@cdxgen/cdxgen 0.0.1 → 13.0.0

package/types/lib/parsers/npmrc.d.ts

@@ -0,0 +1,33 @@
+/**
+ * npmrc keys that are blocked and ignored during parsing for safety, because
+ * they can influence command execution, shell spawning, or sensitive config
+ * locations.
+ *
+ * @type {Set<string>}
+ */
+export declare const DEFAULT_NPMRC_BLOCKLIST: Set<string>;
+/**
+ * Parse .npmrc content into a plain key-value object.
+ *
+ * @param {string} content - Raw .npmrc file content
+ * @returns {Object} Parsed key-value pairs
+ */
+export declare function parseNpmrc(content: string): Object;
+/**
+ * Extract npm/pnpm configuration values from environment variables.
+ * See https://docs.npmjs.com/cli/v11/using-npm/config
+ *
+ * npm uses the NPM_CONFIG_ prefix for env var config:
+ * - Dashes become underscores: --allow-same-version → npm_config_allow_same_version
+ * - Case-insensitive prefix matching: NPM_CONFIG_FOO = npm_config_foo
+ * - Simple keys are lowercased; scoped/URI keys preserve case
+ * - Boolean flags without values are treated as true
+ *
+ * pnpm v11+ uses the PNPM_CONFIG_ prefix instead of NPM_CONFIG_ for pnpm-specific settings.
+ *   Both prefixes are supported; pnpm_config_* takes precedence over npm_config_* for the same key.
+ *   See https://pnpm.io/next/npmrc
+ * @param {Object} env - Environment variables object (defaults to process.env)
+ * @returns {Object} Parsed npm config key-value pairs
+ */
+export declare function parseNpmrcFromEnv(env?: Object): Object;
+//# sourceMappingURL=npmrc.d.ts.map

package/types/lib/parsers/npmrc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npmrc.d.ts","sourceRoot":"","sources":["../../../lib/parsers/npmrc.js"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,EAF1B,GAAG,CAAC,MAAM,CAkBlB,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAHvB,MAGuB,GAFrB,MAAM,CAiClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAH1B,MAGwC,GAFtC,MAAM,CAoBlB"}

package/types/lib/parsers/ollama.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Parse an Ollama Modelfile into reusable model metadata.
+ *
+ * @param {string} raw Modelfile contents
+ * @returns {{
+ *   adapters: string[],
+ *   from?: string,
+ *   license?: string,
+ *   parameters: Record<string, string>,
+ *   system?: string,
+ *   template?: string,
+ * }} parsed model metadata
+ */
+export declare function parseOllamaModelfile(raw: string): {
+    adapters: string[];
+    from?: string;
+    license?: string;
+    parameters: Record<string, string>;
+    system?: string;
+    template?: string;
+};
+//# sourceMappingURL=ollama.d.ts.map

package/types/lib/parsers/ollama.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ollama.d.ts","sourceRoot":"","sources":["../../../lib/parsers/ollama.js"],"names":[],"mappings":"AAgCA;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAV7B,MAU6B,GAT3B;IACR,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAyDH"}

