@cdxgen/cdxgen 0.0.1 → 13.0.0

package/types/lib/inventory/depsUtils.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Merges two CycloneDX dependency arrays into a single deduplicated list.
+ * For each unique ref, the dependsOn and provides sets from both arrays are
+ * combined. Self-referential entries pointing to the parent component are
+ * removed from all dependsOn and provides lists.
+ *
+ * @param {Object[]} dependencies First array of dependency objects
+ * @param {Object[]} newDependencies Second array of dependency objects to merge
+ * @param {Object} parentComponent Parent component whose bom-ref is used to filter self-references
+ * @returns {Object[]} Merged and deduplicated array of dependency objects
+ */
+export declare function mergeDependencies(dependencies: Object[], newDependencies: Object[], parentComponent?: Object): Object[];
+/**
+ * Marks npm @types packages as excluded from runtime scope.
+ *
+ * @param {Object[]} components CycloneDX component objects
+ * @returns {Object[]} The same component array with scopes updated in place
+ */
+export declare function markNpmTypesPackagesAsExcluded(components?: Object[]): Object[];
+/**
+ * Propagates required scope through a dependency graph.
+ *
+ * If component A has `scope: "required"` and dependency metadata says A depends
+ * on B, B is also runtime-relevant. Keep packages optional when lockfile/parser
+ * metadata explicitly identifies them as development, optional, or peer-only.
+ *
+ * @param {Object[]} components CycloneDX component objects
+ * @param {Object[]} dependencies CycloneDX dependency entries
+ * @returns {Object[]} The same component array with scopes updated in place
+ */
+export declare function propagateRequiredScopeFromDependencies(components?: Object[], dependencies?: Object[]): Object[];
+/**
+ * Merge CycloneDX services using bom-ref or group/name/version identity.
+ *
+ * @param {Object[]|Object} services Existing service list
+ * @param {Object[]|Object} newServices New service list
+ * @returns {Object[]} Merged and deduplicated services
+ */
+export declare function mergeServices(services: Object[] | Object, newServices: Object[] | Object): Object[];
+/**
+ * Trim duplicate components by retaining all the properties
+ *
+ * @param {Array} components Components
+ *
+ * @returns {Array} Filtered components
+ */
+export declare function trimComponents(components: any[]): any[];
+/**
+ * Filter out invalid cryptographic-asset components from a component list.
+ * Removes algorithm components without a valid cryptoProperties.oid and
+ * certificate components without cryptoProperties.algorithmProperties.
+ *
+ * @param {Object[] | undefined | null} components Array of CycloneDX components
+ * @returns {Object[]} Filtered array with invalid crypto components removed
+ */
+export declare function filterInvalidCryptoComponents(components: Object[] | undefined | null): Object[];
+/**
+ * Method to check if a given dependency tree is partial or not.
+ *
+ * @param {Array} dependencies List of dependencies
+ * @param {Number} componentsCount Number of components
+ * @returns {Boolean} True if the dependency tree lacks any non-root parents without children. False otherwise.
