@cdxgen/cdxgen 0.0.1 → 13.0.1

package/types/lib/inventory/source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../lib/inventory/source.js"],"names":[],"mappings":"AAmCA,6FAA6F;AAC7F,eAAO,MAAM,4BAA4B,wIAC8F,CAAC;AAExI,6DAA6D;AAC7D,eAAO,MAAM,2BAA2B,UAWvC,CAAC;AAuBF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAH7B,MAAM,GAAC,SAGsB,GAF3B,OAAO,CAUnB;AAiBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAL5B,MAAM,EAKsB,EAAE,OAAO,GAH7C;IAAkC,GAAG,EAA7B,MAAM,GAAC,SAAS,CACxB;CAEkD,GAFxC,MAAM,CAuClB;AA+ED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAJtC,MAAM,GAAC,SAI+B,EAAE,OAAO,GAH/C,MAGoD,GAFlD,MAAM,GAAC,SAAS,CA6I5B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAFtB,MAAM,CASlB;AAkBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAH3B,MAG2B,GAFzB,OAAO,CAWnB;AAkBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAHvB,MAGuB,GAFrB,OAAO,CA+BnB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAHpB,MAGoB,GAFlB,OAAO,CAyBnB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,CAInB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAHxC,MAGwC,GAFtC,MAAM,GAAC,IAAI,CAgEvB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAJrB,MAIqB,EAAE,MAAM,GAH7B,MAAM,GAAC,MAAM,EAAE,GAAC,IAGoB,GAFlC,MAAM,CAyDlB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAHvC,MAAM,GAAC,SAGgC,GAFrC,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAJrC,MAIqC,EAAE,cAAc,EAHrD,MAAM,GAAC,SAG8C,GAFnD,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAJtC,MAIsC,EAAE,cAAc,EAHtD,MAAM,GAAC,SAG+C,GAFpD,MAAM,GAAC,SAAS,CAiF5B;AAoHD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAGkC,GAFhC;IAAC,MAAM,EAAC,MAAM,CAAC;IAAA,KAAK,EAAC,MAAM,CAAC;IAAA,OAAO,EAAC,MAAM,CAAA;CAAC,GAAC,IAAI,CA8D5D;AA6GD;;GAEG;AACH,wBAAgB,yBAAyB,SAExC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,WAAW,EAJ5C,KAAK,CAAC,MAAM,CAIgC,GAF1C,OAAO,CAAC,IAAI,CAAC,CA6BzB;AAyDD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAJ3C,MAI2C,EAAE,OAAO,AAH5D,CACA,EADQ,MAGyD,GAFvD,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAAC,CA4MlI;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAF5B,MAE4B,QAkCtC"}

package/types/lib/inventory/spdx.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Parsed list of SPDX license identifiers loaded from `data/spdx-licenses.json`.
+ *
+ * @type {string[]}
+ */
+export declare const spdxLicenses: string[];
+/**
+ * Method to determine if a license is a valid SPDX license expression
+ *
+ * @param {string} license License string
+ * @returns {boolean} true if the license is a valid SPDX license expression
+ * @see https://spdx.dev/learn/handling-license-info/
+ **/
+export declare function isSpdxLicenseExpression(license: string): boolean;
+/**
+ * Convert the array of licenses to a CycloneDX 1.5 compliant license array.
+ * This should return an array containing:
+ * - one or more SPDX license if no expression is present
+ * - the license of the expression if one expression is present
+ * - a unified conditional 'OR' license expression if more than one expression is present
+ *
+ * @param {Array} licenses Array of licenses
+ * @returns {Array} CycloneDX 1.5 compliant license array
+ */
+export declare function adjustLicenseInformation(licenses: any[]): any[];
+/**
+ * Performs a lookup + validation of the license specified in the
+ * package. If the license is a valid SPDX license ID, set the 'id'
+ * and url of the license object, otherwise, set the 'name' of the license
+ * object.
+ */
+export declare function getLicenses(pkg: any): any[] | undefined;
+/**
+ * Method to retrieve known license by known-licenses.json
+ *
+ * @param {String} licenseUrl Repository url
+ * @param {String} pkg Bom ref
+ * @return {Object} Objetct with SPDX license id or license name
+ */
+export declare function getKnownLicense(licenseUrl: string, pkg: string): Object;
+/**
+ * Tries to find a file containing the license text based on commonly
+ * used naming and content types. If a candidate file is found, add
+ * the text to the license text object and stop.
+ */
+export declare function addLicenseText(pkg: any, l: any, licenseContent: any): void;
+/**
+ * Read the file from the given path to the license text object and includes
+ * content-type attribute, if not default. Returns the license text object.
+ */
+export declare function readLicenseText(licenseFilepath: any, licenseContentType: any): {
+    content: any;
+} | null;
+/**
+ * Method to find the spdx license id from name
+ *
+ * @param {string} name License full name
+ */
+export declare function findLicenseId(name: string): any;
+/**
+ * Method to guess the spdx license id from license contents
+ *
+ * @param {string} content License file contents
+ */
+export declare function guessLicenseId(content: string): any;
+//# sourceMappingURL=spdx.d.ts.map

