@cdxgen/cdxgen 0.0.1 → 13.0.0

package/types/lib/ecosystems/golem.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Determine whether a project language is a Go variant that should trigger golem analysis.
+ *
+ * @param {string} language Project language identifier.
+ * @returns {boolean} True when the language maps to a Go variant.
+ */
+export declare function isGolemGoLanguage(language: string): boolean;
+/**
+ * Read and parse a golem analysis JSON report file.
+ *
+ * @param {string} jsonFile Path to the golem JSON report.
+ * @returns {object|undefined} Parsed report object, or undefined when the file
+ *   is missing or cannot be parsed.
+ */
+export declare function readGolemJsonFile(jsonFile: string): object | undefined;
+/**
+ * Invoke the golem analyzer binary over a source directory to produce a JSON report.
+ *
+ * Assembles the analyze invocation (callgraph mode, data-flow mode, patterns,
+ * tags, tests, stdlib flags) from the options and writes the result to
+ * `outputFile`.
+ *
+ * @param {string} src Source directory to analyze.
+ * @param {string} outputFile Destination path for the JSON report.
+ * @param {object} [options={}] Options controlling golem behavior.
+ * @returns {boolean} True when the analysis succeeded and the report was written.
+ */
+export declare function runGolemAnalysis(src: string, outputFile: string, options?: object): boolean;
+/**
+ * Orchestrate a full golem run: execute the analyzer, read the report, and clean up.
+ *
+ * When `options.semanticsSlicesFile` is set the report is persisted there;
+ * otherwise it is written to a temporary directory that is removed after parsing.
+ *
+ * @param {string} src Source directory to analyze.
+ * @param {object} [options={}] Options forwarded to {@link runGolemAnalysis}.
+ * @returns {object|undefined} Parsed golem report, or undefined on failure.
+ */
+export declare function analyzeGolemProject(src: string, options?: object): object | undefined;
+/**
+ * Project a golem report into CycloneDX component evidence, properties, and crypto assets.
+ *
+ * Aggregates import/usage/call-graph/data-flow evidence and crypto signals from
+ * the report, attaching per-component properties and occurrence evidence while
+ * collecting any derived cryptographic-asset components.
+ *
+ * @param {object} [golemReport={}] Parsed golem analysis report.
+ * @param {Array<object>} [components=[]] Existing BOM components to match against.
+ * @returns {{componentPropertiesMap: Object<string, Array<object>>, cryptoComponents: Array<object>, cryptoGeneratePurls: Object<string, boolean>, dataFlowFrames: Object<string, Array>, metadataProperties: Array<object>, purlLocationMap: Object<string, Array>}}
+ *   Projected evidence maps and crypto components.
+ */
+export declare function collectGolemEvidence(golemReport?: object, components?: Array<object>): {
+    componentPropertiesMap: Record<string, object[]>;
+    cryptoComponents: Array<object>;
+    cryptoGeneratePurls: Record<string, boolean>;
+    dataFlowFrames: Record<string, any[]>;
+    metadataProperties: Array<object>;
+    purlLocationMap: Record<string, any[]>;
+};
+//# sourceMappingURL=golem.d.ts.map

package/types/lib/ecosystems/golem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"golem.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/golem.js"],"names":[],"mappings":"AA+iDA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAJ/B,MAI+B,GAH7B,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,UAAU,EAJrC,MAIqC,EAAE,OAAO,AAHtD,CACA,EADQ,MAGmD,GAFjD,OAAO,CAmDnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,EAAE,OAAO,AAH7C,CACA,EADQ,MAG0C,GAFxC,MAAM,GAAC,SAAS,CA2B5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,AAL7C,CACA,EADQ,MAK0C,EAAE,UAAU,AAJ9D,CACA,EADQ,KAAK,CAAC,MAAM,CAI+C,GAHzD;IAAC,sBAAsB,2BAAgC;IAAC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,mBAAmB,0BAA0B;IAAC,cAAc,wBAAwB;IAAC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,eAAe,wBAAuB;CAAC,CAsFpQ"}

