@cdxgen/cdxgen 0.0.1 → 13.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (722) hide show
  1. package/README.md +921 -87
  2. package/bin/audit.js +239 -0
  3. package/bin/cdxgen.js +2324 -0
  4. package/bin/convert.js +213 -0
  5. package/bin/evinse.js +353 -0
  6. package/bin/hbom.js +495 -0
  7. package/bin/repl.js +2224 -0
  8. package/bin/sign.js +195 -0
  9. package/bin/tracebom.js +295 -0
  10. package/bin/validate.js +268 -0
  11. package/bin/verify.js +189 -0
  12. package/data/README.md +307 -0
  13. package/data/bom-1.4.schema.json +1605 -0
  14. package/data/bom-1.5.schema.json +3660 -0
  15. package/data/bom-1.6.schema.json +5511 -0
  16. package/data/bom-1.7.schema.json +6700 -0
  17. package/data/cbomosdb-queries.json +68 -0
  18. package/data/component-tags.json +339 -0
  19. package/data/container-knowledge-index.json +125 -0
  20. package/data/cosdb-queries.json +17 -0
  21. package/data/crypto-oid.json +1998 -0
  22. package/data/cryptography-defs.json +3793 -0
  23. package/data/cryptography-defs.schema.json +576 -0
  24. package/data/cyclonedx-2.0-bundled.schema.json +7182 -0
  25. package/data/frameworks-list.json +219 -0
  26. package/data/glibc-stdlib.json +117 -0
  27. package/data/gtfobins-index.json +6296 -0
  28. package/data/helpers/init.gradle +71 -0
  29. package/data/jsf-0.82.schema.json +211 -0
  30. package/data/known-licenses.json +82 -0
  31. package/data/lic-mapping.json +338 -0
  32. package/data/license-aliases.json +6624 -0
  33. package/data/license-db.json +39059 -0
  34. package/data/license-deprecations.json +302 -0
  35. package/data/lolbas-index.json +150 -0
  36. package/data/predictive-audit-allowlist.json +11 -0
  37. package/data/pypi-pkg-aliases.json +1199 -0
  38. package/data/python-stdlib.json +308 -0
  39. package/data/queries-darwin.json +193 -0
  40. package/data/queries-win.json +257 -0
  41. package/data/queries.json +268 -0
  42. package/data/ruby-known-modules.json +281 -0
  43. package/data/rules/ai-agent-governance.yaml +323 -0
  44. package/data/rules/ai-bom.yaml +268 -0
  45. package/data/rules/ai-oversight.yaml +186 -0
  46. package/data/rules/ai-provenance.yaml +92 -0
  47. package/data/rules/asar-archives.yaml +150 -0
  48. package/data/rules/cbom-security.yaml +165 -0
  49. package/data/rules/chrome-extensions.yaml +248 -0
  50. package/data/rules/ci-permissions.yaml +802 -0
  51. package/data/rules/container-risk.yaml +353 -0
  52. package/data/rules/dependency-sources.yaml +236 -0
  53. package/data/rules/golem-go.yaml +229 -0
  54. package/data/rules/hbom-compliance.yaml +325 -0
  55. package/data/rules/hbom-performance.yaml +307 -0
  56. package/data/rules/hbom-security.yaml +248 -0
  57. package/data/rules/host-topology.yaml +165 -0
  58. package/data/rules/mcp-servers.yaml +388 -0
  59. package/data/rules/obom-runtime.yaml +1776 -0
  60. package/data/rules/package-integrity.yaml +364 -0
  61. package/data/rules/rootfs-hardening.yaml +179 -0
  62. package/data/rules/vscode-extensions.yaml +237 -0
  63. package/data/spdx-export.schema.json +6794 -0
  64. package/data/spdx-license-list.json +7449 -0
  65. package/data/spdx-licenses.json +759 -0
  66. package/data/spdx.schema.json +819 -0
  67. package/data/templates/README.md +3 -0
  68. package/data/templates/asvs-4.0.3.cdx.json +2943 -0
  69. package/data/templates/asvs-5.0.cdx.json +3046 -0
  70. package/data/templates/bsimm-v13.cdx.json +1008 -0
  71. package/data/templates/masvs-2.0.0.cdx.json +225 -0
  72. package/data/templates/nist-ssdf-1.1.cdx.json +828 -0
  73. package/data/templates/pcissc-secure-slc-1.1.cdx.json +1027 -0
  74. package/data/templates/scvs-1.0.0.cdx.json +813 -0
  75. package/data/templates/ssaf-DRAFT-2023-11.cdx.json +127 -0
  76. package/data/vendor-alias.json +41967 -0
  77. package/data/wrapdb-releases.json +4227 -0
  78. package/index.cjs +15 -0
  79. package/lib/audit/index.js +2800 -0
  80. package/lib/audit/progress.js +114 -0
  81. package/lib/audit/reporters.js +937 -0
  82. package/lib/audit/scoring.js +560 -0
  83. package/lib/audit/targets.js +798 -0
  84. package/lib/cli/bomAssembly.js +1833 -0
  85. package/lib/cli/cliOptions.js +513 -0
  86. package/lib/cli/index.js +2759 -0
  87. package/lib/cli/jsBom.js +2087 -0
  88. package/lib/cli/jvmBom.js +1858 -0
  89. package/lib/cli/managedBom.js +2083 -0
  90. package/lib/cli/nativeBom.js +2125 -0
  91. package/lib/core/activity.js +1087 -0
  92. package/lib/core/env.js +719 -0
  93. package/lib/core/fs.js +1058 -0
  94. package/lib/core/httpClient.js +730 -0
  95. package/lib/core/logger.js +142 -0
  96. package/lib/core/parallel.js +323 -0
  97. package/lib/core/paths.js +70 -0
  98. package/lib/core/projectConfig.js +122 -0
  99. package/lib/core/propertySanitizer.js +174 -0
  100. package/lib/core/spdx.js +5 -0
  101. package/lib/core/state.js +59 -0
  102. package/lib/core/text.js +207 -0
  103. package/lib/core/ui.js +876 -0
  104. package/lib/core/urls.js +84 -0
  105. package/lib/ecosystems/asarutils.js +1636 -0
  106. package/lib/ecosystems/bunutils.js +402 -0
  107. package/lib/ecosystems/caxa.js +77 -0
  108. package/lib/ecosystems/chromextutils.js +1174 -0
  109. package/lib/ecosystems/cmakeResolver.js +587 -0
  110. package/lib/ecosystems/cppEvidence.js +305 -0
  111. package/lib/ecosystems/denoutils.js +1094 -0
  112. package/lib/ecosystems/dotnetutils.js +132 -0
  113. package/lib/ecosystems/ecosystems.js +2772 -0
  114. package/lib/ecosystems/golem.js +1807 -0
  115. package/lib/ecosystems/gradleutils.js +1048 -0
  116. package/lib/ecosystems/jsEvidence.js +317 -0
  117. package/lib/ecosystems/npmutils.js +586 -0
  118. package/lib/ecosystems/parsers-bazel.js +875 -0
  119. package/lib/ecosystems/parsers-dotnet.js +1430 -0
  120. package/lib/ecosystems/parsers-gleam.js +302 -0
  121. package/lib/ecosystems/parsers-go.js +818 -0
  122. package/lib/ecosystems/parsers-js.js +4222 -0
  123. package/lib/ecosystems/parsers-jvm.js +948 -0
  124. package/lib/ecosystems/parsers-misc.js +3191 -0
  125. package/lib/ecosystems/parsers-python.js +2070 -0
  126. package/lib/ecosystems/parsers-rust.js +1294 -0
  127. package/lib/ecosystems/parsers-zig.js +861 -0
  128. package/lib/ecosystems/pep770.js +341 -0
  129. package/lib/ecosystems/pylockutils.js +427 -0
  130. package/lib/ecosystems/pythonutils.js +1281 -0
  131. package/lib/ecosystems/registryProvenance.js +1003 -0
  132. package/lib/ecosystems/remote/huggingface.js +1343 -0
  133. package/lib/ecosystems/rubyutils.js +1629 -0
  134. package/lib/ecosystems/rusi.js +820 -0
  135. package/lib/ecosystems/sbtutils.js +972 -0
  136. package/lib/ecosystems/tea.js +607 -0
  137. package/lib/ecosystems/utils.js +575 -0
  138. package/lib/ecosystems/zigResolver.js +410 -0
  139. package/lib/evinser/db.js +145 -0
  140. package/lib/evinser/evinser.js +2362 -0
  141. package/lib/evinser/scalasem.js +65 -0
  142. package/lib/evinser/swiftsem.js +767 -0
  143. package/lib/helpers/annotationFormatter.js +84 -0
  144. package/lib/helpers/bomSigner.js +312 -0
  145. package/lib/helpers/exportUtils.js +160 -0
  146. package/lib/helpers/remote/dependency-track.js +117 -0
  147. package/lib/helpers/versutils.js +202 -0
  148. package/lib/helpers/vsixutils.js +1069 -0
  149. package/lib/inventory/agentFormulationParser.js +322 -0
  150. package/lib/inventory/aiCollector.js +2140 -0
  151. package/lib/inventory/aiInventory.js +414 -0
  152. package/lib/inventory/aiModelVariants.js +121 -0
  153. package/lib/inventory/aiOversightCollector.js +661 -0
  154. package/lib/inventory/aiProvenanceCollector.js +822 -0
  155. package/lib/inventory/analyzer.js +6089 -0
  156. package/lib/inventory/analyzerScope.js +807 -0
  157. package/lib/inventory/astWorker.js +20 -0
  158. package/lib/inventory/atomUtils.js +1092 -0
  159. package/lib/inventory/auditCategories.js +192 -0
  160. package/lib/inventory/bomUtils.js +369 -0
  161. package/lib/inventory/cacheCommands.js +182 -0
  162. package/lib/inventory/cacheDir.js +104 -0
  163. package/lib/inventory/cbomutils.js +590 -0
  164. package/lib/inventory/cdxrs.js +434 -0
  165. package/lib/inventory/ciParsers/azurePipelines.js +295 -0
  166. package/lib/inventory/ciParsers/circleCi.js +286 -0
  167. package/lib/inventory/ciParsers/common.js +24 -0
  168. package/lib/inventory/ciParsers/githubActions.js +2434 -0
  169. package/lib/inventory/ciParsers/gitlabCi.js +213 -0
  170. package/lib/inventory/ciParsers/jenkins.js +180 -0
