@cdxgen/cdxgen 0.0.1 → 13.0.0

package/types/lib/inventory/cbomutils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cbomutils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cbomutils.js"],"names":[],"mappings":"AAqBA;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,EAAE,gBAAgB,KAAA,SAiC5D;AAmVD;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CAAC,GAAG,EAL5C,MAK4C,EAAE,OAAO,AAJ7D,CAEA,EADA;IAA0B,IAAI,AAA9B,CACA,EADQ,OAAO,CACf;CAEkE,GAFxD,OAAO,CAAC,MAAM,EAAE,CAAC,CAkD7B;AAED;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,CAAC,GAAG,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC,MAAM,EAAE,CAAC,CAuG7B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAHzB,MAGyB,SAanC"}

package/types/lib/inventory/cdxrs.d.ts

@@ -0,0 +1,90 @@
+/**
+ * cdxrs — JS bridge to the Rust-native CycloneDX BOM tooling binary.
+ *
+ * This module is the ONLY place that spawns the `cdxrs` binary. It enforces
+ * the governing invariant: **no failure mode may abort SBOM generation.**
+ * Every failure (missing binary, non-zero exit, timeout, malformed stdout,
+ * version-major mismatch, CDXGEN_RS_DISABLE) logs once at `warn` and returns
+ * a sentinel that makes the caller take the JS path.
+ *
+ * Protocol:
+ *   cdxrs <subcommand> --input <file|-> --output <file|-> --format json
+ *   stdin/stdout carry JSON; stderr carries newline-delimited JSON log records.
+ *   Exit codes: 0 ok, 1 operational failure, 2 bad usage, 3 validation findings.
+ *
+ * See docs/CDXRS_PROTOCOL.md for the full specification.
+ */
+/** Sentinel returned when the Rust path is unavailable. Callers take JS path. */
+export declare const CDXRS_FALLBACK: Readonly<{
+    ok: false;
+    reason: "fallback";
+    stdout: "";
+    exitCode: null;
+}>;
+/**
+ * Determine whether a subcommand is disabled by env vars or the --no-rust alias.
+ *
+ * @param {string} subcommand The subcommand name (e.g. "info").
+ * @returns {boolean} True when the Rust path should be skipped.
+ */
+export declare function cdxrsDisabled(subcommand: string): boolean;
+/**
+ * Resolve the cdxrs binary path for the current platform.
+ *
+ * @returns {string|undefined} Path to the binary, or undefined if not found.
+ */
+export declare function cdxrsBinaryPath(): string | undefined;
+/**
+ * Check whether cdxrs may be used for a subcommand: it must not be disabled,
+ * the binary must be present, and its major version must match.
+ *
+ * The disable check comes first and is deliberate. Callers gate on this function
+ * to decide between the Rust and JS paths, so it has to honour
+ * `CDXGEN_RS_DISABLE` / `--no-rust`; otherwise a disabled run still reports (and
+ * would still select) Rust, and `--no-rust` becomes a no-op for every caller
+ * that does not go through `runCdxrs`.
+ *
+ * @param {string} [subcommand] Subcommand to check, e.g. "info".
+ * @returns {{ available: boolean, version?: string, reason?: string }}
+ */
+export declare function cdxrsAvailable(subcommand?: string): {
+    available: boolean;
+    version?: string;
+    reason?: string;
+};
+/**
+ * Spawn the cdxrs binary, collect stdout/stderr, enforce a timeout, and
+ * kill the process group if the child hangs.
+ *
+ * Every failure mode logs once at `warn` and returns the CDXRS_FALLBACK
+ * sentinel so the caller can take the JS path.
+ *
+ * Pass BOM data one of two ways:
+ *   - `content`: an in-memory string/Buffer, fed to the child over stdin with
+ *     `--input -`. Content larger than 32 MB is spilled to a temp file and
+ *     passed by path instead, per the protocol; the file is always removed.
+ *   - `input`: a path to a file already on disk.
+ *
+ * Passing `content` is the normal case, since cdxgen holds BOMs in memory.
+ *
+ * @param {string} subcommand The subcommand to run (e.g. "info").
+ * @param {Object} opts
+ * @param {string|Buffer} [opts.content] BOM data to feed over stdin.
+ * @param {string} [opts.input] Input file path. Defaults to "-" (stdin), which
+ *   requires `content`.
+ * @param {string[]} [opts.args] Extra arguments to pass.
+ * @param {number} [opts.timeoutMs] Timeout in milliseconds.
+ * @returns {Promise<{ok: boolean, stdout: string, exitCode: number|null, reason?: string}>}
+ */
+export declare function runCdxrs(subcommand: string, opts?: {
+    content?: string | Buffer;
+    input?: string;
+    args?: string[];
+    timeoutMs?: number;
+}): Promise<{
+    ok: boolean;
+    stdout: string;
+    exitCode: number | null;
+    reason?: string;
+}>;
+//# sourceMappingURL=cdxrs.d.ts.map

