@cdxgen/cdxgen 0.0.1 → 13.0.0

package/types/lib/inventory/spdxExpression.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Returns true if the identifier is a LicenseRef-/DocumentRef- style document
+ * reference rather than an SPDX short identifier.
+ *
+ * @param {string} id Identifier
+ * @returns {boolean}
+ */
+export declare function isLicenseRef(id: string): boolean;
+/**
+ * Normalizes a key by lowercasing and removing non-alphanumeric characters.
+ * Matches the key normalization in data generation.
+ *
+ * @returns {string} Normalized lookup key
+ */
+export declare function normalizeKey(name: any): string;
+/**
+ * Performs fuzzy correction on a license ID using aliases and direct case-insensitive lookups.
+ *
+ * @param {string} id License ID to correct
+ * @returns {string|null} Corrected ID or null if not found
+ */
+export declare function correctLicenseId(id: string): string | null;
+/**
+ * Tokenize a raw license expression string.
+ *
+ * @param {string} expr Expression
+ * @returns {string[]} Tokens
+ */
+export declare function tokenize(expr: string): string[];
+/**
+ * Parses and validates an SPDX expression.
+ *
+ * @param {string} expr Raw expression string
+ * @returns {object} Results: { valid: boolean, ast: object|null, unknown: string[] }
+ */
+export declare function parseSpdxExpression(expr: string): object;
+/**
+ * Renders an AST node back to a normalized string.
+ *
+ * @param {object} node AST Node
+ * @returns {string} Normalized string
+ */
+export declare function renderAST(node: object): string;
+/**
+ * Canonicalizes operand casing in the AST based on reference data.
+ *
+ * @param {object} node AST Node
+ * @returns {object} Canonicalized AST Node
+ */
+export declare function canonicalizeAST(node: object): object;
+/**
+ * Resolves deprecation replacements inside the AST recursively.
+ *
+ * @param {object} node AST Node
+ * @returns {object} Upgraded AST Node
+ */
+export declare function upgradeDeprecatedAST(node: object): object;
+//# sourceMappingURL=spdxExpression.d.ts.map

package/types/lib/inventory/spdxExpression.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spdxExpression.d.ts","sourceRoot":"","sources":["../../../lib/inventory/spdxExpression.js"],"names":[],"mappings":"AA+GA;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAHpB,MAGoB,GAFlB,OAAO,CAMnB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,KAAA,GAFpB,MAAM,CAKlB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAHxB,MAGwB,GAFtB,MAAM,GAAC,IAAI,CAyBvB;AAoBD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAHlB,MAGkB,GAFhB,MAAM,EAAE,CA0BpB;AAyID;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAH7B,MAG6B,GAF3B,MAAM,CAoBlB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAHnB,MAGmB,GAFjB,MAAM,CA2BlB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAHzB,MAGyB,GAFvB,MAAM,CA8ClB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B,MAAM,CA6ClB"}

package/types/lib/inventory/spdxUtils.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Convert an SPDX 3.x JSON-LD document into a CycloneDX-like BOM object.
+ *
+ * Maps `software_Package` and `software_File` graph elements to components and
+ * `dependsOn` relationships to a dependency list. Input that is not SPDX
+ * JSON-LD is returned unchanged.
+ *
+ * @param {Object} bomJson SPDX JSON-LD or CycloneDX-like document
+ * @returns {Object} BOM object carrying `components` and `dependencies`
+ */
+export declare const toCycloneDxLikeBom: (bomJson: Object) => Object;
+//# sourceMappingURL=spdxUtils.d.ts.map

package/types/lib/inventory/spdxUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spdxUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/spdxUtils.js"],"names":[],"mappings":"AAwCA;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,YAHpB,MAAM,KACJ,MA0DZ,CAAC"}

package/types/lib/inventory/table.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Render rows as a bordered text table.
+ *
+ * @param {Array[]} rows Table rows
+ * @param {Object} [config={}] Table configuration (header, columns, border style)
+ * @returns {string} Rendered table, or an empty string when there are no rows
+ */
+export declare function table(rows: any[][], config?: Object): string;
+/**
+ * Create a streaming table writer that renders rows to stdout incrementally.
+ *
+ * @param {Object} [config={}] Table configuration (header, columns, border style)
+ * @returns {{write(row: *): void, end(): void}} Writer whose `end()` emits the bottom border
+ */
+export declare function createStream(config?: Object): {
+    write(row: any): void;
+    end(): void;
+};
+//# sourceMappingURL=table.d.ts.map

