@cdxgen/cdxgen 13.2.0 → 13.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (311) hide show
  1. package/README.md +33 -14
  2. package/bin/cdxgen.js +310 -138
  3. package/bin/evinse.js +22 -0
  4. package/bin/repl.js +86 -0
  5. package/bin/sign.js +119 -15
  6. package/bin/tracebom.js +69 -5
  7. package/bin/validate.js +107 -19
  8. package/bin/verify.js +172 -63
  9. package/data/helpers/init.gradle +46 -21
  10. package/data/remediations.json +85 -0
  11. package/data/rules/dependency-sources.yaml +67 -0
  12. package/data/rules/scala-evidence.yaml +115 -0
  13. package/lib/audit/index.js +38 -6
  14. package/lib/cli/bomAssembly.js +105 -15
  15. package/lib/cli/cliOptions.js +93 -1
  16. package/lib/cli/index.js +156 -58
  17. package/lib/cli/jsBom.js +99 -53
  18. package/lib/cli/jvmBom.js +708 -147
  19. package/lib/cli/managedBom.js +415 -224
  20. package/lib/cli/nativeBom.js +264 -44
  21. package/lib/core/activity.js +12 -0
  22. package/lib/core/env.js +22 -15
  23. package/lib/core/fs.js +176 -7
  24. package/lib/core/httpClient.js +159 -24
  25. package/lib/core/metadataProperties.js +97 -0
  26. package/lib/core/pluginRun.js +184 -0
  27. package/lib/core/processTree.js +100 -0
  28. package/lib/core/projectConfig.js +31 -4
  29. package/lib/core/runState.js +39 -0
  30. package/lib/core/toml.js +72 -0
  31. package/lib/ecosystems/asarutils.js +4 -2
  32. package/lib/ecosystems/bunutils.js +274 -108
  33. package/lib/ecosystems/cargoCache.js +231 -8
  34. package/lib/ecosystems/caxa.js +434 -2
  35. package/lib/ecosystems/cmakeResolver.js +76 -21
  36. package/lib/ecosystems/cppBuildContext.js +631 -0
  37. package/lib/ecosystems/cppEvidence.js +399 -51
  38. package/lib/ecosystems/cppIncludeResolver.js +294 -0
  39. package/lib/ecosystems/denoutils.js +93 -66
  40. package/lib/ecosystems/ecosystems.js +1983 -793
  41. package/lib/ecosystems/golem.js +28 -12
  42. package/lib/ecosystems/gradleutils.js +356 -37
  43. package/lib/ecosystems/jsEvidence.js +104 -44
  44. package/lib/ecosystems/kosi.js +31 -7
  45. package/lib/ecosystems/npmutils.js +174 -9
  46. package/lib/ecosystems/parsers-dotnet.js +616 -159
  47. package/lib/ecosystems/parsers-elm.js +46 -28
  48. package/lib/ecosystems/parsers-gleam.js +3 -4
  49. package/lib/ecosystems/parsers-go.js +371 -70
  50. package/lib/ecosystems/parsers-js.js +263 -76
  51. package/lib/ecosystems/parsers-julia.js +2 -3
  52. package/lib/ecosystems/parsers-jvm.js +204 -12
  53. package/lib/ecosystems/parsers-misc.js +929 -216
  54. package/lib/ecosystems/parsers-python.js +167 -24
  55. package/lib/ecosystems/parsers-rust.js +28 -22
  56. package/lib/ecosystems/parsers-terraform.js +1573 -19
  57. package/lib/ecosystems/pythonutils.js +102 -6
  58. package/lib/ecosystems/remote/huggingface.js +3 -0
  59. package/lib/ecosystems/rubyutils.js +1492 -182
  60. package/lib/ecosystems/rusi.js +54 -10
  61. package/lib/ecosystems/sbtutils.js +243 -187
  62. package/lib/ecosystems/scalacliutils.js +342 -0
  63. package/lib/ecosystems/scalasem.js +2618 -0
  64. package/lib/ecosystems/terraformRegistry.js +288 -0
  65. package/lib/ecosystems/utils.js +2 -0
  66. package/lib/ecosystems/vendoredCode.js +156 -0
  67. package/lib/evinser/evinser.js +1008 -191
  68. package/lib/evinser/swiftsem.js +1914 -302
  69. package/lib/helpers/agenticToolutils.js +2 -2
  70. package/lib/helpers/bomSigner.js +1101 -222
  71. package/lib/inventory/aiCollector.js +4 -1
  72. package/lib/inventory/analyzer.js +110 -127