package/types/lib/inventory/cdxrs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cdxrs.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cdxrs.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAwBH,iFAAiF;AACjF,eAAO,MAAM,cAAc;;;;;EAKzB,CAAC;AAOH;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAH7B,MAG6B,GAF3B,OAAO,CAkBnB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAFlB,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,UAAU,AAHtC,CACA,EADQ,MAG8B,GAF5B;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAuBrE;AA2BD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,QAAQ,CAAC,UAAU,EAT9B,MAS8B,EAAE,IAAI,GAP5C;IAA6B,OAAO,AAApC,CACA,EADQ,MAAM,GAAC,MAAM,CACrB;IAAsB,KAAK,AAA3B,CAEA,EAFQ,MAAM,CAEd;IAAwB,IAAI,AAA5B,CACA,EADQ,MAAM,EAAE,CAChB;IAAsB,SAAS,AAA/B,CACA,EADQ,MAAM,CACd;CAEiD,GAFvC,OAAO,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAC,CAAC,CAiP1F"}

package/types/lib/inventory/ciParsers/azurePipelines.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Azure Pipelines formulation parser.
+ *
+ * Matches `azure-pipelines.yml`, `azure-pipelines.yaml`, and
+ * `.azure-pipelines/*.yml` files and converts them into CycloneDX formulation
+ * workflow objects.
+ *
+ * Parser contract: `parse(files, options)` returns
+ * `{ workflows, components, services, properties, dependencies }`.
+ */
+export declare const azurePipelinesParser: {
+    id: string;
+    patterns: string[];
+    /**
+     * @param {string[]} files Matched pipeline file paths
+     * @param {Object} options CLI options
+     * @returns {{ workflows: Object[], components: Object[], services: Object[], properties: Object[], dependencies: Object[] }}
+     */
+    parse(files: string[], options: Object): {
+        workflows: Object[];
+        components: Object[];
+        services: Object[];
+        properties: Object[];
+        dependencies: Object[];
+    };
+};
+//# sourceMappingURL=azurePipelines.d.ts.map

package/types/lib/inventory/ciParsers/azurePipelines.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"azurePipelines.d.ts","sourceRoot":"","sources":["../../../../lib/inventory/ciParsers/azurePipelines.js"],"names":[],"mappings":"AA+PA;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB;IAC/B,EAAE;IACF,QAAQ;IAER;;;;OAIG;IACH,KAAK,QAJM,MAAM,EAAE,WACR,MAAM,GACJ;QAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAA;KAAE;CAsB7H,CAAC"}

package/types/lib/inventory/ciParsers/circleCi.d.ts

@@ -0,0 +1,27 @@
+/**
+ * CircleCI formulation parser.
+ *
+ * Matches `.circleci/config.yml` and `.circleci/config.yaml` and converts them
+ * into CycloneDX formulation workflow objects. Referenced orbs are captured as
+ * components.
+ *
+ * Parser contract: `parse(files, options)` returns
+ * `{ workflows, components, services, properties, dependencies }`.
+ */
+export declare const circleCiParser: {
+    id: string;
+    patterns: string[];
+    /**
+     * @param {string[]} files Matched config file paths
+     * @param {Object} options CLI options
+     * @returns {{ workflows: Object[], components: Object[], services: Object[], properties: Object[], dependencies: Object[] }}
+     */
+    parse(files: string[], options: Object): {
+        workflows: Object[];
+        components: Object[];
+        services: Object[];
+        properties: Object[];
+        dependencies: Object[];
+    };
+};
+//# sourceMappingURL=circleCi.d.ts.map

