@cdxgen/cdxgen 0.0.1 → 13.0.0

package/types/lib/core/paths.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Repo-root resolution, shared by every helper that loads a file from `data/`.
+ *
+ * This lives in its own leaf module — importing nothing from `utils.js` — because
+ * the value is consumed at *module-evaluation* time (`JSON.parse(readFileSync(
+ * join(dirNameStr, "data", …)))`). A module in a cycle with `utils.js` that reads
+ * `dirNameStr` while `utils.js` is still evaluating gets the binding in its
+ * temporal dead zone and throws `ReferenceError: Cannot access 'dirNameStr'
+ * before initialization`. Keeping the definition in a leaf guarantees it is
+ * initialized before any consumer runs.
+ *
+ * The `file://` normalization below is load-bearing, not defensive noise:
+ * `jsr.json` publishes `lib/cli/index.js` to JSR, so `import.meta.url` can be an
+ * `https://` URL, and `fileURLToPath` throws `ERR_INVALID_URL_SCHEME` on those.
+ */
+/** Absolute path to the cdxgen repository root, resolved from the module URL. */
+export declare const dirNameStr: any;
+/** True when running on Windows. */
+export declare const isWin: boolean;
+/** True when running on macOS. */
+export declare const isMac: boolean;
+/**
+ * Validate that a string is a Windows drive root such as `C:\`.
+ *
+ * @param {string} root Candidate drive root string.
+ * @returns {boolean} True when the string is a valid Windows drive root.
+ */
+export declare function isValidDriveRoot(root: string): boolean;
+/**
+ * Convert a kebab-case string to camelCase.
+ *
+ * @param {string} str Kebab-case input string.
+ * @returns {string} camelCase representation of the input.
+ */
+export declare function toCamel(str: string): string;
+//# sourceMappingURL=paths.d.ts.map

package/types/lib/core/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../lib/core/paths.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAYH,iFAAiF;AACjF,eAAO,MAAM,UAAU,KAEV,CAAC;AAEd,oCAAoC;AACpC,eAAO,MAAM,KAAK,SAAyB,CAAC;AAC5C,kCAAkC;AAClC,eAAO,MAAM,KAAK,SAA0B,CAAC;AAE7C;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAH1B,MAG0B,GAFxB,OAAO,CAmBnB;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAHhB,MAGgB,GAFd,MAAM,CAIlB"}

package/types/lib/core/projectConfig.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Config file names cdxgen reads from the directory it is invoked in.
+ */
+export declare const PROJECT_CONFIG_FILENAMES: string[];
+/**
+ * Apply the trust boundary between cdxgen and the directory it is scanning.
+ *
+ * A config file lives in the tree under analysis, so it is attacker-controlled
+ * whenever that tree is. Path options are therefore confined to the config's
+ * own directory - a scanned project may choose where in itself the BOM lands,
+ * but not write outside it - and options that redirect data off the host or
+ * widen what cdxgen executes are announced on the console.
+ *
+ * @param {Object} config parsed config file contents
+ * @param {string} configDir directory the config file was read from
+ * @returns {{config: Object, rejected: string[], announced: string[]}} sanitized config and what it did
+ */
+export declare function sanitizeProjectConfig(config: Object, configDir: string): {
+    config: Object;
+    rejected: string[];
+    announced: string[];
+};
+//# sourceMappingURL=projectConfig.d.ts.map

package/types/lib/core/projectConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectConfig.d.ts","sourceRoot":"","sources":["../../../lib/core/projectConfig.js"],"names":[],"mappings":"AAIA;;GAEG;AACH,eAAO,MAAM,wBAAwB,UAKpC,CAAC;AAsEF;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAJjC,MAIiC,EAAE,SAAS,EAH5C,MAG4C,GAF1C;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,CA4BrE"}