  73. package/lib/inventory/atomUtils.js +703 -43
  74. package/lib/inventory/auditCategories.js +7 -0
  75. package/lib/inventory/buildToolRateLimit.js +144 -0
  76. package/lib/inventory/cacheCommands.js +2 -1
  77. package/lib/inventory/cdxrs.js +103 -12
  78. package/lib/inventory/cmakeBuildDirs.js +254 -0
  79. package/lib/inventory/deps.js +501 -124
  80. package/lib/inventory/depsUtils.js +183 -11
  81. package/lib/inventory/display.js +4 -5
  82. package/lib/inventory/dosai.js +798 -57
  83. package/lib/inventory/dosaiParsers.js +310 -15
  84. package/lib/inventory/dynamic.js +90 -6
  85. package/lib/inventory/evidenceUtils.js +166 -113
  86. package/lib/inventory/fetchBatch.js +690 -55
  87. package/lib/inventory/fetchDiskCache.js +597 -0
  88. package/lib/inventory/forgeEnricher.js +14 -5
  89. package/lib/inventory/jvmLocalRepos.js +917 -0
  90. package/lib/inventory/mcpConfigParser.js +2 -3
  91. package/lib/inventory/parentSelection.js +146 -0
  92. package/lib/inventory/protobom.js +8 -1
  93. package/lib/inventory/purl.js +152 -3
  94. package/lib/inventory/rustFormulationParser.js +3 -4
  95. package/lib/inventory/sbomDocument.js +2 -70
  96. package/lib/inventory/scalaCoords.js +153 -0
  97. package/lib/inventory/source.js +45 -27
  98. package/lib/inventory/spdx.js +101 -0
  99. package/lib/inventory/traceRunner.js +295 -25
  100. package/lib/inventory/tracedCrypto.js +294 -0
  101. package/lib/managers/binary.js +115 -24
  102. package/lib/managers/docker.js +467 -46
  103. package/lib/managers/oci.js +63 -3
  104. package/lib/parsers/cmakeCache.js +69 -0
  105. package/lib/parsers/cmakeLists.js +466 -0
  106. package/lib/parsers/cmakePresets.js +400 -0
  107. package/lib/parsers/compileCommands.js +557 -0
  108. package/lib/parsers/largeJson.js +454 -0
  109. package/lib/parsers/npmrc.js +19 -1
  110. package/lib/parsers/strictJson.js +322 -0
  111. package/lib/parsers/terraformConfig.js +1073 -0
  112. package/lib/parsers/terraformSource.js +652 -0
  113. package/lib/server/server.js +23 -0
  114. package/lib/stages/postgen/introspection/markers.js +1 -1
  115. package/lib/stages/postgen/postgen.js +83 -16
  116. package/lib/stages/postgen/specVersionCompat.js +32 -0
  117. package/lib/validator/bomValidator.js +6 -16
  118. package/lib/validator/index.js +64 -11
  119. package/lib/validator/reporters/console.js +3 -0
  120. package/lib/validator/reporters/json.js +2 -0
  121. package/lib/validator/reporters/sarif.js +7 -0
  122. package/package.json +23 -23
  123. package/types/lib/audit/index.d.ts.map +1 -1
  124. package/types/lib/cli/bomAssembly.d.ts +2 -1
  125. package/types/lib/cli/bomAssembly.d.ts.map +1 -1
  126. package/types/lib/cli/cliOptions.d.ts +33 -1
  127. package/types/lib/cli/cliOptions.d.ts.map +1 -1
  128. package/types/lib/cli/index.d.ts.map +1 -1
  129. package/types/lib/cli/jsBom.d.ts.map +1 -1
  130. package/types/lib/cli/jvmBom.d.ts +24 -1
  131. package/types/lib/cli/jvmBom.d.ts.map +1 -1
  132. package/types/lib/cli/managedBom.d.ts +7 -4
  133. package/types/lib/cli/managedBom.d.ts.map +1 -1
  134. package/types/lib/cli/nativeBom.d.ts +3 -1
  135. package/types/lib/cli/nativeBom.d.ts.map +1 -1
  136. package/types/lib/core/activity.d.ts.map +1 -1
  137. package/types/lib/core/env.d.ts +9 -0
  138. package/types/lib/core/env.d.ts.map +1 -1
  139. package/types/lib/core/fs.d.ts +55 -0
  140. package/types/lib/core/fs.d.ts.map +1 -1
  141. package/types/lib/core/httpClient.d.ts +13 -8
