@cdxgen/cdxgen 0.0.1 → 13.0.0

package/types/lib/inventory/analyzerScope.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Flatten a scalar or nested-array value into a single-level array of
+ * individual resolved values.
+ *
+ * @param {*} value Scalar, array, or nested array of values.
+ * @returns {Array} Flat array of individual values (empty for undefined).
+ */
+export declare const toResolvedValueArray: (value: any) => any[];
+/**
+ * Build a stable dedup key string for a resolved value, prefixing the type so
+ * that distinct types never collide.
+ *
+ * @param {*} value Resolved value to key.
+ * @returns {string} Stable dedup key (e.g. "string:abc", "object:{...}").
+ */
+export declare const resolvedValueKey: (value: any) => string;
+/**
+ * Merge one or more scalar/array resolved values into a single deduplicated
+ * value, returning a scalar when only one unique value remains.
+ *
+ * @param {...*} values Resolved values to merge.
+ * @returns {*} Merged scalar, deduplicated array, or undefined when empty.
+ */
+export declare const mergeResolvedValues: (...values: any[]) => any;
+/**
+ * Filter the resolved values within a scalar/array by a predicate and re-merge
+ * the surviving values.
+ *
+ * @param {*} value Scalar or array of resolved values.
+ * @param {(candidate: *) => boolean} predicate Predicate function to retain values.
+ * @returns {*} Re-merged filtered result.
+ */
+export declare const filterResolvedValues: (value: any, predicate: (candidate: any) => boolean) => any;
+/**
+ * Determine whether every resolved value within a scalar/array satisfies the
+ * given predicate.
+ *
+ * @param {*} value Scalar or array of resolved values.
+ * @param {(candidate: *) => boolean} predicate Predicate function to test.
+ * @returns {boolean} True when there is at least one value and all satisfy the predicate.
+ */
+export declare const hasOnlyResolvedValues: (value: any, predicate: (candidate: any) => boolean) => boolean;
+/**
+ * Read a named property from a statically-resolved object or array value,
+ * mapping across array elements when the value is an array.
+ *
+ * @param {object|Array} objectValue Resolved object or array value.
+ * @param {string} propertyName Property name to read.
+ * @returns {*} The property value, a merged array of results, or undefined.
+ */
+export declare const getStaticObjectProperty: (objectValue: object | any[], propertyName: string) => any;
+/**
+ * Derive narrowed identifier-to-value bindings from a conditional AST node,
+ * given whether the branch was taken.
+ *
+ * Handles parenthesized/type-cast wrappers, logical (&&, ||) and unary (!)
+ * expressions, and equality (==, ===, !=, !==) comparisons between an
+ * identifier and a literal.
+ *
+ * @param {object} astNode The conditional AST node to analyze.
+ * @param {boolean} branchTaken Whether the consequent (true) or alternate (false) branch applies.
+ * @param {(node: object) => (string|undefined)} getLiteralStringValue Function to extract a literal string from an AST node.
+ * @returns {Map<string, *>|undefined} Map of identifier name to narrowed value, or undefined.
+ */
+export declare const deriveStaticNarrowingsFromCondition: (astNode: object, branchTaken: boolean, getLiteralStringValue: (node: object) => (string | undefined)) => Map<string, any> | undefined;
+/**
+ * Best-effort static resolution of an AST node to a concrete value.
+ *
+ * Resolves literals, identifiers (via the provided name→value map),
+ * conditional and logical expressions, member expressions, array and object
+ * expressions, template literals, and binary concatenation. Recursion is
+ * bounded by a depth limit to avoid unbounded analysis.
+ *
+ * @param {object} astNode The AST node to resolve.
+ * @param {Map<string, *>} staticValueByName Map of identifier name to known static value.
+ * @param {(node: object) => (string|undefined)} getLiteralStringValue Function to extract a literal string from an AST node.
+ * @param {(node: object) => (string|undefined)} getMemberExpressionPropertyName Function to extract the property name from a member-expression node.
+ * @param {number} [depth=0] Current recursion depth (capped internally).
+ * @returns {*} The resolved value, or undefined when it cannot be determined.
+ */
+export declare const resolveStaticValue: (astNode: object, staticValueByName: Map<string, any>, getLiteralStringValue: (node: object) => (string | undefined), getMemberExpressionPropertyName: (node: object) => (string | undefined), depth?: number) => any;
+/**
+ * Derive narrowed identifier-to-value bindings from a switch-case node by
+ * inspecting the switch discriminant and fall-through case chain.
+ *
+ * @param {object} switchCaseNode The `SwitchCase` AST node currently in scope.
+ * @param {object} switchStatementNode The enclosing `SwitchStatement` AST node.
+ * @param {Map<string, *>} staticValueByName Map of identifier name to known static value.
+ * @param {(node: object) => (string|undefined)} getLiteralStringValue Function to extract a literal string from an AST node.
+ * @param {(node: object) => (string|undefined)} getMemberExpressionPropertyName Function to extract the property name from a member-expression node.
+ * @returns {Map<string, *>|undefined} Map of discriminant identifier name to narrowed value, or undefined.
+ */
+export declare const deriveStaticNarrowingsFromSwitchCase: (switchCaseNode: object, switchStatementNode: object, staticValueByName: Map<string, any>, getLiteralStringValue: (node: object) => (string | undefined), getMemberExpressionPropertyName: (node: object) => (string | undefined)) => Map<string, any> | undefined;
+/**
+ * Build a name-to-value map for a Babel path by starting from the provided
+ * static values and applying narrowing derived from ancestor if-statements
+ * and switch-cases.
+ *
+ * @param {object} path Babel traversal path whose ancestors are inspected.
+ * @param {Map<string, *>} staticValueByName Initial map of identifier name to known static value.
+ * @param {(node: object) => (string|undefined)} getLiteralStringValue Function to extract a literal string from an AST node.
+ * @param {(node: object) => (string|undefined)} getMemberExpressionPropertyName Function to extract the property name from a member-expression node.
+ * @returns {Map<string, *>} Scoped name-to-value map including ancestor narrowings.
+ */
+export declare const getScopedStaticValueByName: (path: object, staticValueByName: Map<string, any>, getLiteralStringValue: (node: object) => (string | undefined), getMemberExpressionPropertyName: (node: object) => (string | undefined)) => Map<string, any>;
+//# sourceMappingURL=analyzerScope.d.ts.map

