@cdxgen/cdxgen 0.0.1 → 13.0.0

package/types/lib/inventory/fetchRate.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Per-host rate policy for batched registry fetches.
+ *
+ * This is the single source of truth for the JS transport's concurrency and
+ * minimum-interval decisions. The numbers are shared with the Rust transport
+ * (`cdxgen-plugins-bin/thirdparty/cdxrs/src/fetch/rate.rs`); a change to one
+ * side must be reflected in the other, and `fetchRate.poku.js` pins them so a
+ * drift is visible.
+ *
+ * Why a per-host table rather than a single global interval: a single-registry
+ * project — which is to say, almost every npm project — has exactly one host,
+ * so a conservative per-host cap *is* the global cap. Applying crates.io's
+ * 250 ms to every host caps an npm run at 4 requests per second, which is
+ * slower than the serial JS path once connection reuse is taken into account.
+ * Hosts that publish a limit get an interval; hosts that do not are bounded by
+ * the per-host concurrency cap alone, and by whatever `Retry-After` they send.
+ */
+export type Credentials = ("anonymous" | "authenticated");
+export type HostPolicy = {
+    /**
+     * Minimum gap between requests, in milliseconds.
+     */
+    minInterval: number;
+    /**
+     * Maximum requests in flight to this host.
+     */
+    maxConcurrency: number;
+};
+/**
+ * Concurrency allowed for a host with no published limit. Registries that are
+ * CDN-fronted document store fronts (npm, PyPI, RubyGems, NuGet, pub.dev) sit
+ * here; the global cap is what bounds them.
+ */
+export declare const DEFAULT_HOST_CONCURRENCY = 16;
+/**
+ * Global cap on in-flight requests across every host. Per-host caps cannot
+ * sum past this; a 16-way global batch saturates a large npm run without
+ * putting any single host above its published allowance.
+ */
+export declare const DEFAULT_GLOBAL_CONCURRENCY = 16;
+/**
+ * Resolve the credential class for a host based on the environment.
+ *
+ * Only token presence is considered, never its value. A host we hold no token
+ * for keeps the anonymous budget even if some other host has one. Today only
+ * GitHub tokens are honoured, matching the Rust client.
+ *
+ * @param {string} host The hostname to classify.
+ * @returns {Credentials}
+ */
+export declare function credentialsFor(host: string): Credentials;
+/**
+ * Resolve the published policy for a host, or the CDN default.
+ *
+ * @param {string} host The hostname.
+ * @param {Credentials} [credentials] Credential class; defaults to what the
+ *   environment would actually send to this host.
+ * @returns {HostPolicy}
+ */
+export declare function policyFor(host: string, credentials?: Credentials): HostPolicy;
+/**
+ * The table of published policies, exposed for the parity test. The shape is
+ * stable: changing an entry is a policy change that must be mirrored in
+ * `rate.rs`.
+ */
+export declare const PUBLISHED_HOST_POLICIES: {
+    host: string;
+    anonInterval: number;
+    anonConcurrency: number;
+    authInterval: number;
+    authConcurrency: number;
+}[];
+/**
+ * Create a minimum-interval gate for one host.
+ *
+ * `wait()` queues the caller so that successive calls are at least
+ * `minInterval` apart. `externalDelay()` pushes the gate out by a server-side
+ * back-off (`Retry-After`, `X-RateLimit-Reset`) and is counted.
+ */
+export declare class RateLimiter {
+    _minInterval: number;
+    _nextAvailable: number;
+    _externalDelays: number;
+    /**
+     * @param {number} minInterval Minimum gap between requests, in milliseconds.
+     */
+    constructor(minInterval: number);
+    /**
+     * Wait until this host's gate opens, then reserve the next slot. Callers
+     * that arrive while the gate is closed queue up rather than all being
+     * released together.
+     *
+     * @returns {Promise<void>}
+     */
+    wait(): Promise<void>;
+    /**
+     * Record a server-imposed delay and push the gate out to at least now plus
+     * the delay. The caller is still responsible for actually waiting before it
+     * retries; recording alone does not sleep.
+     *
+     * @param {number} delayMs Delay in milliseconds.
+     */
+    externalDelay(delayMs: number): void;
+    /** @returns {number} How many times this host asked us to slow down. */
+    get externalDelayCount(): number;
+}
+/**
+ * Create a counting semaphore with a FIFO wait queue. Used both for the global
+ * concurrency cap and the per-host cap.
+ *
+ * @param {number} limit Maximum simultaneous holders.
+ * @returns {{acquire: () => Promise<() => void>}} An `acquire` function that
+ *   resolves once a slot is free, with a `release` function as its value.
+ */
+export declare function makeSemaphore(limit: number): {
+    acquire: () => Promise<() => void>;
+};
+//# sourceMappingURL=fetchRate.d.ts.map