  142. package/types/lib/core/httpClient.d.ts.map +1 -1
  143. package/types/lib/core/metadataProperties.d.ts +39 -0
  144. package/types/lib/core/metadataProperties.d.ts.map +1 -0
  145. package/types/lib/core/pluginRun.d.ts +97 -0
  146. package/types/lib/core/pluginRun.d.ts.map +1 -0
  147. package/types/lib/core/processTree.d.ts +36 -0
  148. package/types/lib/core/processTree.d.ts.map +1 -0
  149. package/types/lib/core/projectConfig.d.ts +6 -2
  150. package/types/lib/core/projectConfig.d.ts.map +1 -1
  151. package/types/lib/core/runState.d.ts +29 -0
  152. package/types/lib/core/runState.d.ts.map +1 -0
  153. package/types/lib/core/toml.d.ts +20 -0
  154. package/types/lib/core/toml.d.ts.map +1 -0
  155. package/types/lib/ecosystems/asarutils.d.ts.map +1 -1
  156. package/types/lib/ecosystems/bunutils.d.ts +12 -5
  157. package/types/lib/ecosystems/bunutils.d.ts.map +1 -1
  158. package/types/lib/ecosystems/cargoCache.d.ts +12 -0
  159. package/types/lib/ecosystems/cargoCache.d.ts.map +1 -1
  160. package/types/lib/ecosystems/caxa.d.ts +14 -0
  161. package/types/lib/ecosystems/caxa.d.ts.map +1 -1
  162. package/types/lib/ecosystems/cmakeResolver.d.ts +28 -3
  163. package/types/lib/ecosystems/cmakeResolver.d.ts.map +1 -1
  164. package/types/lib/ecosystems/cppBuildContext.d.ts +55 -0
  165. package/types/lib/ecosystems/cppBuildContext.d.ts.map +1 -0
  166. package/types/lib/ecosystems/cppEvidence.d.ts +17 -1
  167. package/types/lib/ecosystems/cppEvidence.d.ts.map +1 -1
  168. package/types/lib/ecosystems/cppIncludeResolver.d.ts +92 -0
  169. package/types/lib/ecosystems/cppIncludeResolver.d.ts.map +1 -0
  170. package/types/lib/ecosystems/denoutils.d.ts +9 -3
  171. package/types/lib/ecosystems/denoutils.d.ts.map +1 -1
  172. package/types/lib/ecosystems/ecosystems.d.ts +62 -13
  173. package/types/lib/ecosystems/ecosystems.d.ts.map +1 -1
  174. package/types/lib/ecosystems/golem.d.ts.map +1 -1
  175. package/types/lib/ecosystems/gradleutils.d.ts +70 -4
  176. package/types/lib/ecosystems/gradleutils.d.ts.map +1 -1
  177. package/types/lib/ecosystems/jsEvidence.d.ts +5 -2
  178. package/types/lib/ecosystems/jsEvidence.d.ts.map +1 -1
  179. package/types/lib/ecosystems/kosi.d.ts +13 -0
  180. package/types/lib/ecosystems/kosi.d.ts.map +1 -1
  181. package/types/lib/ecosystems/npmutils.d.ts +57 -0
  182. package/types/lib/ecosystems/npmutils.d.ts.map +1 -1
  183. package/types/lib/ecosystems/parsers-dotnet.d.ts +118 -4
  184. package/types/lib/ecosystems/parsers-dotnet.d.ts.map +1 -1
  185. package/types/lib/ecosystems/parsers-elm.d.ts.map +1 -1
  186. package/types/lib/ecosystems/parsers-gleam.d.ts.map +1 -1
  187. package/types/lib/ecosystems/parsers-go.d.ts +54 -2
  188. package/types/lib/ecosystems/parsers-go.d.ts.map +1 -1
  189. package/types/lib/ecosystems/parsers-js.d.ts +16 -5
  190. package/types/lib/ecosystems/parsers-js.d.ts.map +1 -1
  191. package/types/lib/ecosystems/parsers-julia.d.ts.map +1 -1
  192. package/types/lib/ecosystems/parsers-jvm.d.ts +46 -1
  193. package/types/lib/ecosystems/parsers-jvm.d.ts.map +1 -1
  194. package/types/lib/ecosystems/parsers-misc.d.ts +70 -4
  195. package/types/lib/ecosystems/parsers-misc.d.ts.map +1 -1
  196. package/types/lib/ecosystems/parsers-python.d.ts +53 -3
  197. package/types/lib/ecosystems/parsers-python.d.ts.map +1 -1
  198. package/types/lib/ecosystems/parsers-rust.d.ts.map +1 -1
  199. package/types/lib/ecosystems/parsers-terraform.d.ts +38 -21
  200. package/types/lib/ecosystems/parsers-terraform.d.ts.map +1 -1