  171. package/lib/inventory/citations.js +234 -0
  172. package/lib/inventory/communityAiConfigParser.js +756 -0
  173. package/lib/inventory/containerRisk.js +204 -0
  174. package/lib/inventory/cryptoAlgorithmFamily.js +258 -0
  175. package/lib/inventory/deps.js +807 -0
  176. package/lib/inventory/depsUtils.js +588 -0
  177. package/lib/inventory/display.js +2128 -0
  178. package/lib/inventory/dosai.js +601 -0
  179. package/lib/inventory/dosaiParsers.js +154 -0
  180. package/lib/inventory/dynamic.js +145 -0
  181. package/lib/inventory/envcontext.js +1789 -0
  182. package/lib/inventory/evidenceUtils.js +774 -0
  183. package/lib/inventory/fetchBatch.js +779 -0
  184. package/lib/inventory/fetchRate.js +255 -0
  185. package/lib/inventory/forgeEnricher.js +300 -0
  186. package/lib/inventory/formulationParsers.js +422 -0
  187. package/lib/inventory/gtfobins.js +339 -0
  188. package/lib/inventory/hbom.js +719 -0
  189. package/lib/inventory/hbomAnalysis.js +310 -0
  190. package/lib/inventory/hbomLoader.js +35 -0
  191. package/lib/inventory/hostTopology.js +835 -0
  192. package/lib/inventory/inventoryStats.js +100 -0
  193. package/lib/inventory/jsonLike.js +121 -0
  194. package/lib/inventory/licenseEnhancer.js +918 -0
  195. package/lib/inventory/lolbas.js +285 -0
  196. package/lib/inventory/mcp.js +253 -0
  197. package/lib/inventory/mcpConfigParser.js +683 -0
  198. package/lib/inventory/mcpDiscovery.js +112 -0
  199. package/lib/inventory/mcpPinning.js +209 -0
  200. package/lib/inventory/osPackageResolver.js +493 -0
  201. package/lib/inventory/osinfo.js +277 -0
  202. package/lib/inventory/osqueryTransform.js +274 -0
  203. package/lib/inventory/plugins.js +466 -0
  204. package/lib/inventory/protobom.js +231 -0
  205. package/lib/inventory/protobomLoader.js +43 -0
  206. package/lib/inventory/provenanceUtils.js +224 -0
  207. package/lib/inventory/purl.js +749 -0
  208. package/lib/inventory/rustFormulationParser.js +339 -0
  209. package/lib/inventory/sbomDocument.js +340 -0
  210. package/lib/inventory/source.js +1488 -0
  211. package/lib/inventory/spdx.js +361 -0
  212. package/lib/inventory/spdxExpression.js +512 -0
  213. package/lib/inventory/spdxUtils.js +107 -0
  214. package/lib/inventory/table.js +263 -0
  215. package/lib/inventory/traceRunner.js +439 -0
  216. package/lib/inventory/unicodeScan.js +147 -0
  217. package/lib/managers/binary.js +3307 -0
  218. package/lib/managers/containerutils.js +125 -0
  219. package/lib/managers/docker.js +2145 -0
  220. package/lib/managers/dockerConnection.js +162 -0
  221. package/lib/managers/oci.js +704 -0
  222. package/lib/managers/piptree.js +267 -0
  223. package/lib/parsers/cmakeCache.js +199 -0
  224. package/lib/parsers/gguf.js +492 -0
  225. package/lib/parsers/gitAiNotes.js +233 -0
  226. package/lib/parsers/gitmodules.js +239 -0
  227. package/lib/parsers/htmlExtract.js +610 -0
  228. package/lib/parsers/huggingfaceManifest.js +551 -0
  229. package/lib/parsers/huggingfaceUtils.js +506 -0
  230. package/lib/parsers/iri.js +618 -0
  231. package/lib/parsers/npmrc.js +99 -0
  232. package/lib/parsers/ollama.js +101 -0
  233. package/lib/parsers/xml.js +841 -0
  234. package/lib/server/openapi.yaml +433 -0
  235. package/lib/server/server.js +616 -0
  236. package/lib/stages/postgen/annotator.js +977 -0
  237. package/lib/stages/postgen/auditBom.js +468 -0
  238. package/lib/stages/postgen/postgen.js +1239 -0
  239. package/lib/stages/postgen/ruleEngine.js +731 -0
  240. package/lib/stages/postgen/sortBom.js +195 -0
  241. package/lib/stages/postgen/spdxConverter.js +796 -0
  242. package/lib/stages/postgen/specVersionCompat.js +703 -0
  243. package/lib/stages/pregen/envAudit.js +388 -0
  244. package/lib/stages/pregen/pregen.js +637 -0
  245. package/lib/third-party/README.md +9 -0
  246. package/lib/third-party/arborist/CHANGELOG.md +1109 -0
  247. package/lib/third-party/arborist/LICENSE.md +20 -0
  248. package/lib/third-party/arborist/README.md +315 -0
  249. package/lib/third-party/arborist/lib/arborist/index.js +258 -0
  250. package/lib/third-party/arborist/lib/arborist/load-actual.js +605 -0
  251. package/lib/third-party/arborist/lib/arborist/load-virtual.js +300 -0
  252. package/lib/third-party/arborist/lib/bin-links.js +120 -0
  253. package/lib/third-party/arborist/lib/calc-dep-flags.js +130 -0
  254. package/lib/third-party/arborist/lib/case-insensitive-map.js +51 -0
  255. package/lib/third-party/arborist/lib/consistent-resolve.js +42 -0
  256. package/lib/third-party/arborist/lib/debug.js +50 -0
  257. package/lib/third-party/arborist/lib/dep-valid.js +190 -0
  258. package/lib/third-party/arborist/lib/edge.js +417 -0
  259. package/lib/third-party/arborist/lib/from-path.js +36 -0
  260. package/lib/third-party/arborist/lib/gather-dep-set.js +43 -0
  261. package/lib/third-party/arborist/lib/index.js +22 -0
  262. package/lib/third-party/arborist/lib/inventory.js +138 -0
  263. package/lib/third-party/arborist/lib/link.js +169 -0
  264. package/lib/third-party/arborist/lib/node.js +1673 -0
  265. package/lib/third-party/arborist/lib/npm-extension.js +45 -0
  266. package/lib/third-party/arborist/lib/override-resolves.js +11 -0
  267. package/lib/third-party/arborist/lib/override-set.js +319 -0
  268. package/lib/third-party/arborist/lib/package-extensions.js +289 -0
  269. package/lib/third-party/arborist/lib/printable.js +210 -0
  270. package/lib/third-party/arborist/lib/proc-log.js +30 -0
  271. package/lib/third-party/arborist/lib/realpath.js +100 -0
  272. package/lib/third-party/arborist/lib/relpath.js +4 -0
  273. package/lib/third-party/arborist/lib/shrinkwrap.js +1291 -0
  274. package/lib/third-party/arborist/lib/spec-from-lock.js +34 -0
  275. package/lib/third-party/arborist/lib/tree-check.js +165 -0
  276. package/lib/third-party/arborist/lib/validate-npm-package-name.js +107 -0
  277. package/lib/third-party/arborist/lib/version-from-tgz.js +51 -0
  278. package/lib/third-party/arborist/lib/yarn-lock.js +397 -0
  279. package/lib/validator/bomValidator.js +985 -0
  280. package/lib/validator/complianceEngine.js +241 -0
  281. package/lib/validator/complianceRules.js +1680 -0
  282. package/lib/validator/generated/runtime.mjs +17 -0
  283. package/lib/validator/generated/validate-1.6.mjs +21258 -0
  284. package/lib/validator/generated/validate-1.7.mjs +24803 -0
  285. package/lib/validator/generated/validate-2.0.mjs +22931 -0
  286. package/lib/validator/index.js +246 -0
  287. package/lib/validator/reporters/annotations.js +142 -0
  288. package/lib/validator/reporters/console.js +160 -0
  289. package/lib/validator/reporters/index.js +41 -0
  290. package/lib/validator/reporters/json.js +37 -0
  291. package/lib/validator/reporters/sarif.js +184 -0
  292. package/package.json +209 -26
  293. package/types/bin/audit.d.ts +3 -0
  294. package/types/bin/audit.d.ts.map +1 -0
  295. package/types/bin/cdxgen.d.ts +3 -0
  296. package/types/bin/cdxgen.d.ts.map +1 -0
  297. package/types/bin/convert.d.ts +3 -0
  298. package/types/bin/convert.d.ts.map +1 -0
  299. package/types/bin/evinse.d.ts +3 -0
  300. package/types/bin/evinse.d.ts.map +1 -0
  301. package/types/bin/hbom.d.ts +3 -0
  302. package/types/bin/hbom.d.ts.map +1 -0
  303. package/types/bin/repl.d.ts +3 -0
  304. package/types/bin/repl.d.ts.map +1 -0
  305. package/types/bin/sign.d.ts +3 -0
  306. package/types/bin/sign.d.ts.map +1 -0
  307. package/types/bin/tracebom.d.ts +3 -0
  308. package/types/bin/tracebom.d.ts.map +1 -0
  309. package/types/bin/validate.d.ts +14 -0
  310. package/types/bin/validate.d.ts.map +1 -0
  311. package/types/bin/verify.d.ts +3 -0
  312. package/types/bin/verify.d.ts.map +1 -0
  313. package/types/lib/audit/index.d.ts +153 -0
  314. package/types/lib/audit/index.d.ts.map +1 -0
  315. package/types/lib/audit/progress.d.ts +31 -0
  316. package/types/lib/audit/progress.d.ts.map +1 -0
  317. package/types/lib/audit/reporters.d.ts +62 -0
  318. package/types/lib/audit/reporters.d.ts.map +1 -0
  319. package/types/lib/audit/scoring.d.ts +36 -0
  320. package/types/lib/audit/scoring.d.ts.map +1 -0
  321. package/types/lib/audit/targets.d.ts +77 -0
  322. package/types/lib/audit/targets.d.ts.map +1 -0
  323. package/types/lib/cli/bomAssembly.d.ts +315 -0
  324. package/types/lib/cli/bomAssembly.d.ts.map +1 -0
  325. package/types/lib/cli/cliOptions.d.ts +156 -0
