@cdxgen/cdxgen 0.0.1 → 13.0.1

package/types/lib/cli/jsBom.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Detects an exact AI inventory type from a direct HuggingFace reference or a
+ * local Modelfile/`.gguf` file input. Returns the explicit selection from
+ * `getExactAiInventoryType` when one is present.
+ *
+ * @param {string} path Project or file path
+ * @param {object} options CLI options
+ * @returns {string|undefined} The detected AI inventory type (`"ai"`) or undefined
+ */
+export declare function getDirectAiInventoryType(path: string, options: object): string | undefined;
+/**
+ * Main Node.js/npm BOM generator. Parses manifests, lockfiles, and import
+ * evidence to assemble components, dependencies, formulation data, AI inventory,
+ * and the parent component for a Node.js project.
+ *
+ * @param {string} path Path to the project
+ * @param {object} options CLI options
+ * @returns {Promise<object>} Promise resolving to a BOM namespace data object
+ */
+export declare function createNodejsBom(path: string, options: object): Promise<object>;
+/**
+ * Regex matching `.wasm` import paths in analyzer output, including optional
+ * query/fragment suffixes.
+ *
+ * @type {RegExp}
+ */
+export declare const WASM_IMPORT_PATTERN: RegExp;
+/**
+ * Adds generic wasm components from discovered source imports.
+ *
+ * @param {Array<Object>} pkgList Node.js package list
+ * @param {Object} allImports analyzer imports map
+ * @returns {Array<Object>} pkgList enriched with wasm components
+ */
+export declare const addWasmComponentsFromImports: (pkgList: Array<Object>, allImports: Object) => Array<Object>;
+/**
+ * Function to create bom string for caxa SEA binaries
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} Promise resolving to BOM object
+ */
+export declare function createCaxaBom(path: string, options: Object): Promise<Object>;
+/**
+ * Function to create BOM for VS Code / IDE extensions.
+ * Supports two modes:
+ * 1. Directory scan: Discovers `.vsix` files and installed extension directories
+ * 2. IDE discovery: Automatically finds extensions installed by known IDEs
+ *
+ * @param {string} path to the project or directory to scan
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} Promise resolving to BOM object
+ */
+export declare function createVscodeExtensionBom(path: string, options: Object): Promise<Object>;
+/**
+ * Function to create BOM for Electron ASAR archives.
+ *
+ * @param {string} path to a single archive or a directory to scan
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} Promise resolving to BOM object
+ */
+export declare function createAsarBom(path: string, options: Object): Promise<Object>;
+/**
+ * Function to create BOM for installed Chrome and Chromium-based browser extensions.
+ *
+ * @param {string} path to the project path or a directly provided extension path
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} Promise resolving to BOM object
+ */
+export declare function createChromeExtensionBom(path: string, options: Object): Promise<Object>;
+/**
+ * Analyze an extracted extension directory for bundled dependencies.
+ * Looks for npm lock files, node_modules, package.json files, minified JS,
+ * and runs the babel-based analyzer on the source.
+ *
+ * @param {string} extDir Path to the extracted extension directory
+ * @param {Object} options CLI options
+ * @returns {Promise<{pkgList: Object[], dependencies: Object[]}>}
+ */
+export declare function analyzeExtensionDir(extDir: string, options: Object): Promise<{
+    pkgList: Object[];
+    dependencies: Object[];
+}>;
+/**
+ * Run deep analysis on installed extension subdirectories within a parent
+ * extensions directory. Each subdirectory represents an installed extension.
