@cdxgen/cdxgen 13.0.0 → 13.1.0

package/types/lib/stages/postgen/parentEdge.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Root reachability repair for the `dependencies` graph.
+ *
+ * CycloneDX expects `metadata.component` to appear in `dependencies` with the
+ * first level of the tree in its `dependsOn`. That edge is emitted by each
+ * ecosystem leg from whatever manifest declares the direct dependencies, so a
+ * leg that resolves a project entirely from a lock file, an export command, or
+ * a pre-resolved graph can produce a complete transitive tree that no consumer
+ * can enter: every edge is present, but nothing is reachable from the root.
+ *
+ * This module repairs that shape at finalization time, independent of the
+ * ecosystem. When the parent has no outgoing edge and the tree does contain
+ * edges, the components that nothing else points to are the roots of the graph,
+ * and attaching them to the parent restores reachability for the whole tree.
+ *
+ * The repair is deliberately weaker than a leg that knows the manifest: a
+ * direct dependency that some transitive dependency also requires is not a
+ * root here and stays out of the parent's `dependsOn`. It is a safety net that
+ * keeps a tree traversable, not a replacement for emitting the edge at the
+ * source, and it records what it inferred so consumers can tell the two apart.
+ */
+/** Property recording how many root edges were inferred rather than observed. */
+export declare const INFERRED_ROOTS_PROPERTY = "cdx:bom:inferredRootDependencies";
+/**
+ * Adds the missing edge from the parent component to the roots of the
+ * dependency graph. A no-op unless the document has a parent component with no
+ * outgoing edge, a tree that already contains edges, and at least one component
+ * that nothing points to.
+ *
+ * @param {Object} bomJson CycloneDX BOM
+ *
+ * @returns {Object} The same BOM, repaired in place when applicable
+ */
+export declare function repairParentDependencyEdge(bomJson: Object): Object;
+//# sourceMappingURL=parentEdge.d.ts.map

package/types/lib/stages/postgen/parentEdge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parentEdge.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/parentEdge.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAoC1E;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAJvC,MAIuC,GAFrC,MAAM,CAqFlB"}

package/types/lib/stages/postgen/postgen.d.ts

@@ -5,9 +5,9 @@
  * @param {Object} options CLI options
  * @param {string} [filePath] Source path used for formulation and metadata context
  *
- * @returns {Object} Modified bomNSData
+ * @returns {Promise<Object>} Modified bomNSData
  */
-export declare function postProcess(bomNSData: Object, options: Object, filePath?: string): Object;
+export declare function postProcess(bomNSData: Object, options: Object, filePath?: string): Promise<Object>;
 /**
  * Apply additional metadata based on components
  *

package/types/lib/stages/postgen/postgen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postgen.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/postgen.js"],"names":[],"mappings":"AAqbA;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAN1B,MAM0B,EAAE,OAAO,EALnC,MAKmC,EAAE,QAAQ,AAJrD,CAEA,EAFQ,MAI6C,GAF3C,MAAM,CAsDlB;AAgHD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAL1B,MAK0B,EAAE,OAAO,EAJnC,MAImC,GAFjC,MAAM,CA8HlB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAL3B,MAK2B,EAAE,OAAO,EAJpC,MAIoC,GAFlC,MAAM,CAqClB;AAkED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,EALtB,MAKsB,EAAE,OAAO,EAJ/B,MAI+B,GAF7B,MAAM,CA0MlB;AAUD;;GAEG;AACH,wBAAgB,UAAU,CAAC,QAAQ,KAAA,QAUlC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,IAFhB,IAAI,CAYhB;AAMD;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EALrB,MAKqB,EAAE,OAAO,EAJ9B,MAI8B,GAF5B,MAAM,CA2HlB"}
+{"version":3,"file":"postgen.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/postgen.js"],"names":[],"mappings":"AAgiBA;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,SAAS,EANhC,MAMgC,EAAE,OAAO,EALzC,MAKyC,EAAE,QAAQ,AAJ3D,CAEA,EAFQ,MAImD,GAFjD,OAAO,CAAC,MAAM,CAAC,CA4D3B;AAgHD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAL1B,MAK0B,EAAE,OAAO,EAJnC,MAImC,GAFjC,MAAM,CA8HlB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAL3B,MAK2B,EAAE,OAAO,EAJpC,MAIoC,GAFlC,MAAM,CAqClB;AAkED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,EALtB,MAKsB,EAAE,OAAO,EAJ/B,MAI+B,GAF7B,MAAM,CA0MlB;AAUD;;GAEG;AACH,wBAAgB,UAAU,CAAC,QAAQ,KAAA,QAUlC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,IAFhB,IAAI,CAYhB;AAMD;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EALrB,MAKqB,EAAE,OAAO,EAJ9B,MAI8B,GAF5B,MAAM,CA2HlB"}

