@cdxgen/cdxgen 13.5.0 → 13.7.0

package/lib/inventory/aiInventory.js

@@ -43,6 +43,7 @@ const AI_INVENTORY_FILE_KINDS = new Set([
   "agent-config",
   "agent-definition",
   "agent-instructions",
+  "agent-spec",
   "ai-agent-file",
   "copilot-instructions",
   "copilot-setup-workflow",
@@ -52,6 +53,10 @@ const AI_INVENTORY_FILE_KINDS = new Set([
   "custom-command",
   "custom-tool",
   "graph-definition",
+  "hook-file",
+  "permission-policy",
+  "settings",
+  "workflow-file",
   AI_SKILL_FILE_KIND,
 ]);
 
@@ -80,6 +85,11 @@ const AI_INVENTORY_PARSERS = [
     id: communityAiConfigParser.id,
     parser: communityAiConfigParser,
     types: ["ai-skill"],
+    // The community agent configurations (.kiro, .cursor/rules,
+    // .claude/agents, and similar) also belong in an AI-BOM next to the
+    // models and services, so `-t ai` runs this parser and keeps its
+    // ai-skill components.
+    aiOverlay: true,
   },
 ];
 
@@ -301,8 +311,23 @@ export function collectAiInventory(discoveryPath, options, types) {
   let components = [];
   const dependencies = [];
   let services = [];
+  // Output of an aiOverlay parser that runs only because `-t ai` was
+  // requested. It is filtered with ai-skill added to the requested types, and
+  // kept apart so the extra type never widens the filter for other parsers
+  // or the language collectors. `--exclude-type ai-skill` turns it off.
+  const overlayTypes = uniqueNonEmptyTypes([...requestedTypes, "ai-skill"]);
+  const overlayEnabled =
+    requestedTypes.includes("ai") &&
+    !requestedTypes.includes("ai-skill") &&
+    !optionIncludesAiInventoryProjectType(options?.excludeType, "ai-skill");
+  let overlayComponents = [];
+  let overlayServices = [];
   for (const parserEntry of AI_INVENTORY_PARSERS) {
-    if (!parserEntry.types.some((type) => requestedTypes.includes(type))) {
+    const requested = parserEntry.types.some((type) =>
+      requestedTypes.includes(type),
+    );
+    const isOverlay = !requested && overlayEnabled && parserEntry.aiOverlay;
+    if (!requested && !isOverlay) {
       continue;
     }
     const matchedFiles = [];
@@ -326,11 +351,20 @@ export function collectAiInventory(discoveryPath, options, types) {
       );
       continue;
     }
-    if (result?.components?.length) {
-      components = components.concat(result.components);
-    }
-    if (result?.services?.length) {
-      services = mergeServices(services, result.services);
+    if (isOverlay) {
+      overlayComponents = overlayComponents.concat(
+        filterInventorySubjectsByTypes(result?.components, overlayTypes),
+      );
+      overlayServices = overlayServices.concat(
+        filterInventorySubjectsByTypes(result?.services, overlayTypes),
+      );
+    } else {
+      if (result?.components?.length) {
+        components = components.concat(result.components);
+      }
+      if (result?.services?.length) {
+        services = mergeServices(services, result.services);
+      }
     }
     if (result?.dependencies?.length) {
       dependencies.push(...result.dependencies);
@@ -365,11 +399,13 @@ export function collectAiInventory(discoveryPath, options, types) {
   }
 
   components = trimComponents(
-    filterInventorySubjectsByTypes(components, requestedTypes),
+    filterInventorySubjectsByTypes(components, requestedTypes).concat(
+      overlayComponents,
+    ),
   );
   services = mergeServices(
-    [],
     filterInventorySubjectsByTypes(services, requestedTypes),
+    overlayServices,
   );
   return {
     components,