+ *
+ * @param {string} extensionsDir Parent directory containing extension subdirs
+ * @param {Object} options CLI options
+ * @param {Object[]} pkgList Mutable array to push discovered components into
+ * @param {Object[]} dependencies Mutable array to merge dependencies into
+ */
+export declare function analyzeInstalledExtensionDirs(extensionsDir: string, options: Object, pkgList: Object[], dependencies: Object[]): Promise<void>;
+//# sourceMappingURL=jsBom.d.ts.map

package/types/lib/cli/jsBom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jsBom.js"],"names":[],"mappings":"AA+FA;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAwB5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CA4zC3B;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAE4C,CAAC;AAEvD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,YAJ9B,KAAK,CAAC,MAAM,CAAC,cACb,MAAM,KACJ,KAAK,CAAC,MAAM,CAwExB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CA6C3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CA+F3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAoN3B;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CAoD3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CA2ChE;AAED;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CACjD,aAAa,EANJ,MAMI,EACb,OAAO,EANE,MAMF,EACP,OAAO,EANE,MAAM,EAMR,EACP,YAAY,EANH,MAAM,EAMH,iBAsBb"}

package/types/lib/cli/jvmBom.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Resolved path to the Gradle modules cache directory, derived from
+ * `GRADLE_CACHE_DIR`, `GRADLE_USER_HOME`, or `~/.gradle/caches/modules-2/files-2.1`.
+ *
+ * @type {string}
+ */
+export declare let GRADLE_CACHE_DIR: string;
+/**
+ * Absolute path to the bundled `init.gradle` helper script under `data/helpers`.
+ *
+ * @type {string}
+ */
+export declare const GRADLE_INIT_SCRIPT: string;
+/**
+ * Resolved path to the sbt/Ivy2 cache directory, derived from `SBT_CACHE_DIR`
+ * or `~/.ivy2/cache`.
+ *
+ * @type {string}
+ */
+export declare const SBT_CACHE_DIR: string;
+/**
+ * Function to create bom string for Java jars
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ *
+ * @returns {Object} BOM with namespace mapping
+ */
+export declare function createJarBom(path: string, options: Object): Object;
+/**
+ * Discover the real sbt project ids for a build by invoking sbt's own
+ * `projects` command. This is more reliable than scraping the build files with
+ * a regex, since it uses sbt's project resolution and avoids false positives
+ * (commented-out code, examples, values that merely resemble project defs) that
+ * can lead to hangs when those bogus scopes are later passed to `dependencyTree`.
+ *
+ * Falls back to the regex-based {@link discoverSbtProjects} heuristic when the
+ * sbt invocation fails or yields nothing useful.
+ *
+ * @param {string} basePath Directory of the sbt build
+ * @param {string} sbtCmd sbt executable
+ * @param {Object} env Environment for the spawned process
+ * @returns {string[]} List of sbt project ids
+ */
+export declare function discoverSbtProjectsFromCmd(basePath: string, sbtCmd: string, env: Object): string[];
+/**
+ * Function to create bom string for Java projects
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} Promise resolving to BOM object
+ */
+export declare function createJavaBom(path: string, options: Object): Promise<Object>;
+//# sourceMappingURL=jvmBom.d.ts.map

package/types/lib/cli/jvmBom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jvmBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jvmBom.js"],"names":[],"mappings":"AAwFA;;;;;GAKG;AACH,eAAO,IAAI,gBAAgB,EAFjB,MAIsD,CAAC;AAUjE;;;;GAIG;AAEH,eAAO,MAAM,kBAAkB,EAHrB,MAQT,CAAC;AAEF;;;;;GAKG;AAEH,eAAO,MAAM,aAAa,EAHhB,MAIqE,CAAC;AAEhF;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAL5B,MAK4B,EAAE,OAAO,EAJrC,MAIqC,GAFnC,MAAM,CA8ElB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EALxC,MAKwC,EAAE,MAAM,EAJhD,MAIgD,EAAE,GAAG,EAHrD,MAGqD,GAFnD,MAAM,EAAE,CA4CpB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CA0iD3B"}

package/types/lib/cli/managedBom.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Checks whether a directory contains .NET project or solution files
+ * (`*.csproj`, `*.fsproj`, `*.vbproj`, `*.sln`).
