@cdxgen/cdxgen 0.0.1 → 13.0.1

package/types/lib/ecosystems/parsers-zig.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Zig `build.zig.zon` parser.
+ *
+ * `build.zig.zon` is ZON — Zig Object Notation — and it is not JSON. It uses
+ * unquoted `.field = value` syntax, `.{}` anonymous struct literals, tuples
+ * (positional struct fields), multiline string literals, character literals,
+ * hex/underscore-separated numbers, and enum literals (`.foo`). A naive
+ * `JSON.parse` with fixups cannot read it, so this module ships a real
+ * tokenizer and recursive-descent parser.
+ *
+ * The grammar implemented here is the subset that appears in `build.zig.zon`:
+ * anonymous struct literals, tuples, string literals (with the full Zig escape
+ * set), multiline string literals, numbers, character literals, booleans,
+ * `null`, enum literals, and `//` line comments — ZON is Zig syntax, and the
+ * manifest `zig init` generates is largely comments.
+ */
+/**
+ * Parse a Zig `build.zig.zon` file and return a package list and parent
+ * component describing the project and its dependencies.
+ *
+ * Zig dependencies are content-addressed rather than versioned by tag, so a
+ * fetched dependency's identity comes from its `.hash`. Two encodings are in
+ * use: the pre-0.14 hex multihash, where a `1220` prefix denotes SHA-2-256
+ * (codec `0x12`, 32-byte length `0x20`), and the 0.14+ form
+ * `<name>-<version>-<base64 digest>`, which carries the dependency's declared
+ * version. The multihash digest is emitted as a CycloneDX `hashes[]` entry
+ * when the codec is recognised; the raw hash string is always kept as a
+ * property so nothing is lost for encodings that cannot be decoded.
+ *
+ * `zig` is not a registered purl type, so dependencies use `pkg:generic/...`
+ * with a `cdx:purl:proposedType=zig` property and a `download_url` qualifier
+ * built from the `url`.
+ *
+ * @param {string} zonFile Path to `build.zig.zon`
+ * @returns {{ pkgList: object[], parentComponent: object }} parsed packages
+ */
+export declare function parseBuildZigZon(zonFile: string): {
+    pkgList: object[];
+    parentComponent: object;
+};
+/**
+ * Parse ZON content (already read from a file or extracted from an archive)
+ * into a package list and parent component.
+ *
+ * The content-based entry point lets the resolver parse manifests read from
+ * `.tar.gz` cache archives without writing them to a temp file.
+ *
+ * @param {string} content Raw ZON source
+ * @param {string} [sourceLabel] Path or label used in `internal:SrcFile`
+ *   evidence. When omitted, `"<zon-content>"` is used.
+ * @returns {{ pkgList: object[], parentComponent: object }} parsed packages
+ */
+export declare function parseBuildZigZonContent(content: string, sourceLabel?: string): {
+    pkgList: object[];
+    parentComponent: object;
+};
+/**
+ * Tokenize a ZON source string.
+ *
+ * The tokenizer is intentionally separate from the parser so each literal form
+ * (string escapes, multiline strings, hex numbers, char literals) is handled
+ * in one place and can be unit-tested in isolation.
+ *
+ * @param {string} src ZON source
+ * @returns {Array<{type: string, value: *}>} tokens
+ * @throws {Error} when the source contains a character that cannot begin a token
+ */
+export declare function tokenizeZon(src: string): Array<{
+    type: string;
+    value: any;
+}>;
+/**
+ * Parse a ZON source string into a JavaScript value.
+ *
+ * Structs become plain objects keyed by field name; tuple (positional) values
+ * are collected under a `_positional` array. Enum literals (`.foo`) become the
+ * bare identifier string.
+ *
+ * @param {string} src ZON source
+ * @returns {*} parsed value
+ */
+export declare function parseZon(src: string): any;
+//# sourceMappingURL=parsers-zig.d.ts.map