  326. package/types/lib/cli/cliOptions.d.ts.map +1 -0
  327. package/types/lib/cli/index.d.ts +107 -0
  328. package/types/lib/cli/index.d.ts.map +1 -0
  329. package/types/lib/cli/jsBom.d.ts +94 -0
  330. package/types/lib/cli/jsBom.d.ts.map +1 -0
  331. package/types/lib/cli/jvmBom.d.ts +54 -0
  332. package/types/lib/cli/jvmBom.d.ts.map +1 -0
  333. package/types/lib/cli/managedBom.d.ts +105 -0
  334. package/types/lib/cli/managedBom.d.ts.map +1 -0
  335. package/types/lib/cli/nativeBom.d.ts +143 -0
  336. package/types/lib/cli/nativeBom.d.ts.map +1 -0
  337. package/types/lib/core/activity.d.ts +178 -0
  338. package/types/lib/core/activity.d.ts.map +1 -0
  339. package/types/lib/core/env.d.ts +192 -0
  340. package/types/lib/core/env.d.ts.map +1 -0
  341. package/types/lib/core/fs.d.ts +158 -0
  342. package/types/lib/core/fs.d.ts.map +1 -0
  343. package/types/lib/core/httpClient.d.ts +149 -0
  344. package/types/lib/core/httpClient.d.ts.map +1 -0
  345. package/types/lib/core/logger.d.ts +28 -0
  346. package/types/lib/core/logger.d.ts.map +1 -0
  347. package/types/lib/core/parallel.d.ts +95 -0
  348. package/types/lib/core/parallel.d.ts.map +1 -0
  349. package/types/lib/core/paths.d.ts +36 -0
  350. package/types/lib/core/paths.d.ts.map +1 -0
  351. package/types/lib/core/projectConfig.d.ts +23 -0
  352. package/types/lib/core/projectConfig.d.ts.map +1 -0
  353. package/types/lib/core/propertySanitizer.d.ts +23 -0
  354. package/types/lib/core/propertySanitizer.d.ts.map +1 -0
  355. package/types/lib/core/spdx.d.ts +5 -0
  356. package/types/lib/core/spdx.d.ts.map +1 -0
  357. package/types/lib/core/state.d.ts +20 -0
  358. package/types/lib/core/state.d.ts.map +1 -0
  359. package/types/lib/core/text.d.ts +78 -0
  360. package/types/lib/core/text.d.ts.map +1 -0
  361. package/types/lib/core/ui.d.ts +87 -0
  362. package/types/lib/core/ui.d.ts.map +1 -0
  363. package/types/lib/core/urls.d.ts +43 -0
  364. package/types/lib/core/urls.d.ts.map +1 -0
  365. package/types/lib/ecosystems/asarutils.d.ts +71 -0
  366. package/types/lib/ecosystems/asarutils.d.ts.map +1 -0
  367. package/types/lib/ecosystems/bunutils.d.ts +38 -0
  368. package/types/lib/ecosystems/bunutils.d.ts.map +1 -0
  369. package/types/lib/ecosystems/caxa.d.ts +8 -0
  370. package/types/lib/ecosystems/caxa.d.ts.map +1 -0
  371. package/types/lib/ecosystems/chromextutils.d.ts +97 -0
  372. package/types/lib/ecosystems/chromextutils.d.ts.map +1 -0
  373. package/types/lib/ecosystems/cmakeResolver.d.ts +176 -0
  374. package/types/lib/ecosystems/cmakeResolver.d.ts.map +1 -0
  375. package/types/lib/ecosystems/cppEvidence.d.ts +35 -0
  376. package/types/lib/ecosystems/cppEvidence.d.ts.map +1 -0
  377. package/types/lib/ecosystems/denoutils.d.ts +76 -0
  378. package/types/lib/ecosystems/denoutils.d.ts.map +1 -0
  379. package/types/lib/ecosystems/dotnetutils.d.ts +45 -0
  380. package/types/lib/ecosystems/dotnetutils.d.ts.map +1 -0
  381. package/types/lib/ecosystems/ecosystems.d.ts +279 -0
  382. package/types/lib/ecosystems/ecosystems.d.ts.map +1 -0
  383. package/types/lib/ecosystems/golem.d.ts +60 -0
  384. package/types/lib/ecosystems/golem.d.ts.map +1 -0
  385. package/types/lib/ecosystems/gradleutils.d.ts +139 -0
  386. package/types/lib/ecosystems/gradleutils.d.ts.map +1 -0
  387. package/types/lib/ecosystems/jsEvidence.d.ts +17 -0
  388. package/types/lib/ecosystems/jsEvidence.d.ts.map +1 -0
  389. package/types/lib/ecosystems/npmutils.d.ts +183 -0
  390. package/types/lib/ecosystems/npmutils.d.ts.map +1 -0
  391. package/types/lib/ecosystems/parsers-bazel.d.ts +36 -0
  392. package/types/lib/ecosystems/parsers-bazel.d.ts.map +1 -0
  393. package/types/lib/ecosystems/parsers-dotnet.d.ts +116 -0
  394. package/types/lib/ecosystems/parsers-dotnet.d.ts.map +1 -0
  395. package/types/lib/ecosystems/parsers-gleam.d.ts +33 -0
  396. package/types/lib/ecosystems/parsers-gleam.d.ts.map +1 -0
  397. package/types/lib/ecosystems/parsers-go.d.ts +92 -0
  398. package/types/lib/ecosystems/parsers-go.d.ts.map +1 -0
  399. package/types/lib/ecosystems/parsers-js.d.ts +242 -0
  400. package/types/lib/ecosystems/parsers-js.d.ts.map +1 -0
  401. package/types/lib/ecosystems/parsers-jvm.d.ts +100 -0
  402. package/types/lib/ecosystems/parsers-jvm.d.ts.map +1 -0
  403. package/types/lib/ecosystems/parsers-misc.d.ts +450 -0
  404. package/types/lib/ecosystems/parsers-misc.d.ts.map +1 -0
  405. package/types/lib/ecosystems/parsers-python.d.ts +145 -0
  406. package/types/lib/ecosystems/parsers-python.d.ts.map +1 -0
  407. package/types/lib/ecosystems/parsers-rust.d.ts +56 -0
  408. package/types/lib/ecosystems/parsers-rust.d.ts.map +1 -0
  409. package/types/lib/ecosystems/parsers-zig.d.ts +83 -0
  410. package/types/lib/ecosystems/parsers-zig.d.ts.map +1 -0
  411. package/types/lib/ecosystems/pep770.d.ts +38 -0
  412. package/types/lib/ecosystems/pep770.d.ts.map +1 -0
  413. package/types/lib/ecosystems/pylockutils.d.ts +68 -0
  414. package/types/lib/ecosystems/pylockutils.d.ts.map +1 -0
  415. package/types/lib/ecosystems/pythonutils.d.ts +70 -0
  416. package/types/lib/ecosystems/pythonutils.d.ts.map +1 -0
  417. package/types/lib/ecosystems/registryProvenance.d.ts +26 -0
  418. package/types/lib/ecosystems/registryProvenance.d.ts.map +1 -0
  419. package/types/lib/ecosystems/remote/huggingface.d.ts +31 -0
  420. package/types/lib/ecosystems/remote/huggingface.d.ts.map +1 -0
  421. package/types/lib/ecosystems/rubyutils.d.ts +182 -0
  422. package/types/lib/ecosystems/rubyutils.d.ts.map +1 -0
  423. package/types/lib/ecosystems/rusi.d.ts +40 -0
  424. package/types/lib/ecosystems/rusi.d.ts.map +1 -0
  425. package/types/lib/ecosystems/sbtutils.d.ts +179 -0
  426. package/types/lib/ecosystems/sbtutils.d.ts.map +1 -0
  427. package/types/lib/ecosystems/tea.d.ts +180 -0
  428. package/types/lib/ecosystems/tea.d.ts.map +1 -0
  429. package/types/lib/ecosystems/utils.d.ts +41 -0
  430. package/types/lib/ecosystems/utils.d.ts.map +1 -0
  431. package/types/lib/ecosystems/zigResolver.d.ts +70 -0
  432. package/types/lib/ecosystems/zigResolver.d.ts.map +1 -0
  433. package/types/lib/evinser/db.d.ts +17 -0
  434. package/types/lib/evinser/db.d.ts.map +1 -0
  435. package/types/lib/evinser/evinser.d.ts +354 -0
  436. package/types/lib/evinser/evinser.d.ts.map +1 -0
  437. package/types/lib/evinser/scalasem.d.ts +15 -0
  438. package/types/lib/evinser/scalasem.d.ts.map +1 -0
  439. package/types/lib/evinser/swiftsem.d.ts +103 -0
  440. package/types/lib/evinser/swiftsem.d.ts.map +1 -0
  441. package/types/lib/helpers/annotationFormatter.d.ts +23 -0
  442. package/types/lib/helpers/annotationFormatter.d.ts.map +1 -0
  443. package/types/lib/helpers/bomSigner.d.ts +28 -0
  444. package/types/lib/helpers/bomSigner.d.ts.map +1 -0
  445. package/types/lib/helpers/exportUtils.d.ts +52 -0
  446. package/types/lib/helpers/exportUtils.d.ts.map +1 -0
  447. package/types/lib/helpers/remote/dependency-track.d.ts +23 -0
  448. package/types/lib/helpers/remote/dependency-track.d.ts.map +1 -0
  449. package/types/lib/helpers/versutils.d.ts +8 -0
  450. package/types/lib/helpers/versutils.d.ts.map +1 -0
  451. package/types/lib/helpers/vsixutils.d.ts +130 -0
  452. package/types/lib/helpers/vsixutils.d.ts.map +1 -0
  453. package/types/lib/inventory/agentFormulationParser.d.ts +21 -0
  454. package/types/lib/inventory/agentFormulationParser.d.ts.map +1 -0
  455. package/types/lib/inventory/aiCollector.d.ts +61 -0
  456. package/types/lib/inventory/aiCollector.d.ts.map +1 -0
  457. package/types/lib/inventory/aiInventory.d.ts +103 -0
  458. package/types/lib/inventory/aiInventory.d.ts.map +1 -0
  459. package/types/lib/inventory/aiModelVariants.d.ts +31 -0
  460. package/types/lib/inventory/aiModelVariants.d.ts.map +1 -0
  461. package/types/lib/inventory/aiOversightCollector.d.ts +28 -0
  462. package/types/lib/inventory/aiOversightCollector.d.ts.map +1 -0
  463. package/types/lib/inventory/aiProvenanceCollector.d.ts +13 -0
  464. package/types/lib/inventory/aiProvenanceCollector.d.ts.map +1 -0
  465. package/types/lib/inventory/analyzer.d.ts +157 -0
  466. package/types/lib/inventory/analyzer.d.ts.map +1 -0
  467. package/types/lib/inventory/analyzerScope.d.ts +106 -0
  468. package/types/lib/inventory/analyzerScope.d.ts.map +1 -0
  469. package/types/lib/inventory/astWorker.d.ts +9 -0
  470. package/types/lib/inventory/astWorker.d.ts.map +1 -0
