@cdxgen/cdxgen 0.0.1 → 13.0.1

package/types/lib/helpers/vsixutils.d.ts

@@ -0,0 +1,130 @@
+/**
+ * The purl type for VS Code extensions as defined by the packageurl spec.
+ */
+export declare const VSCODE_EXTENSION_PURL_TYPE = "vscode-extension";
+/**
+ * IDE configuration entries describing where each IDE stores its extensions.
+ * Each entry contains the IDE name and an array of candidate extension
+ * directory paths for Windows, macOS, and Linux (including remote/server
+ * environments).
+ *
+ * The paths use platform-specific logic via `homedir()` and common
+ * environment variables.
+ */
+export declare function getIdeExtensionDirs(): {
+    name: string;
+    dirs: any[];
+}[];
+/**
+ * Discover all existing IDE extension directories on the current system.
+ *
+ * @returns {Array<{name: string, dir: string}>} Array of objects with IDE name
+ *   and the existing directory path.
+ */
+export declare function discoverIdeExtensionDirs(): Array<{
+    name: string;
+    dir: string;
+}>;
+/**
+ * Parse a `.vsixmanifest` XML string and extract extension metadata.
+ *
+ * @param {string} manifestData Raw XML content of a `.vsixmanifest` file
+ * @returns {Object|undefined} Object with { publisher, name, version, displayName, description, platform, tags } or undefined on failure
+ */
+export declare function parseVsixManifest(manifestData: string): Object | undefined;
+/**
+ * Parse npm-style dependency maps from a VS Code extension's package.json
+ * and create CycloneDX component objects with versionRange attributes.
+ *
+ * @param {Object} pkg Parsed package.json object
+ * @param {string} extensionPurl The purl of the parent extension (for dependency tree)
+ * @returns {{ components: Object[], dependencies: Object[] }} CycloneDX components and dependency tree
+ */
+export declare function parseExtensionDependencies(pkg: Object, extensionPurl: string): {
+    components: Object[];
+    dependencies: Object[];
+};
+/**
+ * Parse a VS Code extension's `package.json` and extract metadata
+ * including deep capability and permission information.
+ *
+ * @param {string|Object} packageJsonData Either raw JSON string or parsed object
+ * @param {string} [srcPath] Optional path to the source directory for evidence
+ * @returns {Object|undefined} Object with metadata and capabilities or undefined
+ */
+export declare function parseVsixPackageJson(packageJsonData: string | Object, srcPath?: string): Object | undefined;
+/**
+ * Extract deep capability and permission information from a VS Code
+ * extension package.json.
+ *
+ * This captures security-relevant metadata such as:
+ * - activationEvents: when the extension activates (e.g., `*` means always)
+ * - extensionKind: where the extension runs (ui, workspace, or both)
+ * - permissions: workspace trust, virtual workspace support
+ * - contributes: commands, debuggers, terminal profiles, task providers, fs providers
+ * - extensionDependencies/extensionPack: required extensions
+ * - scripts: whether postinstall or other lifecycle scripts exist
+ * - main/browser: entry points for analysis
+ *
+ * @param {Object} pkg Parsed package.json object
+ * @returns {Object} Capabilities object with structured metadata
+ */
+export declare function extractExtensionCapabilities(pkg: Object): Object;
+/**
+ * Convert parsed extension metadata into a CycloneDX component object.
+ *
+ * @param {Object} extInfo Object with { publisher, name, version, displayName, description, platform, srcPath, capabilities }
+ * @param {string} [ideName] Optional IDE name for properties
+ * @returns {Object|undefined} CycloneDX component object or undefined
+ */
+export declare function toComponent(extInfo: Object, ideName?: string): Object | undefined;
+/**
+ * Extract a `.vsix` file (ZIP archive) to a temporary directory for deep
+ * analysis. The caller is responsible for cleaning up the temp directory.
+ *
+ * @param {string} vsixFile Absolute path to the `.vsix` file
+ * @returns {Promise<string|undefined>} Path to the extracted temp directory, or undefined on failure
+ */
+export declare function extractVsixToTempDir(vsixFile: string): Promise<string | undefined>;
+/**
+ * Clean up a temporary directory created during vsix extraction.
+ *
+ * @param {string} tempDir Path to the temp directory to remove
+ */
+export declare function cleanupTempDir(tempDir: string): void;
+/**
+ * Parse a `.vsix` file (ZIP archive) and extract the extension metadata.
+ *
+ * @param {string} vsixFile Absolute path to the `.vsix` file
+ * @returns {Promise<Object|undefined>} CycloneDX component object or undefined
+ */
+export declare function parseVsixFile(vsixFile: string): Promise<Object | undefined>;
+/**
+ * Parse a single installed extension directory (already extracted).
+ * Looks for `package.json` (preferred) and `.vsixmanifest`.
+ *
+ * @param {string} extDir Absolute path to the extension directory (e.g. `~/.vscode/extensions/ms-python.python-2023.1.0`)
+ * @param {string} [ideName] Optional IDE name
+ * @returns {Object|undefined} CycloneDX component object or undefined
+ */
+export declare function parseInstalledExtensionDir(extDir: string, ideName?: string): Object | undefined;
+/**
+ * Attempt to extract extension metadata from a directory name following the
+ * pattern `publisher.name-version`.
+ *
+ * @param {string} extDir Absolute path to extension directory
+ * @param {string} [ideName] IDE name
+ * @returns {Object|undefined} CycloneDX component or undefined
+ */
+export declare function parseExtensionDirName(extDir: string, ideName?: string): Object | undefined;
+/**
+ * Collect all installed extensions from a set of IDE extension directories.
+ *
+ * @param {Array<{name: string, dir: string}>} ideDirs Array of { name, dir } from discoverIdeExtensionDirs
+ * @returns {Object[]} Array of CycloneDX component objects
+ */
+export declare function collectInstalledExtensions(ideDirs: Array<{
+    name: string;
+    dir: string;
+}>): Object[];
+//# sourceMappingURL=vsixutils.d.ts.map