package/types/lib/ecosystems/parsers-zig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers-zig.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/parsers-zig.js"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAG6B,GAF3B;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAW1D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EANE,MAMF,EACP,WAAW,AANV,CAEA,EAFQ,MAMoB,GAJlB;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAkE1D;AAsPD;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAJpB,MAIoB,GAHlB,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,GAAC,CAAA;CAAC,CAAC,CAuI3C;AAkND;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAHjB,MAGiB,GAFf,GAAC,CAQb"}

package/types/lib/ecosystems/pep770.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Discover and parse embedded SBOMs from installed distribution metadata
+ * directories and wheel files, per PEP 770. Returns merged components,
+ * dependencies, and citations ready for post-processing.
+ *
+ * Embedded components are returned as dependencies *of* the distribution that
+ * supplied them, never as orphan top-level siblings. An embedded SBOM is
+ * stronger than cdxgen's inference; the upstream component wins on conflict,
+ * which the merge (trimComponents) records by unioning rather than discarding.
+ *
+ * @param {Object} input Discovery inputs
+ * @param {string[]} [input.metadataFiles] Installed `*.dist-info/METADATA` paths
+ * @param {string[]} [input.whlFiles] Wheel file paths
+ * @returns {Promise<{components: Object[], dependencies: Object[], citations: Object[]}>}
+ */
+export declare function collectEmbeddedSboms({ metadataFiles, whlFiles, }?: {
+    metadataFiles?: string[];
+    whlFiles?: string[];
+}): Promise<{
+    components: Object[];
+    dependencies: Object[];
+    citations: Object[];
+}>;
+/**
+ * Test-only export exposing internal helpers and constants for unit testing.
+ *
+ * Underscore-prefixed to signal that it is not part of the public API.
+ *
+ * @type {{ MAX_EMBEDDED_SBOM_BYTES: number, parseEmbeddedSbom: Function, rebaseDependencies: Function, pypiBomRef: Function, distNameVersionFromMetadata: Function }}
+ */
+export declare const _internals: {
+    MAX_EMBEDDED_SBOM_BYTES: number;
+    parseEmbeddedSbom: Function;
+    rebaseDependencies: Function;
+    pypiBomRef: Function;
+    distNameVersionFromMetadata: Function;
+};
+//# sourceMappingURL=pep770.d.ts.map

package/types/lib/ecosystems/pep770.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pep770.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/pep770.js"],"names":[],"mappings":"AA8MA;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,aAAkB,EAClB,QAAa,GACd,GAPE;IAAyB,aAAa,AAAtC,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,QAAQ,AAAjC,CACA,EADQ,MAAM,EAAE,CAChB;CAKG,GALO,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CA0GxF;AAED;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,EAFb;IAAE,uBAAuB,EAAE,MAAM,CAAC;IAAC,iBAAiB,WAAW;IAAC,kBAAkB,WAAW;IAAC,UAAU,WAAW;IAAC,2BAA2B,WAAU;CAQlK,CAAC"}