  471. package/types/lib/inventory/atomUtils.d.ts +159 -0
  472. package/types/lib/inventory/atomUtils.d.ts.map +1 -0
  473. package/types/lib/inventory/auditCategories.d.ts +80 -0
  474. package/types/lib/inventory/auditCategories.d.ts.map +1 -0
  475. package/types/lib/inventory/bomUtils.d.ts +145 -0
  476. package/types/lib/inventory/bomUtils.d.ts.map +1 -0
  477. package/types/lib/inventory/cacheCommands.d.ts +28 -0
  478. package/types/lib/inventory/cacheCommands.d.ts.map +1 -0
  479. package/types/lib/inventory/cacheDir.d.ts +55 -0
  480. package/types/lib/inventory/cacheDir.d.ts.map +1 -0
  481. package/types/lib/inventory/cbomutils.d.ts +37 -0
  482. package/types/lib/inventory/cbomutils.d.ts.map +1 -0
  483. package/types/lib/inventory/cdxrs.d.ts +90 -0
  484. package/types/lib/inventory/cdxrs.d.ts.map +1 -0
  485. package/types/lib/inventory/ciParsers/azurePipelines.d.ts +27 -0
  486. package/types/lib/inventory/ciParsers/azurePipelines.d.ts.map +1 -0
  487. package/types/lib/inventory/ciParsers/circleCi.d.ts +27 -0
  488. package/types/lib/inventory/ciParsers/circleCi.d.ts.map +1 -0
  489. package/types/lib/inventory/ciParsers/common.d.ts +11 -0
  490. package/types/lib/inventory/ciParsers/common.d.ts.map +1 -0
  491. package/types/lib/inventory/ciParsers/githubActions.d.ts +38 -0
  492. package/types/lib/inventory/ciParsers/githubActions.d.ts.map +1 -0
  493. package/types/lib/inventory/ciParsers/gitlabCi.d.ts +26 -0
  494. package/types/lib/inventory/ciParsers/gitlabCi.d.ts.map +1 -0
  495. package/types/lib/inventory/ciParsers/jenkins.d.ts +26 -0
  496. package/types/lib/inventory/ciParsers/jenkins.d.ts.map +1 -0
  497. package/types/lib/inventory/citations.d.ts +90 -0
  498. package/types/lib/inventory/citations.d.ts.map +1 -0
  499. package/types/lib/inventory/communityAiConfigParser.d.ts +14 -0
  500. package/types/lib/inventory/communityAiConfigParser.d.ts.map +1 -0
  501. package/types/lib/inventory/containerRisk.d.ts +20 -0
  502. package/types/lib/inventory/containerRisk.d.ts.map +1 -0
  503. package/types/lib/inventory/cryptoAlgorithmFamily.d.ts +37 -0
  504. package/types/lib/inventory/cryptoAlgorithmFamily.d.ts.map +1 -0
  505. package/types/lib/inventory/deps.d.ts +140 -0
  506. package/types/lib/inventory/deps.d.ts.map +1 -0
  507. package/types/lib/inventory/depsUtils.d.ts +74 -0
  508. package/types/lib/inventory/depsUtils.d.ts.map +1 -0
  509. package/types/lib/inventory/display.d.ts +227 -0
  510. package/types/lib/inventory/display.d.ts.map +1 -0
  511. package/types/lib/inventory/dosai.d.ts +130 -0
  512. package/types/lib/inventory/dosai.d.ts.map +1 -0
  513. package/types/lib/inventory/dosaiParsers.d.ts +59 -0
  514. package/types/lib/inventory/dosaiParsers.d.ts.map +1 -0
  515. package/types/lib/inventory/dynamic.d.ts +25 -0
  516. package/types/lib/inventory/dynamic.d.ts.map +1 -0
  517. package/types/lib/inventory/envcontext.d.ts +377 -0
  518. package/types/lib/inventory/envcontext.d.ts.map +1 -0
  519. package/types/lib/inventory/evidenceUtils.d.ts +74 -0
  520. package/types/lib/inventory/evidenceUtils.d.ts.map +1 -0
  521. package/types/lib/inventory/fetchBatch.d.ts +127 -0
  522. package/types/lib/inventory/fetchBatch.d.ts.map +1 -0
  523. package/types/lib/inventory/fetchRate.d.ts +118 -0
  524. package/types/lib/inventory/fetchRate.d.ts.map +1 -0
  525. package/types/lib/inventory/forgeEnricher.d.ts +31 -0
  526. package/types/lib/inventory/forgeEnricher.d.ts.map +1 -0
  527. package/types/lib/inventory/formulationParsers.d.ts +50 -0
  528. package/types/lib/inventory/formulationParsers.d.ts.map +1 -0
  529. package/types/lib/inventory/gtfobins.d.ts +27 -0
  530. package/types/lib/inventory/gtfobins.d.ts.map +1 -0
  531. package/types/lib/inventory/hbom.d.ts +58 -0
  532. package/types/lib/inventory/hbom.d.ts.map +1 -0
  533. package/types/lib/inventory/hbomAnalysis.d.ts +56 -0
  534. package/types/lib/inventory/hbomAnalysis.d.ts.map +1 -0
  535. package/types/lib/inventory/hbomLoader.d.ts +7 -0
  536. package/types/lib/inventory/hbomLoader.d.ts.map +1 -0
  537. package/types/lib/inventory/hostTopology.d.ts +47 -0
  538. package/types/lib/inventory/hostTopology.d.ts.map +1 -0
  539. package/types/lib/inventory/inventoryStats.d.ts +42 -0
  540. package/types/lib/inventory/inventoryStats.d.ts.map +1 -0
  541. package/types/lib/inventory/jsonLike.d.ts +23 -0
  542. package/types/lib/inventory/jsonLike.d.ts.map +1 -0
  543. package/types/lib/inventory/licenseEnhancer.d.ts +70 -0
  544. package/types/lib/inventory/licenseEnhancer.d.ts.map +1 -0
  545. package/types/lib/inventory/lolbas.d.ts +16 -0
  546. package/types/lib/inventory/lolbas.d.ts.map +1 -0
  547. package/types/lib/inventory/mcp.d.ts +29 -0
  548. package/types/lib/inventory/mcp.d.ts.map +1 -0
  549. package/types/lib/inventory/mcpConfigParser.d.ts +20 -0
  550. package/types/lib/inventory/mcpConfigParser.d.ts.map +1 -0
  551. package/types/lib/inventory/mcpDiscovery.d.ts +33 -0
  552. package/types/lib/inventory/mcpDiscovery.d.ts.map +1 -0
  553. package/types/lib/inventory/mcpPinning.d.ts +11 -0
  554. package/types/lib/inventory/mcpPinning.d.ts.map +1 -0
  555. package/types/lib/inventory/osPackageResolver.d.ts +49 -0
  556. package/types/lib/inventory/osPackageResolver.d.ts.map +1 -0
  557. package/types/lib/inventory/osinfo.d.ts +120 -0
  558. package/types/lib/inventory/osinfo.d.ts.map +1 -0
  559. package/types/lib/inventory/osqueryTransform.d.ts +84 -0
  560. package/types/lib/inventory/osqueryTransform.d.ts.map +1 -0
  561. package/types/lib/inventory/plugins.d.ts +58 -0
  562. package/types/lib/inventory/plugins.d.ts.map +1 -0
  563. package/types/lib/inventory/protobom.d.ts +71 -0
  564. package/types/lib/inventory/protobom.d.ts.map +1 -0
  565. package/types/lib/inventory/protobomLoader.d.ts +17 -0
  566. package/types/lib/inventory/protobomLoader.d.ts.map +1 -0
  567. package/types/lib/inventory/provenanceUtils.d.ts +98 -0
  568. package/types/lib/inventory/provenanceUtils.d.ts.map +1 -0
  569. package/types/lib/inventory/purl.d.ts +313 -0
  570. package/types/lib/inventory/purl.d.ts.map +1 -0
  571. package/types/lib/inventory/rustFormulationParser.d.ts +17 -0
  572. package/types/lib/inventory/rustFormulationParser.d.ts.map +1 -0
  573. package/types/lib/inventory/sbomDocument.d.ts +59 -0
  574. package/types/lib/inventory/sbomDocument.d.ts.map +1 -0
  575. package/types/lib/inventory/source.d.ts +163 -0
  576. package/types/lib/inventory/source.d.ts.map +1 -0
  577. package/types/lib/inventory/spdx.d.ts +66 -0
  578. package/types/lib/inventory/spdx.d.ts.map +1 -0
  579. package/types/lib/inventory/spdxExpression.d.ts +58 -0
  580. package/types/lib/inventory/spdxExpression.d.ts.map +1 -0
  581. package/types/lib/inventory/spdxUtils.d.ts +12 -0
  582. package/types/lib/inventory/spdxUtils.d.ts.map +1 -0
  583. package/types/lib/inventory/table.d.ts +19 -0
  584. package/types/lib/inventory/table.d.ts.map +1 -0
  585. package/types/lib/inventory/traceRunner.d.ts +80 -0
  586. package/types/lib/inventory/traceRunner.d.ts.map +1 -0
  587. package/types/lib/inventory/unicodeScan.d.ts +46 -0
  588. package/types/lib/inventory/unicodeScan.d.ts.map +1 -0
  589. package/types/lib/managers/binary.d.ts +76 -0
  590. package/types/lib/managers/binary.d.ts.map +1 -0
  591. package/types/lib/managers/containerutils.d.ts +30 -0
  592. package/types/lib/managers/containerutils.d.ts.map +1 -0
  593. package/types/lib/managers/docker.d.ts +157 -0
  594. package/types/lib/managers/docker.d.ts.map +1 -0
  595. package/types/lib/managers/dockerConnection.d.ts +42 -0
  596. package/types/lib/managers/dockerConnection.d.ts.map +1 -0
  597. package/types/lib/managers/oci.d.ts +21 -0
  598. package/types/lib/managers/oci.d.ts.map +1 -0
  599. package/types/lib/managers/piptree.d.ts +13 -0
  600. package/types/lib/managers/piptree.d.ts.map +1 -0
  601. package/types/lib/parsers/cmakeCache.d.ts +70 -0
  602. package/types/lib/parsers/cmakeCache.d.ts.map +1 -0
  603. package/types/lib/parsers/gguf.d.ts +39 -0
  604. package/types/lib/parsers/gguf.d.ts.map +1 -0
  605. package/types/lib/parsers/gitAiNotes.d.ts +15 -0
  606. package/types/lib/parsers/gitAiNotes.d.ts.map +1 -0
  607. package/types/lib/parsers/gitmodules.d.ts +88 -0
  608. package/types/lib/parsers/gitmodules.d.ts.map +1 -0
  609. package/types/lib/parsers/htmlExtract.d.ts +34 -0
  610. package/types/lib/parsers/htmlExtract.d.ts.map +1 -0