package/types/lib/core/propertySanitizer.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Recursively sanitize structured values before embedding them in a BOM.
+ *
+ * @param {unknown} value structured value
+ * @returns {unknown} sanitized value
+ */
+export declare function sanitizeStructuredValueForBom(value: unknown): unknown;
+/**
+ * Sanitize a URL value for safe BOM emission.
+ *
+ * @param {string} value URL value
+ * @returns {string} sanitized URL
+ */
+export declare function sanitizeBomUrl(value: string): string;
+/**
+ * Sanitize a property value before serializing it into BOM properties.
+ *
+ * @param {string} name property name
+ * @param {unknown} value property value
+ * @returns {string|unknown} sanitized property value
+ */
+export declare function sanitizeBomPropertyValue(name: string, value: unknown): string | unknown;
+//# sourceMappingURL=propertySanitizer.d.ts.map

package/types/lib/core/propertySanitizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"propertySanitizer.d.ts","sourceRoot":"","sources":["../../../lib/core/propertySanitizer.js"],"names":[],"mappings":"AAyDA;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAHxC,OAGwC,GAFtC,OAAO,CAInB;AAyED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAHzB,MAGyB,GAFvB,MAAM,CAIlB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,KAAK,EAHzC,OAGyC,GAFvC,MAAM,GAAC,OAAO,CAoB1B"}

package/types/lib/core/spdx.d.ts

@@ -0,0 +1,5 @@
+/** SPDX 3.0.1 JSON-LD context URL used when exporting CycloneDX documents to SPDX. */
+export declare const SPDX_JSONLD_CONTEXT = "https://spdx.org/rdf/3.0.1/spdx-context.jsonld";
+/** SPDX specification version string targeted by the SPDX export converter. */
+export declare const SPDX_SPEC_VERSION = "3.0.1";
+//# sourceMappingURL=spdx.d.ts.map

package/types/lib/core/spdx.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spdx.d.ts","sourceRoot":"","sources":["../../../lib/core/spdx.js"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,eAAO,MAAM,mBAAmB,mDACkB,CAAC;AACnD,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,UAAU,CAAC"}

package/types/lib/core/state.d.ts

@@ -0,0 +1,20 @@
+/** Loaded vendor alias mapping from data/vendor-alias.json. */
+declare const vendorAliases: any;
+/** Loaded Meson WrapDB releases from data/wrapdb-releases.json. */
+declare const mesonWrapDB: any;
+/** Loaded list of known frameworks from data/frameworks-list.json. */
+export declare const frameworksList: any;
+/** Loaded set of C/C++ standard library modules from data/glibc-stdlib.json. */
+declare const CPP_STD_MODULES: any;
+/** Installed cdxgen version, read from package.json. */
+export declare const CDXGEN_VERSION: any;
+/** cdxgen npm scope group (e.g. "@cdxgen"), or empty string when unscoped. */
+export declare const CDXGEN_TOOL_GROUP: any;
+/** cdxgen bare tool name (the final path segment of the package name). */
+export declare const CDXGEN_TOOL_NAME: any;
+/** Loaded set of Python standard library modules from data/python-stdlib.json. */
+declare const PYTHON_STD_MODULES: any;
+/** Loaded mapping between Python module names and PyPI package names from data/pypi-pkg-aliases.json. */
+declare const PYPI_MODULE_PACKAGE_MAPPING: any;
+export { CPP_STD_MODULES, mesonWrapDB, PYPI_MODULE_PACKAGE_MAPPING, PYTHON_STD_MODULES, vendorAliases, };
+//# sourceMappingURL=state.d.ts.map

package/types/lib/core/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../../lib/core/state.js"],"names":[],"mappings":"AAKA,+DAA+D;AAC/D,QAAA,MAAM,aAAa,KAElB,CAAC;AACF,mEAAmE;AACnE,QAAA,MAAM,WAAW,KAEhB,CAAC;AACF,sEAAsE;AACtE,eAAO,MAAM,cAAc,KAE1B,CAAC;AAKF,gFAAgF;AAChF,QAAA,MAAM,eAAe,KAEpB,CAAC;AACF,wDAAwD;AACxD,eAAO,MAAM,cAAc,KAAoB,CAAC;AAWhD,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,KACoB,CAAC;AACnD,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,KAA0C,CAAC;AAExE,kFAAkF;AAClF,QAAA,MAAM,kBAAkB,KAEvB,CAAC;AACF,yGAAyG;AACzG,QAAA,MAAM,2BAA2B,KAEhC,CAAC;AAEF,OAAO,EACL,eAAe,EACf,WAAW,EACX,2BAA2B,EAC3B,kBAAkB,EAClB,aAAa,GACd,CAAC"}

