@cdxgen/cdxgen 13.5.0 → 13.7.0

package/types/lib/inventory/cyclonedx20.d.ts

@@ -0,0 +1,99 @@
+/**
+ * CycloneDX 2.0 rendering and reading.
+ *
+ * cdxgen assembles every BOM in the CycloneDX 1.x shape and converts to the
+ * requested spec version at the end of the pipeline (see
+ * lib/stages/postgen/specVersionCompat.js). The 2.0 draft is a structural
+ * rewrite rather than an additive change, so the conversion lives here, as two
+ * pure functions plus small helpers, instead of inside the compat walker:
+ *
+ * - `renderCycloneDx20(internalBom, context)` turns the 1.x-shaped internal
+ *   model into a 2.0 document. It never mutates its input, and its output
+ *   depends only on the model and the optional context (the cdx-hbom
+ *   hardware mapper, see hbomLoader.js: hardwareRenderContext).
+ *   `renderCycloneDx20WithReport(internalBom, context)` does the same and
+ *   also returns the counts of everything the render could not carry.
+ * - `readCycloneDx20(bom20)` turns a 2.0 document into the internal 1.x-shaped
+ *   model, reporting everything it could not carry in `losses`.
+ * - `loadBomForAnalysis(bomJson)` is the single entry point every BOM reader
+ *   uses; it returns the document as is for 1.x and calls readCycloneDx20 for
+ *   2.0, so no reader learns the 2.0 shape.
+ * - `getInternalBom(bomNSData)` and `refreshRenderedBom(bomNSData, options)`
+ *   are the generation-side half: postProcess keeps the 1.x model on
+ *   `bomNSData.internalBomJson` at 2.0, and the writer re-renders once after
+ *   the last mutation.
+ *
+ * Every field name below is quoted from the pinned draft schema
+ * (data/cyclonedx-2.0-bundled.schema.json, CycloneDX/specification 2.0-dev at
+ * ea8c3605829d1da13339a0790b6da73548e42a6b); citations give the `$defs` path.
+ */
+export { readCycloneDx20 } from "./cyclonedx20Read.js";
+export { renderCycloneDx20, renderCycloneDx20WithReport, } from "./cyclonedx20Render.js";
+export { CDX20_INTERNAL_SECTIONS_KEY, CDXGEN_PARTY_REF_ID, DEPENDENCY_TRACK_CDX20_ERROR, } from "./cyclonedx20Tables.js";
+/**
+ * Load any CycloneDX BOM for analysis: the document as is for 1.x, the
+ * internal 1.x-shaped model for 2.0.
+ *
+ * A document whose specVersion is 2.0 or later, or which has a specFormat, is
+ * read as 2.0, and the reader reports stray 1.x members such as
+ * `components` as losses. A model the 2.0 reader or the 2.0 compatibility
+ * pass produced carries the internal model mark (markInternalModel) and is
+ * returned as is; cdxgen hands that model to the evidence analysis in memory
+ * (evinse's `inputBomJson`), because the mark does not survive JSON. The
+ * internal sections key is never trusted on a 1.x document: the returned
+ * copy leaves it out, so it cannot reach a 2.0 render.
+ *
+ * @param {object} bomJson Parsed CycloneDX BOM
+ * @returns {{internalBom: object, specVersion: string, losses: Array<{pointer: string, reason: string}>}}
+ * @throws {Error} With a short message when the 2.0 reader fails on the
+ *   document
+ */
+export declare function loadBomForAnalysis(bomJson: object): {
+    internalBom: object;
+    specVersion: string;
+    losses: Array<{
+        pointer: string;
+        reason: string;
+    }>;
+};
+/**
+ * The one-line notice a reader prints when loading a 2.0 document lost
+ * data: the number of losses, with the details left to thoughtLog.
+ *
+ * @param {Array<{pointer: string, reason: string}>} losses Reader losses
+ * @returns {string} The notice
+ */
+export declare function formatReadLossNotice(losses: Array<{
+    pointer: string;
+    reason: string;
+}>): string;
+/**
+ * Return the 1.x-shaped model of a generation run. At 1.x the rendered BOM is
+ * the internal model, so this always yields something readers can walk.
+ *
+ * @param {{bomJson?: object, internalBomJson?: object}} bomNSData
+ * @returns {object} The 1.x-shaped BOM
+ */
+export declare function getInternalBom(bomNSData: {
+    bomJson?: object;
+    internalBomJson?: object;
+}): object;
+/**
+ * Re-render the 2.0 document after a post-postProcess mutation of the
+ * internal model, with the render context postProcess used
+ * (`bomNSData.renderContext`). A no-op at 1.x, which keeps those versions
+ * byte-identical.
+ *
+ * @param {{bomJson?: object, internalBomJson?: object, renderContext?: object}} bomNSData
+ * @param {object} options CLI options carrying `specVersion`
+ * @returns {{bomJson?: object, internalBomJson?: object}} The same bomNSData
+ */
+export declare function refreshRenderedBom(bomNSData: {
+    bomJson?: object;
+    internalBomJson?: object;
+    renderContext?: object;
+}, options: object): {
+    bomJson?: object;
+    internalBomJson?: object;
+};
+//# sourceMappingURL=cyclonedx20.d.ts.map

