@cdxgen/cdxgen 13.5.0 → 13.7.0

package/types/lib/inventory/cyclonedx20ReadContext.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Shared state and the field-mapping engine of the CycloneDX 2.0 reader.
+ *
+ * Every 2.0 object kind the reader converts has a frozen field spec: the
+ * allowlist of the members the 1.x model carries, with the 1.x name or the
+ * converter for each. `reverseFields` walks the object's own members in
+ * document order and reports every member the spec does not list as a loss,
+ * so a field the reader has no mapping for can never vanish silently.
+ *
+ * Loss pointers are RFC 6901 JSON pointers into the 2.0 input, with array
+ * indexes and `~`/`/` escaped.
+ */
+/**
+ * Mark `bom` as cdxgen's 1.x-shaped internal model. The mark is a
+ * non-enumerable symbol property, so it never reaches JSON output, and a
+ * copy made with JSON or structuredClone does not carry it.
+ *
+ * @param {object} bom The internal model
+ * @returns {object} The same object
+ */
+export declare function markInternalModel(bom: object): object;
+/**
+ * Whether `bom` carries the internal model mark of markInternalModel.
+ *
+ * @param {object} bom Any value
+ * @returns {boolean} True for a marked internal model
+ */
+export declare function isMarkedInternalModel(bom: object): boolean;
+export declare const MAX_READ_DEPTH = 256;
+/**
+ * Copy a parsed JSON value, leaving out every object nested deeper than
+ * `maxDepth` objects and recording its JSON pointer. Arrays do not count
+ * towards the depth, so every object entry of one array sits at the same
+ * depth and is cut with the rest; an array left empty by the cut is left out
+ * of its parent object too. Iterative, so no input depth can exhaust the
+ * call stack.
+ *
+ * @param {*} value Parsed JSON value
+ * @param {number} [maxDepth] Deepest object level kept
+ * @returns {{value: *, truncated: string[]}} The copy and the pointers of the
+ *   objects that were cut
+ */
+export declare function cloneWithDepthLimit(value: any, maxDepth?: number): {
+    value: any;
+    truncated: string[];
+};
+/**
+ * A fresh reader context for one 2.0 document.
+ *
+ * @param {object} doc The (private, cloned) 2.0 document
+ * @returns {object} Reader context
+ */
+export declare function createReadContext(doc: object): object;
+/**
+ * Append reference tokens to a JSON pointer (RFC 6901): `~` becomes `~0` and
+ * `/` becomes `~1`; array indexes are plain numbers.
+ *
+ * @param {string} base Pointer so far ("" is the whole document)
+ * @param {...(string|number)} tokens Member names or array indexes
+ * @returns {string} The extended pointer
+ */
+export declare function jsonPointer(base: string, ...tokens: (string | number)[]): string;
+/** Record one loss. */
+export declare function addLoss(ctx: any, pointer: any, reason: any): void;
+/**
+ * Report every defined member of `source` that `carried` does not list.
+ *
+ * @param {object} ctx Reader context
+ * @param {string} kind 2.0 object kind, used in the reason
+ * @param {object} source 2.0 object
+ * @param {string} pointer JSON pointer of `source`
+ * @param {Set<string>|object} carried Member names (a Set or spec keys)
+ */
+export declare function reportUnmapped(ctx: object, kind: string, source: object, pointer: string, carried: Set<string> | object): void;
+/**
+ * Convert one 2.0 object with a field spec. A spec maps each carried 2.0
+ * member to `true` (copied under the same name), a string (copied under that
+ * 1.x name) or `{to?, spread?, convert}` where
+ * `convert(ctx, value, pointer, source)` returns the 1.x value or undefined
+ * (and reports its own losses); a `spread` rule returns an object of 1.x
+ * members to merge (one 2.0 member feeding several 1.x fields). Members
+ * the spec does not list are reported through reportUnmapped.
+ *
+ * @param {object} ctx Reader context
+ * @param {string} kind 2.0 object kind
+ * @param {object} source 2.0 object
+ * @param {string} pointer JSON pointer of `source`
+ * @param {object} spec Frozen field spec
+ * @returns {object} The 1.x object
+ */
+export declare function reverseFields(ctx: object, kind: string, source: object, pointer: string, spec: object): object;
+/**
+ * Convert each entry of a 2.0 array with `convertEntry(ctx, entry, pointer)`,
+ * dropping entries that convert to undefined. A non-array is a loss.
+ */
+export declare function reverseList(ctx: any, value: any, pointer: any, convertEntry: any): any[] | undefined;
+/** A spec rule converting an array entry by entry. */
+export declare function listOf(convertEntry: any, to: any): Readonly<{
+    to: any;
+    convert: (ctx: any, value: any, pointer: any) => any[] | undefined;
+}>;
+/** A spec rule converting a nested object with its own spec. */
+export declare function objectOf(kind: any, spec: any, to: any): Readonly<{
+    to: any;
+    convert: (ctx: any, value: any, pointer: any) => object | undefined;
+}>;
+/** reverseFields for a value that must be an object; a loss otherwise. */
+export declare function reverseObject(ctx: any, kind: any, value: any, pointer: any, spec: any): object | undefined;
+/** Keep `original` for the 1.x value `internal` in namespace `kind`. */
+export declare function registerShadow(ctx: any, kind: any, internal: any, original: any): void;
+/** Keep `original` under a precomputed shadow key. */
+export declare function registerShadowKey(ctx: any, kind: any, key: any, original: any): void;
+/**
+ * Run `read()` with component shadows suspended: for section entries that
+ * are restored whole, whose nested components the renderer never converts.
+ */
+export declare function withoutComponentShadows(ctx: any, read: any): any;
+//# sourceMappingURL=cyclonedx20ReadContext.d.ts.map

