@cdxgen/cdxgen 0.0.1 → 13.0.1

package/types/lib/inventory/mcpConfigParser.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Parser for MCP (Model Context Protocol) client configuration files.
+ *
+ * Matches common MCP config file names (`.mcp.json`, `mcp.json`,
+ * `claude_desktop_config.json`, `opencode.json[c]`, and editor-specific
+ * variants) and converts each configured server into a CycloneDX service plus
+ * a file component carrying credential-exposure, hidden-unicode, and transport
+ * properties.
+ *
+ * @type {{id: string, patterns: string[], parse(files: string[], options?: Object): {components: Object[], services: Object[]}}}
+ */
+export declare const mcpConfigParser: {
+    id: string;
+    patterns: string[];
+    parse(files: string[], options?: Object): {
+        components: Object[];
+        services: Object[];
+    };
+};
+//# sourceMappingURL=mcpConfigParser.d.ts.map

package/types/lib/inventory/mcpConfigParser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpConfigParser.d.ts","sourceRoot":"","sources":["../../../lib/inventory/mcpConfigParser.js"],"names":[],"mappings":"AAknBA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,EAFlB;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAC,CAAA;CA+C9H,CAAC"}

package/types/lib/inventory/mcpDiscovery.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Normalize a string into a safe MCP reference token.
+ *
+ * NFKC-normalizes, lowercases, collapses separator runs, strips leading and
+ * trailing punctuation, and truncates to 128 characters, falling back to
+ * `unknown` for empty or dot-only results.
+ *
+ * @param {string} value Raw token value
+ * @returns {string} Sanitized reference token
+ */
+export declare function sanitizeMcpRefToken(value: string): string;
+/**
+ * Determine whether a hostname is local: `localhost`, loopback, link-local, or a private address range.
+ *
+ * @param {string} hostname Hostname or IP address
+ * @returns {boolean} `true` when the host resolves to a local or private address
+ */
+export declare function isLocalHost(hostname: string): boolean;
+/**
+ * Return the AI provider names whose detection patterns match the given text.
+ *
+ * @param {string} text Text to scan
+ * @returns {string[]} Matching provider names (e.g. `anthropic`, `openai`)
+ */
+export declare function providerNamesForText(text: string): string[];
+/**
+ * Return the credential-indicator names whose patterns match the given text.
+ *
+ * @param {string} text Text to scan
+ * @returns {string[]} Matching indicator names (e.g. `github-token`, `bearer-token`)
+ */
+export declare function credentialIndicatorsForText(text: string): string[];
+//# sourceMappingURL=mcpDiscovery.d.ts.map

package/types/lib/inventory/mcpDiscovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpDiscovery.d.ts","sourceRoot":"","sources":["../../../lib/inventory/mcpDiscovery.js"],"names":[],"mappings":"AAkBA;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAH9B,MAG8B,GAF5B,MAAM,CAiBlB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAHzB,MAGyB,GAFvB,OAAO,CA8BnB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B,MAAM,EAAE,CAUpB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAHrC,MAGqC,GAFnC,MAAM,EAAE,CAUpB"}

package/types/lib/inventory/mcpPinning.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Apply experimental MCP pinning/composition properties. Mutates `bomJson` in
+ * place and returns citation hints for the registry-attributed integrity. The
+ * caller is responsible for emitting citations only at spec version 1.7+.
+ *
+ * @param {Object} bomJson CycloneDX BOM
+ * @param {Object} [options] CLI options
+ * @returns {Object[]} Citation hints produced by the enrichment
+ */
+export declare function applyMcpPinningState(bomJson: Object, options?: Object): Object[];
+//# sourceMappingURL=mcpPinning.d.ts.map

package/types/lib/inventory/mcpPinning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpPinning.d.ts","sourceRoot":"","sources":["../../../lib/inventory/mcpPinning.js"],"names":[],"mappings":"AAoIA;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAJjC,MAIiC,EAAE,OAAO,AAHlD,CACA,EADQ,MAG+C,GAF7C,MAAM,EAAE,CAqEpB"}

