filePath            Resolved source path
+ * @param {boolean} context.isRemoteOrPurl     True for URL/purl sources
+ * @param {boolean} context.userSetSpecVersion True when the user explicitly
+ *                                             passed `--spec-version`
+ * @param {boolean} [context.isDryRun=false]   Dry-run mode
+ * @param {boolean} [context.isSecureMode]     Secure mode
+ * @returns {{ options: object, warnings: OptionsWarning[] }}
+ */
+export declare function buildOptionsFromArgs(args: object, context: {
+    invokedCommandName: string;
+    filePath: string;
+    isRemoteOrPurl: boolean;
+    userSetSpecVersion: boolean;
+    isDryRun?: boolean;
+    isSecureMode?: boolean;
+}): {
+    options: object;
+    warnings: OptionsWarning[];
+};
+//# sourceMappingURL=cliOptions.d.ts.map

package/types/lib/cli/cliOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cliOptions.d.ts","sourceRoot":"","sources":["../../../lib/cli/cliOptions.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAmBH;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAJpC,MAIoC,EAAE,WAAW,AAHzD,CACA,EADQ,MAG4D,GAF1D,MAAM,GAAC,IAAI,CAoBvB;AA6BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAJzB,GAIyB,EAAE,SAAS,EAHpC,GAGoC,GAFlC,OAAO,CAInB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,kBAAkB,EAHtD,MAGsD,GAFpD,MAAM,CAoBlB;AAwCD,wBAAgB,mBAAmB,CAAC,IAAI,KAAA,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE;;;CAAA,OAyCrE;AAGE,YAAkB,cAAc,GAChC;;;;IAAkC,KAAK,EAA5B,MAAM,GAAC,MAAM,GAAC,OAAO,CAChC;;;;IAAkC,OAAO,EAA9B,MAAM,CACnB;CAAA,CAAA;AAJD;;;;GAIG;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAR3C,MAQ2C,EAAE,OAAO,EAN5D;IAAwB,kBAAkB,EAAlC,MAAM,CACd;IAAyB,kBAAkB,EAAnC,OAAO,CAEf;IAA0B,QAAQ,AAAlC,CACA,EADQ,OAAO,CACf;CAE4D,GAFlD,cAAc,EAAE,CAoF5B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EALjC,MAKiC,EAAE,OAAO,AAJlD,CAEA,EADA;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;CAEuD,GAF7C,cAAc,EAAE,CA+G5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAX9B,MAW8B,EAAE,OAAO,EAT/C;IAAwB,kBAAkB,EAAlC,MAAM,CACd;IAAwB,QAAQ,EAAxB,MAAM,CACd;IAAyB,cAAc,EAA/B,OAAO,CACf;IAAyB,kBAAkB,EAAnC,OAAO,CAEf;IAA0B,QAAQ,AAAlC,CACA,EADQ,OAAO,CACf;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;CAE+C,GAFrC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;CAAE,CA6B3D"}