package/types/lib/ecosystems/gradleutils.d.ts

@@ -0,0 +1,139 @@
+/**
+ * Method to return the gradle command to use.
+ *
+ * @param {string} srcPath Path to look for gradlew wrapper
+ * @param {string|null} rootPath Root directory to look for gradlew wrapper
+ */
+export declare function getGradleCommand(srcPath: string, rootPath: string | null): string;
+/**
+ * Method to combine the general gradle arguments, the sub-commands and the sub-commands' arguments in the correct way
+ *
+ * @param {string[]} gradleArguments The general gradle arguments, which must only be added once
+ * @param {string[]} gradleSubCommands The sub-commands that are to be executed by gradle
+ * @param {string[]} gradleSubCommandArguments The arguments specific to the sub-command(s), which much be added PER sub-command
+ * @param {int} gradleCommandLength The length of the full gradle-command
+ *
+ * @returns {string[]} Array of arrays of arguments to be added to the gradle command
+ */
+export declare function buildGradleCommandArguments(gradleArguments: string[], gradleSubCommands: string[], gradleSubCommandArguments: string[], gradleCommandLength: int): string[];
+/**
+ * Method to split the output produced by Gradle using parallel processing by project
+ *
+ * @param {string} rawOutput Full output produced by Gradle using parallel processing
+ * @param {string[]} relevantTasks The list of gradle tasks whose output need to be considered.
+ * @returns {map} Map with subProject names as keys and corresponding dependency task outputs as values.
+ */
+export declare function splitOutputByGradleProjects(rawOutput: string, relevantTasks: string[]): map;
+/**
+ * Parse gradle projects output
+ *
+ * @param {string} rawOutput Raw string output
+ */
+export declare function parseGradleProjects(rawOutput: string): {
+    rootProject: string;
+    projects: any[];
+};
+/**
+ * Parse gradle properties output
+ *
+ * @param {string} rawOutput Raw string output
+ * @param {string} gradleModuleName The name (or 'path') of the module as seen from the root of the project
+ */
+export declare function parseGradleProperties(rawOutput: string, gradleModuleName?: string): {
+    rootProject: string;
+    projects: any[];
+    metadata: {
+        group: string;
+        version: string;
+        properties: never[];
+    };
+};
+/**
+ * Execute gradle properties command using multi-threading and return parsed output
+ *
+ * @param {string} dir Directory to execute the command
+ * @param {array} allProjectsStr List of all sub-projects (including the preceding `:`)
+ * @param {array} extraArgs List of extra arguments to use when calling gradle
+ *
+ * @returns {string} The combined output for all subprojects of the Gradle properties task
+ */
+export declare function executeParallelGradleProperties(dir: string, allProjectsStr: array, extraArgs?: array): string;
+/**
+ * Method to resolve dependencies from a gradle output
+ *
+ * @param {string} rawOutput Text output from gradle dependencies task
+ * @param {string} rootProjectName Name of the root project
+ * @param {map} gradleModules Cache with all gradle modules that have already been read
+ * @param {string} gradleRootPath Root path where Gradle is to be run when getting module information
+ */
+export declare function parseGradleDep(rawOutput: string, rootProjectName?: string, gradleModules?: map, gradleRootPath?: string): Promise<{
+    pkgList: any[];
+    dependenciesList: {
+        ref: string;
+        dependsOn: any[];
+    }[];
+} | {
+    pkgList?: undefined;
+    dependenciesList?: undefined;
+}>;
+/**
+ * Method that handles object creation for gradle modules.
+ *
+ * @param {string} name The simple name of the module
+ * @param {object} metadata Object with all other parsed data for the gradle module
+ * @returns {object} An object representing the gradle module in SBOM-format
+ */
+export declare function buildObjectForGradleModule(name: string, metadata: object): object;
+/**
+ * Extract Gradle repository URLs from the evaluation output properties.
+ *
+ * @param {string} propertiesOutput Properties command output containing repository lines
+ * @returns {Object} Map of repository names to their URLs
+ */
+export declare function extractGradleRepositoryUrls(propertiesOutput: string): Object;
+/**
+ * Parse the distribution URLs resolved by the init script when the
+ * `resolve-gradle-distribution` feature flag is enabled. The init script emits lines of
+ * the form `<CDXGEN:distribution>:group:name:version -> https://.../name-version.jar`.
+ *
+ * @param {string} stdout Gradle stdout logs containing the distribution markers
+ * @returns {Object} Map of `group:name:version` keys to their resolved distribution URLs
+ */
+export declare function parseGradleResolvedDistributions(stdout: string): Object;
+/**
+ * Parse Gradle info logs to capture HTTP URLs of resolved dependency artifacts.
+ *
+ * @param {string} stdout Gradle stdout logs under --info
+ * @returns {Object} Map of filenames to their resolved distribution URLs
+ */
+export declare function parseGradleInfoLogsForUrls(stdout: string): Object;
+/**
+ * Collect Gradle project dependencies by scanning the Gradle cache directory for JAR files
+ * and their associated POM files.
+ *
+ * Uses the `GRADLE_CACHE_DIR` or `GRADLE_USER_HOME` environment variables to locate the
+ * Gradle files-2.1 cache, then delegates to {@link collectJarNS} to extract namespace
+ * and purl information from those JARs.
+ *
+ * @param {string} _gradleCmd Gradle command (unused; reserved for future use)
+ * @param {string} _basePath Base project path (unused; reserved for future use)
+ * @param {boolean} _cleanup Whether to clean up temporary files (unused; reserved for future use)
+ * @param {boolean} _includeCacheDir Whether to include cache directory (unused; reserved for future use)
+ * @returns {Promise<Object>} JAR namespace mapping object returned by collectJarNS
+ */
+export declare function collectGradleDependencies(_gradleCmd: string, _basePath: string, _cleanup?: boolean, // eslint-disable-line no-unused-vars
+_includeCacheDir?: boolean): Promise<Object>;
+/**
+ * Method to return the mill command to use.
+ *
+ * @param {string} srcPath Path to look for mill wrapper
+ */
+export declare function getMillCommand(srcPath: string): string;
+/**
+ * Method to return the maven command to use.
+ *
+ * @param {string} srcPath Path to look for maven wrapper
+ * @param {string} rootPath Root directory to look for maven wrapper
+ */
+export declare function getMavenCommand(srcPath: string, rootPath: string): string;
+//# sourceMappingURL=gradleutils.d.ts.map

