@cdxgen/cdxgen 13.2.0 → 13.4.0

package/lib/stages/postgen/postgen.js

@@ -22,6 +22,7 @@ import {
 } from "../../core/fs.js";
 import { thoughtLog } from "../../core/logger.js";
 import { dirNameStr } from "../../core/paths.js";
+import { sanitizeBomPropertyValue } from "../../core/propertySanitizer.js";
 import { CDXGEN_TOOL_GROUP, CDXGEN_TOOL_NAME } from "../../core/state.js";
 import {
   AI_INVENTORY_PROJECT_TYPES,
@@ -741,26 +742,26 @@ function applyReleaseNotes(bomJson, options, filePath) {
  */
 export function applyMetadata(bomJson, options) {
   if (!bomJson?.components) {
-    return bomJson;
+    return applyCustomMetadataProperties(bomJson, options);
   }
   const bomPkgTypes = new Set();
   const bomPkgNamespaces = new Set();
   const bomSrcFiles = new Set();
-  for (const comp of bomJson.components) {
-    if (comp.purl) {
-      try {
-        const purlObj = Purl.parse(comp.purl);
-        if (purlObj?.type) {
-          bomPkgTypes.add(purlObj.type);
-        }
-        if (purlObj?.namespace) {
-          bomPkgNamespaces.add(purlObj.namespace);
-        }
-      } catch (_e) {
-        // ignore
-      }
+  // Collect the manifests a component was identified from, rewriting any
+  // absolute path to a relative one as a side effect. Shared by the components
+  // and by metadata.component, which a collector such as the ruby one describes
+  // from the project's own gemspec (discussion 4410).
+  const collectSrcFiles = (comp) => {
+    if (!comp) {
+      return;
     }
     if (comp.properties) {
+      // internal:LocalNodeModulesPath is a lookup path on the scanning host.
+      // Collectors outside the JS evidence pass (caxa, scalasem) keep it, so
+      // it is removed here for every component.
+      comp.properties = comp.properties.filter(
+        (aprop) => aprop.name !== "internal:LocalNodeModulesPath",
+      );
       for (const aprop of comp.properties) {
         if (aprop.name === "internal:SrcFile" && aprop.value) {
           const rdir = relativeDir(aprop.value, options);
@@ -790,6 +791,10 @@ export function applyMetadata(bomJson, options) {
           Array.isArray(aidentityEvidence.methods)
         ) {
           for (const amethod of aidentityEvidence.methods) {
+            // `value` is optional: an attestation, for one, names no file.
+            if (typeof amethod?.value !== "string") {
+              continue;
+            }
             const rdir = relativeDir(amethod.value, options);
             if (
               comp.type !== "file" &&
@@ -806,7 +811,32 @@ export function applyMetadata(bomJson, options) {
         }
       }
     }
-  }
+  };
+  for (const comp of bomJson.components) {
+    if (comp.purl) {
+      try {
+        const purlObj = Purl.parse(comp.purl);
+        if (purlObj?.type) {
+          bomPkgTypes.add(purlObj.type);
+        }
+        if (purlObj?.namespace) {
+          bomPkgNamespaces.add(purlObj.namespace);
+        }
+      } catch (_e) {
+        // ignore
+      }
+    }
+    collectSrcFiles(comp);
+  }
+  // The project's sub-components, the modules of a multi-module build, name
+  // their manifests the same way, at any depth.
+  const collectSrcFilesTree = (comp) => {
+    collectSrcFiles(comp);
+    for (const subComponent of comp?.components || []) {
+      collectSrcFilesTree(subComponent);
+    }
+  };
+  collectSrcFilesTree(bomJson.metadata?.component);
   if (!bomJson.metadata.properties) {
     bomJson.metadata.properties = [];
   }
@@ -862,6 +892,43 @@ export function applyMetadata(bomJson, options) {
       thoughtLog("BOM lacks package manifest details. Please help us improve!");
     }
   }
+  return applyCustomMetadataProperties(bomJson, options);
+}
+
+/**
+ * Add the metadata properties the user asked for on the command line, in the
+ * environment, or in a config file (discussion 4391), after whatever the scan
+ * itself discovered. They never replace a discovered property: the scan's own
+ * names, such as `cdx:bom:componentSrcFiles`, keep their values. A BOM without
+ * components still gets them.
+ *
+ * @param {Object} bomJson BOM JSON Object
+ * @param {Object} options CLI options, with `metadataProperties` as
+ *   `[{name, value}]`
+ *
+ * @returns {Object} BOM JSON Object
+ */
+function applyCustomMetadataProperties(bomJson, options) {
+  if (!bomJson?.metadata || !options?.metadataProperties?.length) {
+    return bomJson;
+  }
+  bomJson.metadata.properties = bomJson.metadata.properties || [];
+  for (const aprop of options.metadataProperties) {
+    if (!aprop?.name?.length || aprop.value === undefined) {
+      continue;
+    }
+    const value = sanitizeBomPropertyValue(aprop.name, `${aprop.value}`);
+    if (!value?.length) {
+      continue;
+    }
+    if (
+      !bomJson.metadata.properties.some(
+        (p) => p.name === aprop.name && p.value === value,
+      )
+    ) {
+      bomJson.metadata.properties.push({ name: aprop.name, value });
+    }
+  }
   return bomJson;
 }
 