package/types/lib/helpers/vsixutils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vsixutils.d.ts","sourceRoot":"","sources":["../../../lib/helpers/vsixutils.js"],"names":[],"mappings":"AAmBA;;GAEG;AACH,eAAO,MAAM,0BAA0B,qBAAqB,CAAC;AAO7D;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB;;;IA8LlC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAH3B,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,CAc9C;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAwH5B;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAJnC,MAImC,EAAE,aAAa,EAHlD,MAGkD,GAFhD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CAmE5D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,eAAe,EAJzC,MAAM,GAAC,MAIkC,EAAE,OAAO,AAH1D,CACA,EADQ,MAGkD,GAFhD,MAAM,GAAC,SAAS,CAsC5B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAHrC,MAGqC,GAFnC,MAAM,CA+GlB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAJxB,MAIwB,EAAE,OAAO,AAHzC,CACA,EADQ,MAGiC,GAF/B,MAAM,GAAC,SAAS,CAwK5B;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAmCrC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAF3B,MAE2B,QAwBrC;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAHjC,MAGiC,GAF/B,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAkErC;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAJtC,MAIsC,EAAE,OAAO,AAHvD,CACA,EADQ,MAG+C,GAF7C,MAAM,GAAC,SAAS,CAkC5B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAJjC,MAIiC,EAAE,OAAO,AAHlD,CACA,EADQ,MAG0C,GAFxC,MAAM,GAAC,SAAS,CAyC5B;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAHvC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAGM,GAFrC,MAAM,EAAE,CA8BpB"}