package/types/lib/inventory/cyclonedx20.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAUH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,iBAAiB,EACjB,2BAA2B,GAC5B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAEhC;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAL/B,MAK+B,GAJ7B;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAC,CAAC,CAAA;CAAC,CAuCxG;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAHhC,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,CAGP,GAF9B,MAAM,CAKlB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAH7B;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAGd,GAF3B,MAAM,CAIlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAJjC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAIlC,EAAE,OAAO,EAH1C,MAG0C,GAFxC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAC,CAgBxD"}

package/types/lib/inventory/cyclonedx20Common.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Small shared helpers for the CycloneDX 2.0 renderer and reader: type
+ * guards, cloning, render counters and the environment-variable shape change.
+ */
+/** True for a plain object (not null, not an array). */
+export declare const isObjectRecord: (value: any) => boolean;
+/** True for a string with at least one character. */
+export declare const isNonEmptyString: (value: any) => boolean;
+/** structuredClone that passes `undefined` through. */
+export declare const clone: (value: any) => any;
+export declare const isBomLink: (value: any) => boolean;
+/**
+ * A fresh, empty set of render counters.
+ *
+ * @param {object} [shadows] 2.0 originals kept by readCycloneDx20 (see
+ *   takeShadow)
+ * @param {{toolRefId?: string, timestamp?: string}} [claims] What identity
+ *   claims are attributed with (see identityClaimContext)
+ * @returns {object} Render counters
+ */
+export declare function createRenderStats(shadows?: object, claims?: {
+    toolRefId?: string;
+    timestamp?: string;
+}): object;
+/**
+ * The key a 1.x value is shadowed under: the SHA-256 of its JSON. The
+ * reader and the renderer serialize the same object the same way, so an
+ * unchanged value finds its 2.0 original again.
+ *
+ * @param {*} value 1.x value
+ * @returns {string} Hex digest
+ */
+export declare function shadowKey(value: any): string;
+/**
+ * The 2.0 original readCycloneDx20 kept for this unchanged 1.x value, as a
+ * fresh clone, or undefined. Identical 1.x values kept for several originals
+ * get them back in document order. Never mutates the stored shadows.
+ *
+ * @param {object} stats Render counters from createRenderStats
+ * @param {string} kind Shadow namespace (component, metadata, …)
+ * @param {*} value 1.x value about to be rendered
+ * @returns {*} The 2.0 original or undefined
+ */
+export declare function takeShadow(stats: object, kind: string, value: any): any;
+/**
+ * The single 2.0 original readCycloneDx20 kept for this unchanged 1.x value,
+ * as a fresh clone, or undefined. Unlike takeShadow nothing is consumed: the
+ * reader registers a key here only when every entry it read under that key
+ * had the same original, so the lookup does not depend on render order.
+ *
+ * @param {object} stats Render counters from createRenderStats
+ * @param {string} kind Shadow namespace (identity)
+ * @param {*} value 1.x value about to be rendered
+ * @returns {*} The 2.0 original or undefined
+ */
+export declare function peekShadow(stats: object, kind: string, value: any): any;
+/** Count one dropped or rewritten value under a stable label. */
+export declare function countDrop(stats: any, label: any, count?: number): void;
+/**
+ * Count one value the render rewrote without losing data (a duplicate refId
+ * turned into a reference, a retargeted annotation subject).
+ */
+export declare function countRewrite(stats: any, label: any, count?: number): void;
+/**
+ * Count a 1.x JSF `signature` the render leaves out: it signs the 1.x
+ * serialization, so it cannot verify over the re-rendered 2.0 document, and
+ * 2.0 `signatures` hold JSS signatures
+ * (#/$defs/cyclonedx-common-2.0/$defs/signatures).
+ */
+export declare function countSignatureDrop(stats: any, path: any): void;
+/** Count every defined key of `source` that `handled` does not list. */
+export declare function countUnmapped(stats: any, prefix: any, source: any, handled: any): void;
+/** Clone the listed fields of `source` that are defined onto `target`. */
+export declare function copyDefined(target: any, source: any, fields: any): void;
+/** Remove duplicate entries (by JSON value) for `uniqueItems` arrays. */
+export declare function uniqueByValue(values: any): any[];
+/** Split a 1.x `author` string the way specVersionCompat does. */
+export declare function authorStringToNames(authorValue: any): string[];
+/** A 1.x scalar-or-array identifier field as a list of strings. */
+export declare function identifierValues(value: any): any[];
+/** Assign `value` to `out[key]` unless it is undefined. */
+export declare function setDefined(out: any, key: any, value: any): void;
+/**
+ * Convert a 1.x `environmentVars` array of {name, value} entries into the 2.0
+ * map of names to values
+ * (#/$defs/cyclonedx-formulation-2.0/$defs/environmentVars). Reverse for read.
+ * Entries the map cannot hold are counted when `stats` is given.
+ */
+export declare function convertEnvironmentVars(value: any, stats: any): any;
+/** Turn a 2.0 environmentVars map back into the 1.x {name, value} array. */
+export declare function reverseEnvironmentVars(value: any): any;
+/** Every refId string declared anywhere under the given roots. */
+export declare function collectDeclaredRefIds(roots: any): Set<any>;
+/**
+ * True when any `party` member (a refId string or a partyReference) or any
+ * `ref` member below `node` names `refId`. Restored 2.0 originals reference
+ * a derived party (see derivedPartyDeclarations) without passing through the
+ * converters, so its declaration follows the rendered document rather than a
+ * render flag.
+ */
+export declare function referencesParty(node: any, refId: any): any;
+//# sourceMappingURL=cyclonedx20Common.d.ts.map