package/types/lib/parsers/xml.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Non-validating XML parser for the manifest formats cdxgen reads: Maven poms,
+ * NuGet nuspec and packages.config, MSBuild project and props files, VSIX
+ * manifests and Apple plists.
+ *
+ * Namespace prefixes are kept verbatim in element and attribute names rather
+ * than resolved, so `<PackageManifest:Metadata>` stays under that literal key.
+ * Doctypes are recorded but never interpreted: no internal subset is read and
+ * no external entity is fetched, so a declared entity reference is an unknown
+ * entity and is rejected like any other.
+ */
+/**
+ * Parse an XML document into a plain object.
+ *
+ * In compact form each element becomes a key on its parent, with text under
+ * `textKey`, attributes under `attributesKey` and comments under `commentKey`;
+ * a name that repeats becomes an array. In verbose form the document becomes a
+ * list of typed nodes under `elements`.
+ *
+ * @param {string} source XML document
+ * @param {object} [options] Parse options
+ * @param {Boolean} [options.compact] Emit the compact form
+ * @param {Boolean} [options.alwaysArray] Wrap every compact-form value in an array
+ * @param {string} [options.textKey] Key holding element text
+ * @param {string} [options.attributesKey] Key holding element attributes
+ * @param {string} [options.commentKey] Key holding comment text
+ * @param {string} [options.cdataKey] Key holding CDATA text
+ * @param {Boolean} [options.ignoreComment] Drop comments
+ * @param {Boolean} [options.ignoreCdata] Drop CDATA sections
+ * @param {Boolean} [options.trim] Trim text in the verbose form
+ *
+ * @returns {object} Parsed document
+ *
+ * @throws {Error} When the document is not well formed
+ */
+export declare function xml2js(source: string, options?: {
+    compact?: boolean;
+    alwaysArray?: boolean;
+    textKey?: string;
+    attributesKey?: string;
+    commentKey?: string;
+    cdataKey?: string;
+    ignoreComment?: boolean;
+    ignoreCdata?: boolean;
+    trim?: boolean;
+}): object;
+//# sourceMappingURL=xml.d.ts.map

package/types/lib/parsers/xml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xml.d.ts","sourceRoot":"","sources":["../../../lib/parsers/xml.js"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiwBH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAhBlB,MAgBkB,EAAE,OAAO,AAfnC,CAWA,EAVA;IAA0B,OAAO,AAAjC,CACA,UAAA;IAA0B,WAAW,AAArC,CACA,UAAA;IAAyB,OAAO,AAAhC,CACA,EADQ,MAAM,CACd;IAAyB,aAAa,AAAtC,CACA,EADQ,MAAM,CACd;IAAyB,UAAU,AAAnC,CACA,EADQ,MAAM,CACd;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;IAA0B,aAAa,AAAvC,CACA,UAAA;IAA0B,WAAW,AAArC,CACA,UAAA;IAA0B,IAAI,AAA9B,CAEA,UAAA;CAIwC,GAJ9B,MAAM,CAyClB"}

package/types/lib/server/server.d.ts

@@ -0,0 +1,51 @@
+import { isAllowedHttpHost } from "../core/activity.js";
+export { isAllowedHttpHost };
+/**
+ * Method to safely parse value passed via the query string or body.
+ *
+ * @param {string|number|Array<string|number>} raw
+ * @returns {string|number|boolean|Array<string|number|boolean>}
+ * @throws {TypeError} if raw (or any array element) isn’t string or number
+ */
+export declare function parseValue(raw: string | number | Array<string | number>): string | number | boolean | Array<string | number | boolean>;
+/**
+ * Parses allowed query/body parameters into a typed options object.
+ * Query parameters take priority over body parameters. Handles the
+ * `type` → `projectType` rename, lifecycle-based `installDeps` defaulting,
+ * and profile option expansion.
+ *
+ * @param {Object} q Parsed query string key/value map
+ * @param {Object} [body={}] Parsed request body key/value map
+ * @param {Object} [options={}] Seed options object to merge results into
+ * @returns {Object} Populated options object
+ */
+export declare function parseQueryString(q: Object, body?: Object, options?: Object): Object;
+/**
+ * Extracts query parameters from an incoming HTTP request object.
+ * Handles repeated keys by collecting their values into an array.
+ * Returns an empty object if the URL cannot be parsed.
+ *
+ * @param {Object} req Node.js/connect HTTP request object
+ * @returns {Object} Key/value map of query parameters from the request URL
+ */
+export declare function getQueryParams(req: Object): Object;
+/**
+ * Configure timeout and keepAlive values on the cdxgen HTTP server.
+ *
+ * @param {import("node:http").Server} cdxgenServer HTTP server instance to configure
+ * @returns {void}
+ */
+declare const configureServer: (cdxgenServer: import("node:http").Server) => void;
+/**
+ * Boot the cdxgen HTTP server.
+ *
+ * Performs startup security checks (secure mode, host exposure, privileged
+ * ports), validates the configured port, registers routes, and begins
+ * listening for BOM generation requests.
+ *
+ * @param {object} options CLI options including `serverHost` and `serverPort`
+ * @returns {void}
+ */
+declare const start: (options: object) => void;
+export { configureServer, start };
+//# sourceMappingURL=server.d.ts.map

