@cdxgen/cdxgen 0.0.1 → 13.0.0

package/types/lib/inventory/mcpConfigParser.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Parser for MCP (Model Context Protocol) client configuration files.
+ *
+ * Matches common MCP config file names (`.mcp.json`, `mcp.json`,
+ * `claude_desktop_config.json`, `opencode.json[c]`, and editor-specific
+ * variants) and converts each configured server into a CycloneDX service plus
+ * a file component carrying credential-exposure, hidden-unicode, and transport
+ * properties.
+ *
+ * @type {{id: string, patterns: string[], parse(files: string[], options?: Object): {components: Object[], services: Object[]}}}
+ */
+export declare const mcpConfigParser: {
+    id: string;
+    patterns: string[];
+    parse(files: string[], options?: Object): {
+        components: Object[];
+        services: Object[];
+    };
+};
+//# sourceMappingURL=mcpConfigParser.d.ts.map

package/types/lib/inventory/mcpConfigParser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpConfigParser.d.ts","sourceRoot":"","sources":["../../../lib/inventory/mcpConfigParser.js"],"names":[],"mappings":"AAknBA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,EAFlB;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAC,CAAA;CA+C9H,CAAC"}

package/types/lib/inventory/mcpDiscovery.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Normalize a string into a safe MCP reference token.
+ *
+ * NFKC-normalizes, lowercases, collapses separator runs, strips leading and
+ * trailing punctuation, and truncates to 128 characters, falling back to
+ * `unknown` for empty or dot-only results.
+ *
+ * @param {string} value Raw token value
+ * @returns {string} Sanitized reference token
+ */
+export declare function sanitizeMcpRefToken(value: string): string;
+/**
+ * Determine whether a hostname is local: `localhost`, loopback, link-local, or a private address range.
+ *
+ * @param {string} hostname Hostname or IP address
+ * @returns {boolean} `true` when the host resolves to a local or private address
+ */
+export declare function isLocalHost(hostname: string): boolean;
+/**
+ * Return the AI provider names whose detection patterns match the given text.
+ *
+ * @param {string} text Text to scan
+ * @returns {string[]} Matching provider names (e.g. `anthropic`, `openai`)
+ */
+export declare function providerNamesForText(text: string): string[];
+/**
+ * Return the credential-indicator names whose patterns match the given text.
+ *
+ * @param {string} text Text to scan
+ * @returns {string[]} Matching indicator names (e.g. `github-token`, `bearer-token`)
+ */
+export declare function credentialIndicatorsForText(text: string): string[];
+//# sourceMappingURL=mcpDiscovery.d.ts.map

package/types/lib/inventory/mcpDiscovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpDiscovery.d.ts","sourceRoot":"","sources":["../../../lib/inventory/mcpDiscovery.js"],"names":[],"mappings":"AAkBA;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAH9B,MAG8B,GAF5B,MAAM,CAiBlB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAHzB,MAGyB,GAFvB,OAAO,CA8BnB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B,MAAM,EAAE,CAUpB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAHrC,MAGqC,GAFnC,MAAM,EAAE,CAUpB"}

package/types/lib/inventory/mcpPinning.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Apply experimental MCP pinning/composition properties. Mutates `bomJson` in
+ * place and returns citation hints for the registry-attributed integrity. The
+ * caller is responsible for emitting citations only at spec version 1.7+.
+ *
+ * @param {Object} bomJson CycloneDX BOM
+ * @param {Object} [options] CLI options
+ * @returns {Object[]} Citation hints produced by the enrichment
+ */
+export declare function applyMcpPinningState(bomJson: Object, options?: Object): Object[];
+//# sourceMappingURL=mcpPinning.d.ts.map

package/types/lib/inventory/mcpPinning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpPinning.d.ts","sourceRoot":"","sources":["../../../lib/inventory/mcpPinning.js"],"names":[],"mappings":"AAoIA;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAJjC,MAIiC,EAAE,OAAO,AAHlD,CACA,EADQ,MAG+C,GAF7C,MAAM,EAAE,CAqEpB"}

