@cdxgen/cdxgen 0.0.1 → 13.0.1

package/types/lib/managers/docker.d.ts

@@ -0,0 +1,157 @@
+import { Buffer } from "node:buffer";
+/** True when the current operating system is Windows. */
+export declare const isWin: boolean;
+/**
+ * Canonical Docker Hub registry hostname used as the default registry when
+ * parsing image names.
+ *
+ * @type {string}
+ */
+export declare const DOCKER_HUB_REGISTRY: string;
+/**
+ * Strip absolute path prefixes from a path string, handling both Unix and
+ * Windows paths (including UNC and extended-length paths such as //?/C:/).
+ * Taken from https://github.com/isaacs/node-tar/blob/main/src/strip-absolute-path.ts
+ *
+ * @param {string} path The path to strip
+ * @returns {string} The path with its absolute root removed
+ */
+export declare const stripAbsolutePath: (path: string) => string;
+/**
+ * Detect colima
+ */
+export declare function detectColima(): any;
+/**
+ * Detect if Rancher desktop is running on a mac.
+ */
+export declare function detectRancherDesktop(): any;
+/**
+ * Establish (or reuse) a `got` client connected to the local Docker or Podman
+ * daemon. Tries multiple socket / URL candidates in order: the default Docker
+ * socket, the rootless Docker socket, the Windows TCP endpoint, the rootless
+ * Podman socket, and the root Podman socket. Sets the module-level flags
+ * `isPodman`, `isPodmanRootless`, `isDockerRootless`, and `isWinLocalTLS` as a
+ * side-effect. Returns `undefined` when containerd / nerdctl is in use or no
+ * daemon could be reached.
+ *
+ * @param {Object} _options Additional options (currently unused; retained for
+ *   backwards compatibility with existing callers)
+ * @param {string} [forRegistry] Registry hostname forwarded to `getDefaultOptions`
+ * @returns {Promise<Object|undefined>} A daemon connection object bound to the
+ *   daemon base URL, or `undefined`
+ */
+export declare const getConnection: (_options: Object, forRegistry?: string) => Promise<Object | undefined>;
+/**
+ * Send a single HTTP request to the Docker / Podman daemon via the connection
+ * returned by {@link getConnection}. GET requests are parsed as JSON; all other
+ * methods receive a Buffer response body.
+ *
+ * @param {string} path API path relative to the daemon base URL (e.g. "images/ubuntu:latest/json")
+ * @param {string} method HTTP method (e.g. "GET", "POST", "DELETE")
+ * @param {string} [forRegistry] Registry hostname forwarded to `getDefaultOptions` for auth headers
+ * @returns {Promise<Object|Buffer|undefined>} Parsed JSON object for GET
+ *   requests, raw Buffer for other methods, or `undefined` if no client is available
+ */
+export declare const makeRequest: (path: string, method: string, forRegistry?: string) => Promise<Object | Buffer | undefined>;
+/**
+ * Parse image name
+ *
+ * docker pull debian
+ * docker pull debian:jessie
+ * docker pull ubuntu@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2
+ * docker pull myregistry.local:5000/testing/test-image
+ */
+export declare const parseImageName: (fullImageName: any) => {
+    registry: string;
+    repo: string;
+    tag: string;
+    digest: string;
+    platform: string;
+    group: string;
+    name: string;
+};
+/**
+ * Method to get image to the local registry by pulling from the remote if required
+ */
+export declare const getImage: (fullImageName: any) => Promise<any>;
+export type TarReadEntryLike = {
+    path: string;
+};
+/**
+ * Extract a container image tar archive into a destination directory.
+ * Applies path sanitisation, ownership/permission preservation settings, and
+ * an entry filter to skip problematic files and device nodes. Handles common
+ * tar errors gracefully, logging only unexpected ones.
+ *
+ * @param {string} fullImageName Path to the source tar archive
+ * @param {string} dir Destination directory to extract into
+ * @param {Object} options CLI options (uses `options.failOnError`)
+ * @returns {Promise<boolean>} `true` on success, `false` when the archive is
+ *   empty or a non-fatal error was encountered
+ */
+export declare const extractTar: (fullImageName: string, dir: string, options: Object) => Promise<boolean>;
+/**
+ * Method to export a container image archive.
+ * Returns the location of the layers with additional packages related metadata
+ */
+export declare const exportArchive: (fullImageName: any, options?: {}) => Promise<Object | undefined>;
+/**
+ * Parse a Docker/containerd manifest file and extract all image layers into a
+ * single merged directory. Resolves the last layer's config to determine the
+ * container's working directory, and builds the package path list for
+ * subsequent analysis.
+ *
+ * @param {string} manifestFile Path to the manifest.json (or index.json) file
+ * @param {Object} localData Local image inspect data (e.g. from `docker inspect`)
+ * @param {string} tempDir Temporary directory that holds the unpacked image
+ * @param {string} allLayersExplodedDir Directory where all layers are merged
+ * @param {Object} options CLI options (uses `options.failOnError`)
+ * @returns {Promise<Object>} Export data object containing `manifest`,
+ *   `allLayersDir`, `allLayersExplodedDir`, `lastLayerConfig`,
+ *   `lastWorkingDir`, `binPaths`, and `pkgPathList`
+ */
+export declare const extractFromManifest: (manifestFile: string, localData: Object, tempDir: string, allLayersExplodedDir: string, options: Object) => Promise<Object>;
+/**
+ * Method to export a container image by using the export feature in docker or podman service.
+ * Returns the location of the layers with additional packages related metadata
+ */
+export declare const exportImage: (fullImageName: any, options: any) => Promise<any>;
+/**
+ * Method to retrieve path list for system-level packages
+ */
+export declare const getPkgPathList: (exportData: any, lastWorkingDir: any) => any[];
+/**
+ * Remove a container image from the local Docker / Podman daemon.
+ *
+ * @param {string} fullImageName Full image name including tag or digest (e.g. "ubuntu:22.04")
+ * @param {boolean} [force=false] When `true`, force-remove the image even if it is in use
+ * @returns {Promise<Buffer|undefined>} Raw response buffer from the daemon, or
+ *   `undefined` if no daemon connection is available
+ */
+export declare const removeImage: (fullImageName: string, force?: boolean) => Promise<Buffer | undefined>;
+/**
+ * Retrieve a base64url-encoded authentication token for a registry server by
+ * invoking the `docker-credential-<exeSuffix>` credential helper binary.
+ * Results are cached in `registry_auth_keys` to avoid redundant subprocess
+ * calls.
+ *
+ * @param {string} exeSuffix Credential helper name suffix (e.g. "osxkeychain", "wincred", "pass")
+ * @param {string} serverAddress Registry server address (e.g. "https://index.docker.io/v1/")
+ * @returns {string|undefined} Base64url-encoded JSON auth token, or `undefined`
+ *   if the helper is unavailable or returns an error
+ */
+export declare const getCredsFromHelper: (exeSuffix: string, serverAddress: string) => string | undefined;
+/**
+ * Append skipped source-file entries to the `internal:SrcFile` properties of matching
+ * components. A component matches when its `oci:SrcImage` property value
+ * equals the skipped image's `image` field and the source file path is not
+ * already listed.
+ *
+ * @param {Array<{image: string, src: string}>} skippedImageSrcs List of skipped image/source pairs
+ * @param {Array<Object>} components CycloneDX component objects to update in place
+ */
+export declare const addSkippedSrcFiles: (skippedImageSrcs: Array<{
+    image: string;
+    src: string;
+}>, components: Array<Object>) => void;
+//# sourceMappingURL=docker.d.ts.map