  611. package/types/lib/parsers/huggingfaceManifest.d.ts +153 -0
  612. package/types/lib/parsers/huggingfaceManifest.d.ts.map +1 -0
  613. package/types/lib/parsers/huggingfaceUtils.d.ts +155 -0
  614. package/types/lib/parsers/huggingfaceUtils.d.ts.map +1 -0
  615. package/types/lib/parsers/iri.d.ts +68 -0
  616. package/types/lib/parsers/iri.d.ts.map +1 -0
  617. package/types/lib/parsers/npmrc.d.ts +33 -0
  618. package/types/lib/parsers/npmrc.d.ts.map +1 -0
  619. package/types/lib/parsers/ollama.d.ts +22 -0
  620. package/types/lib/parsers/ollama.d.ts.map +1 -0
  621. package/types/lib/parsers/xml.d.ts +47 -0
  622. package/types/lib/parsers/xml.d.ts.map +1 -0
  623. package/types/lib/server/server.d.ts +51 -0
  624. package/types/lib/server/server.d.ts.map +1 -0
  625. package/types/lib/stages/postgen/annotator.d.ts +36 -0
  626. package/types/lib/stages/postgen/annotator.d.ts.map +1 -0
  627. package/types/lib/stages/postgen/auditBom.d.ts +92 -0
  628. package/types/lib/stages/postgen/auditBom.d.ts.map +1 -0
  629. package/types/lib/stages/postgen/postgen.d.ts +59 -0
  630. package/types/lib/stages/postgen/postgen.d.ts.map +1 -0
  631. package/types/lib/stages/postgen/ruleEngine.d.ts +18 -0
  632. package/types/lib/stages/postgen/ruleEngine.d.ts.map +1 -0
  633. package/types/lib/stages/postgen/sortBom.d.ts +34 -0
  634. package/types/lib/stages/postgen/sortBom.d.ts.map +1 -0
  635. package/types/lib/stages/postgen/spdxConverter.d.ts +11 -0
  636. package/types/lib/stages/postgen/spdxConverter.d.ts.map +1 -0
  637. package/types/lib/stages/postgen/specVersionCompat.d.ts +71 -0
  638. package/types/lib/stages/postgen/specVersionCompat.d.ts.map +1 -0
  639. package/types/lib/stages/pregen/envAudit.d.ts +14 -0
  640. package/types/lib/stages/pregen/envAudit.d.ts.map +1 -0
  641. package/types/lib/stages/pregen/pregen.d.ts +59 -0
  642. package/types/lib/stages/pregen/pregen.d.ts.map +1 -0
  643. package/types/lib/third-party/arborist/lib/arborist/index.d.ts +47 -0
  644. package/types/lib/third-party/arborist/lib/arborist/index.d.ts.map +1 -0
  645. package/types/lib/third-party/arborist/lib/arborist/load-actual.d.ts +4 -0
  646. package/types/lib/third-party/arborist/lib/arborist/load-actual.d.ts.map +1 -0
  647. package/types/lib/third-party/arborist/lib/arborist/load-virtual.d.ts +4 -0
  648. package/types/lib/third-party/arborist/lib/arborist/load-virtual.d.ts.map +1 -0
  649. package/types/lib/third-party/arborist/lib/bin-links.d.ts +18 -0
  650. package/types/lib/third-party/arborist/lib/bin-links.d.ts.map +1 -0
  651. package/types/lib/third-party/arborist/lib/calc-dep-flags.d.ts +3 -0
  652. package/types/lib/third-party/arborist/lib/calc-dep-flags.d.ts.map +1 -0
  653. package/types/lib/third-party/arborist/lib/case-insensitive-map.d.ts +9 -0
  654. package/types/lib/third-party/arborist/lib/case-insensitive-map.d.ts.map +1 -0
  655. package/types/lib/third-party/arborist/lib/consistent-resolve.d.ts +3 -0
  656. package/types/lib/third-party/arborist/lib/consistent-resolve.d.ts.map +1 -0
  657. package/types/lib/third-party/arborist/lib/debug.d.ts +3 -0
  658. package/types/lib/third-party/arborist/lib/debug.d.ts.map +1 -0
  659. package/types/lib/third-party/arborist/lib/dep-valid.d.ts +3 -0
  660. package/types/lib/third-party/arborist/lib/dep-valid.d.ts.map +1 -0
  661. package/types/lib/third-party/arborist/lib/edge.d.ts +46 -0
  662. package/types/lib/third-party/arborist/lib/edge.d.ts.map +1 -0
  663. package/types/lib/third-party/arborist/lib/from-path.d.ts +3 -0
  664. package/types/lib/third-party/arborist/lib/from-path.d.ts.map +1 -0
  665. package/types/lib/third-party/arborist/lib/gather-dep-set.d.ts +3 -0
  666. package/types/lib/third-party/arborist/lib/gather-dep-set.d.ts.map +1 -0
  667. package/types/lib/third-party/arborist/lib/index.d.ts +3 -0
  668. package/types/lib/third-party/arborist/lib/index.d.ts.map +1 -0
  669. package/types/lib/third-party/arborist/lib/inventory.d.ts +14 -0
  670. package/types/lib/third-party/arborist/lib/inventory.d.ts.map +1 -0
  671. package/types/lib/third-party/arborist/lib/link.d.ts +18 -0
  672. package/types/lib/third-party/arborist/lib/link.d.ts.map +1 -0
  673. package/types/lib/third-party/arborist/lib/node.d.ts +112 -0
  674. package/types/lib/third-party/arborist/lib/node.d.ts.map +1 -0
  675. package/types/lib/third-party/arborist/lib/npm-extension.d.ts +18 -0
  676. package/types/lib/third-party/arborist/lib/npm-extension.d.ts.map +1 -0
  677. package/types/lib/third-party/arborist/lib/override-resolves.d.ts +3 -0
  678. package/types/lib/third-party/arborist/lib/override-resolves.d.ts.map +1 -0
  679. package/types/lib/third-party/arborist/lib/override-set.d.ts +27 -0
  680. package/types/lib/third-party/arborist/lib/override-set.d.ts.map +1 -0
  681. package/types/lib/third-party/arborist/lib/package-extensions.d.ts +36 -0
  682. package/types/lib/third-party/arborist/lib/package-extensions.d.ts.map +1 -0
  683. package/types/lib/third-party/arborist/lib/printable.d.ts +3 -0
  684. package/types/lib/third-party/arborist/lib/printable.d.ts.map +1 -0
  685. package/types/lib/third-party/arborist/lib/proc-log.d.ts +20 -0
  686. package/types/lib/third-party/arborist/lib/proc-log.d.ts.map +1 -0
  687. package/types/lib/third-party/arborist/lib/realpath.d.ts +3 -0
  688. package/types/lib/third-party/arborist/lib/realpath.d.ts.map +1 -0
  689. package/types/lib/third-party/arborist/lib/relpath.d.ts +3 -0
  690. package/types/lib/third-party/arborist/lib/relpath.d.ts.map +1 -0
  691. package/types/lib/third-party/arborist/lib/shrinkwrap.d.ts +54 -0
  692. package/types/lib/third-party/arborist/lib/shrinkwrap.d.ts.map +1 -0
  693. package/types/lib/third-party/arborist/lib/spec-from-lock.d.ts +3 -0
  694. package/types/lib/third-party/arborist/lib/spec-from-lock.d.ts.map +1 -0
  695. package/types/lib/third-party/arborist/lib/tree-check.d.ts +3 -0
  696. package/types/lib/third-party/arborist/lib/tree-check.d.ts.map +1 -0
  697. package/types/lib/third-party/arborist/lib/validate-npm-package-name.d.ts +13 -0
  698. package/types/lib/third-party/arborist/lib/validate-npm-package-name.d.ts.map +1 -0
  699. package/types/lib/third-party/arborist/lib/version-from-tgz.d.ts +6 -0
  700. package/types/lib/third-party/arborist/lib/version-from-tgz.d.ts.map +1 -0
  701. package/types/lib/third-party/arborist/lib/yarn-lock.d.ts +35 -0
  702. package/types/lib/third-party/arborist/lib/yarn-lock.d.ts.map +1 -0
  703. package/types/lib/validator/bomValidator.d.ts +40 -0
  704. package/types/lib/validator/bomValidator.d.ts.map +1 -0
  705. package/types/lib/validator/complianceEngine.d.ts +72 -0
  706. package/types/lib/validator/complianceEngine.d.ts.map +1 -0
  707. package/types/lib/validator/complianceRules.d.ts +61 -0
  708. package/types/lib/validator/complianceRules.d.ts.map +1 -0
  709. package/types/lib/validator/index.d.ts +101 -0
  710. package/types/lib/validator/index.d.ts.map +1 -0
  711. package/types/lib/validator/reporters/annotations.d.ts +37 -0
  712. package/types/lib/validator/reporters/annotations.d.ts.map +1 -0
  713. package/types/lib/validator/reporters/console.d.ts +34 -0
  714. package/types/lib/validator/reporters/console.d.ts.map +1 -0
  715. package/types/lib/validator/reporters/index.d.ts +30 -0
  716. package/types/lib/validator/reporters/index.d.ts.map +1 -0
  717. package/types/lib/validator/reporters/json.d.ts +11 -0
  718. package/types/lib/validator/reporters/json.d.ts.map +1 -0
  719. package/types/lib/validator/reporters/sarif.d.ts +22 -0
  720. package/types/lib/validator/reporters/sarif.d.ts.map +1 -0
  721. package/mod.d.ts +0 -7
  722. package/mod.js +0 -22
package/lib/core/ui.js ADDED
@@ -0,0 +1,876 @@
1
+ /**
2
+ * Live-region CLI UI controller.
3
+ *
4
+ * Layer 0: imports nothing outside `lib/core`. The mechanism is a single live
5
+ * region: a block of lines rewritten in place by rewinding only by the previous
6
+ * frame's height. The block never ends with a newline until `stop()`, so every
7
+ * update is a single `write` and a crashed process can never leave a torn frame
8
+ * on screen.
9
+ *
10
+ * The UX layer on top is the phase model: `ui.phase(label)` returns a handle
11
+ * whose `detail`/`progress`/`succeed`/`fail`/`skip` calls drive the region. In
12
+ * non-interactive mode the same calls emit at most one plain line per state
13
+ * transition, so callers never branch on `ui.interactive`.