+ */
+export declare function isPartialTree(dependencies: any[], componentsCount?: number): boolean;
+/**
+ * Re-compute and set the scope based on the dependency tree
+ *
+ * @param {Array} pkgList List of components
+ * @param {Array} dependencies List of dependencies
+ *
+ * @returns {Array} Updated list
+ */
+export declare function recomputeScope(pkgList: any[], dependencies: any[]): any[];
+//# sourceMappingURL=depsUtils.d.ts.map

package/types/lib/inventory/depsUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"depsUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/depsUtils.js"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EANH,MAAM,EAMH,EACZ,eAAe,EANN,MAAM,EAMA,EACf,eAAe,GANN,MAMW,GALT,MAAM,EAAE,CAuEpB;AA4CD;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,GAH9C,MAAM,EAG6C,GAFjD,MAAM,EAAE,CAYpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sCAAsC,CACpD,UAAU,GALD,MAAM,EAKA,EACf,YAAY,GALH,MAAM,EAKE,GAJN,MAAM,EAAE,CA8DpB;AAoCD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAJ3B,MAAM,EAAE,GAAC,MAIkB,EAAE,WAAW,EAHxC,MAAM,EAAE,GAAC,MAG+B,GAFtC,MAAM,EAAE,CAmEpB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,UAAU,OAAA,SAoIxC;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAH7C,MAAM,EAAE,GAAG,SAAS,GAAG,IAGsB,GAF3C,MAAM,EAAE,CA0CpB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,YAAY,OAAA,EAAE,eAAe,SAAI,WAsB9D;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,OAAA,EAAE,YAAY,OAAA,SAgCnD"}

package/types/lib/inventory/display.d.ts

@@ -0,0 +1,227 @@
+/**
+ * Build operator-facing AI-BOM summary lines.
+ *
+ * @param {Object} bomJson CycloneDX BOM JSON object
+ * @returns {string[]} formatted AI-BOM summary lines
+ */
+export declare function buildAiBomInsightLines(bomJson: Object): string[];
+/**
+ * Print operator-facing AI-BOM summary lines.
+ *
+ * @param {Object} bomJson CycloneDX BOM JSON object
+ */
+export declare function printAiBomInsights(bomJson: Object): void;
+/**
+ * Build AI-BOM pedigree lines for REPL inspection.
+ *
+ * @param {Object} bomJson CycloneDX BOM JSON object
+ * @returns {string[]} formatted pedigree lines
+ */
+export declare function buildAiBomPedigreeLines(bomJson: Object): string[];
+/**
+ * Print AI-BOM pedigree lines.
+ *
+ * @param {Object} bomJson CycloneDX BOM JSON object
+ */
+export declare function printAiBomPedigree(bomJson: Object): void;
+/**
+ * Build AI-BOM model variant lines for REPL inspection.
+ *
+ * @param {Object} bomJson CycloneDX BOM JSON object
+ * @returns {string[]} formatted variant lines
+ */
+export declare function buildAiBomVariantLines(bomJson: Object): string[];
+/**
+ * Print AI-BOM model variant lines.
+ *
+ * @param {Object} bomJson CycloneDX BOM JSON object
+ */
+export declare function printAiBomVariants(bomJson: Object): void;
+/**
+ * Build AI-BOM dataset usage lines for REPL inspection.
+ *
+ * @param {Object} bomJson CycloneDX BOM JSON object
+ * @returns {string[]} formatted dataset lines
+ */
+export declare function buildAiBomDatasetLines(bomJson: Object): string[];
+/**
+ * Print AI-BOM dataset usage lines.
+ *
+ * @param {Object} bomJson CycloneDX BOM JSON object
+ */
+export declare function printAiBomDatasets(bomJson: Object): void;
+/**
+ * Builds the summary and provenance lines printed after the component table.
+ *
+ * @param {Object} bomJson CycloneDX BOM JSON object
+ * @param {string[]|undefined} filterTypes Optional list of component types to include
+ * @param {string|undefined} summaryText Optional summary message to print after the table
+ * @param {number} displayedProvenanceCount Number of displayed components with registry provenance
+ * @returns {string[]} Summary lines to print
+ */
+export declare const buildTableSummaryLines: (bomJson: Object, filterTypes: string[] | undefined, summaryText: string | undefined, displayedProvenanceCount?: number) => string[];
+/**
+ * Builds legend lines for dependency tree marker icons.
+ *
+ * @param {string[]} treeGraphics Dependency tree lines
+ * @returns {string[]} Legend lines to print after the tree output
+ */
+export declare const buildDependencyTreeLegendLines: (treeGraphics: string[]) => string[];
+/**
+ * Aggregate recorded activities into a summary payload with mode and status counts.