package/types/lib/inventory/fetchRate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetchRate.d.ts","sourceRoot":"","sources":["../../../lib/inventory/fetchRate.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAYA,YAAyC,WAAW,GAA1C,CAAC,WAAW,GAAC,eAAe,CAAC,CAAa;AAOpD,YAAkB,UAAU,GAC5B;;;;IAAmB,WAAW,EAAnB,MAAM,CACjB;;;;IAAmB,cAAc,EAAtB,MAAM,CACnB;CAAA,CAAA;AAsDD;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAHxB,MAGwB,GAFtB,WAAW,CAYvB;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,IAAI,EALnB,MAKmB,EAAE,WAAW,AAJxC,CAEA,EAFQ,WAIgC,GAF9B,UAAU,CAuBtB;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;;GAEjC,CAAC;AAEJ;;;;;;GAMG;AACH,qBAAa,WAAW;IAKf,YAAY;IACZ,cAAc;IACd,eAAe;IANtB;;OAEG;IACH,YAAY,WAAW,EAFZ,MAEY,EAItB;IAED;;;;;;OAMG;IACG,IAAI,IAFG,OAAO,CAAC,IAAI,CAAC,CAYzB;IAED;;;;;;OAMG;IACH,aAAa,CAAC,OAAO,EAFV,MAEU,QAMpB;IAED,wEAAwE;IACxE,IAAI,kBAAkB,IADR,MAAM,CAGnB;CACF;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAJxB,MAIwB,GAHtB;IAAC,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,IAAI,CAAC,CAAA;CAAC,CAwBhD"}

package/types/lib/inventory/forgeEnricher.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Parse a GitHub repository URL into its owner and repository name.
+ *
+ * Only accepts URLs where github.com is the actual host (rejecting spoofed
+ * hosts such as `https://evil.com/github.com/o/r`) and only git-safe path
+ * segments, so an untrusted remote URL cannot steer authenticated API requests.
+ *
+ * @param {string} url The git origin url
+ * @returns {{owner: string, repo: string}|null} Object containing owner and repo, or null
+ */
+export declare function parseGitHubUrl(url: string): {
+    owner: string;
+    repo: string;
+} | null;
+/**
+ * Parses GitLab repository origin URL to extract project path/ID.
+ *
+ * @param {string} url The git origin url
+ * @returns {string|null} The project path (owner/repo) or null
+ */
+export declare function parseGitLabUrl(url: string): string | null;
+/**
+ * Enriches AI commits with details from GitHub or GitLab API if tokens are present.
+ *
+ * @param {string} dir Root directory of the repository
+ * @param {Array<Object>} aiCommits List of AI commit objects
+ * @param {Object} options Options containing forgeToken or env context
+ * @returns {Promise<Object>} Object containing reviews list and authoritative flags
+ */
+export declare function enrichFromForge(dir: string, aiCommits: Array<Object>, options?: Object): Promise<Object>;
+//# sourceMappingURL=forgeEnricher.d.ts.map

package/types/lib/inventory/forgeEnricher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forgeEnricher.d.ts","sourceRoot":"","sources":["../../../lib/inventory/forgeEnricher.js"],"names":[],"mappings":"AAiDA;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,IAAI,CAa9C;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAL9B,MAK8B,EAAE,SAAS,EAJzC,KAAK,CAAC,MAAM,CAI6B,EAAE,OAAO,GAHlD,MAGuD,GAFrD,OAAO,CAAC,MAAM,CAAC,CA4M3B"}