package/types/lib/inventory/osPackageResolver.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Reset all OS package resolver caches. Exported for unit tests only.
+ */
+export declare function _resetOsInfoCache(): void;
+/**
+ * Resolves a file path to its owning OS package manager package, including a
+ * correctly computed purl with distro qualifiers derived from /etc/os-release.
+ *
+ * @param {string} filePath - Absolute path to the library file
+ * @returns {{ name: string, version: string, arch: string, type: string, purl: string } | undefined}
+ */
+export declare function resolvePackageForFile(filePath: string): {
+    name: string;
+    version: string;
+    arch: string;
+    type: string;
+    purl: string;
+} | undefined;
+/**
+ * Find the OS package component that provides a given file, by searching the
+ * `internal:PkgProvides` property of each package in the OS package list.
+ *
+ * @param {string} afile Filename or path to look up (matched case-insensitively)
+ * @param {Object[]} osPkgsList Array of OS package component objects to search
+ * @returns {Object|undefined} The matching OS package component, or undefined if not found
+ */
+export declare function getOSPackageForFile(afile: string, osPkgsList: Object[]): Object | undefined;
+/**
+ * Collect all executable files from the given list of binary paths
+ *
+ * @param basePath Base directory
+ * @param binPaths {Array[String]} Paths containing potential binaries
+ * @param excludePaths {Array[String]} Container-relative paths that should be excluded from the result set
+ * @return {Array[String]} List of executables
+ */
+export declare function collectExecutables(basePath: any, binPaths: any, excludePaths?: any): any;
+/**
+ * Collect all shared library files from the given list of paths
+ *
+ * @param basePath Base directory
+ * @param libPaths {Array[String]} Paths containing potential libraries
+ * @param ldConf {String} Config file used by ldconfig to locate additional paths
+ * @param ldConfDirPattern {String} Config directory that can contain more .conf files for ldconfig
+ * @param excludePaths {Array[String]} Container-relative paths that should be excluded from the result set
+ *
+ * @return {Array[String]} List of executables
+ */
+export declare function collectSharedLibs(basePath: any, libPaths: any, ldConf: string, ldConfDirPattern: string, excludePaths?: any): any;
+//# sourceMappingURL=osPackageResolver.d.ts.map

package/types/lib/inventory/osPackageResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"osPackageResolver.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osPackageResolver.js"],"names":[],"mappings":"AAwBA;;GAEG;AACH,wBAAgB,iBAAiB,SAGhC;AA8ED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAHnC,MAGmC,GAFjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA8BnG;AAoGD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAJ9B,MAI8B,EAAE,UAAU,EAH1C,MAAM,EAGoC,GAFxC,MAAM,GAAC,SAAS,CA+B5B;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,KAAA,EAAE,QAAQ,KAAA,EAAE,YAAY,MAAK,OAqEvE;AAcD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,KAAA,EACR,QAAQ,KAAA,EACR,MAAM,QAAA,EACN,gBAAgB,QAAA,EAChB,YAAY,MAAK,OA8ElB"}

