vaspera 2.5.0

package/dist/plugins/types.d.ts

@@ -0,0 +1,304 @@
+/**
+ * Scanner Plugin Types
+ *
+ * Defines the plugin interface for external scanners.
+ * Plugins can be installed from:
+ * 1. Local directory: `.vaspera/plugins/{name}/manifest.json`
+ * 2. npm package: `vaspera-scanner-{name}`
+ *
+ * @module plugins/types
+ */
+import { z } from "zod";
+import type { Severity } from "../certification/types.js";
+import type { DeterministicFinding, ScannerResult } from "../scanners/types.js";
+/**
+ * Plugin manifest schema
+ *
+ * Defines the structure of a plugin's manifest.json file.
+ */
+export declare const PluginManifestSchema: z.ZodObject<{
+    /** Plugin name (alphanumeric with hyphens) */
+    name: z.ZodString;
+    /** Plugin version (semver) */
+    version: z.ZodString;
+    /** Human-readable description */
+    description: z.ZodString;
+    /** Plugin author */
+    author: z.ZodOptional<z.ZodString>;
+    /** Plugin homepage/repository URL */
+    homepage: z.ZodOptional<z.ZodString>;
+    /** License identifier */
+    license: z.ZodOptional<z.ZodString>;
+    /** Minimum Vaspera version required */
+    minVasperaVersion: z.ZodOptional<z.ZodString>;
+    /** Scanner configuration */
+    scanner: z.ZodObject<{
+        /** Scanner type identifier */
+        type: z.ZodString;
+        /** Languages/frameworks this scanner supports */
+        languages: z.ZodArray<z.ZodString, "many">;
+        /** File patterns to include (glob) */
+        include: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** File patterns to exclude (glob) */
+        exclude: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Whether scanner requires external binary */
+        requiresBinary: z.ZodDefault<z.ZodBoolean>;
+        /** Binary name to check for availability */
+        binaryName: z.ZodOptional<z.ZodString>;
+        /** Default timeout in milliseconds */
+        defaultTimeout: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        type: string;
+        languages: string[];
+        requiresBinary: boolean;
+        defaultTimeout: number;
+        include?: string[] | undefined;
+        exclude?: string[] | undefined;
+        binaryName?: string | undefined;
+    }, {
+        type: string;
+        languages: string[];
+        include?: string[] | undefined;
+        exclude?: string[] | undefined;
+        requiresBinary?: boolean | undefined;
+        binaryName?: string | undefined;
+        defaultTimeout?: number | undefined;
+    }>;
+    /** Entry point configuration */
+    entryPoint: z.ZodObject<{
+        /** Path to main module (relative to manifest) */
+        module: z.ZodString;
+        /** Export name for the scanner function */
+        exportName: z.ZodDefault<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        module: string;
+        exportName: string;
+    }, {
+        module: string;
+        exportName?: string | undefined;
+    }>;
+    /** Custom rules configuration */
+    rules: z.ZodOptional<z.ZodObject<{
+        /** Path to rules directory (relative to manifest) */
+        directory: z.ZodOptional<z.ZodString>;
+        /** Rule file extensions */
+        extensions: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        extensions: string[];
+        directory?: string | undefined;
+    }, {
+        directory?: string | undefined;
+        extensions?: string[] | undefined;
+    }>>;
+    /** Plugin capabilities */
+    capabilities: z.ZodDefault<z.ZodObject<{