package/types/lib/inventory/table.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"table.d.ts","sourceRoot":"","sources":["../../../lib/inventory/table.js"],"names":[],"mappings":"AAgNA;;;;;;GAMG;AACH,wBAAgB,KAAK,CAAC,IAAI,EAJf,OAIe,EAAE,MAAM,AAH/B,CACA,EADQ,MAG4B,GAF1B,MAAM,CAIlB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,AAHhC,CACA,EADQ,MAG6B,GAF3B;IAAC,KAAK,CAAC,GAAG,EAAE,GAAC,GAAG,IAAI,CAAC;IAAC,GAAG,IAAI,IAAI,CAAA;CAAC,CAuC9C"}

package/types/lib/inventory/traceRunner.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Parses a command string into command and arguments array.
+ * @param {string} cmdStr - Command string to parse
+ * @returns {{cmd: string, args: string[]}} Parsed command and arguments
+ */
+export declare function parseCommand(cmdStr: string): {
+    cmd: string;
+    args: string[];
+};
+/**
+ * Custom cdxgen resolver for @cdxgen/safer-exec binary dependency.
+ * Validates existence and ensures executable permissions to prevent EACCES issues.
+ *
+ * @returns {string|undefined} Path to the resolved binary or undefined if not found
+ */
+export declare function resolveSaferExecBinary(): string | undefined;
+/**
+ * Executes a command under safer-exec tracing and returns an array of loaded library paths
+ * and collected HTTP access entries.
+ *
+ * @param {string} commandStr - Command to execute and trace
+ * @param {string} [workingDir] - Working directory for the command
+ * @param {Object} [options] - Additional sandbox options
+ * @param {string[]} [options.readPaths] - Extra filesystem read paths merged with READ_PATHS
+ * @param {string[]} [options.writePaths] - Sandbox write paths (default: [tmpdir()])
+ * @param {number} [options.maxMemoryMB] - Max memory in MB (default: TRACE_MAX_MEMORY_MB)
+ * @param {number} [options.maxCPUCores] - Max CPU cores as fractional number
+ * @param {number} [options.maxProcesses] - Max process count (default: TRACE_MAX_PROCESSES)
+ * @param {number} [options.timeoutMs] - Trace timeout in ms (default: TRACE_TIMEOUT_MS)
+ * @param {boolean} [options.disableNetwork] - Disable network in sandbox (default: true)
+ * @param {boolean} [options.traceHTTPURLs] - Enable eBPF-based HTTP URL tracing (Linux only)
+ * @param {number} [options.tracePeriod] - Stop tracing after N seconds (for long-running commands)
+ * @param {boolean} [options.sanitizeEnv] - Strip sensitive env vars before sandboxed execution
+ * @param {boolean} [options.enableDiff] - Enable filesystem mutation diffing
+ * @param {boolean} [options.strict] - Treat sandbox setup warnings as hard errors
+ * @param {string[]} [options.allowHosts] - Hostnames to allow network access to
+ * @param {number[]} [options.allowPorts] - TCP ports to allow
+ * @param {string[]} [options.allowUrls] - URL-based allow rules (Linux, requires traceHTTPURLs)
+ * @param {boolean} [options.blockFork] - Prevent forking new processes
+ * @param {boolean} [options.traceExec] - Log every child process spawned
+ * @param {string[]} [options.allowExec] - Executables the command is allowed to run
+ * @param {string[]} [options.blockExec] - Executables to block from running
+ * @returns {Promise<{libPaths: string[], httpAccessEntries: Object[]}>} Collected libraries and HTTP URLs
+ */
+export declare function executeAndTrace(commandStr: string, workingDir?: string, options?: {
+    readPaths?: string[];
+    writePaths?: string[];
+    maxMemoryMB?: number;
+    maxCPUCores?: number;
+    maxProcesses?: number;
+    timeoutMs?: number;
+    disableNetwork?: boolean;
+    traceHTTPURLs?: boolean;
+    tracePeriod?: number;
+    sanitizeEnv?: boolean;
+    enableDiff?: boolean;
+    strict?: boolean;
+    allowHosts?: string[];
+    allowPorts?: number[];
+    allowUrls?: string[];
+    blockFork?: boolean;
+    traceExec?: boolean;
+    allowExec?: string[];
+    blockExec?: string[];
+}): Promise<{
+    libPaths: string[];
+    httpAccessEntries: Object[];
+}>;
+/**
+ * Groups HTTP access entries into a CycloneDX services-ready map.
+ * Each unique (host, port, protocol) combination becomes a service.
+ *
+ * @param {Object[]} httpAccessEntries - Collected HTTP access entries
+ * @returns {Object.<string, { endpoints: Set<string>, properties: Object[] }>} Services map
+ */
+export declare function groupHttpEntriesToServices(httpAccessEntries: Object[]): Record<string, {
+    endpoints: Set<string>;
+    properties: Object[];
+}>;
+//# sourceMappingURL=traceRunner.d.ts.map