package/types/lib/inventory/formulationParsers.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Register an external formulation parser.
+ *
+ * The parser is appended to the registry and will be invoked by
+ * {@link addFormulationSection} on the next call.
+ *
+ * @param {{ id: string, patterns: string[], parse: Function }} parser
+ */
+export declare function registerParser(parser: {
+    id: string;
+    patterns: string[];
+    parse: Function;
+}): void;
+/**
+ * Return a shallow copy of the currently registered parsers.
+ *
+ * @returns {Array<{ id: string, patterns: string[], parse: Function }>}
+ */
+export declare function getParsers(): Array<{
+    id: string;
+    patterns: string[];
+    parse: Function;
+}>;
+/**
+ * Build the formulation section for a CycloneDX BOM.
+ *
+ * This function is the top-level aggregator: it collects git metadata,
+ * invokes every registered CI parser, and merges the results into a single
+ * CycloneDX formulation entry.
+ *
+ * The function falls back to a minimal stub workflow when no CI config files
+ * are detected at the given path.
+ *
+ * @param {string} filePath         File path
+ * @param {Object} options          CLI options; `options.path` is used as the
+ *                                  project root for file discovery.
+ * @param {Object} [context={}]     Optional context object.  If it contains a
+ *                                  non-empty `formulationList` array those
+ *                                  components are merged into the result.
+ *
+ * @returns {{ formulation: Object[], dependencies: Object[] }}
+ *   `formulation` – array to be placed at `bomJson.formulation`
+ *   `dependencies` – dependency objects to be merged into
+ *                    `bomJson.dependencies` via `mergeDependencies`
+ */
+export declare function addFormulationSection(filePath: string, options: Object, context?: Object): {
+    formulation: Object[];
+    dependencies: Object[];
+};
+//# sourceMappingURL=formulationParsers.d.ts.map

package/types/lib/inventory/formulationParsers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"formulationParsers.d.ts","sourceRoot":"","sources":["../../../lib/inventory/formulationParsers.js"],"names":[],"mappings":"AA0GA;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAF1B;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,WAAU;CAEvB,QAkBpC;AAED;;;;GAIG;AACH,wBAAgB,UAAU,IAFb,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,WAAU;CAAE,CAAC,CAItE;AAgDD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAZnC,MAYmC,EAAE,OAAO,EAX5C,MAW4C,EAAE,OAAO,AAT7D,CAIA,EAJQ,MAS0D,GALxD;IAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CAuN7D"}

package/types/lib/inventory/gtfobins.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Look up GTFOBins metadata for a binary, falling back to its linked (symlink) name.
+ *
+ * @param {string} name Binary name to look up
+ * @param {string} [linkedName] Optional symlinked/linked binary name used as a fallback match
+ * @returns {Object|undefined} Metadata with canonicalName, contexts, functions, mitreTechniques,
+ * privilegedContexts, reference, riskTags, and source details, or undefined when unmatched
+ */
+export declare function getGtfoBinsMetadata(name: string, linkedName?: string): Object | undefined;
+/**
+ * Build `cdx:gtfobins:*` custom properties for a binary matched against the
+ * GTFOBins index.
+ *
+ * @param {string} name Binary name to look up
+ * @param {string} [linkedName] Optional symlinked/linked binary name used as a fallback match
+ * @returns {Object[]} CycloneDX custom properties; empty when the binary is not matched
+ */
+export declare function createGtfoBinsProperties(name: string, linkedName?: string): Object[];
+/**
+ * Resolve GTFOBins properties for a live Linux osquery row.
+ *
+ * @param {string} queryCategory Osquery query category
+ * @param {object} row Osquery row
+ * @returns {Array<object>} CycloneDX custom properties
+ */
+export declare function createGtfoBinsPropertiesFromRow(queryCategory: string, row: object): Array<object>;
+//# sourceMappingURL=gtfobins.d.ts.map

package/types/lib/inventory/gtfobins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gtfobins.d.ts","sourceRoot":"","sources":["../../../lib/inventory/gtfobins.js"],"names":[],"mappings":"AAwJA;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAL7B,MAK6B,EAAE,UAAU,AAJjD,CACA,EADQ,MAIyC,GAHvC,MAAM,GAAC,SAAS,CAyC5B;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,UAAU,AAHtD,CACA,EADQ,MAG8C,GAF5C,MAAM,EAAE,CAmCpB;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,aAAa,EAJlD,MAIkD,EAAE,GAAG,EAHvD,MAGuD,GAFrD,KAAK,CAAC,MAAM,CAAC,CA0FzB"}