  201. package/types/lib/ecosystems/pythonutils.d.ts +27 -2
  202. package/types/lib/ecosystems/pythonutils.d.ts.map +1 -1
  203. package/types/lib/ecosystems/remote/huggingface.d.ts.map +1 -1
  204. package/types/lib/ecosystems/rubyutils.d.ts +164 -3
  205. package/types/lib/ecosystems/rubyutils.d.ts.map +1 -1
  206. package/types/lib/ecosystems/rusi.d.ts +13 -0
  207. package/types/lib/ecosystems/rusi.d.ts.map +1 -1
  208. package/types/lib/ecosystems/sbtutils.d.ts +88 -2
  209. package/types/lib/ecosystems/sbtutils.d.ts.map +1 -1
  210. package/types/lib/ecosystems/scalacliutils.d.ts +56 -0
  211. package/types/lib/ecosystems/scalacliutils.d.ts.map +1 -0
  212. package/types/lib/ecosystems/scalasem.d.ts +311 -0
  213. package/types/lib/ecosystems/scalasem.d.ts.map +1 -0
  214. package/types/lib/ecosystems/terraformRegistry.d.ts +9 -0
  215. package/types/lib/ecosystems/terraformRegistry.d.ts.map +1 -0
  216. package/types/lib/ecosystems/utils.d.ts +2 -2
  217. package/types/lib/ecosystems/utils.d.ts.map +1 -1
  218. package/types/lib/ecosystems/vendoredCode.d.ts +32 -0
  219. package/types/lib/ecosystems/vendoredCode.d.ts.map +1 -0
  220. package/types/lib/evinser/evinser.d.ts +132 -15
  221. package/types/lib/evinser/evinser.d.ts.map +1 -1
  222. package/types/lib/evinser/swiftsem.d.ts +280 -15
  223. package/types/lib/evinser/swiftsem.d.ts.map +1 -1
  224. package/types/lib/helpers/bomSigner.d.ts +182 -13
  225. package/types/lib/helpers/bomSigner.d.ts.map +1 -1
  226. package/types/lib/inventory/aiCollector.d.ts.map +1 -1
  227. package/types/lib/inventory/analyzer.d.ts.map +1 -1
  228. package/types/lib/inventory/atomUtils.d.ts +219 -5
  229. package/types/lib/inventory/atomUtils.d.ts.map +1 -1
  230. package/types/lib/inventory/auditCategories.d.ts +3 -0
  231. package/types/lib/inventory/auditCategories.d.ts.map +1 -1
  232. package/types/lib/inventory/buildToolRateLimit.d.ts +38 -0
  233. package/types/lib/inventory/buildToolRateLimit.d.ts.map +1 -0
  234. package/types/lib/inventory/cacheCommands.d.ts +2 -1
  235. package/types/lib/inventory/cacheCommands.d.ts.map +1 -1
  236. package/types/lib/inventory/cdxrs.d.ts +8 -3
  237. package/types/lib/inventory/cdxrs.d.ts.map +1 -1
  238. package/types/lib/inventory/cmakeBuildDirs.d.ts +58 -0
  239. package/types/lib/inventory/cmakeBuildDirs.d.ts.map +1 -0
  240. package/types/lib/inventory/deps.d.ts +59 -1
  241. package/types/lib/inventory/deps.d.ts.map +1 -1
  242. package/types/lib/inventory/depsUtils.d.ts +15 -0
  243. package/types/lib/inventory/depsUtils.d.ts.map +1 -1
  244. package/types/lib/inventory/display.d.ts.map +1 -1
  245. package/types/lib/inventory/dosai.d.ts +121 -9
  246. package/types/lib/inventory/dosai.d.ts.map +1 -1
  247. package/types/lib/inventory/dosaiParsers.d.ts +53 -7
  248. package/types/lib/inventory/dosaiParsers.d.ts.map +1 -1
  249. package/types/lib/inventory/dynamic.d.ts +10 -0
  250. package/types/lib/inventory/dynamic.d.ts.map +1 -1
  251. package/types/lib/inventory/evidenceUtils.d.ts +19 -4
  252. package/types/lib/inventory/evidenceUtils.d.ts.map +1 -1
  253. package/types/lib/inventory/fetchBatch.d.ts +83 -14
  254. package/types/lib/inventory/fetchBatch.d.ts.map +1 -1
  255. package/types/lib/inventory/fetchDiskCache.d.ts +169 -0
  256. package/types/lib/inventory/fetchDiskCache.d.ts.map +1 -0
  257. package/types/lib/inventory/forgeEnricher.d.ts.map +1 -1
  258. package/types/lib/inventory/jvmLocalRepos.d.ts +178 -0