package/types/lib/ecosystems/gradleutils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gradleutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/gradleutils.js"],"names":[],"mappings":"AAmBA;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,EAAE,QAAQ,EAFvC,MAAM,GAAC,IAEgC,UAwEjD;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,eAAe,EARN,MAAM,EAQA,EACf,iBAAiB,EARR,MAAM,EAQE,EACjB,yBAAyB,EARhB,MAAM,EAQU,EACzB,mBAAmB,EARV,GAQU,GANR,MAAM,EAAE,CA2CpB;AAcD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAJ1C,MAI0C,EAAE,aAAa,EAHzD,MAAM,EAGmD,GAFvD,GAAG,CAqCf;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAFlC,MAEkC;;;EAsD5C;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAHpC,MAGoC,EAAE,gBAAgB,GAFtD,MAE6D;;;;;;;;EAoDvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAPM,MAON,EACH,cAAc,EAPL,KAOK,EACd,SAAS,GAPA,KAOK,GALH,MAAM,CAoFlB;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,SAAS,EANA,MAMA,EACT,eAAe,GANN,MAMe,EACxB,aAAa,GANJ,GAMgB,EACzB,cAAc,GANL,MAMU;;;;;;;;;GAgPpB;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,QAAQ,EAHpD,MAGoD,GAFlD,MAAM,CAiDlB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,gBAAgB,EAHjD,MAGiD,GAF/C,MAAM,CAkBlB;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAH5C,MAG4C,GAF1C,MAAM,CAuBlB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAHtC,MAGsC,GAFpC,MAAM,CA8ClB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAPD,MAOC,EACV,SAAS,EAPA,MAOA,EACT,QAAQ,GAPC,OAOM,EAAE,qCAAqC;AACtD,gBAAgB,GAPP,OAOe,GANb,OAAO,CAAC,MAAM,CAAC,CAgC3B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAF3B,MAE2B,UAarC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,MAG4B,EAAE,QAAQ,EAFtC,MAEsC,UAwIhD"}

package/types/lib/ecosystems/jsEvidence.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Attach JS/TS import and export usage evidence to matching package components.
+ *
+ * For each component, resolves its module aliases (including the deno jsr
+ * specifier), records imported/exported modules as properties, attaches
+ * occurrence evidence, and adjusts the component scope to "required" when the
+ * package is used or "optional" when it is not.
+ *
+ * @param {Array<object>} pkgList Package components to enrich.
+ * @param {object} allImports Map of import specifier to usage evidence objects.
+ * @param {object} allExports Map of export specifier to export evidence objects.
+ * @param {boolean} deep When true, fill in missing description/author/license
+ *   metadata from the local node_modules copy of each package.
+ * @returns {Promise<Array<object>>} The enriched package list (same reference as pkgList).
+ */
+export declare function addEvidenceForImports(pkgList: Array<object>, allImports: object, allExports: object, deep: boolean): Promise<Array<object>>;
+//# sourceMappingURL=jsEvidence.d.ts.map