package/types/lib/server/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../lib/server/server.js"],"names":[],"mappings":"AAWA,OAAO,EACL,iBAAiB,EAGlB,MAAM,qBAAqB,CAAC;AAsE7B,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAc7B;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAJnB,MAAM,GAAC,MAAM,GAAC,KAAK,CAAC,MAAM,GAAC,MAAM,CAId,GAHjB,MAAM,GAAC,MAAM,GAAC,OAAO,GAAC,KAAK,CAAC,MAAM,GAAC,MAAM,GAAC,OAAO,CAAC,CAwC9D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EALvB,MAKuB,EAAE,IAAI,AAJrC,CACA,EADQ,MAIkC,EAAE,OAAO,AAHnD,CACA,EADQ,MAGgD,GAF9C,MAAM,CAmBlB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB,MAAM,CAiClB;AAiBD;;;;;GAKG;AACH,QAAA,MAAM,eAAe,iBAHV,OAAO,WAAW,EAAE,MAAM,KACxB,IAOZ,CAAC;AAIF;;;;;;;;;GASG;AACH,QAAA,MAAM,KAAK,YAHA,MAAM,KACJ,IAuWZ,CAAC;AAEF,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC"}

package/types/lib/stages/postgen/annotator.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Method to determine the type of the BOM.
+ *
+ * @param {Object} bomJson BOM JSON Object
+ *
+ * @returns {String} Type of the bom such as sbom, cbom, obom, ml-bom etc
+ */
+export declare function findBomType(bomJson: Object): string;
+/**
+ * Create the textual representation of the metadata section.
+ *
+ * @param {Object} bomJson BOM JSON Object
+ *
+ * @returns {String | undefined} Textual representation of the metadata
+ */
+export declare function textualMetadata(bomJson: Object): string | undefined;
+/**
+ * Build a human-readable summary of AI authorship provenance and human-oversight
+ * rigor from the BOM's root `properties`. Returns an empty string when no
+ * cdx:ai:codegen provenance was detected.
+ *
+ * @param {Object} bomJson CycloneDX BOM
+ * @returns {string} Summary sentence(s), or "" when no AI provenance is present
+ */
+export declare function summarizeAiProvenance(bomJson: Object): string;
+/**
+ * Extract interesting tags from the component attribute
+ *
+ * @param {Object} component CycloneDX component
+ * @param {String} bomType BOM type
+ * @param {String} parentComponentType Parent component type
+ *
+ * @returns {Array | undefined} Array of string tags
+ */
+export declare function extractTags(component: Object, bomType?: string, parentComponentType?: string): any[] | undefined;
+//# sourceMappingURL=annotator.d.ts.map

package/types/lib/stages/postgen/annotator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"annotator.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/annotator.js"],"names":[],"mappings":"AAgXA;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAJxB,MAIwB,UA8DlC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAJ5B,MAI4B,GAF1B,SAAS,SAAS,CA+T9B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CA+DlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAPA,MAOA,EACT,OAAO,SAAQ,EACf,mBAAmB,SAAgB,GALxB,QAAQ,SAAS,CAqI7B"}