+ *
+ * @param {Object[]} activities Recorded activity objects with a status field
+ * @param {boolean} [dryRunMode] Whether the run was a dry run; defaults to the global dry-run flag
+ * @returns {Object} Payload containing the activities, mode ("dry-run" or "debug"), and summary counts
+ */
+export declare function buildActivitySummaryPayload(activities: Object[], dryRunMode?: boolean): Object;
+/**
+ * Serialize an activity summary into report lines for the given report type.
+ *
+ * Produces a single pretty-printed JSON document for "json", newline-delimited
+ * JSON records (a summary record followed by one record per activity) for
+ * "jsonl", and no lines otherwise.
+ *
+ * @param {Object[]} activities Recorded activity objects
+ * @param {string} [reportType] Report format: "json" or "jsonl"
+ * @param {boolean} [dryRunMode] Whether the run was a dry run; defaults to the global dry-run flag
+ * @returns {string[]} Serialized report lines; empty when the report type is unsupported
+ */
+export declare function serializeActivitySummary(activities: Object[], reportType?: string, dryRunMode?: boolean): string[];
+/**
+ * Prints the BOM components as a streaming table to the console.
+ * Delegates to {@link printOSTable} automatically when the BOM metadata indicates
+ * an operating-system or platform component type.
+ *
+ * @param {Object} bomJson CycloneDX BOM JSON object
+ * @param {string[]} [filterTypes] Optional list of component types to include; all types shown when omitted
+ * @param {string} [highlight] Optional string to highlight in the output
+ * @param {string} [summaryText] Optional summary message to print after the table
+ * @returns {void}
+ */
+export declare function printTable(bomJson: Object, filterTypes?: string[], highlight?: string, summaryText?: string): void;
+/**
+ * Prints OS package components from the BOM as a formatted streaming table.
+ *
+ * @param {Object} bomJson CycloneDX BOM JSON object
+ * @returns {void}
+ */
+export declare function printOSTable(bomJson: Object): void;
+/**
+ * Prints the services listed in the BOM as a formatted table.
+ * Includes endpoint URLs, authentication flag, and cross-trust-boundary flag.
+ *
+ * @param {Object} bomJson CycloneDX BOM JSON object
+ * @returns {void}
+ */
+export declare function printServices(bomJson: Object): void;
+/**
+ * Prints the formulation components from the BOM as a formatted table.
+ *
+ * @param {Object} bomJson CycloneDX BOM JSON object
+ * @returns {void}
+ */
+export declare function printFormulation(bomJson: Object): void;
+/**
+ * Prints component evidence occurrences (file locations) as a streaming table.
+ * Only components that have `evidence.occurrences` are included.
+ *
+ * @param {Object} bomJson CycloneDX BOM JSON object
+ * @returns {void}
+ */
+export declare function printOccurrences(bomJson: Object): void;
+/**
+ * Prints the call stack evidence for each component in the BOM as a formatted table.
+ * Only components that have `evidence.callstack.frames` are included.
+ *
+ * @param {Object} bomJson CycloneDX BOM JSON object
+ * @returns {void}
+ */
+export declare function printCallStack(bomJson: Object): void;
+/**
+ * Prints the dependency tree from the BOM as an ASCII tree diagram.
+ * Uses the `table` library for small trees and plain console output for larger ones.
+ *
+ * @param {Object} bomJson CycloneDX BOM JSON object containing a `dependencies` array
+ * @param {string} [mode="dependsOn"] Dependency relation to traverse (`"dependsOn"` or `"provides"`)
+ * @param {string} [highlight] Optional string to highlight in the tree output
+ * @returns {void}
+ */
+export declare function printDependencyTree(bomJson: Object, mode?: string, highlight?: string): void;
+/**
+ * Builds printable dependency tree lines from a BOM dependency graph.
+ * Produces a spanning forest so shared children are rendered once, while
+ * disconnected or cyclic subgraphs are still emitted as dangling trees.
