@cdxgen/cdxgen 0.0.1 → 13.0.0

package/types/lib/third-party/arborist/lib/validate-npm-package-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-npm-package-name.d.ts","sourceRoot":"","sources":["../../../../../lib/third-party/arborist/lib/validate-npm-package-name.js"],"names":[],"mappings":"AA6BA;;;;;GAKG;AACH,MAAM,CAAC,OAAO,UAAU,QAAQ,CAAC,IAAI,EAH1B,GAG0B,GAFxB;IAAC,mBAAmB,EAAE,OAAO,CAAC;IAAC,mBAAmB,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAC,CAyEhH"}

package/types/lib/third-party/arborist/lib/version-from-tgz.d.ts

@@ -0,0 +1,6 @@
+export default _default;
+declare function _default(name: any, tgz: any): {
+    name: any;
+    version: any;
+} | null;
+//# sourceMappingURL=version-from-tgz.d.ts.map

package/types/lib/third-party/arborist/lib/version-from-tgz.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-from-tgz.d.ts","sourceRoot":"","sources":["../../../../../lib/third-party/arborist/lib/version-from-tgz.js"],"names":[],"mappings":";0BAKgB,IAAI,KAAA,EAAE,GAAG,KAAA"}

package/types/lib/third-party/arborist/lib/yarn-lock.d.ts

@@ -0,0 +1,35 @@
+declare class YarnLock {
+    entries: Map<any, any> | null;
+    current: YarnLockEntry | null | undefined;
+    subkey: string | symbol | undefined;
+    static parse(data: any): YarnLock;
+    static fromTree(tree: any): YarnLock;
+    constructor();
+    endCurrent(): void;
+    parse(data: any): this;
+    splitQuoted(str: any, delim: any): any[];
+    toString(): string;
+    fromTree(tree: any): this;
+    addEntryFromNode(node: any): void;
+    entryDataFromNode(node: any): {
+        dependencies: any;
+        optionalDependencies: any;
+        version: any;
+        resolved: any;
+        integrity: any;
+    };
+    static get Entry(): typeof YarnLockEntry;
+}
+declare class YarnLockEntry {
+    #private;
+    resolved: any;
+    version: any;
+    integrity: any;
+    dependencies: any;
+    optionalDependencies: any;
+    constructor(specs: any);
+    toString(): string;
+    addSpec(spec: any): void;
+}
+export default YarnLock;
+//# sourceMappingURL=yarn-lock.d.ts.map

package/types/lib/third-party/arborist/lib/yarn-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yarn-lock.d.ts","sourceRoot":"","sources":["../../../../../lib/third-party/arborist/lib/yarn-lock.js"],"names":[],"mappings":"AAkGA,cAAM,QAAQ;IAUL,OAAO;IAKP,OAAO;IACP,MAAM;IAfb,MAAM,CAAC,KAAK,CAAC,IAAI,KAAA,YAEhB;IAED,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAA,YAEnB;IAED,cAGC;IAED,UAAU,SAGT;IAED,KAAK,CAAC,IAAI,KAAA,QAiET;IAED,WAAW,CAAC,GAAG,KAAA,EAAE,KAAK,KAAA,SA4BrB;IAED,QAAQ,WASP;IAED,QAAQ,CAAC,IAAI,KAAA,QAYZ;IAED,gBAAgB,CAAC,IAAI,KAAA,QAyFpB;IAED,iBAAiB,CAAC,IAAI,KAAA;;;;;;MAwBrB;IAED,MAAM,KAAK,KAAK,yBAEf;CACF;AAED,cAAM,aAAa;;IAIV,QAAQ;IACR,OAAO;IACP,SAAS;IACT,YAAY;IACZ,oBAAoB;IAN3B,YAAY,KAAK,KAAA,EAOhB;IAED,QAAQ,WAiBP;IAED,OAAO,CAAC,IAAI,KAAA,QAEX;CACF;eAEc,QAAQ"}