package/types/lib/stages/postgen/auditBom.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Detect whether a BOM looks like an HBOM inventory.
+ *
+ * @param {object} bomJson CycloneDX BOM
+ * @returns {boolean} True when the BOM appears to represent hardware inventory
+ */
+export declare function isHbomLikeBom(bomJson: object): boolean;
+/**
+ * Detect whether a BOM looks like an OBOM/runtime inventory.
+ *
+ * @param {object} bomJson CycloneDX BOM
+ * @returns {boolean} True when the BOM appears to represent operations/runtime data
+ */
+export declare function isObomLikeBom(bomJson: object): boolean;
+/**
+ * Summarize dry-run support across active BOM audit rules.
+ *
+ * @param {Object} [options={}] audit configuration options
+ * @returns {Promise<{ fullCount: number, noCount: number, partialCount: number, totalRules: number }>} dry-run summary
+ */
+export declare function getBomAuditDryRunSupportSummary(options?: Object): Promise<{
+    fullCount: number;
+    noCount: number;
+    partialCount: number;
+    totalRules: number;
+}>;
+/**
+ * Format BOM audit dry-run support as a console-friendly summary line.
+ *
+ * @param {{ fullCount: number, noCount: number, partialCount: number, totalRules: number }} summary dry-run support summary
+ * @returns {string} formatted summary text
+ */
+export declare function formatDryRunSupportSummary(summary: {
+    fullCount: number;
+    noCount: number;
+    partialCount: number;
+    totalRules: number;
+}): string;
+/**
+ * Ensure the BOM carries cdx:ai:codegen properties at the document root
+ * (`bomJson.properties`). If they are already present (for example, generated
+ * with `-t ai-provenance`) the BOM is left untouched. Otherwise the target
+ * directory is scanned and any detected properties are merged into the root
+ * `properties` array.
+ *
+ * @param {Object} bomJson Generated CycloneDX BOM (mutated in place)
+ * @param {Object} options CLI options
+ */
+export declare function ensureAiProvenanceProperties(bomJson: Object, options?: Object): void;
+/**
+ * Ensure the BOM carries cdx:ai:oversight properties at the document root
+ * (`bomJson.properties`). If they are already present or AI codegen was not
+ * detected, the BOM is left untouched.
+ *
+ * @param {Object} bomJson Generated CycloneDX BOM (mutated in place)
+ * @param {Object} options CLI options
+ */
+export declare function ensureAiOversightProperties(bomJson: Object, options?: Object): Promise<void>;
+/**
+ * Audit BOM formulation section using JSONata-powered rule engine
+ * @param {Object} bomJson - Generated CycloneDX BOM
+ * @param {Object} options - CLI options
+ * @returns {Promise<Array>} Array of audit findings
+ */
+export declare function auditBom(bomJson: Object, options: Object): Promise<any[]>;
+/**
+ * Format findings into a console report table.
+ *
+ * @param {Array} findings audit findings
+ * @returns {string} console report table
+ */
+export declare function renderBomAuditConsoleReport(findings: any[]): string;
+/**
+ * Print BOM audit findings to the console.
+ *
+ * @param {Array} findings audit findings
+ * @returns {string} rendered console output
+ */
+export declare function formatConsoleOutput(findings: any[]): string;
+/**
+ * Convert BOM audit findings to CycloneDX annotations.
+ *
+ * @param {Array} findings audit findings
+ * @param {Object} bomJson generated CycloneDX BOM
+ * @returns {Array} CycloneDX annotations
+ */
+export declare function formatAnnotations(findings: any[], bomJson: Object): any[];
+/**
+ * Check if any findings meet the severity threshold for secure mode failure
+ */
+export declare function hasCriticalFindings(findings: any, options: any): any;
+//# sourceMappingURL=auditBom.d.ts.map

package/types/lib/stages/postgen/auditBom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditBom.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/auditBom.js"],"names":[],"mappings":"AA8DA;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,OAAO,CA4BnB;AAuBD;;;;;GAKG;AACH,wBAAsB,+BAA+B,CAAC,OAAO,AAH1D,CACA,EADQ,MAGuD,GAFrD,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAKrG;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAHvC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAGvC,GAFrC,MAAM,CAOlB;AA+BD;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAHzC,MAGyC,EAAE,OAAO,GAFlD,MAEuD,QAuBjE;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAAC,OAAO,EAH9C,MAG8C,EAAE,OAAO,GAFvD,MAE4D,iBAkCtE;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,OAAO,CAwC1B;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,OAAA,GAFvC,MAAM,CAmClB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,OAAA,GAF/B,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,OAAA,EAAE,OAAO,EAHxC,MAGwC,SAuFlD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,KAAA,EAAE,OAAO,KAAA,OAQpD"}