+ *
+ * @param {Object[]} dependencies CycloneDX dependency objects
+ * @param {string} [mode="dependsOn"] Dependency relation to traverse
+ * @returns {string[]} Dependency tree lines ready for console rendering
+ */
+export declare const buildDependencyTreeLines: (dependencies: Object[], mode?: string) => string[];
+/**
+ * Prints a table of reachable components derived from a reachability slices file.
+ * Aggregates per-purl reachable-flow counts and sorts them descending.
+ *
+ * @param {Object} sliceArtefacts Slice artefact paths, must include `reachablesSlicesFile`
+ * @returns {void}
+ */
+export declare function printReachables(sliceArtefacts: Object): void;
+/**
+ * Prints a formatted table of CycloneDX vulnerability objects.
+ *
+ * @param {Object[]} vulnerabilities Array of CycloneDX vulnerability objects
+ * @returns {void}
+ */
+export declare function printVulnerabilities(vulnerabilities: Object[]): void;
+/**
+ * Prints an OWASP donation banner when running in a CI environment.
+ * The banner is suppressed when `options.noBanner` is set or the repository
+ * belongs to the cdxgen project itself.
+ *
+ * @param {Object} options CLI options
+ * @returns {void}
+ */
+export declare function printSponsorBanner(options: Object): void;
+/**
+ * Prints a BOM summary table including generator tool names, component package types,
+ * and component namespaces extracted from BOM metadata properties.
+ *
+ * @param {Object} bomJson CycloneDX BOM JSON object
+ * @returns {void}
+ */
+export declare function printSummary(bomJson: Object): void;
+/**
+ * Print the recorded activity summary to the console.
+ *
+ * For "json"/"jsonl" report types the serialized lines are printed verbatim;
+ * otherwise a human-readable console summary with status counts is shown.
+ *
+ * @param {string} [reportType] Report format: "json", "jsonl", or undefined for console output
+ * @returns {void}
+ */
+export declare function printActivitySummary(reportType?: string): void;
+export type EnvAuditFinding = {
+    type: string;
+    variable: string;
+    severity: string;
+    message: string;
+    mitigation: string;
+};
+/**
+ * Prints a grouped secure-mode environment audit call-out panel.
+ *
+ * @param {EnvAuditFinding[]} envAuditFindings Audit findings to display
+ * @returns {void}
+ */
+export declare function printEnvironmentAuditFindings(envAuditFindings?: EnvAuditFinding[]): void;
+/**
+ * Runs the pre-generation environment audit and renders the results as formatted
+ * tables to the console. Called when the --env-audit CLI flag is set.
+ *
+ * @param {string} filePath Project path being scanned
+ * @param {Object} config Loaded .cdxgenrc / config-file values
+ * @param {Object} options Effective CLI options
+ * @param {EnvAuditFinding[]} envAuditFindings Audit findings to display
+ */
+export declare function displaySelfThreatModel(filePath: string, config: Object, options: Object, envAuditFindings: EnvAuditFinding[]): void;
+//# sourceMappingURL=display.d.ts.map

package/types/lib/inventory/display.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"display.d.ts","sourceRoot":"","sources":["../../../lib/inventory/display.js"],"names":[],"mappings":"AAwKA;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAkFpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAHpC,MAGoC,GAFlC,MAAM,EAAE,CA2CpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAyBpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAwBpB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,QAKzC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,YANxB,MAAM,eACN,MAAM,EAAE,GAAC,SAAS,eAClB,MAAM,GAAC,SAAS,6BAChB,MAAM,KACJ,MAAM,EAkGlB,CAAC;AAqNF;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,iBAHhC,MAAM,EAAE,KACN,MAAM,EAclB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAJ3C,MAAM,EAIqC,EAAE,UAAU,AAH/D,CACA,EADQ,OAGkE,GAFhE,MAAM,CAsBlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAND,MAAM,