@cdxgen/cdxgen 0.0.1 → 13.0.0

package/types/lib/core/env.d.ts

@@ -0,0 +1,192 @@
+/** True when running under Node.js. */
+export declare const isNode: boolean;
+/** True when running under Bun. */
+export declare const isBun: boolean;
+/** True when running under Deno. */
+export declare const isDeno: boolean;
+/** Value of the CDXGEN_SPDX_CREATED_BY environment variable, or undefined when unset. */
+export declare const CDXGEN_SPDX_CREATED_BY: string | undefined;
+/**
+ * Resolved table border style for console output ("ascii", "unicode", or
+ * "auto"), driven by the CDXGEN_TABLE_BORDER environment variable.
+ */
+export declare const TABLE_BORDER_STYLE: string;
+/** True when test scope dependencies should be included for Maven projects (default true unless CDX_MAVEN_INCLUDE_TEST_SCOPE is explicitly false). */
+export declare const includeMavenTestScope: boolean;
+/** True when the native Maven dependency tree command should be preferred (default true unless PREFER_MAVEN_DEPS_TREE is false/0). */
+export declare const PREFER_MAVEN_DEPS_TREE: boolean;
+/**
+ * Split a Maven arguments string into an argv array, honoring shell quoting
+ * (single and double quotes) and backslash escaping of whitespace and quotes.
+ *
+ * @param {string} argsString Raw Maven arguments string.
+ * @returns {string[]} Parsed argument array, or an empty array when input is falsy.
+ */
+export declare function parseMavenArgs(argsString: string): string[];
+/**
+ * Determines whether license information should be fetched from remote sources,
+ * based on the FETCH_LICENSE environment variable.
+ *
+ * @returns {boolean} True if the FETCH_LICENSE env var is set to "true" or "1"
+ */
+export declare function shouldFetchLicense(): boolean;
+/**
+ * Determines whether remote package metadata should be fetched for enrichment.
+ *
+ * @returns {boolean} True when registry metadata enrichment is enabled.
+ */
+export declare function shouldFetchPackageMetadata(): boolean;
+/**
+ * Determines whether VCS (version control system) information should be fetched
+ * for Go packages, based on the GO_FETCH_VCS environment variable.
+ *
+ * @returns {boolean} True if the GO_FETCH_VCS env var is set to "true" or "1"
+ */
+export declare function shouldFetchVCS(): boolean;
+/** True when license information should be fetched from remote sources (FETCH_LICENSE env var). */
+export declare const FETCH_LICENSE: boolean;
+/** True when search.maven.org should be used to identify jars without Maven metadata (default true unless SEARCH_MAVEN_ORG is explicitly false). */
+export declare const SEARCH_MAVEN_ORG: boolean;
+/** Resolved Java executable command (JAVA_CMD env var > JAVA_HOME/bin/java > "java"). */
+export declare const JAVA_CMD: string;
+/**
+ * Returns the Java executable command to use, resolved in priority order:
+ * JAVA_CMD env var > JAVA_HOME/bin/java > "java".
+ *
+ * @returns {string} Path or name of the Java executable
+ */
+export declare function getJavaCommand(): string;
+/** Resolved Python executable command (PYTHON_CMD env var > CONDA_PYTHON_EXE > "python"). */
+export declare const PYTHON_CMD: string;
+/**
+ * Returns the Python executable command to use, resolved in priority order:
+ * PYTHON_CMD env var > CONDA_PYTHON_EXE env var > "python".