package/types/lib/inventory/cyclonedx20Common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20Common.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20Common.js"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,wDAAwD;AACxD,eAAO,MAAM,cAAc,yBAC2C,CAAC;AAEvE,qDAAqD;AACrD,eAAO,MAAM,gBAAgB,yBACkB,CAAC;AAEhD,uDAAuD;AACvD,eAAO,MAAM,KAAK,qBACwC,CAAC;AAI3D,eAAO,MAAM,SAAS,yBACqC,CAAC;AAE5D;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,AANtC,CAEA,EAFQ,MAM8B,EAAE,MAAM,AAJ9C,CAEA,EAFQ;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAID,GAFpC,MAAM,CAclB;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAHpB,GAGoB,GAFlB,MAAM,CAIlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,KAAK,EALrB,MAKqB,EAAE,IAAI,EAJ3B,MAI2B,EAAE,KAAK,EAHlC,GAGkC,GAFhC,GAAC,CAmBb;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,KAAK,EALrB,MAKqB,EAAE,IAAI,EAJ3B,MAI2B,EAAE,KAAK,EAHlC,GAGkC,GAFhC,GAAC,CAWb;AAED,iEAAiE;AACjE,wBAAgB,SAAS,CAAC,KAAK,KAAA,EAAE,KAAK,KAAA,EAAE,KAAK,SAAI,QAEhD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,KAAA,EAAE,KAAK,KAAA,EAAE,KAAK,SAAI,QAEnD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,KAAA,EAAE,IAAI,KAAA,QAK7C;AAED,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,KAAK,KAAA,EAAE,MAAM,KAAA,EAAE,MAAM,KAAA,EAAE,OAAO,KAAA,QAM3D;AAED,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,MAAM,KAAA,EAAE,MAAM,KAAA,EAAE,MAAM,KAAA,QAMjD;AAED,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,MAAM,KAAA,SAWnC;AAED,kEAAkE;AAClE,wBAAgB,mBAAmB,CAAC,WAAW,KAAA,YAQ9C;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,KAAK,KAAA,SAKrC;AAED,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,GAAG,KAAA,EAAE,GAAG,KAAA,EAAE,KAAK,KAAA,QAIzC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,KAAA,EAAE,KAAK,KAAA,OAoBlD;AAQD,4EAA4E;AAC5E,wBAAgB,sBAAsB,CAAC,KAAK,KAAA,OAQ3C;AAED,kEAAkE;AAClE,wBAAgB,qBAAqB,CAAC,KAAK,KAAA,YAmB1C;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,KAAA,EAAE,KAAK,KAAA,OAiB1C"}