EAML,EACV,UAAU,AANT,CACA,EADQ,MAMU,EACnB,UAAU,AANT,CACA,EADQ,OAMY,GALV,MAAM,EAAE,CA8BpB;AA6BD;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAPE,MAOF,EACP,WAAW,AAPV,CACA,EADQ,MAAM,EAOQ,EACvB,SAAS,AAPR,CACA,EADQ,MAOY,EACrB,WAAW,AAPV,CACA,EADQ,MAOc,GANZ,IAAI,CA+EhB;AAQD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAHzB,MAGyB,GAFvB,IAAI,CAsBhB;AACD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,IAAI,CAwBhB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,IAAI,CAuBhB;AA0BD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B,IAAI,CAwChB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,GAFzB,IAAI,CA+ChB;AACD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EANE,MAMF,EACP,IAAI,AANH,CACA,EADQ,MAMS,EAClB,SAAS,AANR,CACA,EADQ,MAMY,GALV,IAAI,CAoChB;AAkJD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,iBAJ1B,MAAM,EAAE,SACR,MAAM,KACJ,MAAM,EAyClB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,cAAc,EAHnC,MAGmC,GAFjC,IAAI,CAoChB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,eAAe,EAHzC,MAAM,EAGmC,GAFvC,IAAI,CA4BhB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B,IAAI,CAwBhB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAHzB,MAGyB,GAFvB,IAAI,CAsDhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,AAH5C,CACA,EADQ,MAGgD,GAF9C,IAAI,CAwHhB;AAGE,YAAmG,eAAe,GAAxG;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAC,CAAiB;AA6DrH;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,gBAAgB,GAHnD,eAAe,EAGyC,GAFtD,IAAI,CA+BhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EANC,MAMD,EACR,MAAM,EANG,MAMH,EACN,OAAO,EANE,MAMF,EACP,gBAAgB,EANP,eAAe,EAMR,QAgUjB"}

package/types/lib/inventory/dosai.d.ts

@@ -0,0 +1,130 @@
+/**
+ * Check whether a language is a .NET language supported by dosai analysis.
+ *
+ * @param {string} language Project type or language name
+ * @returns {boolean} True when the language maps to a supported .NET/dotnet identifier
+ */
+export declare function isDosaiDotnetLanguage(language: string): boolean;
+/**
+ * Read and parse a dosai JSON output file.
+ *
+ * @param {string} jsonFile Path to the dosai JSON file
+ * @returns {Object|undefined} Parsed JSON content, or undefined when missing or invalid
+ */
+export declare function readDosaiJsonFile(jsonFile: string): Object | undefined;
+/**
+ * Run a dosai subcommand ("methods", "dataflows", or "crypto") against a source
+ * tree and write its JSON output to the given file.
+ *
+ * @param {string} command Dosai subcommand to execute
+ * @param {string} src Source directory to analyze
+ * @param {string} outputFile Path where the dosai JSON output is written
+ * @param {Object} [options] Options carrying dosaiCommand, dataFlowPatterns, or patternPacks overrides
+ * @returns {boolean} True when the command succeeded and produced the output file, false otherwise
+ */
+export declare function runDosaiCommand(command: string, src: string, outputFile: string, options?: Object): boolean;
+/**
+ * Produce the dosai methods (call graph) slice for a source tree.
+ *
+ * @param {string} src Source directory to analyze
+ * @param {string} outputFile Path where the methods slice JSON is written
+ * @param {Object} [options] Options forwarded to runDosaiCommand
+ * @returns {boolean} True when the slice was produced successfully
+ */
+export declare function createDosaiMethodsSlice(src: string, outputFile: string, options?: Object): boolean;
+/**
+ * Produce the dosai data-flow slice for a source tree.
+ *
+ * @param {string} src Source directory to analyze
+ * @param {string} outputFile Path where the data-flow slice JSON is written
+ * @param {Object} [options] Options carrying dataFlowPatterns or patternPacks overrides
+ * @returns {boolean} True when the slice was produced successfully
+ */
+export declare function createDosaiDataFlowSlice(src: string, outputFile: string, options?: Object): boolean;
+/**
+ * Produce the dosai crypto analysis output for a source tree.