package/types/lib/inventory/traceRunner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"traceRunner.d.ts","sourceRoot":"","sources":["../../../lib/inventory/traceRunner.js"],"names":[],"mappings":"AAyBA;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAHxB,MAGwB,GAFtB;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,CA6BzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAFzB,MAAM,GAAC,SAAS,CAoE5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAxBrC,MAwBqC,EAAE,UAAU,AAvBzD,CACA,EADQ,MAuBiD,EAAE,OAAO,AAtBlE,CAoBA,EAnBA;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;IAA0B,cAAc,AAAxC,CACA,EADQ,OAAO,CACf;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;CAEuE,GAF7D,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CAyOtE;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,iBAAiB,EAHjD,MAAM,EAG2C;eAFlB,GAAG,CAAC,MAAM,CAAC;gBAAc,MAAM,EAAE;GAuC1E"}

package/types/lib/inventory/unicodeScan.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Find dangerous Unicode characters and return their details.
+ *
+ * @param {string} text string to inspect
+ * @returns {{ char: string, codePoint: string, index: number, kind: string }[]} matches
+ */
+export declare function findDangerousUnicodeMatches(text: string): {
+    char: string;
+    codePoint: string;
+    index: number;
+    kind: string;
+}[];
+/**
+ * Scan a text blob for dangerous Unicode characters and summarize where they appear.
+ *
+ * @param {string} text text to inspect
+ * @param {{ syntax?: "markdown" | "text" | "yaml" }} [options] scan options
+ * @returns {{
+ *   codePoints: string[],
+ *   commentCodePoints: string[],
+ *   contexts: string[],
+ *   hasHiddenUnicode: boolean,
+ *   inComments: boolean,
+ *   lineNumbers: number[],
+ *   matches: { char: string, codePoint: string, index: number, kind: string, lineNumber: number, inComment: boolean }[],
+ * }} scan result
+ */
+export declare function scanTextForHiddenUnicode(text: string, options?: {
+    syntax?: "markdown" | "text" | "yaml";
+}): {
+    codePoints: string[];
+    commentCodePoints: string[];
+    contexts: string[];
+    hasHiddenUnicode: boolean;
+    inComments: boolean;
+    lineNumbers: number[];
+    matches: {
+        char: string;
+        codePoint: string;
+        index: number;
+        kind: string;
+        lineNumber: number;
+        inComment: boolean;
+    }[];
+};
+//# sourceMappingURL=unicodeScan.d.ts.map

package/types/lib/inventory/unicodeScan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unicodeScan.d.ts","sourceRoot":"","sources":["../../../lib/inventory/unicodeScan.js"],"names":[],"mappings":"AA0DA;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAHrC,MAGqC,GAFnC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,CAa9E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAZlC,MAYkC,EAAE,OAAO,AAXnD,CACA,EADQ;IAAE,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAAA;CAWS,GAV9C;IACR,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;CACrH,CAwDH"}