package/types/lib/inventory/osinfo.d.ts

@@ -0,0 +1,201 @@
+/**
+ * Ubuntu / Debian codename map and RHEL display-name aliases.
+ * Keep this list updated every year.
+ */
+export declare const OS_DISTRO_ALIAS: {
+    "ubuntu-4.10": string;
+    "ubuntu-5.04": string;
+    "ubuntu-5.10": string;
+    "ubuntu-6.06": string;
+    "ubuntu-6.10": string;
+    "ubuntu-7.04": string;
+    "ubuntu-7.10": string;
+    "ubuntu-8.04": string;
+    "ubuntu-8.10": string;
+    "ubuntu-9.04": string;
+    "ubuntu-9.10": string;
+    "ubuntu-10.04": string;
+    "ubuntu-10.10": string;
+    "ubuntu-11.04": string;
+    "ubuntu-11.10": string;
+    "ubuntu-12.04": string;
+    "ubuntu-12.10": string;
+    "ubuntu-13.04": string;
+    "ubuntu-13.10": string;
+    "ubuntu-14.04": string;
+    "ubuntu-14.10": string;
+    "ubuntu-15.04": string;
+    "ubuntu-15.10": string;
+    "ubuntu-16.04": string;
+    "ubuntu-16.10": string;
+    "ubuntu-17.04": string;
+    "ubuntu-17.10": string;
+    "ubuntu-18.04": string;
+    "ubuntu-18.10": string;
+    "ubuntu-19.04": string;
+    "ubuntu-19.10": string;
+    "ubuntu-20.04": string;
+    "ubuntu-20.10": string;
+    "ubuntu-21.04": string;
+    "ubuntu-21.10": string;
+    "ubuntu-22.04": string;
+    "ubuntu-22.10": string;
+    "ubuntu-23.04": string;
+    "ubuntu-23.10": string;
+    "ubuntu-24.04": string;
+    "ubuntu-24.10": string;
+    "ubuntu-25.04": string;
+    "ubuntu-25.10": string;
+    "debian-15": string;
+    "debian-14": string;
+    "debian-14.5": string;
+    "debian-13": string;
+    "debian-13.5": string;
+    "debian-12": string;
+    "debian-12.5": string;
+    "debian-12.6": string;
+    "debian-11": string;
+    "debian-11.5": string;
+    "debian-10": string;
+    "debian-10.5": string;
+    "debian-9": string;
+    "debian-9.5": string;
+    "debian-8": string;
+    "debian-8.5": string;
+    "debian-7": string;
+    "debian-7.5": string;
+    "debian-6": string;
+    "debian-5": string;
+    "debian-4": string;
+    "debian-3.1": string;
+    "debian-3": string;
+    "debian-2.2": string;
+    "debian-2.1": string;
+    "debian-2": string;
+    "debian-1.3": string;
+    "debian-1.2": string;
+    "debian-1.1": string;
+    "red hat enterprise linux": string;
+    "red hat enterprise linux 6": string;
+    "red hat enterprise linux 7": string;
+    "red hat enterprise linux 8": string;
+    "red hat enterprise linux 9": string;
+    "red hat enterprise linux 10": string;
+};
+/**
+ * Canonical purl namespace for distro vendors that are published under more
+ * than one spelling. Both the os-release path (`getDistroInfo`) and the trivy
+ * passthrough in `lib/managers/binary.js` route through this single map so the
+ * two paths cannot drift apart again.
+ *
+ * Azure Linux 2.0 is CBL-Mariner 2.0 — Microsoft renamed the product — and the
+ * OSV feed publishes `pkg:rpm/azure-linux/<name>` for every generation
+ * (ecosystems "Azure Linux:2" and "Azure Linux:3"), so the historical
+ * spellings azurelinux, cbl-mariner and mariner all canonicalise to
+ * "azure-linux". rhel/ol/amzn/opensuse-* are the cases previously inlined in
+ * getDistroInfo(); alma/rocky-linux were previously inlined in binary.js.
+ *
+ * Amazon Linux canonicalises to "amazon", the spelling the vulnerability feeds
+ * publish (AppThreat vuln-list `amazon`): the os-release ID is `amzn` and
+ * trivy emits `amazon`, and the previous `amazonlinux` mapping here matched
+ * neither, so live-host Amazon Linux purls matched nothing at all.
+ */
+export declare const OS_NAMESPACE_ALIAS: {
+    alma: string;
+    amazonlinux: string;
+    amzn: string;
+    azurelinux: string;
+    "cbl-mariner": string;
+    mariner: string;
+    ol: string;
+    "opensuse-leap": string;
+    "opensuse-tumbleweed": string;
+    rhel: string;
+    "rocky-linux": string;
+};
