@cdxgen/cdxgen 0.0.1 → 13.0.1

package/types/lib/ecosystems/cmakeResolver.d.ts

@@ -0,0 +1,176 @@
+/**
+ * CMake build-context resolver: the layer-3 bridge between the pure parsers
+ * (`lib/parsers/cmakeCache.js`, `lib/parsers/gitmodules.js`) and the C/C++ BOM
+ * lifecycle in `lib/cli/nativeBom.js`.
+ *
+ * This module owns every subprocess invocation and every filesystem read
+ * outside the scan root. It reads `CMakeCache.txt`, `.gitmodules`, the
+ * FetchContent gitclone scripts, and `git submodule status` output, then
+ * returns repo-relative facts the lifecycle can attach to components.
+ */
+import { GIT_COMMAND } from "../inventory/envcontext.js";
+/**
+ * Make an absolute build-machine path repo-relative. Returns `null` when the
+ * path does not lie under the scan root (so the caller can drop it rather than
+ * emit a verbatim build-machine path).
+ *
+ * @param {string} absPath Absolute path from CMakeCache
+ * @param {string} scanRoot The project scan root
+ * @returns {string|null} Repo-relative path using POSIX separators, or null
+ */
+declare function toRepoRelative(absPath: string, scanRoot: string): string | null;
+/**
+ * Detect the build directory that holds a `CMakeCache.txt`.
+ *
+ * Looks for `build/`, `cmake-build-* /`, and `out/` under the scan root. An
+ * explicit `--cmake-cache <path>` option (passed via `options.cmakeCache`)
+ * takes precedence and skips autodetection.
+ *
+ * @param {string} path Project scan root
+ * @param {Object} options CLI options; `options.cmakeCache` is an explicit override
+ * @returns {{ cacheFile: string, buildDir: string } | null}
+ */
+export declare function detectCmakeBuildDir(path: string, options: Object): {
+    cacheFile: string;
+    buildDir: string;
+} | null;
+/**
+ * Read and resolve the CMakeCache facts for a project.
+ *
+ * @param {string} path Project scan root
+ * @param {Object} options CLI options
+ * @returns {{ rootProject: {name?:string, version?:string}|null, projects: Map, findPackages: Map, fetchContentBase?: string, buildDir?: string } | null}
+ */
+export declare function resolveCmakeCache(path: string, options: Object): {
+    rootProject: {
+        name?: string;
+        version?: string;
+    } | null;
+    projects: Map<any, any>;
+    findPackages: Map<any, any>;
+    fetchContentBase?: string;
+    buildDir?: string;
+} | null;
+/**
+ * Read the FetchContent gitclone script and extract the repository URL and tag.
+ *
+ * The script lives at
+ * `<build>/_deps/<name>-subbuild/<name>-populate-prefix/tmp/<name>-populate-gitclone.cmake`
+ * and contains the literal `clone ... "<GIT_REPOSITORY>" "<name>-src"` and
+ * `checkout "<GIT_TAG>" --` lines. No git invocation is needed.
+ *
+ * @param {string} buildDir Build directory
+ * @param {string} depName FetchContent dep name (lowercase)
+ * @returns {{ url: string|null, tag: string|null }}
+ */
+export declare function readFetchContentGitclone(buildDir: string, depName: string): {
+    url: string | null;
+    tag: string | null;
+};
+/**
+ * Parse a gitclone.cmake script for the GIT_REPOSITORY and GIT_TAG literals.
+ *
+ * The clone line carries several quoted arguments (`--config "..."`, the
+ * repository URL, and the source dir), so the URL is identified as the quoted
+ * token that parses as a git remote rather than the first quoted token.
+ *
+ * @param {string} text Script contents
+ * @returns {{ url: string|null, tag: string|null }}
+ */
+export declare function parseGitcloneScript(text: string): {
+    url: string | null;
+    tag: string | null;
+};
+/**
+ * Collect submodule pin data via a single `git submodule status --recursive`.
+ *
+ * Each output line is `<prefix><sha> <path> (<describe>)` where prefix is
+ * ` ` (ok), `-` (uninitialised), `+` (out of sync), `U` (conflict).
+ * Uninitialised submodules (the normal case for `--depth 1` clones and CI)
+ * have no populated working tree, so `describe` is absent; the version
+ * degrades to the commit SHA.