+ *
+ * @returns {string} Path or name of the Python executable
+ */
+export declare function getPythonCommand(): string;
+/** Resolved .NET CLI command (DOTNET_CMD env var, or "dotnet"). */
+export declare let DOTNET_CMD: string;
+/** Resolved Node.js executable command (NODE_CMD env var, or "node"). */
+export declare let NODE_CMD: string;
+/** Resolved npm executable command (NPM_CMD env var, or "npm"). */
+export declare let NPM_CMD: string;
+/** Resolved Yarn executable command (YARN_CMD env var, or "yarn"). */
+export declare let YARN_CMD: string;
+/** Resolved GCC executable command (GCC_CMD env var, or "gcc"). */
+export declare let GCC_CMD: string;
+/** Resolved rustc executable command (RUSTC_CMD env var, or "rustc"). */
+export declare let RUSTC_CMD: string;
+/** Resolved Go executable command (GO_CMD env var, or "go"). */
+export declare let GO_CMD: string;
+/** Resolved Cargo executable command (CARGO_CMD env var, or "cargo"). */
+export declare let CARGO_CMD: string;
+/** Resolved Clojure CLI executable command (CLJ_CMD env var, or "clj"). */
+export declare let CLJ_CMD: string;
+/** Resolved Leiningen executable command (LEIN_CMD env var, or "lein"). */
+export declare let LEIN_CMD: string;
+/** Resolved temp directory used by cdxgen (CDXGEN_TEMP_DIR env var, or "temp"). */
+export declare let CDXGEN_TEMP_DIR: string;
+/** Resolved Swift executable command (SWIFT_CMD env var, or "swift"). */
+export declare const SWIFT_CMD: string;
+/** Resolved Ruby executable command (RUBY_CMD env var, or "ruby"). */
+export declare const RUBY_CMD: string;
+/** Python package components that can be excluded from the generated BOM. */
+export declare const PYTHON_EXCLUDED_COMPONENTS: string[];
+/** Map of base cdxgen project type to the array of accepted alias strings. */
+export declare const PROJECT_TYPE_ALIASES: {
+    java: string[];
+    android: string[];
+    jar: string[];
+    "gradle-index": string[];
+    "sbt-index": string[];
+    "maven-index": string[];
+    "cargo-cache": string[];
+    js: string[];
+    mcp: string[];
+    "ai-skill": string[];
+    py: string[];
+    go: string[];
+    rust: string[];
+    php: string[];
+    ruby: string[];
+    csharp: string[];
+    dart: string[];
+    haskell: string[];
+    elixir: string[];
+    c: string[];
+    clojure: string[];
+    github: string[];
+    hbom: string[];
+    os: string[];
+    jenkins: string[];
+    helm: string[];
+    "helm-index": string[];
+    universal: string[];
+    cloudbuild: string[];
+    swift: string[];
+    binary: string[];
+    oci: string[];
+    cocoa: string[];
+    scala: string[];
+    nix: string[];
+    zig: string[];
+    gleam: string[];
+    caxa: string[];
+    asar: string[];
+    "vscode-extension": string[];
+    "chrome-extension": string[];
+    dynamic: string[];
+    "ai-provenance": string[];
+};
+/** Map of base package manager to the array of accepted alias strings. */
+export declare const PACKAGE_MANAGER_ALIASES: {
+    scala: string[];
+};
+/**
+ * Method to check if a given feature flag is enabled.
+ *
+ * @param {Object} cliOptions CLI options
+ * @param {String} feature Feature flag
+ *
+ * @returns {Boolean} True if the feature is enabled
+ */
+export declare function isFeatureEnabled(cliOptions: Object, feature: string): boolean;
+/**
+ * Method to check if the given project types are allowed by checking against include and exclude types passed from the CLI arguments.
+ *
+ * @param {Array} projectTypes project types to check
+ * @param {Object} options CLI options
+ * @param {Boolean} defaultStatus Default return value if there are no types provided
+ */
+export declare function hasAnyProjectType(projectTypes: any[], options: Object, defaultStatus?: boolean): any;
+/**
+ * Determine whether the predictive dependency audit should run for the current
+ * CLI invocation.
+ *
+ * OBOM-focused runs (`obom` or explicit `-t os` / OS aliases only) should keep
+ * the direct BOM audit findings but skip the predictive dependency audit.
+ *
+ * @param {object} options CLI options
+ * @param {string} [commandPath] Invoked command path or name
+ * @returns {boolean} True when predictive dependency audit should run
+ */
+export declare function shouldRunPredictiveBomAudit(options: object, commandPath?: string): boolean;
+/**
+ * Convenient method to check if the given package manager is allowed.
+ *
+ * @param {String} name Package manager name
+ * @param {Array} conflictingManagers List of package managers
+ * @param {Object} options CLI options