@@ -1503,7 +1570,7 @@ export function annotate(bomJson, options) {
     for (const dep of bomJson.dependencies) {
       const newRef = `${bomLinkPrefix}${stripBomLink(bomJson.serialNumber, bomJson.version, dep.ref)}`;
       const newDependsOn = [];
-      for (const adon of dep.dependsOn) {
+      for (const adon of dep.dependsOn || []) {
         newDependsOn.push(
           `${bomLinkPrefix}${stripBomLink(bomJson.serialNumber, bomJson.version, adon)}`,
         );

package/lib/stages/postgen/specVersionCompat.js

@@ -53,6 +53,17 @@ const DEPENDENCY_1_6_ONLY_FIELDS = new Set(["provides"]);
 // License and license expression objects gained these attributes only in the
 // given spec versions. CycloneDX forbids additional properties, so they must be
 // removed when downgrading. Ref: data/bom-1.{4,5,6}.schema.json
+// The protocol types CycloneDX 1.6 defines; 1.7 added more.
+const SPEC_1_6_PROTOCOL_TYPES = new Set([
+  "tls",
+  "ssh",
+  "ipsec",
+  "ike",
+  "sstp",
+  "wpa",
+  "other",
+  "unknown",
+]);
 const LICENSE_1_5_ONLY_FIELDS = new Set(["bom-ref", "licensing", "properties"]);
 const LICENSE_1_6_ONLY_FIELDS = new Set(["acknowledgement"]);
 const LICENSE_EXPRESSION_1_5_ONLY_FIELDS = new Set(["bom-ref"]);
@@ -602,8 +613,29 @@ function downgradeSubjectForSpecVersion(subject, specVersion, parentKey) {
     // cryptoProperties.algorithmProperties. 1.6 keeps the deprecated free-text
     // `curve`, so that one is preserved. Ref: data/bom-1.6.schema.json.
     const algorithmProperties = subject.cryptoProperties.algorithmProperties;
+    // The curve stays known through the free-text field, by its name without
+    // the registry prefix (`secg/secp256r1` is `secp256r1`).
+    if (algorithmProperties.ellipticCurve && !algorithmProperties.curve) {
+      algorithmProperties.curve = String(algorithmProperties.ellipticCurve)
+        .split("/")
+        .pop();
+    }
     delete algorithmProperties.algorithmFamily;
     delete algorithmProperties.ellipticCurve;
+    // `key-wrap` joined the primitive enum in 1.7.
+    if (algorithmProperties.primitive === "key-wrap") {
+      algorithmProperties.primitive = "other";
+    }
+  }
+  if (
+    specVersion < 1.7 &&
+    subject.cryptoProperties?.protocolProperties?.type &&
+    !SPEC_1_6_PROTOCOL_TYPES.has(
+      subject.cryptoProperties.protocolProperties.type,
+    )
+  ) {
+    // 1.7 added protocol types such as `dtls` and `quic`.
+    subject.cryptoProperties.protocolProperties.type = "other";
   }
   Object.entries(subject).forEach(([key, value]) => {
     downgradeSubjectForSpecVersion(value, specVersion, key);

package/lib/validator/bomValidator.js

@@ -15,7 +15,7 @@ import {
   toCycloneDxSpecVersionString,
 } from "../inventory/bomUtils.js";
 import { isPartialTree } from "../inventory/depsUtils.js";
-import { isValidPurl } from "../inventory/purl.js";
+import { isValidPurl, parsePurlLoose } from "../inventory/purl.js";
 
 const dirName = dirNameStr;
 // The v13 floor is spec 1.6. 1.4 and 1.5 were dropped here so that the JS and
@@ -790,17 +790,13 @@ export const validateRefs = (bomJson) => {
       if (!refMap[dep.ref]) {
         warningsList.push(`Invalid ref in dependencies ${dep.ref}`);
       }
-      let parentPurlType;
-      try {
-        const purlObj = Purl.parse(dep.ref);
-        parentPurlType = purlObj.type;
-      } catch (_e) {
-        // pass
-      }
+      // A ref is the decoded form of a purl, so a version with `+` does not
+      // parse strictly; the type is all that is needed here.
+      const parentPurlType = parsePurlLoose(dep.ref)?.type;
       if (
         parentComponentRef &&
         dep.ref === parentComponentRef &&
-        dep.dependsOn.length === 0 &&
+        !dep.dependsOn?.length &&
         bomJson.dependencies.length > 1
       ) {
         warningsList.push(
@@ -814,13 +810,7 @@ export const validateRefs = (bomJson) => {
               `Invalid ref in dependencies.dependsOn ${don}. Parent: ${dep.ref}`,
             );
           }
-          let childPurlType;
-          try {
-            const purlObj = Purl.parse(don);
-            childPurlType = purlObj.type;
-          } catch (_e) {
-            // pass
-          }
+          const childPurlType = parsePurlLoose(don)?.type;
           if (
             parentPurlType &&
             childPurlType &&

package/lib/validator/index.js

@@ -11,7 +11,11 @@
  * wrapper (`bin/validate.js`) is responsible for reading the input BOM.
  */
 
-import { verifyNode } from "../helpers/bomSigner.js";
+import {
+  loadSharedSecret,
+  signatureReportReasons,
+  verifyBomSignatures,
+} from "../helpers/bomSigner.js";
 import {
   validateBom,
   validateMetadata,
@@ -109,18 +113,26 @@ export async function validateGeneratedBom(bomJson) {
  * Run schema + deep validation checks from the existing validator helpers and
  * capture their boolean results without letting them blow up the process.
  *
+ * An exception is not a verdict on the BOM, so it is recorded in
+ * `validationErrors` instead of silently counting as a plain failure.
+ *
  * @param {object} bomJson
  * @param {object} opts
- * @returns {Promise<{ schemaValid: boolean, deepValid: boolean }>}
+ * @returns {Promise<{ schemaValid: boolean, deepValid: boolean, validationErrors: Array<{ stage: string, message: string }> }>}
  */
 async function runSchemaAndDeep(bomJson, opts) {
   let schemaValid = true;
   let deepValid = true;
+  const validationErrors = [];
   if (opts.schema !== false) {
     try {
       schemaValid = (await validateBom(bomJson)) !== false;
     } catch (err) {
       schemaValid = false;
+      validationErrors.push({
+        stage: "schema",
+        message: err?.message || String(err),
+      });
       if (opts.onError) opts.onError("schema", err);
     }
   }
@@ -133,10 +145,14 @@ async function runSchemaAndDeep(bomJson, opts) {
         validateProps(bomJson) !== false;
     } catch (err) {
       deepValid = false;
+      validationErrors.push({
+        stage: "deep",
+        message: err?.message || String(err),
+      });
       if (opts.onError) opts.onError("deep", err);
     }
   }
-  return { schemaValid, deepValid };
+  return { schemaValid, deepValid, validationErrors };
 }
 