package/types/lib/inventory/cyclonedx20ReadContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20ReadContext.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20ReadContext.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAH1B,MAG0B,GAFxB,MAAM,CAUlB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAH9B,MAG8B,GAF5B,OAAO,CAInB;AAKD,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAL9B,GAK8B,EAAE,QAAQ,AAJhD,CACA,EADQ,MAIyD,GAHvD;IAAC,KAAK,EAAE,GAAC,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,CAiE3C;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAH1B,MAG0B,GAFxB,MAAM,CAgBlB;AAsED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAJrB,MAIqB,EAAE,GAAG,MAAM,EAH7B,CAAC,MAAM,GAAC,MAAM,CAAC,EAGc,GAF9B,MAAM,CAQlB;AAED,uBAAuB;AACvB,wBAAgB,OAAO,CAAC,GAAG,KAAA,EAAE,OAAO,KAAA,EAAE,MAAM,KAAA,QAE3C;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EANvB,MAMuB,EAAE,IAAI,EAL7B,MAK6B,EAAE,MAAM,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,EAAE,OAAO,EAFvD,GAAG,CAAC,MAAM,CAAC,GAAC,MAE2C,QAYjE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAPtB,MAOsB,EAAE,IAAI,EAN5B,MAM4B,EAAE,MAAM,EALpC,MAKoC,EAAE,OAAO,EAJ7C,MAI6C,EAAE,IAAI,EAHnD,MAGmD,GAFjD,MAAM,CA6BlB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,KAAA,EAAE,KAAK,KAAA,EAAE,OAAO,KAAA,EAAE,YAAY,KAAA,qBAa5D;AAED,sDAAsD;AACtD,wBAAgB,MAAM,CAAC,YAAY,KAAA,EAAE,EAAE,KAAA;;;GAMtC;AAED,gEAAgE;AAChE,wBAAgB,QAAQ,CAAC,IAAI,KAAA,EAAE,IAAI,KAAA,EAAE,EAAE,KAAA;;;GAMtC;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,GAAG,KAAA,EAAE,IAAI,KAAA,EAAE,KAAK,KAAA,EAAE,OAAO,KAAA,EAAE,IAAI,KAAA,sBAO5D;AAED,wEAAwE;AACxE,wBAAgB,cAAc,CAAC,GAAG,KAAA,EAAE,IAAI,KAAA,EAAE,QAAQ,KAAA,EAAE,QAAQ,KAAA,QAE3D;AAED,sDAAsD;AACtD,wBAAgB,iBAAiB,CAAC,GAAG,KAAA,EAAE,IAAI,KAAA,EAAE,GAAG,KAAA,EAAE,QAAQ,KAAA,QAGzD;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,KAAA,EAAE,IAAI,KAAA,OAQhD"}

package/types/lib/inventory/cyclonedx20ReadEvidence.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Reader converters for CycloneDX 2.0 component evidence
+ * (#/$defs/cyclonedx-component-2.0/$defs/componentEvidence and
+ * #/$defs/cyclonedx-evidence-2.0) and cryptoProperties
+ * (#/$defs/cyclonedx-cryptography-2.0/$defs/cryptoProperties) back to the 1.x
+ * shapes. Each frozen spec is the allowlist of the members 1.x carries.
+ */
+/**
+ * Register the identity shadows. An identity shadow is looked up by its 1.x
+ * projection alone, whichever component carries it, so a key is registered
+ * only when every identity entry read under it needs the same original; a
+ * key shared with an entry that renders back by itself, or with a different
+ * original, is left to the component shadows.
+ *
+ * @param {object} ctx Reader context
+ */
+export declare function flushIdentityShadows(ctx: object): void;
+/**
+ * componentEvidence → 1.x evidence.
+ *
+ * @param {object} ctx Reader context
+ * @param {object} value 2.0 componentEvidence
+ * @param {string} pointer JSON pointer of `value`
+ * @returns {object|undefined} 1.x evidence
+ */
+export declare function reverseEvidence(ctx: object, value: object, pointer: string): object | undefined;
+/**
+ * cryptoProperties → 1.x cryptoProperties: list-valued
+ * `implementationPlatform` and `securedBy.algorithmRef` become one value,
+ * enum values 1.7 does not list are dropped, and 2.0-only members
+ * (`secProperties`, `renewal`, `rotation`, `keyUsage`, non-hash
+ * fingerprints) are losses.
+ *
+ * @param {object} ctx Reader context
+ * @param {object} value 2.0 cryptoProperties
+ * @param {string} pointer JSON pointer of `value`
+ * @returns {object|undefined} 1.x cryptoProperties
+ */
+export declare function reverseCryptoProperties(ctx: object, value: object, pointer: string): object | undefined;
+//# sourceMappingURL=cyclonedx20ReadEvidence.d.ts.map