+ *
+ * @returns {Boolean} True if the package manager is allowed
+ */
+export declare function isPackageManagerAllowed(name: string, conflictingManagers: any[], options: Object): boolean;
+/**
+ * Function to parse a list of environment variables to identify the paths containing executable binaries
+ *
+ * @param envValues {Array[String]} Environment variables list
+ * @returns {Array[String]} Binary Paths identified from the environment variables
+ */
+export declare function extractPathEnv(envValues: any): any;
+//# sourceMappingURL=env.d.ts.map

package/types/lib/core/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../lib/core/env.js"],"names":[],"mappings":"AAUA,uCAAuC;AACvC,eAAO,MAAM,MAAM,SAAmD,CAAC;AACvE,mCAAmC;AACnC,eAAO,MAAM,KAAK,SAAwC,CAAC;AAC3D,oCAAoC;AACpC,eAAO,MAAM,MAAM,SAA+C,CAAC;AAEnE,yFAAyF;AACzF,eAAO,MAAM,sBAAsB,oBAElC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAIrB,CAAC;AAEX,sJAAsJ;AACtJ,eAAO,MAAM,qBAAqB,SAI/B,CAAC;AAEJ,sIAAsI;AACtI,eAAO,MAAM,sBAAsB,SAElC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAH9B,MAG8B,GAF5B,MAAM,EAAE,CAiDpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAFrB,OAAO,CAOnB;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAF7B,OAAO,CAUnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAFjB,OAAO,CAOnB;AAED,mGAAmG;AACnG,eAAO,MAAM,aAAa,SAAuB,CAAC;AAElD,oJAAoJ;AACpJ,eAAO,MAAM,gBAAgB,SAEwC,CAAC;AAEtE,yFAAyF;AACzF,eAAO,MAAM,QAAQ,QAAmB,CAAC;AAEzC;;;;;GAKG;AACH,wBAAgB,cAAc,IAFjB,MAAM,CAclB;AAED,6FAA6F;AAC7F,eAAO,MAAM,UAAU,QAAqB,CAAC;AAE7C;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,CAUlB;AAED,mEAAmE;AACnE,eAAO,IAAI,UAAU,QAAW,CAAC;AAIjC,yEAAyE;AACzE,eAAO,IAAI,QAAQ,QAAS,CAAC;AAI7B,mEAAmE;AACnE,eAAO,IAAI,OAAO,QAAQ,CAAC;AAI3B,sEAAsE;AACtE,eAAO,IAAI,QAAQ,QAAS,CAAC;AAI7B,mEAAmE;AACnE,eAAO,IAAI,OAAO,QAAQ,CAAC;AAI3B,yEAAyE;AACzE,eAAO,IAAI,SAAS,QAAU,CAAC;AAI/B,gEAAgE;AAChE,eAAO,IAAI,MAAM,QAAO,CAAC;AAIzB,yEAAyE;AACzE,eAAO,IAAI,SAAS,QAAU,CAAC;AAK/B,2EAA2E;AAC3E,eAAO,IAAI,OAAO,QAAQ,CAAC;AAK3B,2EAA2E;AAC3E,eAAO,IAAI,QAAQ,QAAS,CAAC;AAK7B,mFAAmF;AACnF,eAAO,IAAI,eAAe,QAAS,CAAC;AAKpC,yEAAyE;AACzE,eAAO,MAAM,SAAS,QAAkD,CAAC;AAEzE,sEAAsE;AACtE,eAAO,MAAM,QAAQ,QAAgD,CAAC;AAEtE,6EAA6E;AAC7E,eAAO,MAAM,0BAA0B,UAWtC,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB;IAC/B,IAAI;IAwBJ,OAAO;IACP,GAAG;IACH,cAAc;IACd,WAAW;IACX,aAAa;IACb,aAAa;IACb,EAAE;IAiCF,GAAG;IACH,UAAU;IACV,EAAE;IAuBF,EAAE;IACF,IAAI;IACJ,GAAG;IACH,IAAI;IACJ,MAAM;IA4BN,IAAI;IACJ,OAAO;IACP,MAAM;IACN,CAAC;IACD,OAAO;IACP,MAAM;IACN,IAAI;IACJ,EAAE;IACF,OAAO;IACP,IAAI;IACJ,YAAY;IACZ,SAAS;IAcT,UAAU;IACV,KAAK;IAUL,MAAM;IACN,GAAG;IACH,KAAK;IACL,KAAK;IACL,GAAG;IACH,GAAG;IACH,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,kBAAkB;IASlB,kBAAkB;IAMlB,OAAO;IACP,eAAe;CAChB,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB;IAClC,KAAK;CACN,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EALhC,MAKgC,EAAE,OAAO,QAAA,WAiBnD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,OAAA,EAAE,OAAO,EAH5C,MAG4C,EAAE,aAAa,UAAO,OAmG5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAJxC,MAIwC,EAAE,WAAW,AAH7D,CACA,EADQ,MAGqD,GAFnD,OAAO,CAiCnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,QAAA,EAAE,mBAAmB,OAAA,EAAE,OAAO,EAJ/D,MAI+D,WAezE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,KAAA,OA8CvC"}

package/types/lib/core/fs.d.ts

@@ -0,0 +1,158 @@
+import { Buffer } from "node:buffer";
+/**
+ * Safely check if a file path exists without crashing due to a lack of permissions
+ *
+ * @param {String} filePath File path
+ * @Boolean True if the path exists. False otherwise
+ */
+export declare function safeExistsSync(filePath: string): any;
+/**
+ * Permission- and dry-run-aware wrapper around writeFileSync. Records the
+ * activity and returns undefined when blocked.
+ *
+ * @param {string} filePath File path to write.
+ * @param {string|Buffer} data Data to write.
+ * @param {Object} [options] writeFileSync options (encoding, mode, flag).
+ * @returns {void}
+ */
+export declare function safeWriteSync(filePath: string, data: string | Buffer, options?: Object): void;
+/**
+ * Safely create a directory without crashing due to a lack of permissions
+ *
+ * @param {String} filePath File path
+ * @param options {Options} mkdir options
+ * @Boolean True if the path exists. False otherwise
+ */
+export declare function safeMkdirSync(filePath: string, options: Options): undefined;
+/**
+ * Dry-run-aware wrapper around mkdtempSync that records the activity. In dry-run
+ * mode, returns a synthetic path without touching the filesystem.