package/types/lib/ecosystems/jsEvidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsEvidence.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/jsEvidence.js"],"names":[],"mappings":"AA0GA;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EARE,KAAK,CAAC,MAAM,CAQd,EACP,UAAU,EARD,MAQC,EACV,UAAU,EARD,MAQC,EACV,IAAI,EARK,OAQL,GANO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAqMlC"}

package/types/lib/ecosystems/npmutils.d.ts

@@ -0,0 +1,183 @@
+/**
+ * Marks an npm component as development-only.
+ *
+ * @param {object} pkg Component object to annotate
+ * @returns {void}
+ */
+export declare function setNpmDevelopmentProperty(pkg: object): void;
+/**
+ * Marks an npm component as optional.
+ *
+ * @param {object} pkg Component object to annotate
+ * @returns {void}
+ */
+export declare function setNpmOptionalProperty(pkg: object): void;
+/**
+ * Marks an npm component as a peer dependency.
+ *
+ * @param {object} pkg Component object to annotate
+ * @returns {void}
+ */
+export declare function setNpmPeerProperty(pkg: object): void;
+/**
+ * Helper function to create a properly encoded workspace PURL
+ *
+ * @param {string} packageName - Package name (e.g., "@babel/core")
+ * @param {string} version - Package version
+ * @returns {string} Encoded PURL string
+ */
+export declare function createNpmWorkspacePurl(packageName: string, version: string): string;
+/**
+ * Finds a matching npm workspace PURL for the supplied package name.
+ *
+ * @param {string[] | undefined} workspacePackages Array of workspace package PURLs
+ * @param {string} packageName Package name to match against
+ * @returns {string | undefined} Matching workspace package PURL, if any
+ */
+export declare function findMatchingNpmWorkspace(workspacePackages: string[] | undefined, packageName: string): string | undefined;
+/**
+ * Classifies an npm dependency specifier by source type.
+ *
+ * @param {string | undefined | null} spec npm dependency specifier
+ * @returns {{ type: string, value: string } | undefined} Classified manifest source, if supported
+ */
+export declare function classifyNpmManifestSource(spec: string | undefined | null): {
+    type: string;
+    value: string;
+} | undefined;
+/**
+ * Collects unique manifest-declared npm dependency sources from incoming edges.
+ *
+ * @param {object} node Arborist node
+ * @returns {{ type: string, value: string }[]} Unique manifest source entries
+ */
+export declare function collectNpmManifestSources(node: object): {
+    type: string;
+    value: string;
+}[];
+/**
+ * Hydrates sparse npm package metadata from the installed package.json in deep mode.
+ * Existing metadata on the Arborist node wins over on-disk values.
+ *
+ * @param {object} node Arborist node
+ * @param {object} [options={}] CLI options
+ * @returns {{ nodePackage: object, diskPkg: object | undefined, packageJsonPath: string | undefined }} Hydrated package metadata and the source package.json context
+ */
+export declare function hydrateNpmNodePackage(node: object, options?: object): {
+    nodePackage: object;
+    diskPkg: object | undefined;
+    packageJsonPath: string | undefined;
+};
+/**
+ * Helper to check if a package is imported only for TypeScript types.
+ */
+export declare function isPkgTypeOnlyImport(allImports: any, group: any, name: any): boolean;
+/**
+ * Normalize a pnpm lockfile package key by stripping the leading "/@"
+ * separator and any parenthetical peer-dependency suffix.
+ *
+ * @param {string} lockKey Raw package key from a pnpm lockfile.
+ * @returns {string} The normalized key.
+ */
+export declare function normalizePnpmLockKey(lockKey: string): string;
+/**
+ * Normalize an npm registry URL by trimming surrounding whitespace and any
+ * trailing slash. Returns undefined for empty or templated (`${...}`) URLs.
+ *
+ * @param {string} registryUrl Raw registry URL.
+ * @returns {string|undefined} The normalized registry URL, or undefined when
+ *   the URL is empty or templated.
+ */
+export declare function normalizeNpmRegistryUrl(registryUrl: string): string | undefined;
+/**
+ * Load and merge npm/pnpm configuration from the project root with env-derived values.
+ *
+ * Reads `.npmrc` and `.pnpmrc` (when present) under `projectRoot`, layering them
+ * on top of the environment-derived config returned by `parseNpmrcFromEnv`.