package/types/lib/inventory/spdx.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spdx.d.ts","sourceRoot":"","sources":["../../../lib/inventory/spdx.js"],"names":[],"mappings":"AAeA;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAFf,MAAM,EAIf,CAAC;AAMF;;;;;;IAMI;AACJ,wBAAgB,uBAAuB,CAAC,OAAO,EAJpC,MAIoC,GAHlC,OAAO,CA0BnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,OAAA,SA2BhD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,KAAA,qBAqG9B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,UAAU,QAAA,EAAE,GAAG,QAAA,GAFnC,MAAM,CAoDjB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,KAAA,EAAE,CAAC,KAAA,EAAE,cAAc,KAAA,QAoCpD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,eAAe,KAAA,EAAE,kBAAkB,KAAA;;SAUlE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAFvB,MAEuB,OAYjC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAF3B,MAE2B,OAUrC"}

package/types/lib/inventory/spdxExpression.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Returns true if the identifier is a LicenseRef-/DocumentRef- style document
+ * reference rather than an SPDX short identifier.
+ *
+ * @param {string} id Identifier
+ * @returns {boolean}
+ */
+export declare function isLicenseRef(id: string): boolean;
+/**
+ * Normalizes a key by lowercasing and removing non-alphanumeric characters.
+ * Matches the key normalization in data generation.
+ *
+ * @returns {string} Normalized lookup key
+ */
+export declare function normalizeKey(name: any): string;
+/**
+ * Performs fuzzy correction on a license ID using aliases and direct case-insensitive lookups.
+ *
+ * @param {string} id License ID to correct
+ * @returns {string|null} Corrected ID or null if not found
+ */
+export declare function correctLicenseId(id: string): string | null;
+/**
+ * Tokenize a raw license expression string.
+ *
+ * @param {string} expr Expression
+ * @returns {string[]} Tokens
+ */
+export declare function tokenize(expr: string): string[];
+/**
+ * Parses and validates an SPDX expression.
+ *
+ * @param {string} expr Raw expression string
+ * @returns {object} Results: { valid: boolean, ast: object|null, unknown: string[] }
+ */
+export declare function parseSpdxExpression(expr: string): object;
+/**
+ * Renders an AST node back to a normalized string.
+ *
+ * @param {object} node AST Node
+ * @returns {string} Normalized string
+ */
+export declare function renderAST(node: object): string;
+/**
+ * Canonicalizes operand casing in the AST based on reference data.
+ *
+ * @param {object} node AST Node
+ * @returns {object} Canonicalized AST Node
+ */
+export declare function canonicalizeAST(node: object): object;
+/**
+ * Resolves deprecation replacements inside the AST recursively.
+ *
+ * @param {object} node AST Node
+ * @returns {object} Upgraded AST Node
+ */
+export declare function upgradeDeprecatedAST(node: object): object;
+//# sourceMappingURL=spdxExpression.d.ts.map

package/types/lib/inventory/spdxExpression.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spdxExpression.d.ts","sourceRoot":"","sources":["../../../lib/inventory/spdxExpression.js"],"names":[],"mappings":"AA+GA;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAHpB,MAGoB,GAFlB,OAAO,CAMnB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,KAAA,GAFpB,MAAM,CAKlB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAHxB,MAGwB,GAFtB,MAAM,GAAC,IAAI,CAyBvB;AAoBD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAHlB,MAGkB,GAFhB,MAAM,EAAE,CA0BpB;AAyID;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAH7B,MAG6B,GAF3B,MAAM,CAoBlB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAHnB,MAGmB,GAFjB,MAAM,CA2BlB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAHzB,MAGyB,GAFvB,MAAM,CA8ClB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAH9B,MAG8B,GAF5B,MAAM,CA6ClB"}