package/types/lib/validator/bomValidator.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Validate the generated bom using jsonschema
+ *
+ * @param {object} bomJson content
+ *
+ * @returns {Promise<Boolean>} true if the BOM is valid. false otherwise.
+ */
+export declare const validateBom: (bomJson: object) => Promise<boolean>;
+/**
+ * Validate the generated SPDX export.
+ *
+ * @param {object|string} spdxJson SPDX json object
+ * @returns {boolean} true if the SPDX export is valid
+ */
+export declare const validateSpdx: (spdxJson: object | string) => boolean;
+/**
+ * Validate the metadata object
+ *
+ * @param {object} bomJson Bom json object
+ */
+export declare const validateMetadata: (bomJson: object) => boolean;
+/**
+ * Validate the format of all purls
+ *
+ * @param {object} bomJson Bom json object
+ */
+export declare const validatePurls: (bomJson: object) => boolean;
+/**
+ * Validate the refs in dependencies block
+ *
+ * @param {object} bomJson Bom json object
+ */
+export declare const validateRefs: (bomJson: object) => boolean;
+/**
+ * Validate the component properties
+ *
+ * @param {object} bomJson Bom json object
+ */
+export declare function validateProps(bomJson: object): boolean;
+//# sourceMappingURL=bomValidator.d.ts.map

package/types/lib/validator/bomValidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bomValidator.d.ts","sourceRoot":"","sources":["../../../lib/validator/bomValidator.js"],"names":[],"mappings":"AAqPA;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAJb,MAAM,KAEJ,OAAO,SAmCnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,aAHd,MAAM,GAAC,MAAM,KACX,OAyLZ,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,YAFlB,MAAM,YAmEhB,CAAC;AA4CF;;;;GAIG;AACH,eAAO,MAAM,aAAa,YAFf,MAAM,YAsHhB,CAAC;AA2CF;;;;GAIG;AACH,eAAO,MAAM,YAAY,YAFd,MAAM,YAwFhB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAF1B,MAE0B,WAkIpC"}

package/types/lib/validator/complianceEngine.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Orchestrates evaluation of internal compliance rule packs (SCVS + CRA) and
+ * aggregates results into per-benchmark scorecards.
+ *
+ * This module is deliberately independent of the CycloneDX BOM audit engine
+ * (lib/stages/postgen/auditBom.js). The two engines share similar *Finding*
+ * output shape so reporters can consume either source uniformly.
+ */
+import { getAllComplianceRules, getCraRules, getScvsRules } from "./complianceRules.js";
+/**
+ * Resolve a benchmark alias (case-insensitive). Returns null when unknown.
+ *
+ * @param {string} alias
+ * @returns {object | null}
+ */
+export declare function resolveBenchmark(alias: string): object | null;
+/**
+ * List all known benchmark aliases in a stable display order.
+ *
+ * @returns {Array<object>}
+ */
+export declare function listBenchmarks(): Array<object>;
+/**
+ * Evaluate one rule against the BOM and return a Finding-shaped object.
+ *
+ * Rules are pure synchronous functions, but we wrap them in try/catch so one
+ * bad rule cannot fail the entire run.
+ *
+ * @param {object} rule
+ * @param {object} bomJson
+ * @returns {object} Finding
+ */
+export declare function evaluateRule(rule: object, bomJson: object): object;
+/**
+ * Evaluate every rule in the catalog, or a filtered subset.
+ *
+ * @param {object} bomJson CycloneDX BOM
+ * @param {object} [opts]
+ * @param {Array<string>} [opts.categories] Filter to these category values.
+ * @param {Array<string>} [opts.benchmarks] Only run rules from these benchmark aliases.
+ * @returns {Array<object>} Findings (one per rule)
+ */
+export declare function evaluateAll(bomJson: object, opts?: {
+    categories?: Array<string>;
+    benchmarks?: Array<string>;
+}): Array<object>;
+/**
+ * Produce a scorecard for a single benchmark against a set of already-evaluated
+ * findings. Scoring rules:
+ *   - pass      counts as 1 / 1.
+ *   - fail      counts as 0 / 1.
+ *   - manual    is excluded from the percentage but counted separately.
+ *
+ * This mirrors how OWASP SCVS publishes results: automatable controls score a
+ * percentage, manual controls are reported so reviewers can address them.
+ *
+ * @param {object} benchmark Result of resolveBenchmark
+ * @param {Array<object>} findings Full set of findings from evaluateAll
+ * @returns {object}
+ */
+export declare function scoreBenchmark(benchmark: object, findings: Array<object>): object;
+/**
+ * Build scorecards for each requested benchmark. When no benchmarks are
+ * specified, returns scorecards for every built-in benchmark alias.
+ *
+ * @param {Array<object>} findings
+ * @param {Array<string>} [requestedAliases]
+ * @returns {Array<object>}
+ */
+export declare function buildBenchmarkReports(findings: Array<object>, requestedAliases?: Array<string>): Array<object>;
+export { getAllComplianceRules, getCraRules, getScvsRules };
+//# sourceMappingURL=complianceEngine.d.ts.map