package/types/lib/inventory/osPackageResolver.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Reset all OS package resolver caches. Exported for unit tests only.
+ */
+export declare function _resetOsInfoCache(): void;
+/**
+ * Resolves a file path to its owning OS package manager package, including a
+ * correctly computed purl with distro qualifiers derived from /etc/os-release.
+ *
+ * @param {string} filePath - Absolute path to the library file
+ * @returns {{ name: string, version: string, arch: string, type: string, purl: string } | undefined}
+ */
+export declare function resolvePackageForFile(filePath: string): {
+    name: string;
+    version: string;
+    arch: string;
+    type: string;
+    purl: string;
+} | undefined;
+/**
+ * Find the OS package component that provides a given file, by searching the
+ * `internal:PkgProvides` property of each package in the OS package list.
+ *
+ * @param {string} afile Filename or path to look up (matched case-insensitively)
+ * @param {Object[]} osPkgsList Array of OS package component objects to search
+ * @returns {Object|undefined} The matching OS package component, or undefined if not found
+ */
+export declare function getOSPackageForFile(afile: string, osPkgsList: Object[]): Object | undefined;
+/**
+ * Collect all executable files from the given list of binary paths
+ *
+ * @param basePath Base directory
+ * @param binPaths {Array[String]} Paths containing potential binaries
+ * @param excludePaths {Array[String]} Container-relative paths that should be excluded from the result set
+ * @return {Array[String]} List of executables
+ */
+export declare function collectExecutables(basePath: any, binPaths: any, excludePaths?: any): any;
+/**
+ * Collect all shared library files from the given list of paths
+ *
+ * @param basePath Base directory
+ * @param libPaths {Array[String]} Paths containing potential libraries
+ * @param ldConf {String} Config file used by ldconfig to locate additional paths
+ * @param ldConfDirPattern {String} Config directory that can contain more .conf files for ldconfig
+ * @param excludePaths {Array[String]} Container-relative paths that should be excluded from the result set
+ *
+ * @return {Array[String]} List of executables
+ */
+export declare function collectSharedLibs(basePath: any, libPaths: any, ldConf: string, ldConfDirPattern: string, excludePaths?: any): any;
+//# sourceMappingURL=osPackageResolver.d.ts.map

package/types/lib/inventory/osPackageResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"osPackageResolver.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osPackageResolver.js"],"names":[],"mappings":"AAwBA;;GAEG;AACH,wBAAgB,iBAAiB,SAGhC;AA8ED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA8BnG;AAoGD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAJ9B,MAI8B,EAAE,UAAU,EAH1C,MAAM,EAGoC,GAFxC,MAAM,GAAC,SAAS,CA+B5B;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,KAAA,EAAE,QAAQ,KAAA,EAAE,YAAY,MAAK,OAqEvE;AAcD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,KAAA,EACR,QAAQ,KAAA,EACR,MAAM,QAAA,EACN,gBAAgB,QAAA,EAChB,YAAY,MAAK,OA8ElB"}