package/types/lib/inventory/ciParsers/circleCi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"circleCi.d.ts","sourceRoot":"","sources":["../../../../lib/inventory/ciParsers/circleCi.js"],"names":[],"mappings":"AAsPA;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc;IACzB,EAAE;IACF,QAAQ;IAER;;;;OAIG;IACH,KAAK,QAJM,MAAM,EAAE,WACR,MAAM,GACJ;QAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAA;KAAE;CAsB7H,CAAC"}

package/types/lib/inventory/ciParsers/common.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Ensure all step objects in the array are unique (CycloneDX `uniqueItems: true`).
+ *
+ * Identical steps are disambiguated by appending a ` (N)` counter to the step name.
+ * The first occurrence is always left unchanged.
+ *
+ * @param {Object[]} steps
+ * @returns {Object[]|undefined}
+ */
+export declare function disambiguateSteps(steps: Object[]): Object[] | undefined;
+//# sourceMappingURL=common.d.ts.map

package/types/lib/inventory/ciParsers/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../../lib/inventory/ciParsers/common.js"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAH5B,MAAM,EAGsB,GAF1B,MAAM,EAAE,GAAC,SAAS,CAgB9B"}

package/types/lib/inventory/ciParsers/githubActions.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Parse a single GitHub Actions workflow file into workflow, component, and dependency data.
+ *
+ * @param {string} f Absolute path to a workflow YAML file
+ * @param {Object} options CLI options
+ * @returns {{ workflows: Object[], components: Object[], dependencies: Object[] }}
+ */
+export declare function parseWorkflowFile(f: string, options: Object): {
+    workflows: Object[];
+    components: Object[];
+    dependencies: Object[];
+};
+/**
+ * GitHub Actions formulation parser.
+ *
+ * Matches `.github/workflows/*.yml` and `*.yaml` files and converts them into
+ * CycloneDX formulation workflow objects, with referenced actions as components.
+ *
+ * Parser contract: `parse(files, options)` returns
+ * `{ workflows, components, services, properties, dependencies }`.
+ */
+export declare const githubActionsParser: {
+    id: string;
+    patterns: string[];
+    /**
+     * @param {string[]} files Matched workflow file paths
+     * @param {Object} options CLI options
+     * @returns {{ workflows: Object[], components: Object[], services: Object[], properties: Object[], dependencies: Object[] }}
+     */
+    parse(files: string[], options: Object): {
+        workflows: Object[];
+        components: Object[];
+        services: Object[];
+        properties: Object[];
+        dependencies: Object[];
+    };
+};
+//# sourceMappingURL=githubActions.d.ts.map

package/types/lib/inventory/ciParsers/githubActions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"githubActions.d.ts","sourceRoot":"","sources":["../../../../lib/inventory/ciParsers/githubActions.js"],"names":[],"mappings":"AAqyDA;;;;;;GAMG;AAEH,wBAAgB,iBAAiB,CAAC,CAAC,EALxB,MAKwB,EAAE,OAAO,EAJjC,MAIiC,GAH/B;IAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CA+iBjF;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB;IAC9B,EAAE;IACF,QAAQ;IAER;;;;OAIG;IACH,KAAK,QAJM,MAAM,EAAE,WACR,MAAM,GACJ;QAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAA;KAAE;CAsB7H,CAAC"}

package/types/lib/inventory/ciParsers/gitlabCi.d.ts

@@ -0,0 +1,26 @@
+/**
+ * GitLab CI formulation parser.
+ *
+ * Matches `.gitlab-ci.yml` files and converts them into CycloneDX formulation
+ * workflow objects. Each GitLab job becomes a task; script lines become steps.
+ *
+ * Parser contract: `parse(files, options)` returns
+ * `{ workflows, components, services, properties, dependencies }`.
+ */
+export declare const gitlabCiParser: {
+    id: string;
+    patterns: string[];
+    /**
+     * @param {string[]} files Matched CI config file paths
+     * @param {Object} options CLI options
+     * @returns {{ workflows: Object[], components: Object[], services: Object[], properties: Object[], dependencies: Object[] }}
+     */
+    parse(files: string[], options: Object): {
+        workflows: Object[];
+        components: Object[];
+        services: Object[];
+        properties: Object[];
+        dependencies: Object[];
+    };
+};
+//# sourceMappingURL=gitlabCi.d.ts.map