package/types/lib/inventory/hbom.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Determine whether the supplied project types include HBOM.
+ *
+ * @param {string|string[]|undefined|null} projectTypes Project types.
+ * @returns {boolean} True when HBOM is requested.
+ */
+export declare function hasHbomProjectType(projectTypes: string | string[] | undefined | null): boolean;
+/**
+ * Determine whether the supplied project types are exclusively HBOM-oriented.
+ *
+ * @param {string|string[]|undefined|null} projectTypes Project types.
+ * @returns {boolean} True when at least one project type is supplied and all are HBOM-oriented.
+ */
+export declare function isHbomOnlyProjectTypes(projectTypes: string | string[] | undefined | null): boolean;
+/**
+ * Reject mixed HBOM and non-HBOM project types.
+ *
+ * @param {string|string[]|undefined|null} projectTypes Project types.
+ */
+export declare function ensureNoMixedHbomProjectTypes(projectTypes: string | string[] | undefined | null): void;
+/**
+ * Ensure HBOM generation uses the supported CycloneDX version.
+ *
+ * @param {number|string|undefined|null} specVersion Requested spec version.
+ */
+export declare function ensureSupportedHbomSpecVersion(specVersion: number | string | undefined | null): void;
+/**
+ * Ensure merged HBOM + runtime collection has access to osquery.
+ *
+ * @param {object} [options={}] CLI options.
+ * @param {string} [commandName="hbom"] Invoked command name for tailored guidance.
+ */
+export declare function ensureHbomRuntimeSupport(options?: object, commandName?: string): void;
+/**
+ * Translate cdxgen CLI options to cdx-hbom collector options.
+ *
+ * @param {object} [options={}] CLI options.
+ * @returns {object} cdx-hbom collector options.
+ */
+export declare function normalizeHbomOptions(options?: object): object;
+/**
+ * Recompute and attach `cdx:hbom:analysis:*` summary properties to an HBOM.
+ *
+ * Existing analysis properties are dropped and rebuilt from the BOM's
+ * `cdx:hbom:evidence:commandDiagnostic` payload.
+ *
+ * @param {Object} bomJson CycloneDX HBOM document
+ * @returns {Object} The same BOM with refreshed analysis properties
+ */
+export declare function addHbomAnalysisProperties(bomJson: Object): Object;
+/**
+ * Generate an HBOM using the optional cdx-hbom package.
+ *
+ * @param {object} [options={}] CLI options.
+ * @returns {Promise<object>} CycloneDX HBOM document.
+ */
+export declare function createHbomDocument(options?: object): Promise<object>;
+//# sourceMappingURL=hbom.d.ts.map

package/types/lib/inventory/hbom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hbom.d.ts","sourceRoot":"","sources":["../../../lib/inventory/hbom.js"],"names":[],"mappings":"AAwSA;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAHpC,MAAM,GAAC,MAAM,EAAE,GAAC,SAAS,GAAC,IAGU,GAFlC,OAAO,CAMnB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,YAAY,EAHxC,MAAM,GAAC,MAAM,EAAE,GAAC,SAAS,GAAC,IAGc,GAFtC,OAAO,CAUnB;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,YAAY,EAF/C,MAAM,GAAC,MAAM,EAAE,GAAC,SAAS,GAAC,IAEqB,QAgBzD;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,WAAW,EAF/C,MAAM,GAAC,MAAM,GAAC,SAAS,GAAC,IAEuB,QAOzD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,AAH7C,CACA,EADQ,MAG0C,EAAE,WAAW,AAF/D,CACF,EADU,MAEgE,QAmB1E;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,AAHzC,CACA,EADQ,MAGsC,GAFpC,MAAM,CA2BlB;AA8GD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAHtC,MAGsC,GAFpC,MAAM,CA8HlB;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,AAH7C,CACA,EADQ,MAG0C,GAFxC,OAAO,CAAC,MAAM,CAAC,CAiC3B"}