+ *
+ * @param {string} prefix Path prefix for the temporary directory.
+ * @param {string|Object} [options] Encoding or mkdtempSync options.
+ * @returns {string|undefined} The created directory path, a synthetic path in dry-run mode, or undefined when blocked.
+ */
+export declare function safeMkdtempSync(prefix: string, options?: string | Object): string | undefined;
+/**
+ * Dry-run-aware wrapper around rmSync. Records the activity and returns
+ * undefined when blocked.
+ *
+ * @param {string} filePath Path to remove.
+ * @param {Object} [options] rmSync options (recursive, force, etc.).
+ * @returns {void}
+ */
+export declare function safeRmSync(filePath: string, options?: Object): void;
+/**
+ * Dry-run-aware wrapper around unlinkSync. Records the activity and returns
+ * undefined when blocked.
+ *
+ * @param {string} filePath File path to unlink.
+ * @returns {void}
+ */
+export declare function safeUnlinkSync(filePath: string): void;
+/**
+ * Dry-run-aware wrapper around copyFileSync. Records the activity and returns
+ * undefined when blocked.
+ *
+ * @param {string} src Source file path.
+ * @param {string} dest Destination file path.
+ * @param {number} [mode] Optional copy mode bitmask.
+ * @returns {void}
+ */
+export declare function safeCopyFileSync(src: string, dest: string, mode?: number): void;
+/**
+ * Run an archive extractor under dry-run/debug activity tracing. In dry-run
+ * mode the extraction is recorded as blocked and resolves false without running.
+ *
+ * @param {string} sourcePath Path to the source archive.
+ * @param {string} targetPath Path to extract into.
+ * @param {() => Promise} extractor Async function performing the extraction.
+ * @param {string} [kind="unzip"] Archive kind label for tracing.
+ * @param {Object} [options] Optional tracing metadata, blockedReason, and failureReason.
+ * @returns {Promise<boolean>} True when extraction succeeded, false when blocked by dry-run.
+ */
+export declare function safeExtractArchive(sourcePath: string, targetPath: string, extractor: () => Promise<any>, kind?: string, options?: Object): Promise<boolean>;
+/** Set of temporary file paths written by cdxgen that are removed on process exit. */
+export declare const temporaryFiles: Set<any>;
+/** Set accumulating every executable command spawned via safeSpawnSync. */
+export declare const commandsExecuted: Set<any>;
+/**
+ * Safe wrapper around spawnSync that enforces permission checks, injects default
+ * options (maxBuffer, encoding, timeout), warns about unsafe Python and pip/uv
+ * invocations, and records every executed command in the commandsExecuted set.
+ *
+ * @param {string} command The executable to spawn
+ * @param {string[]} args Arguments to pass to the command
+ * @param {Object} options Options forwarded to spawnSync (e.g. cwd, env, shell)
+ * @returns {Object} spawnSync result object with status, stdout, stderr, and error fields
+ */
+export declare function safeSpawnSync(command: string, args: string[], options: Object): Object;
+/** Default spawn timeout in milliseconds (20 minutes), overridable via CDXGEN_TIMEOUT_MS. */
+export declare const TIMEOUT_MS: number;
+/** Default maxBuffer size for spawned process stdout/stderr (100 MB), overridable via CDXGEN_MAX_BUFFER. */
+export declare const MAX_BUFFER: number;
+/**
+ * Method to get files matching a pattern
+ *
+ * @param {string} dirPath Root directory for search
+ * @param {string} pattern Glob pattern (eg: *.gradle)
+ * @param {Object} options CLI options
+ *
+ * @returns {Array[string]} List of matched files
+ */
+export declare function getAllFiles(dirPath: string, pattern: string, options?: Object): any;
+/**
+ * Confine directory-walk caching to one subtree, or switch it off.
+ *
+ * @param {string|undefined} rootDir Subtree whose contents are fixed for the rest of the scan
+ */
+export declare function setDirWalkCacheRoot(rootDir: string | undefined): void;
+/**
+ * Release every cached directory walk.
+ *
+ * Called when a BOM generation cycle starts, so that a long-lived process such
+ * as the server never serves a scan from an earlier scan's view of the
+ * filesystem, and so the retained directory entries are freed.
+ */
+export declare function clearFileDiscoveryCache(): void;
+/**
+ * Method to get files matching a pattern
+ *
+ * @param {string} dirPath Root directory for search
+ * @param {string} pattern Glob pattern (eg: *.gradle)
+ * @param {Boolean} includeDot whether hidden files can be included.
+ * @param {Array} ignoreList Directory patterns to ignore
+ *
+ * @returns {Array[string]} List of matched files
+ */
+export declare function getAllFilesWithIgnore(dirPath: string, pattern: string, includeDot: boolean, ignoreList: any[]): any;
+/**
+ * Return the current timestamp in YYYY-MM-DDTHH:MM:SSZ format.
+ *
+ * @returns {string} ISO formatted timestamp, without milliseconds.