 /**
@@ -151,12 +167,17 @@ async function runSchemaAndDeep(bomJson, opts) {
  * @param {string} [options.minSeverity]        Minimum severity for returned findings.
  * @param {boolean} [options.includeManual]     Include manual-review findings (default true).
  * @param {boolean} [options.includePass]       Include passing findings (default false).
- * @param {string} [options.publicKey]          If set, verify the BOM signature.
+ * @param {string} [options.publicKey]          If set, verify the BOM signature with this public key.
+ * @param {string|Buffer} [options.secretKey]   If set, verify an HMAC (HS*) BOM signature with this shared secret.
+ * @param {boolean} [options.nestedSignatures]  Also verify component, service, and annotation signatures (default true), as cdx-verify does.
+ *   Parse untrusted BOM text with `parseStrictJson()` from `lib/parsers/strictJson.js` when verifying signatures.
  * @returns {{
  *   schemaValid: boolean,
  *   deepValid: boolean,
+ *   validationErrors: Array<{ stage: string, message: string }>,
  *   signatureVerified: boolean | null,
  *   signatureDetails: object | null,
+ *   signatureEntries: Array<{ index: number, algorithm: any, keyId: any, verified: boolean }> | null,
  *   findings: Array<object>,
  *   allFindings: Array<object>,
  *   benchmarks: Array<object>,
@@ -164,7 +185,10 @@ async function runSchemaAndDeep(bomJson, opts) {
  * }}
  */
 export async function validateBomAdvanced(bomJson, options = {}) {
-  const { schemaValid, deepValid } = await runSchemaAndDeep(bomJson, options);
+  const { schemaValid, deepValid, validationErrors } = await runSchemaAndDeep(
+    bomJson,
+    options,
+  );
   const allFindings = evaluateAll(bomJson, {
     categories: options.categories,
     benchmarks: options.benchmarks,
@@ -177,17 +201,44 @@ export async function validateBomAdvanced(bomJson, options = {}) {
   });
   let signatureVerified = null;
   let signatureDetails = null;
-  if (options.publicKey && bomJson?.signature) {
+  let signatureEntries = null;
+  const verificationRequested =
+    (options.publicKey !== undefined && options.publicKey !== null) ||
+    (options.secretKey !== undefined && options.secretKey !== null);
+  if (verificationRequested && bomJson?.signature) {
     try {
-      const match = verifyNode(bomJson, options.publicKey);
-      signatureVerified = Boolean(match);
-      signatureDetails = match || null;
+      const key = options.secretKey
+        ? loadSharedSecret(options.secretKey)
+        : options.publicKey;
+      const signatureReport = verifyBomSignatures(bomJson, [key], {
+        deep: options.nestedSignatures !== false,
+      });
+      signatureVerified = signatureReport.verified;
+      signatureEntries =
+        signatureReport.root?.entries.map(
+          ({ index, algorithm, keyId, verified }) => ({
+            index,
+            algorithm,
+            keyId,
+            verified,
+          }),
+        ) ?? null;
+      if (signatureReport.verified) {
+        signatureDetails = signatureReport.root.match;
+      } else {
+        const reasons = signatureReportReasons(signatureReport);
+        signatureDetails = {
+          error: reasons.length
+            ? [...new Set(reasons)].join(" ")
+            : "No signature matched the key.",
+        };
+      }
     } catch (err) {
       signatureVerified = false;
       signatureDetails = { error: err?.message || String(err) };
     }
-  } else if (options.publicKey) {
-    // Public key provided but BOM has no signature.
+  } else if (verificationRequested) {
+    // Verification key provided but BOM has no signature.
     signatureVerified = false;
     signatureDetails = { error: "BOM has no signature block." };
   }
@@ -197,8 +248,10 @@ export async function validateBomAdvanced(bomJson, options = {}) {
   return {
     schemaValid,
     deepValid,
+    validationErrors,
     signatureVerified,
     signatureDetails,
+    signatureEntries,
     findings: filtered,
     allFindings,
     benchmarks,

package/lib/validator/reporters/console.js

@@ -128,6 +128,9 @@ export function formatSummary(summary) {
 export function render(report) {
   const pieces = [];
   pieces.push(formatSummary(report.summary));
+  for (const e of report.validationErrors || []) {
+    pieces.push(`Validator error during ${e.stage} validation: ${e.message}`);
+  }
   if (report.benchmarks?.length) {
     pieces.push(formatBenchmarks(report.benchmarks));
   }

package/lib/validator/reporters/json.js

@@ -12,7 +12,9 @@ export function render(report, _options = {}) {
   const payload = {
     schemaValid: report.schemaValid,
     deepValid: report.deepValid,
+    validationErrors: report.validationErrors || [],
     signatureVerified: report.signatureVerified ?? null,
+    signatureEntries: report.signatureEntries ?? null,
     summary: report.summary,
     benchmarks: report.benchmarks || [],
     findings: (report.findings || []).map((f) => ({