package/types/lib/managers/docker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../lib/managers/docker.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAuCrC,yDAAyD;AACzD,eAAO,MAAM,KAAK,SAA0B,CAAC;AAC7C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAEoC,CAAC;AAsQ/C;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,SAHnB,MAAM,KACJ,MAiBZ,CAAC;AAEF;;GAEG;AACH,wBAAgB,YAAY,QAoB3B;AAED;;GAEG;AACH,wBAAgB,oBAAoB,QA2CnC;AAyTD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,aANf,MAAM,gBAEN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,SAAS,CA6HpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,SANb,MAAM,UACN,MAAM,gBACN,MAAM,KACJ,OAAO,CAAC,MAAM,GAAC,MAAM,GAAC,SAAS,CAgC3C,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;;;;;;CA2E1B,CAAC;AAkCF;;GAEG;AACH,eAAO,MAAM,QAAQ,sCA2LpB,CAAC;AAGC,YAA4B,gBAAgB,GAAlC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAkB;AAiH/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,kBANZ,MAAM,OACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,OAAO,CAiF3B,CAAC;AAiGF;;;GAGG;AACH,eAAO,MAAM,aAAa,mEA6FzB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,iBATrB,MAAM,aACN,MAAM,WACN,MAAM,wBACN,MAAM,WACN,MAAM,KACJ,OAAO,CAAC,MAAM,CAwH1B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,oDAkJvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,iDAkJ1B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,kBALb,MAAM,UACN,OAAO,KACL,OAAO,CAAC,MAAM,GAAC,SAAS,CAKpC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,cALpB,MAAM,iBACN,MAAM,KACJ,MAAM,GAAC,SA2CnB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,qBAHpB,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,CAAC,cACnC,KAAK,CAAC,MAAM,CAAC,SA4BvB,CAAC"}