package/types/lib/core/text.d.ts

@@ -0,0 +1,78 @@
+/**
+ * ANSI-aware text measurement, stripping, and wrapping helpers.
+ *
+ * Layer 0: this module imports nothing outside `lib/core`. It is the shared
+ * home for the width/wrap primitives that `lib/inventory/table.js` (layer 2)
+ * and `lib/core/ui.js` (layer 0) both need, so neither has to reach across a
+ * layer boundary for them.
+ */
+/** String source of a regex matching ANSI escape sequences (CSI forms). */
+declare const ANSI_PATTERN = "\\u001B\\[[0-?]*[ -/]*[@-~]";
+/** Global regex constructed from {@link ANSI_PATTERN}, used to strip ANSI escapes. */
+declare const ANSI_REGEX: RegExp;
+/** Regex matching Unicode combining mark characters (the `\p{Mark}` category). */
+declare const COMBINING_MARK_REGEX: RegExp;
+/**
+ * Strip ANSI escape sequences from a string.
+ *
+ * @param {string} input Input possibly containing ANSI escapes
+ * @returns {string} Visible text only
+ */
+export declare const stripAnsi: (input: string) => string;
+/**
+ * Detect full-width East-Asian-Wide and emoji code points so they occupy two
+ * cells instead of one. The ranges mirror the EastAsianWidth+F/EV definitions
+ * used by mainstream terminal width libraries.
+ *
+ * @param {number} codePoint Code point to test
+ * @returns {boolean} True when the code point is double-width
+ */
+export declare const isFullWidthCodePoint: (codePoint: number) => boolean;
+/**
+ * Measure the visible cell width of a string, accounting for ANSI escapes,
+ * combining marks, and full-width code points.
+ *
+ * @param {string} input Input to measure
+ * @returns {number} Visible width in terminal cells
+ */
+export declare const stringWidth: (input: string) => number;
+/**
+ * Pad/align text to a target visible width.
+ *
+ * @param {string} text Text to align
+ * @param {number} width Target cell width
+ * @param {"left"|"right"|"center"} [alignment="left"] Alignment
+ * @returns {string} Padded text
+ */
+export declare const alignText: (text: string, width: number, alignment?: "left" | "right" | "center") => string;
+/**
+ * Split a single line into ANSI and non-ANSI tokens, preserving the escape
+ * sequences so wrappers can re-emit them attached to the right chunk.
+ *
+ * @param {string} line Input line
+ * @returns {{isAnsi: boolean, value: string}[]} Tokens in order
+ */
+export declare const splitAnsiTokens: (line: string) => {
+    isAnsi: boolean;
+    value: string;
+}[];
+/**
+ * Wrap a single line by character count, keeping ANSI sequences attached to
+ * the current chunk.
+ *
+ * @param {string} line Input line (no embedded newlines)
+ * @param {number} width Target cell width
+ * @returns {string[]} Wrapped lines
+ */
+export declare const wrapLineByChars: (line: string, width: number) => string[];
+/**
+ * Wrap a single line by word boundaries, falling back to character wrapping
+ * for words longer than the width.
+ *
+ * @param {string} line Input line
+ * @param {number} width Target cell width
+ * @returns {string[]} Wrapped lines
+ */
+export declare const wrapLineByWords: (line: string, width: number) => string[];
+export { ANSI_PATTERN, ANSI_REGEX, COMBINING_MARK_REGEX };
+//# sourceMappingURL=text.d.ts.map