package/types/lib/managers/binary.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Look up plugin manifest entries for the given tool names and return their
+ * CycloneDX tool component objects, de-duplicated by bom-ref.
+ *
+ * @param {string[]} [toolNames=[]] Plugin tool names to resolve.
+ * @returns {Object[]} De-duplicated CycloneDX tool component objects.
+ */
+export declare function getPluginToolComponents(toolNames?: string[]): Object[];
+/**
+ * Run the `cargo-auditable` companion binary against the given source path and
+ * return its stdout.
+ *
+ * @param {string} src Path to the Rust binary or source to inspect.
+ * @returns {string|undefined} The tool's stdout, or undefined when the binary
+ *   is unavailable or produced no output.
+ */
+export declare function getCargoAuditableInfo(src: string): string | undefined;
+/**
+ * Execute sourcekitten plugin with the given arguments
+ *
+ * @param args {Array} Arguments
+ * @returns {undefined|Object} Command output
+ */
+export declare function executeSourcekitten(args: any[]): undefined | Object;
+/**
+ * Get the packages installed in the container image filesystem.
+ *
+ * @param src {String} Source directory containing the extracted filesystem.
+ * @param imageConfig {Object} Image configuration containing environment variables, command, entrypoints etc
+ * @param options CLI options controlling inventory generation
+ *
+ * @returns {Object} Metadata containing packages, dependencies, etc
+ */
+export declare function getOSPackages(src: string, imageConfig: Object, options?: {}): Object;
+/**
+ * Batch-enrich operating-system components with host-path trust data using the
+ * `trustinspector` helper on darwin and Windows.
+ *
+ * @param {Object[]} [components=[]] OS components to enrich.
+ * @returns {{components: Object[], tools: Object[]}} The enriched components
+ *   and any trust-inspector tool components that should be attached to the BOM
+ *   metadata.
+ */
+export declare function enrichOSComponentsWithTrustData(components?: Object[]): {
+    components: Object[];
+    tools: Object[];
+};
+/**
+ * Execute a SQL query against the bundled osquery binary and return the parsed
+ * JSON result.
+ *
+ * @param {string} query The SQL query string to run.
+ * @returns {Object|undefined} The parsed JSON result, or undefined when the
+ *   binary is unavailable, dry-run blocks execution, or the output cannot be
+ *   parsed.
+ */
+export declare function executeOsQuery(query: string): Object | undefined;
+/**
+ * Method to execute dosai to create slices for dotnet
+ *
+ * @param {string} src Source Path
+ * @param {string} slicesFile Slices file name
+ * @returns boolean
+ */
+export declare function getDotnetSlices(src: string, slicesFile: string): boolean;
+/**
+ * Method to generate binary SBOM using blint
+ *
+ * @param {string} src Path to binary or its directory
+ * @param {string} binaryBomFile Path to binary
+ * @param {boolean} deepMode Deep mode flag
+ *
+ * @return {boolean} Result of the generation
+ */
+export declare function getBinaryBom(src: string, binaryBomFile: string, deepMode: boolean): boolean;
+//# sourceMappingURL=binary.d.ts.map

package/types/lib/managers/binary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary.d.ts","sourceRoot":"","sources":["../../../lib/managers/binary.js"],"names":[],"mappings":"AA0YA;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,AAH9C,CACA,EADQ,MAAM,EAGqC,GAFzC,MAAM,EAAE,CAgBpB;AA4FD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,GAH5B,MAAM,GAAC,SAAS,CAmB5B;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,OAAA,GAF3B,SAAS,GAAC,MAAM,CAkB5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,GAAG,QAAA,EAAE,WAAW,EAL7B,MAK6B,EAAE,OAAO,KAAK,GAFrD,MAAM,CA2mBlB;AAkwDD;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,AALvD,CACA,EADQ,MAAM,EAK8C,GAJlD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAC,CAmEnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EALzB,MAKyB,GAJvB,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAJxB,MAIwB,EAAE,UAAU,EAHpC,MAGoC,WAqC9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EANrB,MAMqB,EAAE,aAAa,EALpC,MAKoC,EAAE,QAAQ,EAJ9C,OAI8C,GAF7C,OAAO,CAiClB"}