14
+ */
15
+
16
+ import process from "node:process";
17
+ import { formatWithOptions, inspect } from "node:util";
18
+
19
+ import { readEnvironmentVariable } from "./activity.js";
20
+ import { stringWidth, stripAnsi } from "./text.js";
21
+
22
+ // Frame interval, and the floor on how often detail/progress updates redraw.
23
+ // Updates arriving faster than this are coalesced by the refresh timer.
24
+ const REFRESH_MS = 80;
25
+
26
+ // Glyph sets. Unicode support is a separate capability from color: a redirected
27
+ // UTF-8 log file takes the glyphs happily, while a legacy Windows console
28
+ // renders them as boxes whether or not it does color.
29
+ const GLYPHS = {
30
+ unicode: {
31
+ frames: ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"],
32
+ ellipsis: "…",
33
+ succeeded: "✔",
34
+ failed: "✖",
35
+ skipped: "→",
36
+ },
37
+ ascii: {
38
+ // The frames lib/audit/progress.js used before this module existed.
39
+ frames: ["-", "\\", "|", "/"],
40
+ ellipsis: "...",
41
+ succeeded: "+",
42
+ failed: "x",
43
+ skipped: "~",
44
+ },
45
+ };
46
+
47
+ // Semantic colors — only emitted when `color` is true.
48
+ const COLOR = {
49
+ dim: (s) => `\x1b[2m${s}\x1b[22m`,
50
+ green: (s) => `\x1b[32m${s}\x1b[39m`,
51
+ red: (s) => `\x1b[31m${s}\x1b[39m`,
52
+ yellow: (s) => `\x1b[33m${s}\x1b[39m`,
53
+ };
54
+
55
+ const HIDE_CURSOR = "\x1b[?25l";
56
+ const SHOW_CURSOR = "\x1b[?25h";
57
+ const CLEAR_LINE = "\r\x1b[2K";
58
+ const CURSOR_UP_CLEAR = "\x1b[1A\x1b[2K";
59
+
60
+ const LEVEL_SILENT = 0;
61
+ const LEVEL_NORMAL = 1;
62
+ const LEVEL_VERBOSE = 2;
63
+ const LEVEL_DEBUG = 3;
64
+
65
+ const LEVEL_NAMES = new Map([
66
+ ["silent", LEVEL_SILENT],
67
+ ["quiet", LEVEL_SILENT],
68
+ ["error", LEVEL_SILENT],
69
+ ["normal", LEVEL_NORMAL],
70
+ ["info", LEVEL_NORMAL],
71
+ ["warn", LEVEL_NORMAL],
72
+ ["verbose", LEVEL_VERBOSE],
73
+ ["debug", LEVEL_DEBUG],
74
+ ]);
75
+
76
+ // Phase status → the color and log level its committed line uses. The marker
77
+ // glyph comes from the resolved glyph set.
78
+ const PHASE_OUTCOMES = {
79
+ succeeded: { color: COLOR.green, level: "info" },
80
+ failed: { color: COLOR.red, level: "error" },
81
+ skipped: { color: COLOR.yellow, level: "warn" },
82
+ };
83
+
84
+ /**
85
+ * Resolve a capability snapshot for the live region. Re-runs cleanly when given
86
+ * `overrides` (used by tests with a fake stream and a captive env object).
87
+ *
88
+ * `FORCE_COLOR` non-empty wins over `isatty()`; `TERM` in {dumb, unknown}
89
+ * forces non-interactive; `NO_COLOR` non-empty disables color but not the live
90
+ * region; `CDXGEN_NO_PROGRESS` and `CI=true` disable the live region. A worker
91
+ * thread needs no special case: its stdio is a pipe, so `isTTY` is undefined.
92
+ *
93
+ * @param {object} [overrides] Overrides for stream, env, and resolved flags
94
+ * @returns {{stream: object, interactive: boolean, color: boolean, unicode: boolean, glyphs: object, columns: () => number, rows: () => number}} Capability snapshot
95
+ */
96
+ export function detectCapabilities(overrides = {}) {
97
+ const stream = overrides.stream || process.stderr;
98
+ const env = overrides.env;
99
+ const read = (name) => (env ? env[name] : readEnvironmentVariable(name));
100
+ const isSet = (name) => {
101
+ const value = read(name);
102
+ return value !== undefined && value !== null && value !== "";
103
+ };
104
+ const term = `${read("TERM") || ""}`.toLowerCase();
105
+ const isDumbTerm = term === "dumb" || term === "unknown";
106
+ const ci = `${read("CI") || ""}`.toLowerCase() === "true";
107
+ const noProgressEnv = `${read("CDXGEN_NO_PROGRESS") || ""}`.toLowerCase();
108
+ const noProgress =
109
+ overrides.noProgress === true ||
110
+ noProgressEnv === "true" ||
111
+ noProgressEnv === "1";
112
+ const interactive =
113
+ overrides.interactive !== undefined
114
+ ? !!overrides.interactive
115
+ : stream?.isTTY === true && !isDumbTerm && !ci && !noProgress;
116
+ const color =
117
+ overrides.color !== undefined
118
+ ? !!overrides.color
119
+ : isSet("FORCE_COLOR") || (interactive && !isSet("NO_COLOR"));
120
+ // Legacy Windows consoles draw braille and box-drawing glyphs as boxes.
121
+ // Windows Terminal and VS Code advertise themselves, and every other platform
122
+ // is assumed UTF-8 capable. CDXGEN_UNICODE overrides the guess either way.
123
+ const unicodeEnv = `${read("CDXGEN_UNICODE") || ""}`.toLowerCase();
124
+ let unicode;
125
+ if (overrides.unicode !== undefined) {
126
+ unicode = !!overrides.unicode;
127
+ } else if (unicodeEnv === "true" || unicodeEnv === "1") {
128
+ unicode = true;
129
+ } else if (unicodeEnv === "false" || unicodeEnv === "0") {
130
+ unicode = false;
131
+ } else {
132
+ unicode =
133
+ process.platform !== "win32" ||
134
+ isSet("WT_SESSION") ||
135
+ read("TERM_PROGRAM") === "vscode";
136
+ }
137
+ return {
138
+ stream,
139
+ interactive,
140
+ color,
141
+ unicode,
142
+ glyphs: unicode ? GLYPHS.unicode : GLYPHS.ascii,
143
+ // Read per frame so a terminal resize self-corrects on the next tick.
144
+ columns: () => (Number(stream?.columns) > 0 ? Number(stream.columns) : 80),
145
+ rows: () => (Number(stream?.rows) > 0 ? Number(stream.rows) : 25),
146
+ };
147
+ }
148
+
149
+ /**
150
+ * Resolve the verbosity level. Existing debug env vars win over the flag so no
151
+ * user's CI breaks.
152
+ *
153
+ * @param {number|string} [explicit] Flag-derived level
154
+ * @returns {number} Level in 0..3
155
+ */
156
+ function resolveLevel(explicit) {
157
+ const named = LEVEL_NAMES.get(
158
+ `${readEnvironmentVariable("CDXGEN_LOG_LEVEL") || ""}`.toLowerCase(),
159
+ );
160
+ if (named !== undefined) {
161
+ return named;
162
+ }
163
+ if (
164
+ readEnvironmentVariable("CDXGEN_DEBUG_MODE") === "debug" ||
165
+ readEnvironmentVariable("SCAN_DEBUG_MODE") === "debug"
166
+ ) {
167
+ return LEVEL_DEBUG;
168
+ }
169
+ if (explicit === undefined || explicit === null) {
170
+ return LEVEL_NORMAL;
171
+ }
172
+ const numeric = Number(explicit);
173
+ if (!Number.isFinite(numeric)) {
174
+ return LEVEL_NAMES.get(`${explicit}`.toLowerCase()) ?? LEVEL_NORMAL;
175
+ }
176
+ return Math.max(LEVEL_SILENT, Math.min(LEVEL_DEBUG, Math.round(numeric)));
177
+ }
178
+
179
+ /**
180
+ * Resolve the log serialization format. The env var wins over the flag.
181
+ *
182
+ * @param {string} [explicit] Flag-derived format
183
+ * @returns {("text"|"json")} Resolved format
184
+ */
185
+ function resolveFormat(explicit) {
186
+ const fromEnv =
187
+ `${readEnvironmentVariable("CDXGEN_LOG_FORMAT") || ""}`.toLowerCase();
188
+ if (fromEnv === "json" || fromEnv === "text") {
189
+ return fromEnv;
190
+ }
191
+ return `${explicit || ""}`.toLowerCase() === "json" ? "json" : "text";
192
+ }
193
+
194
+ /**
195
+ * Select a spinner frame from elapsed wall-clock time, so the animation runs at
196
+ * the right rate however often refresh fires and re-rendering during a print
197
+ * never advances it.
198
+ *
199
+ * @param {number} startedAt Phase start timestamp
200
+ * @param {number} now Current timestamp
201
+ * @param {string[]} frames Frame set
202
+ * @returns {string} The frame for this instant
203
+ */
204
+ function spinnerFrame(startedAt, now, frames) {
205
+ const elapsed = Math.max(0, now - startedAt);
206
+ return frames[Math.floor(elapsed / REFRESH_MS) % frames.length];
207
+ }
208
+
209
+ /**
210
+ * Render a determinate progress bar.
211
+ *
212
+ * @param {number} done Completed units
213
+ * @param {number} total Total units
214
+ * @param {number} width Total bar width including brackets
215
+ * @returns {string} Rendered bar, or "" when total is not positive
216
+ */
217
+ function renderBar(done, total, width) {
218
+ const safeTotal = Number(total) > 0 ? Number(total) : 0;
219
+ if (safeTotal <= 0) {
220
+ return "";
221
+ }
222
+ const safeDone = Math.max(0, Math.min(safeTotal, Number(done) || 0));
223
+ const innerWidth = Math.max(4, width - 2);
224
+ const filled = Math.round((safeDone / safeTotal) * innerWidth);
225
+ return `[${"#".repeat(filled)}${"-".repeat(innerWidth - filled)}] ${safeDone}/${safeTotal}`;
226
+ }
227
+
228
+ /**
229
+ * Truncate from the left, keeping the tail.
230
+ *
231
+ * Phase detail is usually a path, where the distinguishing part is the end. Two
232
+ * hundred files under one long temp directory all truncate to the same prefix,
233
+ * which tells the reader nothing about what is in flight.