package/lib/validator/reporters/sarif.js

@@ -167,12 +167,19 @@ export function render(report, options = {}) {
           {
             executionSuccessful:
               report.summary?.fail === 0 && report.schemaValid !== false,
+            toolExecutionNotifications: (report.validationErrors || []).map(
+              (e) => ({
+                level: "error",
+                message: { text: `${e.stage} validation error: ${e.message}` },
+              }),
+            ),
           },
         ],
         results: findings.map(toSarifResult),
         properties: {
           schemaValid: report.schemaValid,
           deepValid: report.deepValid,
+          validationErrors: report.validationErrors || [],
           signatureVerified: report.signatureVerified ?? null,
           summary: report.summary,
           benchmarks: report.benchmarks || [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cdxgen/cdxgen",
-  "version": "13.2.0",
+  "version": "13.4.0",
   "description": "Creates CycloneDX Software Bill of Materials (SBOM) from source or container image",
   "keywords": [
     "sbom",
@@ -123,9 +123,9 @@
     "index.cjs"
   ],
   "dependencies": {
-    "@babel/parser": "8.0.5",
-    "@babel/traverse": "8.0.5",
-    "@cdxgen/cdx-purl": "0.0.5",
+    "@babel/parser": "8.0.7",
+    "@babel/traverse": "8.0.7",
+    "@cdxgen/cdx-purl": "0.0.6",
     "@isaacs/string-locale-compare": "1.1.0",
     "@npmcli/fs": "6.0.0",
     "@npmcli/map-workspaces": "6.0.0",
@@ -140,40 +140,40 @@
     "npm-package-arg": "14.0.0",
     "parse-conflict-json": "6.0.0",
     "semver": "7.8.5",
-    "smol-toml": "^1.8.0",
+    "smol-toml": "1.9.1",
     "ssri": "14.0.0",
     "tar": "7.5.22",
     "treeverse": "3.0.0",
-    "undici": "8.10.2",
+    "undici": "8.11.2",
     "walk-up-path": "4.0.0",
     "yaml": "2.9.1",
-    "yargs": "18.1.0"
+    "yargs": "18.2.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.14",
-    "esmock": "2.7.6",
+    "@biomejs/biome": "2.5.15",
+    "esmock": "2.7.9",
     "poku": "4.5.0",
     "sinon": "22.1.0",
     "typescript": "^7.0.2"
   },
   "optionalDependencies": {
     "@appthreat/atom": "3.1.1",
-    "@appthreat/atom-parsetools": "1.7.0",
-    "@bufbuild/protobuf": "2.15.0",
+    "@appthreat/atom-parsetools": "1.10.2",
+    "@bufbuild/protobuf": "2.16.0",
     "@cdxgen/cdx-hbom": "0.5.1",
     "@cdxgen/cdx-proto": "2.3.0",
-    "@cdxgen/cdxgen-plugins-bin": "4.0.0",
-    "@cdxgen/cdxgen-plugins-bin-darwin-amd64": "4.0.0",
-    "@cdxgen/cdxgen-plugins-bin-darwin-arm64": "4.0.0",
-    "@cdxgen/cdxgen-plugins-bin-linux-amd64": "4.0.0",
-    "@cdxgen/cdxgen-plugins-bin-linux-arm": "4.0.0",
-    "@cdxgen/cdxgen-plugins-bin-linux-arm64": "4.0.0",
-    "@cdxgen/cdxgen-plugins-bin-linux-ppc64": "4.0.0",
-    "@cdxgen/cdxgen-plugins-bin-linuxmusl-amd64": "4.0.0",
-    "@cdxgen/cdxgen-plugins-bin-linuxmusl-arm64": "4.0.0",
-    "@cdxgen/cdxgen-plugins-bin-windows-amd64": "4.0.0",
-    "@cdxgen/cdxgen-plugins-bin-windows-arm64": "4.0.0",
-    "@cdxgen/safer-exec": "0.16.0",
+    "@cdxgen/cdxgen-plugins-bin": "4.1.1",
+    "@cdxgen/cdxgen-plugins-bin-darwin-amd64": "4.1.1",
+    "@cdxgen/cdxgen-plugins-bin-darwin-arm64": "4.1.1",
+    "@cdxgen/cdxgen-plugins-bin-linux-amd64": "4.1.1",
+    "@cdxgen/cdxgen-plugins-bin-linux-arm": "4.1.1",
+    "@cdxgen/cdxgen-plugins-bin-linux-arm64": "4.1.1",
+    "@cdxgen/cdxgen-plugins-bin-linux-ppc64": "4.1.1",
+    "@cdxgen/cdxgen-plugins-bin-linuxmusl-amd64": "4.1.1",
+    "@cdxgen/cdxgen-plugins-bin-linuxmusl-arm64": "4.1.1",
+    "@cdxgen/cdxgen-plugins-bin-windows-amd64": "4.1.1",
+    "@cdxgen/cdxgen-plugins-bin-windows-arm64": "4.1.1",
+    "@cdxgen/safer-exec": "1.1.2",
     "body-parser": "2.3.0",
     "compression": "1.8.2",
     "connect": "3.7.0",