+ *
+ * Falls back to `git ls-tree HEAD <path>` (gitlink, mode 160000) when the
+ * submodule machinery is unavailable.
+ *
+ * @param {string} path Repo directory
+ * @returns {Map<string, { sha: string, describe: string|null, prefix: string }>} Path → pin data
+ */
+export declare function collectSubmoduleStatus(path: string): Map<string, {
+    sha: string;
+    describe: string | null;
+    prefix: string;
+}>;
+/**
+ * Parse a single `git submodule status` output line.
+ *
+ * The status prefix is optional here. `git` writes a space for a submodule that
+ * matches the recorded commit, and the command output arrives trimmed, so that
+ * space is absent from the first line. The prefixes that carry meaning — `-`
+ * uninitialised, `+` out of sync, `U` conflicted — are not whitespace and
+ * always survive, so a line that opens with the SHA is in sync.
+ *
+ * @param {string} line Raw status line
+ * @returns {{ sha: string, describe: string|null, prefix: string, path: string } | null}
+ */
+export declare function parseSubmoduleStatusLine(line: string): {
+    sha: string;
+    describe: string | null;
+    prefix: string;
+    path: string;
+} | null;
+/**
+ * Build the complete CMake/submodule resolution for a project.
+ *
+ * Combines CMakeCache facts, `.gitmodules`, submodule pins, and FetchContent
+ * gitclone scripts into a single boundary set and component list the C/C++
+ * lifecycle can consume.
+ *
+ * @param {string} path Project scan root
+ * @param {Object} options CLI options
+ * @returns {{ rootProject: {name?:string, version?:string}|null, findPackages: Map<string,string>, submodules: Array, fetchDeps: Array, boundaries: Map<string,{kind:string,version?:string,url?:string,name:string}> }}
+ */
+export declare function resolveCmakeContext(path: string, options: Object): {
+    rootProject: {
+        name?: string;
+        version?: string;
+    } | null;
+    findPackages: Map<string, string>;
+    submodules: any[];
+    fetchDeps: any[];
+    boundaries: Map<string, {
+        kind: string;
+        version?: string;
+        url?: string;
+        name: string;
+    }>;
+};
+/**
+ * Build a purl string from resolved submodule/fetch coordinates, returning
+ * null when the parts do not form a valid purl.
+ *
+ * @param {string} resolvedUrl Absolute git URL
+ * @param {string} [version] Resolved version
+ * @returns {string|null}
+ */
+export declare function buildDependentPurl(resolvedUrl: string, version?: string): string | null;
+/**
+ * Collapse components that name the same CMake package at different versions.
+ *
+ * `find_package(Boost 1.54)` in one `CMakeLists.txt` and `find_package(Boost
+ * 1.64)` in another state two minimum requirements for a single dependency, not
+ * two dependencies. A build that satisfies both links one Boost, the higher of
+ * the two, so that requirement becomes the component version and the full set
+ * is kept under `cdx:cmake:versionRequirements`.
+ *
+ * Matching is on name alone, case-insensitively. Components carrying a
+ * `cdx:cmake:depKind` property are left alone: a FetchContent dependency or a
+ * submodule is pinned to a commit that was really checked out, and two such
+ * pins are genuinely two things.