package/lib/inventory/aiProviders.js

@@ -0,0 +1,324 @@
+/**
+ * Organisations that create AI models, keyed by the short creator id cdxgen
+ * uses internally. The value is the full organisation name written to the
+ * `manufacturer` of a model component, since the minimum elements guidance
+ * asks for full names rather than acronyms or product names.
+ */
+export const MODEL_CREATOR_NAMES = new Map([
+  ["alibaba", "Alibaba Cloud"],
+  ["anthropic", "Anthropic"],
+  ["cohere", "Cohere"],
+  ["deepseek", "DeepSeek"],
+  ["google", "Google"],
+  ["meta", "Meta"],
+  ["mistral", "Mistral AI"],
+  ["openai", "OpenAI"],
+  ["xai", "xAI"],
+  ["zhipu", "Zhipu AI"],
+]);
+
+/**
+ * Providers that are a creator's own SDK or API, mapped to that creator.
+ * Hosting, routing and local providers such as groq, together, fireworks,
+ * openrouter, replicate, aws-bedrock, azure-openai, vertex-ai, huggingface
+ * and ollama serve models other organisations made, so they are absent.
+ */
+const CREATOR_OWN_PROVIDERS = new Map([
+  ["anthropic", "anthropic"],
+  ["cohere", "cohere"],
+  ["dashscope", "alibaba"],
+  ["deepseek", "deepseek"],
+  ["gemini", "google"],
+  ["google", "google"],
+  ["meta", "meta"],
+  ["mistral", "mistral"],
+  ["openai", "openai"],
+  ["xai", "xai"],
+  ["zhipu", "zhipu"],
+]);
+
+// Creators whose own API serves only the models they made, so any model
+// called through that API is theirs even when its name is not recognised.
+// OpenAI-compatible clients, Google (Vertex Model Garden) and DashScope also
+// serve models from other creators, so they are not in this set.
+const SINGLE_CATALOGUE_CREATORS = new Set([
+  "anthropic",
+  "cohere",
+  "deepseek",
+  "mistral",
+  "xai",
+  "zhipu",
+]);
+
+/**
+ * Local runtimes and inference servers. They serve whatever tag or served
+ * model name the user chose, so a model they run names no creator.
+ */
+export const LOCAL_MODEL_RUNTIMES = new Set([
+  "gpt4all",
+  "jan",
+  "llama.cpp",
+  "llamafile",
+  "lm-studio",
+  "local",
+  "local-inference",
+  "mlc",
+  "ollama",
+  "vllm",
+  "xinference",
+]);
+
+// Provider prefixes of model routes such as the litellm `groq/llama3-8b`
+// form, mapped to the provider the route names. Matching is case-sensitive
+// because the routes are lowercase while some Hugging Face organisations
+// share the name in another case (Groq, Anthropic, Cohere). Prefixes that are
+// also real lowercase Hub organisations (openai, google, databricks,
+// cerebras, huggingface) are left out.
+const MODEL_ROUTE_PROVIDERS = new Map([
+  ["anthropic", "anthropic"],
+  ["azure", "azure-openai"],
+  ["azure_ai", "azure-ai"],
+  ["bedrock", "aws-bedrock"],
+  ["codestral", "mistral"],
+  ["cohere", "cohere"],
+  ["cohere_chat", "cohere"],
+  ["dashscope", "dashscope"],
+  ["deepseek", "deepseek"],
+  ["fireworks_ai", "fireworks"],
+  ["friendliai", "friendliai"],
+  ["gemini", "gemini"],
+  ["groq", "groq"],
+  ["hosted_vllm", "vllm"],
+  ["llamafile", "llamafile"],
+  ["lm_studio", "lm-studio"],
+  ["mistral", "mistral"],
+  ["moonshot", "moonshot"],
+  ["nvidia_nim", "nvidia-nim"],
+  ["ollama", "ollama"],
+  ["ollama_chat", "ollama"],
+  ["openrouter", "openrouter"],
+  ["perplexity", "perplexity"],
+  ["replicate", "replicate"],
+  ["sagemaker", "aws-sagemaker"],
+  ["sambanova", "sambanova"],
+  ["together_ai", "together"],
+  ["vertex_ai", "vertex-ai"],
+  ["watsonx", "watsonx"],
+  ["xai", "xai"],
+  ["xinference", "xinference"],
+]);
+
+// Google API resource collections that hold a model name, as in
+// `models/gemini-1.5-flash` or `tunedModels/my-model`.
+const GOOGLE_MODEL_COLLECTIONS = new Set(["models", "tunedModels"]);
+
+// Model name prefixes that only one creator publishes under. A prefix, not a