package/types/lib/managers/containerutils.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Method to get all dirs matching a name
+ *
+ * @param {string} dirPath Root directory for search
+ * @param {string} dirName Directory name
+ * @param {boolean} hidden Include hidden directories and files. Default: false
+ * @param {boolean} recurse Recurse. Default: false
+ */
+export declare const getDirs: (dirPath: string, dirName: string, hidden?: boolean, recurse?: boolean) => string[];
+/**
+ * Recursively walk `srcpath` and return all subdirectory paths whose basename
+ * matches `dirName` (the root path is included when it matches).
+ *
+ * @param {string} srcpath Root directory to start the walk from.
+ * @param {string} dirName Basename that a directory must end with to be kept.
+ * @returns {string[]} Matching directory paths.
+ */
+export declare const getOnlyDirs: (srcpath: string, dirName: string) => string[];
+/**
+ * Walk a directory tree once and collect all subdirectories whose basename
+ * matches any of the target names. Returns a map from name to array of paths.
+ *
+ * Replaces multiple {@link getOnlyDirs} calls that each walk the same tree.
+ *
+ * @param {string} srcpath Root directory for search
+ * @param {string[]} dirNames Target directory names to collect
+ * @returns {Record<string, string[]>} Map of dirName to matching paths
+ */
+export declare const getOnlyDirsMulti: (srcpath: string, dirNames: string[]) => Record<string, string[]>;
+//# sourceMappingURL=containerutils.d.ts.map

package/types/lib/managers/containerutils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerutils.d.ts","sourceRoot":"","sources":["../../../lib/managers/containerutils.js"],"names":[],"mappings":"AAOA;;;;;;;GAOG;AACH,eAAO,MAAM,OAAO,YALT,MAAM,WACN,MAAM,WACN,OAAO,YACP,OAAO,aAejB,CAAC;AAkCF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,YAJb,MAAM,WACN,MAAM,KACJ,MAAM,EAoBlB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,YAJlB,MAAM,YACN,MAAM,EAAE,KACN,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CA0BnC,CAAC"}