  259. package/types/lib/inventory/jvmLocalRepos.d.ts.map +1 -0
  260. package/types/lib/inventory/mcpConfigParser.d.ts.map +1 -1
  261. package/types/lib/inventory/parentSelection.d.ts +34 -0
  262. package/types/lib/inventory/parentSelection.d.ts.map +1 -0
  263. package/types/lib/inventory/plugins.d.ts.map +1 -1
  264. package/types/lib/inventory/protobom.d.ts.map +1 -1
  265. package/types/lib/inventory/purl.d.ts +71 -2
  266. package/types/lib/inventory/purl.d.ts.map +1 -1
  267. package/types/lib/inventory/rustFormulationParser.d.ts.map +1 -1
  268. package/types/lib/inventory/sbomDocument.d.ts.map +1 -1
  269. package/types/lib/inventory/scalaCoords.d.ts +80 -0
  270. package/types/lib/inventory/scalaCoords.d.ts.map +1 -0
  271. package/types/lib/inventory/source.d.ts.map +1 -1
  272. package/types/lib/inventory/spdx.d.ts +9 -0
  273. package/types/lib/inventory/spdx.d.ts.map +1 -1
  274. package/types/lib/inventory/traceRunner.d.ts +59 -1
  275. package/types/lib/inventory/traceRunner.d.ts.map +1 -1
  276. package/types/lib/inventory/tracedCrypto.d.ts +42 -0
  277. package/types/lib/inventory/tracedCrypto.d.ts.map +1 -0
  278. package/types/lib/managers/binary.d.ts +30 -1
  279. package/types/lib/managers/binary.d.ts.map +1 -1
  280. package/types/lib/managers/docker.d.ts +29 -0
  281. package/types/lib/managers/docker.d.ts.map +1 -1
  282. package/types/lib/managers/oci.d.ts +17 -1
  283. package/types/lib/managers/oci.d.ts.map +1 -1
  284. package/types/lib/parsers/cmakeCache.d.ts +16 -0
  285. package/types/lib/parsers/cmakeCache.d.ts.map +1 -1
  286. package/types/lib/parsers/cmakeLists.d.ts +77 -0
  287. package/types/lib/parsers/cmakeLists.d.ts.map +1 -0
  288. package/types/lib/parsers/cmakePresets.d.ts +78 -0
  289. package/types/lib/parsers/cmakePresets.d.ts.map +1 -0
  290. package/types/lib/parsers/compileCommands.d.ts +115 -0
  291. package/types/lib/parsers/compileCommands.d.ts.map +1 -0
  292. package/types/lib/parsers/largeJson.d.ts +52 -0
  293. package/types/lib/parsers/largeJson.d.ts.map +1 -0
  294. package/types/lib/parsers/npmrc.d.ts +5 -0
  295. package/types/lib/parsers/npmrc.d.ts.map +1 -1
  296. package/types/lib/parsers/strictJson.d.ts +46 -0
  297. package/types/lib/parsers/strictJson.d.ts.map +1 -0
  298. package/types/lib/parsers/terraformConfig.d.ts +70 -0
  299. package/types/lib/parsers/terraformConfig.d.ts.map +1 -0
  300. package/types/lib/parsers/terraformSource.d.ts +66 -0
  301. package/types/lib/parsers/terraformSource.d.ts.map +1 -0
  302. package/types/lib/server/server.d.ts.map +1 -1
  303. package/types/lib/stages/postgen/postgen.d.ts.map +1 -1
  304. package/types/lib/stages/postgen/specVersionCompat.d.ts.map +1 -1
  305. package/types/lib/validator/bomValidator.d.ts.map +1 -1
  306. package/types/lib/validator/index.d.ts +18 -1
  307. package/types/lib/validator/index.d.ts.map +1 -1
  308. package/types/lib/validator/reporters/console.d.ts.map +1 -1
  309. package/types/lib/validator/reporters/json.d.ts.map +1 -1
  310. package/types/lib/validator/reporters/sarif.d.ts.map +1 -1
  311. package/lib/third-party/arborist/snapshots/calc-dep-flags.test.cjs +0 -462
@@ -90,8 +90,11 @@ const isVendoredArtifactPath = (filePath) => {
90
90
  };
91
91
  const GGUF_MIN_ALIGNMENT = 4;
92
92
  const GGUF_MAX_ALIGNMENT = 1024 * 1024;
93
+ // Tested against full paths. The config exceptions follow IGNORE_FILE_PATTERN
94
+ // in analyzer.js, with the app exception anchored to a path separator instead
95
+ // of the start of a file name.