package/types/lib/inventory/spdxUtils.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Convert an SPDX 3.x JSON-LD document into a CycloneDX-like BOM object.
+ *
+ * Maps `software_Package` and `software_File` graph elements to components and
+ * `dependsOn` relationships to a dependency list. Input that is not SPDX
+ * JSON-LD is returned unchanged.
+ *
+ * @param {Object} bomJson SPDX JSON-LD or CycloneDX-like document
+ * @returns {Object} BOM object carrying `components` and `dependencies`
+ */
+export declare const toCycloneDxLikeBom: (bomJson: Object) => Object;
+//# sourceMappingURL=spdxUtils.d.ts.map

package/types/lib/inventory/spdxUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spdxUtils.d.ts","sourceRoot":"","sources":["../../../lib/inventory/spdxUtils.js"],"names":[],"mappings":"AAwCA;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,YAHpB,MAAM,KACJ,MA0DZ,CAAC"}

package/types/lib/inventory/table.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Render rows as a bordered text table.
+ *
+ * @param {Array[]} rows Table rows
+ * @param {Object} [config={}] Table configuration (header, columns, border style)
+ * @returns {string} Rendered table, or an empty string when there are no rows
+ */
+export declare function table(rows: any[][], config?: Object): string;
+/**
+ * Create a streaming table writer that renders rows incrementally.
+ *
+ * Rows go to the diagnostic stream: a rendered table is human-readable output,
+ * and writing it to stdout corrupted the BOM document under `-o -`.
+ *
+ * @param {Object} [config={}] Table configuration (header, columns, border style)
+ * @returns {{write(row: *): void, end(): void}} Writer whose `end()` emits the bottom border
+ */
+export declare function createStream(config?: Object): {
+    write(row: any): void;
+    end(): void;
+};
+//# sourceMappingURL=table.d.ts.map

package/types/lib/inventory/table.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"table.d.ts","sourceRoot":"","sources":["../../../lib/inventory/table.js"],"names":[],"mappings":"AAiNA;;;;;;GAMG;AACH,wBAAgB,KAAK,CAAC,IAAI,EAJf,OAIe,EAAE,MAAM,AAH/B,CACA,EADQ,MAG4B,GAF1B,MAAM,CAIlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,MAAM,AAHhC,CACA,EADQ,MAG6B,GAF3B;IAAC,KAAK,CAAC,GAAG,EAAE,GAAC,GAAG,IAAI,CAAC;IAAC,GAAG,IAAI,IAAI,CAAA;CAAC,CAuC9C"}