package/types/lib/managers/docker.d.ts

@@ -0,0 +1,157 @@
+import { Buffer } from "node:buffer";
+/** True when the current operating system is Windows. */
+export declare const isWin: boolean;
+/**
+ * Canonical Docker Hub registry hostname used as the default registry when
+ * parsing image names.
+ *
+ * @type {string}
+ */
+export declare const DOCKER_HUB_REGISTRY: string;
+/**
+ * Strip absolute path prefixes from a path string, handling both Unix and
+ * Windows paths (including UNC and extended-length paths such as //?/C:/).
+ * Taken from https://github.com/isaacs/node-tar/blob/main/src/strip-absolute-path.ts
+ *
+ * @param {string} path The path to strip
+ * @returns {string} The path with its absolute root removed
+ */
+export declare const stripAbsolutePath: (path: string) => string;
+/**
+ * Detect colima
+ */
+export declare function detectColima(): any;
+/**
+ * Detect if Rancher desktop is running on a mac.
+ */
+export declare function detectRancherDesktop(): any;
+/**
+ * Establish (or reuse) a `got` client connected to the local Docker or Podman
+ * daemon. Tries multiple socket / URL candidates in order: the default Docker
+ * socket, the rootless Docker socket, the Windows TCP endpoint, the rootless
+ * Podman socket, and the root Podman socket. Sets the module-level flags
+ * `isPodman`, `isPodmanRootless`, `isDockerRootless`, and `isWinLocalTLS` as a
+ * side-effect. Returns `undefined` when containerd / nerdctl is in use or no
+ * daemon could be reached.
+ *
+ * @param {Object} _options Additional options (currently unused; retained for
+ *   backwards compatibility with existing callers)
+ * @param {string} [forRegistry] Registry hostname forwarded to `getDefaultOptions`
+ * @returns {Promise<Object|undefined>} A daemon connection object bound to the
+ *   daemon base URL, or `undefined`
+ */
+export declare const getConnection: (_options: Object, forRegistry?: string) => Promise<Object | undefined>;
+/**
+ * Send a single HTTP request to the Docker / Podman daemon via the connection
+ * returned by {@link getConnection}. GET requests are parsed as JSON; all other
+ * methods receive a Buffer response body.
+ *
+ * @param {string} path API path relative to the daemon base URL (e.g. "images/ubuntu:latest/json")
+ * @param {string} method HTTP method (e.g. "GET", "POST", "DELETE")
+ * @param {string} [forRegistry] Registry hostname forwarded to `getDefaultOptions` for auth headers
+ * @returns {Promise<Object|Buffer|undefined>} Parsed JSON object for GET
+ *   requests, raw Buffer for other methods, or `undefined` if no client is available
+ */
+export declare const makeRequest: (path: string, method: string, forRegistry?: string) => Promise<Object | Buffer | undefined>;
+/**
+ * Parse image name
+ *
+ * docker pull debian
+ * docker pull debian:jessie
+ * docker pull ubuntu@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2
+ * docker pull myregistry.local:5000/testing/test-image
+ */
+export declare const parseImageName: (fullImageName: any) => {
+    registry: string;
+    repo: string;
+    tag: string;
+    digest: string;
+    platform: string;
+    group: string;
+    name: string;
+};
+/**
+ * Method to get image to the local registry by pulling from the remote if required
+ */
+export declare const getImage: (fullImageName: any) => Promise<any>;
+export type TarReadEntryLike = {
+    path: string;
+};
+/**
+ * Extract a container image tar archive into a destination directory.
+ * Applies path sanitisation, ownership/permission preservation settings, and
+ * an entry filter to skip problematic files and device nodes. Handles common
+ * tar errors gracefully, logging only unexpected ones.
+ *
+ * @param {string} fullImageName Path to the source tar archive
+ * @param {string} dir Destination directory to extract into
+ * @param {Object} options CLI options (uses `options.failOnError`)
+ * @returns {Promise<boolean>} `true` on success, `false` when the archive is
+ *   empty or a non-fatal error was encountered
+ */
+export declare const extractTar: (fullImageName: string, dir: string, options: Object) => Promise<boolean>;
+/**
+ * Method to export a container image archive.
+ * Returns the location of the layers with additional packages related metadata
+ */
+export declare const exportArchive: (fullImageName: any, options?: {}) => Promise<Object | undefined>;
+/**
+ * Parse a Docker/containerd manifest file and extract all image layers into a
+ * single merged directory. Resolves the last layer's config to determine the
+ * container's working directory, and builds the package path list for
+ * subsequent analysis.
+ *
+ * @param {string} manifestFile Path to the manifest.json (or index.json) file
+ * @param {Object} localData Local image inspect data (e.g. from `docker inspect`)
+ * @param {string} tempDir Temporary directory that holds the unpacked image
+ * @param {string} allLayersExplodedDir Directory where all layers are merged
+ * @param {Object} options CLI options (uses `options.failOnError`)
+ * @returns {Promise<Object>} Export data object containing `manifest`,
+ *   `allLayersDir`, `allLayersExplodedDir`, `lastLayerConfig`,
+ *   `lastWorkingDir`, `binPaths`, and `pkgPathList`
+ */
+export declare const extractFromManifest: (manifestFile: string, localData: Object, tempDir: string, allLayersExplodedDir: string, options: Object) => Promise<Object>;
+/**
+ * Method to export a container image by using the export feature in docker or podman service.
+ * Returns the location of the layers with additional packages related metadata
+ */
+export declare const exportImage: (fullImageName: any, options: any) => Promise<any>;
+/**
+ * Method to retrieve path list for system-level packages
+ */
+export declare const getPkgPathList: (exportData: any, lastWorkingDir: any) => any[];
+/**
+ * Remove a container image from the local Docker / Podman daemon.
+ *
+ * @param {string} fullImageName Full image name including tag or digest (e.g. "ubuntu:22.04")
+ * @param {boolean} [force=false] When `true`, force-remove the image even if it is in use
+ * @returns {Promise<Buffer|undefined>} Raw response buffer from the daemon, or
+ *   `undefined` if no daemon connection is available
+ */
+export declare const removeImage: (fullImageName: string, force?: boolean) => Promise<Buffer | undefined>;
+/**
+ * Retrieve a base64url-encoded authentication token for a registry server by
+ * invoking the `docker-credential-<exeSuffix>` credential helper binary.
+ * Results are cached in `registry_auth_keys` to avoid redundant subprocess
+ * calls.
+ *
+ * @param {string} exeSuffix Credential helper name suffix (e.g. "osxkeychain", "wincred", "pass")
+ * @param {string} serverAddress Registry server address (e.g. "https://index.docker.io/v1/")
+ * @returns {string|undefined} Base64url-encoded JSON auth token, or `undefined`
+ *   if the helper is unavailable or returns an error
+ */
+export declare const getCredsFromHelper: (exeSuffix: string, serverAddress: string) => string | undefined;
+/**
+ * Append skipped source-file entries to the `internal:SrcFile` properties of matching
+ * components. A component matches when its `oci:SrcImage` property value
+ * equals the skipped image's `image` field and the source file path is not
+ * already listed.
+ *
+ * @param {Array<{image: string, src: string}>} skippedImageSrcs List of skipped image/source pairs
+ * @param {Array<Object>} components CycloneDX component objects to update in place
+ */
+export declare const addSkippedSrcFiles: (skippedImageSrcs: Array<{
+    image: string;
+    src: string;
+}>, components: Array<Object>) => void;
+//# sourceMappingURL=docker.d.ts.map