+ *
+ * @param {string} src Directory to inspect
+ * @param {object} [options={}] CLI options
+ * @returns {boolean} True when at least one .NET project/solution file exists
+ */
+export declare const hasDotnetProjectIndicators: (src: string, options?: object) => boolean;
+/**
+ * Decides whether dosai crypto collection should run for a .NET source. Returns
+ * true when an explicit dosai .NET project type is selected, or when no project
+ * type (or `universal`) is selected and .NET project indicators are present.
+ *
+ * @param {string} src Directory to inspect
+ * @param {object} [options={}] CLI options
+ * @returns {boolean} True when dosai crypto collection should run
+ */
+export declare const shouldCollectDosaiCrypto: (src: string, options?: object) => boolean;
+/**
+ * Function to create bom string for Projects that use Pixi package manager.
+ * createPixiBom is based on createPythonBom.
+ * Pixi package manager utilizes many languages like python, rust, C/C++, ruby, etc.
+ * It produces a Lockfile which help produce reproducible envs across operating systems.
+ * This code will look at the operating system of our machine and create a BOM specific to that machine.
+ *
+ *
+ * @param {String} path
+ * @param {Object} options
+ * @returns {Object | null} BOM object, or `null` when `pixi.lock` is absent and `options.installDeps` is false
+ */
+export declare function createPixiBom(path: string, options: Object): Object | null;
+/**
+ * Function to create bom string for Python projects
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} Promise resolving to BOM object
+ */
+export declare function createPythonBom(path: string, options: Object): Promise<Object>;
+/**
+ * Function to create bom string for GitHub action workflows
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Object} BOM object
+ */
+export declare function createGitHubBom(path: string, options: Object): Object;
+/**
+ * Function to create bom string for cloudbuild yaml
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Object} BOM object
+ */
+export declare function createCloudBuildBom(path: string, options: Object): Object;
+/**
+ * Function to create bom string for Jenkins plugins
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} Promise resolving to BOM object
+ */
+export declare function createJenkinsBom(path: string, options: Object): Promise<Object>;
+/**
+ * Function to create bom string for Helm charts
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Object} BOM object
+ */
+export declare function createHelmBom(path: string, options: Object): Object;
+/**
+ * Function to create bom string for php projects
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Object} BOM object
+ */
+export declare function createPHPBom(path: string, options: Object): Object;
+/**
+ * Function to create bom string for ruby projects
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} Promise resolving to BOM object
+ */
+export declare function createRubyBom(path: string, options: Object): Promise<Object>;
+/**
+ * Function to create bom string for csharp projects
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object|undefined>} Promise resolving to BOM object
+ */
+export declare function createCsharpBom(path: string, options: Object): Promise<Object | undefined>;
+/**
+ * Function to create bom object for cryptographic certificate files
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} Promise resolving to BOM object
+ */
+export declare function createCryptoCertsBom(path: string, options: Object): Promise<Object>;
+//# sourceMappingURL=managedBom.d.ts.map

package/types/lib/cli/managedBom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managedBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/managedBom.js"],"names":[],"mappings":"AAqHA;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,QAJ5B,MAAM,YACN,MAAM,KACJ,OAMZ,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAJ1B,MAAM,YACN,MAAM,KACJ,OAeZ,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,QAAA,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,GAAG,IAAI,CAsEzB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAkpB3B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CAyBlB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,MAAM,CAsBlB;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CA2C3B;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAJvB,MAIuB,EAAE,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CA0BlB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CA8JlB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CA0R3B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAuerC;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAJpC,MAIoC,EAAE,OAAO,EAH7C,MAG6C,GAF3C,OAAO,CAAC,MAAM,CAAC,CAmF3B"}

package/types/lib/cli/nativeBom.d.ts

@@ -0,0 +1,143 @@
+/**
+ * Resolves the local Cargo registry cache directory from the `CARGO_CACHE_DIR`
+ * or `CARGO_HOME` environment variables, falling back to `~/.cargo/registry/cache`.