package/types/lib/inventory/ciParsers/gitlabCi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlabCi.d.ts","sourceRoot":"","sources":["../../../../lib/inventory/ciParsers/gitlabCi.js"],"names":[],"mappings":"AAkLA;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;IACzB,EAAE;IACF,QAAQ;IAER;;;;OAIG;IACH,KAAK,QAJM,MAAM,EAAE,WACR,MAAM,GACJ;QAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAA;KAAE;CAkB7H,CAAC"}

package/types/lib/inventory/ciParsers/jenkins.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Jenkins formulation parser.
+ *
+ * Matches `Jenkinsfile` and `Jenkinsfile.*` at any directory depth and converts
+ * declarative pipeline syntax into CycloneDX formulation workflow objects.
+ *
+ * Parser contract: `parse(files, options)` returns
+ * `{ workflows, components, services, properties, dependencies }`.
+ */
+export declare const jenkinsParser: {
+    id: string;
+    patterns: string[];
+    /**
+     * @param {string[]} files Matched Jenkinsfile paths
+     * @param {Object} options CLI options
+     * @returns {{ workflows: Object[], components: Object[], services: Object[], properties: Object[], dependencies: Object[] }}
+     */
+    parse(files: string[], options: Object): {
+        workflows: Object[];
+        components: Object[];
+        services: Object[];
+        properties: Object[];
+        dependencies: Object[];
+    };
+};
+//# sourceMappingURL=jenkins.d.ts.map

package/types/lib/inventory/ciParsers/jenkins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jenkins.d.ts","sourceRoot":"","sources":["../../../../lib/inventory/ciParsers/jenkins.js"],"names":[],"mappings":"AA6IA;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa;IACxB,EAAE;IACF,QAAQ;IAER;;;;OAIG;IACH,KAAK,QAJM,MAAM,EAAE,WACR,MAAM,GACJ;QAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAA;KAAE;CAsB7H,CAAC"}

package/types/lib/inventory/citations.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Build a schema-valid CycloneDX 1.7 citation object.
+ *
+ * Either `pointers` or `expressions` must be supplied (mutually exclusive), and
+ * either `attributedTo` or `process` must be supplied. The caller is expected to
+ * pass the bom-ref of an entity that actually exists in the BOM; this helper
+ * does not fabricate refs.
+ *
+ * @param {Object} input Citation fields
+ * @param {string[]} [input.pointers] JSON Pointer strings (RFC 6901) targeting the attributed fields
+ * @param {string[]} [input.expressions] JSONPath strings (RFC 9535) targeting the attributed fields
+ * @param {string} [input.attributedTo] bom-ref of the component/service/tool/entity that supplied the data
+ * @param {string} [input.process] bom-ref of a formulation process that produced the data
+ * @param {string} [input.bomRef] Optional bom-ref for the citation itself
+ * @param {string} [input.note] Free-form context or quality note
+ * @param {string} [input.timestamp] ISO-8601 timestamp; defaults to now. Pass
+ *   `citationTimestamp(bomJson)` so repeated renders of one BOM agree.
+ * @returns {Object|null} A citation object, or null when the required oneOf/anyOf pairs are not satisfied
+ */
+export declare function createCitation({ pointers, expressions, attributedTo, process, bomRef, note, timestamp, }?: {
+    pointers?: string[];
+    expressions?: string[];
+    attributedTo?: string;
+    process?: string;
+    bomRef?: string;
+    note?: string;
+    timestamp?: string;
+}): Object | null;
+/**
+ * Merge two citation arrays, dropping exact duplicates. When two citations share
+ * an identity but differ in note/bom-ref, the first one wins and the second is
+ * discarded to keep the array small and stable.
+ *
+ * @param {Object[]} existing Citations already present on the BOM
+ * @param {Object[]} additions Citations produced by a collector
+ * @returns {Object[]} De-duplicated citation array
+ */
+export declare function mergeCitations(existing?: Object[], additions?: Object[]): Object[];
+/**
+ * Collect the bom-refs of all tool components recorded under metadata.tools.
+ * Tool components are the natural attribution target for data that cdxgen
+ * itself produced or resolved.
+ *
+ * @param {Object} bomJson CycloneDX BOM
+ * @returns {string[]} bom-ref strings, in document order
+ */
+export declare function collectToolBomRefs(bomJson: Object): string[];
+/**
+ * Resolve the bom-ref of the cdxgen tool component, if present. This is the
+ * canonical attribution target for inventory that cdxgen collected itself.
+ *
+ * @param {Object} bomJson CycloneDX BOM
+ * @returns {string|undefined} bom-ref of the cdxgen tool, or undefined
+ */
+export declare function findCdxgenToolBomRef(bomJson: Object): string | undefined;
+/**
+ * The timestamp every citation on a document shares. Deriving it from the
+ * document rather than the clock keeps two renders of one BOM identical, the
+ * same rule the annotator follows.
+ *
+ * @param {Object} bomJson CycloneDX BOM
+ * @returns {string} ISO-8601 timestamp
+ */
+export declare function citationTimestamp(bomJson: Object): string;
+/**
+ * Attach a citations array to the BOM root, but only when the spec version can
+ * carry it. At 1.6 and below the field is not allowed and the downgrade path
+ * strips it; this guard keeps callers from emitting data that would immediately
+ * be removed.
+ *
+ * @param {Object} bomJson CycloneDX BOM (mutated)
+ * @param {Object[]} citations Citations to attach
+ * @param {Object} options CLI options (for specVersion)
+ * @returns {Object} The mutated BOM
+ */
+export declare function attachCitations(bomJson: Object, citations: Object[], options?: Object): Object;
+/**
+ * Build a citation that attributes the BOM's component inventory to the cdxgen
+ * tool. This is the baseline provenance statement: cdxgen collected the
+ * components, so the inventory is attributed to cdxgen's tool component.
+ *
+ * @param {Object} bomJson CycloneDX BOM (read for the tool bom-ref)
+ * @param {Object} [context] Extra context
+ * @param {string} [context.note] Optional note appended to the attribution
+ * @returns {Object|null} A citation, or null when no cdxgen tool is referenced
+ */
+export declare function buildInventoryCitation(bomJson: Object, context?: {
+    note?: string;
+}): Object | null;
+//# sourceMappingURL=citations.d.ts.map