+// substring, so a community fine-tune such as openhermes-2.5-mistral-7b is
+// not credited to Mistral AI. The OpenAI entries name its model lines,
+// because a bare gpt prefix also covers open-weight families from other
+// creators (gpt-j, gpt-neo, gpt-neox, gpt-sw3, gpt4all).
+const MODEL_NAME_CREATOR_PREFIXES = [
+  ["chatgpt", "openai"],
+  ["claude", "anthropic"],
+  ["codestral", "mistral"],
+  ["command-r", "cohere"],
+  ["dall-e", "openai"],
+  ["deepseek", "deepseek"],
+  ["gemini", "google"],
+  ["gemma", "google"],
+  ["glm", "zhipu"],
+  ["gpt-3", "openai"],
+  ["gpt-4", "openai"],
+  ["gpt-5", "openai"],
+  ["gpt-audio", "openai"],
+  ["gpt-image", "openai"],
+  ["gpt-oss", "openai"],
+  ["gpt-realtime", "openai"],
+  ["gpt2", "openai"],
+  ["grok", "xai"],
+  ["llama", "meta"],
+  ["meta-llama", "meta"],
+  ["mistral", "mistral"],
+  ["mixtral", "mistral"],
+  ["qwen", "alibaba"],
+  ["text-embedding-3", "openai"],
+  ["text-embedding-ada", "openai"],
+];
+
+// Spellings of a creator's name, compared after lowercasing and dropping
+// everything but letters and digits. They cover the creator ids, the full
+// names, the creators' own Hugging Face organisations and the way GGUF
+// converters write general.organization ("Meta Llama", "Mistralai").
+const MODEL_CREATOR_ALIASES = new Map([
+  ["alibaba", "alibaba"],
+  ["alibabacloud", "alibaba"],
+  ["qwen", "alibaba"],
+  ["anthropic", "anthropic"],
+  ["cohere", "cohere"],
+  ["cohereforai", "cohere"],
+  ["coherelabs", "cohere"],
+  ["deepseek", "deepseek"],
+  ["deepseekai", "deepseek"],
+  ["google", "google"],
+  ["googledeepmind", "google"],
+  ["facebook", "meta"],
+  ["meta", "meta"],
+  ["metallama", "meta"],
+  ["mistral", "mistral"],
+  ["mistralai", "mistral"],
+  ["openai", "openai"],
+  ["xai", "xai"],
+  ["xaiorg", "xai"],
+  ["thudm", "zhipu"],
+  ["zaiorg", "zhipu"],
+  ["zhipu", "zhipu"],
+  ["zhipuai", "zhipu"],
+]);
+
+const normalizeProviderId = (provider) =>
+  typeof provider === "string" ? provider.trim().toLowerCase() : "";
+
+const aliasKey = (value) =>
+  String(value || "")
+    .toLowerCase()
+    .replace(/[^a-z0-9]/gu, "");
+
+/**
+ * Split a model reference written in source code into the route provider it
+ * names, if any, and the model name a creator lookup should read.
+ *
+ * `groq/llama3-8b-8192` names the groq route and the model `llama3-8b-8192`.
+ * `models/gemini-1.5-flash`, `tunedModels/x` and
+ * `projects/p/locations/l/publishers/google/models/gemini-1.5-pro` are Google
+ * API resource names, and the model is the part after the last `models`
+ * segment. Neither form is a Hugging Face repository id.
+ *
+ * @param {string} modelId Model reference as written in the source
+ * @returns {{ name: string, nonHub: boolean, route?: string, routeProvider?: string }}
+ *   The model name, whether the reference is not a Hub repository id, and the
+ *   route and its provider when one is named
+ */
+export function splitModelReference(modelId) {
+  const value = String(modelId || "").trim();
+  const segments = value.split("/");
+  if (segments.length < 2 || segments.some((segment) => !segment)) {
+    return { name: value, nonHub: false };
+  }
+  if (GOOGLE_MODEL_COLLECTIONS.has(segments[0])) {
+    return { name: segments.slice(1).join("/"), nonHub: true };
+  }
+  const publishersIndex = segments.indexOf("publishers");
+  const modelsIndex = segments.lastIndexOf("models");
+  if (publishersIndex >= 0 && modelsIndex > publishersIndex) {
+    return { name: segments.slice(modelsIndex + 1).join("/"), nonHub: true };
+  }
+  const routeProvider = MODEL_ROUTE_PROVIDERS.get(segments[0]);
+  if (routeProvider) {
+    return {