+        /** Supports incremental scanning */
+        incremental: z.ZodDefault<z.ZodBoolean>;
+        /** Supports auto-fix */
+        autofix: z.ZodDefault<z.ZodBoolean>;
+        /** Supports custom rules */
+        customRules: z.ZodDefault<z.ZodBoolean>;
+        /** Can run in sandbox */
+        sandboxable: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        autofix: boolean;
+        incremental: boolean;
+        customRules: boolean;
+        sandboxable: boolean;
+    }, {
+        autofix?: boolean | undefined;
+        incremental?: boolean | undefined;
+        customRules?: boolean | undefined;
+        sandboxable?: boolean | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    version: string;
+    description: string;
+    name: string;
+    scanner: {
+        type: string;
+        languages: string[];
+        requiresBinary: boolean;
+        defaultTimeout: number;
+        include?: string[] | undefined;
+        exclude?: string[] | undefined;
+        binaryName?: string | undefined;
+    };
+    capabilities: {
+        autofix: boolean;
+        incremental: boolean;
+        customRules: boolean;
+        sandboxable: boolean;
+    };
+    entryPoint: {
+        module: string;
+        exportName: string;
+    };
+    license?: string | undefined;
+    author?: string | undefined;
+    rules?: {
+        extensions: string[];
+        directory?: string | undefined;
+    } | undefined;
+    homepage?: string | undefined;
+    minVasperaVersion?: string | undefined;
+}, {
+    version: string;
+    description: string;
+    name: string;
+    scanner: {
+        type: string;
+        languages: string[];
+        include?: string[] | undefined;
+        exclude?: string[] | undefined;
+        requiresBinary?: boolean | undefined;
+        binaryName?: string | undefined;
+        defaultTimeout?: number | undefined;
+    };
+    entryPoint: {
+        module: string;
+        exportName?: string | undefined;
+    };
+    capabilities?: {
+        autofix?: boolean | undefined;
+        incremental?: boolean | undefined;
+        customRules?: boolean | undefined;
+        sandboxable?: boolean | undefined;
+    } | undefined;
+    license?: string | undefined;
+    author?: string | undefined;
+    rules?: {
+        directory?: string | undefined;
+        extensions?: string[] | undefined;
+    } | undefined;
+    homepage?: string | undefined;
+    minVasperaVersion?: string | undefined;
+}>;
+export type PluginManifest = z.infer<typeof PluginManifestSchema>;
+/**
+ * Scanner plugin context provided to the scanner function
+ */
+export interface ScannerPluginContext {
+    /** Project path being scanned */
+    projectPath: string;
+    /** Files to scan (if incremental mode) */
+    files?: string[];
+    /** Scanner timeout in milliseconds */
+    timeout: number;
+    /** Custom rules directory */
+    rulesDir?: string;
+    /** Plugin-specific configuration from .vaspera/config.yaml */
+    config?: Record<string, unknown>;
+    /** Logger instance */
+    logger: {
+        debug: (message: string, data?: Record<string, unknown>) => void;
+        info: (message: string, data?: Record<string, unknown>) => void;
+        warn: (message: string, data?: Record<string, unknown>) => void;
+        error: (message: string, data?: Record<string, unknown>) => void;
+    };
+}
+/**
+ * Scanner plugin function signature
+ *
+ * Plugins must export a function matching this signature.