package/types/lib/stages/postgen/postgen.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Filter and enhance BOM post generation.
+ *
+ * @param {Object} bomNSData BOM with namespaces object
+ * @param {Object} options CLI options
+ * @param {string} [filePath] Source path used for formulation and metadata context
+ *
+ * @returns {Object} Modified bomNSData
+ */
+export declare function postProcess(bomNSData: Object, options: Object, filePath?: string): Object;
+/**
+ * Apply additional metadata based on components
+ *
+ * @param {Object} bomJson BOM JSON Object
+ * @param {Object} options CLI options
+ *
+ * @returns {Object} Filtered BOM JSON
+ */
+export declare function applyMetadata(bomJson: Object, options: Object): Object;
+/**
+ * Apply definitions.standards based on options
+ *
+ * @param {Object} bomJson BOM JSON Object
+ * @param {Object} options CLI options
+ *
+ * @returns {Object} Filtered BOM JSON
+ */
+export declare function applyStandards(bomJson: Object, options: Object): Object;
+/**
+ * Filter BOM based on options
+ *
+ * @param {Object} bomJson BOM JSON Object
+ * @param {Object} options CLI options
+ *
+ * @returns {Object} Filtered BOM JSON
+ */
+export declare function filterBom(bomJson: Object, options: Object): Object;
+/**
+ * Clean up
+ */
+export declare function cleanupEnv(_options: any): void;
+/**
+ * Removes the cdxgen temporary directory if it was created inside the system
+ * temp directory (as indicated by `CDXGEN_TMP_DIR`). No-ops when the variable
+ * is unset or points outside the system temp directory.
+ *
+ * @returns {void}
+ */
+export declare function cleanupTmpDir(): void;
+/**
+ * Annotate the document with annotator
+ *
+ * @param {Object} bomJson BOM JSON Object
+ * @param {Object} options CLI options
+ *
+ * @returns {Object} Annotated BOM JSON
+ */
+export declare function annotate(bomJson: Object, options: Object): Object;
+//# sourceMappingURL=postgen.d.ts.map

package/types/lib/stages/postgen/postgen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgen.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/postgen.js"],"names":[],"mappings":"AAqbA;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAN1B,MAM0B,EAAE,OAAO,EALnC,MAKmC,EAAE,QAAQ,AAJrD,CAEA,EAFQ,MAI6C,GAF3C,MAAM,CAsDlB;AAgHD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAL1B,MAK0B,EAAE,OAAO,EAJnC,MAImC,GAFjC,MAAM,CA8HlB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAL3B,MAK2B,EAAE,OAAO,EAJpC,MAIoC,GAFlC,MAAM,CAqClB;AAkED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,EALtB,MAKsB,EAAE,OAAO,EAJ/B,MAI+B,GAF7B,MAAM,CA0MlB;AAUD;;GAEG;AACH,wBAAgB,UAAU,CAAC,QAAQ,KAAA,QAUlC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,IAFhB,IAAI,CAYhB;AAMD;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EALrB,MAKqB,EAAE,OAAO,EAJ9B,MAI8B,GAF5B,MAAM,CA2HlB"}

package/types/lib/stages/postgen/ruleEngine.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Load and validate rules from a directory of YAML files
+ * @param {string} rulesDir - Path to directory containing .yaml rule files
+ * @returns {Promise<Array>} Array of parsed rule objects
+ */
+export declare function loadRules(rulesDir: string): Promise<any[]>;
+/**
+ * Evaluate a single rule against the BOM using JSONata
+ * @param {Object} rule - Parsed rule object
+ * @param {Object} bomJson - Full CycloneDX BOM object
+ * @returns {Promise<Array>} Array of matched findings
+ */
+export declare function evaluateRule(rule: Object, bomJson: Object, options?: {}): Promise<any[]>;
+/**
+ * Evaluate all rules against a BOM
+ */
+export declare function evaluateRules(rules: any, bomJson: any, options?: {}): Promise<any[]>;
+//# sourceMappingURL=ruleEngine.d.ts.map