+ */
+export declare function getTimestamp(): string;
+/**
+ * Return the temp directory, creating CDXGEN_TEMP_DIR when it is set but does
+ * not yet exist. Falls back to the OS tmpdir when unset.
+ *
+ * @returns {string} Resolved temp directory path.
+ */
+export declare function getTmpDir(): string;
+/**
+ * Computes the checksum for a file path using the given hash algorithm
+ *
+ * @param {string} hashName name of hash algorithm
+ * @param {string} path path to file
+ * @returns {Promise<String>} hex value of hash
+ */
+export declare function checksumFile(hashName: string, path: string): Promise<string>;
+/**
+ * Computes multiple checksum for a file path using the given hash algorithms
+ *
+ * @param {Array[String]} algorithms Array of algorithms
+ * @param {string} path path to file
+ * @returns {Promise<Object>} hashes object
+ */
+export declare function multiChecksumFile(algorithms: any, path: string): Promise<Object>;
+//# sourceMappingURL=fs.d.ts.map

package/types/lib/core/fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../lib/core/fs.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAsErC;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,QAAA,OAmCtC;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAL3B,MAK2B,EAAE,IAAI,EAJjC,MAAM,GAAC,MAI0B,EAAE,OAAO,AAHlD,CACA,EADQ,MAG0C,GAFxC,IAAI,CA0BhB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,QAAA,EAAE,OAAO,EAH5B,OAG4B,aAwB9C;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAAM,GAAC,MAGyC,GAF9C,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAJxB,MAIwB,EAAE,OAAO,AAHzC,CACA,EADQ,MAG6C,GAF3C,IAAI,CAchB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,IAAI,CAchB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,IAAI,EAJ/B,MAI+B,EAAE,IAAI,AAH7C,CACA,EADQ,MAGiD,GAF/C,IAAI,CAkBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EARD,MAQC,EACV,UAAU,EARD,MAQC,EACV,SAAS,EARA,kBAQA,EACT,IAAI,AARH,CACA,EADQ,MAQK,EACd,OAAO,AARN,CACA,EADQ,MAQU,GAPR,OAAO,CAAC,OAAO,CAAC,CAwD5B;AAED,sFAAsF;AACtF,eAAO,MAAM,cAAc,UAAY,CAAC;AASxC,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,UAAY,CAAC;AAuK1C;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAL1B,MAK0B,EAAE,IAAI,EAJhC,MAAM,EAI0B,EAAE,OAAO,EAHzC,MAGyC,GAFvC,MAAM,CA8OlB;AAED,6FAA6F;AAC7F,eAAO,MAAM,UAAU,QAEP,CAAC;AAEjB,4GAA4G;AAC5G,eAAO,MAAM,UAAU,QAEJ,CAAC;AAEpB;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,OAAO,EANxB,MAMwB,EAAE,OAAO,EALjC,MAKiC,EAAE,OAAO,GAJ1C,MAI+C,OAuCzD;AA0BD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAFhC,MAAM,GAAC,SAEyB,QAK1C;AA4BD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,SAGtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EARE,MAQF,EACP,OAAO,EARE,MAQF,EACP,UAAU,SAAA,EACV,UAAU,OAAA,OAmDX;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAFf,MAAM,CAIlB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,IAFZ,MAAM,CAYlB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAJ1B,MAI0B,EAAE,IAAI,EAHhC,MAGgC,GAF9B,OAAO,QAAQ,CAU3B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,KAAA,EAAE,IAAI,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA8B3B"}

package/types/lib/core/httpClient.d.ts

@@ -0,0 +1,149 @@
+/**
+ * A tiny, `got`-compatible HTTP client built on top of undici.
+ *
+ * cdxgen historically relied on the `got` library. `got` keeps a per-request
+ * HTTP cache backed by an EventEmitter which, during large `--deep` scans that
+ * issue thousands of parallel license/metadata lookups, leaks "error" listeners
+ * and floods the console with `MaxListenersExceededWarning` messages. undici
+ * uses a pooled dispatcher and does not exhibit this behaviour.
+ *
+ * This module intentionally implements only the subset of the `got` surface
+ * that cdxgen consumes:
+ *
+ * - Callable form: `client(url, options)` and the verb helpers `client.get`,
+ *   `client.post`, `client.put` and `client.head`.
+ * - `client.extend(defaults)` to derive a new client with merged defaults.
+ * - Request options: `method`, `headers`, `body`, `json`, `responseType`
+ *   (`"json"` | `"buffer"` | `"text"`), `throwHttpErrors`, `followRedirect`,
+ *   `timeout` (number of milliseconds or a `got`-style phase object), `retry`
+ *   (accepted for API compatibility; no automatic retries are performed),
+ *   `https.rejectUnauthorized` and `context`.