package/types/lib/managers/dockerConnection.d.ts

@@ -0,0 +1,42 @@
+/**
+ * undici-backed connection helper for talking to the local Docker / Podman
+ * daemon (over a unix socket) or a remote daemon (over TCP/TLS). This replaces
+ * cdxgen's previous use of `got` for daemon communication.
+ *
+ * @module dockerConnection
+ */
+/**
+ * Retry policy for transient Docker/Podman daemon and registry failures.
+ * Mirrors the retry behaviour cdxgen previously configured on the got client.
+ *
+ * @type {Object}
+ */
+export declare const DAEMON_RETRY_OPTIONS: Object;
+/**
+ * Parse a got-style Docker daemon `prefixUrl` into the pieces undici needs.
+ * Unix socket URLs use the form `http://unix:/path/to/socket:`; anything else
+ * is treated as a regular TCP/TLS base URL.
+ *
+ * @param {string} prefixUrl got-style prefix URL for the daemon endpoint.
+ * @returns {{socketPath: (string|undefined), baseUrl: string}} The unix socket
+ *   path (when applicable) and the origin to use as the undici base URL.
+ */
+export declare const parseDaemonPrefixUrl: (prefixUrl: string) => {
+    socketPath: (string | undefined);
+    baseUrl: string;
+};
+/**
+ * Create a connection to the Docker / Podman daemon backed by undici. The
+ * returned object mimics the small slice of the got client that cdxgen relies
+ * on: a `request()` method returning a parsed body and a synchronous `stream()`
+ * method returning a readable image tar stream.
+ *
+ * @param {string} prefixUrl got-style daemon prefix URL (unix socket or TCP).
+ * @param {Object} [headers] Default headers (e.g. `X-Registry-Auth`) to send.
+ * @param {Object} [https] TLS material for remote daemons
+ *   (`{ certificate, key, rejectUnauthorized }`).
+ * @returns {Object} Connection object with `request`, `stream`, `close`,
+ *   `prefixUrl` and `baseUrl`.
+ */
+export declare const createDaemonConnection: (prefixUrl: string, headers?: Object, https?: Object) => Object;
+//# sourceMappingURL=dockerConnection.d.ts.map

package/types/lib/managers/dockerConnection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dockerConnection.d.ts","sourceRoot":"","sources":["../../../lib/managers/dockerConnection.js"],"names":[],"mappings":"AAMA;;;;;;GAMG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAFvB,MAMT,CAAC;AAOF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,cAJtB,MAAM,KACJ;IAAC,UAAU,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAe5D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,cAPxB,MAAM,YACN,MAAM,UACN,MAAM,KAEJ,MAiGZ,CAAC"}