package/types/lib/stages/postgen/ruleEngine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ruleEngine.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/ruleEngine.js"],"names":[],"mappings":"AAmfA;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,OAAO,CAuF1B;AAiCD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,EAAE,OAAO,KAAK,GAFjD,OAAO,OAAO,CAuF1B;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,KAAK,KAAA,EAAE,OAAO,KAAA,EAAE,OAAO,KAAK,kBAY/D"}
+{"version":3,"file":"ruleEngine.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/ruleEngine.js"],"names":[],"mappings":"AAogBA;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,QAAQ,EAH7B,MAG6B,GAF3B,OAAO,OAAO,CAuF1B;AAiCD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAJ5B,MAI4B,EAAE,OAAO,EAHrC,MAGqC,EAAE,OAAO,KAAK,GAFjD,OAAO,OAAO,CAuF1B;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,KAAK,KAAA,EAAE,OAAO,KAAA,EAAE,OAAO,KAAK,kBAY/D"}

package/types/lib/stages/pregen/envAudit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"envAudit.d.ts","sourceRoot":"","sources":["../../../../lib/stages/pregen/envAudit.js"],"names":[],"mappings":"AAuHA;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,AAJjC,CACA,EADQ,MAIuC,EAAE,OAAO,AAHxD,CACA,EADQ,MAGqD,GAFnD,MAAM,EAAE,CAkQpB"}
+{"version":3,"file":"envAudit.d.ts","sourceRoot":"","sources":["../../../../lib/stages/pregen/envAudit.js"],"names":[],"mappings":"AA2JA;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,AAJjC,CACA,EADQ,MAIuC,EAAE,OAAO,AAHxD,CACA,EADQ,MAGqD,GAFnD,MAAM,EAAE,CAsQpB"}