package/types/lib/inventory/analyzerScope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzerScope.d.ts","sourceRoot":"","sources":["../../../lib/inventory/analyzerScope.js"],"names":[],"mappings":"AAmCA;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,UAHtB,GAAC,UAWX,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,UAHlB,GAAC,KACC,MAOZ,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,cAHlB,GAAC,EAAA,KACF,GAmBZ,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,UAJtB,GAAC,aACD,CAAC,SAAS,EAAE,GAAC,KAAK,OAAO,KACvB,GAMZ,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,UAJvB,GAAC,aACD,CAAC,SAAS,EAAE,GAAC,KAAK,OAAO,KACvB,OAKZ,CAAC;AAaF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,gBAJzB,MAAM,QAAM,gBACZ,MAAM,KACJ,GAcZ,CAAC;AAmEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mCAAmC,YALrC,MAAM,eACN,OAAO,yBACP,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,MAAM,GAAC,SAAS,CAAC,KAClC,GAAG,CAAC,MAAM,EAAE,GAAC,CAAC,GAAC,SAwF3B,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,kBAAkB,YAPpB,MAAM,qBACN,GAAG,CAAC,MAAM,EAAE,GAAC,CAAC,yBACd,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,MAAM,GAAC,SAAS,CAAC,mCACpC,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,MAAM,GAAC,SAAS,CAAC,UACpC,MAAM,KACJ,GAmPZ,CAAC;AAgEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oCAAoC,mBAPtC,MAAM,uBACN,MAAM,qBACN,GAAG,CAAC,MAAM,EAAE,GAAC,CAAC,yBACd,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,MAAM,GAAC,SAAS,CAAC,mCACpC,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,MAAM,GAAC,SAAS,CAAC,KAClC,GAAG,CAAC,MAAM,EAAE,GAAC,CAAC,GAAC,SAqF3B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0BAA0B,SAN5B,MAAM,qBACN,GAAG,CAAC,MAAM,EAAE,GAAC,CAAC,yBACd,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,MAAM,GAAC,SAAS,CAAC,mCACpC,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,MAAM,GAAC,SAAS,CAAC,KAClC,GAAG,CAAC,MAAM,EAAE,GAAC,CA+DzB,CAAC"}

package/types/lib/inventory/astWorker.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Worker entry for parallel AST analysis. Each task is `{ src, file }`;
+ * the result is `{ imports, exports }` produced by `parseFileASTTreeCollected`.
+ *
+ * Parse failures return `null` so the caller can skip the file, matching the
+ * `catch (_err)` behaviour of the serial loop.
+ */
+export {};
+//# sourceMappingURL=astWorker.d.ts.map

package/types/lib/inventory/astWorker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"astWorker.d.ts","sourceRoot":"","sources":["../../../lib/inventory/astWorker.js"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/types/lib/inventory/atomUtils.d.ts