package/types/lib/inventory/agentFormulationParser.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Discover AI agent instruction and skill files that can hide MCP/runtime
+ * surfaces from package-only inventory.
+ */
+export declare const agentFormulationParser: {
+    id: string;
+    patterns: string[];
+    parse(files: any, _options?: {}): {
+        components: {
+            "bom-ref": string;
+            name: any;
+            properties: {
+                name: string;
+                value: any;
+            }[];
+            type: string;
+        }[];
+        services: any[];
+    };
+};
+//# sourceMappingURL=agentFormulationParser.d.ts.map

package/types/lib/inventory/agentFormulationParser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentFormulationParser.d.ts","sourceRoot":"","sources":["../../../lib/inventory/agentFormulationParser.js"],"names":[],"mappings":"AAuIA;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;CAsLlC,CAAC"}

package/types/lib/inventory/aiCollector.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Collect AI-related inventory from JavaScript and TypeScript sources.
+ *
+ * @param {string} discoveryPath directory or file being analyzed
+ * @param {Object} [options={}] collection options
+ * @returns {{ components: Object[], dependencies: Object[], services: Object[] }} AI inventory
+ */
+export declare function collectJsAiInventory(discoveryPath: string, options?: Object): {
+    components: Object[];
+    dependencies: Object[];
+    services: Object[];
+};
+/**
+ * Collect AI inventory from local Hugging Face repository metadata files.
+ *
+ * @param {string} discoveryPath directory or file being analyzed
+ * @param {Object} [options={}] collection options
+ * @returns {{ components: Object[], dependencies: Object[], services: Object[] }} AI inventory
+ */
+export declare function collectHuggingFaceRepoAiInventory(discoveryPath: string, options?: Object): {
+    components: Object[];
+    dependencies: Object[];
+    services: Object[];
+};
+/**
+ * Collect AI-related inventory from Python sources.
+ *
+ * @param {string} discoveryPath directory or file being analyzed
+ * @param {Object} [options={}] collection options
+ * @returns {{ components: Object[], dependencies: Object[], services: Object[] }} AI inventory
+ */
+export declare function collectPythonAiInventory(discoveryPath: string, options?: Object): {
+    components: Object[];
+    dependencies: Object[];
+    services: Object[];
+};
+/**
+ * Collect AI-related inventory from notebook sources.
+ *
+ * @param {string} discoveryPath directory or file being analyzed
+ * @param {Object} [options={}] collection options
+ * @returns {{ components: Object[], dependencies: Object[], services: Object[] }} AI inventory
+ */
+export declare function collectNotebookAiInventory(discoveryPath: string, options?: Object): {
+    components: Object[];
+    dependencies: Object[];
+    services: Object[];
+};
+/**
+ * Collect AI-related inventory from prompt and agent configuration files.
+ *
+ * @param {string} discoveryPath directory or file being analyzed
+ * @param {Object} [options={}] collection options
+ * @returns {{ components: Object[], dependencies: Object[], services: Object[] }} AI inventory
+ */
+export declare function collectPromptConfigAiInventory(discoveryPath: string, options?: Object): {
+    components: Object[];
+    dependencies: Object[];
+    services: Object[];
+};
+//# sourceMappingURL=aiCollector.d.ts.map

package/types/lib/inventory/aiCollector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aiCollector.d.ts","sourceRoot":"","sources":["../../../lib/inventory/aiCollector.js"],"names":[],"mappings":"AAotDA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAJvC,MAIuC,EAAE,OAAO,AAHxD,CACA,EADQ,MAGqD,GAFnD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CA6IhF;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAAC,aAAa,EAJpD,MAIoD,EAAE,OAAO,AAHrE,CACA,EADQ,MAGkE,GAFhE;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAiMhF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,aAAa,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,aAAa,EAJ7C,MAI6C,EAAE,OAAO,AAH9D,CACA,EADQ,MAG2D,GAFzD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,aAAa,EAJjD,MAIiD,EAAE,OAAO,AAHlE,CACA,EADQ,MAG+D,GAF7D;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAQhF"}