package/types/lib/core/text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"text.d.ts","sourceRoot":"","sources":["../../../lib/core/text.js"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,2EAA2E;AAC3E,QAAA,MAAM,YAAY,gCAAgC,CAAC;AACnD,sFAAsF;AACtF,QAAA,MAAM,UAAU,QAAgC,CAAC;AACjD,kFAAkF;AAClF,QAAA,MAAM,oBAAoB,QAAc,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,SAAS,UAHX,MAAM,KACJ,MAE+D,CAAC;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,cAHtB,MAAM,KACJ,OAkBZ,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,UAHb,MAAM,KACJ,MAgBZ,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,SALX,MAAM,SACN,MAAM,cACN,MAAM,GAAC,OAAO,GAAC,QAAQ,KACrB,MAiBZ,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,SAHjB,MAAM,KACJ;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAkB5C,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,SAJjB,MAAM,SACN,MAAM,KACJ,MAAM,EAgClB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,SAJjB,MAAM,SACN,MAAM,KACJ,MAAM,EAmClB,CAAC;AAEF,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC"}

package/types/lib/core/ui.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Live-region CLI UI controller.
+ *
+ * Layer 0: imports nothing outside `lib/core`. The mechanism is a single live
+ * region: a block of lines rewritten in place by rewinding only by the previous
+ * frame's height. The block never ends with a newline until `stop()`, so every
+ * update is a single `write` and a crashed process can never leave a torn frame
+ * on screen.
+ *
+ * The UX layer on top is the phase model: `ui.phase(label)` returns a handle
+ * whose `detail`/`progress`/`succeed`/`fail`/`skip` calls drive the region. In
+ * non-interactive mode the same calls emit at most one plain line per state
+ * transition, so callers never branch on `ui.interactive`.
+ */
+/**
+ * Resolve a capability snapshot for the live region. Re-runs cleanly when given
+ * `overrides` (used by tests with a fake stream and a captive env object).
+ *
+ * `FORCE_COLOR` non-empty wins over `isatty()`; `TERM` in {dumb, unknown}
+ * forces non-interactive; `NO_COLOR` non-empty disables color but not the live
+ * region; `CDXGEN_NO_PROGRESS` and `CI=true` disable the live region. A worker
+ * thread needs no special case: its stdio is a pipe, so `isTTY` is undefined.
+ *
+ * @param {object} [overrides] Overrides for stream, env, and resolved flags
+ * @returns {{stream: object, interactive: boolean, color: boolean, unicode: boolean, glyphs: object, columns: () => number, rows: () => number}} Capability snapshot
+ */
+export declare function detectCapabilities(overrides?: object): {
+    stream: object;
+    interactive: boolean;
+    color: boolean;
+    unicode: boolean;
+    glyphs: object;
+    columns: () => number;
+    rows: () => number;
+};
+/**
+ * Create a live-region controller.
+ *
+ * @param {object} [options] Controller options
+ * @param {object} [options.stream] Writable stream (default `process.stderr`)
+ * @param {number|string} [options.level] Verbosity ladder 0..3
+ * @param {("text"|"json")} [options.format] Log serialization format
+ * @param {boolean} [options.noProgress] Force-disable the live region
+ * @param {boolean} [options.color] Force color on or off
+ * @param {boolean} [options.interactive] Force the live region on or off
+ * @param {() => number} [options.now] Clock, injectable for tests
+ * @returns {object} Controller
+ */
+export declare function createUi(options?: {
+    stream?: object;
+    level?: number | string;
+    format?: ("text" | "json");
+    noProgress?: boolean;
+    color?: boolean;
+    interactive?: boolean;
+    now?: () => number;
+}): object;
+/**
+ * Process-wide default live-region UI controller instance. Library code imports
+ * this directly; the CLI reconfigures it once flags are parsed.
+ *
+ * @type {Object}
+ */
+export declare const ui: Object;
+/**
+ * Convenience facade exposing leveled log methods (`error`, `warn`, `info`,
+ * `debug`) that delegate to the default controller instance.
+ *
+ * @type {Object}
+ */
+export declare const log: Object;
+/**
+ * Install a global `console` shim routing `log`/`info`/`warn`/`error`/`debug`/
+ * `trace` through the controller. This converts every existing `console.*` call
+ * site to land on the diagnostic stream above the live region without editing
+ * any of them. Unknown members delegate to the real console.
+ *
+ * @param {object} [uiInstance] Controller to route through
+ * @returns {() => void} Function that restores the original console
+ */
+export declare function installConsoleShim(uiInstance?: object): () => void;
+/**
+ * Restore the console captured by {@link installConsoleShim}. Safe to call when
+ * no shim is installed.
+ */
+export declare function restoreConsole(): void;
+//# sourceMappingURL=ui.d.ts.map