+ *
+ * @param {Object[]} pkgList Components scraped from CMake-like files
+ * @returns {Object[]} Components with one entry per package name, in first-seen order
+ */
+export declare function collapseCmakeVersions(pkgList: Object[]): Object[];
+export { GIT_COMMAND, toRepoRelative };
+//# sourceMappingURL=cmakeResolver.d.ts.map

package/types/lib/ecosystems/cmakeResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cmakeResolver.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cmakeResolver.js"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH,OAAO,EAEL,WAAW,EAEZ,MAAM,4BAA4B,CAAC;AAgBpC;;;;;;;;GAQG;AACH,iBAAS,cAAc,CAAC,OAAO,EAJpB,MAIoB,EAAE,QAAQ,EAH9B,MAG8B,GAF5B,MAAM,GAAC,IAAI,CAWvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAkC1D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC;IAAE,WAAW,EAAE;QAAC,IAAI,CAAC,EAAC,MAAM,CAAC;QAAC,OAAO,CAAC,EAAC,MAAM,CAAA;KAAC,GAAC,IAAI,CAAC;IAAC,QAAQ,gBAAM;IAAC,YAAY,gBAAM;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAuBxJ;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAIsC,EAAE,OAAO,EAH/C,MAG+C,GAF7C;IAAE,GAAG,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,CAmClD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAH7B,MAG6B,GAF3B;IAAE,GAAG,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAC,IAAI,CAAA;CAAE,CA6BlD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAHhC,MAGgC,GAF9B,GAAG,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAiB/E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAHlC,MAGkC,GAFhC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA4BvF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC;IAAE,WAAW,EAAE;QAAC,IAAI,CAAC,EAAC,MAAM,CAAC;QAAC,OAAO,CAAC,EAAC,MAAM,CAAA;KAAC,GAAC,IAAI,CAAC;IAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAC,MAAM,CAAC,CAAC;IAAC,UAAU,QAAQ;IAAC,SAAS,QAAQ;IAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAC;QAAC,IAAI,EAAC,MAAM,CAAC;QAAA,OAAO,CAAC,EAAC,MAAM,CAAC;QAAA,GAAG,CAAC,EAAC,MAAM,CAAC;QAAA,IAAI,EAAC,MAAM,CAAA;KAAC,CAAC,CAAA;CAAE,CAqGvN;AAgBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAJnC,MAImC,EAAE,OAAO,AAHpD,CACA,EADQ,MAG4C,GAF1C,MAAM,GAAC,IAAI,CAcvB;AAuED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAHlC,MAAM,EAG4B,GAFhC,MAAM,EAAE,CA2DpB;AAED,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC"}

package/types/lib/ecosystems/cppEvidence.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Method to find c/c++ modules by collecting usages with atom
+ *
+ * @param {string} src directory
+ * @param {object} options Command line options
+ * @param {array} osPkgsList Array of OS pacakges represented as components
+ * @param {array} epkgList Existing packages list
+ */
+export declare function getCppModules(src: string, options: object, osPkgsList: array, epkgList: array): {
+    parentComponent: Object | {
+        name: any;
+        version: any;
+        description: any;
+        license: any;
+        purl: any;
+        type: string;
+        "bom-ref": string;
+        group?: undefined;
+    } | {
+        description?: undefined;
+        license?: undefined;
+        purl?: undefined;
+        "bom-ref"?: undefined;
+        group: any;
+        name: any;
+        version: string;
+        type: string;
+    } | undefined;
+    pkgList: any[];
+    dependenciesList: {
+        ref: any;
+        dependsOn: any[];
+    }[];
+};
+//# sourceMappingURL=cppEvidence.d.ts.map

package/types/lib/ecosystems/cppEvidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cppEvidence.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/cppEvidence.js"],"names":[],"mappings":"AA4BA;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EALtB,MAKsB,EAAE,OAAO,EAJ/B,MAI+B,EAAE,UAAU,EAH3C,KAG2C,EAAE,QAAQ,EAFrD,KAEqD;;;;;;;;;;;;;;;;;;;;;;;;;EA4Q/D"}

package/types/lib/ecosystems/denoutils.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Remove JSONC (JSON-with-comments) noise from a source string so it can be
+ * parsed with `JSON.parse`. Handles `//` line comments, `/* block *​/`
+ * comments and trailing commas, while leaving string literals untouched.
+ *
+ * Implemented as a small single-pass scanner rather than a regex, per the
+ * cdxgen convention of avoiding hard-to-review/exponential regexes for
+ * untrusted input.
+ *
+ * @param {string} text Raw JSONC source.
+ * @returns {string} Plain JSON text.
+ */
+export declare function stripJsonc(text: string): string;
+/**
+ * Parse a JSON or JSONC file (deno.json or deno.jsonc) into a plain object.
+ *
+ * @param {string} jsonFile Path to the deno.json(c) file.
+ * @returns {Object|undefined} Parsed config, or undefined on failure.
+ */
+export declare function parseDenoJsonFile(jsonFile: string): Object | undefined;
+/**
+ * Locate the deno.json or deno.jsonc manifest for a given directory.
+ *
+ * @param {string} dir Directory to search.
+ * @returns {string|undefined} Path to the manifest, if present.