package/types/lib/inventory/traceRunner.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Parses a command string into command and arguments array.
+ * @param {string} cmdStr - Command string to parse
+ * @returns {{cmd: string, args: string[]}} Parsed command and arguments
+ */
+export declare function parseCommand(cmdStr: string): {
+    cmd: string;
+    args: string[];
+};
+/**
+ * Custom cdxgen resolver for @cdxgen/safer-exec binary dependency.
+ * Validates existence and ensures executable permissions to prevent EACCES issues.
+ *
+ * @returns {string|undefined} Path to the resolved binary or undefined if not found
+ */
+export declare function resolveSaferExecBinary(): string | undefined;
+/**
+ * Executes a command under safer-exec tracing and returns an array of loaded library paths
+ * and collected HTTP access entries.
+ *
+ * @param {string} commandStr - Command to execute and trace
+ * @param {string} [workingDir] - Working directory for the command
+ * @param {Object} [options] - Additional sandbox options
+ * @param {string[]} [options.readPaths] - Extra filesystem read paths merged with READ_PATHS
+ * @param {string[]} [options.writePaths] - Sandbox write paths (default: [tmpdir()])
+ * @param {number} [options.maxMemoryMB] - Max memory in MB (default: TRACE_MAX_MEMORY_MB)
+ * @param {number} [options.maxCPUCores] - Max CPU cores as fractional number
+ * @param {number} [options.maxProcesses] - Max process count (default: TRACE_MAX_PROCESSES)
+ * @param {number} [options.timeoutMs] - Trace timeout in ms (default: TRACE_TIMEOUT_MS)
+ * @param {boolean} [options.disableNetwork] - Disable network in sandbox (default: true)
+ * @param {boolean} [options.traceHTTPURLs] - Enable eBPF-based HTTP URL tracing (Linux only)
+ * @param {number} [options.tracePeriod] - Stop tracing after N seconds (for long-running commands)
+ * @param {boolean} [options.sanitizeEnv] - Strip sensitive env vars before sandboxed execution
+ * @param {boolean} [options.enableDiff] - Enable filesystem mutation diffing
+ * @param {boolean} [options.strict] - Treat sandbox setup warnings as hard errors
+ * @param {string[]} [options.allowHosts] - Hostnames to allow network access to
+ * @param {number[]} [options.allowPorts] - TCP ports to allow
+ * @param {string[]} [options.allowUrls] - URL-based allow rules (Linux, requires traceHTTPURLs)
+ * @param {boolean} [options.blockFork] - Prevent forking new processes
+ * @param {boolean} [options.traceExec] - Log every child process spawned
+ * @param {string[]} [options.allowExec] - Executables the command is allowed to run
+ * @param {string[]} [options.blockExec] - Executables to block from running
+ * @returns {Promise<{libPaths: string[], httpAccessEntries: Object[]}>} Collected libraries and HTTP URLs
+ */
+export declare function executeAndTrace(commandStr: string, workingDir?: string, options?: {
+    readPaths?: string[];
+    writePaths?: string[];
+    maxMemoryMB?: number;
+    maxCPUCores?: number;
+    maxProcesses?: number;
+    timeoutMs?: number;
+    disableNetwork?: boolean;
+    traceHTTPURLs?: boolean;
+    tracePeriod?: number;
+    sanitizeEnv?: boolean;
+    enableDiff?: boolean;
+    strict?: boolean;
+    allowHosts?: string[];
+    allowPorts?: number[];
+    allowUrls?: string[];
+    blockFork?: boolean;
+    traceExec?: boolean;
+    allowExec?: string[];
+    blockExec?: string[];
+}): Promise<{
+    libPaths: string[];
+    httpAccessEntries: Object[];
+}>;
+/**
+ * Groups HTTP access entries into a CycloneDX services-ready map.
+ * Each unique (host, port, protocol) combination becomes a service.
+ *
+ * @param {Object[]} httpAccessEntries - Collected HTTP access entries
+ * @returns {Object.<string, { endpoints: Set<string>, properties: Object[] }>} Services map
+ */
+export declare function groupHttpEntriesToServices(httpAccessEntries: Object[]): Record<string, {
+    endpoints: Set<string>;
+    properties: Object[];
+}>;
+//# sourceMappingURL=traceRunner.d.ts.map

package/types/lib/inventory/traceRunner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"traceRunner.d.ts","sourceRoot":"","sources":["../../../lib/inventory/traceRunner.js"],"names":[],"mappings":"AAyBA;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAHxB,MAGwB,GAFtB;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAC,CA6BzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAFzB,MAAM,GAAC,SAAS,CAoE5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAxBrC,MAwBqC,EAAE,UAAU,AAvBzD,CACA,EADQ,MAuBiD,EAAE,OAAO,AAtBlE,CAoBA,EAnBA;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAAyB,YAAY,AAArC,CACA,EADQ,MAAM,CACd;IAAyB,SAAS,AAAlC,CACA,EADQ,MAAM,CACd;IAA0B,cAAc,AAAxC,CACA,EADQ,OAAO,CACf;IAA0B,aAAa,AAAvC,CACA,EADQ,OAAO,CACf;IAAyB,WAAW,AAApC,CACA,EADQ,MAAM,CACd;IAA0B,WAAW,AAArC,CACA,EADQ,OAAO,CACf;IAA0B,UAAU,AAApC,CACA,EADQ,OAAO,CACf;IAA0B,MAAM,AAAhC,CACA,EADQ,OAAO,CACf;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,UAAU,AAArC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA0B,SAAS,AAAnC,CACA,EADQ,OAAO,CACf;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;IAA2B,SAAS,AAApC,CACA,EADQ,MAAM,EAAE,CAChB;CAEuE,GAF7D,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CAyOtE;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,iBAAiB,EAHjD,MAAM,EAG2C;eAFlB,GAAG,CAAC,MAAM,CAAC;gBAAc,MAAM,EAAE;GAuC1E"}