93
96
  const IGNORE_SOURCE_FILE_PATTERN =
94
- /(^|\/|\\)(__tests__|fixtures?|examples?|samples?)($|\/|\\)|(^|\/|\\)(test|spec|mock|setup-jest|conftest|sitecustomize)\.(js|ts|tsx|py)$|(?<!vite\.|vue\.)(conf|config)\.(js|ts|tsx)$/iu;
97
+ /(^|\/|\\)(__tests__|fixtures?|examples?|samples?)($|\/|\\)|(^|\/|\\)(test|spec|mock|setup-jest|conftest|sitecustomize)\.([cm]?[jt]sx?|py)$|(?<!vite\.|vue\.|svelte\.|astro\.|(?:^|\/|\\)app\.)(conf|config)\.[cm]?[jt]sx?$/iu;
95
98
  const HOST_PROVIDER_PATTERNS = [
96
99
  ["openai", /(?:^|\.)openai\.com$/iu],
97
100
  ["anthropic", /(?:^|\.)anthropic\.com$/iu],
@@ -68,9 +68,19 @@ const IGNORE_DIRS = readEnvironmentVariable("ASTGEN_IGNORE_DIRS")
68
68
  "coverage",
69
69
  ];
70
70
 
71
+ // The pattern is tested against file names. Config files are skipped because
72
+ // their imports are mostly build and test tooling. The exceptions hold code the
73
+ // application is built from: the Vite, Vue CLI, Svelte, and Astro configs name
74
+ // the build plugins and integrations the app needs, and app.config.* holds
75
+ // application code, such as the root providers of an Angular app. The app
76
+ // exception is anchored to the start of the name, so names such as
77
+ // webapp.config.ts are still skipped. [cm]?[jt]sx? covers every JavaScript and
78
+ // TypeScript module extension, as the default test globs of Jest and Vitest do.
79
+ // Keep the config exceptions in step with IGNORE_SOURCE_FILE_PATTERN in
80
+ // aiCollector.js.
71
81
  const IGNORE_FILE_PATTERN = new RegExp(
72
82
  readEnvironmentVariable("ASTGEN_IGNORE_FILE_PATTERN") ||
73
- "(test|spec|mock|setup-jest|\\.d)\\.(js|ts|tsx)$|(?<!vite\\.|vue\\.|svelte\\.)(conf|config)\\.(js|ts|tsx)$",
83
+ "(test|spec|mock|setup-jest|\\.d)\\.[cm]?[jt]sx?$|(?<!vite\\.|vue\\.|svelte\\.|astro\\.|^app\\.)(conf|config)\\.[cm]?[jt]sx?$",
74
84
  "i",
75
85
  );
76
86
 
@@ -210,6 +220,46 @@ const getAllFiles = (
210
220
  return result;
211
221
  };
212
222
 
223
+ /**
224
+ * Walk a directory tree once and return the files whose names end with any of
225
+ * the given extensions.
226
+ *
227
+ * Files are grouped by extension in the order of `extensions`, and each group
228
+ * keeps the walk order. That is the order one walk per extension produced, and
229
+ * occurrences reach the BOM in it.
230
+ *
231
+ * @param {string} dir Directory to walk
232
+ * @param {string[]} extensions File extensions, each with its leading dot
233
+ * @param {boolean|Object} deepOrOptions Deep flag, or `{ deep, exclude, noIgnore }`
234
+ * @returns {string[]} Matching file paths
235
+ */
236
+ const getAllFilesByExtensions = (dir, extensions, deepOrOptions) => {
237
+ const searchOptions = normalizeAnalyzerSearchOptions(deepOrOptions);
238
+ const files = getAllFiles(
239
+ searchOptions.deep,
240
+ dir,
241
+ undefined,
242
+ undefined,
243
+ undefined,
244
+ new RegExp(
245
+ `(?:${extensions.map((extension) => `\\${extension}`).join("|")})$`,
246
+ ),
247
+ dir,
248
+ searchOptions.exclude,
249
+ searchOptions.noIgnore,
250
+ );
251
+ const filesByExtension = extensions.map(() => []);
252
+ for (const file of files) {
253
+ const extensionIndex = extensions.findIndex((extension) =>
254
+ file.endsWith(extension),
255
+ );
256
+ if (extensionIndex !== -1) {
257
+ filesByExtension[extensionIndex].push(file);
258
+ }
259
+ }
260
+ return filesByExtension.flat();
261
+ };
262
+
213
263
  const babelParserOptions = {
214
264
  sourceType: "unambiguous",
215
265
  allowImportExportEverywhere: true,
@@ -1752,37 +1802,29 @@ export const parseFileASTTreeCollected = (src, file) => {
1752
1802
  return { imports, exports };
1753
1803
  };
1754
1804
 
1805
+ const JS_TS_SOURCE_EXTENSIONS = [
1806
+ ".js",
1807
+ ".jsx",
1808
+ ".cjs",
1809
+ ".mjs",
1810
+ ".ts",
1811
+ ".tsx",
1812
+ ".mts",
1813
+ ".cts",
1814
+ ".vue",
1815
+ ".svelte",
1816
+ ];
1817
+
1755
1818
  /**
1756
- * Return paths to all (j|tsx?) files.