+ *
+ * @param {string} projectRoot Project root directory to search for rc files.
+ * @returns {Object<string, string>} Merged npmrc configuration object.
+ */
+export declare function loadNpmrcConfig(projectRoot: string): Record<string, string>;
+/**
+ * Strip a leading "@" from an npm scope group name.
+ *
+ * @param {string} group Raw scope group (e.g. "@scope").
+ * @returns {string} The scope without the leading "@", or an empty string.
+ */
+export declare function normalizeNpmScopeGroup(group: string): string;
+/**
+ * Resolve the npm registry URL for a git-installed package.
+ *
+ * Prefers the scope-specific registry (`@scope:registry`) from the npmrc config,
+ * falling back to the global `registry` value.
+ *
+ * @param {string} group npm scope group (with or without leading "@").
+ * @param {Object<string, string>} [npmrcConfig={}] Merged npmrc configuration.
+ * @returns {string|undefined} The resolved registry URL, or undefined.
+ */
+export declare function resolveNpmRegistryUrlForGitPackage(group: string, npmrcConfig?: Record<string, string>): string | undefined;
+/**
+ * Build purl qualifiers (vcs_url, repository_url) for a git-sourced npm package.
+ *
+ * @param {string} vcsUrl Version-control URL (e.g. "repo#commit").
+ * @param {string} group npm scope group.
+ * @param {Object<string, string>} npmrcConfig Merged npmrc configuration.
+ * @returns {Object<string, string>|null} Qualifier map, or null when none apply.
+ */
+export declare function buildNpmGitPurlQualifiers(vcsUrl: string, group: string, npmrcConfig: Record<string, string>): Record<string, string> | null;
+/**
+ * Construct the registry tarball download URL for an npm package.
+ *
+ * @param {string} registryUrl Normalized registry base URL.
+ * @param {string} group npm scope group.
+ * @param {string} name Package name.
+ * @param {string} version Package version.
+ * @returns {string|undefined} The tarball URL, or undefined when required inputs are missing.
+ */
+export declare function buildNpmRegistryTarballUrl(registryUrl: string, group: string, name: string, version: string): string | undefined;
+/**
+ * Build distribution-intake external references for a git npm package's tarball.
+ *
+ * Resolves the registry URL for the package scope and constructs the tarball
+ * download URL, returning a single-element external-reference list.
+ *
+ * @param {string} group npm scope group.
+ * @param {string} name Package name.
+ * @param {string} version Package version.
+ * @param {Object<string, string>} npmrcConfig Merged npmrc configuration.
+ * @returns {Array<{type: string, url: string}>|undefined} Distribution-intake
+ *   references, or undefined when the registry URL cannot be resolved.
+ */
+export declare function buildNpmGitDistributionIntakeRefs(group: string, name: string, version: string, npmrcConfig: Record<string, string>): Array<{
+    type: string;
+    url: string;
+}> | undefined;
+/**
+ * Parse a pnpm lockfile key into group/name/git-spec for git-resolved packages.
+ *
+ * @param {string} lockKey Raw package key from a pnpm lockfile.
+ * @returns {{group: string, name: string, gitSpec: string, fullName: string, packageName: string}|null}
+ *   Parsed coordinates, or null when the key is not a git reference.
+ */
+export declare function parsePnpmGitLockKey(lockKey: string): {
+    group: string;
+    name: string;
+    gitSpec: string;
+    fullName: string;
+    packageName: string;
+} | null;
+/**
+ * Build external-reference/intake objects for git-resolved pnpm packages.
+ *
+ * Scans the lockfile `packages` and `snapshots` maps for git resolutions,
+ * deriving purl, vcs_url, and distribution-intake references for each. Entries
+ * are indexed under every alias of their lock key for fast lookup.
+ *
+ * @param {Object<string, object>} packages Lockfile `packages` map.
+ * @param {Object<string, object>} snapshots Lockfile `snapshots` map.
+ * @param {Object<string, string>} [npmrcConfig={}] Merged npmrc configuration.
+ * @returns {Object<string, object>} Map of lookup key to git package reference.
+ */
+export declare function buildPnpmGitPkgRefs(packages: Record<string, object>, snapshots: Record<string, object>, npmrcConfig?: Record<string, string>): Record<string, object>;
+//# sourceMappingURL=npmutils.d.ts.map