+ * - `beforeRequest`, `afterResponse` and `beforeError` hooks with the same
+ *   calling conventions cdxgen uses today. These hooks continue to power
+ *   cdxgen's dry-run enforcement, host allow-listing, network-activity
+ *   recording and HTTP trace logging.
+ * - Automatic response decompression (`gzip`, `deflate`, `br`) driven by the
+ *   `Content-Encoding` header, matching `got`'s transparent decoding.
+ * - Proxy support via the standard `HTTP_PROXY`/`HTTPS_PROXY`/`NO_PROXY`
+ *   environment variables (through undici's `EnvHttpProxyAgent`).
+ * - An in-memory GET response cache (enabled by default, disabled by setting
+ *   the `CDXGEN_NO_CACHE` environment variable) that replaces the got + Keyv
+ *   cache cdxgen previously relied on.
+ * - Response objects exposing `statusCode`, `headers`, `body`, `rawBody`,
+ *   `url` and `request.options`.
+ * - A lazily-resolved `.json()` method on the returned promise, mirroring
+ *   `got`'s `client(url).json()` usage.
+ *
+ * @module httpClient
+ */
+/**
+ * Error thrown when the server responds with a non 2xx/3xx status code and
+ * `throwHttpErrors` has not been disabled. Shaped like `got`'s `HTTPError` so
+ * that existing `error.response.statusCode` and `error.options.context` checks
+ * keep working.
+ */
+export declare class HTTPError extends Error {
+    response: Object;
+    options: Object;
+    code: string;
+    /**
+     * @param {Object} response Response object produced by this client.
+     * @param {Object} options Merged request options for the failed request.
+     */
+    constructor(response: Object, options: Object);
+}
+/**
+ * Error thrown for transport-level failures (DNS, connection reset, timeouts).
+ * Carries the merged request `options` so `beforeError` hooks can inspect the
+ * request context.
+ */
+export declare class RequestError extends Error {
+    options: Object;
+    code: any;
+    cause: Error;
+    /**
+     * @param {Error} cause Underlying error thrown by undici.
+     * @param {Object} options Merged request options for the failed request.
+     */
+    constructor(cause: Error, options: Object);
+}
+/**
+ * Resolve the default HTTP request timeout, honoring the validated
+ * CDXGEN_HTTP_TIMEOUT_MS environment variable when set to a positive integer.
+ *
+ * @returns {number} Timeout in milliseconds
+ */
+export declare function getDefaultHttpTimeoutMs(): number;
+/**
+ * Translate a `got`-style timeout option into a single total-request timeout in
+ * milliseconds suitable for `AbortSignal.timeout`. A plain number is used
+ * verbatim. A phase object (e.g. `{ connect, send, response }`, or `{ request }`)
+ * is reduced to the sum of its numeric phases, which provides a sensible upper
+ * bound for the whole request.
+ *
+ * @param {number|Object} [timeout] `got`-style timeout option.
+ * @returns {number|undefined} Total timeout in milliseconds, or `undefined`.
+ */
+export declare function resolveTimeout(timeout?: number | Object): number | undefined;
+/**
+ * Determine whether the in-memory HTTP response cache is disabled via the
+ * CDXGEN_NO_CACHE environment variable. Evaluated per request so tests and
+ * callers can toggle it at runtime.
+ *
+ * @returns {boolean} True when caching should be skipped.
+ */
+export declare function isCacheDisabled(): boolean;
+/**
+ * Clear the in-memory HTTP response cache. Primarily useful for tests.
+ *
+ * @returns {void}
+ */
+export declare function clearHttpCache(): void;
+/**
+ * Error thrown when a cassette replay session encounters a request with no
+ * matching recorded interaction.  This is loud-by-design: a silent fall-
+ * through to the live network would make offline golden tests meaningless.
+ */
+export declare class CassetteMissError extends Error {
+    method: string;
+    url: string;
+    /**
+     * @param {string} method HTTP method.
+     * @param {string} url Request URL.
+     */
+    constructor(method: string, url: string);
+}
+/**
+ * Install an HTTP interceptor that acts as the single network seam for test
+ * cassettes.  The interceptor receives a request descriptor and must return
+ * either a `got`-like response object (replay hit) or `null` (pass-through /
+ * record mode).
+ *
+ * @param {(req: { method: string, url: URL, headers: Object, body: *, responseType?: string, options: Object }) => Promise<Object|null>} fn
+ *   Interceptor function.
+ * @returns {void}
+ */
+export declare function setHttpInterceptor(fn: (req: {
+    method: string;
+    url: URL;
+    headers: Object;
+    body: any;
+    responseType?: string;
+    options: Object;
+}) => Promise<Object | null>): void;
+/**
+ * Remove the currently-installed HTTP interceptor, restoring normal network
+ * behaviour.
+ *
+ * @returns {void}
+ */
+export declare function clearHttpInterceptor(): void;
+/**
+ * Create a `got`-compatible HTTP client bound to the supplied defaults.
+ *
+ * @param {Object} [defaults] Default request options merged into every call.