package/types/lib/inventory/aiInventory.d.ts

@@ -0,0 +1,103 @@
+/** Project types treated as AI-related inventory for collection and parsing. */
+export declare const AI_INVENTORY_PROJECT_TYPES: string[];
+/**
+ * Set of file-kind labels that identify AI instruction and agent-definition
+ * files (for example copilot instructions, crew agents/tasks, custom tools).
+ */
+export declare const AI_INSTRUCTION_FILE_KINDS: Set<string>;
+/** Constant label used to classify AI skill definition files. */
+export declare const AI_SKILL_FILE_KIND = "skill-file";
+/** Constant label used to classify MCP (Model Context Protocol) config files. */
+export declare const MCP_CONFIG_FILE_KIND = "mcp-config";
+/**
+ * Read a property value from an inventory subject.
+ *
+ * @param {Object} subject component or service
+ * @param {string} name property name
+ * @returns {string|undefined} matching property value
+ */
+export declare function inventoryPropertyValue(subject: Object, name: string): string | undefined;
+/**
+ * Determine whether CLI project type options include an AI inventory selector.
+ *
+ * @param {string|string[]|undefined} optionValue raw CLI option value
+ * @param {string} type AI inventory type
+ * @returns {boolean} true when the requested type is enabled
+ */
+export declare function optionIncludesAiInventoryProjectType(optionValue: string | string[] | undefined, type: string): boolean;
+/**
+ * Classify an inventory subject into AI inventory types.
+ *
+ * @param {Object} subject component or service
+ * @returns {string[]} matching inventory types
+ */
+export declare function inventoryTypesForSubject(subject: Object): string[];
+/**
+ * Check whether a subject belongs to a specific AI inventory type.
+ *
+ * @param {Object} subject component or service
+ * @param {string} type AI inventory type
+ * @returns {boolean} true when the subject matches
+ */
+export declare function matchesAiInventoryType(subject: Object, type: string): boolean;
+/**
+ * Check whether a subject should be excluded by an AI inventory type filter.
+ *
+ * @param {Object} subject component or service
+ * @param {string} type AI inventory type
+ * @returns {boolean} true when the subject matches the exclusion
+ */
+export declare function matchesAiInventoryExcludeType(subject: Object, type: string): boolean;
+/**
+ * Filter components or services by requested AI inventory types.
+ *
+ * @param {Object[]} subjects inventory subjects
+ * @param {string[]} types allowed AI inventory types
+ * @returns {Object[]} filtered subjects
+ */
+export declare function filterInventorySubjectsByTypes(subjects: Object[], types: string[]): Object[];
+/**
+ * Filter dependency edges to include only retained AI inventory subjects.
+ *
+ * @param {Object[]} dependencies dependency edges
+ * @param {Object[]} components retained components
+ * @param {Object[]} services retained services
+ * @returns {Object[]} filtered dependency edges
+ */
+export declare function filterInventoryDependencies(dependencies: Object[], components: Object[], services: Object[]): Object[];
+/**
+ * Collect AI inventory subjects and dependency edges for the requested types.
+ *
+ * @param {string} discoveryPath directory or file being analyzed
+ * @param {Object} options collection options
+ * @param {string[]} types requested inventory types
+ * @returns {{ components: Object[], dependencies: Object[], services: Object[] }} AI inventory
+ */
+export declare function collectAiInventory(discoveryPath: string, options: Object, types: string[]): {
+    components: Object[];
+    dependencies: Object[];
+    services: Object[];
+};
+/**
+ * Summarize collected AI inventory counts for reporting.
+ *
+ * @param {{ components?: Object[], services?: Object[] }} inventory collected AI inventory
+ * @returns {{
+ *   aiComponentCount: number,
+ *   aiServiceCount: number,
+ *   instructionCount: number,
+ *   mcpConfigCount: number,
+ *   skillComponentCount: number,
+ * }} summary counts
+ */
+export declare function summarizeAiInventory(inventory: {
+    components?: Object[];
+    services?: Object[];
+}): {
+    aiComponentCount: number;
+    aiServiceCount: number;
+    instructionCount: number;
+    mcpConfigCount: number;
+    skillComponentCount: number;
+};
+//# sourceMappingURL=aiInventory.d.ts.map