package/types/lib/validator/complianceEngine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"complianceEngine.d.ts","sourceRoot":"","sources":["../../../lib/validator/complianceEngine.js"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,qBAAqB,EACrB,WAAW,EACX,YAAY,EACb,MAAM,sBAAsB,CAAC;AAsD9B;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAH3B,MAG2B,GAFzB,MAAM,GAAG,IAAI,CAKzB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAFjB,KAAK,CAAC,MAAM,CAAC,CAIzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CA6ClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,OAAO,EANxB,MAMwB,EAAE,IAAI,AALtC,CAGA,EAFA;IAA6B,UAAU,AAAvC,CACA,EADQ,KAAK,CAAC,MAAM,CAAC,CACrB;IAA6B,UAAU,AAAvC,CACA,EADQ,KAAK,CAAC,MAAM,CAAC,CACrB;CAE2C,GAFjC,KAAK,CAAC,MAAM,CAAC,CAqBzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAJ7B,MAI6B,EAAE,QAAQ,EAHvC,KAAK,CAAC,MAAM,CAG2B,GAFrC,MAAM,CAuClB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAJnC,KAAK,CAAC,MAAM,CAIuB,EAAE,gBAAgB,AAH7D,CACA,EADQ,KAAK,CAAC,MAAM,CAGyC,GAFnD,KAAK,CAAC,MAAM,CAAC,CAOzB;AAED,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC"}

package/types/lib/validator/complianceRules.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Internal compliance rule catalog for cdx-validate.
+ *
+ * Implements OWASP SCVS (Software Component Verification Standard) controls
+ * and selected EU Cyber Resilience Act (CRA) SBOM expectations as plain
+ * JavaScript evaluators. Controls that are not automatable from a static
+ * CycloneDX BOM (for example, process or organizational controls) are still
+ * modelled so that benchmark reports can surface them as "manual review
+ * required" items with a stable identifier.
+ *
+ * Each rule exports:
+ *   id            - Stable short identifier (e.g. "SCVS-1.1").
+ *   name          - Human readable short name.
+ *   description   - Long description (wording taken from the source standard).
+ *   standard      - Source standard key: "SCVS" or "CRA".
+ *   standardRefs  - Array of canonical control identifiers.
+ *   category      - Grouping used by --categories.
+ *   severity      - Severity emitted for a failing automatable rule.
+ *   scvsLevels    - For SCVS rules, the levels (L1/L2/L3) that require the
+ *                   control. Non-SCVS rules use an empty array.
+ *   automatable   - True when evaluate() returns a deterministic pass/fail
+ *                   from the BOM alone. False means the rule is emitted as
+ *                   severity "info" / status "manual" so downstream tooling
+ *                   can track coverage.
+ *   evaluate      - Function(bomJson) => RuleResult.
+ *
+ * RuleResult shape:
+ *   {
+ *     status: "pass" | "fail" | "manual",
+ *     message: string,              // human readable summary
+ *     mitigation?: string,
+ *     locations?: Array<{ bomRef?, purl?, file? }>,
+ *     evidence?: Record<string, any>
+ *   }
+ */
+/**
+ * Returns the full catalog of compliance rules (SCVS + CRA).
+ *
+ * @returns {Array<object>}
+ */
+export declare function getAllComplianceRules(): Array<object>;
+/**
+ * Returns only SCVS rules.
+ *
+ * @returns {Array<object>}
+ */
+export declare function getScvsRules(): Array<object>;
+/**
+ * Returns only CRA rules.
+ *
+ * @returns {Array<object>}
+ */
+export declare function getCraRules(): Array<object>;
+/**
+ * Test-only export exposing internal helper functions for unit tests.
+ * Double-underscore prefixed to discourage external use.
+ *
+ * @type {Object}
+ */
+export declare const __test: Object;
+//# sourceMappingURL=complianceRules.d.ts.map