package/types/lib/inventory/osinfo.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Ubuntu / Debian codename map and RHEL display-name aliases.
+ * Keep this list updated every year.
+ */
+export declare const OS_DISTRO_ALIAS: {
+    "ubuntu-4.10": string;
+    "ubuntu-5.04": string;
+    "ubuntu-5.10": string;
+    "ubuntu-6.06": string;
+    "ubuntu-6.10": string;
+    "ubuntu-7.04": string;
+    "ubuntu-7.10": string;
+    "ubuntu-8.04": string;
+    "ubuntu-8.10": string;
+    "ubuntu-9.04": string;
+    "ubuntu-9.10": string;
+    "ubuntu-10.04": string;
+    "ubuntu-10.10": string;
+    "ubuntu-11.04": string;
+    "ubuntu-11.10": string;
+    "ubuntu-12.04": string;
+    "ubuntu-12.10": string;
+    "ubuntu-13.04": string;
+    "ubuntu-13.10": string;
+    "ubuntu-14.04": string;
+    "ubuntu-14.10": string;
+    "ubuntu-15.04": string;
+    "ubuntu-15.10": string;
+    "ubuntu-16.04": string;
+    "ubuntu-16.10": string;
+    "ubuntu-17.04": string;
+    "ubuntu-17.10": string;
+    "ubuntu-18.04": string;
+    "ubuntu-18.10": string;
+    "ubuntu-19.04": string;
+    "ubuntu-19.10": string;
+    "ubuntu-20.04": string;
+    "ubuntu-20.10": string;
+    "ubuntu-21.04": string;
+    "ubuntu-21.10": string;
+    "ubuntu-22.04": string;
+    "ubuntu-22.10": string;
+    "ubuntu-23.04": string;
+    "ubuntu-23.10": string;
+    "ubuntu-24.04": string;
+    "ubuntu-24.10": string;
+    "ubuntu-25.04": string;
+    "ubuntu-25.10": string;
+    "debian-15": string;
+    "debian-14": string;
+    "debian-14.5": string;
+    "debian-13": string;
+    "debian-13.5": string;
+    "debian-12": string;
+    "debian-12.5": string;
+    "debian-12.6": string;
+    "debian-11": string;
+    "debian-11.5": string;
+    "debian-10": string;
+    "debian-10.5": string;
+    "debian-9": string;
+    "debian-9.5": string;
+    "debian-8": string;
+    "debian-8.5": string;
+    "debian-7": string;
+    "debian-7.5": string;
+    "debian-6": string;
+    "debian-5": string;
+    "debian-4": string;
+    "debian-3.1": string;
+    "debian-3": string;
+    "debian-2.2": string;
+    "debian-2.1": string;
+    "debian-2": string;
+    "debian-1.3": string;
+    "debian-1.2": string;
+    "debian-1.1": string;
+    "red hat enterprise linux": string;
+    "red hat enterprise linux 6": string;
+    "red hat enterprise linux 7": string;
+    "red hat enterprise linux 8": string;
+    "red hat enterprise linux 9": string;
+    "red hat enterprise linux 10": string;
+};
+/**
+ * Parse an os-release file from an arbitrary root path and return a plain
+ * key→value object.  Results are cached per root path so the file is read
+ * at most once per process per distinct root.
+ *
+ * @param {string} [root="/"] - Root of the filesystem to search (e.g. a
+ *   container rootfs extracted to a temp directory, or "/" for the live host).
+ * @returns {Object} Raw key/value pairs from the os-release file.
+ */
+export declare function readOsRelease(root?: string): Object;
+/**
+ * Reset the per-root os-release cache. Exported for unit tests only.
+ */
+export declare function _resetOsReleaseCache(): void;
+/**
+ * Derive structured distro information from an os-release file.
+ *
+ * Returns an object with:
+ *   - purlType    {string}  "deb" | "apk" | "rpm"
+ *   - namespace   {string}  purl namespace (e.g. "ubuntu", "alpine", "fedora")
+ *   - distroId    {string}  ID + "-" + VERSION_ID  (e.g. "ubuntu-22.04")
+ *   - distroName  {string}  codename/alias          (e.g. "jammy")
+ *
+ * Mirrors the logic in lib/managers/binary.js getOSPackages() so that both
+ * callers share a single implementation.
+ *
+ * @param {string} [root="/"] - Filesystem root to look for os-release.
+ * @returns {{ purlType: string, namespace: string, distroId: string, distroName: string }}
+ */
+export declare function getDistroInfo(root?: string): {
+    purlType: string;
+    namespace: string;
+    distroId: string;
+    distroName: string;
+};
+//# sourceMappingURL=osinfo.d.ts.map

package/types/lib/inventory/osinfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"osinfo.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osinfo.js"],"names":[],"mappings":"AAGA;;;GAGG;AACH,eAAO,MAAM,eAAe;IAC1B,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,WAAW;IACX,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,UAAU;IACV,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,0BAA0B;IAC1B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,6BAA6B;CAC9B,CAAC;AAQF;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAJ/B,CAEA,EAFQ,MAI6B,GAF3B,MAAM,CAqClB;AAGD;;GAEG;AACH,wBAAgB,oBAAoB,SAEnC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAH/B,CACA,EADQ,MAG6B,GAF3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAmHzF"}