+ *
+ * @returns {string|undefined} Absolute path to the Cargo cache directory
+ */
+export declare function getCargoCacheDir(): string | undefined;
+/**
+ * Function to create bom string for Go projects
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object | undefined>} Promise resolving to a BOM object or `undefined`
+ */
+export declare function createGoBom(path: string, options: Object): Promise<Object | undefined>;
+/**
+ * Function to create bom string for Rust projects
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object|undefined>} Promise resolving to a BOM object or undefined
+ */
+export declare function createRustBom(path: string, options: Object): Promise<Object | undefined>;
+/**
+ * Parses a `.crate` file name into a CycloneDX component (name, version, purl,
+ * bom-ref, and source/cache properties). Returns undefined when the file name
+ * does not match the `name-version` convention.
+ *
+ * @param {string} crateFile Absolute path to a `.crate` archive
+ * @returns {object|undefined} Component object or undefined
+ */
+export declare function buildCargoCacheComponent(crateFile: string): object | undefined;
+/**
+ * Enriches a cargo cache component with a SHA-256 hash and filename-based
+ * identity evidence (confidence 0.5). Hash computation failures are ignored.
+ *
+ * @param {string} crateFile Absolute path to the `.crate` archive
+ * @param {object} [component] Component produced by `buildCargoCacheComponent`
+ * @returns {Promise<object|undefined>} The enriched component or undefined
+ */
+export declare function enrichCargoCacheComponent(crateFile: string, component?: object): Promise<object | undefined>;
+/**
+ * Builds a BOM from `.crate` files found in the Cargo registry cache (or from a
+ * single `.crate` path). Optionally fetches crates.io license metadata when
+ * license fetching is enabled.
+ *
+ * @param {string} path Directory or `.crate` file path
+ * @param {object} options CLI options
+ * @returns {Promise<object>} Promise resolving to a BOM namespace data object
+ */
+export declare function createCargoCacheBom(path: string, options: object): Promise<object>;
+/**
+ * Function to create bom string for Dart projects
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} Promise resolving to BOM object
+ */
+export declare function createDartBom(path: string, options: Object): Promise<Object>;
+/**
+ * Function to create bom string for cpp projects
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Object} BOM object
+ */
+export declare function createCppBom(path: string, options: Object): Object;
+/**
+ * Function to create bom string for clojure projects
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Object} BOM object
+ */
+export declare function createClojureBom(path: string, options: Object): Object;
+/**
+ * Function to create bom string for Haskell projects
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Object} BOM object
+ */
+export declare function createHaskellBom(path: string, options: Object): Object;
+/**
+ * Function to create bom string for Elixir projects
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Object} BOM object
+ */
+export declare function createElixirBom(path: string, options: Object): Object;
+/**
+ * Function to create bom string for swift projects
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} Promise resolving to BOM object
+ */
+export declare function createSwiftBom(path: string, options: Object): Promise<Object>;
+/**
+ * Function to create bom string for cocoa projects
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object | undefined>} Promise resolving to a BOM object, or `undefined` when no Podfiles are found
+ */
+export declare function createCocoaBom(path: string, options: Object): Promise<Object | undefined>;
+/**
+ * Function to create bom string for Nix flakes
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} Promise resolving to BOM object
+ */
+export declare function createNixBom(path: string, options: Object): Promise<Object>;
+/**
+ * Function to create bom string for Zig projects.
+ *
+ * Zig moved package management into the build system, so the dependency list
+ * lives in `build.zig.zon` (ZON, not JSON). The resolver walks the full
+ * dependency graph by locating each dependency's manifest through the in-tree
+ * `zig-pkg/` directory or the global cache, producing both a flat component
+ * list and a CycloneDX `dependencies[]` edge list.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} Promise resolving to BOM object
+ */
+export declare function createZigBom(path: string, options: Object): Promise<Object>;
+/**
+ * Function to create bom string for Gleam projects.