+ */
+export type ScannerPluginFn = (context: ScannerPluginContext) => Promise<ScannerResult>;
+/**
+ * Loaded scanner plugin
+ */
+export interface LoadedPlugin {
+    /** Plugin manifest */
+    manifest: PluginManifest;
+    /** Path to plugin directory */
+    path: string;
+    /** Source of the plugin */
+    source: "local" | "npm";
+    /** Scanner function */
+    scan: ScannerPluginFn;
+    /** Whether plugin is enabled */
+    enabled: boolean;
+    /** Load error if failed */
+    loadError?: string;
+}
+/**
+ * Plugin registry entry
+ */
+export interface PluginRegistryEntry {
+    /** Plugin name */
+    name: string;
+    /** Plugin version */
+    version: string;
+    /** Plugin source */
+    source: "local" | "npm";
+    /** Whether plugin is loaded */
+    loaded: boolean;
+    /** Load error if any */
+    error?: string;
+    /** Last loaded timestamp */
+    loadedAt?: string;
+}
+/**
+ * Plugin load options
+ */
+export interface PluginLoadOptions {
+    /** Whether to load from local .vaspera/plugins */
+    loadLocal?: boolean;
+    /** Whether to load from npm packages */
+    loadNpm?: boolean;
+    /** Specific plugins to load (by name) */
+    only?: string[];
+    /** Plugins to skip */
+    skip?: string[];
+    /** Whether to run plugins in sandbox (child process) */
+    sandbox?: boolean;
+    /** Plugin-specific configurations */
+    configs?: Record<string, Record<string, unknown>>;
+}
+/**
+ * Plugin execution result
+ */
+export interface PluginExecutionResult {
+    /** Plugin name */
+    plugin: string;
+    /** Scanner result */
+    result: ScannerResult;
+    /** Execution time in ms */
+    durationMs: number;
+    /** Whether execution was sandboxed */
+    sandboxed: boolean;
+    /** Error if execution failed */
+    error?: string;
+}
+/**
+ * Severity mapping configuration for a plugin
+ */
+export interface PluginSeverityMapping {
+    /** Plugin name */
+    plugin: string;
+    /** Mapping from plugin severity to Vaspera severity */
+    mapping: Record<string, Severity>;
+    /** Default severity if no mapping found */
+    default: Severity;
+}
+/**
+ * Plugin finding with source information
+ */
+export interface PluginFinding extends DeterministicFinding {
+    /** Source plugin name */
+    pluginSource: string;
+    /** Original severity from plugin */
+    originalSeverity?: string;
+}
+/**
+ * Check if a value is a valid plugin manifest
+ */
+export declare function isValidManifest(value: unknown): value is PluginManifest;
+/**
+ * Validate a plugin manifest and return errors
+ */
+export declare function validateManifest(value: unknown): {
+    valid: boolean;
+    manifest?: PluginManifest;
+    errors?: string[];
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/plugins/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/plugins/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAEhF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;IAC/B,8CAA8C;;IAG9C,8BAA8B;;IAG9B,iCAAiC;;IAGjC,oBAAoB;;IAGpB,qCAAqC;;IAGrC,yBAAyB;;IAGzB,uCAAuC;;IAGvC,4BAA4B;;QAE1B,8BAA8B;;QAG9B,iDAAiD;;QAGjD,sCAAsC;;QAGtC,sCAAsC;;QAGtC,+CAA+C;;QAG/C,4CAA4C;;QAG5C,sCAAsC;;;;;;;;;;;;;;;;;;;IAIxC,gCAAgC;;QAE9B,iDAAiD;;QAGjD,2CAA2C;;;;;;;;;IAI7C,iCAAiC;;QAE/B,qDAAqD;;QAGrD,2BAA2B;;;;;;;;;IAI7B,0BAA0B;;QAExB,oCAAoC;;QAGpC,wBAAwB;;QAGxB,4BAA4B;;QAG5B,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAG3B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IAEpB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAEjB,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAEhB,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC,sBAAsB;IACtB,MAAM,EAAE;QACN,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;QACjE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;QAChE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;QAChE,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;KAClE,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAExF;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,sBAAsB;IACtB,QAAQ,EAAE,cAAc,CAAC;IAEzB,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IAEb,2BAA2B;IAC3B,MAAM,EAAE,OAAO,GAAG,KAAK,CAAC;IAExB,uBAAuB;IACvB,IAAI,EAAE,eAAe,CAAC;IAEtB,gCAAgC;IAChC,OAAO,EAAE,OAAO,CAAC;IAEjB,2BAA2B;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,kBAAkB;IAClB,IAAI,EAAE,MAAM,CAAC;IAEb,qBAAqB;IACrB,OAAO,EAAE,MAAM,CAAC;IAEhB,oBAAoB;IACpB,MAAM,EAAE,OAAO,GAAG,KAAK,CAAC;IAExB,+BAA+B;IAC/B,MAAM,EAAE,OAAO,CAAC;IAEhB,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,kDAAkD;IAClD,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB,wCAAwC;IACxC,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,sBAAsB;IACtB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,wDAAwD;IACxD,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,qCAAqC;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnD;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,kBAAkB;IAClB,MAAM,EAAE,MAAM,CAAC;IAEf,qBAAqB;IACrB,MAAM,EAAE,aAAa,CAAC;IAEtB,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;IAEnB,sCAAsC;IACtC,SAAS,EAAE,OAAO,CAAC;IAEnB,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,kBAAkB;IAClB,MAAM,EAAE,MAAM,CAAC;IAEf,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAElC,2CAA2C;IAC3C,OAAO,EAAE,QAAQ,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,oBAAoB;IACzD,yBAAyB;IACzB,YAAY,EAAE,MAAM,CAAC;IAErB,oCAAoC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAOvE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG;IAChD,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB,CASA"}

package/dist/plugins/types.js

@@ -0,0 +1,100 @@
+/**
+ * Scanner Plugin Types
+ *
+ * Defines the plugin interface for external scanners.