package/types/lib/inventory/citations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"citations.d.ts","sourceRoot":"","sources":["../../../lib/inventory/citations.js"],"names":[],"mappings":"AAyBA;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,OAAO,EACP,MAAM,EACN,IAAI,EACJ,SAAS,GACV,GAlBE;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAAuB,YAAY,AAAnC,CACA,EADQ,MAAM,CACd;IAAuB,OAAO,AAA9B,CACA,EADQ,MAAM,CACd;IAAuB,MAAM,AAA7B,CACA,EADQ,MAAM,CACd;IAAuB,IAAI,AAA3B,CACA,EADQ,MAAM,CACd;IAAuB,SAAS,AAAhC,CAEA,EAFQ,MAAM,CAEd;CAUG,GAVO,MAAM,GAAC,IAAI,CA0CvB;AAmBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,GAJ5B,MAAM,EAI2B,EAAE,SAAS,GAH5C,MAAM,EAG2C,GAF/C,MAAM,EAAE,CAiBpB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B,MAAM,EAAE,CAgBpB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAHjC,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAK5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,GAF5B,MAAM,CAIlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAL5B,MAK4B,EAAE,SAAS,EAJvC,MAAM,EAIiC,EAAE,OAAO,GAHhD,MAGqD,GAFnD,MAAM,CAuBlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EALnC,MAKmC,EAAE,OAAO,AAJpD,CAEA,EADA;IAAyB,IAAI,AAA7B,CACA,EADQ,MAAM,CACd;CAEyD,GAF/C,MAAM,GAAC,IAAI,CAcvB"}

package/types/lib/inventory/communityAiConfigParser.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Parser object for community AI assistant configuration files.
+ *
+ * Dispatches matched files (opencode/langgraph configs, agent/skill/rule
+ * markdown, crewai python/yaml definitions, and similar) to dedicated
+ * parsers and collects the resulting components and services.
+ *
+ * @type {Object}
+ * @property {string} id Unique parser identifier ("community-ai-config")
+ * @property {string[]} patterns File path patterns this parser handles
+ * @property {Function} parse Parse matched files into components and services
+ */
+export declare const communityAiConfigParser: Object;
+//# sourceMappingURL=communityAiConfigParser.d.ts.map