package/types/lib/ecosystems/pylockutils.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Check whether a file name conforms to pylock naming.
+ *
+ * @param {string} lockFilePath lock file path
+ * @returns {boolean} true if this is a pylock file
+ */
+export declare function isPyLockFile(lockFilePath: string): boolean;
+/**
+ * Check whether a parsed toml object follows pylock format.
+ *
+ * @param {object} lockTomlObj parsed toml object
+ * @returns {boolean} true if object appears to be pylock data
+ */
+export declare function isPyLockObject(lockTomlObj: object): boolean;
+/**
+ * Get package entries from py lock data in a format-agnostic way.
+ *
+ * @param {object} lockTomlObj parsed toml object
+ * @returns {Array<object>} package entries
+ */
+export declare function getPyLockPackages(lockTomlObj: object): Array<object>;
+/**
+ * Convert top-level pylock keys to custom cdx properties.
+ *
+ * @param {object} lockTomlObj parsed toml object
+ * @returns {Array<object>} custom properties
+ */
+export declare function collectPyLockTopLevelProperties(lockTomlObj: object): Array<object>;
+/**
+ * Convert package-level pylock keys to custom cdx properties.
+ *
+ * @param {object} pkg pylock package entry
+ * @returns {Array<object>} custom properties
+ */
+export declare function collectPyLockPackageProperties(pkg: object): Array<object>;
+/**
+ * Build file components from pylock source entries.
+ *
+ * @param {object} pkg pylock package entry
+ * @param {string} lockFile lock file path
+ * @returns {Array<object>} file components
+ */
+export declare function collectPyLockFileComponents(pkg: object, lockFile: string): Array<object>;
+/**
+ * Check whether index points to the default pypi registry.
+ *
+ * @param {string} indexUrl index URL from pylock
+ * @returns {boolean} true for default pypi
+ */
+export declare function isDefaultPypiRegistry(indexUrl: string): boolean;
+/**
+ * Normalize a pylock package index URL for comparison and reporting.
+ *
+ * @param {string} indexUrl package index URL
+ * @returns {string|undefined} normalized registry URL
+ */
+export declare function normalizePyLockRegistry(indexUrl: string): string | undefined;
+/**
+ * Collect dependency names and scopes from a pylock package entry.
+ *
+ * @param {object} pkg pylock package entry
+ * @returns {{ name: string, scope: string }[]} dependency relationships
+ */
+export declare function collectPyLockDependencyRelationships(pkg: object): {
+    name: string;
+    scope: string;
+}[];
+//# sourceMappingURL=pylockutils.d.ts.map

package/types/lib/ecosystems/pylockutils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pylockutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/pylockutils.js"],"names":[],"mappings":"AA+BA;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,YAAY,EAH9B,MAG8B,GAF5B,OAAO,CAOnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAH/B,MAG+B,GAF7B,OAAO,CAMnB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAHlC,MAGkC,GAFhC,KAAK,CAAC,MAAM,CAAC,CAUzB;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,WAAW,EAHhD,MAGgD,GAF9C,KAAK,CAAC,MAAM,CAAC,CAazB;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAHvC,MAGuC,GAFrC,KAAK,CAAC,MAAM,CAAC,CAazB;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAJpC,MAIoC,EAAE,QAAQ,EAH9C,MAG8C,GAF5C,KAAK,CAAC,MAAM,CAAC,CAwCzB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC,OAAO,CAOnB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CAc5B;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAAC,GAAG,EAH7C,MAG6C,GAF3C;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,CAgB7C"}

package/types/lib/ecosystems/pythonutils.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Universal virtual environment metadata detector
+ * @param {Object} env - Environment variables (defaults to process.env)
+ * @param {string} [explicitPath] - Optional explicit venv path to inspect
+ * @returns {Object} Structured environment metadata
+ */
+export declare function getVenvMetadata(env?: Object, explicitPath?: string): Object;
+/**
+ * Determines the appropriate Python executable path from a virtual environment.
+ * Inspects the virtual environment metadata to detect the Python type (system,
+ * conda, pyenv, etc.) and returns the most specific executable found, falling
+ * back to the global `PYTHON_CMD` constant when no executable is detected.
+ *
+ * @param {string} env Path to the Python virtual environment directory
+ * @returns {string} Path to the Python executable or the fallback command name
+ */
+export declare function get_python_command_from_env(env: string): string;
+/**
+ * Method to find python modules by parsing the imports and then checking with PyPI to obtain the latest version
+ *
+ * @param {string} src directory
+ * @param {Array} epkgList Existing package list
+ * @param {Object} options CLI options
+ * @returns List of packages
+ */
+export declare function getPyModules(src: string, epkgList: any[], options: Object): Promise<{
+    allImports: {};
+    pkgList: any;
+    dependenciesList: {
+        ref: string;
+        dependsOn: never[];
+    }[];
+    modList: any;
+}>;
+/**
+ * Create uv.lock file with uv sync command.
+ *
+ * @param {string} basePath Path
+ * @param {Object} options CLI options
+ */
+export declare function createUVLock(basePath: string, options: Object): void;
+/**
+ * Execute pip freeze by creating a virtual env in a temp directory and construct the dependency tree
+ *
+ * @param {string} basePath Base path
+ * @param {string} reqOrSetupFile Requirements or setup.py file
+ * @param {string} tempVenvDir Temp venv dir
+ * @param {Object} parentComponent Parent component
+ *
+ * @returns {Object} List of packages from the virtual env
+ */
+export declare function getPipFrozenTree(basePath: string, reqOrSetupFile: string, tempVenvDir: string, parentComponent: Object, projectRoot: any, getTreeWithPluginFn: any): Object;
+export declare function getPipTreeForPackages(basePath: any, pkgList: any, tempVenvDir: any, parentComponent: any, getTreeWithPluginFn: any): {
+    rootList?: undefined;
+    dependenciesList?: undefined;
+    failedPkgList?: undefined;
+} | {
+    failedPkgList: any[];
+    rootList: {
+        name: any;
+        version: any;
+        purl: any;
+        "bom-ref": string;
+    }[];
+    dependenciesList: {
+        ref: string;
+        dependsOn: any[];
+    }[];
+};
+//# sourceMappingURL=pythonutils.d.ts.map