+ * Plugins can be installed from:
+ * 1. Local directory: `.vaspera/plugins/{name}/manifest.json`
+ * 2. npm package: `vaspera-scanner-{name}`
+ *
+ * @module plugins/types
+ */
+import { z } from "zod";
+/**
+ * Plugin manifest schema
+ *
+ * Defines the structure of a plugin's manifest.json file.
+ */
+export const PluginManifestSchema = z.object({
+    /** Plugin name (alphanumeric with hyphens) */
+    name: z.string().regex(/^[a-z0-9-]+$/, "Name must be lowercase alphanumeric with hyphens"),
+    /** Plugin version (semver) */
+    version: z.string().regex(/^\d+\.\d+\.\d+/, "Version must be semver format"),
+    /** Human-readable description */
+    description: z.string().min(1).max(500),
+    /** Plugin author */
+    author: z.string().optional(),
+    /** Plugin homepage/repository URL */
+    homepage: z.string().url().optional(),
+    /** License identifier */
+    license: z.string().optional(),
+    /** Minimum Vaspera version required */
+    minVasperaVersion: z.string().optional(),
+    /** Scanner configuration */
+    scanner: z.object({
+        /** Scanner type identifier */
+        type: z.string(),
+        /** Languages/frameworks this scanner supports */
+        languages: z.array(z.string()),
+        /** File patterns to include (glob) */
+        include: z.array(z.string()).optional(),
+        /** File patterns to exclude (glob) */
+        exclude: z.array(z.string()).optional(),
+        /** Whether scanner requires external binary */
+        requiresBinary: z.boolean().default(false),
+        /** Binary name to check for availability */
+        binaryName: z.string().optional(),
+        /** Default timeout in milliseconds */
+        defaultTimeout: z.number().default(120000),
+    }),
+    /** Entry point configuration */
+    entryPoint: z.object({
+        /** Path to main module (relative to manifest) */
+        module: z.string(),
+        /** Export name for the scanner function */
+        exportName: z.string().default("default"),
+    }),
+    /** Custom rules configuration */
+    rules: z.object({
+        /** Path to rules directory (relative to manifest) */
+        directory: z.string().optional(),
+        /** Rule file extensions */
+        extensions: z.array(z.string()).default([".yaml", ".yml", ".json"]),
+    }).optional(),
+    /** Plugin capabilities */
+    capabilities: z.object({
+        /** Supports incremental scanning */
+        incremental: z.boolean().default(false),
+        /** Supports auto-fix */
+        autofix: z.boolean().default(false),
+        /** Supports custom rules */
+        customRules: z.boolean().default(false),
+        /** Can run in sandbox */
+        sandboxable: z.boolean().default(true),
+    }).default({}),
+});
+/**
+ * Check if a value is a valid plugin manifest
+ */
+export function isValidManifest(value) {
+    try {
+        PluginManifestSchema.parse(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Validate a plugin manifest and return errors
+ */
+export function validateManifest(value) {
+    const result = PluginManifestSchema.safeParse(value);
+    if (result.success) {
+        return { valid: true, manifest: result.data };
+    }
+    return {
+        valid: false,
+        errors: result.error.errors.map((e) => `${e.path.join(".")}: ${e.message}`),
+    };
+}
+//# sourceMappingURL=types.js.map