package/types/lib/inventory/osqueryTransform.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Derive a version value from an osquery result row.
+ *
+ * Falls back through alternate row fields (e.g. `hotfix_id`, `port`, `pid`)
+ * that carry version-like values for the given query category.
+ *
+ * @param {Object} res osquery result row
+ * @returns {string|undefined} First present version-like field value
+ */
+export declare function deriveOsQueryVersion(res: Object): string | undefined;
+/**
+ * Derive a name value from an osquery result row.
+ *
+ * @param {Object} res osquery result row
+ * @param {boolean} singleResult Whether the query returned exactly one row
+ * @param {string} queryName Query name used as a fallback name for single-result queries
+ * @returns {string|undefined} First present name-like field value
+ */
+export declare function deriveOsQueryName(res: Object, singleResult: boolean, queryName: string): string | undefined;
+/**
+ * Derive a publisher value from an osquery result row.
+ *
+ * @param {Object} res osquery result row
+ * @returns {string} Publisher-like value, or an empty string when absent or literal `"null"`
+ */
+export declare function deriveOsQueryPublisher(res: Object): string;
+/**
+ * Derive a description value from an osquery result row.
+ *
+ * @param {Object} res osquery result row
+ * @returns {string} First present description-like field value, or an empty string
+ */
+export declare function deriveOsQueryDescription(res: Object): string;
+/**
+ * Sanitize an identity string for use in component names and references.
+ *
+ * @param {string} value Raw identity value
+ * @returns {string} Value with spaces mapped to `+`, `:`/`%` mapped to `-`, and `@`/brace delimiters trimmed
+ */
+export declare function sanitizeOsQueryIdentity(value: string): string;
+/**
+ * Sanitize a value for safe use inside a `bom-ref`.
+ *
+ * @param {string} value Raw value
+ * @param {string} [fallback="unknown"] Value returned when the input is empty or `"null"`
+ * @returns {string} Whitespace-collapsed value with bom-ref delimiters replaced by `-`
+ */
+export declare function sanitizeOsQueryBomRefValue(value: string, fallback?: string): string;
+/**
+ * Build a deterministic fallback `bom-ref` for an osquery-derived component.
+ *
+ * @param {string} queryCategory Osquery category (e.g. `deb_packages`)
+ * @param {string} componentType CycloneDX component type
+ * @param {string|undefined} name Component name
+ * @param {string|undefined} version Component version
+ * @param {string|undefined} identityField Row field used to distinguish the component's identity
+ * @param {string|undefined} identityValue Value of the identity field
+ * @returns {string} BOM ref of the form `osquery:<category>:<type>:<name>@<version>[<field>=<value>]`
+ */
+export declare function createOsQueryFallbackBomRef(queryCategory: string, componentType: string, name: string | undefined, version: string | undefined, identityField: string | undefined, identityValue: string | undefined): string;
+/**
+ * Determine whether an osquery-derived component type may carry a purl.
+ *
+ * @param {string} componentType CycloneDX component type
+ * @returns {boolean} `false` for `cryptographic-asset`, `data`, `device`, and `information`
+ */
+export declare function shouldCreateOsQueryPurl(componentType: string): boolean;
+/**
+ * Construct a purl string for an osquery-derived component.
+ *
+ * Builds through `tryBuildPurl`, so an invalid combination yields `null`
+ * instead of throwing. Derives a swid `tag_id` qualifier when missing and a
+ * distro namespace from `/etc/os-release` for OS package types that require one.
+ *
+ * @param {string} purlType Purl type (e.g. `deb`, `rpm`, `generic`)
+ * @param {string|null} group Purl namespace or group
+ * @param {string} name Component name
+ * @param {string} version Component version
+ * @param {Object|null} qualifiers Purl qualifiers
+ * @param {string|null} subpath Purl subpath (leading slashes are stripped)
+ * @returns {string|null} Canonical purl string, or `null` when the parts do not form a valid purl
+ */
+export declare function createOsQueryPurl(purlType: string, group: string | null, name: string, version: string, qualifiers: Object | null, subpath: string | null): string | null;
+//# sourceMappingURL=osqueryTransform.d.ts.map