package/types/lib/ecosystems/pythonutils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pythonutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/pythonutils.js"],"names":[],"mappings":"AAiCA;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAJxB,MAIsC,EAAE,YAAY,AAH5D,CACA,EADQ,MAG2D,GAFzD,MAAM,CAyLlB;AAyED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAHpC,MAGoC,GAFlC,MAAM,CA6BlB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAL3B,MAK2B,EAAE,QAAQ,OAAA,EAAE,OAAO,EAH9C,MAG8C;;;;;;;;GAuExD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAH1B,MAG0B,EAAE,OAAO,EAFnC,MAEmC,QAgD7C;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EARC,MAQD,EACR,cAAc,EARL,MAQK,EACd,WAAW,EARF,MAQE,EACX,eAAe,EARN,MAQM,EACf,WAAW,KAAA,EACX,mBAAmB,KAAA,GARR,MAAM,CAmkBlB;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,KAAA,EACR,OAAO,KAAA,EACP,WAAW,KAAA,EACX,eAAe,KAAA,EACf,mBAAmB,KAAA;;;;;;;;;;;;;;;;EAwNpB"}

package/types/lib/ecosystems/registryProvenance.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Extract advanced npm provenance and publishing properties from registry metadata.
+ *
+ * @param {object} packument npm packument body
+ * @param {string | undefined} version package version
+ * @returns {object[]} custom properties
+ */
+export declare function collectNpmRegistryProvenanceProperties(packument: object, version: string | undefined): object[];
+/**
+ * Extract advanced PyPI provenance and publishing properties from registry metadata.
+ *
+ * @param {object} projectBody PyPI JSON body
+ * @param {string | undefined} version package version
+ * @returns {object[]} custom properties
+ */
+export declare function collectPypiRegistryProvenanceProperties(projectBody: object, version: string | undefined): object[];
+/**
+ * Extract Cargo/crates.io release, publisher, and provenance-adjacent properties.
+ *
+ * @param {object} crateBody crates.io `/api/v1/crates/{name}` response body
+ * @param {string | undefined} version crate version
+ * @param {object} [ownersBody] crates.io `/api/v1/crates/{name}/owners` response body
+ * @returns {object[]} custom properties
+ */
+export declare function collectCargoRegistryProvenanceProperties(crateBody: object, version: string | undefined, ownersBody?: object): object[];
+//# sourceMappingURL=registryProvenance.d.ts.map