package/dist/plugins/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/plugins/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,8CAA8C;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,kDAAkD,CAAC;IAE1F,8BAA8B;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,+BAA+B,CAAC;IAE5E,iCAAiC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAEvC,oBAAoB;IACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE7B,qCAAqC;IACrC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAErC,yBAAyB;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE9B,uCAAuC;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAExC,4BAA4B;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,8BAA8B;QAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAEhB,iDAAiD;QACjD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAE9B,sCAAsC;QACtC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAEvC,sCAAsC;QACtC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAEvC,+CAA+C;QAC/C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAE1C,4CAA4C;QAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAEjC,sCAAsC;QACtC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;KAC3C,CAAC;IAEF,gCAAgC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,iDAAiD;QACjD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAElB,2CAA2C;QAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;KAC1C,CAAC;IAEF,iCAAiC;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,qDAAqD;QACrD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAEhC,2BAA2B;QAC3B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;KACpE,CAAC,CAAC,QAAQ,EAAE;IAEb,0BAA0B;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,oCAAoC;QACpC,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAEvC,wBAAwB;QACxB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAEnC,4BAA4B;QAC5B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAEvC,yBAAyB;QACzB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACvC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACf,CAAC,CAAC;AAyJH;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,CAAC;QACH,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAK7C,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAChD,CAAC;IACD,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;KAC5E,CAAC;AACJ,CAAC"}

package/dist/sbom/cyclonedx.d.ts

@@ -0,0 +1,30 @@
+/**
+ * CycloneDX SBOM Generator
+ *
+ * Generates CycloneDX 1.5 SBOMs from package.json and lock files.
+ *
+ * @module sbom/cyclonedx
+ */
+import type { CycloneDXSBOM, CycloneDXVulnerability, SBOMOptions } from "./types.js";
+import type { DeterministicFinding } from "../scanners/types.js";
+/**
+ * Convert scanner findings to vulnerabilities
+ */
+export declare function findingsToVulnerabilities(findings: DeterministicFinding[]): CycloneDXVulnerability[];
+/**
+ * Generate CycloneDX SBOM
+ */
+export declare function generateSBOM(projectPath: string, options?: SBOMOptions, findings?: DeterministicFinding[]): Promise<CycloneDXSBOM>;
+/**
+ * Generate SBOM as JSON string
+ */
+export declare function generateSBOMJson(projectPath: string, options?: SBOMOptions, findings?: DeterministicFinding[]): Promise<string>;
+/**
+ * Calculate SHA-256 hash of content
+ */
+export declare function calculateSha256(content: string): string;
+/**
+ * Generate compact SBOM summary
+ */
+export declare function generateSBOMSummary(sbom: CycloneDXSBOM): string;
+//# sourceMappingURL=cyclonedx.d.ts.map

package/dist/sbom/cyclonedx.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx.d.ts","sourceRoot":"","sources":["../../src/sbom/cyclonedx.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EACV,aAAa,EAGb,sBAAsB,EAGtB,WAAW,EAEZ,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAyZjE;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,oBAAoB,EAAE,GAC/B,sBAAsB,EAAE,CAsC1B;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,WAAW,EACrB,QAAQ,CAAC,EAAE,oBAAoB,EAAE,GAChC,OAAO,CAAC,aAAa,CAAC,CAyCxB;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,WAAW,EACrB,QAAQ,CAAC,EAAE,oBAAoB,EAAE,GAChC,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAa/D"}