package/types/lib/stages/postgen/ruleEngine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruleEngine.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/ruleEngine.js"],"names":[],"mappings":"AAmfA;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,OAAO,CAuF1B;AAiCD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,EAAE,OAAO,KAAK,GAFjD,OAAO,OAAO,CAuF1B;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,KAAK,KAAA,EAAE,OAAO,KAAA,EAAE,OAAO,KAAK,kBAY/D"}

package/types/lib/stages/postgen/sortBom.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Deterministic ordering for CycloneDX BOM collections.
+ *
+ * Several CycloneDX arrays are sets by semantics — `properties`, `hashes`,
+ * `licenses`, `externalReferences`, `evidence.occurrences`, `evidence.identity`,
+ * `dependencies[].dependsOn`, and `metadata.tools.components` — yet their
+ * insertion order in cdxgen output depends on filesystem traversal order, Map
+ * iteration order, or the order plugin helpers happened to push in. On a
+ * container image that is scanned through ~25 ecosystem legs, two consecutive
+ * runs of the same image can therefore disagree on property ordering inside
+ * otherwise-identical components, which makes the BOM non-byte-comparable.
+ *
+ * Sorting these collections once, at finalization time, makes every BOM a
+ * pure function of its inputs without touching the component or dependency
+ * array order (which callers depend on).
+ *
+ * The comparators are content-derived string keys, the same strategy the golden
+ * normalizer in `contrib/sbom-normalize.js` uses. The two serve opposite ends
+ * and neither gates the other: the normalizer sorts a BOM's arrays *before*
+ * comparing it to a golden, so it erases emission order and no golden can
+ * observe what this module does. Ordering here is covered by `sortBom.poku.js`
+ * and by comparing two consecutive scans of the same input.
+ */
+/**
+ * Sort every unordered collection in a BOM so that two runs on the same input
+ * produce byte-identical output (modulo `serialNumber` and
+ * `metadata.timestamp`).
+ *
+ * Called from {@link postProcess} exactly once per BOM generation cycle.
+ *
+ * @param {object} bomJson CycloneDX BOM object (mutated in place).
+ */
+export declare function sortBomCollections(bomJson: object): object;
+//# sourceMappingURL=sortBom.d.ts.map

package/types/lib/stages/postgen/sortBom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sortBom.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/sortBom.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAyFH;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAF/B,MAE+B,UA0EzC"}

package/types/lib/stages/postgen/spdxConverter.d.ts

@@ -0,0 +1,11 @@
+import { SPDX_JSONLD_CONTEXT, SPDX_SPEC_VERSION } from "../../core/spdx.js";
+export { SPDX_JSONLD_CONTEXT, SPDX_SPEC_VERSION };
+/**
+ * Convert a CycloneDX BOM JSON document into an SPDX 3.0.1 JSON-LD document.
+ *
+ * @param {object|string} bomJson CycloneDX BOM JSON
+ * @param {object} [options] CLI options
+ * @returns {object|undefined} SPDX 3.0.1 JSON-LD document
+ */
+export declare function convertCycloneDxToSpdx(bomJson: object | string, options?: object): object | undefined;
+//# sourceMappingURL=spdxConverter.d.ts.map

package/types/lib/stages/postgen/spdxConverter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spdxConverter.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/spdxConverter.js"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5E,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC;AAspBlD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAJnC,MAAM,GAAC,MAI4B,EAAE,OAAO,AAHpD,CACA,EADQ,MAGiD,GAF/C,MAAM,GAAC,SAAS,CA4H5B"}