package/types/lib/core/ui.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui.d.ts","sourceRoot":"","sources":["../../../lib/core/ui.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAsEH;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,AAHzC,CACA,EADQ,MAGsC,GAFpC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,MAAM,CAAA;CAAC,CAqD/I;AAsID;;;;;;;;;;;;GAYG;AACH,wBAAgB,QAAQ,CAAC,OAAO,AAV7B,CAQA,EAPA;IAAyB,MAAM,AAA/B,CACA,EADQ,MAAM,CACd;IAAgC,KAAK,AAArC,CACA,EADQ,MAAM,GAAC,MAAM,CACrB;IAAkC,MAAM,AAAxC,CACA,EADQ,CAAC,MAAM,GAAC,MAAM,CAAC,CACvB;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;IAA0B,KAAK,AAA/B,CACA,EADQ,OAAO,CACf;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAA+B,GAAG,AAAlC,CACA,EADQ,MAAM,MAAM,CACpB;CAEkC,GAFxB,MAAM,CA8dlB;AAED;;;;;GAKG;AACH,eAAO,MAAM,EAAE,EAFL,MAEoB,CAAC;AAE/B;;;;;GAKG;AACH,eAAO,MAAM,GAAG,EAFN,MA2BT,CAAC;AAcF;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,AAH1C,CACA,EADQ,MAGuC,GAFrC,MAAM,IAAI,CAiCtB;AAED;;;GAGG;AACH,wBAAgB,cAAc,SAK7B"}

package/types/lib/core/urls.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Host-aware URL predicates.
+ *
+ * Substring tests such as `url.includes("github.com")` also match hosts that
+ * merely embed the name (`github.com.example.org`, `evil-github.com`) and
+ * paths that mention it (`https://example.org/mirror/github.com/o/r`). The
+ * helpers here parse the URL and compare the hostname, so a match means the
+ * request really is destined for the named host.
+ */
+/**
+ * Parses a URL, tolerating scheme-relative and scheme-less inputs commonly
+ * found in package metadata.
+ *
+ * @param {String} url URL to parse
+ * @returns {URL|undefined} Parsed URL or undefined when unparseable
+ */
+export declare function parseUrl(url: string): URL | undefined;
+/**
+ * Whether the url's host is the given host or one of its subdomains.
+ *
+ * @param {String} url URL to test
+ * @param {String} host Bare host name, such as `github.com`
+ * @returns {Boolean} True when the url targets that host
+ */
+export declare function urlHostMatches(url: string, host: string): boolean;
+/**
+ * Whether the url points at a github.com repository. Requires an explicit
+ * scheme so that bare module paths are not mistaken for URLs.
+ *
+ * @param {String} url URL to test
+ * @returns {Boolean} True for `https://github.com/owner/repo` style urls
+ */
+export declare function isGitHubUrl(url: string): boolean;
+/**
+ * Whether a slash-separated module path (a Go import path, for instance) is
+ * rooted at the given host.
+ *
+ * @param {String} modulePath Module path such as `github.com/owner/repo`
+ * @param {String} host Bare host name
+ * @returns {Boolean} True when the first path segment is that host
+ */
+export declare function modulePathHost(modulePath: string, host: string): boolean;
+//# sourceMappingURL=urls.d.ts.map

package/types/lib/core/urls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"urls.d.ts","sourceRoot":"","sources":["../../../lib/core/urls.js"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,GAAG,QAAA,GAFf,GAAG,GAAC,SAAS,CAqBzB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,QAAA,EAAE,IAAI,QAAA,WAQvC;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,QAAA,WAK9B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,UAAU,QAAA,EAAE,IAAI,QAAA,WAM9C"}