1819
+ * Return paths to all JavaScript, TypeScript, Vue, and Svelte source files,
1820
+ * found in one walk of the tree.
1821
+ *
1822
+ * @param {string} src Directory to walk
1823
+ * @param {boolean|Object} deep Deep flag, or `{ deep, exclude, noIgnore }`
1824
+ * @returns {string[]} Source file paths, grouped by extension
1757
1825
  */
1758
1826
  const getAllSrcJSAndTSFiles = (src, deep) =>
1759
- Promise.all(
1760
- [
1761
- ".js",
1762
- ".jsx",
1763
- ".cjs",
1764
- ".mjs",
1765
- ".ts",
1766
- ".tsx",
1767
- ".mts",
1768
- ".cts",
1769
- ".vue",
1770
- ".svelte",
1771
- ].map((extension) => {
1772
- const searchOptions = normalizeAnalyzerSearchOptions(deep);
1773
- return getAllFiles(
1774
- searchOptions.deep,
1775
- src,
1776
- extension,
1777
- undefined,
1778
- undefined,
1779
- undefined,
1780
- src,
1781
- searchOptions.exclude,
1782
- searchOptions.noIgnore,
1783
- );
1784
- }),
1785
- );
1827
+ getAllFilesByExtensions(src, JS_TS_SOURCE_EXTENSIONS, deep);
1786
1828
 
1787
1829
  const getAngularWorkspaceManifestFiles = (
1788
1830
  dir,
@@ -2139,51 +2181,42 @@ const parseAngularStyleFiles = (
2139
2181
  excludePatterns,
2140
2182
  noIgnore = false,
2141
2183
  ) => {
2142
- for (const extension of ANGULAR_STYLE_FILE_EXTENSIONS) {
2143
- const styleFiles = getAllFiles(
2144
- deep,
2145
- src,
2146
- extension,
2147
- undefined,
2148
- undefined,
2149
- undefined,
2150
- src,
2151
- excludePatterns,
2152
- noIgnore,
2153
- );
2154
- for (const styleFile of styleFiles) {
2155
- let content;
2156
- try {
2157
- content = readFileSync(styleFile, "utf-8");
2158
- } catch {
2159
- continue;
2160
- }
2161
- for (const referencePattern of STYLE_PACKAGE_REFERENCE_PATTERNS) {
2162
- for (const match of content.matchAll(referencePattern)) {
2163
- const reference = match[1];
2164
- if (!reference) {
2165
- continue;
2166
- }
2167
- if (
2168
- match[0]?.trim().startsWith("url") &&
2169
- !isPackageStyleUrlReference(reference)
2170
- ) {
2171
- continue;
2172
- }
2173
- const prefix = content.slice(0, match.index || 0);
2174
- const lineNumber = prefix.split(/\r?\n/).length;
2175
- const lineStart = prefix.lastIndexOf("\n");
2176
- const columnNumber =
2177
- lineStart >= 0 ? prefix.length - lineStart - 1 : 0;
2178
- setAngularPackageRef(
2179
- allImports,
2180
- allExports,
2181
- src,
2182
- styleFile,
2183
- reference,
2184
- { column: columnNumber, line: lineNumber },
2185
- );
2184
+ const styleFiles = getAllFilesByExtensions(
2185
+ src,
2186
+ ANGULAR_STYLE_FILE_EXTENSIONS,
2187
+ { deep, exclude: excludePatterns, noIgnore },
2188
+ );
2189
+ for (const styleFile of styleFiles) {
2190
+ let content;
2191
+ try {
2192
+ content = readFileSync(styleFile, "utf-8");
2193
+ } catch {
2194
+ continue;
2195
+ }
2196
+ for (const referencePattern of STYLE_PACKAGE_REFERENCE_PATTERNS) {
2197
+ for (const match of content.matchAll(referencePattern)) {
2198
+ const reference = match[1];
2199
+ if (!reference) {
2200
+ continue;
2186
2201
  }
2202
+ if (
2203
+ match[0]?.trim().startsWith("url") &&
2204
+ !isPackageStyleUrlReference(reference)
2205
+ ) {
2206
+ continue;
2207
+ }
2208
+ const prefix = content.slice(0, match.index || 0);
2209
+ const lineNumber = prefix.split(/\r?\n/).length;
2210
+ const lineStart = prefix.lastIndexOf("\n");
2211
+ const columnNumber = lineStart >= 0 ? prefix.length - lineStart - 1 : 0;
2212
+ setAngularPackageRef(
2213
+ allImports,
2214
+ allExports,
2215
+ src,
2216
+ styleFile,
2217
+ reference,
2218
+ { column: columnNumber, line: lineNumber },
2219
+ );
2187
2220
  }
2188
2221
  }
2189
2222
  }
@@ -3478,8 +3511,7 @@ export const findJSImportsExports = async (src, deep) => {
3478
3511
  // scope of astWorker.js. Absence is silent — tier 1 covers all scope
3479
3512
  // evidence.