+ */
+export declare function findDenoJson(dir: string): string | undefined;
+/**
+ * Fetch JSR registry metadata for deno/jsr package components.
+ *
+ * For each component carrying a `cdx:deno:jsrKey` property, fetches the version
+ * and package endpoints from the JSR API (batched in a single prefetch round
+ * when enabled) and fills in license, description, and the GitHub source link.
+ *
+ * @param {Array<object>} pkgList Package components potentially enriched with `cdx:deno:jsrKey`.
+ * @returns {Promise<Array<object>>} The enriched package list (same reference as pkgList).
+ */
+export declare function getJsrMetadata(pkgList: Array<object>): Promise<Array<object>>;
+/**
+ * Parse a deno.lock file (versions 2 through 5) and return the package list
+ * and dependency graph in the same shape as the other lockfile parsers.
+ *
+ * Lock version summary:
+ *  - v5 (Deno >= 2.x, current): flat top-level `specifiers`, `jsr`, `npm` and
+ *    optional `remote` maps. jsr entries list their own jsr dependencies; npm
+ *    entries only carry an integrity hash and DO NOT list their own transitive
+ *    npm dependencies (see the limitation note below).
+ *  - v2/v3/v4: `npm.specifiers` + `npm.packages` (packages carry a
+ *    `dependencies` map of `name` -> `name@version`), optional `jsr` map and
+ *    `remote` map.
+ *
+ * purl mapping:
+ *  - `jsr:@scope/name@ver` -> `pkg:npm/@jsr/scope__name@ver` (see
+ *    `JSR_NPM_SCOPE` doc comment for the rationale).
+ *  - `npm:name@ver` -> `pkg:npm/name@ver` with the sha512 integrity as
+ *    `_integrity`.
+ *  - `https://...` remote imports -> `pkg:generic/<basename>` with a
+ *    `download_url` external reference.
+ *
+ * v5 npm-transitive limitation: in v5 lockfiles the `npm` map is flat and each
+ * npm entry contains only an integrity hash, never a dependencies list. As a
+ * result the CycloneDX dependency graph for npm packages under v5 is shallow
+ * (only the parent component -> direct npm deps). Resolving the full npm
+ * transitive graph would require hitting the npm registry or the deno
+ * `node_modules` cache, which cdxgen intentionally does not do by default.
+ *
+ * @param {string} lockFile Path to the deno.lock file.
+ * @param {Object} [options] Parsing options (`parentComponent`, `projectRoot`).
+ * @returns {Promise<{pkgList: Array, dependenciesList: Array}>} Parsed
+ *   packages and dependency graph.
+ */
+export declare function parseDenoLock(lockFile: string, options?: Object): Promise<{
+    pkgList: any[];
+    dependenciesList: any[];
+}>;
+//# sourceMappingURL=denoutils.d.ts.map

package/types/lib/ecosystems/denoutils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"denoutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/denoutils.js"],"names":[],"mappings":"AA8DA;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAHpB,MAGoB,GAFlB,MAAM,CAuDlB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,GAAC,SAAS,CAuB5B;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAHrB,MAGqB,GAFnB,MAAM,GAAC,SAAS,CAY5B;AAwSD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAHjC,KAAK,CAAC,MAAM,CAGqB,GAF/B,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAwElC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EALjC,MAKiC,EAAE,OAAO,AAJlD,CACA,EADQ,MAI+C,GAH7C,OAAO,CAAC;IAAC,OAAO,QAAQ;IAAC,gBAAgB,QAAO;CAAC,CAAC,CAke9D"}

package/types/lib/ecosystems/dotnetutils.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Extracts version number from a HintPath in .NET project files
+ * @param {string|null|undefined} hintPath - The HintPath string to extract version from
+ * @returns {string|null} The extracted version number or null if not found
+ * @example
+ * extractVersionFromHintPath('..\\packages\\BouncyCastle.Cryptography.2.6.2\\lib\\net461\\BouncyCastle.Cryptography.dll')