+ *
+ * Gleam resolves through Hex, so packages carry `pkg:hex/...` purls and no new
+ * purl type is introduced. The `manifest.toml` lock is the source of truth for
+ * resolved versions and the direct/transitive distinction; `gleam.toml` is the
+ * manifest.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} Promise resolving to BOM object
+ */
+export declare function createGleamBom(path: string, options: Object): Promise<Object>;
+//# sourceMappingURL=nativeBom.d.ts.map

package/types/lib/cli/nativeBom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nativeBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/nativeBom.js"],"names":[],"mappings":"AA2IA;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAFnB,MAAM,GAAC,SAAS,CAU5B;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAwavC;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAmJrC;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,GAAC,SAAS,CAiC5B;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,SAAS,EAJ9C,MAI8C,EAAE,SAAS,AAHjE,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA8BrC;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAJnC,MAImC,EAAE,OAAO,EAH5C,MAG4C,GAF1C,OAAO,CAAC,MAAM,CAAC,CAwB3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAiE3B;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,MAAM,CAkZlB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CA+GlB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,CA0BlB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,CA0BlB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CA0I3B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAmLvC;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CAkI3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,GAFnC,OAAO,CAAC,MAAM,CAAC,CA4D3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAJ9B,MAI8B,EAAE,OAAO,EAHvC,MAGuC,GAFrC,OAAO,CAAC,MAAM,CAAC,CAwD3B"}

package/types/lib/core/activity.d.ts

@@ -0,0 +1,178 @@
+/** True when CDXGEN_DEBUG_MODE or SCAN_DEBUG_MODE requests debug/verbose output. */
+export declare const DEBUG_MODE: boolean;
+/** True when cdxgen runs in secure/permission-restricted mode (CDXGEN_SECURE_MODE or Node.js --permission). */
+export declare const isSecureMode: any;
+/** Mutable flag indicating dry-run mode; when true, filesystem, network, and process activity is blocked and recorded instead of executed. */
+export declare let isDryRun: any;
+/** Error code string attached to errors raised when an operation is blocked by dry-run mode. */
+export declare const DRY_RUN_ERROR_CODE = "CDXGEN_DRY_RUN";
+/** @param {number} count Number of times an activity was observed. @returns {string} Suffix string indicating repeat count, or empty string. */
+declare const buildReadCountSuffix: (count: number) => string;
+/**
+ * Classify a filesystem path into an activity metadata object describing its
+ * classification (lockfile, manifest, certificate, key, cache, etc.), ecosystem,
+ * label, and whether it is sensitive.
+ *
+ * @param {string} filePath File path to classify.
+ * @returns {Object|undefined} Metadata object, or undefined when the path does not match a known pattern.
+ */
+declare function classifyActivityPath(filePath: string): Object | undefined;
+/**
+ * Classify a discovery glob pattern into a discovery type and human-readable label.
+ *
+ * @param {string|string[]} pattern Glob pattern (or array of patterns) used for discovery.
+ * @returns {{discoveryType: string, label: string}} Discovery metadata with a `discoveryType` and `label`.
+ */
+declare function classifyDiscoveryPattern(pattern: string | string[]): {
+    discoveryType: string;
+    label: string;
+};
+/**
+ * Tests whether an environment variable name matches sensitive patterns
+ * (token, key, secret, password, credential, auth, session, cookie, etc.).
+ *
+ * @param {string} varName Environment variable name to test.
+ * @returns {boolean} True when the name matches a sensitive pattern.
+ */
+export declare function isSensitiveEnvironmentVariableName(varName: string): boolean;
+/**
+ * Record a deduplicated observed activity entry (filesystem, environment, or
+ * discovery). No-op unless dry-run or debug mode is active.
+ *
+ * @param {string} kind Activity kind (e.g. "inspect", "discover", "decision").
+ * @param {string} target Activity target (path, host, or identifier).
+ * @param {Object} [options] Optional metadata including `status`, `reason`, `reasonBuilder`, `metadata`, `traceKey`, and `traceDetail`.
+ * @returns {Object|undefined} The recorded activity entry, or undefined.