234
+ *
235
+ * @param {string} text Input text
236
+ * @param {number} maxWidth Maximum display width
237
+ * @param {string} ellipsis Marker for the elided head
238
+ * @returns {string} Text fitting within maxWidth
239
+ */
240
+ function truncateHead(text, maxWidth, ellipsis) {
241
+ if (stringWidth(text) <= maxWidth) {
242
+ return text;
243
+ }
244
+ const budget = maxWidth - stringWidth(ellipsis);
245
+ const chars = [...text];
246
+ let width = 0;
247
+ let start = chars.length;
248
+ while (start > 0) {
249
+ const charWidth = stringWidth(chars[start - 1]);
250
+ if (width + charWidth > budget) {
251
+ break;
252
+ }
253
+ width += charWidth;
254
+ start -= 1;
255
+ }
256
+ return `${ellipsis}${chars.slice(start).join("")}`;
257
+ }
258
+
259
+ /**
260
+ * Format console-style arguments into a single line.
261
+ *
262
+ * @param {unknown[]} args Arguments
263
+ * @returns {string} Formatted line
264
+ */
265
+ function formatArgs(args) {
266
+ if (args.length === 0) {
267
+ return "";
268
+ }
269
+ return args
270
+ .map((arg) =>
271
+ typeof arg === "string"
272
+ ? arg
273
+ : inspect(arg, {
274
+ colors: false,
275
+ breakLength: Number.POSITIVE_INFINITY,
276
+ }),
277
+ )
278
+ .join(" ");
279
+ }
280
+
281
+ /**
282
+ * Create a live-region controller.
283
+ *
284
+ * @param {object} [options] Controller options
285
+ * @param {object} [options.stream] Writable stream (default `process.stderr`)
286
+ * @param {number|string} [options.level] Verbosity ladder 0..3
287
+ * @param {("text"|"json")} [options.format] Log serialization format
288
+ * @param {boolean} [options.noProgress] Force-disable the live region
289
+ * @param {boolean} [options.color] Force color on or off
290
+ * @param {boolean} [options.interactive] Force the live region on or off
291
+ * @param {() => number} [options.now] Clock, injectable for tests
292
+ * @returns {object} Controller
293
+ */
294
+ export function createUi(options = {}) {
295
+ let caps = detectCapabilities(options);
296
+ let level = resolveLevel(options.level);
297
+ let format = resolveFormat(options.format);
298
+ const now = typeof options.now === "function" ? options.now : Date.now;
299
+
300
+ // JSON log format disables the live region entirely: NDJSON to stderr only.
301
+ const isLive = () => caps.interactive && format !== "json";
302
+
303
+ /** @type {object[]} Phases currently running, in start order. */
304
+ const running = [];
305
+ let lastHeight = 0;
306
+ let lastRenderAt = 0;
307
+ let dirty = false;
308
+ let stopped = false;
309
+ let interval = null;
310
+ let cursorHidden = false;
311
+ let signalsInstalled = false;
312
+
313
+ function write(chunk) {
314
+ const stream = caps.stream;
315
+ if (!chunk || typeof stream?.write !== "function") {
316
+ return;
317
+ }
318
+ try {
319
+ stream.write(chunk);
320
+ } catch (err) {
321
+ // A consumer that closed the pipe (`| head`) must not produce a stack.
322
+ if (err?.code !== "EPIPE") {
323
+ throw err;
324
+ }
325
+ }
326
+ }
327
+
328
+ function rewind() {
329
+ if (lastHeight <= 0) {
330
+ return "";
331
+ }
332
+ // The cursor sits on the block's last line, so move up height-1 times.
333
+ return `${CLEAR_LINE}${CURSOR_UP_CLEAR.repeat(lastHeight - 1)}`;
334
+ }
335
+
336
+ function renderPhaseRow(phase, at) {
337
+ const { frames, ellipsis } = caps.glyphs;
338
+ let row = `${spinnerFrame(phase.startedAt, at, frames)} ${phase.label}`;
339
+ if (phase.total > 0) {
340
+ const barWidth = Math.min(
341
+ 20,
342
+ Math.max(6, caps.columns() - stringWidth(row) - 16),
343
+ );
344
+ row += ` ${renderBar(phase.done, phase.total, barWidth)}`;
345
+ }
346
+ if (phase.detailText) {
347
+ const separator = caps.unicode ? " — " : " - ";
348
+ const remaining = Math.max(
349
+ 8,
350
+ caps.columns() - stringWidth(row) - stringWidth(separator),
351
+ );
352
+ row += `${separator}${truncateHead(phase.detailText, remaining, ellipsis)}`;
353
+ }
354
+ return row;
355
+ }
356
+
357
+ /**
358
+ * Build the current frame, clamped to the terminal height. Clamping is not
359
+ * cosmetic: a frame taller than the screen scrolls the terminal, after which
360
+ * the rewind count under-shoots and smears output for the rest of the run.
361
+ *
362
+ * @returns {{body: string, height: number}} Frame body and its line count
363
+ */
364
+ function buildFrame() {
365
+ if (!isLive() || running.length === 0) {
366
+ return { body: "", height: 0 };
367
+ }
368
+ const at = now();
369
+ const lines = running.map((phase) => renderPhaseRow(phase, at));
370
+ const maxLines = Math.max(1, caps.rows() - 1);
371
+ if (lines.length <= maxLines) {
372
+ return { body: lines.join("\n"), height: lines.length };
373
+ }
374
+ const kept = lines.slice(0, Math.max(1, maxLines - 1));
375
+ kept.push(`${caps.glyphs.ellipsis} and ${lines.length - kept.length} more`);
376
+ return { body: kept.join("\n"), height: kept.length };
377
+ }
378
+
379
+ function render() {
380
+ if (!isLive()) {
381
+ return;
382
+ }
383
+ const { body, height } = buildFrame();
384
+ write(rewind() + body);
385
+ lastHeight = height;
386
+ lastRenderAt = now();
387
+ dirty = false;
388
+ }
389
+
390
+ /**
391
+ * Request a redraw. State transitions render at once; detail and progress
392
+ * updates are coalesced to one frame per REFRESH_MS, so a caller reporting
393
+ * per-file progress in a tight loop costs one write per frame, not per file.
394
+ *
395
+ * @param {boolean} [force] Render immediately regardless of the throttle
396
+ */
397
+ function requestRender(force = false) {
398
+ if (!isLive()) {
399
+ return;
400
+ }
401
+ dirty = true;
402
+ if (force || now() - lastRenderAt >= REFRESH_MS) {
403
+ render();
404
+ }
405
+ }
406
+
407
+ function tick() {
408
+ if (dirty || running.length > 0) {
409
+ render();
410
+ }
411
+ }
412
+
413
+ function startTimer() {
414
+ if (interval || stopped || !isLive()) {
415
+ return;
416
+ }
417
+ if (!cursorHidden) {
418
+ write(HIDE_CURSOR);
419
+ cursorHidden = true;
420
+ }
421
+ // unref() so a forgotten stop() can never hold the process open.
422
+ interval = setInterval(tick, REFRESH_MS);
423
+ interval.unref?.();
424
+ installSignalHandlers();
425
+ }
426
+
427
+ function stopTimer() {
428
+ if (interval) {
429
+ clearInterval(interval);
430
+ interval = null;
431
+ }
432
+ }
433
+
434
+ function showCursor() {
435
+ if (cursorHidden) {
436
+ write(SHOW_CURSOR);
437
+ cursorHidden = false;
438
+ }
439
+ }
440
+
441
+ function onExit() {
442
+ stopTimer();
443
+ showCursor();
444
+ }
445
+
446
+ /**
447
+ * Restore the terminal and then let the signal do what it would have done.
448
+ * Registering a listener suppresses Node's default terminate-on-SIGINT, so
449
+ * the signal has to be re-raised or Ctrl-C would stop killing long scans.
450
+ *
451
+ * @param {NodeJS.Signals} signal The received signal
452
+ */
453
+ function onSignal(signal) {
454
+ removeSignalHandlers();
455
+ stopTimer();
456
+ showCursor();
457
+ process.kill(process.pid, signal);
458
+ }
459
+
460
+ function installSignalHandlers() {
461
+ if (signalsInstalled) {
462
+ return;
463
+ }
464
+ signalsInstalled = true;
465
+ process.on("SIGINT", onSignal);
466
+ process.on("SIGTERM", onSignal);
467
+ process.on("exit", onExit);
468
+ }
469
+
470
+ function removeSignalHandlers() {
471
+ if (!signalsInstalled) {
472
+ return;
473
+ }
474
+ signalsInstalled = false;
475
+ process.off("SIGINT", onSignal);
476
+ process.off("SIGTERM", onSignal);
477
+ process.off("exit", onExit);
478
+ }
479
+
480
+ /**
481
+ * Print a line above the live region. The line becomes permanent scrollback
482
+ * and the region is redrawn below it, in exactly one `write` so a frame is
483
+ * never left torn.
484
+ *
485
+ * @param {string} text Line to print, without a trailing newline
486
+ */
487
+ function print(text) {
488
+ const line = `${text ?? ""}`;
489
+ if (!isLive()) {
490
+ write(`${line}\n`);
491
+ return;
492
+ }
493
+ const { body, height } = buildFrame();
494
+ write(`${rewind()}${line}\n${body}`);
495
+ lastHeight = height;
496
+ lastRenderAt = now();
497
+ dirty = false;
498
+ }
499
+
500
+ /**
501
+ * Emit one leveled record: NDJSON when the json format is selected, otherwise
502
+ * a line through the live-region-aware print path.
503
+ *
504
+ * @param {string} levelName Record level
505
+ * @param {string} message Message text
506
+ */
507
+ function writeLine(levelName, message) {
508
+ if (format === "json") {
509
+ write(
510
+ `${JSON.stringify({
511
+ ts: new Date().toISOString(),
512
+ level: levelName,
513
+ msg: message,
514
+ })}\n`,
515
+ );
516
+ return;
517
+ }
518
+ print(message);
519
+ }
520
+
521
+ /**
522
+ * Pause the live region, run `fn`, then redraw. Used when a spawned process
523
+ * must own the terminal.
524
+ *
525
+ * @param {() => any} fn Work to run with the region cleared
526
+ * @returns {any} Result of `fn`
527
+ */
528
+ function pause(fn) {
529
+ if (!isLive()) {
530
+ return fn();
531
+ }
532
+ write(rewind());
533
+ lastHeight = 0;
534
+ try {
535
+ return fn();
536
+ } finally {
537
+ render();
538
+ }
539
+ }
540
+
541
+ function commitPhase(phase) {
542
+ const outcome = PHASE_OUTCOMES[phase.status] || PHASE_OUTCOMES.succeeded;
543
+ const glyph = caps.glyphs[phase.status] || caps.glyphs.succeeded;
544
+ const elapsed = `${((now() - phase.startedAt) / 1000).toFixed(1)}s`;
545
+ const parts = [
546
+ phase.label,
547
+ phase.note,
548
+ caps.color ? COLOR.dim(elapsed) : elapsed,
549
+ ];
550
+ const marker = caps.color ? outcome.color(glyph) : glyph;
551
+ const message = `${marker} ${parts.filter(Boolean).join(" ")}`;
552
+ writeLine(outcome.level, caps.color ? message : stripAnsi(message));
553
+ }
554
+
555
+ /**
556
+ * Begin a named phase.