package/types/lib/inventory/cyclonedx20ReadEvidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20ReadEvidence.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20ReadEvidence.js"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA4JH;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAF7B,MAE6B,QAmBvC;AA0GD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EALxB,MAKwB,EAAE,KAAK,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,MAAM,GAAC,SAAS,CAI5B;AAiJD;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,KAAK,EAJvC,MAIuC,EAAE,OAAO,EAHhD,MAGgD,GAF9C,MAAM,GAAC,SAAS,CAI5B"}

package/types/lib/inventory/cyclonedx20ReadSections.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Reader converters for the CycloneDX 2.0 document sections other than the
+ * inventories: metadata, compositions, annotations, vulnerabilities,
+ * citations and formulation. Each frozen spec is the allowlist of the
+ * members 1.x carries; everything else is a loss. Every converted section
+ * entry is kept as a shadow, so a read-then-render round trip restores the
+ * 2.0 members the 1.x model has no field for while the entry is unchanged.
+ */
+/**
+ * metadata → 1.x metadata without `component` (the inventory subject) and
+ * `tools` (read separately, so each tool component has its own shadow).
+ *
+ * @param {object} ctx Reader context
+ * @param {object} metadata 2.0 metadata
+ * @returns {object} 1.x metadata
+ */
+export declare function readMetadata(ctx: object, metadata: object): object;
+/**
+ * compositions → 1.x compositions.
+ *
+ * @param {object} ctx Reader context
+ * @param {Array} compositions 2.0 compositions
+ * @param {Map<string, string|undefined>} inventorySubjects inventory refId →
+ *   subject refId
+ * @returns {Array|undefined} 1.x compositions
+ */
+export declare function readCompositions(ctx: object, compositions: any[], inventorySubjects: Map<string, string | undefined>): any[] | undefined;
+/** annotations → 1.x annotations. */
+export declare function readAnnotations(ctx: any, annotations: any): any[] | undefined;
+/** vulnerabilities → 1.x vulnerabilities. */
+export declare function readVulnerabilities(ctx: any, vulnerabilities: any): any[] | undefined;
+/** A 2.0 citation JSONPath expression → its 1.x form. */
+export declare function reverseCitationExpression(expression: any): any;
+/** citations → 1.x citations. */
+export declare function readCitations(ctx: any, citations: any): any[] | undefined;
+/**
+ * formulation → 1.x formulas without their components (the reader puts the
+ * formula components back from definitions afterwards).
+ *
+ * @param {object} ctx Reader context
+ * @param {Array} formulation 2.0 formulation
+ * @returns {Array|undefined} 1.x formulas
+ */
+export declare function readFormulation(ctx: object, formulation: any[]): any[] | undefined;
+//# sourceMappingURL=cyclonedx20ReadSections.d.ts.map

package/types/lib/inventory/cyclonedx20ReadSections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20ReadSections.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20ReadSections.js"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA2EH;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAJrB,MAIqB,EAAE,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,CAsBlB;AAkED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EANzB,MAMyB,EAAE,YAAY,OAAA,EAAE,iBAAiB,EAJ1D,GAAG,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAI8B,GAFxD,QAAM,SAAS,CAU3B;AAkCD,qCAAqC;AACrC,wBAAgB,eAAe,CAAC,GAAG,KAAA,EAAE,WAAW,KAAA,qBAI/C;AA0JD,6CAA6C;AAC7C,wBAAgB,mBAAmB,CAAC,GAAG,KAAA,EAAE,eAAe,KAAA,qBAQvD;AAED,yDAAyD;AACzD,wBAAgB,yBAAyB,CAAC,UAAU,KAAA,OAgBnD;AAeD,iCAAiC;AACjC,wBAAgB,aAAa,CAAC,GAAG,KAAA,EAAE,SAAS,KAAA,qBAI3C;AA+HD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAJxB,MAIwB,EAAE,WAAW,OAAA,GAFnC,QAAM,SAAS,CA+B3B"}