package/types/lib/stages/postgen/specVersionCompat.d.ts

@@ -0,0 +1,71 @@
+/**
+ * CycloneDX specification version compatibility.
+ *
+ * A BOM assembled in memory always carries the richest shape cdxgen knows how
+ * to produce. Emitting it at an older specification version therefore means
+ * removing elements that version does not define, and reshaping the ones it
+ * models differently — CycloneDX forbids additional properties, so a stray
+ * field fails schema validation outright.
+ *
+ * The reshaping is not purely subtractive. `evidence.identity` is a single
+ * object up to 1.5 and an array from 1.6, and `metadata.tools` flips from a
+ * `tools` object to component/service arrays at 2.0, so downgrades and upgrades
+ * both rewrite structure rather than just delete keys.
+ *
+ * This module is the single home for that logic. It is applied to generated
+ * BOMs by the postgen stage and to existing BOMs by `cdx-convert --to`, so both
+ * paths produce byte-identical output for the same target version.
+ */
+/**
+ * Restrict a BOM to the component types the caller asked for.
+ *
+ * Dependencies referencing pruned components are dropped so the graph never
+ * points at a `bom-ref` that no longer exists.
+ *
+ * @param {Object} bomJson CycloneDX BOM, mutated in place
+ * @param {Object} options CLI options carrying `componentType`
+ * @returns {Object} The mutated BOM
+ */
+export declare function applyComponentTypeFilter(bomJson: Object, options: Object): Object;
+/**
+ * Reshape a BOM so it is valid at the requested specification version.
+ *
+ * Component types the target version does not define are filtered out first,
+ * then root-level version-only fields are stripped, then the document is walked
+ * key by key to downgrade (below 2.0) or upgrade (2.0 and above) each subject.
+ * The BOM's `specVersion` and `$schema` are rewritten last.
+ *
+ * The target version is taken from `options.specVersion` when set, falling back
+ * to the BOM's own `specVersion`. A malformed explicit version is left alone
+ * rather than guessed at.
+ *
+ * @param {Object} bomJson CycloneDX BOM, mutated in place
+ * @param {Object} options CLI options carrying the requested `specVersion`
+ * @returns {Object} The mutated BOM
+ */
+export declare function applySpecVersionCompatibility(bomJson: Object, options: Object): Object;
+/**
+ * Collect the set of field paths present in a BOM.
+ *
+ * Array nesting does not extend the path, so the result describes which fields
+ * a document carries rather than where they sit. That keeps a comparison
+ * between two BOMs meaningful across a compatibility pass, which both drops
+ * array entries and reshapes fields whose cardinality changed between spec
+ * versions — `evidence.identity` reads the same whether it holds one object or
+ * an array of them.
+ *
+ * @param {Object} subject BOM or BOM fragment
+ * @param {string} [prefix] Path accumulated so far
+ * @param {Set<string>} [paths] Accumulator
+ * @returns {Set<string>} Field paths, e.g. `components.evidence.identity`
+ */
+export declare function collectFieldPaths(subject: Object, prefix?: string, paths?: Set<string>): Set<string>;
+/**
+ * Report which field paths a compatibility pass removed.
+ *
+ * @param {Object} sourceBomJson BOM before normalization
+ * @param {Object} normalizedBomJson BOM after normalization
+ * @returns {string[]} Sorted field paths that no longer appear
+ */
+export declare function diffRemovedFieldPaths(sourceBomJson: Object, normalizedBomJson: Object): string[];
+//# sourceMappingURL=specVersionCompat.d.ts.map

package/types/lib/stages/postgen/specVersionCompat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"specVersionCompat.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/specVersionCompat.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA0SH;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,MAAM,CAclB;AAmRD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAJ1C,MAI0C,EAAE,OAAO,EAHnD,MAGmD,GAFjD,MAAM,CA6BlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAL9B,MAK8B,EAAE,MAAM,AAJ9C,CACA,EADQ,MAI2C,EAAE,KAAK,AAH1D,CACA,EADQ,GAAG,CAAC,MAAM,CAGoD,GAF5D,GAAG,CAAC,MAAM,CAAC,CAkBvB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAJxC,MAIwC,EAAE,iBAAiB,EAH3D,MAG2D,GAFzD,MAAM,EAAE,CAOpB"}