package/types/lib/inventory/cyclonedx20Derived.d.ts

@@ -0,0 +1,74 @@
+/**
+ * The 2.0 sections the renderer derives from the 1.x-shaped internal model
+ * rather than converts: post-quantum migration risks (pqcMigration.js,
+ * #4592), and the coding-agent parties and behavioral blueprint
+ * (agentBlueprint.js, #4593).
+ *
+ * A model read from 2.0 carries its 2.0-only sections (risks, blueprints,
+ * parties) for 2.0 output. Derived entries in them are recognised by refId
+ * (`risk-pqc-*`, `blueprint-declared-agents`, agent parties `party-agent-*`
+ * of system kind `agent`). The renderer drops carried derived entries and
+ * derives them again from the model, so they follow edits to the model and
+ * are never declared twice. Every other carried entry is kept, first, and a
+ * derived entry never replaces a carried entry with the same refId.
+ *
+ * Only cdxgen's own analysis is derived: the sections are derived only when
+ * the model's `metadata.tools` lists cdxgen with a bom-ref, the rule
+ * identityClaimContext applies to cdxgen's identity claims. Another tool's
+ * BOM converted with `cdx-convert --to 2.0` gets no derived section.
+ */
+/** A risk entry renderCycloneDx20 derives (see collectPqcRisks). */
+export declare const isDerivedRisk: (risk: any) => boolean;
+/** The blueprint renderCycloneDx20 derives (see collectAgentBehaviour). */
+export declare const isDerivedBlueprint: (blueprint: any) => boolean;
+/** An agent party renderCycloneDx20 derives (see collectAgentBehaviour). */
+export declare const isDerivedAgentParty: (party: any) => boolean;
+/**
+ * Does the model's `metadata.tools` list cdxgen with a bom-ref? The same
+ * test decides whether cdxgen's identity claims are written.
+ *
+ * @param {object} internalBom The 1.x-shaped internal model
+ * @returns {boolean} True when cdxgen is a listed tool
+ */
+export declare function isCdxgenListedTool(internalBom: object): boolean;
+/**
+ * Derive the 2.0 sections of an internal model; all empty unless cdxgen is a
+ * listed tool (isCdxgenListedTool).
+ *
+ * @param {object} internalBom The 1.x-shaped internal model
+ * @returns {{risks: object[], agentParties: object[], blueprints: object[]}}
+ */
+export declare function deriveCycloneDx20Sections(internalBom: object): {
+    risks: object[];
+    agentParties: object[];
+    blueprints: object[];
+};
+/**
+ * Add the derived risks and blueprint to a rendered document whose carried
+ * 2.0 sections are already in place, and return the parties to declare: the
+ * carried parties without derived agent parties, then the derived ones.
+ *
+ * @param {object} out The document being rendered
+ * @param {object[]} carriedParties Parties carried from a 2.0 read
+ * @param {object} internalBom The internal model the document renders
+ * @returns {object[]} The parties to declare before the cdxgen party
+ */
+export declare function appendDerivedSections(out: object, carriedParties: object[], internalBom: object): object[];
+/**
+ * Split the derived entries out of a list read from 2.0. An entry that is
+ * what the renderer derives again from the read model is dropped without a
+ * loss; a derived-looking entry that differs is dropped too (the renderer
+ * would replace it), and its index is returned so the reader reports the
+ * loss.
+ *
+ * @param {object[]} entries The 2.0 list (risks, blueprints, parties)
+ * @param {object[]} derived What the renderer derives from the read model
+ * @param {Function} isDerived Recogniser for derived entries
+ * @returns {{kept: object[], differing: number[]}} The entries to carry, and
+ *   the indexes of dropped entries that differ from the derivation
+ */
+export declare function splitDerivedEntries(entries: object[], derived: object[], isDerived: Function): {
+    kept: object[];
+    differing: number[];
+};
+//# sourceMappingURL=cyclonedx20Derived.d.ts.map

package/types/lib/inventory/cyclonedx20Derived.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20Derived.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20Derived.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAgBH,oEAAoE;AACpE,eAAO,MAAM,aAAa,wBACuB,CAAC;AAElD,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,6BACc,CAAC;AAE9C,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,yBAEC,CAAC;AAElC;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAHnC,MAGmC,GAFjC,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAH1C,MAG0C,GAFxC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAC,CAY3E;AAWD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAL9B,MAK8B,EAAE,cAAc,EAJ9C,MAAM,EAIwC,EAAE,WAAW,EAH3D,MAG2D,GAFzD,MAAM,EAAE,CAqCpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EANhC,MAAM,EAM0B,EAAE,OAAO,EALzC,MAAM,EAKmC,EAAE,SAAS,UAAA,GAHlD;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,CAejD"}