557
+ *
558
+ * @param {string} label Phase label
559
+ * @returns {object} Phase handle
560
+ */
561
+ function phase(label) {
562
+ const handle = {
563
+ label: label || "working",
564
+ detailText: null,
565
+ done: 0,
566
+ total: 0,
567
+ status: "running",
568
+ startedAt: now(),
569
+ note: null,
570
+ committed: false,
571
+
572
+ /**
573
+ * Replace the trailing detail text on this phase's row.
574
+ *
575
+ * @param {string} text Detail text
576
+ * @returns {object} This handle
577
+ */
578
+ detail(text) {
579
+ if (!this.committed) {
580
+ this.detailText = text ? `${text}` : null;
581
+ requestRender();
582
+ }
583
+ return this;
584
+ },
585
+
586
+ /**
587
+ * Switch this phase's row to a progress bar.
588
+ *
589
+ * @param {number} done Completed units
590
+ * @param {number} total Total units
591
+ * @returns {object} This handle
592
+ */
593
+ progress(done, total) {
594
+ if (!this.committed) {
595
+ this.done = Number(done) || 0;
596
+ this.total = Number(total) || 0;
597
+ requestRender();
598
+ }
599
+ return this;
600
+ },
601
+
602
+ /**
603
+ * Commit this phase as succeeded.
604
+ *
605
+ * @param {string} [summary] One-line outcome summary
606
+ */
607
+ succeed(summary) {
608
+ finish(this, "succeeded", summary);
609
+ },
610
+
611
+ /**
612
+ * Commit this phase as failed.
613
+ *
614
+ * @param {Error|string} [err] Failure cause
615
+ */
616
+ fail(err) {
617
+ finish(
618
+ this,
619
+ "failed",
620
+ err instanceof Error ? err.message : `${err ?? "failed"}`,
621
+ );
622
+ },
623
+
624
+ /**
625
+ * Commit this phase as skipped.
626
+ *
627
+ * @param {string} [reason] Why the phase was skipped
628
+ */
629
+ skip(reason) {
630
+ finish(this, "skipped", reason || "skipped");
631
+ },
632
+ };
633
+ running.push(handle);
634
+ startTimer();
635
+ requestRender(true);
636
+ return handle;
637
+ }
638
+
639
+ function finish(handle, status, note) {
640
+ if (handle.committed) {
641
+ return;
642
+ }
643
+ handle.committed = true;
644
+ handle.status = status;
645
+ handle.note = note ? `${note}` : null;
646
+ const index = running.indexOf(handle);
647
+ if (index >= 0) {
648
+ running.splice(index, 1);
649
+ }
650
+ if (running.length === 0 && isLive()) {
651
+ // Clear the region so the committed line is not drawn over a stale frame.
652
+ write(rewind());
653
+ lastHeight = 0;
654
+ }
655
+ if (level >= LEVEL_NORMAL || status === "failed") {
656
+ commitPhase(handle);
657
+ }
658
+ if (running.length === 0) {
659
+ stopTimer();
660
+ } else {
661
+ requestRender(true);
662
+ }
663
+ }
664
+
665
+ /**
666
+ * Stop the controller: halt the timer, commit the final frame, restore the
667
+ * cursor, and detach signal handlers. Safe to call more than once.
668
+ */
669
+ function stop() {
670
+ if (stopped) {
671
+ return;
672
+ }
673
+ stopped = true;
674
+ stopTimer();
675
+ if (isLive()) {
676
+ // The final frame is committed with the one newline the region owes.
677
+ const { body } = buildFrame();
678
+ write(body ? `${rewind()}${body}\n` : rewind());
679
+ lastHeight = 0;
680
+ }
681
+ showCursor();
682
+ removeSignalHandlers();
683
+ }
684
+
685
+ /**
686
+ * Re-resolve capabilities, level, and format. Used by the CLI once flags are
687
+ * parsed, and by the server to force non-interactive NDJSON.
688
+ *
689
+ * @param {object} [next] Same shape as the constructor options
690
+ */
691
+ function configure(next = {}) {
692
+ caps = detectCapabilities({ ...next, stream: next.stream || caps.stream });
693
+ if (next.level !== undefined) {
694
+ level = resolveLevel(next.level);
695
+ }
696
+ if (next.format !== undefined) {
697
+ format = resolveFormat(next.format);
698
+ }
699
+ if (!isLive()) {
700
+ stopTimer();
701
+ showCursor();
702
+ }
703
+ }
704
+
705
+ const logApi = {
706
+ /**
707
+ * Log an error. Always emitted, at every level.
708
+ *
709
+ * @param {...unknown} args Message parts
710
+ */
711
+ error(...args) {
712
+ writeLine("error", formatArgs(args));
713
+ },
714
+ /**
715
+ * Log a warning.
716
+ *
717
+ * @param {...unknown} args Message parts
718
+ */
719
+ warn(...args) {
720
+ if (level >= LEVEL_NORMAL) {
721
+ writeLine("warn", formatArgs(args));
722
+ }
723
+ },
724
+ /**
725
+ * Log an informational message.
726
+ *
727
+ * @param {...unknown} args Message parts
728
+ */
729
+ info(...args) {
730
+ if (level >= LEVEL_NORMAL) {
731
+ writeLine("info", formatArgs(args));
732
+ }
733
+ },
734
+ /**
735
+ * Log a debug message. Shown from verbosity level 2.
736
+ *
737
+ * @param {...unknown} args Message parts
738
+ */
739
+ debug(...args) {
740
+ if (level >= LEVEL_VERBOSE) {
741
+ writeLine("debug", formatArgs(args));
742
+ }
743
+ },
744
+ };
745
+
746
+ return {
747
+ print,
748
+ writeLine,
749
+ phase,
750
+ pause,
751
+ stop,
752
+ configure,
753
+ log: logApi,
754
+ get interactive() {
755
+ return isLive();
756
+ },
757
+ get color() {
758
+ return caps.color;
759
+ },
760
+ get level() {
761
+ return level;
762
+ },
763
+ get format() {
764
+ return format;
765
+ },
766
+ get stream() {
767
+ return caps.stream;
768
+ },
769
+ };
770
+ }
771
+
772
+ /**
773
+ * Process-wide default live-region UI controller instance. Library code imports
774
+ * this directly; the CLI reconfigures it once flags are parsed.
775
+ *
776
+ * @type {Object}
777
+ */
778
+ export const ui = createUi({});
779
+
780
+ /**
781
+ * Convenience facade exposing leveled log methods (`error`, `warn`, `info`,
782
+ * `debug`) that delegate to the default controller instance.
783
+ *
784
+ * @type {Object}
785
+ */
786
+ export const log = {
787
+ /**
788
+ * Log an error through the default controller.
789
+ *
790
+ * @param {...unknown} args Message parts
791
+ */
792
+ error: (...args) => ui.log.error(...args),
793
+ /**
794
+ * Log a warning through the default controller.
795
+ *
796
+ * @param {...unknown} args Message parts
797
+ */
798
+ warn: (...args) => ui.log.warn(...args),
799
+ /**
800
+ * Log an informational message through the default controller.
801
+ *
802
+ * @param {...unknown} args Message parts
803
+ */
804
+ info: (...args) => ui.log.info(...args),
805
+ /**
806
+ * Log a debug message through the default controller.
807
+ *
808
+ * @param {...unknown} args Message parts
809
+ */
810
+ debug: (...args) => ui.log.debug(...args),
811
+ };
812
+
813
+ // Minimum verbosity level for each shimmed console method.
814
+ const CONSOLE_ROUTES = {
815
+ log: { level: LEVEL_NORMAL, name: "info" },
816
+ info: { level: LEVEL_NORMAL, name: "info" },
817
+ warn: { level: LEVEL_NORMAL, name: "warn" },
818
+ error: { level: LEVEL_SILENT, name: "error" },
819
+ debug: { level: LEVEL_VERBOSE, name: "debug" },
820
+ trace: { level: LEVEL_DEBUG, name: "trace" },
821
+ };
822
+
823
+ let originalConsole = null;
824
+
825
+ /**
826
+ * Install a global `console` shim routing `log`/`info`/`warn`/`error`/`debug`/
827
+ * `trace` through the controller. This converts every existing `console.*` call
828
+ * site to land on the diagnostic stream above the live region without editing
829
+ * any of them. Unknown members delegate to the real console.
830
+ *
831
+ * @param {object} [uiInstance] Controller to route through
832
+ * @returns {() => void} Function that restores the original console
833
+ */
834
+ export function installConsoleShim(uiInstance = ui) {
835
+ if (originalConsole !== null) {
836
+ return restoreConsole;
837
+ }
838
+ originalConsole = globalThis.console;
839
+ const overrides = {};
840
+ for (const [method, route] of Object.entries(CONSOLE_ROUTES)) {
841
+ overrides[method] = (...args) => {
842
+ if (uiInstance.level < route.level) {
843
+ return;
844
+ }
845
+ const formatted = formatWithOptions(
846
+ { colors: uiInstance.color },
847
+ ...args,
848
+ );
849
+ // Streams without color (pipes, CI, NO_COLOR) stay free of escape bytes
850
+ // so the diagnostic stream is grep-safe.
851
+ uiInstance.writeLine(
852
+ route.name,
853
+ uiInstance.color ? formatted : stripAnsi(formatted),
854
+ );
855
+ };
856
+ }
857
+ globalThis.console = new Proxy(originalConsole, {
858
+ get(target, prop, receiver) {
859
+ return Object.hasOwn(overrides, prop)
860
+ ? overrides[prop]
861
+ : Reflect.get(target, prop, receiver);
862
+ },
863
+ });
864
+ return restoreConsole;
865
+ }
866
+
867
+ /**
868
+ * Restore the console captured by {@link installConsoleShim}. Safe to call when
869
+ * no shim is installed.
870
+ */
871
+ export function restoreConsole() {
872
+ if (originalConsole !== null) {
873
+ globalThis.console = originalConsole;
874
+ originalConsole = null;
875
+ }
876
+ }