+/**
+ * Vendor prefixes that `distro` qualifier values are canonicalised for, so one
+ * release has exactly one qualifier value no matter which side produced it.
+ *
+ * trivy stamps the qualifier from its own distro table while cdxgen stamps it
+ * from os-release, and the two disagree: an Oracle Linux 9.8 image came out
+ * with `oracle-9.8` on 99 components and `ol-9.8` on 43, and a RHEL 9.8 image
+ * with namespace `redhat` but qualifier `rhel-9.8`. Canonicalising both sides
+ * through this map collapses each release onto the vendor its purl namespace
+ * already uses.
+ *
+ * SUSE is deliberately absent. `sles-15.6`, `opensuse-leap-15.6` and
+ * `opensuse-tumbleweed-<snapshot>` are the values consumers derive the release
+ * channel from (vulnerability-db maps them to per-release channels), and both
+ * sides already agree on them; folding Leap and Tumbleweed onto a bare
+ * `opensuse-` vendor would destroy exactly the distinction that matters.
+ *
+ * Keys are matched longest-first so `cbl-mariner-2.0` resolves against the
+ * full vendor segment rather than a shorter prefix.
+ */
+export declare const OS_DISTRO_QUALIFIER_ALIAS: {
+    alma: string;
+    amazonlinux: string;
+    amzn: string;
+    azurelinux: string;
+    "cbl-mariner": string;
+    mariner: string;
+    ol: string;
+    rhel: string;
+    "rocky-linux": string;
+};
+/**
+ * Whether a `distro` qualifier value is safe to place in a purl unencoded.
+ *
+ * @param {string} qualifier - distro qualifier value
+ * @returns {boolean} true when the value contains only purl-safe characters
+ */
+export declare function isCleanDistroQualifier(qualifier: string): boolean;
+/**
+ * Canonicalise the vendor prefix of a `distro` qualifier value
+ * (e.g. "cbl-mariner-2.0" or "mariner-2.0" -> "azure-linux-2.0") so a release
+ * has exactly one qualifier spelling regardless of which tool emitted it.
+ * Values without a known vendor prefix are returned unchanged.
+ *
+ * @param {string} qualifier - distro qualifier value such as "azurelinux-3.0"
+ * @returns {string} canonical qualifier value
+ */
+export declare function canonicalDistroQualifier(qualifier: string): string;
+/**
+ * Parse an os-release file from an arbitrary root path and return a plain
+ * key→value object.  Results are cached per root path so the file is read
+ * at most once per process per distinct root.
+ *
+ * @param {string} [root="/"] - Root of the filesystem to search (e.g. a
+ *   container rootfs extracted to a temp directory, or "/" for the live host).
+ * @returns {Object} Raw key/value pairs from the os-release file.
+ */
+export declare function readOsRelease(root?: string): Object;
+/**
+ * Reset the per-root os-release cache. Exported for unit tests only.
+ */
+export declare function _resetOsReleaseCache(): void;
+/**
+ * Derive structured distro information from an os-release file.
+ *
+ * Returns an object with:
+ *   - purlType    {string}  "deb" | "apk" | "rpm"
+ *   - namespace   {string}  canonical purl namespace (e.g. "ubuntu", "alpine",
+ *                           "azure-linux" for both Azure Linux and CBL-Mariner)
+ *   - distroId    {string}  ID + "-" + VERSION_ID with a canonical vendor
+ *                           prefix (e.g. "ubuntu-22.04", "azure-linux-3.0")
+ *   - distroName  {string}  codename/alias          (e.g. "jammy")
+ *
+ * Mirrors the logic in lib/managers/binary.js getOSPackages() so that both
+ * callers share a single implementation.
+ *
+ * @param {string} [root="/"] - Filesystem root to look for os-release.
+ * @returns {{ purlType: string, namespace: string, distroId: string, distroName: string }}
+ */
+export declare function getDistroInfo(root?: string): {
+    purlType: string;
+    namespace: string;
+    distroId: string;
+    distroName: string;
+};
+//# sourceMappingURL=osinfo.d.ts.map