package/types/lib/inventory/cyclonedx20Parties.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Conversions between the 1.x organizational entities and contacts and the
+ * CycloneDX 2.0 parties (#/$defs/cyclonedx-party-2.0) and common entities
+ * (#/$defs/cyclonedx-common-2.0).
+ */
+/**
+ * A person party playing `role` for a 1.x contact. The contact's `bom-ref`
+ * is the party's refId (#/$defs/cyclonedx-party-2.0/$defs/party).
+ *
+ * @param {object|string} contact 1.x organizationalContact
+ * @param {string} role Predefined role
+ * @param {object} stats Render counters
+ * @returns {object|undefined} 2.0 party
+ */
+export declare function contactToParty(contact: object | string, role: string, stats: object): object | undefined;
+/**
+ * Convert a 1.x organizationalEntity into 2.0 parties playing `role`
+ * (#/$defs/cyclonedx-party-2.0/$defs/party, required `[roles]`, exactly one
+ * identity sub-shape). The organization
+ * (#/$defs/cyclonedx-party-2.0/$defs/organization) takes `url` as
+ * `[{url}]` and `addresses` as an array and has no `bom-ref` or `contact`, so
+ * every 1.x contact becomes its own person party with the same role.
+ */
+export declare function entityToParties(entity: any, role: any, stats: any): object[];
+/**
+ * Convert a 1.x organizationalContact to the 2.0 common organizationalContact
+ * (#/$defs/cyclonedx-common-2.0/$defs/organizationalContact), which renames
+ * `bom-ref` to `refId`. Used by metadata authors and annotators.
+ */
+export declare function toCommonContact(contact: any, stats: any): {
+    name: any;
+} | {
+    refId: any;
+} | undefined;
+/**
+ * Convert a 1.x organizationalEntity to the 2.0 common organizationalEntity
+ * (#/$defs/cyclonedx-common-2.0/$defs/organizationalEntity), used by
+ * metadata.supplier, metadata.manufacturer and annotator.organization. It
+ * keeps `url` strings and `contact`, and renames `bom-ref` to `refId`.
+ */
+export declare function toCommonEntity(entity: any, stats: any): {
+    refId: any;
+    name: any;
+    address: {
+        refId: any;
+    };
+    url: any[];
+    contact: any;
+} | undefined;
+/**
+ * Convert the 1.x party-ish component fields into `parties`
+ * (#/$defs/cyclonedx-party-2.0/$defs/party). `author` strings and `authors`
+ * contacts become persons with the `author` role, `publisher` an organization
+ * with the `publisher` role, and supplier/manufacturer organizations keep
+ * their roles.
+ */
+export declare function collectParties(component: any, stats: any): object[];
+/**
+ * Read 2.0 component or service `parties` into the 1.x fields
+ * (`supplier`, `manufacturer`, `authors`, `publisher`, `provider`). A person
+ * playing the supplier, manufacturer or provider role becomes a contact of
+ * that organization, the inverse of entityToParties. Party references resolve
+ * against definitions.parties. Everything else is a loss.
+ *
+ * @param {object} ctx Reader context
+ * @param {Array} parties 2.0 parties
+ * @param {string} pointer JSON pointer of `parties`
+ * @param {object} roleFields Roles to read (subset of PARTY_ROLE_FIELDS_1X)
+ * @returns {object} 1.x fields by name
+ */
+export declare function reverseParties(ctx: object, parties: any[], pointer: string, roleFields: object): object;
+/**
+ * Read one 2.0 party (inline or a partyReference) whose roles `roleFields`
+ * lists: its roles, the 1.x organization or contact it describes, and the
+ * pointer of the party object. Unlisted roles and members are losses.
+ *
+ * @param {object} ctx Reader context
+ * @param {object} entry 2.0 party or partyReference
+ * @param {string} pointer JSON pointer of `entry`
+ * @param {object} roleFields Role names to read, as keys
+ * @returns {{roles: string[], identity: {kind: string, identity: object}, pointer: string}|undefined}
+ */
+export declare function readParty(ctx: object, entry: object, pointer: string, roleFields: object): {
+    roles: string[];
+    identity: {
+        kind: string;
+        identity: object;
+    };
+    pointer: string;
+} | undefined;
+//# sourceMappingURL=cyclonedx20Parties.d.ts.map