package/types/lib/inventory/cyclonedx20Render.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Render the 1.x-shaped internal model as a CycloneDX 2.0 document: the
+ * document sections, reference integrity and the render report. The public
+ * entry points are re-exported from cyclonedx20.js.
+ */
+/**
+ * Render the 1.x-shaped internal model as a CycloneDX 2.0 document and report
+ * what could not be carried. Pure: the input is never mutated and the output
+ * shares no objects with it. Deterministic: the same input renders to the
+ * same JSON.
+ *
+ * @param {object} internalBom BOM in the 1.x shape
+ * @param {{hardwareMapper?: Function, hardwareOptions?: {includeSensitiveIdentifiers?: boolean, identifierPolicy?: string}}} [context]
+ *   What the render may use besides the model: `hardwareMapper` is the
+ *   optional toCdx20HardwareComponent of @cdxgen/cdx-hbom and
+ *   `hardwareOptions` its identifier options (see hbomLoader.js:
+ *   hardwareRenderContext and cyclonedx20RenderHardware.js). The output
+ *   depends only on the model and this context.
+ * @returns {{bomJson: object, report: {drops: Object<string, number>, rewrites: Object<string, number>, customSchemes: string[], droppedMethods: Array<{reason: string, technique: string}>}}}
+ *   The 2.0 document, the counts of values the render could not carry
+ *   (`drops`) and of values it rewrote without losing data (`rewrites`), by
+ *   label
+ */
+export declare function renderCycloneDx20WithReport(internalBom: object, context?: {
+    hardwareMapper?: Function;
+    hardwareOptions?: {
+        includeSensitiveIdentifiers?: boolean;
+        identifierPolicy?: string;
+    };
+}): {
+    bomJson: object;
+    report: {
+        drops: Record<string, number>;
+        rewrites: Record<string, number>;
+        customSchemes: string[];
+        droppedMethods: Array<{
+            reason: string;
+            technique: string;
+        }>;
+    };
+};
+/**
+ * Render the 1.x-shaped internal model as a CycloneDX 2.0 document. Pure: the
+ * input is never mutated and the output shares no objects with it. What the
+ * render could not carry is logged through thoughtLog; use
+ * renderCycloneDx20WithReport for the counts.
+ *
+ * @param {object} internalBom BOM in the 1.x shape
+ * @param {object} [context] See renderCycloneDx20WithReport
+ * @returns {object} BOM in the 2.0 shape
+ */
+export declare function renderCycloneDx20(internalBom: object, context?: object): object;
+//# sourceMappingURL=cyclonedx20Render.d.ts.map

package/types/lib/inventory/cyclonedx20Render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20Render.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20Render.js"],"names":[],"mappings":"AAAA;;;;GAIG;AA+dH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAZ5C,MAY4C,EAAE,OAAO,AAX7D,CAEuC,EAF/B;IAAC,cAAc,CAAC,WAAW;IAAC,eAAe,CAAC,EAAE;QAAC,2BAA2B,CAAC,EAAE,OAAO,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAC,CAAA;CAWtD,GALxD;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE;QAAC,KAAK,yBAAyB;QAAC,QAAQ,yBAAyB;QAAC,aAAa,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,KAAK,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAC,CAAC,CAAA;KAAC,CAAA;CAAC,CA4C7L;AAwKD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAJlC,MAIkC,EAAE,OAAO,AAHnD,CACA,EADQ,MAGgD,GAF9C,MAAM,CAIlB"}