package/types/lib/inventory/osinfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"osinfo.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osinfo.js"],"names":[],"mappings":"AAGA;;;GAGG;AACH,eAAO,MAAM,eAAe;IAC1B,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,WAAW;IACX,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,UAAU;IACV,UAAU;IACV,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,0BAA0B;IAC1B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,6BAA6B;CAC9B,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB;IAC7B,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,EAAE;IACF,eAAe;IACf,qBAAqB;IACrB,IAAI;IACJ,aAAa;CACd,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,yBAAyB;IACpC,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,EAAE;IACF,IAAI;IACJ,aAAa;CACd,CAAC;AASF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAHrC,MAGqC,GAFnC,OAAO,CAInB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAGuC,GAFrC,MAAM,CAYlB;AAQD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAJ/B,CAEA,EAFQ,MAI6B,GAF3B,MAAM,CAqClB;AAGD;;GAEG;AACH,wBAAgB,oBAAoB,SAEnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAAC,IAAI,AAH/B,CACA,EADQ,MAG6B,GAF3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAiHzF"}

package/types/lib/inventory/osqueryTransform.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Derive a version value from an osquery result row.
+ *
+ * Falls back through alternate row fields (e.g. `hotfix_id`, `port`, `pid`)
+ * that carry version-like values for the given query category.
+ *
+ * @param {Object} res osquery result row
+ * @returns {string|undefined} First present version-like field value
+ */
+export declare function deriveOsQueryVersion(res: Object): string | undefined;
+/**
+ * Derive a name value from an osquery result row.
+ *
+ * @param {Object} res osquery result row
+ * @param {boolean} singleResult Whether the query returned exactly one row
+ * @param {string} queryName Query name used as a fallback name for single-result queries
+ * @returns {string|undefined} First present name-like field value
+ */
+export declare function deriveOsQueryName(res: Object, singleResult: boolean, queryName: string): string | undefined;
+/**
+ * Derive a publisher value from an osquery result row.
+ *
+ * @param {Object} res osquery result row
+ * @returns {string} Publisher-like value, or an empty string when absent or literal `"null"`
+ */
+export declare function deriveOsQueryPublisher(res: Object): string;
+/**
+ * Derive a description value from an osquery result row.
+ *
+ * @param {Object} res osquery result row
+ * @returns {string} First present description-like field value, or an empty string
+ */
+export declare function deriveOsQueryDescription(res: Object): string;
+/**
+ * Sanitize an identity string for use in component names and references.
+ *
+ * @param {string} value Raw identity value
+ * @returns {string} Value with spaces mapped to `+`, `:`/`%` mapped to `-`, and `@`/brace delimiters trimmed
+ */
+export declare function sanitizeOsQueryIdentity(value: string): string;
+/**
+ * Sanitize a value for safe use inside a `bom-ref`.
+ *
+ * @param {string} value Raw value
+ * @param {string} [fallback="unknown"] Value returned when the input is empty or `"null"`
+ * @returns {string} Whitespace-collapsed value with bom-ref delimiters replaced by `-`
+ */
+export declare function sanitizeOsQueryBomRefValue(value: string, fallback?: string): string;
+/**
+ * Build a deterministic fallback `bom-ref` for an osquery-derived component.
+ *
+ * @param {string} queryCategory Osquery category (e.g. `deb_packages`)
+ * @param {string} componentType CycloneDX component type
+ * @param {string|undefined} name Component name
+ * @param {string|undefined} version Component version
+ * @param {string|undefined} identityField Row field used to distinguish the component's identity
+ * @param {string|undefined} identityValue Value of the identity field
+ * @returns {string} BOM ref of the form `osquery:<category>:<type>:<name>@<version>[<field>=<value>]`
+ */
+export declare function createOsQueryFallbackBomRef(queryCategory: string, componentType: string, name: string | undefined, version: string | undefined, identityField: string | undefined, identityValue: string | undefined): string;
+/**
+ * Determine whether an osquery-derived component type may carry a purl.
+ *
+ * @param {string} componentType CycloneDX component type
+ * @returns {boolean} `false` for `cryptographic-asset`, `data`, `device`, and `information`
+ */
+export declare function shouldCreateOsQueryPurl(componentType: string): boolean;
+/**
+ * Construct a purl string for an osquery-derived component.
+ *
+ * Builds through `tryBuildPurl`, so an invalid combination yields `null`
+ * instead of throwing. Derives a swid `tag_id` qualifier when missing and a
+ * distro namespace from `/etc/os-release` for OS package types that require one.
+ *
+ * @param {string} purlType Purl type (e.g. `deb`, `rpm`, `generic`)
+ * @param {string|null} group Purl namespace or group
+ * @param {string} name Component name
+ * @param {string} version Component version
+ * @param {Object|null} qualifiers Purl qualifiers
+ * @param {string|null} subpath Purl subpath (leading slashes are stripped)
+ * @returns {string|null} Canonical purl string, or `null` when the parts do not form a valid purl
+ */
+export declare function createOsQueryPurl(purlType: string, group: string | null, name: string, version: string, qualifiers: Object | null, subpath: string | null): string | null;
+//# sourceMappingURL=osqueryTransform.d.ts.map