@@ -0,0 +1,159 @@
+/**
+ * Platform-specific @appthreat/atom-* native package names that carry the
+ * bundled native `atom` binary.
+ */
+export declare const ATOM_NATIVE_PACKAGES: Set<string>;
+/**
+ * Convert cdxgen's glob-style exclude patterns to a Scala/Java regex string.
+ *
+ * @param {string[]} patterns Glob patterns from cdxgen's `--exclude` option
+ * @returns {string|undefined} Scala-compatible regex or undefined when empty
+ */
+export declare function globPatternsToAtomIgnoreRegex(patterns?: string[]): string | undefined;
+/**
+ * Determine whether a file path is excluded by the given atom-style glob
+ * exclude patterns.
+ *
+ * @param {string} filePath File path to test.
+ * @param {string[]} [patterns=[]] Glob exclude patterns.
+ * @returns {boolean} True when the path matches an exclude pattern.
+ */
+export declare function isPathExcludedByGlobPatterns(filePath: string, patterns?: string[]): boolean;
+/**
+ * Remove atom-slice entries whose source file matches the given glob exclude
+ * patterns, preserving the original slice structure otherwise.
+ *
+ * Filters `objectSlices`, `userDefinedTypes`, `reachables`, and reachable
+ * `paths`/`graph` nodes/edges that reference excluded files.
+ *
+ * @param {object|Array} sliceData Atom slice data object or array.
+ * @param {string[]} [patterns=[]] Glob exclude patterns.
+ * @returns {object|Array} Filtered slice data (shallow copy when an object).
+ */
+export declare function filterAtomSlicesByExcludePatterns(sliceData: object | any[], patterns?: string[]): object | any[];
+/**
+ * Build additional environment variables for Atom from cdxgen CLI options.
+ *
+ * @param {Object} options CLI options
+ * @param {string} language Atom language name
+ * @returns {Object} Environment variables to pass to Atom
+ */
+export declare function buildAtomCommandEnv(options?: Object, language?: string): Object;
+/**
+ * Resolve the atom platform sub-package name and provider kind for the current
+ * (or supplied) runtime. This is a cdxgen-side reimplementation of atom's own
+ * `resolveAtomProvider`, kept here rather than imported from
+ * `@appthreat/atom/resolve.js` so it is safe under every cdxgen runtime
+ * (node, bun, deno, caxa) and inside the extracted caxa tree where the
+ * dispatcher's own resolver may not find a sibling sub-package.
+ *
+ * The returned `preferredPkg`/`kind` pair must agree with atom's
+ * `resolveAtomProvider` and `NATIVE_PACKAGES`; the parity test in
+ * atomUtils.poku.js asserts the agreement for all eight published triples.
+ *
+ * @param {Object} [opts] Optional overrides for testability
+ * @param {string} [opts.platform] Defaults to `process.platform`
+ * @param {string} [opts.arch] Defaults to `process.arch`
+ * @param {string} [opts.libc] Defaults to detected libc on linux
+ * @returns {{preferredPkg: string, kind: "native"|"jar", platform: string, arch: string, libc?: string}}
+ */
+export declare function resolveAtomProvider(opts?: {
+    platform?: string;
+    arch?: string;
+    libc?: string;
+}): {
+    preferredPkg: string;
+    kind: "native" | "jar";
+    platform: string;
+    arch: string;
+    libc?: string;
+};
+/**
+ * Returns `"native"` or `"jar"` for the currently resolved atom provider.
+ * Used to gate Java/JDK advice so users on the five native platforms are not
+ * told to install a JDK for a failure that has nothing to do with Java.
+ */
+export declare function atomProviderKind(): "jar" | "native";
+/**
+ * Locate the `php-parse` binary that the PHP frontend needs.
+ *
+ * atom 3's dispatcher unconditionally sets `PHP_PARSER_BIN=<ATOM_HOME>/bin/php-parse`,
+ * which for a native sub-package does not exist and also clobbers a caller-set
+ * value. cdxgen therefore resolves the real location and forwards it through
+ * the child env (see `buildAtomCommandEnv`); `executeAtom` then spawns the
+ * native binary directly for PHP so the dispatcher cannot clobber it (see
+ * `resolveDirectAtomBinaryPath`). Resolution order:
+ *   1. explicit `PHP_PARSER_BIN` env var (operators / container images)
+ *   2. `@appthreat/atom-parsetools/plugins/bin/php-parse` under cdxgen's own
+ *      node_modules, then under `GLOBAL_NODE_MODULES_PATH` for global installs
+ *
+ * Returns `undefined` when neither is found, in which case PHP analysis runs
+ * through the dispatcher unchanged (and fails on native platforms until atom
+ * fixes the clobber).
+ *
+ * @returns {string|undefined}
+ */
+export declare function resolvePhpParseBin(): string | undefined;
+/**
+ * Resolve the atom native binary path directly, bypassing the dispatcher.
+ *
+ * This is required for the PHP frontend: the dispatcher clobbers
+ * `PHP_PARSER_BIN` with a path that does not exist on native platforms, and
+ * atom 3.0.x crashes in `defaultPhpParserBin` parsing that bogus value before
+ * any `--frontend-args php-parser-bin=` override is consulted. Spawning the
+ * native binary directly lets cdxgen control the child env, so the correct
+ * `PHP_PARSER_BIN` reaches atom. Returns `undefined` when the provider is the
+ * jar kind or the native binary cannot be located (in which case the dispatcher
+ * is used as-is).
+ *
+ * @returns {string|undefined}
+ */
+export declare function resolveDirectAtomBinaryPath(): string | undefined;
+/**
+ * Retrieves the atom command by referring to various environment variables
+ */
+export declare function getAtomCommand(): any;
+/**
+ * Compute the maximum heap atom may grow to, in bytes.
+ *
+ * Neither of atom's two runtimes bounds itself to anything a machine can
+ * comfortably back: a GraalVM native image defaults to
+ * `MaximumHeapSizePercent=80` of physical memory, and HotSpot to a quarter of
+ * it. Both use a collector that grows the heap in preference to collecting, so
+ * on a large host atom reserves tens of gigabytes and the machine, not atom,
+ * is what runs out of memory.
+ *
+ * The ceiling is therefore the smaller of half of physical memory and
+ * `ATOM_MAX_HEAP_CAP_BYTES`, with a floor so that a small container still gets
+ * a workable heap. `ATOM_MAX_HEAP` overrides the whole calculation and accepts
+ * a plain byte count or a `k`/`m`/`g` suffix.
+ *
+ * @returns {number|undefined} Heap ceiling in bytes, or `undefined` to leave the runtime default in place
+ */
+export declare function atomMaxHeapBytes(): number | undefined;
+/**
+ * Execute the atom tool against a source directory or file with the given arguments.
+ *
+ * Resolves the atom binary via `getAtomCommand`, sets up the required environment
+ * (including `JAVA_HOME` from `ATOM_JAVA_HOME` if set), and spawns the process.
+ * Logs diagnostic messages for common failure modes such as unsupported Java versions,
+ * missing `astgen`, and JVM crashes.
+ *
+ * @param {string} src Path to the source directory or file to analyse
+ * @param {string[]} args Arguments to pass to the atom command
+ * @param {Object} extra_env Additional environment variables to merge into the process environment
+ * @returns {boolean} `true` if atom executed successfully and the language is supported; `false` otherwise
+ */
+export declare function executeAtom(src: string, args: string[], extra_env?: Object): boolean;
+/**
+ * Find the imported modules in the application with atom parsedeps command
+ *
+ * @param {string} src
+ * @param {string} language
+ * @param {string} methodology
+ * @param {string} slicesFile
+ * @param {Object} options CLI options
+ * @returns List of imported modules
+ */
+export declare function findAppModules(src: string, language: string, methodology?: string, slicesFile?: string, options?: Object): any;
+//# sourceMappingURL=atomUtils.d.ts.map