package/types/lib/inventory/cyclonedx20RenderComponents.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Render-side conversion of 1.x components, services and tools to CycloneDX
+ * 2.0 components (#/$defs/cyclonedx-component-2.0/$defs/component).
+ */
+/**
+ * Convert license choices: 1.x license objects and expressions may carry
+ * `bom-ref`, which the 2.0 licenseDeclaration renames to `refId`
+ * (#/$defs/cyclonedx-license-2.0/$defs/licenseDeclaration), and a license
+ * `text` is an attachment.
+ *
+ * @param {object[]} licenses 1.x license choices
+ * @param {object} stats Render counters
+ * @returns {object[]|undefined} 2.0 license choices
+ */
+export declare function convertLicenses(licenses: object[], stats: object): object[] | undefined;
+/**
+ * Convert a 1.x attachment ({contentType, encoding, content}) to the 2.0
+ * attachment (#/$defs/cyclonedx-common-2.0/$defs/attachment, `mediaType`
+ * instead of `contentType`, `content` required). A content type that is not
+ * a media type the 2.0 pattern accepts is counted and left out.
+ *
+ * @param {object} attachment 1.x attachment
+ * @param {object} stats Render counters
+ * @param {string} label Counter label of the attachment's position
+ * @returns {object|undefined} 2.0 attachment, or undefined without content
+ */
+export declare function convertAttachment(attachment: object, stats: object, label: string): object | undefined;
+/**
+ * Convert release notes
+ * (#/$defs/cyclonedx-release-notes-2.0/$defs/releaseNotes): the members are
+ * the same, but each note's `text` is an attachment and a note requires it.
+ *
+ * @param {object} releaseNotes 1.x release notes
+ * @param {object} stats Render counters
+ * @returns {object|undefined} 2.0 release notes
+ */
+export declare function convertReleaseNotes(releaseNotes: object, stats: object): object | undefined;
+/** Map a 1.x free-text data classification onto the 2.0 enum or `{name}`. */
+export declare function toDataClassification(classification: any): any;
+/**
+ * Convert 1.x dataGovernance ({custodians, stewards, owners} of
+ * organization-or-contact entries) into the 2.0 array of parties
+ * (#/$defs/cyclonedx-data-2.0/$defs/dataGovernance) with the matching roles.
+ */
+export declare function convertGovernance(governance: any, stats: any): any[] | undefined;
+/** Convert 1.x data contents ({attachment, url, properties}). */
+export declare function convertDataContents(contents: any, stats: any): {
+    attachment: object;
+} | undefined;
+/**
+ * Convert one 1.x component to the 2.0 component shape
+ * (#/$defs/cyclonedx-component-2.0/$defs/component). Fields with no 2.0
+ * home (`signature`, the deprecated `modified`, …) are counted.
+ */
+export declare function convertComponent(component: any, stats: any): any;
+/**
+ * Convert one 1.x service into a 2.0 component of type `service`
+ * (#/$defs/cyclonedx-component-2.0/$defs/component/properties/type). The
+ * provider becomes a party with the `provider` role. `authenticated`,
+ * `x-trust-boundary` and `trustZone` have no 2.0 field; they ride as the
+ * cdx:service:* properties of CARRIED_SERVICE_PROPERTIES, after the service's
+ * own properties, and the reader turns them back into the 1.x fields.
+ */
+export declare function convertService(service: any, stats: any): any;
+/**
+ * Convert metadata.tools: the 1.x {components, services} object, or the
+ * legacy 1.5 array. 2.0 tools hold only `components`
+ * (#/$defs/cyclonedx-metadata-2.0/$defs/metadata/properties/tools).
+ */
+export declare function convertTools(tools: any, stats: any): {
+    components: any[];
+} | undefined;
+//# sourceMappingURL=cyclonedx20RenderComponents.d.ts.map

package/types/lib/inventory/cyclonedx20RenderComponents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20RenderComponents.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20RenderComponents.js"],"names":[],"mappings":"AAAA;;;GAGG;AAwEH;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAJ7B,MAAM,EAIuB,EAAE,KAAK,EAHpC,MAGoC,GAFlC,MAAM,EAAE,GAAC,SAAS,CAiC9B;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EALjC,MAKiC,EAAE,KAAK,EAJxC,MAIwC,EAAE,KAAK,EAH/C,MAG+C,GAF7C,MAAM,GAAC,SAAS,CAkC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAJrC,MAIqC,EAAE,KAAK,EAH5C,MAG4C,GAF1C,MAAM,GAAC,SAAS,CA0B5B;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,cAAc,KAAA,OAUlD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,KAAA,EAAE,KAAK,KAAA,qBA2BlD;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,CAAC,QAAQ,KAAA,EAAE,KAAK,KAAA;;cAuBlD;AA0ND;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,KAAA,EAAE,KAAK,KAAA,OAyChD;AA8DD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,KAAA,EAAE,KAAK,KAAA,OA4C5C;AAwCD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,KAAA,EAAE,KAAK,KAAA;;cAmBxC"}

package/types/lib/inventory/cyclonedx20RenderDefinitions.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Render-side conversion of the 1.x definitions standards and the root
+ * `declarations` (#/$defs/cyclonedx-standard-2.0 and
+ * #/$defs/cyclonedx-declaration-2.0). Their members keep their names; the
+ * 1.x `bom-ref` becomes `refId`, organizations and contacts take the 2.0
+ * common shapes, attachments the 2.0 attachment, and a 1.x JSF `signature`
+ * is counted and left out (see countSignatureDrop).
+ */
+/**
+ * Convert 1.x definitions.standards
+ * (#/$defs/cyclonedx-standard-2.0/$defs/standards). Requirement `parent`
+ * and level `requirements` are refLinkType values; the refIds keep the
+ * bom-ref values, so they still resolve.
+ *
+ * @param {object[]} standards 1.x standards
+ * @param {object} stats Render counters
+ * @returns {object[]|undefined} 2.0 standards
+ */
+export declare function convertStandards(standards: object[], stats: object): object[] | undefined;
+/**
+ * Render the root `declarations`
+ * (#/$defs/cyclonedx-declaration-2.0/$defs/declarations).
+ *
+ * @param {object} declarations 1.x declarations
+ * @param {object} stats Render counters
+ * @returns {object|undefined} 2.0 declarations
+ */
+export declare function renderDeclarations(declarations: object, stats: object): object | undefined;
+//# sourceMappingURL=cyclonedx20RenderDefinitions.d.ts.map

package/types/lib/inventory/cyclonedx20RenderDefinitions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20RenderDefinitions.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20RenderDefinitions.js"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA2FH;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAJ/B,MAAM,EAIyB,EAAE,KAAK,EAHtC,MAGsC,GAFpC,MAAM,EAAE,GAAC,SAAS,CA6C9B;AA8GD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAJpC,MAIoC,EAAE,KAAK,EAH3C,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAyI5B"}