package/types/lib/inventory/hbomAnalysis.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Parse command diagnostic values carried as `cdx:hbom:evidence:commandDiagnostic` properties.
+ *
+ * @param {Object} bomJson CycloneDX HBOM document
+ * @returns {Object[]} Parsed command diagnostic objects, skipping unparseable entries
+ */
+export declare function getHbomCommandDiagnostics(bomJson: Object): Object[];
+/**
+ * Summarize HBOM command diagnostics by issue kind with counts and identifiers.
+ *
+ * @param {Object} bomJson CycloneDX HBOM document
+ * @returns {Object} Summary with per-issue counts, sorted command/id/hint lists, and a `requiresPrivilegedEnrichment` flag
+ */
+export declare function getHbomCommandDiagnosticSummary(bomJson: Object): Object;
+/**
+ * Determine whether a BOM carries HBOM markers (`cdx:hbom:*` properties).
+ *
+ * @param {Object} bomJson CycloneDX BOM document
+ * @returns {boolean} `true` when the BOM looks like an HBOM
+ */
+export declare function isHbomLikeBom(bomJson: Object): boolean;
+/**
+ * Return a component's `cdx:hbom:hardwareClass` property value.
+ *
+ * @param {Object} component CycloneDX component
+ * @returns {string|undefined} Hardware class value when present
+ */
+export declare function getHbomHardwareClass(component: Object): string | undefined;
+/**
+ * Count components per `cdx:hbom:hardwareClass`, sorted by count descending.
+ *
+ * @param {Object[]} [components=[]] CycloneDX components
+ * @returns {{hardwareClass: string, count: number}[]} Sorted hardware class counts
+ */
+export declare function getHbomHardwareClassCounts(components?: Object[]): {
+    hardwareClass: string;
+    count: number;
+}[];
+/**
+ * Format the top hardware-class counts as a `class (count)` comma-separated string.
+ *
+ * @param {{hardwareClass: string, count: number}[]} [hardwareClassCounts=[]] Hardware class counts
+ * @returns {string} Summary string covering at most five entries
+ */
+export declare function formatHbomHardwareClassSummary(hardwareClassCounts?: {
+    hardwareClass: string;
+    count: number;
+}[]): string;
+/**
+ * Build an overall HBOM summary from metadata, components, evidence, and diagnostics.
+ *
+ * @param {Object} bomJson CycloneDX HBOM document
+ * @returns {Object} HBOM summary with collector profile, platform, architecture, hardware class counts, evidence counts, and command diagnostic details
+ */
+export declare function getHbomSummary(bomJson: Object): Object;
+//# sourceMappingURL=hbomAnalysis.d.ts.map

package/types/lib/inventory/hbomAnalysis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hbomAnalysis.d.ts","sourceRoot":"","sources":["../../../lib/inventory/hbomAnalysis.js"],"names":[],"mappings":"AAoDA;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAHtC,MAGsC,GAFpC,MAAM,EAAE,CAMpB;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAH5C,MAG4C,GAF1C,MAAM,CAuElB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,OAAO,CA6BnB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAI5B;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,AAHlD,CACA,EADQ,MAAM,EAGyC,GAF7C;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAkBpD;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,mBAAmB,AAH/D,CACA,EADQ;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAGsB,GAF1D,MAAM,CAOlB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAH3B,MAG2B,GAFzB,MAAM,CAkFlB"}

package/types/lib/inventory/hbomLoader.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Resolve the optional cdx-hbom module.
+ *
+ * @returns {Promise<object>} Loaded cdx-hbom module namespace.
+ */
+export declare function importHbomModule(): Promise<object>;
+//# sourceMappingURL=hbomLoader.d.ts.map

package/types/lib/inventory/hbomLoader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hbomLoader.d.ts","sourceRoot":"","sources":["../../../lib/inventory/hbomLoader.js"],"names":[],"mappings":"AAUA;;;;GAIG;AACH,wBAAsB,gBAAgB,IAFzB,OAAO,CAAC,MAAM,CAAC,CAqB3B"}

package/types/lib/inventory/hostTopology.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Determine whether a BOM is a merged HBOM+OBOM host view.
+ *
+ * @param {Object} bomJson CycloneDX BOM document
+ * @returns {boolean} `true` when the BOM declares the merged host-view mode or mixes HBOM components with osquery runtime components
+ */
+export declare function isMergedHostViewBom(bomJson: Object): boolean;
+/**
+ * Extract `cdx:hostview:*` summary values from a host-view BOM.
+ *
+ * @param {Object} bomJson CycloneDX BOM document
+ * @returns {{linkedHardwareComponentCount: number, linkedRuntimeCategories: string[], mode: string|undefined, runtimeAnchorCount: number, runtimeComponentCount: number, topologyLinkCount: number}} Host view summary
+ */
+export declare function getHostViewSummary(bomJson: Object): {
+    linkedHardwareComponentCount: number;
+    linkedRuntimeCategories: string[];
+    mode: string | undefined;
+    runtimeAnchorCount: number;
+    runtimeComponentCount: number;
+    topologyLinkCount: number;
+};
+/**
+ * Annotate an HBOM with host-inventory topology links.
+ *
+ * Links osquery runtime components and host anchor components to hardware
+ * components through dependency edges and rebuilds the `cdx:hostview:*`
+ * summary properties.
+ *
+ * @param {Object} bomJson CycloneDX HBOM document
+ * @returns {Object} The annotated BOM, returned unchanged when the BOM is not HBOM-like
+ */
+export declare function applyHostInventoryTopology(bomJson: Object): Object;
+/**
+ * Merge an HBOM with OBOM runtime data into a single host-view BOM.
+ *
+ * Combines components, dependencies, services, and metadata from both BOMs,
+ * then applies host-inventory topology annotations to the merged result.
+ *
+ * @param {Object} hbomJson CycloneDX HBOM document
+ * @param {{bomJson?: Object, parentComponent?: Object}} obomData OBOM result carrying its BOM document and optional parent component
+ * @returns {Object} Merged host-view BOM, or the HBOM alone when OBOM data is absent
+ */
+export declare function mergeHostInventoryBoms(hbomJson: Object, obomData: {
+    bomJson?: Object;
+    parentComponent?: Object;
+}): Object;
+//# sourceMappingURL=hostTopology.d.ts.map