package/types/lib/inventory/atomUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/atomUtils.js"],"names":[],"mappings":"AA6CA;;;GAGG;AACH,eAAO,MAAM,oBAAoB,aAM/B,CAAC;AA4RH;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,GAH3C,MAAM,EAG0C,GAF9C,MAAM,GAAC,SAAS,CAU5B;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAJ1C,MAI0C,EAAE,QAAQ,AAH5D,CACA,EADQ,MAAM,EAGmD,GAFvD,OAAO,CAkBnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAAC,SAAS,EAJhD,MAAM,QAI0C,EAAE,QAAQ,AAHlE,CACA,EADQ,MAAM,EAGyD,GAF7D,MAAM,QAAM,CA2DxB;AA4BD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAJhC,MAIqC,EAAE,QAAQ,GAH/C,MAGoD,GAFlD,MAAM,CAkDlB;AAgBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,AANrC,CAIA,EAHA;IAAsB,QAAQ,AAA9B,CACA,EADQ,MAAM,CACd;IAAsB,IAAI,AAA1B,CACA,EADQ,MAAM,CACd;IAAsB,IAAI,AAA1B,CACA,EADQ,MAAM,CACd;CAE0C,GAFhC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,GAAC,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,CA6CvG;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,qBAE/B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,IAFrB,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,IAF9B,MAAM,GAAC,SAAS,CAkD5B;AAsBD;;GAEG;AACH,wBAAgB,cAAc,QAwB7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,GAAC,SAAS,CA0B5B;AA0DD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,GAAG,EALpB,MAKoB,EAAE,IAAI,EAJ1B,MAAM,EAIoB,EAAE,SAAS,GAHrC,MAG0C,GAFxC,OAAO,CAqJnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EARM,MAQN,EACH,QAAQ,EARC,MAQD,EACR,WAAW,GARF,MAQa,EACtB,UAAU,GARD,MAQa,EACtB,OAAO,GARE,MAQG,OAsCb"}