package/types/lib/inventory/cyclonedx20RenderEvidence.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Render-side conversion of 1.x component evidence and cryptoProperties to
+ * the CycloneDX 2.0 shapes (#/$defs/cyclonedx-component-2.0/$defs/componentEvidence,
+ * #/$defs/cyclonedx-cryptography-2.0/$defs/cryptoProperties).
+ */
+/**
+ * The refId prefix of the party derived for a tool other than cdxgen. Any
+ * refId that starts with it is a valid refIdType
+ * (#/$defs/cyclonedx-common-2.0/$defs/refIdType: non-empty and not starting
+ * with the BOM-Link intro `urn:cdx:`), whatever the tool's own refId is, so
+ * the tool refId is appended unchanged and the party refId stays readable and
+ * deterministic.
+ */
+export declare const TOOL_PARTY_REF_ID_PREFIX = "party-tool-";
+/**
+ * What the claims cdxgen writes at 2.0 are attributed with (#4591). cdxgen
+ * claims only analysis it did:
+ *
+ * - `toolRefId` is the refId of the cdxgen tool component, present only when
+ *   the BOM's `metadata.tools` lists cdxgen with a `bom-ref` (the tool named
+ *   "cdxgen", the same match findCdxgenToolBomRef in
+ *   lib/inventory/citations.js makes). Identity evidence carries cdxgen's
+ *   assertion, its tool and method results only when this is set.
+ * - `assertingTool` is set only without `toolRefId`: the first other tool
+ *   component with a `bom-ref` (`{refId, toolRefId, label?}`), whose party
+ *   asserts the component identifiers (`identifiers[].party` is required).
+ *   With neither, cdxgen, as the converting tool, asserts the identifiers it
+ *   wrote.
+ * - `timestamp` is the BOM timestamp when it has one.
+ *
+ * Nothing is invented: absent members stay absent.
+ *
+ * @param {object} bom BOM in the 1.x shape (only `metadata` is read)
+ * @returns {{toolRefId?: string, assertingTool?: {refId: string, toolRefId: string, label?: string}, timestamp?: string}} Claim context
+ */
+export declare function identityClaimContext(bom: object): {
+    toolRefId?: string;
+    assertingTool?: {
+        refId: string;
+        toolRefId: string;
+        label?: string;
+    };
+    timestamp?: string;
+};
+/**
+ * The refId of the party asserting the component identifiers: the cdxgen
+ * party when cdxgen is the listed tool or no tool is listed, else the party
+ * of the first other listed tool (see identityClaimContext).
+ *
+ * @param {object} claims Claim context from identityClaimContext
+ * @returns {string} Party refId
+ */
+export declare function identifierPartyRefId(claims: object): string;
+/**
+ * The parties the renderer derives from the claim context, in the order it
+ * appends them: the cdxgen party, then the asserting tool's party when there
+ * is one. Each is a party (#/$defs/cyclonedx-party-2.0/$defs/party) with the
+ * `asserter` role and a system identity
+ * (#/$defs/cyclonedx-party-2.0/$defs/system, kind `automation`) whose `ref`
+ * names the tool component only when that refId is declared. The renderer
+ * declares one only when the document references it; the reader drops one
+ * that matches exactly, since the render derives it again.
+ *
+ * @param {object} claims Claim context from identityClaimContext
+ * @param {Set<string>} declared refIds declared in the document
+ * @returns {object[]} Party declarations
+ */
+export declare function derivedPartyDeclarations(claims: object, declared: Set<string>): object[];
+/**
+ * Convert one 1.x identity entry to componentIdentityEvidence
+ * (#/$defs/cyclonedx-component-2.0/$defs/componentIdentityEvidence). When
+ * cdxgen is the listed tool (#4591), the entry is cdxgen's attributed claim:
+ * `tools` names the helper recorded on the entry or, failing that, the cdxgen
+ * tool; `assertion` credits the cdxgen party as asserter
+ * (#/$defs/cyclonedx-evidence-2.0/$defs/assertion); and a method with a
+ * matched value has the result `detected`. For another tool's BOM cdxgen did
+ * not do that analysis, so none of these is added; the entry's own `tools`
+ * are kept. `timestamp` is the BOM's own when it has one.
+ *
+ * @param {object} entry 1.x identity evidence entry
+ * @param {object} stats Render counters from createRenderStats
+ * @returns {object|undefined} The 2.0 entry, or undefined without a field
+ */
+export declare function convertIdentityEntry(entry: object, stats: object): object | undefined;
+/**
+ * Convert component evidence
+ * (#/$defs/cyclonedx-component-2.0/$defs/componentEvidence). The 1.x
+ * `callstack` object becomes the `callStacks` array; identity `field` becomes
+ * `scheme`. Every nested object is cloned, so nothing is shared with the
+ * input.
+ */
+export declare function convertComponentEvidence(evidence: any, stats: any): {
+    identity: any[];
+    occurrences: any[];
+    callStacks: {
+        frames: any[];
+    }[];
+    licenses: any[];
+    copyright: any[];
+} | undefined;
+/**
+ * Convert cryptoProperties
+ * (#/$defs/cyclonedx-cryptography-2.0/$defs/cryptoProperties, required
+ * `[assetType]`): drop the deprecated free-text `curve` (2.0 keeps only
+ * `ellipticCurve`) and the algorithm families and protocol types the pinned
+ * 2.0 enums do not list, move the deprecated 1.x reference members into
+ * `relatedCryptographicAssets`, and count every member 2.0 has no field for.
+ */
+export declare function convertCryptoProperties(cryptoProperties: any, stats: any): any;
+//# sourceMappingURL=cyclonedx20RenderEvidence.d.ts.map