package/types/lib/cli/index.d.ts

@@ -0,0 +1,107 @@
+export { summarizeAiInventory } from "../inventory/aiInventory.js";
+export { createAndroidBom, createBinaryBom, dedupeBom, listComponents, } from "./bomAssembly.js";
+export { createAsarBom, createCaxaBom, createChromeExtensionBom, createNodejsBom, createVscodeExtensionBom, } from "./jsBom.js";
+export { createJarBom, createJavaBom } from "./jvmBom.js";
+export { createCloudBuildBom, createCryptoCertsBom, createCsharpBom, createGitHubBom, createHelmBom, createJenkinsBom, createPHPBom, createPixiBom, createPythonBom, createRubyBom, } from "./managedBom.js";
+export { createClojureBom, createCocoaBom, createCppBom, createDartBom, createElixirBom, createGleamBom, createGoBom, createHaskellBom, createNixBom, createRustBom, createSwiftBom, createZigBom, } from "./nativeBom.js";
+/**
+ * Function to create obom string for the current OS using osquery
+ *
+ * @param {string} _path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} Promise resolving to BOM object
+ */
+export declare function createOSBom(_path: string, options: Object): Promise<Object>;
+/**
+ * Function to create bom string for docker compose
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} Promise resolving to BOM object
+ */
+export declare function createContainerSpecLikeBom(path: string, options: Object): Promise<Object>;
+/**
+ * Function to create bom string for all languages
+ *
+ * @param {string[]} pathList list of to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} Promise resolving to BOM object
+ */
+/**
+ * Join non-zero counts into a phase summary.
+ *
+ * Each entry carries its own plural form rather than having one appended, so
+ * nouns like "shared library" read correctly.
+ *
+ * @param {Array<[number, string, string]>} entries Count, singular, and plural
+ * @returns {string} Summary such as "412 OS packages, 3 services"
+ */
+export declare function summarizeCounts(entries: Array<[number, string, string]>): string;
+/**
+ * Summarize components by purl type, so a scan reports "412 npm, 88 pypi"
+ * rather than an anonymous total.
+ *
+ * @param {object[]} components Components carrying purls
+ * @returns {string} Comma-separated counts, busiest type first
+ */
+export declare function summarizePurlTypes(components: object[]): string;
+/**
+ * Generates BOMs across multiple project types and/or paths, then merges and
+ * deduplicates the results into a single BOM namespace data object. Handles
+ * OCI/container inventory, per-path scans, formulation accumulation, and
+ * parent-component reconciliation.
+ *
+ * @param {string|string[]} pathList Comma-separated string or array of paths
+ * @param {object} options CLI options
+ * @returns {Promise<object>} Promise resolving to a deduplicated BOM namespace
+ *   data object (components, dependencies, bomJson, parentComponent, etc.)
+ */
+export declare function createMultiXBom(pathList: string | string[], options: object): Promise<object>;
+/**
+ * Function to create a dynamic SBOM by executing a command and tracing the
+ * shared libraries it loads at runtime via instrumentation.
+ *
+ * Components receive scope=required, evidence.identity[].methods[].technique=
+ * instrumentation, and confidence 0.8 (version known) or 0.5 (version unknown).
+ *
+ * @param {string} path - Target path (used as working directory fallback)
+ * @param {Object} options - CLI options; must include options.traceCmd
+ * @returns {Promise<Object>} Promise resolving to BOM data object
+ */
+export declare function createDynamicBom(path: string, options: Object): Promise<Object>;
+/**
+ * Function to create bom string for various languages
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object|undefined>} Promise resolving to BOM object, or undefined if path is not readable
+ */
+export declare function createXBom(path: string, options: Object): Promise<Object | undefined>;
+/**
+ * Function to create a hardware BOM for the current host.
+ *
+ * @param {string} _path Source path (unused for live host HBOM generation)
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} Promise resolving to BOM object
+ */
+export declare function createHBom(_path: string, options: Object): Promise<Object>;
+/**
+ * Function to create bom string for various languages
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} Promise resolving to BOM object
+ */
+export declare function createBom(path: string, options: Object): Promise<Object>;
+/**
+ * Method to submit the generated bom to dependency-track or cyclonedx server
+ *
+ * @param {Object} args CLI args
+ * @param {Object} bomContents BOM Json
+ * @return {Promise<{ token: string } | undefined>} a promise with a token (if request was successful) or undefined (in case of invalid arguments)
+ * @throws {Error} if the request fails
+ */
+export declare function submitBom(args: Object, bomContents: Object): Promise<{
+    token: string;
+} | undefined>;
+//# sourceMappingURL=index.d.ts.map

package/types/lib/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/cli/index.js"],"names":[],"mappings":"AAmEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAsCnE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,aAAa,EACb,wBAAwB,EACxB,eAAe,EACf,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA8B1D,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,eAAe,EACf,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,aAAa,EACb,eAAe,EACf,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AAyBxB;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,OAAO,CAAC,MAAM,CAAC,CAwE3B;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,OAAO,EAHnD,MAGmD,GAFjD,OAAO,CAAC,MAAM,CAAC,CAkU3B;AAgCD;;;;;;GAMG;AACH;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAGF,GAF1B,MAAM,CAUlB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAAM,EAG4B,GAFhC,MAAM,CAalB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EALnC,MAAM,GAAC,MAAM,EAKsB,EAAE,OAAO,EAJ5C,MAI4C,GAH1C,OAAO,CAAC,MAAM,CAAC,CA4kC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CAoD3B;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA4YrC;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,CAAC,CAsB3B;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,OAAO,CAAC,MAAM,CAAC,CA4U3B;AAED;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,IAAI,EALzB,MAKyB,EAAE,WAAW,EAJtC,MAIsC,GAHrC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CA+HjD"}