package/types/lib/inventory/hostTopology.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostTopology.d.ts","sourceRoot":"","sources":["../../../lib/inventory/hostTopology.js"],"names":[],"mappings":"AA2mBA;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,GAF9B,OAAO,CAUnB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAH/B,MAG+B,GAF7B;IAAC,4BAA4B,EAAE,MAAM,CAAC;IAAC,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,GAAC,SAAS,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAC;IAAC,qBAAqB,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAC,CA0BnM;AAYD;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAHvC,MAGuC,GAFrC,MAAM,CAiFlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAJpC,MAIoC,EAAE,QAAQ,EAH9C;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAGG,GAF5C,MAAM,CA0DlB"}

package/types/lib/inventory/inventoryStats.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Return the value of a named CycloneDX property.
+ *
+ * @param {Object[]|Object} propertiesOrObject Property array or an object with a `properties` array
+ * @param {string} propertyName Property name to look up
+ * @returns {string|undefined} First matching property value, or undefined when absent
+ */
+export declare function getPropertyValue(propertiesOrObject: Object[] | Object, propertyName: string): string | undefined;
+/**
+ * Filter components down to unpackaged executable file components.
+ *
+ * @param {Object[]} [components=[]] CycloneDX components
+ * @returns {Object[]} File components flagged `internal:is_executable=true`
+ */
+export declare function getUnpackagedExecutableComponents(components?: Object[]): Object[];
+/**
+ * Filter components down to unpackaged shared-library file components.
+ *
+ * @param {Object[]} [components=[]] CycloneDX components
+ * @returns {Object[]} File components flagged `internal:is_shared_library=true`
+ */
+export declare function getUnpackagedSharedLibraryComponents(components?: Object[]): Object[];
+/**
+ * Filter components down to source-derived (js-ast) cryptographic-asset components.
+ *
+ * @param {Object[]} [components=[]] CycloneDX components
+ * @returns {Object[]} Crypto assets whose `cdx:crypto:sourceType` starts with `js-ast:`
+ */
+export declare function getSourceDerivedCryptoComponents(components?: Object[]): Object[];
+/**
+ * Compute counts and lists of unpackaged executables and shared libraries.
+ *
+ * @param {Object[]} [components=[]] CycloneDX components
+ * @returns {{unpackagedExecutables: Object[], unpackagedSharedLibraries: Object[], unpackagedExecutableCount: number, unpackagedSharedLibraryCount: number}} Container file inventory stats
+ */
+export declare function getContainerFileInventoryStats(components?: Object[]): {
+    unpackagedExecutables: Object[];
+    unpackagedSharedLibraries: Object[];
+    unpackagedExecutableCount: number;
+    unpackagedSharedLibraryCount: number;
+};
+//# sourceMappingURL=inventoryStats.d.ts.map

package/types/lib/inventory/inventoryStats.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventoryStats.d.ts","sourceRoot":"","sources":["../../../lib/inventory/inventoryStats.js"],"names":[],"mappings":"AAUA;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,kBAAkB,EAJxC,MAAM,EAAE,GAAC,MAI+B,EAAE,YAAY,EAHtD,MAGsD,GAFpD,MAAM,GAAC,SAAS,CAM5B;AAkBD;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAAC,UAAU,AAHzD,CACA,EADQ,MAAM,EAGgD,GAFpD,MAAM,EAAE,CAQpB;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAAC,UAAU,AAH5D,CACA,EADQ,MAAM,EAGmD,GAFvD,MAAM,EAAE,CAQpB;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,UAAU,AAHxD,CACA,EADQ,MAAM,EAG+C,GAFnD,MAAM,EAAE,CAUpB;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,AAHtD,CACA,EADQ,MAAM,EAG6C,GAFjD;IAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAAC,yBAAyB,EAAE,MAAM,EAAE,CAAC;IAAC,yBAAyB,EAAE,MAAM,CAAC;IAAC,4BAA4B,EAAE,MAAM,CAAA;CAAC,CAY3J"}