package/types/lib/inventory/osqueryTransform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"osqueryTransform.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osqueryTransform.js"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAH7B,MAG6B,GAF3B,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAL1B,MAK0B,EAAE,YAAY,EAJxC,OAIwC,EAAE,SAAS,EAHnD,MAGmD,GAFjD,MAAM,GAAC,SAAS,CAkB5B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,MAG+B,GAF7B,MAAM,CAWlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAHjC,MAGiC,GAF/B,MAAM,CAelB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAHlC,MAGkC,GAFhC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAJrC,MAIqC,EAAE,QAAQ,AAHvD,CACA,EADQ,MAG2D,GAFzD,MAAM,CAWlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,aAAa,EATJ,MASI,EACb,aAAa,EATJ,MASI,EACb,IAAI,EATK,MAAM,GAAC,SASZ,EACJ,OAAO,EATE,MAAM,GAAC,SAST,EACP,aAAa,EATJ,MAAM,GAAC,SASH,EACb,aAAa,EATJ,MAAM,GAAC,SASH,GARF,MAAM,CA8BlB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAH1C,MAG0C,GAFxC,OAAO,CAMnB;AAaD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EATC,MASD,EACR,KAAK,EATI,MAAM,GAAC,IASX,EACL,IAAI,EATK,MASL,EACJ,OAAO,EATE,MASF,EACP,UAAU,EATD,MAAM,GAAC,IASN,EACV,OAAO,EATE,MAAM,GAAC,IAST,GARI,MAAM,GAAC,IAAI,CAuCvB"}

package/types/lib/inventory/plugins.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Determine the normalized plugin target tuple for the current runtime.
+ *
+ * @returns {{arch: string, extn: string, platform: string, pluginsBinSuffix: string}}
+ */
+export declare function getPluginsBinTarget(): {
+    arch: string;
+    extn: string;
+    platform: string;
+    pluginsBinSuffix: string;
+};
+/**
+ * Resolve the cdxgen companion plugins directory for the current runtime.
+ *
+ * @returns {{
+ *   arch: string,
+ *   extn: string,
+ *   extraNMBinPath: string|undefined,
+ *   platform: string,
+ *   pluginManifestFile: string|undefined,
+ *   pluginVersion: string|undefined,
+ *   pluginsBinSuffix: string,
+ *   pluginsDir: string,
+ * }}
+ */
+export declare function resolveCdxgenPlugins(): {
+    arch: string;
+    extn: string;
+    extraNMBinPath: string | undefined;
+    platform: string;
+    pluginManifestFile: string | undefined;
+    pluginVersion: string | undefined;
+    pluginsBinSuffix: string;
+    pluginsDir: string;
+};
+/**
+ * Retrieve the default plugin runtime, recomputing it only when the
+ * environment that influences plugin discovery changes.
+ *
+ * @returns {ReturnType<typeof resolveCdxgenPlugins>} The resolved plugin runtime.
+ */
+export declare function getDefaultPluginRuntime(): ReturnType<typeof resolveCdxgenPlugins>;
+/**
+ * Add the detected node_modules binary directory to PATH when present.
+ *
+ * @param {ReturnType<typeof resolveCdxgenPlugins>} [pluginRuntime] Detected plugin runtime.
+ * @returns {ReturnType<typeof resolveCdxgenPlugins>} The resolved plugin runtime.
+ */
+export declare function setPluginsPathEnv(pluginRuntime?: ReturnType<typeof resolveCdxgenPlugins>): ReturnType<typeof resolveCdxgenPlugins>;
+/**
+ * Resolve a known plugin binary path, honoring explicit environment overrides.
+ *
+ * @param {string} toolName Tool identifier.
+ * @param {ReturnType<typeof resolveCdxgenPlugins>} [pluginRuntime] Detected plugin runtime.
+ * @returns {string|undefined} Resolved binary path or configured override.
+ */
+export declare function resolvePluginBinary(toolName: string, pluginRuntime?: ReturnType<typeof resolveCdxgenPlugins>): string | undefined;
+//# sourceMappingURL=plugins.d.ts.map

package/types/lib/inventory/plugins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.d.ts","sourceRoot":"","sources":["../../../lib/inventory/plugins.js"],"names":[],"mappings":"AA+CA;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAC,CAgCpF;AA8DD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,IAXvB;IACR,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,GAAC,SAAS,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,GAAC,SAAS,CAAC;IACrC,aAAa,EAAE,MAAM,GAAC,SAAS,CAAC;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB,CAqMH;AAYD;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAF1B,UAAU,CAAC,OAAO,oBAAoB,CAAC,CASnD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,AAH5C,CACA,EADQ,UAAU,CAAC,OAAO,oBAAoB,CAGU,GAF9C,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAWnD;AAwDD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAIiC,EAAE,aAAa,AAHxD,CACA,EADQ,UAAU,CAAC,OAAO,oBAAoB,CAGsB,GAF1D,MAAM,GAAC,SAAS,CAS5B"}