package/types/lib/inventory/osqueryTransform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"osqueryTransform.d.ts","sourceRoot":"","sources":["../../../lib/inventory/osqueryTransform.js"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAH7B,MAG6B,GAF3B,MAAM,GAAC,SAAS,CAa5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAL1B,MAK0B,EAAE,YAAY,EAJxC,OAIwC,EAAE,SAAS,EAHnD,MAGmD,GAFjD,MAAM,GAAC,SAAS,CAkB5B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,MAG+B,GAF7B,MAAM,CAWlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAHjC,MAGiC,GAF/B,MAAM,CAelB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAHlC,MAGkC,GAFhC,MAAM,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAJrC,MAIqC,EAAE,QAAQ,AAHvD,CACA,EADQ,MAG2D,GAFzD,MAAM,CAWlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,aAAa,EATJ,MASI,EACb,aAAa,EATJ,MASI,EACb,IAAI,EATK,MAAM,GAAC,SASZ,EACJ,OAAO,EATE,MAAM,GAAC,SAST,EACP,aAAa,EATJ,MAAM,GAAC,SASH,EACb,aAAa,EATJ,MAAM,GAAC,SASH,GARF,MAAM,CA8BlB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAH1C,MAG0C,GAFxC,OAAO,CAMnB;AAaD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EATC,MASD,EACR,KAAK,EATI,MAAM,GAAC,IASX,EACL,IAAI,EATK,MASL,EACJ,OAAO,EATE,MASF,EACP,UAAU,EATD,MAAM,GAAC,IASN,EACV,OAAO,EATE,MAAM,GAAC,IAST,GARI,MAAM,GAAC,IAAI,CAuCvB"}

package/types/lib/inventory/plugins.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Determine the normalized plugin target tuple for the current runtime.
+ *
+ * @returns {{arch: string, extn: string, platform: string, pluginsBinSuffix: string}}
+ */
+export declare function getPluginsBinTarget(): {
+    arch: string;
+    extn: string;
+    platform: string;
+    pluginsBinSuffix: string;
+};
+/**
+ * Resolve the cdxgen companion plugins directory for the current runtime.
+ *
+ * @returns {{
+ *   arch: string,
+ *   extn: string,
+ *   extraNMBinPath: string|undefined,
+ *   platform: string,
+ *   pluginManifestFile: string|undefined,
+ *   pluginVersion: string|undefined,
+ *   pluginsBinSuffix: string,
+ *   pluginsDir: string,
+ * }}
+ */
+export declare function resolveCdxgenPlugins(): {
+    arch: string;
+    extn: string;
+    extraNMBinPath: string | undefined;
+    platform: string;
+    pluginManifestFile: string | undefined;
+    pluginVersion: string | undefined;
+    pluginsBinSuffix: string;
+    pluginsDir: string;
+};
+/**
+ * Retrieve the default plugin runtime, recomputing it only when the
+ * environment that influences plugin discovery changes.
+ *
+ * @returns {ReturnType<typeof resolveCdxgenPlugins>} The resolved plugin runtime.
+ */
+export declare function getDefaultPluginRuntime(): ReturnType<typeof resolveCdxgenPlugins>;
+/**
+ * Add the detected node_modules binary directory to PATH when present.
+ *
+ * @param {ReturnType<typeof resolveCdxgenPlugins>} [pluginRuntime] Detected plugin runtime.
+ * @returns {ReturnType<typeof resolveCdxgenPlugins>} The resolved plugin runtime.
+ */
+export declare function setPluginsPathEnv(pluginRuntime?: ReturnType<typeof resolveCdxgenPlugins>): ReturnType<typeof resolveCdxgenPlugins>;
+/**
+ * Resolve a known plugin binary path, honoring explicit environment overrides.
+ *
+ * @param {string} toolName Tool identifier.
+ * @param {ReturnType<typeof resolveCdxgenPlugins>} [pluginRuntime] Detected plugin runtime.
+ * @returns {string|undefined} Resolved binary path or configured override.
+ */
+export declare function resolvePluginBinary(toolName: string, pluginRuntime?: ReturnType<typeof resolveCdxgenPlugins>): string | undefined;
+//# sourceMappingURL=plugins.d.ts.map