package/types/lib/inventory/auditCategories.d.ts

@@ -0,0 +1,80 @@
+/** Frozen list of hardware-bill-of-materials (HBOM) audit categories. */
+export declare const HBOM_AUDIT_CATEGORIES: readonly string[];
+/** Frozen list of cryptographic-bill-of-materials (CBOM) audit categories. */
+export declare const CBOM_AUDIT_CATEGORIES: readonly string[];
+/** Frozen list of host-topology audit categories. */
+export declare const HOST_TOPOLOGY_AUDIT_CATEGORIES: readonly string[];
+/** Frozen list of Golem (Go Evinse) audit categories. */
+export declare const GOLEM_AUDIT_CATEGORIES: readonly string[];
+/** Frozen list of AI-bill-of-materials audit categories. */
+export declare const AI_BOM_AUDIT_CATEGORIES: readonly string[];
+/** Comma-separated default HBOM category string used when none is specified. */
+export declare const DEFAULT_HBOM_AUDIT_CATEGORIES: string;
+/**
+ * Frozen map of category alias names to their expanded concrete category lists.
+ * Used by `expandBomAuditCategories` to resolve shorthand aliases.
+ */
+export declare const BOM_AUDIT_CATEGORY_ALIASES: Readonly<{
+    "ai-inventory": string[];
+    aibom: string[];
+    "ai-bom": string[];
+    "ai-provenance": string[];
+    "ai-oversight": string[];
+    cbom: string[];
+    "crypto-bom": string[];
+    golem: string[];
+    hbom: string[];
+    host: string[];
+}>;
+/**
+ * Normalize a category string or array into a deduplicated array of trimmed,
+ * non-empty category names.
+ *
+ * @param {string|string[]} categories Comma-separated string or array of categories.
+ * @returns {string[]} Deduplicated, trimmed category names.
+ */
+export declare function normalizeBomAuditCategories(categories: string | string[]): string[];
+/**
+ * Expand category aliases into their concrete category lists, returning a
+ * deduplicated array of resolved categories.
+ *
+ * @param {string|string[]} categories Comma-separated string or array of categories or aliases.
+ * @returns {string[]} Deduplicated, fully expanded category names.
+ */
+export declare function expandBomAuditCategories(categories: string | string[]): string[];
+/**
+ * Collect the sorted set of unique categories present in the loaded audit rules.
+ *
+ * @param {Array<{category?: string}>} rules Loaded audit rule objects.
+ * @returns {string[]} Sorted unique category names found in the rules.
+ */
+export declare function availableBomAuditCategories(rules: Array<{
+    category?: string;
+}>): string[];
+/**
+ * Validate that every requested category is a known category or alias,
+ * throwing an Error listing the valid options otherwise.
+ *
+ * @param {string|string[]} categories Comma-separated string or array of categories to validate.
+ * @param {Array<{category?: string}>} rules Loaded audit rule objects to derive valid categories from.
+ * @returns {{categories: string[], expandedCategories: string[], validCategories: string[]}} Normalized, expanded, and valid category lists.
+ */
+export declare function validateBomAuditCategories(categories: string | string[], rules: Array<{
+    category?: string;
+}>): {
+    categories: string[];
+    expandedCategories: string[];
+    validCategories: string[];
+};
+/**
+ * Determine the default BOM audit categories for the current CLI invocation.
+ *
+ * OBOM-focused runs should default to the runtime-specific rule pack unless the
+ * user explicitly requests other categories.
+ *
+ * @param {object} options CLI options
+ * @param {string} [commandPath] Invoked command path or name
+ * @returns {string | undefined} Default category string, if any
+ */
+export declare function getDefaultBomAuditCategories(options: object, commandPath?: string): string | undefined;
+//# sourceMappingURL=auditCategories.d.ts.map

package/types/lib/inventory/auditCategories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditCategories.d.ts","sourceRoot":"","sources":["../../../lib/inventory/auditCategories.js"],"names":[],"mappings":"AAEA,yEAAyE;AACzE,eAAO,MAAM,qBAAqB,mBAIhC,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,mBAGhC,CAAC;AAEH,qDAAqD;AACrD,eAAO,MAAM,8BAA8B,mBAAmC,CAAC;AAE/E,yDAAyD;AACzD,eAAO,MAAM,sBAAsB,mBAIjC,CAAC;AAEH,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,mBAIlC,CAAC;AAEH,gFAAgF;AAChF,eAAO,MAAM,6BAA6B,QAAkC,CAAC;AAE7E;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;EAWrC,CAAC;AAMH;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAH3C,MAAM,GAAC,MAAM,EAG8B,GAFzC,MAAM,EAAE,CAiBpB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAHxC,MAAM,GAAC,MAAM,EAG2B,GAFtC,MAAM,EAAE,CAapB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAHtC,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,CAGa,GAFpC,MAAM,EAAE,CAMpB;AAUD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAJ1C,MAAM,GAAC,MAAM,EAI6B,EAAE,KAAK,EAHjD,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,CAGwB,GAF/C;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAC,CAyB3F;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAJzC,MAIyC,EAAE,WAAW,AAH9D,CACA,EADQ,MAGsD,GAFpD,MAAM,GAAG,SAAS,CA8B9B"}