package/types/lib/inventory/protobom.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Determine whether a spec version is supported for protobuf serialization.
+ *
+ * @param {string|undefined} specVersion CycloneDX spec version string
+ * @returns {boolean} `true` when supported by `@cdxgen/cdx-proto`, or when no spec version is provided
+ */
+export declare const isProtoSupportedSpecVersion: (specVersion: string | undefined) => boolean;
+/**
+ * Assert that a spec version is supported by `@cdxgen/cdx-proto`.
+ *
+ * Throws an `Error` naming the unsupported version and the operation when the
+ * spec version cannot be serialized to protobuf; returns without effect
+ * otherwise.
+ *
+ * @param {string|undefined} specVersion CycloneDX spec version string
+ * @param {string} [operation="protobuf operations"] Operation label used in the error message
+ */
+export declare const assertProtoSupportedSpecVersion: (specVersion: string | undefined, operation?: string) => void;
+/**
+ * Determine whether a path looks like a CycloneDX protobuf file.
+ *
+ * @param {string} filePath File path
+ * @returns {boolean} true when the path looks like a protobuf BOM file
+ */
+export declare const isProtoBomFile: (filePath: string) => boolean;
+/**
+ * Method to convert the given bom json to proto binary
+ *
+ * @param {string | Object} bomJson BOM Json
+ * @param {string} binFile Binary file name
+ * @param {string | number} [specVersion] CycloneDX spec version fallback for BOMs without specVersion
+ */
+export declare const writeBinary: (bomJson: string | Object, binFile: string, specVersion?: string | number) => void;
+/**
+ * Method to read a serialized binary
+ *
+ * @param {string} binFile Binary file name
+ * @param {boolean} asJson Convert to JSON
+ * @param {string | number} [specVersion] Optional specification version. When omitted, cdxgen auto-detects the matching schema.
+ */
+export declare const readBinary: (binFile: string, asJson: boolean, specVersion?: string | number) => import("@cdxgen/cdx-proto").AnyBom | import("@cdxgen/cdx-proto").AnyBomJson | undefined;
+/**
+ * Method to compute size and count statistics for a BOM.
+ *
+ * @param {string | Object} bomJson BOM Json, BOM Json string, or proto message
+ * @param {string | number} [specVersion] CycloneDX spec version fallback for BOMs without specVersion
+ * @returns {Object} Component and dependency counts with JSON/binary byte sizes and compression ratio
+ */
+export declare const getBomStats: (bomJson: string | Object, specVersion?: string | number) => Object;
+/**
+ * Method to cross-convert a BOM between CycloneDX specification versions using
+ * the protobuf schemas.
+ *
+ * Downgrades are lossy: fields that the target version does not define are
+ * dropped and reported in `warnings` as field paths.
+ *
+ * This is the raw `@cdxgen/cdx-proto` conversion. It reshapes nothing that the
+ * two schemas model with different cardinality, so a BOM crossing the 1.5/1.6
+ * `evidence.identity` boundary must be normalized first. Prefer
+ * `applySpecVersionCompatibility` from the postgen stage for that.
+ *
+ * @param {string | Object} bomJson BOM Json, BOM Json string, or proto message
+ * @param {string | number} targetSpecVersion Target CycloneDX spec version
+ * @param {string | number} [specVersion] CycloneDX spec version fallback for BOMs without specVersion
+ * @returns {{bomJson: Object, warnings: string[]}} Converted BOM Json and the field paths dropped
+ */
+export declare const convertBomSpecVersion: (bomJson: string | Object, targetSpecVersion: string | number, specVersion?: string | number) => {
+    bomJson: Object;
+    warnings: string[];
+};
+//# sourceMappingURL=protobom.d.ts.map