package/types/lib/stages/pregen/envAudit.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Inspect the environment for security risks and return a list of findings.
+ *
+ * Checks include Node.js `NODE_OPTIONS`/`CDXGEN_NODE_OPTIONS` code-execution
+ * and permission flags, TLS bypass indicators, proxy interception, suspicious
+ * credential-naming variables, JVM agent injection (for JVM project types),
+ * root/Deno permission elevation, and debug exposure.
+ *
+ * @param {Object} [env=process.env] The environment record to audit.
+ * @param {Object} [options={}] CLI options used to scope JVM checks.
+ * @returns {Object[]} Security findings describing detected risks.
+ */
+export declare function auditEnvironment(env?: Object, options?: Object): Object[];
+//# sourceMappingURL=envAudit.d.ts.map

package/types/lib/stages/pregen/envAudit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envAudit.d.ts","sourceRoot":"","sources":["../../../../lib/stages/pregen/envAudit.js"],"names":[],"mappings":"AAuHA;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,AAJjC,CACA,EADQ,MAIuC,EAAE,OAAO,AAHxD,CACA,EADQ,MAGqD,GAFnD,MAAM,EAAE,CAkQpB"}

package/types/lib/stages/pregen/pregen.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Method to prepare the build environment for BOM generation purposes.
+ *
+ * @param {String} filePath Path
+ * @param {Object} options CLI options
+ */
+export declare function prepareEnv(filePath: string, options: Object): void;
+/**
+ * Method to prepare sdkman build environment for BOM generation purposes.
+ *
+ * @param {String} projectType Project type
+ */
+export declare function prepareSdkmanBuild(projectType: string): boolean | undefined;
+/**
+ * Method to check and prepare the environment for python
+ *
+ * @param {String} _filePath Path
+ * @param {Object} options CLI Options
+ */
+export declare function preparePythonEnv(_filePath: string, options: Object): void;
+/**
+ * Method to check and prepare the environment for node
+ *
+ * @param {String} filePath Path
+ * @param {Object} options CLI Options
+ */
+export declare function prepareNodeEnv(filePath: string, options: Object): void;
+/**
+ * If NVM_DIR is in path, however nvm command is not loaded.
+ * it is possible that required nodeVersion is not installed.
+ * This function loads nvm and install the nodeVersion
+ *
+ * @param {String} nodeVersion required version number
+ *
+ * @returns {Boolean} true if successful, otherwise false
+ */
+export declare function tryLoadNvmAndInstallTool(nodeVersion: string): boolean;
+/**
+ * This method installs and create package-lock.json
+ *
+ * @param {String} filePath Path
+ * @param {String} nvmNodePath Path to node version in nvm
+ */
+export declare function doNpmInstall(filePath: string, nvmNodePath: string): void;
+/**
+ * Method to check and build the swift project
+ *
+ * @param {String} filePath Path
+ * @param {Object} options CLI Options
+ */
+export declare function prepareSwiftEnv(filePath: string, options: Object): void;
+/**
+ * Method to check and prepare the environment for Ruby projects
+ *
+ * @param {String} filePath Path
+ * @param {Object} options CLI Options
+ */
+export declare function prepareRubyEnv(filePath: string, options: Object): void;
+//# sourceMappingURL=pregen.d.ts.map

package/types/lib/stages/pregen/pregen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pregen.d.ts","sourceRoot":"","sources":["../../../../lib/stages/pregen/pregen.js"],"names":[],"mappings":"AAoCA;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,QAAQ,QAAA,EAAE,OAAO,EAFjC,MAEiC,QAkB3C;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,QAAA,uBAS7C;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,QAAA,EAAE,OAAO,EAFxC,MAEwC,QA4ClD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,QAAA,EAAE,OAAO,EAFrC,MAEqC,QAmE/C;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,QAAA,WAsBnD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,QAAA,EAAE,WAAW,QAAA,QAsCjD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,QAAA,EAAE,OAAO,EAFtC,MAEsC,QA6EhD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,QAAA,EAAE,OAAO,EAFrC,MAEqC,QAqQ/C"}