package/types/lib/ecosystems/registryProvenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registryProvenance.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/registryProvenance.js"],"names":[],"mappings":"AA6SA;;;;;;GAMG;AACH,wBAAgB,sCAAsC,CAAC,SAAS,EAJrD,MAIqD,EAAE,OAAO,EAH9D,MAAM,GAAG,SAGqD,GAF5D,MAAM,EAAE,CA4MpB;AAED;;;;;;GAMG;AACH,wBAAgB,uCAAuC,CAAC,WAAW,EAJxD,MAIwD,EAAE,OAAO,EAHjE,MAAM,GAAG,SAGwD,GAF/D,MAAM,EAAE,CAmRpB;AAED;;;;;;;GAOG;AACH,wBAAgB,wCAAwC,CACtD,SAAS,EANA,MAMA,EACT,OAAO,EANE,MAAM,GAAG,SAMX,EACP,UAAU,AANT,CACA,EADQ,MAMC,GALC,MAAM,EAAE,CA0MpB"}

package/types/lib/ecosystems/remote/huggingface.d.ts

@@ -0,0 +1,31 @@
+export { normalizeHuggingFaceReference, toHuggingFacePurl, } from "../../parsers/huggingfaceUtils.js";
+/**
+ * Clear the in-process Hugging Face caches used for remote metadata lookup.
+ */
+export declare function resetHuggingFaceRemoteCaches(): void;
+/**
+ * Check whether remote Hugging Face metadata resolution is enabled.
+ *
+ * @param {Object} [options={}] CLI options
+ * @returns {boolean} true when remote resolution is enabled
+ */
+export declare const isHuggingFaceRemoteEnabled: (options?: Object) => boolean;
+/**
+ * Resolve a Hugging Face model, dataset, or space into a BOM component.
+ *
+ * @param {string} assetType asset type such as model or dataset
+ * @param {string} repoId Hugging Face repository id
+ * @param {Object} [options={}] fetch and header overrides
+ * @returns {Promise<Object|undefined>} resolved BOM component
+ */
+export declare function fetchHuggingFaceAssetInventory(assetType: string, repoId: string, options?: Object): Promise<Object | undefined>;
+/**
+ * Resolve a Hugging Face asset to the primary CycloneDX component only.
+ *
+ * @param {string} assetType asset type such as model or dataset
+ * @param {string} repoId Hugging Face repository id
+ * @param {Object} [options={}] fetch and header overrides
+ * @returns {Promise<Object|undefined>} primary resolved component
+ */
+export declare function fetchHuggingFaceAssetMetadata(assetType: string, repoId: string, options?: Object): Promise<Object | undefined>;
+//# sourceMappingURL=huggingface.d.ts.map

package/types/lib/ecosystems/remote/huggingface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"huggingface.d.ts","sourceRoot":"","sources":["../../../../lib/ecosystems/remote/huggingface.js"],"names":[],"mappings":"AA4JA,OAAO,EACL,6BAA6B,EAC7B,iBAAiB,GAClB,MAAM,mCAAmC,CAAC;AAE3C;;GAEG;AACH,wBAAgB,4BAA4B,SAG3C;AAq6BD;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,aAH5B,MAAM,KACJ,OAOV,CAAC;AAEJ;;;;;;;GAOG;AACH,wBAAsB,8BAA8B,CAClD,SAAS,EANA,MAMA,EACT,MAAM,EANG,MAMH,EACN,OAAO,AANN,CACA,EADQ,MAMG,GALD,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA0MrC;AAED;;;;;;;GAOG;AACH,wBAAsB,6BAA6B,CACjD,SAAS,EANA,MAMA,EACT,MAAM,EANG,MAMH,EACN,OAAO,AANN,CACA,EADQ,MAMG,GALD,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAarC"}