package/types/lib/managers/docker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../lib/managers/docker.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAuCrC,yDAAyD;AACzD,eAAO,MAAM,KAAK,SAA0B,CAAC;AAC7C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAEoC,CAAC;AAsQ/C;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,SAHnB,MAAM,KACJ,MAiBZ,CAAC;AAEF;;GAEG;AACH,wBAAgB,YAAY,QAoB3B;AAED;;GAEG;AACH,wBAAgB,oBAAoB,QA2CnC;AAyTD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,aANf,MAAM,gBAEN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,SAAS,CA6HpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,SANb,MAAM,UACN,MAAM,gBACN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,MAAM,GAAC,SAAS,CAgC3C,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;;;;;;CA2E1B,CAAC;AAkCF;;GAEG;AACH,eAAO,MAAM,QAAQ,sCA2LpB,CAAC;AAGC,YAA4B,gBAAgB,GAAlC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAkB;AAiH/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,kBANZ,MAAM,OACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,OAAO,CAiF3B,CAAC;AAiGF;;;GAGG;AACH,eAAO,MAAM,aAAa,mEA6FzB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,iBATrB,MAAM,aACN,MAAM,WACN,MAAM,wBACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,MAAM,CAwH1B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,oDAkJvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,iDAkJ1B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,kBALb,MAAM,UACN,OAAO,KACL,OAAO,CAAC,MAAM,GAAC,SAAS,CAKpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,cALpB,MAAM,iBACN,MAAM,KACJ,MAAM,GAAC,SA2CnB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,qBAHpB,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,cACnC,KAAK,CAAC,MAAM,CAAC,SA4BvB,CAAC"}