package/types/lib/inventory/protobom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protobom.d.ts","sourceRoot":"","sources":["../../../lib/inventory/protobom.js"],"names":[],"mappings":"AAiEA;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,gBAH7B,MAAM,GAAC,SAAS,KACd,OAWZ,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,gBAHjC,MAAM,GAAC,SAAS,cAChB,MAAM,SAiBhB,CAAC;AA4BF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,aAHhB,MAAM,KACJ,OAOZ,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAJb,MAAM,GAAG,MAAM,WACf,MAAM,gBACN,MAAM,GAAG,MAAM,SAWzB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,YAJZ,MAAM,UACN,OAAO,gBACP,MAAM,GAAG,MAAM,4FAiBzB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAJb,MAAM,GAAG,MAAM,gBACf,MAAM,GAAG,MAAM,KACb,MAGsC,CAAC;AAEpD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,qBAAqB,YALvB,MAAM,GAAG,MAAM,qBACf,MAAM,GAAG,MAAM,gBACf,MAAM,GAAG,MAAM,KACb;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAehD,CAAC"}

package/types/lib/inventory/protobomLoader.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Determine whether a path looks like a CycloneDX protobuf BOM file.
+ *
+ * @param {string} filePath File path
+ * @returns {boolean} true when the path uses a protobuf BOM extension
+ */
+export declare function isProtoBomPath(filePath: string): boolean;
+/**
+ * Import protobuf BOM helpers and replace optional-dependency loader failures
+ * with actionable command-specific messages.
+ *
+ * @param {string} [commandName="cdxgen"] CLI command name
+ * @param {string} [featureDescription="protobuf support"] Feature being used
+ * @returns {Promise<object>} Loaded protobom module namespace
+ */
+export declare function importProtobomModule(commandName?: string, featureDescription?: string): Promise<object>;
+//# sourceMappingURL=protobomLoader.d.ts.map

package/types/lib/inventory/protobomLoader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protobomLoader.d.ts","sourceRoot":"","sources":["../../../lib/inventory/protobomLoader.js"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,OAAO,CAOnB;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,AALV,CACA,EADQ,MAKa,EACtB,kBAAkB,AALjB,CACA,EADQ,MAK8B,GAJ5B,OAAO,CAAC,MAAM,CAAC,CAqB3B"}