+ * // returns '2.6.2'
+ *
+ * extractVersionFromHintPath('C:\\Users\\user\\.nuget\\packages\\microsoft.entityframeworkcore\\7.0.10\\lib\\net6.0\\Microsoft.EntityFrameworkCore.dll')
+ * // returns '7.0.10'
+ *
+ * extractVersionFromHintPath('../packages/MyLib.1.0.0+build.123/lib/net48/MyLib.dll')
+ * // returns '1.0.0+build.123'
+ */
+export declare function extractVersionFromHintPath(hintPath: string | null | undefined): string | null;
+/**
+ * Validates if a string is a valid semantic version
+ * Supports versions with pre-release identifiers and build metadata
+ * @param {string|null|undefined} version - The version string to validate
+ * @returns {boolean} True if the version is valid, false otherwise
+ * @example
+ * isValidVersion('1.0.0') // true
+ * isValidVersion('1.0.0-alpha') // true
+ * isValidVersion('1.0.0+build.123') // true
+ * isValidVersion('1.0.0-alpha+build.123') // true
+ * isValidVersion('1.0.0-') // false
+ * isValidVersion('invalid') // false
+ */
+export declare function isValidVersion(version: string | null | undefined): boolean;
+/**
+ * Extracts both package name and version from a HintPath in .NET project files
+ * @param {string|null|undefined} hintPath - The HintPath string to extract package info from
+ * @returns {{name: string|null, version: string|null}} Object containing package name and version
+ * @example
+ * extractPackageInfoFromHintPath('..\\packages\\BouncyCastle.Cryptography.2.6.2\\lib\\net461\\BouncyCastle.Cryptography.dll')
+ * // returns { name: 'BouncyCastle.Cryptography', version: '2.6.2' }
+ *
+ * extractPackageInfoFromHintPath('C:\\Users\\user\\.nuget\\packages\\microsoft.entityframeworkcore\\7.0.10\\lib\\net6.0\\Microsoft.EntityFrameworkCore.dll')
+ * // returns { name: 'microsoft.entityframeworkcore', version: '7.0.10' }
+ */
+export declare function extractPackageInfoFromHintPath(hintPath: string | null | undefined): {
+    name: string | null;
+    version: string | null;
+};
+//# sourceMappingURL=dotnetutils.d.ts.map

package/types/lib/ecosystems/dotnetutils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dotnetutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/dotnetutils.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAZxC,MAAM,GAAC,IAAI,GAAC,SAY4B,GAXtC,MAAM,GAAC,IAAI,CAgDvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAV3B,MAAM,GAAC,IAAI,GAAC,SAUe,GATzB,OAAO,CAenB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAT5C,MAAM,GAAC,IAAI,GAAC,SASgC,GAR1C;IAAC,IAAI,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,GAAC,IAAI,CAAA;CAAC,CAsDrD"}

package/types/lib/ecosystems/ecosystems.d.ts

@@ -0,0 +1,279 @@
+export declare let metadata_cache: {};
+/**
+ * Internal helper to reset metadata_cache. Used by parseGoModData (still in
+ * utils.js until batch 6) because ESM forbids reassigning an imported binding.
+ * NOT re-exported through the utils.js barrel.
+ */
+export declare function _clearMetadataCache(): void;
+/**
+ * Fetches license information for a list of Swift packages by querying the
+ * GitHub repository license API for packages hosted on github.com.
+ *
+ * @param {Object[]} pkgList List of Swift package objects with optional repository.url fields
+ * @returns {Promise<Object[]>} Resolved list of package objects, each augmented with a license field where available
+ */
+export declare function getSwiftPackageMetadata(pkgList: Object[]): Promise<Object[]>;
+/**
+ * Method to retrieve metadata for npm packages by querying npmjs
+ *
+ * @param {Array} pkgList Package list
+ */
+export declare function getNpmMetadata(pkgList: any[], registryUrl: any): Promise<any[]>;
+/**
+ * Method to locate local Gradle, Maven, or Coursier cache files for a given maven coordinate.