package/types/lib/ecosystems/npmutils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npmutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/npmutils.js"],"names":[],"mappings":"AA4CA;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAHlC,MAGkC,GAFhC,IAAI,CAgBhB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,MAG+B,GAF7B,IAAI,CAIhB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAH3B,MAG2B,GAFzB,IAAI,CAIhB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAJvC,MAIuC,EAAE,OAAO,EAHhD,MAGgD,GAF9C,MAAM,CA2BlB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,iBAAiB,EAJ/C,MAAM,EAAE,GAAG,SAIoC,EAAE,WAAW,EAH5D,MAG4D,GAF1D,MAAM,GAAG,SAAS,CAe9B;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAHnC,MAAM,GAAG,SAAS,GAAG,IAGc,GAFjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA0CvD;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAHnC,MAGmC,GAFjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,CAqB7C;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,AAHhD,CACA,EADQ,MAG6C,GAF3C;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAmCrG;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,KAAA,EAAE,KAAK,KAAA,EAAE,IAAI,KAAA,WAoC1D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAHjC,MAGiC,GAF/B,MAAM,CAQlB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAJxC,MAIwC,GAHtC,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAHhC,MAGgC,0BAa1C;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAHjC,MAGiC,GAF/B,MAAM,CAOlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAJ7C,MAI6C,EAAE,WAAW,AAHlE,CACA,wBAEuE,GAF7D,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EALrC,MAKqC,EAAE,KAAK,EAJ5C,MAI4C,EAAE,WAAW,wBAAA,GAFvD,yBAAuB,IAAI,CAYvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAN3C,MAM2C,EAAE,KAAK,EALlD,MAKkD,EAAE,IAAI,EAJxD,MAIwD,EAAE,OAAO,EAHjE,MAGiE,GAF/D,MAAM,GAAC,SAAS,CAY5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EARI,MAQJ,EACL,IAAI,EARK,MAQL,EACJ,OAAO,EARE,MAQF,EACP,WAAW,wBAAA,GAPA,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,GAAC,SAAS,CA8BxD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAJhC,MAIgC,GAH9B;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAC,GAAC,IAAI,CAsBtG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,wBAAA,EAAE,SAAS,wBAAA,EAAE,WAAW,AAHjE,CACA,wBAEsE,0BAgExE"}

package/types/lib/ecosystems/parsers-bazel.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Parse a `MODULE.bazel` manifest and return its BCR modules and ecosystem
+ * dependencies. The MODULE.bazel file is Starlark; this extractor finds calls
+ * by name and reads their keyword/string arguments using a balanced-paren scan
+ * rather than a regex, because MODULE.bazel calls can nest.
+ *
+ * @param {string} moduleFile Path to `MODULE.bazel`
+ * @returns {{ pkgList: object[], parentComponent: object, rootInputs: string[] }}
+ */
+export declare function parseModuleBazel(moduleFile: string): {
+    pkgList: object[];
+    parentComponent: object;
+    rootInputs: string[];
+};
+/**
+ * Parse a `MODULE.bazel.lock` for resolved dependencies and the module graph.
+ *
+ * @param {string} lockFile Path to `MODULE.bazel.lock`
+ * @returns {{ pkgList: object[], dependencies: object[] }}
+ */
+export declare function parseModuleBazelLock(lockFile: string): {
+    pkgList: object[];
+    dependencies: object[];
+};
+/**
+ * Find every top-level call to `name(...)` in Starlark source and return the
+ * parsed keyword/string arguments of each. Scanning uses a balanced-paren
+ * counter rather than a regex, because MODULE.bazel calls can nest other calls
+ * inside their argument lists.
+ *
+ * @param {string} src Starlark source
+ * @param {string} name Function name to match (dotted names supported)
+ * @returns {Array<Map<string, string|string[]>>} one argument map per call
+ */
+export declare function findAllCalls(src: string, name: string): Array<Map<string, string | string[]>>;
+//# sourceMappingURL=parsers-bazel.d.ts.map

package/types/lib/ecosystems/parsers-bazel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers-bazel.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-bazel.js"],"names":[],"mappings":"AAgDA;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAHhC,MAGgC,GAF9B;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAiDhF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAHlC,MAGkC,GAFhC;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CAiDzD;AA4aD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAJrB,MAIqB,EAAE,IAAI,EAH3B,MAG2B,GAFzB,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,GAAC,MAAM,EAAE,CAAC,CAAC,CA2B/C"}