package/types/lib/inventory/provenanceUtils.d.ts

@@ -0,0 +1,98 @@
+/** npm provenance evidence component property names. */
+export declare const NPM_PROVENANCE_EVIDENCE_PROPERTIES: string[];
+/** PyPI provenance evidence component property names. */
+export declare const PYPI_PROVENANCE_EVIDENCE_PROPERTIES: string[];
+/** Cargo provenance evidence component property names. */
+export declare const CARGO_PROVENANCE_EVIDENCE_PROPERTIES: string[];
+/** All registry provenance evidence component property names (npm, PyPI, and Cargo combined). */
+export declare const REGISTRY_PROVENANCE_EVIDENCE_PROPERTIES: string[];
+/** Trusted-publishing indicator component property names for each registry. */
+export declare const TRUSTED_PUBLISHING_PROPERTIES: string[];
+/** Icon appended to component names that carry registry provenance evidence. */
+export declare const REGISTRY_PROVENANCE_ICON = "\uD83D\uDEE1";
+/**
+ * Return a component property value by name.
+ *
+ * @param {object} component CycloneDX component
+ * @param {string} propertyName Property name to look up
+ * @returns {string | undefined} Property value if present
+ */
+export declare function getComponentPropertyValue(component: object, propertyName: string): string | undefined;
+/**
+ * Return a property value by name from a raw properties array.
+ *
+ * @param {object[]} properties CycloneDX properties array
+ * @param {string} propertyName Property name to look up
+ * @returns {string | undefined} Property value if present
+ */
+export declare function getPropertyValue(properties: object[], propertyName: string): string | undefined;
+/**
+ * Check whether any of the supplied properties exist and carry a value.
+ *
+ * @param {object[]} properties CycloneDX properties array
+ * @param {string[]} propertyNames Property names to test
+ * @returns {boolean} True when any named property has a non-empty value
+ */
+export declare function hasAnyPropertyValue(properties: object[], propertyNames: string[]): boolean;
+/**
+ * Determine whether a raw properties array includes trusted publishing metadata.
+ *
+ * @param {object[]} properties CycloneDX properties array
+ * @returns {boolean} True when trusted publishing is recorded for npm, PyPI, or Cargo
+ */
+export declare function hasTrustedPublishingProperties(properties: object[]): boolean;
+/**
+ * Determine whether a raw properties array includes direct registry provenance evidence.
+ *
+ * @param {object[]} properties CycloneDX properties array
+ * @returns {boolean} True when direct provenance evidence is present
+ */
+export declare function hasRegistryProvenanceEvidenceProperties(properties: object[]): boolean;
+/**
+ * Determine whether a component includes trusted publishing metadata.
+ *
+ * @param {object} component CycloneDX component
+ * @returns {boolean} True when trusted publishing is recorded for npm, PyPI, or Cargo
+ */
+export declare function hasComponentTrustedPublishing(component: object): boolean;
+/**
+ * Determine whether a component includes direct registry provenance evidence.
+ *
+ * @param {object} component CycloneDX component
+ * @returns {boolean} True when provenance URL, digests, signatures, or key IDs exist
+ */
+export declare function hasComponentRegistryProvenanceEvidence(component: object): boolean;
+/**
+ * Determine whether a component includes registry provenance metadata.
+ *
+ * @param {object} component CycloneDX component
+ * @returns {boolean} True when provenance or trusted publishing metadata exists
+ */
+export declare function hasComponentRegistryProvenance(component: object): boolean;
+/**
+ * Filter components to those carrying trusted publishing metadata.
+ *
+ * @param {object[]} components BOM components
+ * @returns {object[]} Trusted-publishing-backed components
+ */
+export declare function getTrustedComponents(components: object[]): object[];
+/**
+ * Filter components to those carrying direct registry provenance evidence.
+ *
+ * @param {object[]} components BOM components
+ * @returns {object[]} Provenance-backed components
+ */
+export declare function getProvenanceComponents(components: object[]): object[];
+/**
+ * Count components with trusted publishing metadata by registry ecosystem.
+ *
+ * @param {object[]} components BOM components
+ * @returns {{cargo: number, npm: number, pypi: number, total: number}} Trusted publishing counts
+ */
+export declare function getTrustedPublishingComponentCounts(components: object[]): {
+    cargo: number;
+    npm: number;
+    pypi: number;
+    total: number;
+};
+//# sourceMappingURL=provenanceUtils.d.ts.map

package/types/lib/inventory/provenanceUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenanceUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/provenanceUtils.js"],"names":[],"mappings":"AAOA,wDAAwD;AACxD,eAAO,MAAM,kCAAkC,UAQ9C,CAAC;AACF,yDAAyD;AACzD,eAAO,MAAM,mCAAmC,UAS/C,CAAC;AACF,0DAA0D;AAC1D,eAAO,MAAM,oCAAoC,UAOhD,CAAC;AACF,iGAAiG;AACjG,eAAO,MAAM,uCAAuC,UAInD,CAAC;AACF,+EAA+E;AAC/E,eAAO,MAAM,6BAA6B,UAIzC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,iBAAO,CAAC;AAE7C;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAJxC,MAIwC,EAAE,YAAY,EAHtD,MAGsD,GAFpD,MAAM,GAAG,SAAS,CAK9B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAJhC,MAAM,EAI0B,EAAE,YAAY,EAH9C,MAG8C,GAF5C,MAAM,GAAG,SAAS,CAI9B;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAJnC,MAAM,EAI6B,EAAE,aAAa,EAHlD,MAAM,EAG4C,GAFhD,OAAO,CAMnB;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,EAH9C,MAAM,EAGwC,GAF5C,OAAO,CAMnB;AAED;;;;;GAKG;AACH,wBAAgB,uCAAuC,CAAC,UAAU,EAHvD,MAAM,EAGiD,GAFrD,OAAO,CAOnB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,SAAS,EAH5C,MAG4C,GAF1C,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,sCAAsC,CAAC,SAAS,EAHrD,MAGqD,GAFnD,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAH7C,MAG6C,GAF3C,OAAO,CAOnB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAHpC,MAAM,EAG8B,GAFlC,MAAM,EAAE,CASpB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAHvC,MAAM,EAGiC,GAFrC,MAAM,EAAE,CASpB;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,UAAU,EAHnD,MAAM,EAG6C,GAFjD;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CA0CrE"}