package/types/lib/inventory/jsonLike.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Strip line (`//`) and block comments from JSON-like text without altering
+ * string literals.
+ *
+ * @param {string} raw Raw JSON-like text
+ * @returns {string} Text with comments removed
+ */
+export declare function stripJsonComments(raw: string): string;
+/**
+ * Remove trailing commas before `}` or `]` without altering string literals.
+ *
+ * @param {string} raw Raw JSON-like text
+ * @returns {string} Text with trailing commas removed
+ */
+export declare function stripJsonTrailingCommas(raw: string): string;
+/**
+ * Parse JSONC/JSON5-like text (comments and trailing commas allowed) into a value.
+ *
+ * @param {string} raw Raw JSON-like text
+ * @returns {*} Parsed value; throws when the normalized text is not valid JSON
+ */
+export declare function parseJsonLike(raw: string): any;
+//# sourceMappingURL=jsonLike.d.ts.map

package/types/lib/inventory/jsonLike.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonLike.d.ts","sourceRoot":"","sources":["../../../lib/inventory/jsonLike.js"],"names":[],"mappings":"AAmBA;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAH1B,MAG0B,GAFxB,MAAM,CA8ClB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAHhC,MAGgC,GAF9B,MAAM,CAkClB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAHtB,MAGsB,GAFpB,GAAC,CAIb"}

package/types/lib/inventory/licenseEnhancer.d.ts

@@ -0,0 +1,70 @@
+import { parseSpdxExpression } from "./spdxExpression.js";
+/**
+ * Parses a compliance policy file.
+ *
+ * @param {string} policyPath Path to policy file
+ * @returns {object|null} Parsed policy object
+ */
+export declare function loadPolicy(policyPath: string): object | null;
+export { parseSpdxExpression };
+/**
+ * Resolves a raw license ID or expression to a CycloneDX license object shape.
+ *
+ * @param {string} raw Raw license string
+ * @param {object} opts Options
+ * @returns {object|null} Resolved license object: { id } or { expression } or { name }
+ */
+export declare function resolveLicenseId(raw: string, opts?: object): object | null;
+/**
+ * Upgrades deprecated SPDX license identifiers or expressions.
+ *
+ * @param {string} idOrExpr License ID or expression
+ * @returns {string} Upgraded identifier or expression
+ */
+export declare function upgradeDeprecated(idOrExpr: string): string;
+/**
+ * Normalizes a single CycloneDX license object or string.
+ *
+ * @param {object|string} license License object or string
+ * @param {object} opts Options
+ * @returns {object} Normalized license object
+ */
+export declare function normalizeLicense(license: object | string, opts?: object): object;
+/**
+ * Normalizes and deduplicates a component's licenses array.
+ *
+ * @param {object} component CycloneDX Component
+ * @param {object} opts Options
+ * @returns {object} Modified component
+ */
+export declare function enhanceComponentLicenses(component: object, opts?: object): object;
+/**
+ * Opt-in: enriches a license object with metadata properties and compliance policy.
+ *
+ * @param {object} licenseWrapper License wrapper object
+ * @param {object} policy Compliance policy
+ * @param {object} opts Options
+ * @returns {object} Enriched license wrapper
+ */
+export declare function enrichLicenseMetadata(licenseWrapper: object, policy: object, _opts?: {}): object;
+/**
+ * Walks a whole BOM and enhances all metadata and component licenses.
+ *
+ * @param {object} bom CycloneDX BOM JSON Object
+ * @param {object} opts Options
+ * @returns {object} Enhanced BOM
+ */
+export declare function enhanceBom(bom: object, opts?: object): object;
+/**
+ * Walks every component license in a BOM and returns the entries that violate
+ * the supplied compliance policy (alert `error`, or `warning` when
+ * `includeWarnings` is set). Recurses into nested components and the metadata
+ * component.
+ *
+ * @param {object} bom CycloneDX BOM
+ * @param {object} policy Parsed policy object (see loadPolicy)
+ * @param {object} [opts] { includeWarnings?: boolean }
+ * @returns {object[]} Violations: { ref, name, version, license, category, alert }
+ */
+export declare function collectPolicyViolations(bom: object, policy: object, opts?: object): object[];
+//# sourceMappingURL=licenseEnhancer.d.ts.map