package/types/lib/validator/complianceRules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"complianceRules.d.ts","sourceRoot":"","sources":["../../../lib/validator/complianceRules.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAskDH;;;;GAIG;AACH,wBAAgB,qBAAqB,IAFxB,KAAK,CAAC,MAAM,CAAC,CAIzB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAFf,KAAK,CAAC,MAAM,CAAC,CAIzB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,IAFd,KAAK,CAAC,MAAM,CAAC,CAIzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,MAAM,EAFT,MAQT,CAAC"}

package/types/lib/validator/index.d.ts

@@ -0,0 +1,101 @@
+/**
+ * cdx-validate orchestrator.
+ *
+ * Combines cdxgen's existing structural validation
+ * ({@link ./bomValidator.js}) with the compliance rule packs in
+ * {@link ./complianceEngine.js} and (optionally) signature verification from
+ * {@link ../helpers/bomSigner.js}.
+ *
+ * This module exposes a single high-level function, `validateBomAdvanced`,
+ * and helpers to classify the result. It does *not* perform any I/O: the CLI
+ * wrapper (`bin/validate.js`) is responsible for reading the input BOM.
+ */
+/**
+ * Map of severity names to numeric ordering used for severity threshold
+ * comparisons.
+ *
+ * @type {Object<string, number>}
+ */
+declare const SEVERITY_ORDER: Record<string, number>;
+/**
+ * Validate a BOM.
+ *
+ * Validation is done in JavaScript. `cdxrs validate` is deliberately not used:
+ * it rejects BOMs the JS validator accepts and reports its findings on stdout
+ * rather than through the bridge, which turns a disagreement between the two
+ * implementations into an unexplained non-zero exit.
+ *
+ * **No failure mode may abort SBOM generation.**
+ *
+ * @param {object} bomJson Parsed CycloneDX BOM.
+ * @returns {Promise<{ valid: boolean, source: "js", findings: null }>}
+ */
+export declare function validateGeneratedBom(bomJson: object): Promise<{
+    valid: boolean;
+    source: "js";
+    findings: null;
+}>;
+/**
+ * Run structural + compliance validation against a parsed BOM.
+ *
+ * @param {object} bomJson Parsed CycloneDX JSON BOM.
+ * @param {object} [options]
+ * @param {boolean} [options.schema]            Run JSON-Schema validation (default true).
+ * @param {boolean} [options.deep]              Run purl/ref/metadata deep checks (default true).
+ * @param {Array<string>} [options.benchmarks]  Aliases to include in the scorecards (default: all).
+ * @param {Array<string>} [options.categories]  Restrict compliance rules to these categories.
+ * @param {string} [options.minSeverity]        Minimum severity for returned findings.
+ * @param {boolean} [options.includeManual]     Include manual-review findings (default true).
+ * @param {boolean} [options.includePass]       Include passing findings (default false).
+ * @param {string} [options.publicKey]          If set, verify the BOM signature.
+ * @returns {{
+ *   schemaValid: boolean,
+ *   deepValid: boolean,
+ *   signatureVerified: boolean | null,
+ *   signatureDetails: object | null,
+ *   findings: Array<object>,
+ *   allFindings: Array<object>,
+ *   benchmarks: Array<object>,
+ *   summary: object
+ * }}
+ */
+export declare function validateBomAdvanced(bomJson: object, options?: {
+    schema?: boolean;
+    deep?: boolean;
+    benchmarks?: Array<string>;
+    categories?: Array<string>;
+    minSeverity?: string;
+    includeManual?: boolean;
+    includePass?: boolean;
+    publicKey?: string;
+}): {
+    schemaValid: boolean;
+    deepValid: boolean;
+    signatureVerified: boolean | null;
+    signatureDetails: object | null;
+    findings: Array<object>;
+    allFindings: Array<object>;
+    benchmarks: Array<object>;
+    summary: object;
+};
+/**
+ * Decide whether a report should trigger a non-zero CLI exit.
+ *
+ * @param {object} report
+ * @param {object} opts
+ * @param {string} [opts.failSeverity] Severity level at or above which failing findings are considered a failure (default "high").
+ * @param {boolean} [opts.strict]      When true, failing on any `fail` status regardless of severity, and a failing schema/deep validation also counts.
+ * @param {boolean} [opts.requireSignature] Require a valid signature when verification was requested.
+ * @returns {{ shouldFail: boolean, reason: string | null }}
+ */
+export declare function shouldFail(report: object, opts?: {
+    failSeverity?: string;
+    strict?: boolean;
+    requireSignature?: boolean;
+}): {
+    shouldFail: boolean;
+    reason: string | null;
+};
+export { buildBenchmarkReports, evaluateAll } from "./complianceEngine.js";
+export { SEVERITY_ORDER };
+//# sourceMappingURL=index.d.ts.map