package/types/lib/ecosystems/rubyutils.d.ts

@@ -0,0 +1,182 @@
+/**
+ * Is the given string a `Gem::Platform` such as `x86_64-linux` or `java`?
+ * The cpu component is an open token in RubyGems, so we validate by looking
+ * for a known os name in any position.
+ *
+ * Note that `truffleruby` is deliberately absent from the os table.
+ * `Gem::Platform.new("truffleruby").to_s` is `"unknown"`: TruffleRuby reports a
+ * conventional local platform such as `x86_64-linux`, and reuses plain ruby
+ * gems via an allowlist rather than through a platform of its own. So
+ * `truffleruby` never appears as a platform suffix.
+ *
+ * @param {string} value Candidate platform string
+ * @returns {boolean} true if the value looks like a gem platform
+ */
+export declare function isRubyPlatform(value: string): boolean;
+/**
+ * Normalize a gem platform the way `Gem::Platform` does.
+ *
+ * The only alias that matters for a lockfile or a gemspec is `jruby`, which
+ * `Gem::Platform` maps to the os `java`, so `Gem::Platform.new("jruby").to_s`
+ * is `"java"`. Normalizing keeps a JRuby gem from being reported under two
+ * different purls depending on which spelling the source used.
+ *
+ * @param {string | undefined} platform Platform to normalize
+ * @returns {string | undefined} Normalized platform
+ */
+export declare function normalizeGemPlatform(platform: string | undefined): string | undefined;
+/**
+ * Split a gem version string into its version and optional native platform.
+ *
+ * Bundler writes native gems as `name (version-platform)`, for example
+ * `google-protobuf (3.25.1-x86_64-linux)`. This mirrors how Bundler itself
+ * parses the lockfile: its `NAME_VERSION` regex captures the version as
+ * `([^-]*)` followed by an optional `-(.*)` platform, i.e. it splits at the
+ * *first* hyphen. That is unambiguous because `Gem::Version` rewrites any `-`
+ * to `.pre.` on construction, so a canonical version string, which is what
+ * Bundler writes to the lockfile, never contains a hyphen.
+ *
+ * @param {string | undefined} version Version that may include a platform suffix
+ * @returns {{version: (string | undefined), platform: (string | undefined)}} Version and platform
+ */
+export declare function splitRubyVersionPlatform(version: string | undefined): {
+    version: (string | undefined);
+    platform: (string | undefined);
+};
+/**
+ * Simplify the ruby version by removing platform suffixes
+ *
+ * @param {string} version Version to simplify
+ * @returns {string} Simplified version
+ */
+export declare function simplifyRubyVersion(version: string): string;
+/**
+ * Construct a gem purl. Per the purl specification, the native platform is
+ * represented with the `platform` qualifier and not as part of the version.
+ * `ruby` is the implied default platform, so it is left out.
+ *
+ * @param {string} name Gem name
+ * @param {string | undefined} version Gem version without any platform suffix
+ * @param {string | undefined} platform Gem platform such as `x86_64-linux`
+ * @returns {string} purl string
+ */
+export declare function toGemPurl(name: string, version: string | undefined, platform: string | undefined): string;
+/**
+ * Parse a single line from the `CHECKSUMS` section of a Gemfile.lock. Bundler
+ * 2.5 onwards writes `name (version[-platform]) algo=digest[,algo=digest]`,
+ * where the `name (version[-platform])` token is identical to the one used in
+ * the `specs:` section. The digest is lowercase hex. An entry may carry no
+ * checksum at all when Bundler could not obtain one.
+ *
+ * @param {string} line Trimmed line from the CHECKSUMS section
+ * @returns {{lockName: string, hashes: Array<object>} | undefined} Lock name and CycloneDX hashes
+ */
+export declare function parseGemChecksumLine(line: string): {
+    lockName: string;
+    hashes: Array<object>;
+} | undefined;
+/**
+ * Default location of Bundler's compact index cache. This is the protocol
+ * Bundler itself uses to resolve, so any gem the developer has ever installed
+ * has a cached `info/<gem>` file here.
+ *
+ * @returns {string} Path to the compact index cache directory
+ */
+export declare function getCompactIndexCacheDir(): string;
+/**
+ * Parse the contents of a Bundler compact index `info/<gem>` file. Each line
+ * describes one release:
+ *
+ *   `VERSION[-PLATFORM] <deps>|checksum:<sha256>,ruby:<req>,rubygems:<req>,...`
+ *
+ * This is the cheapest source of gem metadata available: a single local file
+ * carries the sha256, the runtime dependencies and the required ruby and
+ * rubygems versions for every release of a gem.
+ *
+ * @param {string} infoData Contents of an info file
+ * @returns {object} Map of `version[-platform]` to release metadata
+ */
+export declare function parseCompactIndexInfo(infoData: string): object;
+/**
+ * Parse a `.bundle/config` file. Bundler writes a small YAML document of
+ * `BUNDLE_<SETTING>: "value"` pairs. Two settings matter for an SBOM:
+ * `BUNDLE_PATH`, which tells us where the gems actually live, and
+ * `BUNDLE_WITHOUT`, which tells us that some groups were never installed and
+ * that the SBOM is therefore incomplete by construction.
+ *
+ * @param {string} configFile Path to a .bundle/config file
+ * @returns {object} Map of setting name to value
+ */
+export declare function parseBundleConfig(configFile: string): object;
+/**
+ * Enrich gem components from the caches present on the machine, without making
+ * any network calls. Two sources are consulted:
+ *
+ * 1. Bundler's compact index cache, for the sha256 and the required ruby and
+ *    rubygems versions of the exact release, including native variants.
+ * 2. The installed gemspecs under `GEM_HOME/specifications`, for licenses,
+ *    description, project URIs and the native extension list.
+ *
+ * Because this only reads files it also works in dry-run mode, where the
+ * registry lookups performed by `getRubyGemsMetadata` are blocked.
+ *
+ * @param {Array} pkgList List of gem components to enrich in place
+ * @param {object} options Options
+ * @param {string} options.gemHome GEM_HOME to read installed gemspecs from
+ * @param {string} options.compactIndexCacheDir Bundler compact index cache directory
+ * @returns {Promise<Array>} The enriched package list
+ */
+export declare function enrichGemsFromLocalCache(pkgList: any[], options?: {
+    gemHome: string;
+    compactIndexCacheDir: string;
+}): Promise<any[]>;
+/**
+ * Method to query rubygems api for gems details
+ *
+ * A gem that ships several native builds appears in the BOM once per platform.
+ * Rather than making one request per variant, the versions listing endpoint is
+ * used to fetch every version and platform of such a gem in a single request.
+ *
+ * @param {Array} pkgList List of packages with metadata
+ */
+export declare function getRubyGemsMetadata(pkgList: any[]): Promise<any[]>;
+/**
+ * Utility method to convert a gem package name to a CamelCased module name. Low accuracy.
+ *
+ * @param name Package name
+ */
+export declare function toGemModuleNames(name: any): string[];
+/**
+ * Collect all namespaces for a given gem present at the given gemHome
+ *
+ * @param {String} rubyCommand Ruby command to use if bundle is not available
+ * @param {String} bundleCommand Bundle command to use
+ * @param {String} gemHome Value to use as GEM_HOME env variable
+ * @param {String} gemName Name of the gem
+ * @param {String} filePath File path to the directory containing the Gemfile or .bundle directory
+ *
+ * @returns {Array<string>} List of module names
+ */
+export declare function collectGemModuleNames(rubyCommand: string, bundleCommand: string, gemHome: string, gemName: string, filePath: string): Array<string>;
+/**
+ * Method to parse Gemspec file contents
+ *
+ * @param {string} gemspecData Gemspec data
+ * @param {string} gemspecFile File name for evidence.
+ */
+export declare function parseGemspecData(gemspecData: string, gemspecFile: string): Promise<any[]>;
+/**
+ * Method to parse Gemfile.lock
+ *
+ * @param {object} gemLockData Gemfile.lock data
+ * @param {string} lockFile Lock file
+ */
+export declare function parseGemfileLockData(gemLockData: object, lockFile: string): Promise<any[] | {
+    pkgList: any[];
+    dependenciesList: {
+        ref: string;
+        dependsOn: any[];
+    }[];
+    rootList: any[];
+}>;
+//# sourceMappingURL=rubyutils.d.ts.map