package/types/lib/inventory/bomUtils.d.ts

@@ -0,0 +1,145 @@
+/**
+ * The default CycloneDX specification version used across cdxgen when a caller
+ * does not specify one (matches the `--spec-version` CLI default).
+ */
+export declare const DEFAULT_CDX_SPEC_VERSION = 1.7;
+/**
+ * Frozen map of CycloneDX spec versions (as "major.minor" strings) to the
+ * frozen list of component types supported by that version.
+ */
+export declare const CYCLONEDX_COMPONENT_TYPES_BY_SPEC_VERSION: Readonly<{
+    1.4: readonly string[];
+    1.5: readonly string[];
+    1.6: readonly string[];
+    1.7: readonly string[];
+    "2.0": readonly string[];
+}>;
+/**
+ * Determine whether the given BOM object is an SPDX JSON-LD document.
+ *
+ * @param {object} bomJson BOM JSON object to inspect.
+ * @returns {boolean} True when the object carries an SPDX `@context` and an `SpdxDocument` graph entry.
+ */
+export declare const isSpdxJsonLd: (bomJson: object) => boolean;
+/**
+ * Normalize a CycloneDX spec version to a numeric major.minor value.
+ *
+ * @param {string|number} specVersion Spec version string or number (e.g. "1.5", 1.6).
+ * @returns {number|undefined} Numeric major.minor version, or undefined when unparseable.
+ */
+export declare const normalizeCycloneDxSpecVersion: (specVersion: string | number) => number | undefined;
+/**
+ * Format a CycloneDX spec version as a "major.minor" string.
+ *
+ * @param {string|number} specVersion Spec version string or number.
+ * @returns {string|undefined} "major.minor" string, or undefined when unparseable.
+ */
+export declare const toCycloneDxSpecVersionString: (specVersion: string | number) => string | undefined;
+/**
+ * Determine whether a spec version is greater than or equal to a minimum version,
+ * comparing major then minor components.
+ *
+ * @param {string|number} specVersion The spec version to test.
+ * @param {string|number} minimumVersion The minimum required spec version.
+ * @returns {boolean} True when specVersion is at least minimumVersion.
+ */
+export declare const isCycloneDxSpecVersionAtLeast: (specVersion: string | number, minimumVersion: string | number) => boolean;
+/**
+ * Determine whether a spec version is CycloneDX 2.0 or later.
+ *
+ * @param {string|number} specVersion The spec version to test.
+ * @returns {boolean} True when the spec version is at least 2.0.
+ */
+export declare const isCycloneDx20SpecVersion: (specVersion: string | number) => boolean;
+/**
+ * Return the list of component types supported by a given CycloneDX spec
+ * version, falling back to the 1.7 list when the version is unrecognized.
+ *
+ * @param {string|number} [specVersion=1.7] CycloneDX spec version.
+ * @returns {string[]} Supported component type names for that version.
+ */
+export declare const getSupportedCycloneDxComponentTypes: (specVersion?: string | number) => string[];
+/**
+ * Normalize a component type filter (single value, array, or falsy) into a
+ * deduplicated array of trimmed, non-empty type strings.
+ *
+ * @param {string|string[]} componentType Component type or array of types.
+ * @returns {string[]} Deduplicated, trimmed component type strings.
+ */
+export declare const normalizeCycloneDxComponentTypeFilter: (componentType: string | string[]) => string[];
+/**
+ * Determine whether a component type is enabled given the configured type
+ * filter and spec version.
+ *
+ * @param {string} componentType The component type to test.
+ * @param {object} [options] Options carrying the filter and spec version.
+ * @param {string|string[]} [options.componentType] Explicit type filter from CLI options.
+ * @param {string|number} [options.specVersion] CycloneDX spec version for default support lookup.
+ * @returns {boolean} True when the component type passes the filter.
+ */
+export declare const isCycloneDxComponentTypeEnabled: (componentType: string, options?: {
+    componentType?: string | string[];
+    specVersion?: string | number;
+}) => boolean;
+/**
+ * Return the appropriate CycloneDX root format key ("bomFormat" or
+ * "specFormat") for the given spec version or BOM object.
+ *
+ * @param {string|number|object} specVersionOrBom Spec version, or a BOM object whose `specVersion` is read.
+ * @returns {string} The root format key name to use.
+ */
+export declare const getCycloneDxRootFormatKey: (specVersionOrBom: string | number | object) => string;
+/**
+ * Return the BOM format identifier string from a BOM object.
+ *
+ * @param {object} bomJson BOM JSON object.
+ * @returns {string|undefined} The `specFormat` or `bomFormat` value.
+ */
+export declare const getCycloneDxFormat: (bomJson: object) => string | undefined;
+/**
+ * Determine whether a BOM object carries the CycloneDX format identifier.
+ *
+ * @param {object} bomJson BOM JSON object.
+ * @returns {boolean} True when the format identifier equals "CycloneDX".
+ */
+export declare const hasCycloneDxFormat: (bomJson: object) => boolean;
+/**
+ * Determine whether an object is a valid CycloneDX BOM by checking both the
+ * format identifier and a parseable spec version.
+ *
+ * @param {object} bomJson BOM JSON object.
+ * @returns {boolean} True when the object is a valid CycloneDX BOM.
+ */
+export declare const isCycloneDxBom: (bomJson: object) => boolean;
+/**
+ * Mutates a CycloneDX BOM object so the appropriate root format key is present
+ * for the requested spec version, while preserving conventional serialized
+ * root-key ordering (`bomFormat`/`specFormat` and `specVersion` first). Only the currently
+ * supported CycloneDX major.minor version shape is accepted; multi-component
+ * future versions such as `2.0.1` intentionally return `undefined` from the
+ * normalizer rather than being silently truncated.
+ *
+ * @param {object} bomJson BOM JSON object to mutate.
+ * @param {string|number} specVersion Desired CycloneDX spec version.
+ * @param {object} options Root-key compatibility options.
+ * @returns {object} The same `bomJson` object, after in-place mutation.
+ */
+export declare const setCycloneDxFormat: (bomJson: object, specVersion: string | number, { preserveLegacyBomFormat }?: object) => object;
+/**
+ * Detect the format of a BOM object, distinguishing CycloneDX, SPDX JSON-LD,
+ * and unknown formats.
+ *
+ * @param {object} bomJson BOM JSON object.
+ * @returns {string} "cyclonedx", "spdx", or "unknown".
+ */
+export declare const detectBomFormat: (bomJson: object) => string;
+/**
+ * Build a user-facing error message explaining that the supplied BOM is not a
+ * CycloneDX document, tailored to the detected format.
+ *
+ * @param {object} bomJson BOM JSON object that was rejected.
+ * @param {string} [commandName="This command"] Name of the command requiring CycloneDX input.
+ * @returns {string} Human-readable error message.
+ */
+export declare const getNonCycloneDxErrorMessage: (bomJson: object, commandName?: string) => string;
+//# sourceMappingURL=bomUtils.d.ts.map