package/types/lib/stages/pregen/pregen.d.ts

@@ -11,6 +11,137 @@ export declare function prepareEnv(filePath: string, options: Object): void;
  * @param {String} projectType Project type
  */
 export declare function prepareSdkmanBuild(projectType: string): boolean | undefined;
+/**
+ * Method to detect and provision JVM build tools (maven, gradle, sbt, scala)
+ * plus a compatible JDK before BOM generation.
+ *
+ * Two styles are supported:
+ * - Explicit: a versioned project type such as `-t maven3.9.9` installs that
+ *   exact sdkman version and pins it for the generation step.
+ * - Automatic: with the `jvm-tool-setup` feature flag, tool versions are
+ *   derived from repo markers (`.sdkmanrc`, build tool wrappers,
+ *   `project/build.properties`) and missing tools are provisioned. Projects
+ *   pinning a tool through a wrapper are left alone because the wrapper
+ *   provisions itself; only JDK compatibility is checked.
+ *
+ * @param {String} filePath Project path
+ * @param {Object} options CLI options
+ *
+ * @returns {String|undefined} The `javaNN` project type whose JDK this call
+ *   already provisioned, so the caller can skip installing it again.
+ */
+export declare function prepareJvmBuildEnv(filePath: string, options: Object): string | undefined;
+/**
+ * Report the JVM toolchain that would be provisioned, without provisioning it.
+ *
+ * Dry-run exists so that the reader can see every side effect cdxgen would
+ * cause before allowing it to run for real, and provisioning a toolchain is
+ * the largest side effect this stage has: it downloads and installs software
+ * and then rewrites the command environment used for the rest of the run.
+ * Skipping the stage silently would hide exactly what dry-run is for, so each
+ * install, each JDK decision, and each environment variable that would change
+ * is recorded as a blocked activity instead.
+ *
+ * @param {Object} options CLI options
+ * @param {Array} installPins Tools that would be installed
+ * @param {Object} detected Repo detection result
+ */
+export declare function recordJvmBuildEnvIntent(options: Object, installPins: any[], detected: Object): void;
+/**
+ * Detect the JVM build tools a project needs from its own version pins, in
+ * precedence order: MAVEN_TOOL style overrides, `.sdkmanrc`, container/CI
+ * version hints, then build tool wrappers and repo markers. Wrapper-pinned
+ * tools are returned as known versions without an install because the
+ * wrapper downloads its own distribution.
+ *
+ * @param {String} filePath Project path
+ * @param {Array} explicitPins Pins collected from versioned project types
+ *
+ * @returns {Object} `{ installPins, wrapperVersions, javaVersionHint }`
+ */
+export declare function detectJvmToolsFromRepo(filePath: string, explicitPins: any[]): Object;
+/**
+ * Resolve a tool pin to an exact, locally known version. Exact versions that
+ * are already installed pass through untouched; otherwise the available
+ * sdkman versions are consulted to resolve partial prefixes such as `3.9`
+ * and to pick defaults.
+ *
+ * @param {Object} pin `{ tool, version?, source }`
+ *
+ * @returns {Object|undefined} Pin with an exact version, or undefined when no
+ *   version could be determined.
+ */
+export declare function resolveJvmToolPinVersion(pin: Object): Object | undefined;
+/**
+ * Fetch the versions available for a candidate via `sdk list`.
+ *
+ * @param {String} tool sdkman candidate name
+ *
+ * @returns {String|undefined} Command output, or undefined on failure.
+ */
+export declare function fetchSdkmanVersionList(tool: string): string | undefined;
+/**
+ * Check whether a JVM build tool already has a usable command, honouring the
+ * existing `MVN_CMD`/`GRADLE_CMD`/`SBT_CMD` overrides.
+ *
+ * The probe deliberately runs outside the scanned project. Build tool
+ * launchers read JVM arguments from the working directory before doing
+ * anything else - Maven from `.mvn/jvm.config` and sbt from `.jvmopts` or
+ * `.sbtopts` - so a `--version` call inside a project would let that project
+ * inject options such as `-javaagent` into the probe. Only the presence of a
+ * working command is being established here, which the project cannot affect.
+ *
+ * @param {String} tool Tool name
+ *
+ * @returns {Boolean} True when the tool responds to `--version`.
+ */
+export declare function isJvmToolUsable(tool: string): boolean;
+/**
+ * Ensure a JDK compatible with the pinned tools is active. Installs a JDK
+ * only when the current java is missing or older than required; an explicit
+ * `javaNN` project type is honoured as-is with a warning when it is too old.
+ *
+ * @param {String} filePath Project path
+ * @param {Object} options CLI options
+ * @param {Array} knownToolVersions Tool versions that will run
+ * @param {Number} javaVersionHint JDK major requested by the repo
+ *
+ * @returns {Number|undefined} Effective JDK major after the check.
+ */
+export declare function ensureCompatibleJdk(filePath: string, options: Object, knownToolVersions: any[], javaVersionHint: number): number | undefined;
+/**
+ * Pick the closest `javaNN` alias covering a required JDK major.
+ *
+ * @param {Number} major Required JDK major
+ *
+ * @returns {String|undefined} Alias such as `java17`.
+ */
+export declare function pickJavaAliasForMajor(major: number): string | undefined;
+/**
+ * Warn when the Gradle version in play cannot run on the effective JDK.
+ *
+ * @param {Array} knownToolVersions Tool versions that will run
+ * @param {Number} javaMajor Effective JDK major
+ */
+export declare function warnGradleJavaIncompatibility(knownToolVersions: any[], javaMajor: number): void;
+/**
+ * Install a pinned tool unless it is already available, applying the failure
+ * policy used by the ruby preparation: continue with whatever exists unless
+ * both `deep` and `failOnError` are set.
+ *
+ * @param {Object} pin `{ tool, version, source }`
+ * @param {Object} options CLI options
+ *
+ * @returns {Boolean} True when the exact version is active.
+ */
+export declare function provisionJvmTool(pin: Object, options: Object): boolean;
+/**
+ * Point the tool command environment variables at the freshly provisioned
+ * binary so the existing resolvers pick it up deterministically.
+ *
+ * @param {Object} pin `{ tool, version }`
+ */
+export declare function setJvmToolCommandEnv(pin: Object): void;
 /**
  * Method to check and prepare the environment for python
  *