package/types/lib/inventory/unicodeScan.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Find dangerous Unicode characters and return their details.
+ *
+ * @param {string} text string to inspect
+ * @returns {{ char: string, codePoint: string, index: number, kind: string }[]} matches
+ */
+export declare function findDangerousUnicodeMatches(text: string): {
+    char: string;
+    codePoint: string;
+    index: number;
+    kind: string;
+}[];
+/**
+ * Scan a text blob for dangerous Unicode characters and summarize where they appear.
+ *
+ * @param {string} text text to inspect
+ * @param {{ syntax?: "markdown" | "text" | "yaml" }} [options] scan options
+ * @returns {{
+ *   codePoints: string[],
+ *   commentCodePoints: string[],
+ *   contexts: string[],
+ *   hasHiddenUnicode: boolean,
+ *   inComments: boolean,
+ *   lineNumbers: number[],
+ *   matches: { char: string, codePoint: string, index: number, kind: string, lineNumber: number, inComment: boolean }[],
+ * }} scan result
+ */
+export declare function scanTextForHiddenUnicode(text: string, options?: {
+    syntax?: "markdown" | "text" | "yaml";
+}): {
+    codePoints: string[];
+    commentCodePoints: string[];
+    contexts: string[];
+    hasHiddenUnicode: boolean;
+    inComments: boolean;
+    lineNumbers: number[];
+    matches: {
+        char: string;
+        codePoint: string;
+        index: number;
+        kind: string;
+        lineNumber: number;
+        inComment: boolean;
+    }[];
+};
+//# sourceMappingURL=unicodeScan.d.ts.map

package/types/lib/inventory/unicodeScan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unicodeScan.d.ts","sourceRoot":"","sources":["../../../lib/inventory/unicodeScan.js"],"names":[],"mappings":"AA0DA;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAHrC,MAGqC,GAFnC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,CAa9E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAZlC,MAYkC,EAAE,OAAO,AAXnD,CACA,EADQ;IAAE,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAAA;CAWS,GAV9C;IACR,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;CACrH,CAwDH"}