package/types/lib/managers/oci.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Retrieves a CycloneDX BOM attached to an OCI image purely in JavaScript
+ * without relying on the `oras` CLI tool.
+ *
+ * @param {string} image OCI image reference (e.g. `"registry.example.com/org/app:tag"`)
+ * @param {string} [platform] OCI platform string (e.g. `"linux/amd64"`); no-op for JS implementation
+ * @returns {Promise<Object|undefined>} Parsed CycloneDX BOM JSON object, or `undefined` if not found
+ */
+export declare function getBomWithOras(image: string, _platform?: undefined): Promise<Object | undefined>;
+/**
+ * Attach a CycloneDX BOM to an OCI image using the OCI 1.1 artifact manifest
+ * API, pushing the BOM as a blob and linking it via the referrers API (with a
+ * fallback tag when the registry does not support referrers).
+ *
+ * @param {string} image The target OCI image reference to attach the BOM to.
+ * @param {Object} bomJson The CycloneDX BOM document to attach.
+ * @returns {Promise<string|undefined>} The digest of the pushed manifest, or
+ *   undefined when the manifest could not be pushed.
+ */
+export declare function attachBomNative(image: string, bomJson: Object): Promise<string | undefined>;
+//# sourceMappingURL=oci.d.ts.map

package/types/lib/managers/oci.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci.d.ts","sourceRoot":"","sources":["../../../lib/managers/oci.js"],"names":[],"mappings":"AAgXA;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAJ/B,MAI+B,EAAE,SAAS,YAAY,GAFpD,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA4GrC;AAmFD;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,KAAK,EALhC,MAKgC,EAAE,OAAO,EAJzC,MAIyC,GAHvC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAmIrC"}

package/types/lib/managers/piptree.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Execute the piptree plugin and return the generated tree as json object.
+ * The resulting tree would also include dependencies belonging to pip.
+ * Usage analysis is performed at a later stage to mark many of these packages as optional.
+ *
+ * @param {Object} env Environment variables to use
+ * @param {String} python_cmd Python command to use
+ * @param {String} basePath Current working directory
+ *
+ * @returns {Object} Dependency tree
+ */
+export declare const getTreeWithPlugin: (env: Object, python_cmd: string, basePath: string) => Object;
+//# sourceMappingURL=piptree.d.ts.map

package/types/lib/managers/piptree.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"piptree.d.ts","sourceRoot":"","sources":["../../../lib/managers/piptree.js"],"names":[],"mappings":"AA8NA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,QANnB,MAAM,2CAIJ,MAmCZ,CAAC"}