+ *
+ * @param {string} group Maven groupId
+ * @param {string} name Maven artifactId
+ * @param {string} version Package version
+ * @returns {Object|null} Object containing jarPath, sha1, and pomPath, or null
+ */
+export declare function findLocalMvnArtifact(group: string, name: string, version: string): Object | null;
+/**
+ * Method to retrieve metadata for maven packages by querying maven central
+ *
+ * @param {Array} pkgList Package list
+ * @param {Object} jarNSMapping Jar Namespace mapping object
+ * @param {Boolean} force Force fetching of license
+ *
+ * @returns {Array} Updated package list
+ */
+export declare function getMvnMetadata(pkgList: any[], jarNSMapping?: Object, force?: boolean): any[];
+/**
+ * Method to compose URL of pom.xml
+ *
+ * @param {String} urlPrefix
+ * @param {String} group
+ * @param {String} name
+ * @param {String} version
+ *
+ * @return {String} fullUrl
+ */
+export declare function composePomXmlUrl({ urlPrefix, group, name, version }: string): string;
+/**
+ * Method to fetch pom.xml data and parse it to JSON
+ *
+ * @param {String} urlPrefix
+ * @param {String} group
+ * @param {String} name
+ * @param {String} version
+ *
+ * @return {Object|undefined}
+ */
+export declare function fetchPomXmlAsJson({ urlPrefix, group, name, version }: string): Object | undefined;
+/**
+ * Method to fetch pom.xml data
+ *
+ * @param {String} urlPrefix
+ * @param {String} group
+ * @param {String} name
+ * @param {String} version
+ *
+ * @return {Promise<String>}
+ */
+export declare function fetchPomXml({ urlPrefix, group, name, version }: string): Promise<string>;
+/**
+ * Method extract single or multiple license entries that might appear in pom.xml
+ *
+ * @param {Object|Array} license
+ */
+export declare function parseLicenseEntryOrArrayFromPomXml(license: Object | any[]): any[] | undefined;
+/**
+ * Method to parse pom.xml in search of a comment containing license text
+ *
+ * @param {String} urlPrefix
+ * @param {String} group
+ * @param {String} name
+ * @param {String} version
+ *
+ * @return {Promise<String>} License ID
+ */
+export declare function extractLicenseCommentFromPomXml({ urlPrefix, group, name, version, }: string): Promise<string>;
+/**
+ * Method to mimic pip version solver using node-semver
+ *
+ * @param {Array} versionsList List of version numbers available
+ * @param {*} versionSpecifiers pip version specifier
+ */
+export declare function guessPypiMatchingVersion(versionsList: any[], versionSpecifiers: any): any;
+/**
+ * Method to retrieve metadata for python packages by querying pypi
+ *
+ * @param {Array} pkgList Package list
+ * @param {Boolean} fetchDepsInfo Fetch dependencies info from pypi
+ */
+export declare function getPyMetadata(pkgList: any[], fetchDepsInfo: boolean): Promise<any[]>;
+/**
+ * Method to parse bdist_wheel metadata (dist-info/METADATA)
+ *
+ * @param {string} mDataFile bdist_wheel metadata file
+ * @param {string} rawMetadata Raw metadata
+ *
+ */
+export declare function parseBdistMetadata(mDataFile: string, rawMetadata?: string): {
+    name: string;
+    version: string;
+    description: string;
+    author: string;
+    licenses: never[];
+    externalReferences: never[];
+    properties: never[];
+}[];
+/**
+ * Build a stable dedupe key for an external reference from its type/url/comment.
+ *
+ * @param {{type: string, url: string, comment?: string}} reference External reference.
+ * @returns {string} JSON-stringified dedupe key.
+ */
+export declare function createExternalReferenceKey(reference: {
+    type: string;
+    url: string;
+    comment?: string;
+}): string;
+/**
+ * Merge external references onto a component, skipping duplicates.
+ *
+ * @param {object} component Component to enrich with external references.
+ * @param {Array<{type: string, url: string, comment?: string}>} references References to merge.
+ * @returns {void}
+ */
+export declare function mergeExternalReferences(component: object, references: Array<{
+    type: string;
+    url: string;
+    comment?: string;
+}>): void;
+/**
+ * Method to construct a GitHub API url for the given repo metadata
+ * @param {Object} repoMetadata Repo metadata with group and name
+ * @return {String|undefined} github api url (or undefined - if not enough data)
+ */
+export declare function repoMetadataToGitHubApiUrl(repoMetadata: Object): string | undefined;
+/**
+ * Method to split GitHub url into its parts
+ * @param {String} repoUrl Repository url
+ * @return {[String]} parts from url
+ */
+export declare function getGithubUrlParts(repoUrl: string): [string];
+/**
+ * Method to construct GitHub api url from repo metadata or one of multiple formats of repo URLs
+ * @param {String} repoUrl Repository url
+ * @param {Object} repoMetadata Object containing group and package name strings
+ * @return {String|undefined} github api url (or undefined - if not a GitHub repo)
+ */
+export declare function toGitHubApiUrl(repoUrl: string, repoMetadata: Object): string | undefined;
+/**
+ * Prefetch the GitHub licence endpoint for a list of repository URLs.