package/types/lib/inventory/cyclonedx20Parties.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20Parties.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20Parties.js"],"names":[],"mappings":"AAAA;;;;GAIG;AAoFH;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAL3B,MAAM,GAAC,MAKoB,EAAE,IAAI,EAJjC,MAIiC,EAAE,KAAK,EAHxC,MAGwC,GAFtC,MAAM,GAAC,SAAS,CAc5B;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,KAAA,EAAE,IAAI,KAAA,EAAE,KAAK,KAAA,YA4DlD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,KAAA,EAAE,KAAK,KAAA;;;;cAwB7C;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,KAAA,EAAE,KAAK,KAAA;;;;;;;;cAiC3C;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,SAAS,KAAA,EAAE,KAAK,KAAA,YA0B9C;AAiND;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,GAAG,EANvB,MAMuB,EAAE,OAAO,OAAA,EAAE,OAAO,EAJzC,MAIyC,EAAE,UAAU,EAHrD,MAGqD,GAFnD,MAAM,CAqBlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,GAAG,EANlB,MAMkB,EAAE,KAAK,EALzB,MAKyB,EAAE,OAAO,EAJlC,MAIkC,EAAE,UAAU,EAH9C,MAG8C,GAF5C;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAapG"}

package/types/lib/inventory/cyclonedx20Read.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Read a CycloneDX 2.0 document into the 1.x-shaped internal model. The
+ * public entry point is re-exported from cyclonedx20.js.
+ *
+ * Where definitions.components entries go (2.0 records no membership, so the
+ * rule is fixed and deterministic, applied in document order):
+ *
+ * 0. An entry whose refId a formula lists in its
+ *    `cdx:formulation:componentRefs` property (a JSON array of refIds, which
+ *    renderCycloneDx20 writes for a subject-less document) is a component of
+ *    every formula that lists it.
+ * 1. An entry whose refId a formula references (a `ref` member, such as a
+ *    resource reference, anywhere in its tree) is a component of the first
+ *    such formula. Other strings that happen to equal the refId, such as a
+ *    task type, do not count.
+ * 2. In a document with inventories, an entry a componentReference the
+ *    reader resolves points to (from an inventory, a tool, an annotator, a
+ *    vulnerability or another definitions component) stays in definitions
+ *    (kept for 2.0 output); its content reaches 1.x through the referencing
+ *    entries.
+ * 3. In a document with inventories, any other entry is a formula component
+ *    when the document has a formulation (the renderer moves 1.x
+ *    formula.components there), and otherwise stays in definitions with a
+ *    loss: 1.x has no home for it.
+ * 4. In a document without inventories (the renderer puts a subject-less
+ *    document's components there), any other entry is a root component.
+ *    Entries without a refId follow the same rules and are never dropped.
+ * 5. Before all of these, an entry whose type 1.x does not have (`material`)
+ *    stays in definitions with a loss.
+ */
+/**
+ * Read a 2.0 document into the internal 1.x-shaped model. Never throws on a
+ * schema-valid 2.0 document. Objects nested deeper than MAX_READ_DEPTH are
+ * left out, each with a loss. The returned model carries the internal model
+ * mark (markInternalModel), which loadBomForAnalysis checks. Every member the reader sees but cannot carry
+ * into 1.x is reported in `losses` as `{pointer, reason}`, where `pointer` is
+ * an RFC 6901 JSON pointer into the input. Objects whose 1.x form would not
+ * render back to the same 2.0 object are kept under the internal sections
+ * key, so renderCycloneDx20 restores them while they are unchanged.
+ *
+ * @param {object} bom20 BOM in the 2.0 shape
+ * @returns {{internalBom: object, losses: Array<{pointer: string, reason: string}>}}
+ */
+export declare function readCycloneDx20(bom20: object): {
+    internalBom: object;
+    losses: Array<{
+        pointer: string;
+        reason: string;
+    }>;
+};
+//# sourceMappingURL=cyclonedx20Read.d.ts.map

package/types/lib/inventory/cyclonedx20Read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20Read.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20Read.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAmGH;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAH1B,MAG0B,GAFxB;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAC,CAAC,CAAA;CAAC,CA2CnF"}