package/types/lib/inventory/plugins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.d.ts","sourceRoot":"","sources":["../../../lib/inventory/plugins.js"],"names":[],"mappings":"AA+CA;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAC,CAgCpF;AA8DD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,IAXvB;IACR,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,GAAC,SAAS,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,GAAC,SAAS,CAAC;IACrC,aAAa,EAAE,MAAM,GAAC,SAAS,CAAC;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB,CAqMH;AAYD;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAF1B,UAAU,CAAC,OAAO,oBAAoB,CAAC,CASnD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,AAH5C,CACA,EADQ,UAAU,CAAC,OAAO,oBAAoB,CAGU,GAF9C,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAWnD;AAwDD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAJjC,MAIiC,EAAE,aAAa,AAHxD,CACA,EADQ,UAAU,CAAC,OAAO,oBAAoB,CAGsB,GAF1D,MAAM,GAAC,SAAS,CAS5B"}

package/types/lib/inventory/protobom.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Determine whether a spec version is supported for protobuf serialization.
+ *
+ * @param {string|undefined} specVersion CycloneDX spec version string
+ * @returns {boolean} `true` when supported by `@cdxgen/cdx-proto`, or when no spec version is provided
+ */
+export declare const isProtoSupportedSpecVersion: (specVersion: string | undefined) => boolean;
+/**
+ * Assert that a spec version is supported by `@cdxgen/cdx-proto`.
+ *
+ * Throws an `Error` naming the unsupported version and the operation when the
+ * spec version cannot be serialized to protobuf; returns without effect
+ * otherwise.
+ *
+ * @param {string|undefined} specVersion CycloneDX spec version string
+ * @param {string} [operation="protobuf operations"] Operation label used in the error message
+ */
+export declare const assertProtoSupportedSpecVersion: (specVersion: string | undefined, operation?: string) => void;
+/**
+ * Determine whether a path looks like a CycloneDX protobuf file.
+ *
+ * @param {string} filePath File path
+ * @returns {boolean} true when the path looks like a protobuf BOM file
+ */
+export declare const isProtoBomFile: (filePath: string) => boolean;
+/**
+ * Method to convert the given bom json to proto binary
+ *
+ * @param {string | Object} bomJson BOM Json
+ * @param {string} binFile Binary file name
+ * @param {string | number} [specVersion] CycloneDX spec version fallback for BOMs without specVersion
+ */
+export declare const writeBinary: (bomJson: string | Object, binFile: string, specVersion?: string | number) => void;
+/**
+ * Method to read a serialized binary
+ *
+ * @param {string} binFile Binary file name
+ * @param {boolean} asJson Convert to JSON
+ * @param {string | number} [specVersion] Optional specification version. When omitted, cdxgen auto-detects the matching schema.
+ */
+export declare const readBinary: (binFile: string, asJson: boolean, specVersion?: string | number) => import("@cdxgen/cdx-proto").AnyBom | import("@cdxgen/cdx-proto").AnyBomJson | undefined;
+/**
+ * Method to compute size and count statistics for a BOM.
+ *
+ * @param {string | Object} bomJson BOM Json, BOM Json string, or proto message
+ * @param {string | number} [specVersion] CycloneDX spec version fallback for BOMs without specVersion
+ * @returns {Object} Component and dependency counts with JSON/binary byte sizes and compression ratio
+ */
+export declare const getBomStats: (bomJson: string | Object, specVersion?: string | number) => Object;
+/**
+ * Method to cross-convert a BOM between CycloneDX specification versions using
+ * the protobuf schemas.
+ *
+ * Downgrades are lossy: fields that the target version does not define are
+ * dropped and reported in `warnings` as field paths.
+ *
+ * This is the raw `@cdxgen/cdx-proto` conversion. It reshapes nothing that the
+ * two schemas model with different cardinality, so a BOM crossing the 1.5/1.6
+ * `evidence.identity` boundary must be normalized first. Prefer
+ * `applySpecVersionCompatibility` from the postgen stage for that.
+ *
+ * @param {string | Object} bomJson BOM Json, BOM Json string, or proto message
+ * @param {string | number} targetSpecVersion Target CycloneDX spec version
+ * @param {string | number} [specVersion] CycloneDX spec version fallback for BOMs without specVersion
+ * @returns {{bomJson: Object, warnings: string[]}} Converted BOM Json and the field paths dropped
+ */
+export declare const convertBomSpecVersion: (bomJson: string | Object, targetSpecVersion: string | number, specVersion?: string | number) => {
+    bomJson: Object;
+    warnings: string[];
+};
+//# sourceMappingURL=protobom.d.ts.map