package/types/lib/validator/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/validator/index.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAYH;;;;;GAKG;AACH,QAAA,MAAM,cAAc,wBAAuD,CAAC;AA4D5E;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,CAAC,CAKrE;AAoCD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EArBtC,MAqBsC,EAAE,OAAO,AApBvD,CASA,EARA;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAA0B,IAAI,AAA9B,CACA,EADQ,OAAO,CACf;IAAgC,UAAU,AAA1C,CACA,EADQ,KAAK,CAAC,MAAM,CAAC,CACrB;IAAgC,UAAU,AAA1C,CACA,EADQ,KAAK,CAAC,MAAM,CAAC,CACrB;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;CAW4D,GAXlD;IACR,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAA;CAChB,CA2CH;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAPtB,MAOsB,EAAE,IAAI,GALpC;IAAsB,YAAY,AAAlC,CACA,EADQ,MAAM,CACd;IAAuB,MAAM,AAA7B,CACA,EADQ,OAAO,CACf;IAAuB,gBAAgB,AAAvC,CACA,EADQ,OAAO,CACf;CAEyC,GAF/B;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CA0B1D;AAED,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,CAAC"}

package/types/lib/validator/reporters/annotations.d.ts

@@ -0,0 +1,37 @@
+/**
+ * CycloneDX annotation reporter — embeds findings as `annotations[]` entries
+ * on a copy of the input BOM. Can be reused by `bom-audit`.
+ *
+ * CycloneDX supports the annotation schema from spec version 1.5 onward.
+ */
+/**
+ * Render a set of findings into CycloneDX annotations.
+ *
+ * @param {Array<object>} findings Finding objects emitted by the validator or auditBom engine.
+ * @param {object} bomJson Full CycloneDX BOM (needed for annotator/subject wiring).
+ * @returns {Array<object>} CycloneDX annotation objects.
+ */
+export declare function buildAnnotations(findings: Array<object>, bomJson: object): Array<object>;
+/**
+ * Produce a new BOM object with findings embedded as annotations. The caller
+ * is responsible for writing the result to disk.
+ *
+ * @param {object} bomJson
+ * @param {Array<object>} findings
+ * @returns {object}
+ */
+export declare function renderBom(bomJson: object, findings: Array<object>): object;
+/**
+ * Convenience wrapper matching the signature of the other reporters. The
+ * second argument expects `{ bomJson }` because annotations are BOM-shaped,
+ * not report-shaped.
+ *
+ * @param {object} report Output of validateBomAdvanced().
+ * @param {object} options
+ * @param {object} options.bomJson The BOM to annotate.
+ * @returns {string} JSON string of the annotated BOM.
+ */
+export declare function render(report: object, options?: {
+    bomJson: object;
+}): string;
+//# sourceMappingURL=annotations.d.ts.map