3480
3513
  await primeSvelteParser();
3481
- const promiseMap = await getAllSrcJSAndTSFiles(src, deep);
3482
- const srcFiles = promiseMap.flat();
3514
+ const srcFiles = getAllSrcJSAndTSFiles(src, deep);
3483
3515
  const tasks = srcFiles.map((file) => ({ src, file }));
3484
3516
  const parallelWorthwhile =
3485
3517
  totalSourceBytes(srcFiles) >= MIN_PARALLEL_PARSE_BYTES;
@@ -4580,8 +4612,7 @@ export const analyzeJsCryptoFile = (filePath) => {
4580
4612
  export const detectJsCryptoInventory = async (src, deep = false) => {
4581
4613
  let srcFiles = [];
4582
4614
  try {
4583
- const promiseMap = await getAllSrcJSAndTSFiles(src, deep);
4584
- srcFiles = promiseMap.flat();
4615
+ srcFiles = getAllSrcJSAndTSFiles(src, deep);
4585
4616
  } catch {
4586
4617
  return { algorithms: [], libraries: [] };
4587
4618
  }
@@ -4626,31 +4657,7 @@ export const detectExtensionCapabilities = (src, deep = false) => {
4626
4657
  }
4627
4658
  let srcFiles = [];
4628
4659
  try {
4629
- const searchOptions = normalizeAnalyzerSearchOptions(deep);
4630
- srcFiles = [
4631
- ".js",
4632
- ".jsx",
4633
- ".cjs",
4634
- ".mjs",
4635
- ".ts",
4636
- ".tsx",
4637
- ".mts",
4638
- ".cts",
4639
- ".vue",
4640
- ".svelte",
4641
- ].flatMap((extension) =>
4642
- getAllFiles(
4643
- searchOptions.deep,
4644
- src,
4645
- extension,
4646
- undefined,
4647
- undefined,
4648
- undefined,
4649
- src,
4650
- searchOptions.exclude,
4651
- searchOptions.noIgnore,
4652
- ),
4653
- );
4660
+ srcFiles = getAllSrcJSAndTSFiles(src, deep);
4654
4661
  } catch (_err) {
4655
4662
  return { capabilities: [], indicators: {} };
4656
4663
  }
@@ -5857,31 +5864,7 @@ export const detectMcpInventory = (src, deep = false) => {
5857
5864
  const servicesByKey = new Map();
5858
5865
  let srcFiles = [];
5859
5866
  try {
5860
- const searchOptions = normalizeAnalyzerSearchOptions(deep);
5861
- srcFiles = [
5862
- ".js",
5863
- ".jsx",
5864
- ".cjs",
5865
- ".mjs",
5866
- ".ts",
5867
- ".tsx",
5868
- ".mts",
5869
- ".cts",
5870
- ".vue",
5871
- ".svelte",
5872
- ].flatMap((extension) =>
5873
- getAllFiles(
5874
- searchOptions.deep,
5875
- src,
5876
- extension,
5877
- undefined,
5878
- undefined,
5879
- undefined,
5880
- src,
5881
- searchOptions.exclude,
5882
- searchOptions.noIgnore,
5883
- ),
5884
- );
5867
+ srcFiles = getAllSrcJSAndTSFiles(src, deep);
5885
5868
  } catch {
5886
5869
  return { components: [], dependencies: [], services: [] };
5887
5870
  }