package/types/lib/inventory/cyclonedx20RenderEvidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20RenderEvidence.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20RenderEvidence.js"],"names":[],"mappings":"AAAA;;;;GAIG;AA6FH;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,gBAAgB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAH7B,MAG6B,GAF3B;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAC,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAC,CAgCxH;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAHhC,MAGgC,GAF9B,MAAM,CAIlB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAJpC,MAIoC,EAAE,QAAQ,EAH9C,GAAG,CAAC,MAAM,CAGoC,GAF5C,MAAM,EAAE,CA0BpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAJ/B,MAI+B,EAAE,KAAK,EAHtC,MAGsC,GAFpC,MAAM,GAAC,SAAS,CA6C5B;AAoID;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,KAAA,EAAE,KAAK,KAAA;;;;;;;;cAkDvD;AAiPD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,gBAAgB,KAAA,EAAE,KAAK,KAAA,OAiB9D"}

package/types/lib/inventory/cyclonedx20RenderHardware.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Hardware components at 2.0 (cdxgen/cdxgen#4755). What each `cdx:hbom:*`
+ * property means in the 2.0 draft is owned by @cdxgen/cdx-hbom, whose
+ * optional `./cdx20` export provides `toCdx20HardwareComponent(component,
+ * {partyRefId, includeSensitiveIdentifiers, identifierPolicy})`. The caller
+ * loads it (lib/inventory/hbomLoader.js: hardwareRenderContext) and passes
+ * it, with those options, to renderCycloneDx20 in the render context, so the
+ * render stays a pure function of its arguments.
+ *
+ * The renderer converts the component as usual and then takes only these
+ * members from the mapper's result, each checked against the pinned schema:
+ *
+ * - `identifiers`: only groups asserted by the party the renderer passed
+ *   (the one its own identifiers use, which it declares when referenced).
+ *   Their identities are appended to that party's group, or added as a new
+ *   group, so a purl identity is never replaced. Only identities with a
+ *   scheme from the identityScheme enum (or a custom `{name}`) and a
+ *   non-empty value are taken.
+ * - `classification` (#/$defs/cyclonedx-physical-2.0/$defs/classification):
+ *   `category`, `subcategory`, and `codes` that are taxonomyCode objects
+ *   (`{standard, value}`); a bare string code is dropped and counted.
+ * - a manufacturer party, when the generic conversion produced none.
+ *
+ * Every `cdx:hbom:*` property stays: the hbom audit rules read them.
+ */
+/** True when the 1.x component carries at least one cdx:hbom:* property. */
+export declare function isHardwareComponent(component: any): any;
+/**
+ * Add the hardware mapper's 2.0 members to a converted hardware component.
+ * Without a mapper, or for a component without cdx:hbom:* properties, the
+ * converted component is returned unchanged. The mapper gets a clone of the
+ * 1.x component, the asserting party refId the generic identifiers use (so
+ * its identifiers resolve to the party the renderer declares) and the
+ * identifier options of the render context (`stats.hardwareOptions`).
+ *
+ * @param {object} component The 1.x component
+ * @param {object} converted Its generic 2.0 conversion, extended in place
+ * @param {object} stats Render counters with the optional `hardwareMapper`
+ * @returns {object} The converted component
+ */
+export declare function applyHardwareMapping(component: object, converted: object, stats: object): object;
+//# sourceMappingURL=cyclonedx20RenderHardware.d.ts.map

package/types/lib/inventory/cyclonedx20RenderHardware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20RenderHardware.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20RenderHardware.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAeH,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,SAAS,KAAA,OAQ5C;AAqHD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EALnC,MAKmC,EAAE,SAAS,EAJ9C,MAI8C,EAAE,KAAK,EAHrD,MAGqD,GAFnD,MAAM,CA0BlB"}