package/types/lib/inventory/bomUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bomUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/bomUtils.js"],"names":[],"mappings":"AAGA;;;GAGG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAuC5C;;;GAGG;AACH,eAAO,MAAM,yCAAyC;;;;;;EAMpD,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,YAAY,YAHd,MAAM,KACJ,OAOV,CAAC;AAgBJ;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,gBAH/B,MAAM,GAAC,MAAM,KACX,MAAM,GAAC,SAQnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,gBAH9B,MAAM,GAAC,MAAM,KACX,MAAM,GAAC,SAWnB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,gBAJ/B,MAAM,GAAC,MAAM,kBACb,MAAM,GAAC,MAAM,KACX,OAYZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,gBAH1B,MAAM,GAAC,MAAM,KACX,OAGkC,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,iBAHrC,MAAM,GAAC,MAAM,KACX,MAAM,EAQlB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qCAAqC,kBAHvC,MAAM,GAAC,MAAM,EAAE,KACb,MAAM,EAYlB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,kBANjC,MAAM,YAEd;IAAkC,aAAa,AAA/C,CACA,EADQ,MAAM,GAAC,MAAM,EAAE,CACvB;IAAgC,WAAW,AAA3C,CACA,EADQ,MAAM,GAAC,MAAM,CACrB;CAAA,KAAU,OAkBZ,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,qBAH3B,MAAM,GAAC,MAAM,GAAC,MAAM,KAClB,MAUZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,YAHpB,MAAM,KACJ,MAAM,GAAC,SAGuB,CAAC;AAE5C;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,YAHpB,MAAM,KACJ,OAGqC,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,YAHhB,MAAM,KACJ,OAIsD,CAAC;AAoCpE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,YALpB,MAAM,eACN,MAAM,GAAC,MAAM,gCACb,MAAM,KACJ,MAkCZ,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,YAHjB,MAAM,KACJ,MAUZ,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,YAJ7B,MAAM,gBACN,MAAM,KACJ,MAWZ,CAAC"}

package/types/lib/inventory/cacheCommands.d.ts

@@ -0,0 +1,28 @@
+/**
+ * `cdxgen cache` subcommand — inspect and purge the metadata fetch cache.
+ *
+ * This module operates directly on the filesystem because JS is the authority
+ * for the cache directory. The cache layout is:
+ *   <cacheDir>/cdxrs-fetch/<host>/<hash>.json
+ */
+/**
+ * Gather statistics about the fetch cache.
+ *
+ * @returns {Object} Cache info: directory, entryCount, totalBytes,
+ *   perHost breakdown, oldestMtime, newestMtime.
+ */
+export declare function cacheInfo(): Object;
+/**
+ * Remove all entries from the fetch cache.
+ *
+ * @returns {Object} Result with removedCount, freedBytes, directory.
+ */
+export declare function cacheClear(): Object;
+/**
+ * Run the cache subcommand and print results.
+ *
+ * @param {"info"|"clear"} action What to do.
+ * @returns {Promise<number>} Exit code.
+ */
+export declare function runCacheCommand(action: "info" | "clear"): Promise<number>;
+//# sourceMappingURL=cacheCommands.d.ts.map

package/types/lib/inventory/cacheCommands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cacheCommands.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cacheCommands.js"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAgCH;;;;;GAKG;AACH,wBAAgB,SAAS,IAHZ,MAAM,CAwDlB;AAED;;;;GAIG;AACH,wBAAgB,UAAU,IAFb,MAAM,CAwBlB;AAUD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAHjC,MAAM,GAAC,OAG0B,GAF/B,OAAO,CAAC,MAAM,CAAC,CAyC3B"}