package/types/lib/parsers/cmakeCache.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Pure parser for CMakeCache.txt.
+ *
+ * CMakeCache is produced by `cmake` during configuration. Each non-comment line
+ * is `KEY:TYPE=VALUE`, where TYPE is one of BOOL, PATH, FILEPATH, STRING,
+ * INTERNAL, STATIC, UNINITIALIZED. Comment lines start with `//`; a leading
+ * `# This is the CMakeCache file.` header and blank lines are ignored.
+ *
+ * This module is layer 1 (pure text in, data out): it has no filesystem or
+ * subprocess access. The git/build-directory orchestration that consumes these
+ * facts lives in `lib/ecosystems/cmakeResolver.js`.
+ */
+/**
+ * Parse the raw text of a CMakeCache.txt file into an ordered key→entry map.
+ *
+ * Only well-formed `KEY:TYPE=VALUE` lines are captured. Comment (`//`), blank,
+ * and the `# This is the CMakeCache file.` header lines are ignored, as are
+ * lines that do not carry a recognised CMake cache type.
+ *
+ * @param {string} text Raw CMakeCache.txt contents
+ * @returns {Map<string, {type: string, value: string}>} Ordered map of cache entries
+ */
+export declare function parseCmakeCache(text: string): Map<string, {
+    type: string;
+    value: string;
+}>;
+/**
+ * Extract the version from a `FIND_PACKAGE_MESSAGE_DETAILS_<Pkg>:INTERNAL`
+ * value.
+ *
+ * The value is a sequence of `[...]` groups whose last group is
+ * `[v<VERSION>()]`. The version may be empty (`[v()]`). Only the final
+ * `[v...]` group is matched so a `[v...]` fragment inside an earlier bracket
+ * (a library path) cannot poison the result.
+ *
+ * @param {string} value The INTERNAL value after `=`
+ * @returns {string|null} The resolved version, empty string when the group is
+ *   present but empty, or `null` when no `[v...]` group is present.
+ */
+export declare function parseFindPackageVersion(value: string): string | null;
+/**
+ * Resolve the high-level facts a CMakeCache exposes about a configured build.
+ *
+ * Harvests the root project, every project directory, FetchContent sources, and
+ * the resolved versions of `find_package` lookups. `<name>_VERSION` is **not**
+ * present in the cache for subprojects, so fetched/submodule versions must be
+ * resolved from git or the gitclone script instead.
+ *
+ * @param {Map<string, {type: string, value: string}>} map Output of {@link parseCmakeCache}
+ * @returns {{ rootProject: {name?: string, version?: string} | null, projects: Map<string, {version?: string, sourceDir?: string, binaryDir?: string, isTopLevel?: boolean, kind: string}>, findPackages: Map<string, string>, fetchContentBase?: string }}
+ */
+export declare function resolveCmakeCacheFacts(map: Map<string, {
+    type: string;
+    value: string;
+}>): {
+    rootProject: {
+        name?: string;
+        version?: string;
+    } | null;
+    projects: Map<string, {
+        version?: string;
+        sourceDir?: string;
+        binaryDir?: string;
+        isTopLevel?: boolean;
+        kind: string;
+    }>;
+    findPackages: Map<string, string>;
+    fetchContentBase?: string;
+};
+//# sourceMappingURL=cmakeCache.d.ts.map

package/types/lib/parsers/cmakeCache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cmakeCache.d.ts","sourceRoot":"","sources":["../../../lib/parsers/cmakeCache.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAHzB,MAGyB,GAFvB,GAAG,CAAC,MAAM,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAAC,CA0BtD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAJlC,MAIkC,GAHhC,MAAM,GAAC,IAAI,CA0BvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAH/B,GAAG,CAAC,MAAM,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAGV,GAF7B;IAAE,WAAW,EAAE;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAC,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;IAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,CAiG1P"}

package/types/lib/parsers/gguf.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Convert a GGUF `general.file_type` enumeration value to a stable encoding label.
+ *
+ * The mapping follows the current `llama_ftype` enumeration used by GGUF writers.
+ * Unknown values intentionally return `undefined` so callers can fall back to
+ * filename-derived or executor-specific hints.
+ *
+ * @param {number|string|undefined} fileType numeric GGUF file type value
+ * @returns {string|undefined} encoding label such as `Q5_K_M` or `BF16`
+ */
+export declare function ggufFileTypeName(fileType: number | string | undefined): string | undefined;
+/**
+ * Parse a GGUF filename using the upstream naming convention documented by the
+ * GGUF specification.
+ *
+ * The convention is intentionally strict and will return `undefined` for files
+ * that do not follow the recommended layout. Callers that need to support older
+ * or community-specific names can use this as a first pass and then fall back to
+ * project-specific heuristics.
+ *
+ * @param {string} filePathOrName absolute path or bare filename
+ * @returns {Object|undefined} parsed filename details when recognized
+ */
+export declare function parseGgufFilename(filePathOrName: string): Object | undefined;
+/**
+ * Parse GGUF metadata from an in-memory header buffer.
+ *
+ * @param {Uint8Array|Buffer} buffer GGUF header buffer
+ * @returns {Object} parsed metadata map
+ */
+export declare function parseGgufMetadataBuffer(buffer: Uint8Array | Buffer): Object;
+/**
+ * Read selected GGUF metadata keys from a model artifact without loading the whole file.
+ *
+ * @param {string} filePath GGUF file path
+ * @returns {Object|undefined} parsed GGUF metadata
+ */
+export declare function readGgufMetadata(filePath: string): Object | undefined;
+//# sourceMappingURL=gguf.d.ts.map