+ *
+ * @param {string} src Source directory to analyze
+ * @param {string} outputFile Path where the crypto analysis JSON is written
+ * @param {Object} [options] Options forwarded to runDosaiCommand
+ * @returns {boolean} True when the analysis was produced successfully
+ */
+export declare function createDosaiCryptoAnalysis(src: string, outputFile: string, options?: Object): boolean;
+/**
+ * Run dosai crypto analysis in a temporary directory and return the parsed result.
+ *
+ * @param {string} src Source directory to analyze
+ * @param {Object} [options] Options forwarded to createDosaiCryptoAnalysis
+ * @returns {Object|undefined} Parsed crypto analysis JSON, or undefined when the analysis fails
+ */
+export declare function analyzeDosaiCrypto(src: string, options?: Object): Object | undefined;
+/**
+ * Persist the combined native dosai report to options.semanticsSlicesFile.
+ *
+ * Mirrors the rusi/golem persistence contract (analyzeRusiProject /
+ * analyzeGolemProject on branch feat/rusi-persist-report): when a semantics-
+ * slices path is provided, the FULL native report is written there and kept so
+ * downstream tools (depscan) can consume the complete methods + data-flow
+ * facts that cdxgen only projects a subset of into the SBOM evidence. dotnet
+ * does not otherwise use the semantics slice (atom is never run for dotnet),
+ * so the path is free to carry the combined dosai report. Returns the resolved
+ * durable path when something was persisted, otherwise undefined.
+ */
+export declare function persistDosaiSemanticsReport(options: any, methodsSlice: any, dataFlowSlice: any): any;
+/**
+ * Build a purl alias map for a list of components.
+ *
+ * @param {Object[]} [components] Component objects with purl fields
+ * @returns {Map<string, string>} Map of exact purls and normalized type/namespace/name keys to canonical purls
+ */
+export declare function buildPurlAliasMap(components?: Object[]): Map<string, string>;
+/**
+ * Resolve a possibly-aliased purl to the canonical component purl.
+ *
+ * @param {string} purl Purl from a dosai report
+ * @param {Map<string, string>} purlAliasMap Alias map built by buildPurlAliasMap
+ * @returns {string|undefined} Canonical component purl, the input purl when unaliased, or undefined when empty
+ */
+export declare function resolveComponentPurl(purl: string, purlAliasMap: Map<string, string>): string | undefined;
+/**
+ * Map a dosai methods slice to per-purl occurrence evidence.
+ *
+ * Extracts source locations, imported modules, and called methods from the
+ * Dependencies and PackageReachability sections of the slice.
+ *
+ * @param {Object} methodsSlice Parsed dosai methods slice JSON
+ * @param {Object[]} [components] BOM components used to resolve purl aliases
+ * @returns {Object} Object with purlLocationMap, purlModulesMap, and purlMethodsMap keyed by purl
+ */
+export declare function collectDosaiPurlEvidence(methodsSlice: Object, components?: Object[]): Object;
+/**
+ * Extract data-flow call frames per component purl from a dosai data-flow result.
+ *
+ * Frames are derived from slice and PackageReachability node ids, and grouped
+ * under every purl referenced by each flow (source, sink, and intermediate).
+ *
+ * @param {Object} dataFlowResult Parsed dosai data-flow slice JSON
+ * @param {Object[]} [components] BOM components used to resolve purl aliases
+ * @returns {Object} Map of canonical purl to arrays of call-stack frame objects
+ */
+export declare function collectDosaiDataFlowFrames(dataFlowResult: Object, components?: Object[]): Object;
+/**
+ * Infer service and endpoint definitions from a dosai methods slice.