package/types/lib/inventory/cacheDir.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Cache directory resolution for the cdxrs fetch metadata cache.
+ *
+ * JS is the single source of truth for the path. `fetchBatch.js` passes
+ * `--cache-dir <path>` to every `cdxrs fetch` invocation; Rust keeps its own
+ * resolution only as the fallback for standalone CLI use. Both sides follow
+ * the same rules so they agree — verified by a parity test.
+ *
+ * Resolution order:
+ * 1. `CDXGEN_CACHE_DIR` if set and non-empty (documented escape hatch).
+ * 2. Platform cache directory with a `cdxgen` component.
+ * 3. `null` — cache disabled. A cache that cannot find a home must not fall
+ *    back to the current working directory or a temp dir.
+ */
+/**
+ * Resolve the cache directory from explicit inputs, with no reference to the
+ * ambient environment or the host platform.
+ *
+ * Mirrors `HttpCache::resolve_cache_for` in cdxrs. Taking the platform as an
+ * argument is what lets every branch be tested on every host; keep it that way
+ * rather than reading `isWin`/`isMac` here, or the Windows and Linux branches
+ * become untestable on a macOS developer machine.
+ *
+ * @param {Object} inputs Resolution inputs.
+ * @param {"linux"|"macos"|"windows"} inputs.platform Which convention to apply.
+ * @param {string} [inputs.cdxgenCacheDir] `CDXGEN_CACHE_DIR`.
+ * @param {string} [inputs.xdgCacheHome] `XDG_CACHE_HOME`. Ignored unless
+ *   absolute, per the XDG spec, so it cannot point inside the working directory.
+ * @param {string} [inputs.home] Home directory.
+ * @param {string} [inputs.localAppData] `LOCALAPPDATA`.
+ * @returns {string|null} Absolute path, or null when nothing resolves.
+ */
+export declare function resolveCacheDirFor({ platform, cdxgenCacheDir, xdgCacheHome, home, localAppData, }: {
+    platform: "linux" | "macos" | "windows";
+    cdxgenCacheDir?: string;
+    xdgCacheHome?: string;
+    home?: string;
+    localAppData?: string;
+}): string | null;
+/**
+ * Resolve the metadata cache directory from the environment.
+ *
+ * @returns {string|null} Absolute path, or null when no home directory can be
+ *   determined and `CDXGEN_CACHE_DIR` is unset.
+ */
+export declare function resolveCacheDir(): string | null;
+/**
+ * The fetch subdirectory inside the cache root. All cdxrs fetch entries live
+ * under `<cacheDir>/cdxrs-fetch/<host>/<hash>.json`.
+ *
+ * @param {string} cacheDir Resolved cache directory.
+ * @returns {string} Path to the fetch subdirectory.
+ */
+export declare function fetchCacheDir(cacheDir: string): string;
+//# sourceMappingURL=cacheDir.d.ts.map

package/types/lib/inventory/cacheDir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cacheDir.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cacheDir.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAQH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,QAAQ,EACR,cAAc,EACd,YAAY,EACZ,IAAI,EACJ,YAAY,GACb,EAdE;IAA0C,QAAQ,EAA1C,OAAO,GAAC,OAAO,GAAC,SAAS,CACjC;IAAwB,cAAc,AAAtC,CACA,EADQ,MAAM,CACd;IAAwB,YAAY,AAApC,CAEA,EAFQ,MAAM,CAEd;IAAwB,IAAI,AAA5B,CACA,EADQ,MAAM,CACd;IAAwB,YAAY,AAApC,CACA,EADQ,MAAM,CACd;CAQF,GARY,MAAM,GAAC,IAAI,CA2BvB;AAcD;;;;;GAKG;AACH,wBAAgB,eAAe,IAHlB,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,MAAM,CAIlB"}

package/types/lib/inventory/cbomutils.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Method to collect crypto and ssl libraries from the OS.
+ *
+ * @param {Object} options
+ * @returns osPkgsList Array of OS crypto packages
+ */
+export declare function collectOSCryptoLibs(options: Object, executeOsQueryFn: any): any[];
+/**
+ * Build cryptographic-asset components by running source-level JS crypto
+ * detection over the given directory.
+ *
+ * @param {string} src Path to the source directory to scan.
+ * @param {object} [options] Collection options forwarded to the detector and evidence normalizer.
+ * @param {boolean} [options.deep] When true, perform a deep scan including nested directories.
+ * @returns {Promise<Object[]>} Sorted array of cryptographic-asset component objects.
+ */
+export declare function collectSourceCryptoComponents(src: string, options?: {
+    deep?: boolean;
+}): Promise<Object[]>;
+/**
+ * Build cryptographic-asset components from dosai crypto analysis output,
+ * mapping detected algorithms, operations, and key materials into CycloneDX
+ * components.
+ *
+ * @param {string} src Path to the source directory used for evidence attribution.
+ * @param {object} [options] Collection options forwarded to the analyzer and evidence normalizer.
+ * @returns {Promise<Object[]>} Sorted array of cryptographic-asset component objects (empty when dosai produces no output).
+ */
+export declare function collectDosaiCryptoComponents(src: string, options?: object): Promise<Object[]>;
+/**
+ * Find crypto algorithm in the given code snippet
+ *
+ * @param {string} code Code snippet
+ * @returns {Array} Arary of crypto algorithm objects with oid and description
+ */
+export declare function findCryptoAlgos(code: string): any[];
+//# sourceMappingURL=cbomutils.d.ts.map