package/types/lib/ecosystems/rubyutils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rubyutils.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/rubyutils.js"],"names":[],"mappings":"AA0DA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAHzB,MAGyB,GAFvB,OAAO,CAOnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAHlC,MAAM,GAAG,SAGyB,GAFhC,MAAM,GAAG,SAAS,CAO9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAHrC,MAAM,GAAG,SAG4B,GAFnC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAAC,QAAQ,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CAAC,CAe3E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAHhC,MAGgC,GAF9B,MAAM,CAIlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,IAAI,EALnB,MAKmB,EAAE,OAAO,EAJ5B,MAAM,GAAG,SAImB,EAAE,QAAQ,EAHtC,MAAM,GAAG,SAG6B,GAFpC,MAAM,CAclB;AAsED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAAC,GAAG,SAAS,CAqBjE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,IAF1B,MAAM,CAWlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC,MAAM,CAiClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAHjC,MAGiC,GAF/B,MAAM,CAgClB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,OAAA,EAAE,OAAO,GAJ5D;IAAwB,OAAO,EAAvB,MAAM,CACd;IAAwB,oBAAoB,EAApC,MAAM,CACd;CAEiE,GAFvD,OAAO,OAAO,CA+I1B;AAwID;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,OAAA,kBAkIhD;AA6CD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,KAAA,YAsBpC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,QAAA,EACX,aAAa,QAAA,EACb,OAAO,QAAA,EACP,OAAO,QAAA,EACP,QAAQ,QAAA,GAPG,KAAK,CAAC,MAAM,CAAC,CA4IzB;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EAHvC,MAGuC,EAAE,WAAW,EAFpD,MAEoD,kBA8P9D;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,EAH3C,MAG2C,EAAE,QAAQ,EAFrD,MAEqD;;;;;;;GAgV/D"}