+ *
+ * Sanitizes API endpoint routes, derives stable service names, and records
+ * `cdx:dosai:*` properties (http method, auth requirements, claim counts) per
+ * service in the supplied map, mutating it in place.
+ *
+ * @param {Object} methodsSlice Parsed dosai methods slice JSON
+ * @param {Object} [servicesMap] Map of service name to service definition, mutated in place
+ * @returns {Object} The updated services map
+ */
+export declare function collectDosaiServicesFromMethods(methodsSlice: Object, servicesMap?: Object): Object;
+/**
+ * Normalize a services map into a sorted array of CycloneDX service objects.
+ *
+ * @param {Object} [servicesMap] Map of service name to service definition with Set-backed endpoints
+ * @returns {Object[]} Array of service objects with sorted endpoint arrays and properties
+ */
+export declare function normalizeDosaiServiceMap(servicesMap?: Object): Object[];
+//# sourceMappingURL=dosai.d.ts.map

package/types/lib/inventory/dosai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dosai.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dosai.js"],"names":[],"mappings":"AAmJA;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAW5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAN5B,MAM4B,EAAE,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAyDnB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,UAAU,EAJ5C,MAI4C,EAAE,OAAO,AAH7D,CACA,EADQ,MAG0D,GAFxD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EALjC,MAKiC,EAAE,UAAU,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD,OAAO,CAInB;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EALlC,MAKkC,EAAE,UAAU,EAJ9C,MAI8C,EAAE,OAAO,AAH/D,CACA,EADQ,MAG4D,GAF1D,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,AAH5C,CACA,EADQ,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAe5B;AAuBD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,KAAA,EACP,YAAY,KAAA,EACZ,aAAa,KAAA,OAiBd;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,AAHzC,CACA,EADQ,MAAM,EAGgC,GAFpC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/B;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAJ9B,MAI8B,EAAE,YAAY,EAH5C,GAAG,CAAC,MAAM,EAAE,MAAM,CAG0B,GAF1C,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAJ1C,MAI0C,EAAE,UAAU,AAH9D,CACA,EADQ,MAAM,EAGqD,GAFzD,MAAM,CAmElB;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,cAAc,EAJ9C,MAI8C,EAAE,UAAU,AAHlE,CACA,EADQ,MAAM,EAGyD,GAF7D,MAAM,CAsClB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC7C,YAAY,EALH,MAKG,EACZ,WAAW,AALV,CACA,EADQ,MAKO,GAJL,MAAM,CA2ElB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,AAHjD,CACA,EADQ,MAG8C,GAF5C,MAAM,EAAE,CAUpB"}

package/types/lib/inventory/dosaiParsers.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Build a lowercase type/namespace/name lookup key for a purl.
+ *
+ * Falls back to a stripped, lowercased form of the raw string when the purl
+ * cannot be parsed.
+ *
+ * @param {string} purl Package URL string
+ * @returns {string|undefined} Normalized key, or undefined when the input is empty or not a string
+ */
+export declare function normalizeDosaiPurlKey(purl: string): string | undefined;
+/**
+ * Append a value to the Set stored under a key in a map, creating the Set when absent.
+ *
+ * @param {Object} map Map of key to Set of values, mutated in place
+ * @param {string} key Map key (usually a purl)
+ * @param {string} value Value to add; no-op when key or value is falsy
+ * @returns {void}
+ */
+export declare function addDosaiSetValue(map: Object, key: string, value: string): void;
+/**
+ * Format a `file#line` location string from a dosai node or location item.
+ *
+ * @param {Object} item Dosai node, edge, or location object carrying Path/FileName and LineNumber fields
+ * @returns {string|undefined} Location string with a `#line` suffix when available, or undefined when no file is known
+ */
+export declare function dosaiLocation(item: Object): string | undefined;
+/**
+ * Return a validated source location for .NET source extensions, from a call graph node.