+ * @returns {Function} Callable client exposing `get`/`post`/`put`/`head`,
+ *   `extend`, `defaults` and `hooks`.
+ */
+export declare function createHttpClient(defaults?: Object): Function;
+//# sourceMappingURL=httpClient.d.ts.map

package/types/lib/core/httpClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpClient.d.ts","sourceRoot":"","sources":["../../../lib/core/httpClient.js"],"names":[],"mappings":"AAeA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH;;;;;GAKG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAU3B,QAAQ;IACR,OAAO;IACP,IAAI;IAXX;;;OAGG;IACH,YAAY,QAAQ,EAHT,MAGS,EAAE,OAAO,EAFlB,MAEkB,EAQ5B;CACF;AAED;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,KAAK;IAQ9B,OAAO;IACP,IAAI;IACJ,KAAK;IATZ;;;OAGG;IACH,YAAY,KAAK,EAHN,KAGM,EAAE,OAAO,EAFf,MAEe,EAMzB;CACF;AA8DD;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAF1B,MAAM,CAYlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,AAHnC,CACA,EADQ,MAAM,GAAC,MAGoB,GAFzB,MAAM,GAAC,SAAS,CAyB5B;AAwGD;;;;;;GAMG;AACH,wBAAgB,eAAe,IAFlB,OAAO,CAKnB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAFjB,IAAI,CAIhB;AAkBD;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAUnC,MAAM;IACN,GAAG;IAVV;;;OAGG;IACH,YAAY,MAAM,EAHP,MAGO,EAAE,GAAG,EAFZ,MAEY,EAOtB;CACF;AASD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAJ1B,CAAC,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,GAAC,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,MAAM,GAAC,IAAI,CAIlG,GAFxB,IAAI,CAIhB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAFvB,IAAI,CAIhB;AA8RD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,AAJtC,CACA,EADQ,MAImC,YAwC7C"}

package/types/lib/core/logger.d.ts

@@ -0,0 +1,28 @@
+/** True when thought/reasoning logging is enabled (CDXGEN_THOUGHT_LOG, CDXGEN_THINK_MODE, or verbose debug mode). */
+export declare const THINK_MODE: any;
+/** True when structured command/HTTP trace logging is enabled (CDXGEN_TRACE_LOG, CDXGEN_TRACE_ID, CDXGEN_TRACE_MODE, or verbose debug mode). */
+export declare const TRACE_MODE: any;
+/**
+ * Logs a thought message to the think logger if THINK_MODE is enabled.
+ * Automatically appends a period to the message if it lacks terminal punctuation.
+ *
+ * @param {string} s The thought message to log
+ * @param {Object} [args] Optional additional arguments to log alongside the message
+ * @returns {void}
+ */
+export declare function thoughtLog(s: string, args?: Object): void;
+/**
+ * Closes the think log group by emitting the closing `</think>` marker.
+ * Has no effect if THINK_MODE is not enabled.
+ *
+ * @returns {void}
+ */
+export declare function thoughtEnd(): void;
+/**
+ * Log trace messages
+ *
+ * @param {String} traceType Trace type
+ * @param {Object} args Additional arguments
+ */
+export declare function traceLog(traceType: string, args: Object): void;
+//# sourceMappingURL=logger.d.ts.map

package/types/lib/core/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../../lib/core/logger.js"],"names":[],"mappings":"AAoBA,qHAAqH;AACrH,eAAO,MAAM,UAAU,KAGsB,CAAC;AAc9C,gJAAgJ;AAChJ,eAAO,MAAM,UAAU,KAIsB,CAAC;AAiB9C;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAJjB,MAIiB,EAAE,IAAI,AAH/B,CACA,EADQ,MAGuB,GAFrB,IAAI,CAehB;AACD;;;;;GAKG;AACH,wBAAgB,UAAU,IAFb,IAAI,CAOhB;AAYD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,SAAS,QAAA,EAAE,IAAI,EAF7B,MAE6B,QA8BvC"}

package/types/lib/core/parallel.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Bounded concurrency utilities for CPU-bound and I/O-bound parallel work.
+ *
+ * Two primitives live here:
+ *
+ * - {@link mapWithConcurrency} — a promise pool for async I/O work (file
+ *   hashing, registry fetches). Tasks are async; results preserve input order.
+ *
+ * - {@link mapInWorkers} — a worker-thread pool for synchronous CPU work (AST
+ *   parsing). Below a configurable threshold tasks run inline; above it they
+ *   are distributed across `worker_threads` workers. Any failure of the thread
+ *   machinery itself — an unavailable `worker_threads`, a worker entry that
+ *   will not load, a worker that dies mid-task — falls back to running the
+ *   remaining tasks inline, so the result is the same whether or not threads
+ *   were usable.
+ */
+/**
+ * Run an async mapper over an array with bounded concurrency.