package/types/lib/validator/reporters/annotations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"annotations.d.ts","sourceRoot":"","sources":["../../../../lib/validator/reporters/annotations.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AAyBH;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAJ9B,KAAK,CAAC,MAAM,CAIkB,EAAE,OAAO,EAHvC,MAGuC,GAFrC,KAAK,CAAC,MAAM,CAAC,CAwEzB;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAJtB,MAIsB,EAAE,QAAQ,EAHhC,KAAK,CAAC,MAAM,CAGoB,GAF9B,MAAM,CAUlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CAAC,MAAM,EALlB,MAKkB,EAAE,OAAO,GAHnC;IAAwB,OAAO,EAAvB,MAAM,CACd;CAEwC,GAF9B,MAAM,CAMlB"}

package/types/lib/validator/reporters/console.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Console reporter — renders findings and benchmark scorecards as tables.
+ * Uses cdxgen's internal table helper for lightweight rendering.
+ */
+/**
+ * Produce a human-readable summary of findings.
+ *
+ * @param {Array<object>} findings
+ * @param {object} [options]
+ * @returns {string}
+ */
+export declare function formatFindings(findings: Array<object>, options?: object): string;
+/**
+ * Produce a scorecard table for benchmark reports.
+ *
+ * @param {Array<object>} reports
+ * @returns {string}
+ */
+export declare function formatBenchmarks(reports: Array<object>): string;
+/**
+ * Produce a compact one-line summary for CI logs.
+ *
+ * @param {object} summary
+ * @returns {string}
+ */
+export declare function formatSummary(summary: object): string;
+/**
+ * Render the full report as a single string.
+ *
+ * @param {object} report Output of validateBomAdvanced().
+ * @returns {string}
+ */
+export declare function render(report: object): string;
+//# sourceMappingURL=console.d.ts.map

package/types/lib/validator/reporters/console.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"console.d.ts","sourceRoot":"","sources":["../../../../lib/validator/reporters/console.js"],"names":[],"mappings":"AAAA;;;GAGG;AAoBH;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAJ5B,KAAK,CAAC,MAAM,CAIgB,EAAE,OAAO,AAH7C,CACA,EADQ,MAG0C,GAFxC,MAAM,CAiClB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,KAAK,CAAC,MAAM,CAGiB,GAF3B,MAAM,CAmClB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB,MAAM,CAWlB;AAED;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAHlB,MAGkB,GAFhB,MAAM,CAkClB"}

package/types/lib/validator/reporters/index.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Reporter registry — dispatches to the requested reporter.
+ *
+ * Reporters are intentionally kept as independent modules so they can also be
+ * consumed by the BOM audit engine or future validators.
+ */
+import * as annotations from "./annotations.js";
+import * as consoleReporter from "./console.js";
+import * as json from "./json.js";
+import * as sarif from "./sarif.js";
+/**
+ * Map of reporter name → module.
+ */
+export declare const reporters: {
+    console: typeof consoleReporter;
+    json: typeof json;
+    sarif: typeof sarif;
+    annotations: typeof annotations;
+};
+/**
+ * Render a validation report using the named reporter.
+ *
+ * @param {string} name   Reporter identifier.
+ * @param {object} report Output of validateBomAdvanced().
+ * @param {object} [opts] Reporter-specific options.
+ * @returns {string}
+ */
+export declare function render(name: string, report: object, opts?: object): string;
+export { annotations, consoleReporter as console, json, sarif };
+//# sourceMappingURL=index.d.ts.map