package/types/lib/inventory/communityAiConfigParser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"communityAiConfigParser.d.ts","sourceRoot":"","sources":["../../../lib/inventory/communityAiConfigParser.js"],"names":[],"mappings":"AAwpBA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,EAL1B,MAoFT,CAAC"}

package/types/lib/inventory/containerRisk.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Resolve container-risk metadata for a binary, considering a linked alias name
+ * and GTFOBins-derived techniques.
+ *
+ * @param {string} name Binary name to look up
+ * @param {string} [linkedName] Optional symlinked/linked binary name used as a fallback match
+ * @returns {Object|undefined} Merged risk metadata (attack tactics/techniques, risk tags,
+ * offense tools, seccomp details) or undefined when no entry matches
+ */
+export declare function getContainerRiskMetadata(name: string, linkedName?: string): Object | undefined;
+/**
+ * Build `cdx:container:*` custom properties for a binary matched against the
+ * container-risk index.
+ *
+ * @param {string} name Binary name to look up
+ * @param {string} [linkedName] Optional symlinked/linked binary name used as a fallback match
+ * @returns {Object[]} CycloneDX custom properties; empty when the binary is not matched
+ */
+export declare function createContainerRiskProperties(name: string, linkedName?: string): Object[];
+//# sourceMappingURL=containerRisk.d.ts.map

package/types/lib/inventory/containerRisk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerRisk.d.ts","sourceRoot":"","sources":["../../../lib/inventory/containerRisk.js"],"names":[],"mappings":"AAsFA;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EALlC,MAKkC,EAAE,UAAU,AAJtD,CACA,EADQ,MAI8C,GAH5C,MAAM,GAAC,SAAS,CA0C5B;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAJvC,MAIuC,EAAE,UAAU,AAH3D,CACA,EADQ,MAGmD,GAFjD,MAAM,EAAE,CA6DpB"}

package/types/lib/inventory/cryptoAlgorithmFamily.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Resolve a detected algorithm name to a CycloneDX 1.7 `algorithmFamily` enum
+ * value. Returns undefined when no rule matches, so the caller can leave the
+ * field unset rather than emitting an invalid value.
+ *
+ * @param {string} name Detected or OID algorithm name
+ * @returns {string|undefined} A valid algorithmFamily enum value, or undefined
+ */
+export declare function resolveAlgorithmFamily(name: string): string | undefined;
+/**
+ * Resolve a curve name to the CycloneDX 1.7 `ellipticCurve` enum. When the
+ * name cannot be mapped to the enum, the deprecated 1.6 free-text `curve`
+ * property is returned instead so the cryptographic fact is preserved.
+ *
+ * @param {string} curveName Detected curve name
+ * @returns {Object} `{ ellipticCurve }` when mappable, `{ curve }` when only
+ *   the deprecated free-text form is available, or `{}` when no curve is named.
+ */
+export declare function resolveEllipticCurve(curveName: string): Object;
+/**
+ * Apply resolved algorithm-family and curve properties to a cryptographic
+ * component's `cryptoProperties.algorithmProperties`. The component is mutated
+ * in place; the primitive is preserved when already set.
+ *
+ * @param {Object} component A CycloneDX cryptographic-asset component
+ * @param {Object} context Detected context
+ * @param {string} [context.name] Algorithm name used to resolve the family
+ * @param {string} [context.primitive] Cryptographic primitive (e.g. "signature")
+ * @param {string} [context.curve] Curve name to resolve
+ * @returns {Object} The mutated component
+ */
+export declare function applyAlgorithmProperties(component: Object, context?: {
+    name?: string;
+    primitive?: string;
+    curve?: string;
+}): Object;
+//# sourceMappingURL=cryptoAlgorithmFamily.d.ts.map

package/types/lib/inventory/cryptoAlgorithmFamily.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cryptoAlgorithmFamily.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cryptoAlgorithmFamily.js"],"names":[],"mappings":"AAwJA;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAHhC,MAGgC,GAF9B,MAAM,GAAC,SAAS,CAsB5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAJnC,MAImC,GAHjC,MAAM,CAoBlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAPvC,MAOuC,EAAE,OAAO,GALxD;IAAyB,IAAI,AAA7B,CACA,EADQ,MAAM,CACd;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;IAAyB,KAAK,AAA9B,CACA,EADQ,MAAM,CACd;CAE6D,GAFnD,MAAM,CAqClB"}