+ */
+export declare function recordObservedActivity(kind: string, target: string, options?: Object): Object | undefined;
+/** @param {string} target Activity target. @param {Object} [options] Options forwarded to recordObservedActivity. @returns {Object|undefined} Recorded activity entry. */
+export declare function recordDecisionActivity(target: string, options?: Object): Object | undefined;
+/** @param {string} target Activity target. @param {Object} [options] Options forwarded to recordObservedActivity. @returns {Object|undefined} Recorded activity entry. */
+export declare function recordDiscoveryActivity(target: string, options?: Object): Object | undefined;
+/** @param {string} target Activity target. @param {Object} [options] Options forwarded to recordObservedActivity. @returns {Object|undefined} Recorded activity entry. */
+export declare function recordPolicyActivity(target: string, options?: Object): Object | undefined;
+/**
+ * Record a symlink resolution outcome, normalizing both paths relative to an
+ * optional base path.
+ *
+ * @param {string} sourcePath The symlink source path.
+ * @param {string} resolvedPath The resolved target path.
+ * @param {Object} [options] Options including `basePath`, `status`, `reason`, `errorCode`, and `metadata`.
+ * @returns {Object|undefined} Recorded activity entry, or undefined.
+ */
+export declare function recordSymlinkResolution(sourcePath: string, resolvedPath: string, options?: Object): Object | undefined;
+/**
+ * Record a deduplicated environment-variable read, flagging names that match
+ * sensitive patterns.
+ *
+ * @param {string} varName Environment variable name that was read.
+ * @param {Object} [options] Options including `source`, `sensitive`, `status`, and `reason`.
+ * @returns {Object|undefined} Recorded activity entry, or undefined.
+ */
+export declare function recordEnvironmentRead(varName: string, options?: Object): Object | undefined;
+/**
+ * Record a sensitive-file read, deriving classification metadata from the path.
+ *
+ * @param {string} filePath Path of the sensitive file that was read.
+ * @param {Object} [options] Options including `kind`, `label`, `status`, and `reason`.
+ * @returns {Object|undefined} Recorded activity entry, or undefined.
+ */
+export declare function recordSensitiveFileRead(filePath: string, options?: Object): Object | undefined;
+/**
+ * Read an environment variable while recording the read for activity tracing.
+ *
+ * @param {string} varName Environment variable name to read.
+ * @param {Object} [options] Options forwarded to recordEnvironmentRead.
+ * @returns {string|undefined} The variable value, or undefined when unset.
+ */
+export declare function readEnvironmentVariable(varName: string, options?: Object): string | undefined;
+/**
+ * Toggle dry-run mode on or off and keep the CDXGEN_DRY_RUN environment variable in sync.
+ *
+ * @param {boolean} enabled True to enable dry-run mode, false to disable.
+ * @returns {void}
+ */
+export declare function setDryRunMode(enabled: boolean): void;
+/**
+ * Construct an Error tagged as a dry-run-blocked operation.
+ *
+ * @param {string} action Action that was blocked (e.g. "network", "execute").
+ * @param {string} target Target of the blocked action.
+ * @param {string} [reason] Optional human-readable reason; defaults to a generic message.
+ * @returns {Error} Error with `code`, `action`, `target`, and `dryRun` properties set.
+ */
+export declare function createDryRunError(action: string, target: string, reason?: string): Error;
+/**
+ * Returns true when the given error was produced by dry-run blocking.
+ *
+ * @param {Error} error Error to inspect.
+ * @returns {boolean} True when the error carries the dry-run code or flag.
+ */
+export declare function isDryRunError(error: Error): boolean;
+/** Error code string attached to errors raised when a request is blocked by the host allow-list or secure-mode policy. */
+export declare const BLOCKED_HOST_ERROR_CODE = "CDXGEN_HOST_BLOCKED";
+/**
+ * Create an error used to abort a request to a host that policy disallows
+ * (CDXGEN_ALLOWED_HOSTS or the secure-mode https-only restriction). The
+ * beforeRequest hook must throw this so the request is actually aborted;
+ * returning does not stop the request.
+ *
+ * @param {string} target The blocked request URL.
+ * @param {string} reason Human readable reason for the block.