+      name: segments.slice(1).join("/"),
+      nonHub: true,
+      route: segments[0],
+      routeProvider,
+    };
+  }
+  return { name: value, nonHub: false };
+}
+
+/**
+ * Name the creator of a model from its name alone, when only one creator
+ * publishes under that name.
+ *
+ * @param {string} modelName Model name without route or namespace
+ * @returns {string|undefined} Creator id
+ */
+export function modelCreatorFromName(modelName) {
+  const normalized = String(modelName || "")
+    .trim()
+    .toLowerCase();
+  for (const [prefix, creator] of MODEL_NAME_CREATOR_PREFIXES) {
+    if (normalized.startsWith(prefix)) {
+      return creator;
+    }
+  }
+  return /^o[134](?:$|[-:])/u.test(normalized) ? "openai" : undefined;
+}
+
+/**
+ * Resolve a creator spelling, such as a Hugging Face organisation or a
+ * GGUF general.organization value, to a known creator id.
+ *
+ * @param {string} name Organisation name or namespace
+ * @returns {string|undefined} Creator id, or undefined when unknown
+ */
+export function modelCreatorFromOrganization(name) {
+  return MODEL_CREATOR_ALIASES.get(aliasKey(name));
+}
+
+/**
+ * Pick the creator of a model that source code calls by name.
+ *
+ * The provider of such a model is the SDK, AI host or route the code uses,
+ * which names the client rather than the model: the openai SDK is the usual
+ * client for self-hosted Llama or DeepSeek servers, and a file may use
+ * several SDKs. So the creator is the one the model name names, when the
+ * provider is that creator, is a hosting or routing service, or the file
+ * also uses the creator's own SDK or host. A different creator's SDK leaves
+ * it unset. A model name that names no creator is credited only to a
+ * provider whose own API serves nothing but its own models. A local runtime
+ * serves whatever tag the user created, so it names no creator, and neither
+ * does a file that only uses a local runtime.
+ *
+ * @param {string} modelId Model reference as written in the source
+ * @param {{ provider?: string, fileProviders?: Iterable<string>, runtimes?: Iterable<string> }} [context]
+ *   The provider the code declares through an SDK import, AI host or dosai
+ *   report (never a guess from the model name), every provider the file
+ *   references, and the runtimes it uses
+ * @returns {string|undefined} Creator id
+ */
+export function resolveModelCreator(modelId, context = {}) {
+  const reference = splitModelReference(modelId);
+  const provider = normalizeProviderId(
+    reference.routeProvider || context.provider,
+  );
+  if (LOCAL_MODEL_RUNTIMES.has(provider)) {
+    return undefined;
+  }
+  if (
+    !provider &&
+    [...(context.runtimes || [])].some((runtime) =>
+      LOCAL_MODEL_RUNTIMES.has(normalizeProviderId(runtime)),
+    )
+  ) {
+    return undefined;
+  }
+  const nameCreator = modelCreatorFromName(reference.name);
+  const providerCreator = CREATOR_OWN_PROVIDERS.get(provider);
+  if (!nameCreator) {
+    return SINGLE_CATALOGUE_CREATORS.has(providerCreator)
+      ? providerCreator
+      : undefined;
+  }
+  if (!providerCreator || providerCreator === nameCreator) {
+    return nameCreator;
+  }
+  for (const fileProvider of context.fileProviders || []) {
+    if (
+      CREATOR_OWN_PROVIDERS.get(normalizeProviderId(fileProvider)) ===
+      nameCreator
+    ) {
+      return nameCreator;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Build the CycloneDX organisational entity for a creator id.
+ *
+ * @param {string} creator Creator id
+ * @returns {{ name: string }|undefined} Manufacturer entity
+ */
+export function modelCreatorEntity(creator) {
+  const name = MODEL_CREATOR_NAMES.get(creator);
+  return name ? { name } : undefined;
+}