package/types/lib/audit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/audit/index.js"],"names":[],"mappings":"AA6EA,yFAAyF;AACzF,eAAO,MAAM,wBAAwB,UAKpC,CAAC;AAuCF;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAHxB,MAGwB,GAFtB,MAAM,CAclB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAHxB,MAGwB,GAFtB,MAAM,EAAE,CAoBpB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAAE,CA0BjD;AA+CD;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAAC,SAAS,EAJ9C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAIW,EAAE,OAAO,AAH/D,CACA,EADQ,MAG4D,GAF1D,OAAO,CAAC,MAAM,CAAC,CAuG3B;AA4bD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAHtC,MAGsC,GAFpC,MAAM,EAAE,CAqdpB;AA0JD;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAJ1C,MAI0C,EAAE,MAAM,EAHlD,MAGkD,GAFhD;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CA0CnD;AAoCD;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAL1C,MAK0C,EAAE,MAAM,EAJlD,MAIkD,EAAE,UAAU,EAH9D,MAG8D,GAF5D;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CASnD;AAmGD;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAJ/C,MAI+C,EAAE,MAAM,EAHvD,MAGuD,GAFrD,MAAM,EAAE,CAkEpB;AAgKD;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAwQ3B;AAoVD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAAM,EAGwB,GAF5B,MAAM,EAAE,CAgDpB;AAoBD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,SAAS,EAJrC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAIE,EAAE,OAAO,EAH9C,MAG8C,GAF5C,OAAO,CAAC,MAAM,CAAC,CAiJ3B;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAH3B,MAG2B,GAFzB,OAAO,CAAC,MAAM,CAAC,CA0B3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EALnC,MAKmC,EAAE,SAAS,EAJ9C,MAAM,EAIwC,EAAE,MAAM,EAHtD,MAAM,GAAC,IAG+C,GAFpD,IAAI,CAwChB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAwChD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,GAF5B,MAAM,GAAG,SAAS,CAU9B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/audit/index.js"],"names":[],"mappings":"AA6EA,yFAAyF;AACzF,eAAO,MAAM,wBAAwB,UAKpC,CAAC;AAuCF;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAHxB,MAGwB,GAFtB,MAAM,CAclB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAHxB,MAGwB,GAFtB,MAAM,EAAE,CAoBpB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAH1B,MAG0B,GAFxB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAAE,CA0BjD;AA+CD;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAAC,SAAS,EAJ9C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAIW,EAAE,OAAO,AAH/D,CACA,EADQ,MAG4D,GAF1D,OAAO,CAAC,MAAM,CAAC,CAuG3B;AAidD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAHtC,MAGsC,GAFpC,MAAM,EAAE,CAqdpB;AA+JD;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAJ1C,MAI0C,EAAE,MAAM,EAHlD,MAGkD,GAFhD;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CA0CnD;AAoCD;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAL1C,MAK0C,EAAE,MAAM,EAJlD,MAIkD,EAAE,UAAU,EAH9D,MAG8D,GAF5D;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CASnD;AAmGD;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAJ/C,MAI+C,EAAE,MAAM,EAHvD,MAGuD,GAFrD,MAAM,EAAE,CAkEpB;AAgKD;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAwQ3B;AAoVD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAAM,EAGwB,GAF5B,MAAM,EAAE,CAgDpB;AAoBD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,SAAS,EAJrC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAIE,EAAE,OAAO,EAH9C,MAG8C,GAF5C,OAAO,CAAC,MAAM,CAAC,CAuJ3B;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAH3B,MAG2B,GAFzB,OAAO,CAAC,MAAM,CAAC,CA0B3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EALnC,MAKmC,EAAE,SAAS,EAJ9C,MAAM,EAIwC,EAAE,MAAM,EAHtD,MAAM,GAAC,IAG+C,GAFpD,IAAI,CAwChB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAwChD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAH9B,MAG8B,GAF5B,MAAM,GAAG,SAAS,CAU9B"}

package/types/lib/cli/bomAssembly.d.ts

@@ -65,7 +65,8 @@ export declare const componentToSimpleFullName: (comp: object) => string;
 /**
  * Strips transient keys (`evidence`, `_integrity`, `license`, `qualifiers`,
  * `repository`, `homepage`) from a parent component while preserving licenses
- * and external references (bug #1519).
+ * and external references (bug #1519). External references whose URL is not a
+ * valid IRI reference are dropped.
  *
  * @param {object} comp Parent component to clean in place
  * @returns {object} The cleaned parent component