package/types/lib/managers/dockerConnection.d.ts

@@ -0,0 +1,42 @@
+/**
+ * undici-backed connection helper for talking to the local Docker / Podman
+ * daemon (over a unix socket) or a remote daemon (over TCP/TLS). This replaces
+ * cdxgen's previous use of `got` for daemon communication.
+ *
+ * @module dockerConnection
+ */
+/**
+ * Retry policy for transient Docker/Podman daemon and registry failures.
+ * Mirrors the retry behaviour cdxgen previously configured on the got client.
+ *
+ * @type {Object}
+ */
+export declare const DAEMON_RETRY_OPTIONS: Object;
+/**
+ * Parse a got-style Docker daemon `prefixUrl` into the pieces undici needs.
+ * Unix socket URLs use the form `http://unix:/path/to/socket:`; anything else
+ * is treated as a regular TCP/TLS base URL.
+ *
+ * @param {string} prefixUrl got-style prefix URL for the daemon endpoint.
+ * @returns {{socketPath: (string|undefined), baseUrl: string}} The unix socket
+ *   path (when applicable) and the origin to use as the undici base URL.
+ */
+export declare const parseDaemonPrefixUrl: (prefixUrl: string) => {
+    socketPath: (string | undefined);
+    baseUrl: string;
+};
+/**
+ * Create a connection to the Docker / Podman daemon backed by undici. The
+ * returned object mimics the small slice of the got client that cdxgen relies
+ * on: a `request()` method returning a parsed body and a synchronous `stream()`
+ * method returning a readable image tar stream.
+ *
+ * @param {string} prefixUrl got-style daemon prefix URL (unix socket or TCP).
+ * @param {Object} [headers] Default headers (e.g. `X-Registry-Auth`) to send.
+ * @param {Object} [https] TLS material for remote daemons
+ *   (`{ certificate, key, rejectUnauthorized }`).
+ * @returns {Object} Connection object with `request`, `stream`, `close`,
+ *   `prefixUrl` and `baseUrl`.
+ */
+export declare const createDaemonConnection: (prefixUrl: string, headers?: Object, https?: Object) => Object;
+//# sourceMappingURL=dockerConnection.d.ts.map

package/types/lib/managers/dockerConnection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dockerConnection.d.ts","sourceRoot":"","sources":["../../../lib/managers/dockerConnection.js"],"names":[],"mappings":"AAMA;;;;;;GAMG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAFvB,MAMT,CAAC;AAOF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,cAJtB,MAAM,KACJ;IAAC,UAAU,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAe5D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,cAPxB,MAAM,YACN,MAAM,UACN,MAAM,KAEJ,MAiGZ,CAAC"}

package/types/lib/managers/oci.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Retrieves a CycloneDX BOM attached to an OCI image purely in JavaScript
+ * without relying on the `oras` CLI tool.
+ *
+ * @param {string} image OCI image reference (e.g. `"registry.example.com/org/app:tag"`)
+ * @param {string} [platform] OCI platform string (e.g. `"linux/amd64"`); no-op for JS implementation
+ * @returns {Promise<Object|undefined>} Parsed CycloneDX BOM JSON object, or `undefined` if not found
+ */
+export declare function getBomWithOras(image: string, _platform?: undefined): Promise<Object | undefined>;
+/**
+ * Attach a CycloneDX BOM to an OCI image using the OCI 1.1 artifact manifest
+ * API, pushing the BOM as a blob and linking it via the referrers API (with a
+ * fallback tag when the registry does not support referrers).
+ *
+ * @param {string} image The target OCI image reference to attach the BOM to.
+ * @param {Object} bomJson The CycloneDX BOM document to attach.
+ * @returns {Promise<string|undefined>} The digest of the pushed manifest, or
+ *   undefined when the manifest could not be pushed.
+ */
+export declare function attachBomNative(image: string, bomJson: Object): Promise<string | undefined>;
+//# sourceMappingURL=oci.d.ts.map

package/types/lib/managers/oci.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci.d.ts","sourceRoot":"","sources":["../../../lib/managers/oci.js"],"names":[],"mappings":"AAgXA;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAJ/B,MAI+B,EAAE,SAAS,YAAY,GAFpD,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA4GrC;AAmFD;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,KAAK,EALhC,MAKgC,EAAE,OAAO,EAJzC,MAIyC,GAHvC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAmIrC"}

package/types/lib/managers/piptree.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Execute the piptree plugin and return the generated tree as json object.
+ * The resulting tree would also include dependencies belonging to pip.
+ * Usage analysis is performed at a later stage to mark many of these packages as optional.
+ *
+ * @param {Object} env Environment variables to use
+ * @param {String} python_cmd Python command to use
+ * @param {String} basePath Current working directory
+ *
+ * @returns {Object} Dependency tree
+ */
+export declare const getTreeWithPlugin: (env: Object, python_cmd: string, basePath: string) => Object;
+//# sourceMappingURL=piptree.d.ts.map

package/types/lib/managers/piptree.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"piptree.d.ts","sourceRoot":"","sources":["../../../lib/managers/piptree.js"],"names":[],"mappings":"AA8NA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,QANnB,MAAM,2CAIJ,MAmCZ,CAAC"}