package/lib/inventory/atomUtils.js

@@ -183,6 +183,7 @@ export function findCompileCommands(src, options = {}) {
 }
 
 const atomFrontendArgKeysCache = new Map();
+const atomOptionsCache = new Map();
 
 /**
  * Split an atom command that may carry a leading argument (`node
@@ -271,6 +272,43 @@ export function atomFrontendArgKeys(language) {
   return keys;
 }
 
+/**
+ * The options the installed atom accepts, as `atom --help` lists them. Asked
+ * once per atom command. An atom that fails to start accepts none.
+ *
+ * @returns {Set<string>} Supported options, such as `--bom-file`
+ */
+export function atomOptions() {
+  const command = getAtomCommand();
+  if (atomOptionsCache.has(command)) {
+    return atomOptionsCache.get(command);
+  }
+  const [bin, leadingArg] = splitAtomCommand(command);
+  const args = ["--help"];
+  if (leadingArg !== undefined) {
+    args.unshift(leadingArg);
+  }
+  const env = { ...process.env };
+  if (readEnvironmentVariable("ATOM_JAVA_HOME")) {
+    env.JAVA_HOME = readEnvironmentVariable("ATOM_JAVA_HOME");
+  }
+  const options = new Set();
+  const result = safeSpawnSync(bin, args, {
+    shell: isWin,
+    env,
+    timeout: 120000,
+  });
+  if (result?.status === 0 && result.stdout) {
+    for (const match of `${result.stdout}`.matchAll(
+      /(?:^|\s)(--[a-z][a-z0-9-]*)/g,
+    )) {
+      options.add(match[1]);
+    }
+  }
+  atomOptionsCache.set(command, options);
+  return options;
+}
+
 /**
  * The `--frontend-args` atom takes for a C/C++ language: the project's
  * compilation database, when there is one and the installed atom reads it
@@ -315,6 +353,45 @@ export function atomCompileCommandsArgs(src, language, options = {}) {
   return ["--frontend-args", `compile-commands=${database}`];
 }
 
+/**
+ * The `--bom-file` a reachables slice takes package purls from: the BOM evinse
+ * annotates. atom would otherwise only find a BOM saved as `bom.json` inside
+ * the scanned directory, so a BOM written anywhere else gave every reachable
+ * flow no purl. An atom without `--bom-file` is given the arguments it has
+ * always been given, and still reads a `bom.json` in the scanned directory.
+ *
+ * @param {string} sliceType atom slice command
+ * @param {Object} options CLI options, for `input`
+ * @returns {string[]} Arguments to add to the atom command
+ */
+export function atomBomFileArgs(sliceType, options = {}) {
+  if (
+    sliceType !== "reachables" ||
+    !options?.input ||
+    !safeExistsSync(options.input)
+  ) {
+    return [];
+  }
+  const bomFile = resolve(options.input);
+  // The argument reaches a Windows shell command line through `shell: isWin`
+  // in executeAtom, so a path a shell would interpret is never passed on.
+  if (UNSAFE_SHELL_CHARS_RE.test(bomFile)) {
+    console.warn(
+      `The BOM path ${bomFile} contains characters a shell would interpret. Reachable flows will carry purls only if a bom.json is in the scanned directory.`,
+    );
+    return [];
+  }
+  if (!atomOptions().has("--bom-file")) {
+    if (DEBUG_MODE) {
+      console.log(
+        "The installed atom does not take --bom-file. Reachable flows will carry purls only if a bom.json is in the scanned directory.",
+      );
+    }
+    return [];
+  }
+  return ["--bom-file", bomFile];
+}
+
 /**
  * The arguments that stop atom's Java frontend from running the scanned
  * project's build. In its default delombok mode, atom runs