package/types/lib/cli/bomAssembly.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bomAssembly.d.ts","sourceRoot":"","sources":["../../../lib/cli/bomAssembly.js"],"names":[],"mappings":"AA8DA;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,aAJ7B,MAAM,qBACN,MAAM,EAAE,KACN,OAsBZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,EAFf,MAG8E,CAAC;AAEzF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,0CAH9B,MAAM;;;;;CAwChB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,YAJ1B,MAAM,KACJ,MAAM,GAAC,SAyBnB,CAAC;AAqFF;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,YALjB,MAAM,YACN,MAAM,KACJ;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CA+CrD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,SAH3B,MAAM,KACJ,MAQZ,CAAC;AAEF;;;;;;;GAOG;AAGH,eAAO,MAAM,oBAAoB,SALtB,MAAM,KACJ,MAwBZ,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,YAHnB,MAAM,KACJ,MAAM,EAgBlB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,YAHtB,MAAM,UAwBhB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,eAAe,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;;;qBAzJhD,MAAM,EAAE;gBAAU,MAAM,EAAE;;;;EA0gBrD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAH/B,QAAQ,MAGuB,SAyCzC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAN3B,MAM2B,EAAE,UAAU,EALvC,MAKuC,EAAE,GAAG,EAJ5C,MAI4C,EAAE,KAAK,GAHnD,MAG2D,GAFzD,MAAM,EAAE,CAcpB;AAED;;;;GAIG;AAEH,eAAO,MAAM,cAAc,EAHjB,MAAM,EAGqD,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAFxB,MAEyC,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAJjC,MAIiC,EAAE,YAAY,EAH/C,MAG+C,GAF7C,MAAM,EAAE,CASpB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAOpB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAHlC,MAGkC,GAFhC,GAAG,CAAC,MAAM,CAAC,CA6BvB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAJxC,MAIwC,EAAE,GAAG,EAH7C,MAG6C,GAF3C,OAAO,CAiBnB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,OAAO,KAAA,EACP,UAAU,KAAA,EACV,GAAG,KAAA,EACH,KAAK,KAAA,EACL,OAAO,KAAA,EACP,SAAS,UAAQ,QA6PlB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,KAAA,OA+EvC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,KAAA,EAAE,SAAS,KAAA,QA6B3C;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,KAAA,EAAE,MAAM,KAAA,EAAE,SAAS,KAAA,QAMtD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAJ7B,MAI6B,EAAE,MAAM,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CAoB5B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,YAPhB,MAAM,WACN,MAAM,SACN,MAAM,WACN,MAAM,KAEJ,MA+FZ,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAI5B;AAiDD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAHzC,MAGyC,GAFvC,MAAM,EAAE,CAMpB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAHxC,MAGwC,GAFtC,MAAM,EAAE,CAMpB;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,wBAAwB,EALf,MAAM,EAKS,EACxB,wBAAwB,EALf,MAAM,EAKS,GAJb,MAAM,EAAE,CASpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAHxC,MAGwC,GAFtC,MAAM,EAAE,CAyBpB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAHpC,MAGoC,GAFlC,MAAM,GAAC,SAAS,CAS5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,wBAAwB,EAHtD,MAAM,EAGgD,GAFpD,OAAO,CAInB;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EALvC,MAAM,EAKiC,EAAE,aAAa,EAJtD,MAIsD,EAAE,OAAO,EAH/D,GAAG,CAAC,MAAM,CAGqD,GAF7D,MAAM,EAAE,CAgBpB;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,QAAQ,EAH9C,MAAM,EAGwC,GAF5C,MAAM,EAAE,CAQpB;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EALvC,MAKuC,EAAE,KAAK,EAJ9C,MAI8C,EAAE,QAAQ,EAHxD,MAAM,EAGkD,GAFtD,MAAM,CAIlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAJvC,MAIuC,EAAE,aAAa,EAHtD,MAGsD,GAFpD,IAAI,CAyDhB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAPtB,MAOsB,EAAE,UAAU,OAAA,EAAE,eAAe,EALnD,MAKmD,EAAE,YAAY,OAAA,GAF/D,MAAM,CA8ClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,YAJjC,MAAM,mBACN,MAAM,KACJ,OAYZ,CAAC"}
+{"version":3,"file":"bomAssembly.d.ts","sourceRoot":"","sources":["../../../lib/cli/bomAssembly.js"],"names":[],"mappings":"AAgEA;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,aAJ7B,MAAM,qBACN,MAAM,EAAE,KACN,OAsBZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,EAFf,MAG8E,CAAC;AAEzF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,0CAH9B,MAAM;;;;;CAwChB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,YAJ1B,MAAM,KACJ,MAAM,GAAC,SAyBnB,CAAC;AA8GF;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,YALjB,MAAM,YACN,MAAM,KACJ;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CA+CrD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,SAH3B,MAAM,KACJ,MAQZ,CAAC;AAEF;;;;;;;;GAQG;AAGH,eAAO,MAAM,oBAAoB,SALtB,MAAM,KACJ,MA6BZ,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,YAHnB,MAAM,KACJ,MAAM,EAgBlB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,YAHtB,MAAM,UAwBhB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,eAAe,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;;;qBA/JhD,MAAM,EAAE;gBAAU,MAAM,EAAE;;;;EAshBrD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAH/B,QAAQ,MAGuB,SA0CzC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAN3B,MAM2B,EAAE,UAAU,EALvC,MAKuC,EAAE,GAAG,EAJ5C,MAI4C,EAAE,KAAK,GAHnD,MAG2D,GAFzD,MAAM,EAAE,CAcpB;AAED;;;;GAIG;AAEH,eAAO,MAAM,cAAc,EAHjB,MAAM,EAGqD,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAFxB,MAEyC,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAJjC,MAIiC,EAAE,YAAY,EAH/C,MAG+C,GAF7C,MAAM,EAAE,CASpB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAOpB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAHlC,MAGkC,GAFhC,GAAG,CAAC,MAAM,CAAC,CA6BvB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAJxC,MAIwC,EAAE,GAAG,EAH7C,MAG6C,GAF3C,OAAO,CAiBnB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,OAAO,KAAA,EACP,UAAU,KAAA,EACV,GAAG,KAAA,EACH,KAAK,KAAA,EACL,OAAO,KAAA,EACP,SAAS,UAAQ,QAqRlB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,KAAA,OAkGvC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,KAAA,EAAE,SAAS,KAAA,QA6B3C;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,KAAA,EAAE,MAAM,KAAA,EAAE,SAAS,KAAA,QAMtD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAJ7B,MAI6B,EAAE,MAAM,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CAoB5B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,YAPhB,MAAM,WACN,MAAM,SACN,MAAM,WACN,MAAM,KAEJ,MAsGZ,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAI5B;AAiDD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAHzC,MAGyC,GAFvC,MAAM,EAAE,CAMpB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAHxC,MAGwC,GAFtC,MAAM,EAAE,CAMpB;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,wBAAwB,EALf,MAAM,EAKS,EACxB,wBAAwB,EALf,MAAM,EAKS,GAJb,MAAM,EAAE,CASpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAHxC,MAGwC,GAFtC,MAAM,EAAE,CAyBpB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAHpC,MAGoC,GAFlC,MAAM,GAAC,SAAS,CAS5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,wBAAwB,EAHtD,MAAM,EAGgD,GAFpD,OAAO,CAInB;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EALvC,MAAM,EAKiC,EAAE,aAAa,EAJtD,MAIsD,EAAE,OAAO,EAH/D,GAAG,CAAC,MAAM,CAGqD,GAF7D,MAAM,EAAE,CAgBpB;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,QAAQ,EAH9C,MAAM,EAGwC,GAF5C,MAAM,EAAE,CAQpB;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EALvC,MAKuC,EAAE,KAAK,EAJ9C,MAI8C,EAAE,QAAQ,EAHxD,MAAM,EAGkD,GAFtD,MAAM,CAIlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAJvC,MAIuC,EAAE,aAAa,EAHtD,MAGsD,GAFpD,IAAI,CAyDhB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAPtB,MAOsB,EAAE,UAAU,OAAA,EAAE,eAAe,EALnD,MAKmD,EAAE,YAAY,OAAA,GAF/D,MAAM,CA8ClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,YAJjC,MAAM,mBACN,MAAM,KACJ,OAYZ,CAAC"}