+ *
+ * The single biggest remaining serialisation: `getRepoLicense` is called once
+ * per component from npm, Maven, Swift and Go, each call a full round trip to
+ * api.github.com. Batching them also makes the authenticated concurrency
+ * allowance worth having — with `GITHUB_TOKEN` set, cdxrs runs eight of these at
+ * a time instead of one.
+ *
+ * @param {Array<string|undefined>} repoUrls Repository URLs (duplicates and
+ *   empties are fine).
+ * @returns {Promise<void>}
+ */
+export declare function prefetchRepoLicenses(repoUrls: Array<string | undefined>): Promise<void>;
+/**
+ * Discard prefetched repository licences. Tests only.
+ */
+export declare function resetRepoLicensePrefetch(): void;
+/**
+ * Fetch the license for a repository, primarily via the GitHub license API.
+ *
+ * Resolves the GitHub API license endpoint for the repository URL, deriving an
+ * SPDX id from the response (or by scanning the license file content when the
+ * API reports `NOASSERTION`). Honours any prefetched response.
+ *
+ * @param {string} repoUrl Repository URL.
+ * @param {object} [repoMetadata] Optional repository metadata.
+ * @returns {Promise<{url: string, id?: string, name?: string}|undefined>}
+ *   Resolved license object, or undefined when no license can be determined.
+ */
+export declare function getRepoLicense(repoUrl: string, repoMetadata?: object): Promise<{
+    url: string;
+    id?: string;
+    name?: string;
+} | undefined>;
+/**
+ * Prefetch the pkg.go.dev pages for a list of Go modules.
+ *
+ * Go was the last ecosystem making one round trip per module with the URL known
+ * up front: `getGoPkgLicense` and `getGoPkgVCSUrl` are both called from inside
+ * the parsers' loops, so a module list of any size was fetched strictly one at a
+ * time. Both pages are HTML, which is why these requests carry
+ * `responseType: "text"` and so run on the JS pool rather than through cdxrs.
+ *
+ * Callers must pass exactly the modules their loop will look up. A superset
+ * issues requests the serial path never made; a subset only loses some of the
+ * batching.
+ *
+ * @param {Array<{group?: string, name?: string}>} modules Modules about to be
+ *   resolved. Duplicates and entries without a name are fine.
+ * @returns {Promise<void>}
+ */
+export declare function prefetchGoPkgMetadata(modules: Array<{
+    group?: string;
+    name?: string;
+}>): Promise<void>;
+/**
+ * Discard prefetched pkg.go.dev documents. Tests only.
+ */
+export declare function resetGoPkgPrefetch(): void;
+/**
+ * Method to get go pkg license from go.dev site.
+ *
+ * @param {Object} repoMetadata Repo metadata
+ */
+export declare function getGoPkgLicense(repoMetadata: Object): Promise<any>;
+/**
+ * Method to get go pkg vcs url from go.dev site.
+ *
+ * @param {String} group Package group
+ * @param {String} name Package name
+ */
+export declare function getGoPkgVCSUrl(group: string, name: string): Promise<any>;
+/**
+ * Method to retrieve metadata for rust packages by querying crates
+ *
+ * @param {Array} pkgList Package list
+ */
+export declare function getCratesMetadata(pkgList: any[]): Promise<any[]>;
+/**
+ * Method to retrieve metadata for dart packages by querying pub.dev
+ *
+ * @param {Array} pkgList Package list
+ */
+export declare function getDartMetadata(pkgList: any[]): Promise<any[]>;
+/**
+ * Normalize a Cargo checksum/integrity string into canonical hex-prefixed form.
+ *
+ * Accepts an existing `sha256-`/`sha384-` prefixed digest (validating the hex
+ * length) or a bare hex digest, returning `<algo>-<digest>`. Returns undefined
+ * for non-string or unrecognized inputs.