+ * @returns {Error} Error carrying the blocked-host code.
+ */
+export declare function createBlockedHostError(target: string, reason: string): Error;
+/**
+ * Merge context metadata into the current activity context applied to every recorded activity.
+ *
+ * @param {Object} [context] Context properties to merge.
+ * @returns {void}
+ */
+export declare function setActivityContext(context?: Object): void;
+/** Clear the current activity context. @returns {void} */
+export declare function resetActivityContext(): void;
+/**
+ * Append a timestamped activity entry to the ledger and emit a trace log.
+ * No-op unless dry-run or debug mode is active.
+ *
+ * @param {Object} activity Activity properties to record.
+ * @returns {Object|undefined} The recorded, identified entry, or undefined when recording is inactive.
+ */
+export declare function recordActivity(activity: Object): Object | undefined;
+/** @returns {Object[]} Shallow copy of the recorded activity ledger. */
+export declare function getRecordedActivities(): Object[];
+/** Clear the activity ledger and all dedup maps. @returns {void} */
+export declare function resetRecordedActivities(): void;
+/**
+ * Record a filesystem activity entry with the given kind, target, and status.
+ *
+ * @param {string} kind Activity kind (e.g. "write", "mkdir", "cleanup").
+ * @param {string} target Filesystem target path.
+ * @param {string} status Activity status (e.g. "completed", "blocked").
+ * @param {string} [reason] Optional human-readable reason.
+ * @param {Object} [metadata] Optional additional metadata.
+ * @returns {Object|undefined} Recorded activity entry, or undefined.
+ */
+declare function recordFilesystemActivity(kind: string, target: string, status: string, reason?: string, metadata?: Object): Object | undefined;
+/** Set accumulating hostnames of remote hosts contacted during a scan. */
+export declare const remoteHostsAccessed: Set<any>;
+/**
+ * Test a hostname against the CDXGEN_ALLOWED_HOSTS allow-list, supporting exact
+ * matches and `*.suffix` wildcards. When no allow-list is configured, all hosts are allowed.
+ *
+ * @param {string} hostname Hostname to test.
+ * @param {string} [allowedHostsEnv] Comma-separated allow-list string; defaults to the CDXGEN_ALLOWED_HOSTS env var.
+ * @returns {boolean} True when the hostname is permitted.
+ */
+export declare function isAllowedHttpHost(hostname: string, allowedHostsEnv?: string): boolean;
+/**
+ * Checks for dangerous Unicode characters that could enable homograph attacks
+ *
+ * @param {string} str String to check
+ * @returns {boolean} true if dangerous Unicode is found
+ */
+export declare function hasDangerousUnicode(str: string): boolean;
+/** The shared got-compatible HTTP client for all outbound requests, enforcing dry-run, host-allow-list, and secure-mode policies via beforeRequest/afterResponse/beforeError hooks. */
+export declare const cdxgenAgent: Function;
+export { buildReadCountSuffix, classifyActivityPath, classifyDiscoveryPattern, recordFilesystemActivity, };