package/types/lib/inventory/deps.d.ts

@@ -0,0 +1,140 @@
+/**
+ * Collect maven dependencies
+ *
+ * @param {string} mavenCmd Maven command to use
+ * @param {string} basePath Path to the maven project
+ * @param {boolean} cleanup Remove temporary directories
+ * @param {boolean} includeCacheDir Include maven and gradle cache directories
+ */
+export declare function collectMvnDependencies(mavenCmd: string, basePath: string, cleanup?: boolean, includeCacheDir?: boolean): Promise<{}>;
+/**
+ * Method to collect class names from all jars in a directory
+ *
+ * @param {string} jarPath Path containing jars
+ * @param {object} pomPathMap Map containing jar to pom names. Required to successfully parse gradle cache.
+ *
+ * @return object containing jar name and class list
+ */
+export declare function collectJarNS(jarPath: string, pomPathMap?: object): Promise<{}>;
+/**
+ * Convert a JAR namespace mapping (produced by {@link collectJarNS}) into an array
+ * of CycloneDX package component objects.
+ *
+ * Each entry in the mapping is resolved to a component with name, group, version,
+ * purl, hashes, namespace properties, and source file evidence.
+ *
+ * @param {Object} jarNSMapping Map of purl string to `{ jarFile, pom, namespaces, hashes }`
+ * @returns {Promise<Object[]>} Array of component objects derived from the JAR mapping
+ */
+export declare function convertJarNSToPackages(jarNSMapping: Object): Promise<Object[]>;
+/**
+ * Deprecated function to parse pom.xml. Use parsePom instead.
+ *
+ * @deprecated
+ * @param pomXmlData XML contents
+ * @returns {Object} Parent component data
+ */
+export declare function parsePomXml(pomXmlData: any): Object;
+/**
+ * Parse a JAR MANIFEST.MF file and return its key-value pairs as an object.
+ *
+ * @param {string} jarMetadata Raw text contents of a MANIFEST.MF file
+ * @returns {Object} Key-value pairs extracted from the manifest
+ */
+export declare function parseJarManifest(jarMetadata: string): Object;
+/**
+ * Select the most reliable group candidate from JAR manifest metadata.
+ *
+ * @param {Object} jarMetadata Parsed MANIFEST.MF key-value map
+ * @returns {string} Best group candidate, or empty string if none exists
+ */
+export declare function inferJarGroupFromManifest(jarMetadata?: Object): string;
+/**
+ * Trim group suffix that duplicates the artifact name for compound artifact names.
+ *
+ * @param {string} group Group candidate
+ * @param {string} name Artifact name candidate
+ * @returns {string} Adjusted group
+ */
+export declare function trimJarGroupSuffix(group: string, name: string): string;
+/**
+ * Parse a Maven pom.properties file and return its key-value pairs as an object.
+ *
+ * @param {string} pomProperties Raw text contents of a pom.properties file
+ * @returns {Object} Key-value pairs extracted from the properties file
+ */
+export declare function parsePomProperties(pomProperties: string): Object;
+/**
+ * Method to get pom properties from maven directory
+ *
+ * @param {string} mavenDir Path to maven directory
+ *
+ * @return array with pom properties
+ */
+export declare function getPomPropertiesFromMavenDir(mavenDir: string): {};
+/**
+ * Method to read a single file entry from a zip file
+ *
+ * @param {string} zipFile Zip file to read
+ * @param {string} filePattern File pattern
+ * @param {string} contentEncoding Encoding. Defaults to utf-8
+ *
+ * @returns {Promise<string|undefined>} File contents
+ */
+export declare function readZipEntry(zipFile: string, filePattern: string, contentEncoding?: string): Promise<string | undefined>;
+/**
+ * Read every zip entry whose name contains `pathFragment`. Unlike
+ * `readZipEntry`, which returns the first matching entry, this enumerates all
+ * matches — needed for PEP 770, where a distribution may carry several SBOM
+ * documents under `<dist>.dist-info/sboms/`, in a directory whose name is
+ * prefixed by the distribution stem and so is not known in advance.
+ *
+ * Entries larger than `maxEntryBytes` are skipped without being decompressed,
+ * because a wheel is untrusted input and its declared sizes are the only cheap
+ * defence against an archive that expands without bound.
+ *
+ * @param {string} zipFile Path to a zip archive (e.g. a wheel)
+ * @param {string} pathFragment Substring an entry name must contain
+ * @param {Object} [opts] Options
+ * @param {string} [opts.contentEncoding] Text encoding. Defaults to utf-8
+ * @param {number} [opts.maxEntryBytes] Per-entry uncompressed size bound
+ * @returns {Promise<Array<{name: string, data: string}>>} Matching entries
+ */
+export declare function readZipEntriesMatching(zipFile: string, pathFragment: string, { contentEncoding, maxEntryBytes }?: {
+    contentEncoding?: string;
+    maxEntryBytes?: number;
+}): Promise<Array<{
+    name: string;
+    data: string;
+}>>;
+/**
+ * Method to get the classes and relevant sources in a jar file
+ *
+ * @param {string} jarFile Jar file to read
+ *
+ * @returns List of classes and sources matching certain known patterns
+ */
+export declare function getJarClasses(jarFile: string): Promise<any>;
+/**
+ * Recursively flatten a Python package's transitive dependencies into the
+ * dependencies map and flat package list.
+ *
+ * @param {Object} dependenciesMap Map of bom-ref to the list of dependent bom-refs, mutated in place
+ * @param {Object[]} pkgList Flat list of package component objects, mutated in place
+ * @param {string} reqOrSetupFile Path to the requirements.txt or setup.py file used as evidence
+ * @param {Object} t Root package object with name, version, and nested dependencies
+ * @returns {void}
+ */
+export declare function flattenDeps(dependenciesMap: Object, pkgList: Object[], reqOrSetupFile: string, t: Object): void;
+/**
+ * Comparator function for sorting CycloneDX component objects.
+ *
+ * Compares components by `bom-ref`, then `purl`, then `name`, using locale-aware
+ * string comparison on the first available key.
+ *
+ * @param {Object|string} a First component to compare
+ * @param {Object|string} b Second component to compare
+ * @returns {number} Negative, zero, or positive integer as required by Array.sort
+ */
+export declare function componentSorter(a: Object | string, b: Object | string): number;
+//# sourceMappingURL=deps.d.ts.map