package/types/lib/parsers/gguf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gguf.d.ts","sourceRoot":"","sources":["../../../lib/parsers/gguf.js"],"names":[],"mappings":"AAsTA;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAH9B,MAAM,GAAC,MAAM,GAAC,SAGgB,GAF5B,MAAM,GAAC,SAAS,CAQ5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,cAAc,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CA6D5B;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAHnC,UAAU,GAAC,MAGwB,GAFjC,MAAM,CAgDlB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAH9B,MAG8B,GAF5B,MAAM,GAAC,SAAS,CAgC5B"}

package/types/lib/parsers/gitAiNotes.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Tolerant parser for git-ai notes.
+ *
+ * Supports three shapes, all degrading gracefully (never throws):
+ *  1. The real git-ai `authorship/*` schema: per-file attribution blocks
+ *     followed by a `---` separator and a JSON metadata block carrying
+ *     `sessions` (each with an `agent_id` describing the AI tool/model).
+ *  2. A flat JSON object `{ agent, model, session, prompt, lines, ranges }`.
+ *  3. Line-oriented `key: value` / `key = value` text.
+ *
+ * @param {string} raw Raw git note content
+ * @returns {Object} Extracted fields { agent, model, session, prompt, lines, ranges, sessions, prompts, agents, models, aiAttributionCount }
+ */
+export declare function parseGitAiNote(raw: string): Object;
+//# sourceMappingURL=gitAiNotes.d.ts.map

package/types/lib/parsers/gitAiNotes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitAiNotes.d.ts","sourceRoot":"","sources":["../../../lib/parsers/gitAiNotes.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB,MAAM,CAyFlB"}

package/types/lib/parsers/gitmodules.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Pure parser for `.gitmodules` (git config INI) and a URL→purl coordinate helper.
+ *
+ * The file format is git-config INI:
+ *
+ * ```
+ * [submodule "name"]
+ *     path = third_party/foo
+ *     url = https://github.com/org/foo.git
+ *     branch = main
+ * ```
+ *
+ * Submodule URLs are frequently *relative* (`../dep`, `../../org/dep`). Such a
+ * URL is meaningless until resolved against the origin remote. The
+ * {@link resolveSubmoduleUrl} helper takes the origin URL as an argument
+ * (rather than discovering it) so this module stays layer 1 — no git, no fs.
+ *
+ * Purl coordinates are produced here as plain data; the purl *string* is built
+ * by the layer-3 resolver via `tryBuildPurl`, because cdx-purl lives in layer 2
+ * and a layer-1 parser may not reach it.
+ */
+/**
+ * Parse `.gitmodules` text into an ordered list of submodule descriptors.
+ *
+ * @param {string} text Raw `.gitmodules` contents
+ * @returns {{ name: string, path?: string, url?: string, branch?: string }[]} Submodules in file order
+ */
+export declare function parseGitmodules(text: string): {
+    name: string;
+    path?: string;
+    url?: string;
+    branch?: string;
+}[];
+/**
+ * Parse a git remote URL into an origin descriptor.
+ *
+ * Supports https, the `git@host:owner/repo` SSH shorthand, and
+ * `ssh://git@host/owner/repo` URLs.
+ *
+ * @param {string} url Origin remote URL
+ * @returns {{ scheme: string, host?: string, owner?: string, name?: string, baseUrl?: string } | null}
+ */
+export declare function parseGitRemoteUrl(url: string): {
+    scheme: string;
+    host?: string;
+    owner?: string;
+    name?: string;
+    baseUrl?: string;
+} | null;
+/**
+ * Resolve a submodule URL that may be relative against the origin remote.
+ *
+ * Git treats the superproject URL as a *directory* rather than a file, so
+ * `../bar` against `https://example.com/repositories/foo` resolves to
+ * `https://example.com/repositories/bar`, and `./inner` resolves to
+ * `https://example.com/repositories/foo/inner`. RFC 3986 would strip the last
+ * segment first and land a level higher, so the base carries an explicit
+ * trailing slash before resolution. SSH shorthand origins (`git@host:o/root`)
+ * are normalised to `https://host/o/root` first.
+ *
+ * @param {string} submoduleUrl URL from `.gitmodules` (absolute or relative)
+ * @param {string} originUrl Origin remote URL of the containing repo
+ * @returns {string|null} Absolute URL, or null when it cannot be resolved
+ */
+export declare function resolveSubmoduleUrl(submoduleUrl: string, originUrl: string): string | null;
+/**
+ * Build purl coordinates from a resolved submodule URL.
+ *
+ * GitHub remotes become `pkg:github/<owner>/<name>@<version>`; every other
+ * host becomes `pkg:generic` coordinates with a `vcs_url` qualifier, because
+ * only GitHub has a registered purl type that cdx-purl recognises.
+ *
+ * The caller (layer 3) turns these into a purl string via `tryBuildPurl`.
+ *
+ * @param {string} resolvedUrl Absolute git URL
+ * @param {string} [version] Resolved version (tag or commit SHA)
+ * @returns {{ type: string, namespace: string|null, name: string, version: string|null, qualifiers?: { vcs_url: string } } | null}
+ */
+export declare function submodulePurlCoordinates(resolvedUrl: string, version?: string): {
+    type: string;
+    namespace: string | null;
+    name: string;
+    version: string | null;
+    qualifiers?: {
+        vcs_url: string;
+    };
+} | null;
+//# sourceMappingURL=gitmodules.d.ts.map