package/types/lib/ecosystems/rusi.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Checks if the provided language is a Rust language alias.
+ *
+ * @param {string} language The language to check.
+ * @returns {boolean} True if the language is Rust.
+ */
+export declare function isRusiRustLanguage(language: string): boolean;
+/**
+ * Reads and parses the JSON output generated by rusi.
+ *
+ * @param {string} jsonFile Path to the rusi output file.
+ * @returns {Object|undefined} Parsed JSON report or undefined.
+ */
+export declare function readRusiJsonFile(jsonFile: string): Object | undefined;
+/**
+ * Invokes the rusi binary to analyze a codebase.
+ *
+ * @param {string} src Directory to analyze.
+ * @param {string} outputFile Path to store the resulting JSON file.
+ * @param {Object} options Options containing rusi configurations.
+ * @returns {boolean} True if successful.
+ */
+export declare function runRusiAnalysis(src: string, outputFile: string, options?: Object): boolean;
+/**
+ * Orchestrates the execution of rusi and returns the parsed report.
+ *
+ * @param {string} src Directory to analyze.
+ * @param {Object} options Configuration options.
+ * @returns {Object|undefined} Parsed rusi report or undefined.
+ */
+export declare function analyzeRusiProject(src: string, options?: Object): Object | undefined;
+/**
+ * Extracts and maps CycloneDX evidence structures from a rusi report.
+ *
+ * @param {Object} rusiReport The parsed JSON generated by rusi.
+ * @param {Array} components The components present in the SBOM.
+ * @returns {Object} Maps representing evidence structures.
+ */
+export declare function collectRusiEvidence(rusiReport?: Object, components?: any[]): Object;
+//# sourceMappingURL=rusi.d.ts.map

package/types/lib/ecosystems/rusi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rusi.d.ts","sourceRoot":"","sources":["../../../lib/ecosystems/rusi.js"],"names":[],"mappings":"AAsnBA;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAHhC,MAGgC,GAF9B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAH9B,MAG8B,GAF5B,MAAM,GAAC,SAAS,CAW5B;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EALxB,MAKwB,EAAE,UAAU,EAJpC,MAIoC,EAAE,OAAO,GAH7C,MAGkD,GAFhD,OAAO,CAuDnB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAJ3B,MAI2B,EAAE,OAAO,GAHpC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CA2B5B;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,GAJnC,MAIwC,EAAE,UAAU,QAAK,GAFvD,MAAM,CA4DlB"}