package/types/lib/inventory/aiInventory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aiInventory.d.ts","sourceRoot":"","sources":["../../../lib/inventory/aiInventory.js"],"names":[],"mappings":"AAcA,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,UAA4B,CAAC;AACpE;;;GAGG;AACH,eAAO,MAAM,yBAAyB,aAapC,CAAC;AACH,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,eAAe,CAAC;AAC/C,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,eAAe,CAAC;AA2DjD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAJnC,MAImC,EAAE,IAAI,EAHzC,MAGyC,GAFvC,MAAM,GAAC,SAAS,CAI5B;AAYD;;;;;;GAMG;AACH,wBAAgB,oCAAoC,CAAC,WAAW,EAJrD,MAAM,GAAC,MAAM,EAAE,GAAC,SAIqC,EAAE,IAAI,EAH3D,MAG2D,GAFzD,OAAO,CAkBnB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAHrC,MAGqC,GAFnC,MAAM,EAAE,CAiCpB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAJnC,MAImC,EAAE,IAAI,EAHzC,MAGyC,GAFvC,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAJ1C,MAI0C,EAAE,IAAI,EAHhD,MAGgD,GAF9C,OAAO,CAiBnB;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAJ5C,MAAM,EAIsC,EAAE,KAAK,EAHnD,MAAM,EAG6C,GAFjD,MAAM,EAAE,CAYpB;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,YAAY,EANH,MAAM,EAMH,EACZ,UAAU,EAND,MAAM,EAML,EACV,QAAQ,EANC,MAAM,EAMP,GALG,MAAM,EAAE,CAgCpB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EALrC,MAKqC,EAAE,OAAO,EAJ9C,MAI8C,EAAE,KAAK,EAHrD,MAAM,EAG+C,GAFnD;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAyFhF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EATnC;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAST,GARjC;IACR,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CA+BH"}

package/types/lib/inventory/aiModelVariants.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Normalize a list of detected AI model variant labels into a unique string array.
+ *
+ * @param {unknown[]} [variants=[]] detected variant candidates
+ * @returns {string[]} normalized variant labels
+ */
+export declare function normalizeDetectedVariants(variants?: unknown[]): string[];
+/**
+ * Detect normalized AI model variant labels from names, metadata, and notes.
+ *
+ * @param {{
+ *   description?: string,
+ *   metadata?: unknown[],
+ *   modelName?: string,
+ *   notes?: unknown[],
+ *   quantization?: string,
+ *   relation?: string,
+ *   tags?: unknown[],
+ * }} [signals] variant detection signals
+ * @returns {string[]} normalized variant labels
+ */
+export declare function detectAiModelVariants(signals?: {
+    description?: string;
+    metadata?: unknown[];
+    modelName?: string;
+    notes?: unknown[];
+    quantization?: string;
+    relation?: string;
+    tags?: unknown[];
+}): string[];
+//# sourceMappingURL=aiModelVariants.d.ts.map

package/types/lib/inventory/aiModelVariants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aiModelVariants.d.ts","sourceRoot":"","sources":["../../../lib/inventory/aiModelVariants.js"],"names":[],"mappings":"AAkEA;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,AAH/C,CACA,EADQ,OAAO,EAGqC,GAF1C,MAAM,EAAE,CAQpB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,AAX1C,CASA,EATQ;IACN,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;CAI4B,GAFrC,MAAM,EAAE,CA4BpB"}