package/types/lib/validator/reporters/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../lib/validator/reporters/index.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,eAAe,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AAEpC;;GAEG;AACH,eAAO,MAAM,SAAS;;;;;CAKrB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,IAAI,EALhB,MAKgB,EAAE,MAAM,EAJxB,MAIwB,EAAE,IAAI,AAHtC,CACA,EADQ,MAG8B,GAF5B,MAAM,CAUlB;AAED,OAAO,EAAE,WAAW,EAAE,eAAe,IAAI,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC"}

package/types/lib/validator/reporters/json.d.ts

@@ -0,0 +1,11 @@
+/**
+ * JSON reporter — emits a stable, documented structure for programmatic use.
+ * No dependencies.
+ */
+/**
+ * @param {object} report Output of validateBomAdvanced().
+ * @param {object} [_options] Unused
+ * @returns {string}
+ */
+export declare function render(report: object, _options?: object): string;
+//# sourceMappingURL=json.d.ts.map

package/types/lib/validator/reporters/json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../../../lib/validator/reporters/json.js"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAJlB,MAIkB,EAAE,QAAQ,AAHpC,CACA,EADQ,MAGiC,GAF/B,MAAM,CA4BlB"}

package/types/lib/validator/reporters/sarif.d.ts

@@ -0,0 +1,22 @@
+/**
+ * SARIF 2.1.0 reporter — renders findings as a SARIF log suitable for upload
+ * to GitHub code scanning or any other SARIF-aware consumer.
+ *
+ * No external dependencies. Spec: https://docs.oasis-open.org/sarif/sarif/v2.1.0/
+ */
+/**
+ * Render a validation report as SARIF.
+ *
+ * @param {object} report Output of validateBomAdvanced().
+ * @param {object} [options]
+ * @param {string} [options.toolName]    Override driver name.
+ * @param {string} [options.toolVersion] Driver version to embed.
+ * @param {boolean} [options.includeManual] Include manual-review findings (default false).
+ * @returns {string}
+ */
+export declare function render(report: object, options?: {
+    toolName?: string;
+    toolVersion?: string;
+    includeManual?: boolean;
+}): string;
+//# sourceMappingURL=sarif.d.ts.map

package/types/lib/validator/reporters/sarif.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.d.ts","sourceRoot":"","sources":["../../../../lib/validator/reporters/sarif.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AAgIH;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAPlB,MAOkB,EAAE,OAAO,AANnC,CAIA,EAHA;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,CACd;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;CAEwC,GAF9B,MAAM,CA0ClB"}

package/mod.d.ts

@@ -1,7 +0,0 @@
-/**
- * Name placeholder for cdxgen v13.
- *
- * @returns A message naming the package to install instead
- */
-export declare function placeholderNotice(): string;
-export default placeholderNotice;

package/mod.js

@@ -1,22 +0,0 @@
-/**
- * Name placeholder for cdxgen v13.
- *
- * This package exists so that the `@cdxgen/cdxgen` name is registered on npm
- * and JSR, which is a precondition for configuring trusted publishing (OIDC)
- * on either registry: a trusted publisher is attached to an existing package,
- * so the package has to be created before the real release can use it.
- *
- * It deliberately ships no CLI. cdxgen's binary is called `cdxgen`, and a
- * placeholder that installs an executable of that name would shadow the real
- * tool for anyone who installed this by mistake.
- *
- * @returns {string} A message naming the package to install instead
- */
-export function placeholderNotice() {
-  return (
-    "@cdxgen/cdxgen is a name placeholder. cdxgen v13 has not been released " +
-    "under this name yet — install @cyclonedx/cdxgen instead."
-  );
-}
-
-export default placeholderNotice;