package/types/lib/cli/cliOptions.d.ts

@@ -37,6 +37,33 @@ export declare function validateSpecVersion(specVersion: number, commandName?: s
  * @returns {boolean}  True when the user explicitly set this flag
  */
 export declare function isUserProvided(value: any, yaDefault: any): boolean;
+/**
+ * Combine the custom metadata properties of every source (discussion 4391):
+ * the `--metadata-property` flag, the CDXGEN_METADATA_PROPERTY and
+ * CDXGEN_METADATA_PROPERTIES environment variables, and a config file's
+ * `metadata-property` or `metadataProperties` entry.
+ *
+ * yargs would let the highest-precedence source replace the others outright,
+ * so each is read on its own and they are merged instead. A name set by more
+ * than one source takes its values from the one that wins in the usual order
+ * — the command line, then the environment, then the config file — while a
+ * source may repeat a name for a multi-valued property.
+ *
+ * @param {object} args Parsed yargs argv
+ * @param {object} [context]
+ * @param {string[]} [context.argv] Raw command-line arguments, which tell a
+ *   flag on the command line from one yargs filled in from elsewhere
+ * @param {object} [context.projectConfig] The sanitized config file contents.
+ *   Without it, a programmatic caller's `args` are taken as the config.
+ * @returns {{name: string, value: string}[]} The merged properties
+ */
+export declare function resolveMetadataProperties(args: object, { argv, projectConfig }?: {
+    argv?: string[];
+    projectConfig?: object;
+}): {
+    name: string;
+    value: string;
+}[];
 /**
  * Apply command-name-based defaults to the raw parsed args. When cdxgen is
  * invoked via a symlink or alias (e.g. `obom`, `cbom`, `spdxgen`, `aibom`),
@@ -50,10 +77,11 @@ export declare function isUserProvided(value: any, yaDefault: any): boolean;
  * @returns {object} A shallow copy of args with alias-based defaults applied
  */
 export declare function applyCommandNameDefaults(args: object, invokedCommandName: string): object;
-export declare function buildInitialOptions(args: any, { filePath, isRemoteOrPurl, argv }: {
+export declare function buildInitialOptions(args: any, { filePath, isRemoteOrPurl, argv, projectConfig }: {
     argv?: any;
     filePath: any;
     isRemoteOrPurl: any;
+    projectConfig: any;
 }): any;
 export type OptionsWarning = {
     /**
@@ -141,6 +169,9 @@ export declare function applyAdvancedOptions(options: object, context?: {
  *                                             passed `--spec-version`
  * @param {boolean} [context.isDryRun=false]   Dry-run mode
  * @param {boolean} [context.isSecureMode]     Secure mode
+ * @param {object} [context.projectConfig]     Sanitized config file contents,
+ *                                             whose metadata properties merge
+ *                                             with the other sources'
  * @returns {{ options: object, warnings: OptionsWarning[] }}
  */
 export declare function buildOptionsFromArgs(args: object, context: {
@@ -150,6 +181,7 @@ export declare function buildOptionsFromArgs(args: object, context: {
     userSetSpecVersion: boolean;
     isDryRun?: boolean;
     isSecureMode?: boolean;
+    projectConfig?: object;
 }): {
     options: object;
     warnings: OptionsWarning[];

package/types/lib/cli/cliOptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cliOptions.d.ts","sourceRoot":"","sources":["../../../lib/cli/cliOptions.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAoBH;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAJpC,MAIoC,EAAE,WAAW,AAHzD,CACA,EADQ,MAG4D,GAF1D,MAAM,GAAC,IAAI,CAoBvB;AA4CD;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAJzB,GAIyB,EAAE,SAAS,EAHpC,GAGoC,GAFlC,OAAO,CAInB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,kBAAkB,EAHtD,MAGsD,GAFpD,MAAM,CAoBlB;AAqED,wBAAgB,mBAAmB,CACjC,IAAI,KAAA,EACJ,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAmB,EAAE;;;;CAAA,OA8ClD;AAqBE,YAAkB,cAAc,GAChC;;;;IAAkC,KAAK,EAA5B,MAAM,GAAC,MAAM,GAAC,OAAO,CAChC;;;;IAAkC,OAAO,EAA9B,MAAM,CACnB;CAAA,CAAA;AAJD;;;;GAIG;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAR3C,MAQ2C,EAAE,OAAO,EAN5D;IAAwB,kBAAkB,EAAlC,MAAM,CACd;IAAyB,kBAAkB,EAAnC,OAAO,CAEf;IAA0B,QAAQ,AAAlC,CACA,EADQ,OAAO,CACf;CAE4D,GAFlD,cAAc,EAAE,CA6G5B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EALjC,MAKiC,EAAE,OAAO,AAJlD,CAEA,EADA;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;CAEuD,GAF7C,cAAc,EAAE,CAqI5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAX9B,MAW8B,EAAE,OAAO,EAT/C;IAAwB,kBAAkB,EAAlC,MAAM,CACd;IAAwB,QAAQ,EAAxB,MAAM,CACd;IAAyB,cAAc,EAA/B,OAAO,CACf;IAAyB,kBAAkB,EAAnC,OAAO,CAEf;IAA0B,QAAQ,AAAlC,CACA,EADQ,OAAO,CACf;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;CAE+C,GAFrC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;CAAE,CA6B3D"}
+{"version":3,"file":"cliOptions.d.ts","sourceRoot":"","sources":["../../../lib/cli/cliOptions.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAwBH;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAJpC,MAIoC,EAAE,WAAW,AAHzD,CACA,EADQ,MAG4D,GAF1D,MAAM,GAAC,IAAI,CAoBvB;AA4CD;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAJzB,GAIyB,EAAE,SAAS,EAHpC,GAGoC,GAFlC,OAAO,CAInB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EATK,MASL,EACJ,EAAE,IAAmB,EAAE,aAAa,EAAE,AATrC,CAKA,EAJA;IAA2B,IAAI,AAA/B,CAEA,EAFQ,MAAM,EAAE,CAEhB;IAAyB,aAAa,AAAtC,CAEA,EAFQ,MAAM,CAEd;CAI0C,GAJhC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,EAAE,CAsD3C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,kBAAkB,EAHtD,MAGsD,GAFpD,MAAM,CAoBlB;AAuED,wBAAgB,mBAAmB,CACjC,IAAI,KAAA,EACJ,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAmB,EAAE,aAAa,EAAE;;;;;CAAA,OAqDjE;AAqBE,YAAkB,cAAc,GAChC;;;;IAAkC,KAAK,EAA5B,MAAM,GAAC,MAAM,GAAC,OAAO,CAChC;;;;IAAkC,OAAO,EAA9B,MAAM,CACnB;CAAA,CAAA;AAJD;;;;GAIG;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAR3C,MAQ2C,EAAE,OAAO,EAN5D;IAAwB,kBAAkB,EAAlC,MAAM,CACd;IAAyB,kBAAkB,EAAnC,OAAO,CAEf;IAA0B,QAAQ,AAAlC,CACA,EADQ,OAAO,CACf;CAE4D,GAFlD,cAAc,EAAE,CA6G5B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EALjC,MAKiC,EAAE,OAAO,AAJlD,CAEA,EADA;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;CAEuD,GAF7C,cAAc,EAAE,CAqI5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAd9B,MAc8B,EAAE,OAAO,EAZ/C;IAAwB,kBAAkB,EAAlC,MAAM,CACd;IAAwB,QAAQ,EAAxB,MAAM,CACd;IAAyB,cAAc,EAA/B,OAAO,CACf;IAAyB,kBAAkB,EAAnC,OAAO,CAEf;IAA0B,QAAQ,AAAlC,CACA,EADQ,OAAO,CACf;IAA0B,YAAY,AAAtC,CACA,EADQ,OAAO,CACf;IAAyB,aAAa,AAAtC,CAGA,EAHQ,MAAM,CAGd;CAE+C,GAFrC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;CAAE,CA+B3D"}