package/types/lib/inventory/aiOversightCollector.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Core collector for AI oversight. Orchestrates the collection of local git
+ * signals, optionally enriches with forge (GitHub/GitLab) pull/merge request
+ * review data, computes a transparent weighted rigor score, and emits
+ * `cdx:ai:oversight:*` CycloneDX properties.
+ *
+ * When git-ai notes carry AI attribution data, the result also includes
+ * `cdx:ai:codegen:models`, `cdx:ai:codegen:agents`, and related properties:
+ * model names, agent tool names, note/session counts, and total AI-attributed
+ * entry counts.
+ *
+ * Honesty first: local git cannot observe pull-request reviews/approvals, so
+ * review-dependent metrics (reviewCoverage, reviewLatencyVsSize, selfMergeRate,
+ * verificationDebtRatio) are reported as `unavailable` unless a forge enricher
+ * supplies authoritative data. This prevents a git-only scan from falsely
+ * reporting "zero oversight".
+ *
+ * @param {string} dir Root directory of the repository
+ * @param {Object} [options] Oversight evaluation options
+ * @param {number} [options.gitMaxCount] Max commits to scan (defaults to 20)
+ * @param {string} [options.gitAiNotesRef] Git notes ref (defaults to refs/notes/ai)
+ * @returns {Promise<Object>} Oversight metrics, score, band, and properties
+ */
+export declare function collectAiOversight(dir: string, options?: {
+    gitMaxCount?: number;
+    gitAiNotesRef?: string;
+}): Promise<Object>;
+//# sourceMappingURL=aiOversightCollector.d.ts.map

package/types/lib/inventory/aiOversightCollector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aiOversightCollector.d.ts","sourceRoot":"","sources":["../../../lib/inventory/aiOversightCollector.js"],"names":[],"mappings":"AAuOA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EANjC,MAMiC,EAAE,OAAO,AALlD,CAGA,EAFA;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,aAAa,AAAtC,CACA,EADQ,MAAM,CACd;CAEuD,GAF7C,OAAO,CAAC,MAAM,CAAC,CAwZ3B"}

package/types/lib/inventory/aiProvenanceCollector.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Collects and evaluates signals indicating the presence/use of AI coding agents, assistants, or LLMs.
+ *
+ * @param {string} dir Root directory of the project
+ * @param {Object} [options] Evaluation options
+ * @param {number} [options.gitMaxCount] Maximum number of git commits to inspect
+ *
+ * @returns {Object} The evaluation result containing overall status, tool breakdowns, and properties
+ */
+export declare function collectAiProvenance(dir: string, options?: {
+    gitMaxCount?: number;
+}): Object;
+//# sourceMappingURL=aiProvenanceCollector.d.ts.map

package/types/lib/inventory/aiProvenanceCollector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aiProvenanceCollector.d.ts","sourceRoot":"","sources":["../../../lib/inventory/aiProvenanceCollector.js"],"names":[],"mappings":"AA+SA;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAN5B,MAM4B,EAAE,OAAO,AAL7C,CAGA,EAFA;IAAyB,WAAW,AAApC,CAEA,EAFQ,MAAM,CAEd;CAEkD,GAFxC,MAAM,CA+flB"}