package/lib/inventory/bomUtils.js

@@ -43,6 +43,13 @@ const COMPONENT_TYPES_1_5 = [
   "data",
 ];
 const COMPONENT_TYPES_1_6 = [...COMPONENT_TYPES_1_5, "cryptographic-asset"];
+// CycloneDX 2.0 keeps every 1.6 type and turns services into components of
+// type `service` (`#/$defs/cyclonedx-component-2.0/$defs/component/properties/type`),
+// next to the new physical type `material`. The draft's enum, quoted:
+// application, framework, library, container, platform, operating-system,
+// device, device-driver, firmware, file, machine-learning-model, data,
+// cryptographic-asset, material, service.
+const COMPONENT_TYPES_2_0 = [...COMPONENT_TYPES_1_6, "material", "service"];
 
 /**
  * Frozen map of CycloneDX spec versions (as "major.minor" strings) to the
@@ -53,7 +60,7 @@ export const CYCLONEDX_COMPONENT_TYPES_BY_SPEC_VERSION = Object.freeze({
   1.5: Object.freeze(COMPONENT_TYPES_1_5),
   1.6: Object.freeze(COMPONENT_TYPES_1_6),
   1.7: Object.freeze(COMPONENT_TYPES_1_6),
-  "2.0": Object.freeze(COMPONENT_TYPES_1_6),
+  "2.0": Object.freeze(COMPONENT_TYPES_2_0),
 });
 