package/types/lib/cli/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/cli/index.js"],"names":[],"mappings":"AAyEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAuCnE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,aAAa,EACb,wBAAwB,EACxB,eAAe,EACf,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA0C1D,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,eAAe,EACf,UAAU,EACV,aAAa,EACb,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,YAAY,EACZ,eAAe,EACf,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,aAAa,EACb,cAAc,EACd,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AA8BxB;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,OAAO,CAAC,MAAM,CAAC,CAwE3B;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,OAAO,EAHnD,MAGmD,GAFjD,OAAO,CAAC,MAAM,CAAC,CAkU3B;AAgCD;;;;;;GAMG;AACH;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAGF,GAF1B,MAAM,CAUlB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAAM,EAG4B,GAFhC,MAAM,CAalB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EALnC,MAAM,GAAC,MAAM,EAKsB,EAAE,OAAO,EAJ5C,MAI4C,GAH1C,OAAO,CAAC,MAAM,CAAC,CAqmC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CAoD3B;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CA0gBrC;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,CAAC,CAsB3B;AAED;;;;;;GAMG;AACH;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,OAAO,CAAC,MAAM,CAAC,CAa3B;AA0XD;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,IAAI,EALzB,MAKyB,EAAE,WAAW,EAJtC,MAIsC,GAHrC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CA+FjD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/cli/index.js"],"names":[],"mappings":"AA2EA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAwCnE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,aAAa,EACb,wBAAwB,EACxB,eAAe,EACf,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA0C1D,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,eAAe,EACf,UAAU,EACV,aAAa,EACb,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,YAAY,EACZ,eAAe,EACf,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,aAAa,EACb,cAAc,EACd,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AA8BxB;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAJtB,MAIsB,EAAE,OAAO,EAH/B,MAG+B,GAF7B,OAAO,CAAC,MAAM,CAAC,CAwE3B;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAJ1C,MAI0C,EAAE,OAAO,EAHnD,MAGmD,GAFjD,OAAO,CAAC,MAAM,CAAC,CAkU3B;AAgCD;;;;;;GAMG;AACH;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAH5B,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAGF,GAF1B,MAAM,CAUlB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAHlC,MAAM,EAG4B,GAFhC,MAAM,CAalB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EALnC,MAAM,GAAC,MAAM,EAKsB,EAAE,OAAO,EAJ5C,MAI4C,GAH1C,OAAO,CAAC,MAAM,CAAC,CAkqC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAJhC,MAIgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CAoF3B;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAsgBrC;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAJ3B,MAI2B,EAAE,OAAO,EAHpC,MAGoC,GAFlC,OAAO,CAAC,MAAM,CAAC,CAsB3B;AAED;;;;;;GAMG;AACH;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,OAAO,CAAC,MAAM,CAAC,CAa3B;AAgYD;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,IAAI,EALzB,MAKyB,EAAE,WAAW,EAJtC,MAIsC,GAHrC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CA+FjD"}

package/types/lib/cli/jsBom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jsBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jsBom.js"],"names":[],"mappings":"AAqGA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAwB5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAy1C3B;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAE4C,CAAC;AAEvD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,YAJ9B,KAAK,CAAC,MAAM,CAAC,cACb,MAAM,KACJ,KAAK,CAAC,MAAM,CAwExB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CA6C3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CA+F3B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EANhC,MAMgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CA6B3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAoN3B;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CAoD3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CA2ChE;AAED;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CACjD,aAAa,EANJ,MAMI,EACb,OAAO,EANE,MAMF,EACP,OAAO,EANE,MAAM,EAMR,EACP,YAAY,EANH,MAAM,EAMH,iBAsBb"}
+{"version":3,"file":"jsBom.d.ts","sourceRoot":"","sources":["../../../lib/cli/jsBom.js"],"names":[],"mappings":"AAiHA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAwB5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,OAAO,CAAC,MAAM,CAAC,CAq3C3B;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAFtB,MAE4C,CAAC;AAEvD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,YAJ9B,KAAK,CAAC,MAAM,CAAC,cACb,MAAM,KACJ,KAAK,CAAC,MAAM,CAwExB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAmD3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CA+F3B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EANhC,MAMgC,EAAE,OAAO,EAHzC,MAGyC,GAFvC,OAAO,CAAC,MAAM,CAAC,CA6B3B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAJ7B,MAI6B,EAAE,OAAO,EAHtC,MAGsC,GAFpC,OAAO,CAAC,MAAM,CAAC,CAoN3B;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAJxC,MAIwC,EAAE,OAAO,EAHjD,MAGiD,GAF/C,OAAO,CAAC,MAAM,CAAC,CAoD3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,GAF5C,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CA2ChE;AAED;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CACjD,aAAa,EANJ,MAMI,EACb,OAAO,EANE,MAMF,EACP,OAAO,EANE,MAAM,EAMR,EACP,YAAY,EANH,MAAM,EAMH,iBAsBb"}