package/types/lib/ecosystems/asarutils.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Synchronously checks if a file is a valid Electron ASAR archive by sniffing its header.
+ *
+ * @param {string} archivePath - Path to the file to check
+ * @returns {boolean} True if the file has a valid ASAR header, false otherwise
+ */
+export declare function isAsarArchiveSync(archivePath: string): boolean;
+/**
+ * Synchronously reads and parses the header of an Electron ASAR archive.
+ *
+ * @param {string} archivePath - Path to the ASAR archive
+ * @returns {Object} Object containing archiveDataOffset, header files node, headerSize, and headerString
+ * @throws {Error} If the archive is invalid or header cannot be parsed
+ */
+export declare function readAsarArchiveHeaderSync(archivePath: string): Object;
+/**
+ * Synchronously lists all entries (files, directories, symlinks) in an Electron ASAR archive.
+ *
+ * @param {string} archivePath - Path to the ASAR archive
+ * @returns {Object} Object containing the archive header info and list of entries
+ * @throws {Error} If the archive is invalid or header parsing fails
+ */
+export declare function listAsarEntries(archivePath: string): Object;
+/**
+ * Recursively rewrites paths within component properties and evidence of an extracted archive
+ * to use virtual archive paths instead of local temporary extraction paths.
+ *
+ * @param {Object|Array} subject - The component, array of components, or component graph to rewrite
+ * @param {string} extractedDir - The temporary path where the archive was extracted
+ * @param {string} archivePath - The original path of the archive
+ * @returns {Object|Array} The updated subject with paths rewritten
+ */
+export declare function rewriteExtractedArchivePaths(subject: Object | any[], extractedDir: string, archivePath: string): Object | any[];
+/**
+ * Parse an Electron ASAR archive and emit inventory, metadata, and optional
+ * signing information.
+ *
+ * @param {string} archivePath Absolute or relative path to an ASAR archive
+ * @param {Object} [options={}] Parse options
+ * @param {string} [options.asarVirtualPath] Virtual archive identity to use in
+ * BOM references and evidence for nested ASAR recursion
+ * @param {number} [options.specVersion] CycloneDX spec version used to choose
+ * compatible component types
+ * @returns {Promise<Object>} Parsed archive analysis result
+ */
+export declare function parseAsarArchive(archivePath: string, options?: {
+    asarVirtualPath?: string;
+    specVersion?: number;
+}): Promise<Object>;
+/**
+ * Synchronously extracts an Electron ASAR archive to a temporary directory.
+ *
+ * @param {string} archivePath - Path to the ASAR archive to extract
+ * @returns {Promise<string|undefined>} Resolves to the path of the temporary directory, or undefined if extraction fails
+ */
+export declare function extractAsarToTempDir(archivePath: string): Promise<string | undefined>;
+/**
+ * Cleans up a temporary directory that was used for ASAR extraction.
+ *
+ * @param {string} tempDir - Path to the temporary directory to remove
+ */
+export declare function cleanupAsarTempDir(tempDir: string): void;
+/**
+ * Builds BOM properties summarizing the extraction status and manifest counts of an ASAR archive.
+ *
+ * @param {Object} archiveAnalysis - The parsed archive analysis result
+ * @param {boolean} extractionPerformed - Whether the extraction was actually executed
+ * @returns {Array<Object>} List of CycloneDX component properties
+ */
+export declare function buildAsarExtractionSummary(archiveAnalysis: Object, extractionPerformed: boolean): Array<Object>;
+//# sourceMappingURL=asarutils.d.ts.map

package/types/lib/ecosystems/asarutils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"asarutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/asarutils.js"],"names":[],"mappings":"AA6PA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAHlC,MAGkC,GAFhC,OAAO,CA6BnB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAJ1C,MAI0C,GAHxC,MAAM,CAwDlB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAJhC,MAIgC,GAH9B,MAAM,CA2ClB;AAgYD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EANE,MAAM,QAMR,EACP,YAAY,EANH,MAMG,EACZ,WAAW,EANF,MAME,GALA,MAAM,QAAM,CAqDxB;AAyYD;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EARvC,MAQuC,EAAE,OAAO,AAPxD,CAKA,EAJA;IAAyB,eAAe,AAAxC,CAEA,EAFQ,MAAM,CAEd;IAAyB,WAAW,AAApC,CAEA,EAFQ,MAAM,CAEd;CAE6D,GAFnD,OAAO,CAAC,MAAM,CAAC,CAyM3B;AAuGD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,EAH3C,MAG2C,GAFzC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA+BrC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAYzC;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,eAAe,EALN,MAKM,EACf,mBAAmB,EALV,OAKU,GAJR,KAAK,CAAC,MAAM,CAAC,CA0BzB"}