package/types/lib/inventory/licenseEnhancer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"licenseEnhancer.d.ts","sourceRoot":"","sources":["../../../lib/inventory/licenseEnhancer.js"],"names":[],"mappings":"AAOA,OAAO,EAIL,mBAAmB,EAIpB,MAAM,qBAAqB,CAAC;AAkF7B;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAH1B,MAG0B,GAFxB,MAAM,GAAC,IAAI,CAavB;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAJzB,MAIyB,EAAE,IAAI,GAH/B,MAGoC,GAFlC,MAAM,GAAC,IAAI,CAwFvB;AAgBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,CA8BlB;AA0DD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAJ7B,MAAM,GAAC,MAIsB,EAAE,IAAI,GAHnC,MAGwC,GAFtC,MAAM,CAqFlB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAJvC,MAIuC,EAAE,IAAI,GAH7C,MAGkD,GAFhD,MAAM,CA4ClB;AAoGD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,cAAc,EALzC,MAKyC,EAAE,MAAM,EAJjD,MAIiD,EAAE,KAAK,KAAK,GAF3D,MAAM,CAyElB;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAJnB,MAImB,EAAE,IAAI,GAHzB,MAG8B,GAF5B,MAAM,CAgDlB;AA4KD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,MAAM,EAJxC,MAIwC,EAAE,IAAI,AAHtD,CACA,EADQ,MAGmD,GAFjD,MAAM,EAAE,CA0CpB"}

package/types/lib/inventory/lolbas.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Resolve LOLBAS metadata for a binary or script name.
+ *
+ * @param {string} candidate Binary or script path/name
+ * @returns {object|undefined} Matched LOLBAS metadata
+ */
+export declare function getLolbasMetadata(candidate: string): object | undefined;
+/**
+ * Resolve LOLBAS properties for an osquery row.
+ *
+ * @param {string} queryCategory Osquery query category
+ * @param {object} row Osquery row
+ * @returns {Array<object>} CycloneDX custom properties
+ */
+export declare function createLolbasProperties(queryCategory: string, row: object): Array<object>;
+//# sourceMappingURL=lolbas.d.ts.map

package/types/lib/inventory/lolbas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lolbas.d.ts","sourceRoot":"","sources":["../../../lib/inventory/lolbas.js"],"names":[],"mappings":"AA2JA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAHhC,MAGgC,GAF9B,MAAM,GAAC,SAAS,CAqB5B;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,aAAa,EAJzC,MAIyC,EAAE,GAAG,EAH9C,MAG8C,GAF5C,KAAK,CAAC,MAAM,CAAC,CAiGzB"}

package/types/lib/inventory/mcp.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Classify a package/component/import reference as MCP-related.
+ *
+ * @param {Object|string} ref Package/component reference or import source
+ * @returns {{
+ *   isMcp: boolean,
+ *   isOfficial: boolean,
+ *   isKnownIntegration: boolean,
+ *   role: string | undefined,
+ *   catalogSource: string | undefined,
+ *   packageName: string
+ * }}
+ */
+export declare function classifyMcpReference(ref: Object | string): {
+    isMcp: boolean;
+    isOfficial: boolean;
+    isKnownIntegration: boolean;
+    role: string | undefined;
+    catalogSource: string | undefined;
+    packageName: string;
+};
+/**
+ * Add MCP catalog metadata to a CycloneDX component.
+ *
+ * @param {Object} component CycloneDX component
+ * @returns {Object} Same component reference
+ */
+export declare function enrichComponentWithMcpMetadata(component: Object): Object;
+//# sourceMappingURL=mcp.d.ts.map

package/types/lib/inventory/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../../lib/inventory/mcp.js"],"names":[],"mappings":"AAsFA;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAV7B,MAAM,GAAC,MAUsB,GAT3B;IACR,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,OAAO,CAAC;IACpB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,WAAW,EAAE,MAAM,CAAA;CACpB,CA8EH;AAYD;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAH7C,MAG6C,GAF3C,MAAM,CA6DlB"}