+ *
+ * @param {string} integrity Raw checksum string from a Cargo.lock or registry.
+ * @returns {string|undefined} Canonical `algo-digest` integrity, or undefined.
+ */
+export declare function normalizeCargoIntegrity(integrity: string): string | undefined;
+/**
+ * Method to extract a war or ear file
+ *
+ * @param {string} jarFile Path to jar file
+ * @param {string} tempDir Temporary directory to use for extraction
+ * @param {object} jarNSMapping Jar class names mapping object
+ *
+ * @return pkgList Package list
+ */
+export declare function extractJarArchive(jarFile: string, tempDir: string, jarNSMapping?: object): Promise<any[]>;
+/**
+ * Method to retrieve metadata for nuget packages
+ *
+ * @param {Array} pkgList Package list
+ * @param {Array} dependencies Dependencies
+ */
+export declare function getNugetMetadata(pkgList: any[], dependencies?: any[]): Promise<{
+    pkgList: any[];
+    dependencies: any[];
+}>;
+//# sourceMappingURL=ecosystems.d.ts.map

package/types/lib/ecosystems/ecosystems.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecosystems.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/ecosystems.js"],"names":[],"mappings":"AAyFA,eAAO,IAAI,cAAc,IAAK,CAAC;AAY/B;;;;GAIG;AACH,wBAAgB,mBAAmB,SAElC;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAH1C,MAAM,EAGoC,GAFxC,OAAO,CAAC,MAAM,EAAE,CAAC,CAmC7B;AAyBD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,OAAO,OAAA,EAAE,WAAW,KAAA,kBAiGxD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAL/B,MAK+B,EAAE,IAAI,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,MAAM,GAAC,IAAI,CAmIvB;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,OAAA,EACP,YAAY,GAPH,MAOQ,EACjB,KAAK,UAAQ,SA+Ed;AA4ND;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,UAGnE;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,GAF/D,MAAM,GAAC,SAAS,CA6B3B;AAgBD;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAA,GAFzD,OAAO,QAAQ,CAgB1B;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAF/C,MAAM,QAEyC,qBAUzD;AAED;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CAAC,EACpD,SAAS,EACT,KAAK,EACL,IAAI,EACJ,OAAO,GACR,QAAA,GAPW,OAAO,QAAQ,CAc1B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,OAAA,EAAE,iBAAiB,EAF7D,GAE6D,OAwBvE;AA6BD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,OAAA,EAAE,aAAa,SAAA,kBAyPzD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAJjC,MAIiC,EAAE,WAAW,GAH9C,MAG0D;;;;;;;;IAiIpE;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAHzC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAGH,GAFvC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAJtC,MAIsC,EAAE,UAAU,EAHlD,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAGD,GAFhD,IAAI,CAuBhB;AAiBD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,YAAY,EAH5C,MAG4C,GAF3C,SAAO,SAAS,CAqB3B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,QAAA,GAF7B,QAAQ,CAQnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,QAAA,EAAE,YAAY,EAHzC,MAGyC,GAFxC,SAAO,SAAS,CAc3B;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAJxC,KAAK,CAAC,MAAM,GAAC,SAAS,CAIkB,GAFtC,OAAO,CAAC,IAAI,CAAC,CAqCzB;AAED;;GAEG;AACH,wBAAgB,wBAAwB,SAEvC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,OAAO,EALjC,MAKiC,EAAE,YAAY,AAJvD,CACA,EADQ,MAI+C,GAH7C,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CAkExE;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAJxC,KAAK,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,CAIG,GAFtC,OAAO,CAAC,IAAI,CAAC,CAwCzB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,SAEjC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,YAAY,EAFvC,MAEuC,gBA2CjD;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,KAAK,QAAA,EAAE,IAAI,QAAA,gBAsB/C;AA2CD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,OAAA,kBA4G9C;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,OAAO,OAAA,kBAiE5C;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAHtC,MAGsC,GAFpC,MAAM,GAAC,SAAS,CA6B5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EANpC,MAMoC,EAAE,OAAO,EAL7C,MAK6C,EAAE,YAAY,GAJ3D,MAIgE,kBAmY1E;AA6MD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,OAAA,EAAE,YAAY,QAAY;;;GA4JvE"}