package/types/lib/ecosystems/parsers-dotnet.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Method to parse .nupkg files
+ *
+ * @param {String} nupkgFile .nupkg file
+ * @returns {Object} Object containing package list and dependencies
+ */
+export declare function parseNupkg(nupkgFile: string): Object;
+/**
+ * Method to parse .nuspec files
+ *
+ * @param {String} nupkgFile .nupkg file
+ * @param {String} nuspecData Raw nuspec data
+ * @returns {Object} Object containing package list and dependencies
+ */
+export declare function parseNuspecData(nupkgFile: string, nuspecData: string): Object;
+/**
+ * Parse a C# packages.config XML file and return a list of NuGet package components.
+ *
+ * @param {string} pkgData Raw XML string of a packages.config file
+ * @param {string} pkgFile Path to the packages.config file, used for evidence properties
+ * @param {Object} pkgNameVersions Package name - version map of versions already resolved
+ *        from more precise manifests (project.assets.json / packages.lock.json), used to
+ *        backfill templated or missing versions
+ * @returns {Object[]} Array of NuGet package objects with purl, name, and version
+ */
+export declare function parseCsPkgData(pkgData: string, pkgFile: string, pkgNameVersions?: Object): Object[];
+/**
+ * Parse a Directory.Packages.props file and return the package versions it declares
+ * centrally via NuGet Central Package Management.
+ *
+ * @param {String} propsFile Path to a Directory.Packages.props file
+ *
+ * @returns {Object} Map of lowercased package id to version. NuGet package ids are
+ *          case-insensitive, so callers must lowercase before looking up.
+ */
+export declare function parseDirectoryPackagesProps(propsFile: string): Object;
+/**
+ * Method to collect the versions declared by NuGet Central Package Management for a
+ * given project file, by walking up to the nearest Directory.Packages.props.
+ *
+ * MSBuild imports the first Directory.Packages.props found while walking up from the
+ * project directory, and that file is often at the repository root - above the
+ * directory cdxgen was invoked with. The walk therefore deliberately continues past
+ * the scan root rather than stopping at it.
+ *
+ * @param {String} projFile Path to a .csproj like project file
+ * @param {Object} cache Optional per-scan cache keyed by props file path, so that a
+ *        repository with many projects parses each props file once
+ *
+ * @returns {Object} Map of lowercased package id to version. Empty when the project
+ *          does not use central package management.
+ */
+export declare function getCentralPackageVersions(projFile: string, cache?: Object): Object;
+/**
+ * Method to find all text nodes in PropertyGroup elements in .props files.
+ *
+ * @param {String} propsFiles .props files in this project
+ *
+ * @returns {Object} Containing text nodes from PropertyGroup elements and their values
+ */
+export declare function getPropertyGroupTextNodes(propsFiles: string): Object;
+/**
+ * Method to parse .csproj like xml files
+ *
+ * @param {String} csProjData Raw data
+ * @param {String} projFile File name
+ * @param {Object} pkgNameVersions Package name - version map object
+ * @param {Boolean} msbuildInstalled Whether msbuild is available to resolve properties
+ * @param {Object} pkgVersionLabelCandidates Candidate values for msbuild version properties
+ * @param {Object} centralVersions Versions declared centrally in Directory.Packages.props,
+ *        keyed by lowercased package id. See {@link getCentralPackageVersions}.
+ *
+ * @returns {Object} Containing parent component, package, and dependencies
+ */
+export declare function parseCsProjData(csProjData: string, projFile: string, pkgNameVersions?: Object, msbuildInstalled?: boolean, pkgVersionLabelCandidates?: Object, centralVersions?: Object): Object;
+/**
+ * Parse a .NET project.assets.json file and return the package list and dependency tree.
+ *
+ * Extracts NuGet packages and their transitive dependency relationships from the
+ * `libraries` and `targets` sections of a project.assets.json file produced by
+ * the .NET restore process.
+ *
+ * @param {string} csProjData Raw JSON string of the project.assets.json file
+ * @param {string} assetsJsonFile Path to the project.assets.json file, used for evidence properties
+ * @returns {{ pkgList: Object[], dependenciesList: Object[] }}
+ */
+export declare function parseCsProjAssetsData(csProjData: string, assetsJsonFile: string): {
+    pkgList: Object[];
+    dependenciesList: Object[];
+};
+/**
+ * Parse a .NET packages.lock.json file and return the package list, dependency tree,
+ * and list of direct/root dependencies.
+ *
+ * @param {string} csLockData Raw JSON string of the packages.lock.json file
+ * @param {string} pkgLockFile Path to the packages.lock.json file, used for evidence properties
+ * @returns {{ pkgList: Object[], dependenciesList: Object[], rootList: Object[] }}
+ */
+export declare function parseCsPkgLockData(csLockData: string, pkgLockFile: string): {
+    pkgList: Object[];
+    dependenciesList: Object[];
+    rootList: Object[];
+};
+/**
+ * Parse a Paket dependency manager lock file (paket.lock) and return the package list
+ * and dependency tree.
+ *
+ * @param {string} paketLockData Raw text contents of the paket.lock file
+ * @param {string} pkgLockFile Path to the paket.lock file, used for evidence properties
+ * @returns {{ pkgList: Object[], dependenciesList: Object[] }}
+ */
+export declare function parsePaketLockData(paketLockData: string, pkgLockFile: string): {
+    pkgList: Object[];
+    dependenciesList: Object[];
+};
+//# sourceMappingURL=parsers-dotnet.d.ts.map