package/types/lib/parsers/gitmodules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitmodules.d.ts","sourceRoot":"","sources":["../../../lib/parsers/gitmodules.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAHzB,MAGyB,GAFvB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,CAwC5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAH1B,MAG0B,GAFxB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA4DrG;AA0BD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAJrC,MAIqC,EAAE,SAAS,EAHhD,MAGgD,GAF9C,MAAM,GAAC,IAAI,CAwBvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAJzC,MAIyC,EAAE,OAAO,AAH1D,CACA,EADQ,MAGkD,GAFhD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,CAyBjI"}

package/types/lib/parsers/htmlExtract.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Decode named (`&`) and numeric (`'` / `'`) HTML entities.
+ * Unrecognised sequences are returned verbatim so licence text is never mangled.
+ *
+ * @param {string} str Text that may contain entity references.
+ * @returns {string} Decoded text.
+ */
+export declare function decodeEntities(str: string): string;
+/**
+ * Extract the licence heading from a pkg.go.dev page.
+ *
+ * Current markup puts the licence in `<section class="License"><h2>`, and
+ * several licences arrive as one comma-separated heading — `Apache-2.0, MIT`
+ * for gopkg.in/yaml.v3 — which the caller splits on ", ". Older markup used a
+ * container with `id="LICENSE"`; that path is tried first and costs one scan.
+ *
+ * Should a page ever carry several licence sections, their headings are joined
+ * with ", " so they split into separate licences rather than fusing into one
+ * nonsense identifier.
+ *
+ * @param {string} html Raw pkg.go.dev HTML.
+ * @returns {string} Trimmed licence text, or "" when nothing matches.
+ */
+export declare function extractLicenseText(html: string): string;
+/**
+ * Extract the repository URL from a pkg.go.dev page: the decoded `href` of the
+ * first direct anchor inside `div.UnitMeta-repo`. Anchors nested deeper in the
+ * container are links to other things, so only a direct child counts.
+ *
+ * @param {string} html Raw pkg.go.dev HTML.
+ * @returns {string|undefined}
+ */
+export declare function extractRepoUrl(html: string): string | undefined;
+//# sourceMappingURL=htmlExtract.d.ts.map

package/types/lib/parsers/htmlExtract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"htmlExtract.d.ts","sourceRoot":"","sources":["../../../lib/parsers/htmlExtract.js"],"names":[],"mappings":"AAsDA;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAHvB,MAGuB,GAFrB,MAAM,CAmDlB;AA+aD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAH5B,MAG4B,GAF1B,MAAM,CA6BlB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAHxB,MAGwB,GAFtB,MAAM,GAAC,SAAS,CAkB5B"}