+//# sourceMappingURL=activity.d.ts.map

package/types/lib/core/activity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity.d.ts","sourceRoot":"","sources":["../../../lib/core/activity.js"],"names":[],"mappings":"AAOA,oFAAoF;AACpF,eAAO,MAAM,UAAU,SAEkB,CAAC;AAE1C,+GAA+G;AAC/G,eAAO,MAAM,YAAY,KAE4B,CAAC;AAQtD,8IAA8I;AAC9I,eAAO,IAAI,QAAQ,KACkD,CAAC;AAEtE,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,mBAAmB,CAAC;AA0QnD,gJAAgJ;AAChJ,QAAA,MAAM,oBAAoB,UADd,MAAM,KAA4D,MACA,CAAC;AAe/E;;;;;;;GAOG;AACH,iBAAS,oBAAoB,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;GAKG;AACH,iBAAS,wBAAwB,CAAC,OAAO,EAH9B,MAAM,GAAC,MAAM,EAGiB,GAF5B;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAqClD;AA0BD;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAH/C,MAG+C,GAF7C,OAAO,CAInB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EALhC,MAKgC,EAAE,MAAM,EAJxC,MAIwC,EAAE,OAAO,AAHzD,CACA,EADQ,MAGsD,GAFpD,MAAM,GAAC,SAAS,CA4B5B;AAED,0KAA0K;AAC1K,wBAAgB,sBAAsB,CAAC,MAAM,EADjC,MACiC,EAAE,OAAO,AADV,CAAuE,EAA/D,MACO,GADkE,MAAM,GAAC,SAAS,CAG5I;AAED,0KAA0K;AAC1K,wBAAgB,uBAAuB,CAAC,MAAM,EADlC,MACkC,EAAE,OAAO,AADX,CAAuE,EAA/D,MACQ,GADiE,MAAM,GAAC,SAAS,CAG5I;AAED,0KAA0K;AAC1K,wBAAgB,oBAAoB,CAAC,MAAM,EAD/B,MAC+B,EAAE,OAAO,AADR,CAAuE,EAA/D,MACK,GADoE,MAAM,GAAC,SAAS,CAG5I;AA2CD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAND,MAMC,EACV,YAAY,EANH,MAMG,EACZ,OAAO,AANN,CACA,EADQ,MAMG,GALD,MAAM,GAAC,SAAS,CAuC5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAJlC,MAIkC,EAAE,OAAO,AAHnD,CACA,EADQ,MAGgD,GAF9C,MAAM,GAAC,SAAS,CA2B5B;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAJrC,MAIqC,EAAE,OAAO,AAHtD,CACA,EADQ,MAGmD,GAFjD,MAAM,GAAC,SAAS,CAgC5B;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAJpC,MAIoC,EAAE,OAAO,AAHrD,CACA,EADQ,MAGkD,GAFhD,MAAM,GAAC,SAAS,CAK5B;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,OAG0B,GAFxB,IAAI,CAShB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAL7B,MAK6B,EAAE,MAAM,EAJrC,MAIqC,EAAE,MAAM,AAHrD,CACA,EADQ,MAG6C,GAF3C,KAAK,CAYjB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAHxB,KAGwB,GAFtB,OAAO,CAInB;AAED,0HAA0H;AAC1H,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAJlC,MAIkC,EAAE,MAAM,EAH1C,MAG0C,GAFxC,KAAK,CASjB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,AAHvC,CACA,EADQ,MAGoC,GAFlC,IAAI,CAOhB;AAED,0DAA0D;AAC1D,wBAAgB,oBAAoB,IADc,IAAI,CAGrD;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,MAAM,GAAC,SAAS,CAgB5B;AAID,wEAAwE;AACxE,wBAAgB,qBAAqB,IADvB,MAAM,EAAE,CAGrB;AAED,oEAAoE;AACpE,wBAAgB,uBAAuB,IADqB,IAAI,CAO/D;AAED;;;;;;;;;GASG;AACH,iBAAS,wBAAwB,CAC/B,IAAI,EARK,MAQL,EACJ,MAAM,EARG,MAQH,EACN,MAAM,EARG,MAQH,EACN,MAAM,AARL,CACA,EADQ,MAQS,EAClB,QAAQ,AARP,CACA,EADQ,MAQI,GAPF,MAAM,GAAC,SAAS,CAgB5B;AAED,0EAA0E;AAC1E,eAAO,MAAM,mBAAmB,UAAY,CAAC;AAE7C;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EALC,MAKD,EACR,eAAe,AALd,CACA,EADQ,MAKwD,GAJtD,OAAO,CA+BnB;AAED;;;;;GAKG;AAEH,wBAAgB,mBAAmB,CAAC,GAAG,EAJ5B,MAI4B,GAH1B,OAAO,CAmBnB;AA4CD,uLAAuL;AACvL,eAAO,MAAM,WAAW,UAsItB,CAAC;AAEH,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,GACzB,CAAC"}