package/types/lib/inventory/cyclonedx20ReadCommon.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Reader converters for the CycloneDX 2.0 common objects
+ * (#/$defs/cyclonedx-common-2.0, #/$defs/cyclonedx-license-2.0,
+ * #/$defs/cyclonedx-release-notes-2.0) back to their 1.x shapes. Each frozen
+ * spec is the allowlist of the members 1.x carries; anything else is a loss.
+ */
+/** hash (#/$defs/cyclonedx-common-2.0/$defs/hash) → 1.x hash. */
+export declare function reverseHash(ctx: any, value: any, pointer: any): object | undefined;
+/** A list of hashes. */
+export declare const HASHES_RULE: Readonly<{
+    to: any;
+    convert: (ctx: any, value: any, pointer: any) => any[] | undefined;
+}>;
+/** property (#/$defs/cyclonedx-common-2.0/$defs/property) → 1.x property. */
+export declare function reverseProperty(ctx: any, value: any, pointer: any): object | undefined;
+/** A list of properties. */
+export declare const PROPERTIES_RULE: Readonly<{
+    to: any;
+    convert: (ctx: any, value: any, pointer: any) => any[] | undefined;
+}>;
+/** externalReference → 1.x externalReference. */
+export declare function reverseExternalReference(ctx: any, value: any, pointer: any): object | undefined;
+/** A list of external references. */
+export declare const EXTERNAL_REFERENCES_RULE: Readonly<{
+    to: any;
+    convert: (ctx: any, value: any, pointer: any) => any[] | undefined;
+}>;
+/** attachment: `mediaType` is the 1.x `contentType`. */
+export declare function reverseAttachment(ctx: any, value: any, pointer: any): object | undefined;
+/** An attachment-valued member. */
+export declare const ATTACHMENT_RULE: Readonly<{
+    convert: typeof reverseAttachment;
+}>;
+/** postalAddress (common or party) → 1.x postalAddress. */
+export declare function reverseAddress(ctx: any, value: any, pointer: any): object | undefined;
+/** organizationalContact → 1.x organizationalContact. */
+export declare function reverseContact(ctx: any, value: any, pointer: any): object | undefined;
+/** organizationalEntity (common) → 1.x organizationalEntity. */
+export declare function reverseEntity(ctx: any, value: any, pointer: any): object | undefined;
+/**
+ * One licenseChoice entry. A licenseReference (`{ref}`) resolves against
+ * definitions.licenses; 1.x has no license references, so the declaration
+ * is inlined and the reference itself reported.
+ */
+export declare function reverseLicenseChoice(ctx: any, value: any, pointer: any): object | undefined;
+/** A licenses member. */
+export declare const LICENSES_RULE: Readonly<{
+    to: any;
+    convert: (ctx: any, value: any, pointer: any) => any[] | undefined;
+}>;
+/**
+ * Issues a patch or release resolves. 1.x lists issues only; a reference to a
+ * weakness, vulnerability or requirement has no 1.x form.
+ */
+export declare const RESOLVES_RULE: Readonly<{
+    to: any;
+    convert: (ctx: any, value: any, pointer: any) => any[] | undefined;
+}>;
+/**
+ * releaseNotes, inline or a releaseNotesReference resolved against
+ * definitions.releaseNotes (1.x has no reference form).
+ */
+export declare function reverseReleaseNotes(ctx: any, value: any, pointer: any): object | undefined;
+/** A patentAssertions member; 1.x requires `asserter` and `assertionType`. */
+export declare const PATENT_ASSERTIONS_RULE: Readonly<{
+    to: any;
+    convert: (ctx: any, value: any, pointer: any) => any[] | undefined;
+}>;
+//# sourceMappingURL=cyclonedx20ReadCommon.d.ts.map

package/types/lib/inventory/cyclonedx20ReadCommon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20ReadCommon.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20ReadCommon.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AAmBH,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,GAAG,KAAA,EAAE,KAAK,KAAA,EAAE,OAAO,KAAA,sBAE9C;AAED,wBAAwB;AACxB,eAAO,MAAM,WAAW;;;EAAsB,CAAC;AAI/C,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,GAAG,KAAA,EAAE,KAAK,KAAA,EAAE,OAAO,KAAA,sBAElD;AAED,4BAA4B;AAC5B,eAAO,MAAM,eAAe;;;EAA0B,CAAC;AA0BvD,iDAAiD;AACjD,wBAAgB,wBAAwB,CAAC,GAAG,KAAA,EAAE,KAAK,KAAA,EAAE,OAAO,KAAA,sBAQ3D;AAED,qCAAqC;AACrC,eAAO,MAAM,wBAAwB;;;EAAmC,CAAC;AAQzE,wDAAwD;AACxD,wBAAgB,iBAAiB,CAAC,GAAG,KAAA,EAAE,KAAK,KAAA,EAAE,OAAO,KAAA,sBAEpD;AAED,mCAAmC;AACnC,eAAO,MAAM,eAAe;;EAAgD,CAAC;AAY7E,2DAA2D;AAC3D,wBAAgB,cAAc,CAAC,GAAG,KAAA,EAAE,KAAK,KAAA,EAAE,OAAO,KAAA,sBAEjD;AASD,yDAAyD;AACzD,wBAAgB,cAAc,CAAC,GAAG,KAAA,EAAE,KAAK,KAAA,EAAE,OAAO,KAAA,sBAQjD;AAUD,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,GAAG,KAAA,EAAE,KAAK,KAAA,EAAE,OAAO,KAAA,sBAQhD;AAyDD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,KAAA,EAAE,KAAK,KAAA,EAAE,OAAO,KAAA,sBAwCvD;AAED,yBAAyB;AACzB,eAAO,MAAM,aAAa;;;EAA+B,CAAC;AAE1D;;;GAGG;AACH,eAAO,MAAM,aAAa;;;EAMxB,CAAC;AAoBH;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,KAAA,EAAE,KAAK,KAAA,EAAE,OAAO,KAAA,sBA2BtD;AA+CD,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB;;;EAajC,CAAC"}