package/types/lib/inventory/analyzer.d.ts

@@ -0,0 +1,157 @@
+/**
+ * Parse a single file and return its imports/exports as isolated objects,
+ * without mutating shared state. Intended for parallel execution.
+ *
+ * @param {string} src Project root
+ * @param {string} file Absolute file path
+ * @returns {{imports: Object, exports: Object}}
+ */
+export declare const parseFileASTTreeCollected: (src: string, file: string) => {
+    imports: Object;
+    exports: Object;
+};
+/**
+ * Capability categories analyzed in Chromium browser-extension sources, such
+ * as file access, device access, network, bluetooth, and fingerprinting.
+ */
+export declare const CHROMIUM_EXTENSION_CAPABILITY_CATEGORIES: string[];
+/**
+ * Capability categories analyzed in plain JavaScript/TypeScript sources, such
+ * as child-process execution, code generation, dynamic fetch, and dynamic import.
+ */
+export declare const JS_CAPABILITY_CATEGORIES: string[];
+/**
+ * Babel-parse a JavaScript source and flag suspicious execution, network, and
+ * obfuscation indicators such as child-process calls, fetch usage, and long
+ * base64 strings.
+ *
+ * @param {string} source JavaScript source code to analyze.
+ * @returns {{executionIndicators: string[], networkIndicators: string[], obfuscationIndicators: string[], indicators: string[]}} Suspicious indicator findings (empty arrays when the source cannot be parsed).
+ */
+export declare function analyzeSuspiciousJsSource(source: string): {
+    executionIndicators: string[];
+    networkIndicators: string[];
+    obfuscationIndicators: string[];
+    indicators: string[];
+};
+/**
+ * Find all imports and exports
+ */
+export declare const findJSImportsExports: (src: any, deep: any) => Promise<{
+    allImports: {};
+    allExports: {};
+}>;
+/**
+ * Detect suspicious obfuscation, execution, and network indicators in a single
+ * JavaScript/TypeScript source file using Babel AST analysis.
+ *
+ * @param {string} filePath Source file path
+ * @returns {{executionIndicators: string[], indicators: string[], networkIndicators: string[], obfuscationIndicators: string[]}}
+ */
+export declare const analyzeSuspiciousJsFile: (filePath: string) => {
+    executionIndicators: string[];
+    indicators: string[];
+    networkIndicators: string[];
+    obfuscationIndicators: string[];
+};
+/**
+ * AST-scan JavaScript source for runtime capability usage including child
+ * process execution, eval/code generation, dynamic fetch, and dynamic import.
+ *
+ * @param {string} source JavaScript source code to analyze.
+ * @returns {{capabilities: string[], hasDynamicFetch: boolean, hasDynamicImport: boolean, hasEval: boolean, indicatorMap: Object<string, string[]>}} Capability analysis result (empty when the source cannot be parsed).
+ */
+export declare function analyzeJsCapabilitiesSource(source: string): {
+    capabilities: string[];
+    hasDynamicFetch: boolean;
+    hasDynamicImport: boolean;
+    hasEval: boolean;
+    indicatorMap: Record<string, string[]>;
+};
+/**
+ * Read a JavaScript/TypeScript file from disk and return its capability
+ * analysis, converting it to parseable code first.
+ *
+ * @param {string} filePath Path to the JS/TS file to analyze.
+ * @returns {{capabilities: string[], hasDynamicFetch: boolean, hasDynamicImport: boolean, hasEval: boolean, indicatorMap: Object<string, string[]>}|undefined} Capability analysis result, or undefined when the file cannot be read.
+ */
+export declare const analyzeJsCapabilitiesFile: (filePath: string) => {
+    capabilities: string[];
+    hasDynamicFetch: boolean;
+    hasDynamicImport: boolean;
+    hasEval: boolean;
+    indicatorMap: Record<string, string[]>;
+} | undefined;
+/**
+ * AST-scan JavaScript source for cryptographic algorithm and library usage,
+ * detecting calls to Node.js `crypto`, WebCrypto, JWT/JOSE libraries, and
+ * literal algorithm references.
+ *
+ * @param {string} source JavaScript source code to analyze.
+ * @returns {{algorithms: Object[], libraries: string[]}} Detected crypto algorithms and library names (empty arrays when the source cannot be parsed).
+ */
+export declare function analyzeJsCryptoSource(source: string): {
+    algorithms: Object[];
+    libraries: string[];
+};
+/**
+ * Read a JavaScript/TypeScript file from disk and return detected
+ * cryptographic algorithms and libraries.
+ *
+ * @param {string} filePath Path to the JS/TS file to analyze.
+ * @returns {{algorithms: Object[], libraries: string[]}|undefined} Crypto analysis result, or undefined when the file cannot be read.
+ */
+export declare const analyzeJsCryptoFile: (filePath: string) => {
+    algorithms: Object[];
+    libraries: string[];
+} | undefined;
+/**
+ * Walk a source tree aggregating cryptographic inventory (algorithms and
+ * libraries) across all JavaScript/TypeScript files found.
+ *
+ * @param {string} src Path to the source directory to scan.
+ * @param {boolean} [deep=false] When true, includes node_modules and nested directories.
+ * @returns {Promise<{algorithms: Object[], libraries: string[]}>} Aggregated crypto inventory (empty arrays when no files are found).
+ */
+export declare const detectJsCryptoInventory: (src: string, deep?: boolean) => Promise<{
+    algorithms: Object[];
+    libraries: string[];
+}>;
+/**
+ * Detect browser-extension capability signals from source code using Babel AST analysis.
+ *
+ * @param {string} src Path to the extension source directory
+ * @param {boolean} deep When true, includes node_modules and nested directories
+ * @returns {{capabilities: string[], indicators: Object<string, string[]>}}
+ * `indicators` is keyed by capability category name and contains arrays of
+ * detected signal strings (for example property chains and call names).
+ */
+export declare const detectExtensionCapabilities: (src: string, deep?: boolean) => {
+    capabilities: string[];
+    indicators: Record<string, string[]>;
+};
+/**
+ * Detect MCP server inventory from Python source using import and decorator heuristics.
+ *
+ * @param {string} src Absolute or relative path to the project source directory
+ * @param {boolean} deep When true, also scans nested paths more aggressively
+ * @returns {{components: Object[], dependencies: Object[], services: Object[]}}
+ */
+export declare const detectPythonMcpInventory: (src: string, deep?: boolean) => {
+    components: Object[];
+    dependencies: Object[];
+    services: Object[];
+};
+/**
+ * Detect MCP server inventory from JavaScript/TypeScript source using AST analysis.
+ *
+ * @param {string} src Absolute or relative path to the project source directory
+ * @param {boolean} deep When true, also scans nested paths more aggressively
+ * @returns {{components: Object[], dependencies: Object[], services: Object[]}}
+ */
+export declare const detectMcpInventory: (src: string, deep?: boolean) => {
+    components: Object[];
+    dependencies: Object[];
+    services: Object[];
+};
+//# sourceMappingURL=analyzer.d.ts.map