package/types/lib/ecosystems/parsers-dotnet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers-dotnet.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-dotnet.js"],"names":[],"mappings":"AAeA;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,SAAS,QAAA,GAF7B,MAAM,CAWlB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,SAAS,QAAA,EAAE,UAAU,QAAA,GAFxC,MAAM,CA4JlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAP3B,MAO2B,EAAE,OAAO,EANpC,MAMoC,EAAE,eAAe,GALrD,MAK0D,GAFxD,MAAM,EAAE,CAsFpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,QAAA,GAHxC,MAAM,CA+ClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,QAAA,EAAE,KAAK,GAN9C,MAMmD,GAHjD,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,QAAA,GAFvC,MAAM,CA2ClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,UAAU,QAAA,EACV,QAAQ,QAAA,EACR,eAAe,GAXN,MAWW,EACpB,gBAAgB,UAAQ,EACxB,yBAAyB,GAXhB,MAWqB,EAC9B,eAAe,GAXN,MAWW,GART,MAAM,CA4dlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAJrC,MAIqC,EAAE,cAAc,EAHrD,MAGqD,GAFnD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAE,CAuP7D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAJlC,MAIkC,EAAE,WAAW,EAH/C,MAG+C,GAF7C;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAkHjF;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAJrC,MAIqC,EAAE,WAAW,EAHlD,MAGkD,GAFhD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAE,CAyH7D"}

package/types/lib/ecosystems/parsers-gleam.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Gleam package parser.
+ *
+ * Gleam resolves dependencies through Hex, so packages are identified with the
+ * registered `hex` purl type (`pkg:hex/<name>@<version>`). No new purl type is
+ * introduced: a Gleam package on Hex is a Hex package, with a flat name and no
+ * namespace, exactly as the registered `hex` rules allow.
+ *
+ * Two files are consulted:
+ *   - `gleam.toml` — the manifest (project name, version, target, and the
+ *     version ranges the project declares for its dependencies).
+ *   - `manifest.toml` — the lock file written by the Gleam build tool, which
+ *     pins every resolved package version and records which packages each one
+ *     requires. The lock is the source of truth for versions and for the
+ *     direct/transitive distinction.
+ *
+ * When `manifest.toml` is absent (the project has not been resolved), the
+ * manifest alone is used and versions are left unspecified.
+ */
+/**
+ * Parse a Gleam project from its `gleam.toml` manifest and optional
+ * `manifest.toml` lock.
+ *
+ * @param {string} gleamTomlFile Path to `gleam.toml`
+ * @param {string} [manifestTomlFile] Path to `manifest.toml`, if present
+ * @returns {{ pkgList: object[], dependencies: object[], parentComponent: object }}
+ */
+export declare function parseGleamProject(gleamTomlFile: string, manifestTomlFile?: string): {
+    pkgList: object[];
+    dependencies: object[];
+    parentComponent: object;
+};
+//# sourceMappingURL=parsers-gleam.d.ts.map

package/types/lib/ecosystems/parsers-gleam.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers-gleam.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-gleam.js"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAJpC,MAIoC,EAAE,gBAAgB,AAH9D,CACA,EADQ,MAGsD,GAFpD;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAiGlF"}