package/types/lib/stages/pregen/pregen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pregen.d.ts","sourceRoot":"","sources":["../../../../lib/stages/pregen/pregen.js"],"names":[],"mappings":"AAoCA;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,QAAQ,QAAA,EAAE,OAAO,EAFjC,MAEiC,QAkB3C;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,QAAA,uBAS7C;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,QAAA,EAAE,OAAO,EAFxC,MAEwC,QA4ClD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,QAAA,EAAE,OAAO,EAFrC,MAEqC,QAmE/C;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,QAAA,WAsBnD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,QAAA,EAAE,WAAW,QAAA,QAsCjD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,QAAA,EAAE,OAAO,EAFtC,MAEsC,QA6EhD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,QAAA,EAAE,OAAO,EAFrC,MAEqC,QAqQ/C"}
+{"version":3,"file":"pregen.d.ts","sourceRoot":"","sources":["../../../../lib/stages/pregen/pregen.js"],"names":[],"mappings":"AAqEA;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,QAAQ,QAAA,EAAE,OAAO,EAFjC,MAEiC,QA6B3C;AAoED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,QAAA,uBAS7C;AAyCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,QAAA,EAAE,OAAO,EALzC,MAKyC,GAHvC,SAAO,SAAS,CA8F5B;AAmBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAJpC,MAIoC,EAAE,WAAW,OAAA,EAAE,QAAQ,EAF3D,MAE2D,QA2ErE;AAgBD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,QAAA,EAAE,YAAY,OAAA,GAFhD,MAAM,CA0HlB;AA+BD;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EALjC,MAKiC,GAH/B,MAAM,GAAC,SAAS,CAgE5B;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,QAAA,GAF9B,SAAO,SAAS,CAkB5B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,IAAI,QAAA,WAiFnC;AAwBD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,QAAA,EACR,OAAO,EARE,MAQF,EACP,iBAAiB,OAAA,EACjB,eAAe,QAAA,GANJ,SAAO,SAAS,CAoE5B;AA+BD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,QAAA,GAF9B,SAAO,SAAS,CAW5B;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,iBAAiB,OAAA,EAAE,SAAS,QAAA,QAwBzE;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,OAAO,EAJlC,MAIkC,WA4C5C;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAF7B,MAE6B,QA2BvC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,QAAA,EAAE,OAAO,EAFxC,MAEwC,QAwDlD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,QAAA,EAAE,OAAO,EAFrC,MAEqC,QAuE/C;AA+BD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,QAAA,WAsBnD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,QAAA,EAAE,WAAW,QAAA,QAyDjD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,QAAA,EAAE,OAAO,EAFtC,MAEsC,QA8FhD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,QAAA,EAAE,OAAO,EAFrC,MAEqC,QAyU/C"}

package/types/lib/validator/bomValidator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bomValidator.d.ts","sourceRoot":"","sources":["../../../lib/validator/bomValidator.js"],"names":[],"mappings":"AAqPA;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAJb,MAAM,KAEJ,OAAO,SAmCnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,aAHd,MAAM,GAAC,MAAM,KACX,OAyLZ,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,YAFlB,MAAM,YAmEhB,CAAC;AA4CF;;;;GAIG;AACH,eAAO,MAAM,aAAa,YAFf,MAAM,YAsHhB,CAAC;AA2CF;;;;GAIG;AACH,eAAO,MAAM,YAAY,YAFd,MAAM,YAwFhB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAF1B,MAE0B,WAkIpC"}
+{"version":3,"file":"bomValidator.d.ts","sourceRoot":"","sources":["../../../lib/validator/bomValidator.js"],"names":[],"mappings":"AAqPA;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAJb,MAAM,KAEJ,OAAO,SAmCnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,aAHd,MAAM,GAAC,MAAM,KACX,OAyLZ,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,YAFlB,MAAM,YAmEhB,CAAC;AA4CF;;;;GAIG;AACH,eAAO,MAAM,aAAa,YAFf,MAAM,YA+HhB,CAAC;AA2CF;;;;GAIG;AACH,eAAO,MAAM,YAAY,YAFd,MAAM,YAwFhB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAF1B,MAE0B,WAkIpC"}