package/types/lib/inventory/cyclonedx20RenderPatents.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Render-side conversion of 1.x patents, patent families and patent
+ * assertions (#/$defs/cyclonedx-patent-2.0). The members are the same; the
+ * 1.x `bom-ref` becomes `refId`, and organizations and contacts take the
+ * 2.0 common shapes.
+ */
+/**
+ * Convert 1.x definitions.patents: patents and patent families.
+ *
+ * @param {object[]} patents 1.x patents and patent families
+ * @param {object} stats Render counters
+ * @returns {object[]|undefined} 2.0 patents
+ */
+export declare function convertPatents(patents: object[], stats: object): object[] | undefined;
+/**
+ * Convert 1.x patentAssertions
+ * (#/$defs/cyclonedx-patent-2.0/$defs/patentAssertions): the asserter is an
+ * organization, a contact or a refLinkType string.
+ *
+ * @param {object[]} assertions 1.x patent assertions
+ * @param {object} stats Render counters
+ * @returns {object[]|undefined} 2.0 patent assertions, or undefined when
+ *   none is left
+ */
+export declare function convertPatentAssertions(assertions: object[], stats: object): object[] | undefined;
+//# sourceMappingURL=cyclonedx20RenderPatents.d.ts.map

package/types/lib/inventory/cyclonedx20RenderPatents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20RenderPatents.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20RenderPatents.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AA4EH;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAJ3B,MAAM,EAIqB,EAAE,KAAK,EAHlC,MAGkC,GAFhC,MAAM,EAAE,GAAC,SAAS,CA6C9B;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EALvC,MAAM,EAKiC,EAAE,KAAK,EAJ9C,MAI8C,GAH5C,MAAM,EAAE,GAAC,SAAS,CAiC9B"}

package/types/lib/inventory/cyclonedx20RenderRefIds.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Reference integrity of a rendered CycloneDX 2.0 document: every refId is
+ * unique (the 2.0 refIdType rule "Every `refId` shall be unique within the
+ * document", which JSON Schema cannot check), and dependency and
+ * vulnerability references resolve to a declared refId or a BOM-Link.
+ */
+/**
+ * Make every refId unique. The roots are walked in order, so the earliest
+ * root keeps a repeated refId; pass the inventories before metadata so the
+ * subject of a self-scan keeps its members when it repeats the refId of the
+ * tool. A later declaration with an already declared refId becomes:
+ *
+ * - a componentReference or partyReference `{ref}` when it sits in a slot
+ *   that accepts one and an earlier declaration of the same kind already
+ *   holds every member it has (nothing is lost);
+ * - nothing, in the definitions registry, under the same condition (counted
+ *   as already declared), and also when an inventory declares the refId
+ *   with other members (the members only the registry entry had are
+ *   counted as dropped);
+ * - unchanged, when neither it nor an earlier declaration sits in a
+ *   component or party slot (counted);
+ * - otherwise the same object under a new refId `<refId>-dup-<n>`, so no data
+ *   is lost and references to the refId keep resolving to the first
+ *   declaration.
+ *
+ * @param {Array<{section: string, value: *}>} roots Rendered sections, the
+ *   definitions root marked with `section: "definitions"`
+ * @param {object} stats Render counters
+ */
+export declare function dedupeRefIds(roots: Array<{
+    section: string;
+    value: any;
+}>, stats: object): void;
+/**
+ * Keep only dependency references that resolve: an entry whose `ref` names
+ * nothing declared is dropped, and so is each such `dependsOn` and
+ * `provides` member. An emptied `dependsOn` stays, since an empty list says
+ * the component has no dependencies.
+ *
+ * @param {object[]|undefined} dependencies Rendered dependencies
+ * @param {Set<string>} declared Every declared refId
+ * @param {object} stats Render counters
+ * @returns {object[]|undefined} The dependencies left, or undefined
+ */
+export declare function resolveDependencyRefs(dependencies: object[] | undefined, declared: Set<string>, stats: object): object[] | undefined;
+/**
+ * Drop vulnerability `affects` entries whose `ref` resolves to nothing, and
+ * an `affects` list left empty.
+ *
+ * @param {object[]|undefined} vulnerabilities Rendered vulnerabilities
+ * @param {Set<string>} declared Every declared refId
+ * @param {object} stats Render counters
+ */
+export declare function resolveAffectsRefs(vulnerabilities: object[] | undefined, declared: Set<string>, stats: object): void;
+//# sourceMappingURL=cyclonedx20RenderRefIds.d.ts.map

package/types/lib/inventory/cyclonedx20RenderRefIds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20RenderRefIds.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20RenderRefIds.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AAqGH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAJvB,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,GAAC,CAAA;CAAC,CAIV,EAAE,KAAK,EAF9B,MAE8B,QA2GxC;AAKD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EALvC,MAAM,EAAE,GAAC,SAK8B,EAAE,QAAQ,EAJjD,GAAG,CAAC,MAAM,CAIuC,EAAE,KAAK,EAHxD,MAGwD,GAFtD,MAAM,EAAE,GAAC,SAAS,CA6B9B;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,eAAe,EAJvC,MAAM,EAAE,GAAC,SAI8B,EAAE,QAAQ,EAHjD,GAAG,CAAC,MAAM,CAGuC,EAAE,KAAK,EAFxD,MAEwD,QAwBlE"}