+ *
+ * Results are placed at their original index so order is preserved regardless
+ * of completion order. Below the concurrency limit tasks start immediately;
+ * above it they queue in FIFO order.
+ *
+ * The bound is per call, so two pools running at once can together hold twice
+ * the limit open. Every caller today awaits its pool before the next phase
+ * begins, so the effective bound is the limit; a caller that starts a pool
+ * without awaiting it should pass a smaller `concurrency`.
+ *
+ * @template T, R
+ * @param {Array<T>} items
+ * @param {(item: T, index: number) => Promise<R>|R} mapper
+ * @param {number} [concurrency]
+ * @returns {Promise<Array<R>>}
+ */
+export declare function mapWithConcurrency<T, R>(items: Array<T>, mapper: (item: T, index: number) => Promise<R> | R, concurrency?: number): Promise<Array<R>>;
+/**
+ * Maximum number of worker threads the pool will create for a single call.
+ *
+ * @returns {number}
+ */
+export declare function getMaxWorkers(): number;
+/**
+ * The task count at or above which {@link mapInWorkers} dispatches to threads
+ * instead of running inline.
+ *
+ * @returns {number}
+ */
+export declare function getWorkerThreshold(): number;
+/**
+ * Workers created by the most recent {@link mapInWorkers} call. Scoped to that
+ * one call rather than to the process, so a batch that ran inline reports 0
+ * rather than the widest earlier batch.
+ *
+ * @returns {number}
+ */
+export declare function lastWorkerPoolSize(): number;
+/**
+ * Run synchronous CPU-bound tasks across worker threads.
+ *
+ * Below the threshold (default 24), tasks run inline on the calling thread,
+ * because starting a worker costs more than a small batch saves. Above it,
+ * tasks are distributed to a pool of ephemeral workers that are terminated
+ * before the call returns, so a completed scan does not hold the event loop
+ * open.
+ *
+ * Results are always returned in the original task order.
+ *
+ * Two kinds of failure are distinguished. A task that fails inside the worker
+ * is reported by the worker as `{error}` and is treated as that one task
+ * failing: it yields `options.errorResult` when `options.swallowErrors` is set,
+ * and rejects otherwise. A failure of the thread machinery — `worker_threads`
+ * missing, the entry module refusing to load, a worker exiting mid-task — is
+ * not a property of any task, so the tasks that had not completed are run
+ * inline instead. That keeps the result independent of whether threads were
+ * usable, which matters because callers of this function treat an empty result
+ * as "nothing found" rather than as an error.
+ *
+ * @template T, R
+ * @param {URL|string} workerUrl - Resolved URL of the worker entry module
+ * @param {Array<T>} tasks - Structured-cloneable task descriptors
+ * @param {(task: T) => R} inlineFn - Called per task when running inline
+ * @param {Object} [options]
+ * @param {number} [options.threshold] - Minimum task count to use threads
+ * @param {number} [options.maxWorkers] - Cap on thread count
+ * @param {boolean} [options.swallowErrors] - Return errorResult instead of rejecting
+ * @param {R} [options.errorResult] - Value used when an error is swallowed
+ * @returns {Promise<Array<R|null>>}
+ */
+export declare function mapInWorkers<T, R>(workerUrl: URL | string, tasks: Array<T>, inlineFn: (task: T) => R, options?: {
+    threshold?: number;
+    maxWorkers?: number;
+    swallowErrors?: boolean;
+    errorResult?: R;
+}): Promise<Array<R | null>>;
+//# sourceMappingURL=parallel.d.ts.map

package/types/lib/core/parallel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parallel.d.ts","sourceRoot":"","sources":["../../../lib/core/parallel.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAyBH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CAN3B,CAAC,EAAE,CAAC,EAMwB,KAAK,EALnC,KAAK,CAAC,CAAC,CAK4B,EAAE,MAAM,EAJ3C,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAC,CAII,EAAE,WAAW,AAHhE,CACA,EADQ,MAGwD,GAFtD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAsB7B;AAED;;;;GAIG;AACH,wBAAgB,aAAa,IAFhB,MAAM,CAIlB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAFrB,MAAM,CAIlB;AAKD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAFrB,MAAM,CAIlB;AAuDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,YAAY,CAXrB,CAAC,EAAE,CAAC,EAWkB,SAAS,EAVjC,GAAG,GAAC,MAU6B,EAAE,KAAK,EATxC,KAAK,CAAC,CAAC,CASiC,EAAE,QAAQ,EARlD,CAAC,IAAI,EAAE,CAAC,KAAK,CAQqC,EAAE,OAAO,AAPnE,CAKA,EAJA;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;IAAyB,UAAU,AAAnC,CACA,EADQ,MAAM,CACd;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAAoB,WAAW,AAA/B,CACA,EADQ,CAAC,CACT;CAEwE,GAF9D,OAAO,CAAC,KAAK,CAAC,CAAC,GAAC,IAAI,CAAC,CAAC,CA8HlC"}