 /**

package/lib/inventory/brotliDecoder.js

@@ -0,0 +1,142 @@
+// BOM components for the Brotli decoders compiled into native files. The
+// detection itself, and why its markers can be trusted, is in
+// lib/core/brotliProbe.js.
+
+import {
+  MAX_BROTLI_PROBE_BYTES,
+  MAX_BROTLI_PROBES,
+  readBrotliDecoder,
+} from "../core/brotliProbe.js";
+import { applyPurl, tryBuildPurl } from "./purl.js";
+
+export { MAX_BROTLI_PROBE_BYTES, MAX_BROTLI_PROBES, readBrotliDecoder };
+
+/**
+ * The properties a file component carries once it has been probed: the fix
+ * state of each decoder found in it, or why it could not be read.
+ *
+ * @param {Object} decoder result of readBrotliDecoder
+ * @returns {{name: string, value: string}[]} properties to append
+ */
+export function brotliDecoderProperties(decoder) {
+  const properties = [];
+  if (decoder?.skipped) {
+    properties.push({ name: "cdx:brotli:probe", value: decoder.skipped });
+  }
+  if (decoder?.c) {
+    properties.push(
+      { name: "cdx:brotli:c:blockSwitchFix", value: decoder.c.blockSwitchFix },
+      { name: "cdx:brotli:c:evidence", value: decoder.c.evidence },
+    );
+  }
+  if (decoder?.go) {
+    properties.push({
+      name: "cdx:brotli:go:blockSwitchFix",
+      value: decoder.go.blockSwitchFix,
+    });
+  }
+  return properties;
+}
+
+/**
+ * The library component every embedded decoder links to. It has no version:
+ * no build records one, and only the per-file cdx:brotli:*:blockSwitchFix
+ * properties say whether a copy is vulnerable. The `vcs_url` qualifier names
+ * the project and keeps the identity apart from an unpackaged `brotli`
+ * executable, which is `pkg:generic/brotli`. The purl has no namespace: a
+ * `pkg:github` purl is typed as an application and `pkg:generic/google` as a
+ * framework when the BOM is assembled, and this is neither.
+ *
+ * @returns {Object} component with `purl` and `bom-ref`
+ */
+export function createBrotliComponent() {
+  return applyPurl(
+    {
+      type: "library",
+      name: "brotli",
+      description:
+        "Brotli decoder compiled into native files; see the cdx:brotli properties on each file",
+      properties: [],
+    },
+    tryBuildPurl({
+      type: "generic",
+      name: "brotli",
+      qualifiers: { vcs_url: "git+https://github.com/google/brotli" },
+    }),
+  );
+}
+
+/**
+ * Start collecting the decoder copies of one scan.
+ *
+ * @returns {{component: Object|undefined, dependencies: Object[], copies: number, unpatched: number, unknown: number}}
+ */
+export function createBrotliInventory() {
+  return {
+    component: undefined,
+    dependencies: [],
+    copies: 0,
+    unpatched: 0,
+    unknown: 0,
+  };
+}
+
+/**
+ * Tag a probed file component and, when it holds a decoder, link it to the
+ * shared brotli component, creating that component on first use. Mutates the
+ * file component in place.
+ *
+ * @param {Object} inventory accumulator from createBrotliInventory
+ * @param {Object} fileComponent file component with a `properties` array
+ * @param {Object} decoder result of readBrotliDecoder
+ */
+export function attachBrotliDecoder(inventory, fileComponent, decoder) {
+  const properties = brotliDecoderProperties(decoder);
+  if (!properties.length) {
+    return;
+  }
+  fileComponent.properties.push(...properties);
+  if (!decoder.c && !decoder.go) {
+    return;
+  }
+  if (!inventory.component) {
+    inventory.component = createBrotliComponent();
+  }
+  const states = [decoder.c?.blockSwitchFix, decoder.go?.blockSwitchFix];
+  inventory.copies += 1;
+  if (states.includes("false")) {
+    inventory.unpatched += 1;
+  } else if (states.includes("unknown")) {
+    inventory.unknown += 1;
+  }
+  if (fileComponent["bom-ref"] && inventory.component["bom-ref"]) {
+    inventory.dependencies.push({
+      ref: fileComponent["bom-ref"],
+      dependsOn: [inventory.component["bom-ref"]],
+    });
+  }
+}
+
+/**
+ * Finish an inventory: record the copy counts on the brotli component.
+ *
+ * @param {Object} inventory accumulator from createBrotliInventory
+ * @returns {{components: Object[], dependencies: Object[]}} what to add to the BOM
+ */
+export function finishBrotliInventory(inventory) {
+  if (!inventory?.component) {
+    return { components: [], dependencies: [] };
+  }
+  inventory.component.properties = [
+    { name: "cdx:brotli:embeddedCopies", value: String(inventory.copies) },
+    { name: "cdx:brotli:unpatchedCopies", value: String(inventory.unpatched) },
+    { name: "cdx:brotli:unknownCopies", value: String(inventory.unknown) },
+  ];
+  return {
+    components: [inventory.component],
+    dependencies: [
+      { ref: inventory.component["bom-ref"], dependsOn: [] },
+      ...inventory.dependencies,
+    ],
+  };
+}

package/lib/inventory/buildToolRateLimit.js

@@ -129,7 +129,7 @@ export function noteBuildToolRateLimit(tool, output, context = {}) {
     ? `, so cdxgen runs no further ${tool} resolution in this scan and`
     : ", so";
   console.warn(
-    `The repository ${tool} downloads from is rate limiting this machine (HTTP 429)${stopped} its dependency tree is incomplete. ${MIRROR_SETTINGS[tool] || MIRROR_SETTINGS[TOOL_MATCHER[tool]]} cdxgen's own lookups can be moved with MAVEN_CENTRAL_URL.`,
+    `The repository ${tool} downloads from is rate limiting this machine (HTTP 429)${stopped} its dependency tree is incomplete. ${MIRROR_SETTINGS[tool] || MIRROR_SETTINGS[TOOL_MATCHER[tool]]} Set MAVEN_CENTRAL_MIRROR=true to point every build tool at Google's Maven Central mirror, or MAVEN_CENTRAL_URL for cdxgen's own lookups.`,
   );
   recordDegradation("build.rate-limited", {
     ecosystem: "java",