package/types/lib/inventory/analyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../../../lib/inventory/analyzer.js"],"names":[],"mappings":"AAspDA;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAJ3B,MAAM,QACN,MAAM,KACJ;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAO7C,CAAC;AA0oBF;;;GAGG;AACH,eAAO,MAAM,wCAAwC,UAQpD,CAAC;AA4JF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,UAQpC,CAAC;AA+JF;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAHrC,MAGqC,GAFnC;IAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAC,CA2J/H;AAsLD;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;EA2FhC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,aAHzB,MAAM,KACJ;IAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,qBAAqB,EAAE,MAAM,EAAE,CAAA;CAe9H,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAHvC,MAGuC,GAFrC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,2BAA0B;CAAC,CAqOnJ;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,aAH3B,MAAM,KACJ;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,2BAA0B;CAAC,GAAC,SAgBpJ,CAAC;AAyQF;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAHjC,MAGiC,GAF/B;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,CA2avD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,aAHrB,MAAM,KACJ;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,GAAC,SAUxD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,QAJzB,MAAM,SACN,OAAO,KACL,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,CAiC/D,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,QAN7B,MAAM,SACN,OAAO,KACL;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,2BAA0B;CAuGzE,CAAC;AAs8BF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,QAJ1B,MAAM,SACN,OAAO,KACL;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAiJ7E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,QAJpB,MAAM,SACN,OAAO,KACL;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAqrB7E,CAAC"}