package/types/lib/ecosystems/bunutils.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Split a bun.lock package descriptor (eg `@babel/parser@7.29.7`,
+ * `left-pad@1.3.0` or `foo@git+https://github.com/foo/bar#abcdef`) into its
+ * group, name and version/specifier components.
+ *
+ * @param {string} descriptor The `name@specifier` descriptor string.
+ * @returns {{group: string, name: string, version: string}} Parsed pieces. The
+ *   version is returned verbatim, so non-registry specifiers (git/tarball URLs)
+ *   are preserved for the caller to handle.
+ */
+export declare function parseBunDescriptor(descriptor: string): {
+    group: string;
+    name: string;
+    version: string;
+};
+/**
+ * Parse a bun text lockfile (`bun.lock`, lockfileVersion 1).
+ *
+ * Bun's text lockfile is JSONC (JSON with trailing commas). It records the
+ * workspace roots under `workspaces` and the fully resolved dependency tree
+ * under `packages`, where each entry is an array of the form
+ * `["name@version", "registry", { dependencies, optionalDependencies, bin,
+ * os, cpu, ... }, "sha512-..."]`. Nested duplicate versions are keyed by their
+ * dependency path (eg `"parent/child"`).
+ *
+ * The binary lockfile (`bun.lockb`) is intentionally not supported - callers
+ * should ask users to regenerate it with `bun install --save-text-lockfile`.
+ *
+ * @param {string} bunLockFile Path to the bun.lock file.
+ * @param {Object} [options] Parsing options (`parentComponent`).
+ * @returns {Promise<{pkgList: Array, dependenciesList: Array}>} Parsed packages
+ *   and dependency graph, matching the shape of the other lockfile parsers.
+ */
+export declare function parseBunLock(bunLockFile: string, options?: Object): Promise<{
+    pkgList: any[];
+    dependenciesList: any[];
+}>;
+//# sourceMappingURL=bunutils.d.ts.map

package/types/lib/ecosystems/bunutils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bunutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/bunutils.js"],"names":[],"mappings":"AAuBA;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EALlC,MAKkC,GAJhC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAwB1D;AAyBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,YAAY,CAAC,WAAW,EALnC,MAKmC,EAAE,OAAO,AAJpD,CACA,EADQ,MAIiD,GAH/C,OAAO,CAAC;IAAC,OAAO,QAAQ;IAAC,gBAAgB,QAAO;CAAC,CAAC,CAoT9D"}

package/types/lib/ecosystems/caxa.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Parse caxa self-extracting executable metadata.
+ *
+ * @param {string} mfile Path to the caxa metadata file.
+ * @returns {Promise<Object>} Parsed metadata object.
+ */
+export declare function parseCaxaMetadata(mfile: string): Promise<Object>;
+//# sourceMappingURL=caxa.d.ts.map

package/types/lib/ecosystems/caxa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caxa.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/caxa.js"],"names":[],"mappings":"AAMA;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAHlC,MAGkC,GAFhC,OAAO,CAAC,MAAM,CAAC,CAkE3B"}