package/types/lib/managers/binary.d.ts

@@ -0,0 +1,147 @@
+/**
+ * Look up plugin manifest entries for the given tool names and return their
+ * CycloneDX tool component objects, de-duplicated by bom-ref.
+ *
+ * @param {string[]} [toolNames=[]] Plugin tool names to resolve.
+ * @returns {Object[]} De-duplicated CycloneDX tool component objects.
+ */
+export declare function getPluginToolComponents(toolNames?: string[]): Object[];
+/**
+ * Run the `cargo-auditable` companion binary against the given source path and
+ * return its stdout.
+ *
+ * @param {string} src Path to the Rust binary or source to inspect.
+ * @returns {string|undefined} The tool's stdout, or undefined when the binary
+ *   is unavailable or produced no output.
+ */
+export declare function getCargoAuditableInfo(src: string): string | undefined;
+/**
+ * Execute sourcekitten plugin with the given arguments
+ *
+ * @param args {Array} Arguments
+ * @returns {undefined|Object} Command output
+ */
+export declare function executeSourcekitten(args: any[]): undefined | Object;
+/**
+ * Canonicalise the distro vendor namespace of an OS package component
+ * produced by trivy, regardless of whether trivy expressed the vendor via the
+ * purl namespace or the component group (it is inconsistent between
+ * packages). e.g. pkg:rpm/alma/... -> pkg:rpm/almalinux/... and
+ * pkg:rpm/cbl-mariner/... -> pkg:rpm/azure-linux/... so the purls match the
+ * vulnerability feeds. Also aligns the ``distro`` qualifier vendor prefix
+ * (alma-9.8 -> almalinux-9.8, mariner-2.0 -> azure-linux-2.0), including
+ * spellings that disagree with the namespace, and rebuilds ``group`` and
+ * ``bom-ref`` from the rewritten purl.
+ *
+ * The namespace table is OS_NAMESPACE_ALIAS from lib/inventory/osinfo.js so
+ * the trivy path and the os-release path (getDistroInfo) cannot drift apart.
+ *
+ * A `distro` qualifier that is not purl-safe (trivy emits Amazon Linux as
+ * `amazon-2023.12.20260727+(Amazon Linux)`) is replaced with the os-release
+ * derived value, or dropped when there is none: an unusable qualifier
+ * invalidates the purl and fails validation for the whole BOM.
+ *
+ * @param {Object} comp trivy OS package component (mutated in place)
+ * @param {Object} purlObj parsed PackageURL of comp.purl (mutated in place)
+ * @param {string} name component package name (basename form)
+ * @param {string} group component group derived from the trivy component name
+ * @param {string} [distroId] canonical os-release distro id, e.g. "amazon-2023"
+ * @returns {string} the canonicalised group
+ */
+export declare function canonicaliseOsPackageNamespace(comp: Object, purlObj: Object, name: string, group: string, distroId?: string): string;
+/**
+ * Repair a `distro` qualifier that cannot survive purl parsing, in place.
+ *
+ * trivy stamps Amazon Linux with the full pretty version — the qualifier
+ * arrives as `distro=amazon-2023.12.20260727+%28Amazon+Linux%29`, whose spaces
+ * and parentheses `Purl.parse` rejects outright ("Invalid character in
+ * qualifier distro"). The component then bypasses every canonicalisation below
+ * (they all need a parsed purl) and reaches the BOM verbatim, where schema
+ * validation fails and the *entire* SBOM is discarded — an Amazon Linux scan
+ * produces no output at all today.
+ *
+ * The release is already known from os-release, so the unusable value is
+ * swapped for it; with no usable replacement the qualifier is dropped, since a
+ * missing qualifier costs one matching hint while an invalid one costs the
+ * whole document.
+ *
+ * @param {Object} comp component whose purl may carry an unusable qualifier
+ * @param {string} [distroId] canonical os-release distro id, e.g. "amazon-2023"
+ * @returns {Object} the same component
+ */
+export declare function repairOsComponentPurl(comp: Object, distroId?: string): Object;
+/**
+ * Drop source-package shadow components that duplicate a real installed
+ * package, in place.
+ *
+ * A shadow is emitted whenever an rpm/deb declares a source name different
+ * from its own (bzip2-libs -> bzip2) so that scanners keying on source names
+ * still match. When the source package is *itself* installed at the same
+ * version, the shadow's purl is identical to the real component's and the two
+ * collapse in trimComponents() — which keeps whichever was seen first and
+ * never merges `tags`. Seen-first is trivy's listing order, so the outcome is
+ * arbitrary: when the shadow wins, a genuinely installed package is reported
+ * with `tags: ["source"]` and identity confidence 0, the very marker the
+ * shadow carries so consumers can filter shadows out. That turns a real
+ * package into a filtered-away one.
+ *
+ * Dropping the redundant shadow is loss-free: it duplicates the real
+ * component's purl (so nothing that matches on purl changes) and its bom-ref
+ * is byte-identical, so no dependency reference can dangle.
+ *
+ * @param {Array} pkgList component list, mutated in place
+ * @returns {Array} the same list, for convenience
+ */
+export declare function dropRedundantSourceComponents(pkgList: any[]): any[];
+/**
+ * Get the packages installed in the container image filesystem.
+ *
+ * @param src {String} Source directory containing the extracted filesystem.
+ * @param imageConfig {Object} Image configuration containing environment variables, command, entrypoints etc
+ * @param options CLI options controlling inventory generation
+ *
+ * @returns {Object} Metadata containing packages, dependencies, etc
+ */
+export declare function getOSPackages(src: string, imageConfig: Object, options?: {}): Object;
+/**
+ * Batch-enrich operating-system components with host-path trust data using the
+ * `trustinspector` helper on darwin and Windows.
+ *
+ * @param {Object[]} [components=[]] OS components to enrich.
+ * @returns {{components: Object[], tools: Object[]}} The enriched components
+ *   and any trust-inspector tool components that should be attached to the BOM
+ *   metadata.
+ */
+export declare function enrichOSComponentsWithTrustData(components?: Object[]): {
+    components: Object[];
+    tools: Object[];
+};
+/**
+ * Execute a SQL query against the bundled osquery binary and return the parsed
+ * JSON result.
+ *
+ * @param {string} query The SQL query string to run.
+ * @returns {Object|undefined} The parsed JSON result, or undefined when the
+ *   binary is unavailable, dry-run blocks execution, or the output cannot be
+ *   parsed.
+ */
+export declare function executeOsQuery(query: string): Object | undefined;
+/**
+ * Method to execute dosai to create slices for dotnet
+ *
+ * @param {string} src Source Path
+ * @param {string} slicesFile Slices file name
+ * @returns boolean
+ */
+export declare function getDotnetSlices(src: string, slicesFile: string): boolean;
+/**
+ * Method to generate binary SBOM using blint
+ *
+ * @param {string} src Path to binary or its directory
+ * @param {string} binaryBomFile Path to binary
+ * @param {boolean} deepMode Deep mode flag
+ *
+ * @return {boolean} Result of the generation
+ */
+export declare function getBinaryBom(src: string, binaryBomFile: string, deepMode: boolean): boolean;
+//# sourceMappingURL=binary.d.ts.map