package/types/lib/inventory/deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps.d.ts","sourceRoot":"","sources":["../../../lib/inventory/deps.js"],"names":[],"mappings":"AA6BA;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EANC,MAMD,EACR,QAAQ,EANC,MAMD,EACR,OAAO,GANE,OAMK,EACd,eAAe,GANN,OAMc,eAuDxB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAL/B,MAK+B,EAAE,UAAU,GAJ3C,MAIgD,eAsK1D;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,YAAY,EAH9C,MAG8C,GAF5C,OAAO,CAAC,MAAM,EAAE,CAAC,CAgE7B;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,UAAU,KAAA,GAFzB,MAAM,CAkClB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAHjC,MAGiC,GAF/B,MAAM,CAiBlB;AAgBD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,GAH1C,MAG+C,GAF7C,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAJ7B,MAI6B,EAAE,IAAI,EAHnC,MAGmC,GAFjC,MAAM,CAqBlB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAHrC,MAGqC,GAFnC,MAAM,CAiBlB;AACD;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAJ1C,MAI0C,MAYpD;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAPE,MAOF,EACP,WAAW,EAPF,MAOE,EACX,eAAe,GAPN,MAOgB,GALd,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA4CrC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EARE,MAQF,EACP,YAAY,EARH,MAQG,EACZ,EAAE,eAAyB,EAAE,aAA+B,EAAE,AAR7D,CAGA,EAFA;IAAsB,eAAe,AAArC,CACA,EADQ,MAAM,CACd;IAAsB,aAAa,AAAnC,CACA,EADQ,MAAM,CACd;CAKkE,GALxD,OAAO,CAAC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,CAAC,CAAC,CAkDxD;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAJhC,MAIgC,gBAqE1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,eAAe,EANhC,MAMgC,EAAE,OAAO,EALzC,MAAM,EAKmC,EAAE,cAAc,EAJzD,MAIyD,EAAE,CAAC,EAH5D,MAG4D,GAF1D,IAAI,CAqDhB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAJtB,MAAM,GAAC,MAIe,EAAE,CAAC,EAHzB,MAAM,GAAC,MAGkB,GAFvB,MAAM,CAWlB"}