package/types/lib/ecosystems/chromextutils.d.ts

@@ -0,0 +1,97 @@
+/**
+ * The purl type for Chrome extensions as defined by the packageurl spec.
+ */
+export declare const CHROME_EXTENSION_PURL_TYPE = "chrome-extension";
+/**
+ * Discover known Chromium-based browser user-data directories.
+ *
+ * @returns {Array<{browser: string, channel: string, dir: string}>}
+ */
+export declare function getChromiumExtensionDirs(): Array<{
+    browser: string;
+    channel: string;
+    dir: string;
+}>;
+/**
+ * Discover existing Chromium-based browser user-data directories.
+ *
+ * @returns {Array<{browser: string, channel: string, dir: string}>}
+ */
+export declare function discoverChromiumExtensionDirs(): Array<{
+    browser: string;
+    channel: string;
+    dir: string;
+}>;
+/**
+ * Compare Chromium extension versions with numeric dot-separated semantics.
+ *
+ * @param {string} leftVersion Left version
+ * @param {string} rightVersion Right version
+ * @returns {number} Negative when left<right, positive when left>right, zero when equal
+ */
+export declare function compareChromiumExtensionVersions(leftVersion: string, rightVersion: string): number;
+/**
+ * Read profile names from Chromium user-data directory.
+ *
+ * @param {string} userDataDir Browser user-data directory
+ * @returns {string[]} Profile directory names
+ */
+export declare function getChromiumProfiles(userDataDir: string): string[];
+/**
+ * Parse a Chromium extension manifest file.
+ *
+ * @param {string} manifestFile Absolute path to manifest.json
+ * @returns {Object|undefined} Parsed manifest metadata
+ */
+export declare function parseChromiumExtensionManifest(manifestFile: string): Object | undefined;
+/**
+ * Infer browser context from a resolved Chromium extension manifest path.
+ *
+ * @param {string} manifestFile Absolute path to manifest.json
+ * @returns {{browser?: string, channel?: string, profile?: string, profilePath?: string}}
+ */
+export declare function inferChromiumContextFromManifest(manifestFile: string): {
+    browser?: string;
+    channel?: string;
+    profile?: string;
+    profilePath?: string;
+};
+/**
+ * Collect one directly specified extension from a path.
+ *
+ * Supported path forms:
+ * - `<...>/manifest.json`
+ * - `<...>/<extension-id>/<version>/manifest.json`
+ * - `<...>/<version>/` (contains manifest.json)
+ * - `<...>/<extension-id>/` (contains version subdirectories)
+ *
+ * Note: a standalone `<...>/<version>/` directory is not sufficient unless its
+ * parent directory name is the extension id, because the parser derives the
+ * extension id from the version directory's parent path.
+ *
+ * @param {string} extensionPath Candidate extension path
+ * @returns {{components: Object[], extensionDirs: string[]}}
+ */
+export declare function collectChromeExtensionsFromPath(extensionPath: string): {
+    components: Object[];
+    extensionDirs: string[];
+};
+/**
+ * Convert parsed Chromium extension metadata into a CycloneDX component object.
+ *
+ * @param {Object} extInfo Extension metadata
+ * @returns {Object|undefined} CycloneDX component object or undefined
+ */
+export declare function toComponent(extInfo: Object): Object | undefined;
+/**
+ * Collect installed Chromium extension components from discovered browser directories.
+ *
+ * @param {Array<{browser: string, channel: string, dir: string}>} browserDirs Browser directories
+ * @returns {Object[]} Array of CycloneDX component objects
+ */
+export declare function collectInstalledChromeExtensions(browserDirs: Array<{
+    browser: string;
+    channel: string;
+    dir: string;
+}>): Object[];
+//# sourceMappingURL=chromextutils.d.ts.map

package/types/lib/ecosystems/chromextutils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chromextutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/chromextutils.js"],"names":[],"mappings":"AAeA;;GAEG;AACH,eAAO,MAAM,0BAA0B,qBAAqB,CAAC;AAsK7D;;;;GAIG;AACH,wBAAgB,wBAAwB,IAF3B,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,CAqMlE;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,IAFhC,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,CAYlE;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAJjD,MAIiD,EAAE,YAAY,EAH/D,MAG+D,GAF7D,MAAM,CAwBlB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAHpC,MAGoC,GAFlC,MAAM,EAAE,CA8CpB;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,YAAY,EAHhD,MAGgD,GAF9C,MAAM,GAAC,SAAS,CAuK5B;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,YAAY,EAHlD,MAGkD,GAFhD;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAC,CA4BxF;AAuFD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,+BAA+B,CAAC,aAAa,EAHlD,MAGkD,GAFhD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,EAAE,MAAM,EAAE,CAAA;CAAC,CAuC3D;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAHxB,MAGwB,GAFtB,MAAM,GAAC,SAAS,CAiO5B;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAHjD,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAGJ,GAF/C,MAAM,EAAE,CAyGpB"}