package/types/lib/inventory/protobom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protobom.d.ts","sourceRoot":"","sources":["../../../lib/inventory/protobom.js"],"names":[],"mappings":"AAiEA;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,gBAH7B,MAAM,GAAC,SAAS,KACd,OAWZ,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,gBAHjC,MAAM,GAAC,SAAS,cAChB,MAAM,SAiBhB,CAAC;AA4BF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,aAHhB,MAAM,KACJ,OAOZ,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAJb,MAAM,GAAG,MAAM,WACf,MAAM,gBACN,MAAM,GAAG,MAAM,SAWzB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,YAJZ,MAAM,UACN,OAAO,gBACP,MAAM,GAAG,MAAM,4FAiBzB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAJb,MAAM,GAAG,MAAM,gBACf,MAAM,GAAG,MAAM,KACb,MAGsC,CAAC;AAEpD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,qBAAqB,YALvB,MAAM,GAAG,MAAM,qBACf,MAAM,GAAG,MAAM,gBACf,MAAM,GAAG,MAAM,KACb;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAehD,CAAC"}

package/types/lib/inventory/protobomLoader.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Determine whether a path looks like a CycloneDX protobuf BOM file.
+ *
+ * @param {string} filePath File path
+ * @returns {boolean} true when the path uses a protobuf BOM extension
+ */
+export declare function isProtoBomPath(filePath: string): boolean;
+/**
+ * Import protobuf BOM helpers and replace optional-dependency loader failures
+ * with actionable command-specific messages.
+ *
+ * @param {string} [commandName="cdxgen"] CLI command name
+ * @param {string} [featureDescription="protobuf support"] Feature being used
+ * @returns {Promise<object>} Loaded protobom module namespace
+ */
+export declare function importProtobomModule(commandName?: string, featureDescription?: string): Promise<object>;
+//# sourceMappingURL=protobomLoader.d.ts.map

package/types/lib/inventory/protobomLoader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protobomLoader.d.ts","sourceRoot":"","sources":["../../../lib/inventory/protobomLoader.js"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAH5B,MAG4B,GAF1B,OAAO,CAOnB;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,AALV,CACA,EADQ,MAKa,EACtB,kBAAkB,AALjB,CACA,EADQ,MAK8B,GAJ5B,OAAO,CAAC,MAAM,CAAC,CAqB3B"}