+ *
+ * @param {Object} node Dosai call graph node object
+ * @returns {string|undefined} Location string, or undefined unless the file is .cs/.vb/.fs/.fsx/.r with a positive line number
+ */
+export declare function dosaiSourceLocationFromNode(node: Object): string | undefined;
+/**
+ * Return a validated source location for .NET source extensions, from a location object.
+ *
+ * @param {Object} location Dosai location object carrying Path/FileName and LineNumber fields
+ * @returns {string|undefined} Location string, or undefined unless the file is .cs/.vb/.fs/.fsx/.r with a positive line number
+ */
+export declare function dosaiSourceLocation(location: Object): string | undefined;
+/**
+ * Build a purl alias map from BOM components.
+ *
+ * Maps both exact component purls and normalized type/namespace/name keys to
+ * the canonical component purl so dosai-reported purls can be reconciled.
+ *
+ * @param {Object[]} [components] Component objects with purl fields
+ * @returns {Map<string, string>} Map of purl or normalized key to canonical component purl
+ */
+export declare function buildDosaiPurlAliasMap(components?: Object[]): Map<string, string>;
+/**
+ * Resolve a purl to the canonical component purl via the alias map.
+ *
+ * @param {string} purl Purl reported by dosai
+ * @param {Map<string, string>} purlAliasMap Alias map built by buildDosaiPurlAliasMap
+ * @returns {string|undefined} Canonical component purl, the input purl when unaliased, or undefined when empty
+ */
+export declare function resolveDosaiComponentPurl(purl: string, purlAliasMap: Map<string, string>): string | undefined;
+//# sourceMappingURL=dosaiParsers.d.ts.map

package/types/lib/inventory/dosaiParsers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dosaiParsers.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dosaiParsers.js"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,GAAG,EAJ9B,MAI8B,EAAE,KAAK,EAHrC,MAGqC,GAFnC,IAAI,CAQhB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAHvB,MAGuB,GAFrB,MAAM,GAAC,SAAS,CAc5B;AAcD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,AAH9C,CACA,EADQ,MAAM,EAGqC,GAFzC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAe/B;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAJnC,MAImC,EAAE,YAAY,EAHjD,GAAG,CAAC,MAAM,EAAE,MAAM,CAG+B,GAF/C,MAAM,GAAC,SAAS,CAW5B"}

package/types/lib/inventory/dynamic.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Builds a flat list of CycloneDX component objects and services by executing
+ * the given command and inspecting which shared libraries it loads at runtime
+ * and which HTTP URLs it accesses.
+ *
+ * Each component receives:
+ *  - type: "library"
+ *  - scope: "required"  (loaded at runtime — definitely required)
+ *  - hashes: SHA-256 of the on-disk file
+ *  - evidence.identity[].methods[].technique: "instrumentation"
+ *  - confidence: 0.8 when the OS package manager reports a version, 0.5 otherwise
+ *
+ * Services are detected from HTTP request URLs collected during tracing and
+ * follow the CycloneDX service schema with endpoints.
+ *
+ * @param {string} commandStr - Shell command to execute and trace (e.g. "node --version")
+ * @param {string} workingDir - Working directory for the traced process
+ * @param {Object} [traceOptions] - Additional sandbox options forwarded to executeAndTrace
+ * @returns {Promise<{components: Array<Object>, services: Array<Object>}>} Components and services
+ */
+export declare function buildDynamicComponents(commandStr: string, workingDir: string, traceOptions?: Object): Promise<{
+    components: Array<Object>;
+    services: Array<Object>;
+}>;
+//# sourceMappingURL=dynamic.d.ts.map

package/types/lib/inventory/dynamic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dynamic.d.ts","sourceRoot":"","sources":["../../../lib/inventory/dynamic.js"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAND,MAMC,EACV,UAAU,EAND,MAMC,EACV,YAAY,AANX,CACA,EADQ,MAMQ,GALN,OAAO,CAAC;IAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAAC,CAAC,CAsHzE"}