package/types/lib/inventory/cyclonedx20ReadComponents.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Reader converters for CycloneDX 2.0 components
+ * (#/$defs/cyclonedx-component-2.0/$defs/component) back to 1.x components
+ * and, for `type: service`, 1.x services. Each frozen spec is the allowlist
+ * of the members 1.x carries; everything else is reported as a loss.
+ */
+/**
+ * A 2.0 component (not a service) → a 1.x component, or undefined when its
+ * type has no 1.x equivalent (a loss).
+ *
+ * @param {object} ctx Reader context
+ * @param {object} component 2.0 component
+ * @param {string} pointer JSON pointer of `component`
+ * @returns {object|undefined} 1.x component
+ */
+export declare function reverseComponent(ctx: object, component: object, pointer: string): object | undefined;
+/**
+ * A 2.0 component of type `service` → a 1.x service.
+ *
+ * @param {object} ctx Reader context
+ * @param {object} component 2.0 service component
+ * @param {string} pointer JSON pointer of `component`
+ * @returns {object} 1.x service
+ */
+export declare function reverseService(ctx: object, component: object, pointer: string): object;
+/**
+ * Resolve a componentEntry (component, componentReference or
+ * component-choice) to a concrete component. A reference resolves against
+ * every declared component; a choice keeps its first resolvable member.
+ *
+ * @param {object} ctx Reader context (with `componentIndex`)
+ * @param {object} entry 2.0 componentEntry
+ * @param {string} pointer JSON pointer of `entry`
+ * @returns {{component: object, pointer: string}|undefined}
+ */
+export declare function resolveComponentEntry(ctx: object, entry: object, pointer: string, depth?: number): {
+    component: object;
+    pointer: string;
+} | undefined;
+/**
+ * Read one top-level component entry (an inventory entry, subject, tool,
+ * definitions component, formula component or annotator) into 1.x, as a
+ * component or a service. `needsShadow` is set when the 1.x value does not
+ * render back to the same 2.0 entry; a caller that keeps the entry passes the
+ * result to keepComponentShadow.
+ *
+ * @param {object} ctx Reader context
+ * @param {object} entry 2.0 componentEntry
+ * @param {string} pointer JSON pointer of `entry`
+ * @returns {{internal: object, isService: boolean, refId?: string, entry: object, needsShadow: boolean}|undefined}
+ */
+export declare function readComponentEntry(ctx: object, entry: object, pointer: string): {
+    internal: object;
+    isService: boolean;
+    refId?: string;
+    entry: object;
+    needsShadow: boolean;
+} | undefined;
+/**
+ * Note a kept component entry for the shadows. Entries read inside a section
+ * entry that is itself restored whole (annotations, vulnerabilities) are not
+ * noted, since the renderer never converts them.
+ *
+ * @param {object} ctx Reader context
+ * @param {object} read Result of readComponentEntry
+ */
+export declare function keepComponentShadow(ctx: object, read: object): void;
+/**
+ * Register the component shadows. Kept entries whose 1.x values are
+ * identical share a key; when any of them needs a shadow, all of them are
+ * registered in document order, which is the order the renderer converts
+ * them in, so each gets its own original back.
+ *
+ * @param {object} ctx Reader context
+ */
+export declare function flushComponentShadows(ctx: object): void;
+//# sourceMappingURL=cyclonedx20ReadComponents.d.ts.map

package/types/lib/inventory/cyclonedx20ReadComponents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20ReadComponents.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20ReadComponents.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AA2aH;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,SAAS,EAJpC,MAIoC,EAAE,OAAO,EAH7C,MAG6C,GAF3C,MAAM,GAAC,SAAS,CAY5B;AA8FD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EALvB,MAKuB,EAAE,SAAS,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC,MAAM,CAIlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAL9B,MAK8B,EAAE,KAAK,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,EAAE,KAAK,SAAI,GAFvD;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CA+C1D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAL3B,MAK2B,EAAE,KAAK,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAC,GAAC,SAAS,CA2BjH;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAH5B,MAG4B,EAAE,IAAI,EAFlC,MAEkC,QAS5C;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAF9B,MAE8B,QAWxC"}