package/types/lib/managers/binary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary.d.ts","sourceRoot":"","sources":["../../../lib/managers/binary.js"],"names":[],"mappings":"AAyYA;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,AAH9C,CACA,EADQ,MAAM,EAGqC,GAFzC,MAAM,EAAE,CAgBpB;AA4FD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAJ9B,MAI8B,GAH5B,MAAM,GAAC,SAAS,CAmB5B;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,OAAA,GAF3B,SAAS,GAAC,MAAM,CAkB5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EARK,MAQL,EACJ,OAAO,EARE,MAQF,EACP,IAAI,EARK,MAQL,EACJ,KAAK,EARI,MAQJ,EACL,QAAQ,AARP,CACA,EADQ,MAQD,GAPG,MAAM,CAgDlB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAJ/B,MAI+B,EAAE,QAAQ,AAHjD,CACA,EADQ,MAGyC,GAFvC,MAAM,CA6BlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,OAAA,SAoBpD;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,GAAG,QAAA,EAAE,WAAW,EAL7B,MAK6B,EAAE,OAAO,KAAK,GAFrD,MAAM,CA6lBlB;AAkwDD;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,AALvD,CACA,EADQ,MAAM,EAK8C,GAJlD;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAC,CAmEnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EALzB,MAKyB,GAJvB,MAAM,GAAC,SAAS,CA8D5B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAJxB,MAIwB,EAAE,UAAU,EAHpC,MAGoC,WAqC9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EANrB,MAMqB,EAAE,aAAa,EALpC,MAKoC,EAAE,QAAQ,EAJ9C,OAI8C,GAF7C,OAAO,CAiClB"}

package/types/lib/managers/containerutils.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Method to get all dirs matching a name
+ *
+ * @param {string} dirPath Root directory for search
+ * @param {string} dirName Directory name
+ * @param {boolean} hidden Include hidden directories and files. Default: false
+ * @param {boolean} recurse Recurse. Default: false
+ */
+export declare const getDirs: (dirPath: string, dirName: string, hidden?: boolean, recurse?: boolean) => string[];
+/**
+ * Recursively walk `srcpath` and return all subdirectory paths whose basename
+ * matches `dirName` (the root path is included when it matches).
+ *
+ * @param {string} srcpath Root directory to start the walk from.
+ * @param {string} dirName Basename that a directory must end with to be kept.
+ * @returns {string[]} Matching directory paths.
+ */
+export declare const getOnlyDirs: (srcpath: string, dirName: string) => string[];
+/**
+ * Walk a directory tree once and collect all subdirectories whose basename
+ * matches any of the target names. Returns a map from name to array of paths.
+ *
+ * Replaces multiple {@link getOnlyDirs} calls that each walk the same tree.
+ *
+ * @param {string} srcpath Root directory for search
+ * @param {string[]} dirNames Target directory names to collect
+ * @returns {Record<string, string[]>} Map of dirName to matching paths
+ */
+export declare const getOnlyDirsMulti: (srcpath: string, dirNames: string[]) => Record<string, string[]>;
+//# sourceMappingURL=containerutils.d.ts.map

package/types/lib/managers/containerutils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerutils.d.ts","sourceRoot":"","sources":["../../../lib/managers/containerutils.js"],"names":[],"mappings":"AAOA;;;;;;;GAOG;AACH,eAAO,MAAM,OAAO,YALT,MAAM,WACN,MAAM,WACN,OAAO,YACP,OAAO,aAejB,CAAC;AAkCF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,YAJb,MAAM,WACN,MAAM,KACJ,MAAM,EAoBlB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,YAJlB,MAAM,YACN,MAAM,EAAE,KACN,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CA0BnC,CAAC"}