@cdxgen/cdxgen 13.6.0 → 13.7.0

package/types/lib/inventory/cyclonedx20Derived.d.ts

@@ -0,0 +1,74 @@
+/**
+ * The 2.0 sections the renderer derives from the 1.x-shaped internal model
+ * rather than converts: post-quantum migration risks (pqcMigration.js,
+ * #4592), and the coding-agent parties and behavioral blueprint
+ * (agentBlueprint.js, #4593).
+ *
+ * A model read from 2.0 carries its 2.0-only sections (risks, blueprints,
+ * parties) for 2.0 output. Derived entries in them are recognised by refId
+ * (`risk-pqc-*`, `blueprint-declared-agents`, agent parties `party-agent-*`
+ * of system kind `agent`). The renderer drops carried derived entries and
+ * derives them again from the model, so they follow edits to the model and
+ * are never declared twice. Every other carried entry is kept, first, and a
+ * derived entry never replaces a carried entry with the same refId.
+ *
+ * Only cdxgen's own analysis is derived: the sections are derived only when
+ * the model's `metadata.tools` lists cdxgen with a bom-ref, the rule
+ * identityClaimContext applies to cdxgen's identity claims. Another tool's
+ * BOM converted with `cdx-convert --to 2.0` gets no derived section.
+ */
+/** A risk entry renderCycloneDx20 derives (see collectPqcRisks). */
+export declare const isDerivedRisk: (risk: any) => boolean;
+/** The blueprint renderCycloneDx20 derives (see collectAgentBehaviour). */
+export declare const isDerivedBlueprint: (blueprint: any) => boolean;
+/** An agent party renderCycloneDx20 derives (see collectAgentBehaviour). */
+export declare const isDerivedAgentParty: (party: any) => boolean;
+/**
+ * Does the model's `metadata.tools` list cdxgen with a bom-ref? The same
+ * test decides whether cdxgen's identity claims are written.
+ *
+ * @param {object} internalBom The 1.x-shaped internal model
+ * @returns {boolean} True when cdxgen is a listed tool
+ */
+export declare function isCdxgenListedTool(internalBom: object): boolean;
+/**
+ * Derive the 2.0 sections of an internal model; all empty unless cdxgen is a
+ * listed tool (isCdxgenListedTool).
+ *
+ * @param {object} internalBom The 1.x-shaped internal model
+ * @returns {{risks: object[], agentParties: object[], blueprints: object[]}}
+ */
+export declare function deriveCycloneDx20Sections(internalBom: object): {
+    risks: object[];
+    agentParties: object[];
+    blueprints: object[];
+};
+/**
+ * Add the derived risks and blueprint to a rendered document whose carried
+ * 2.0 sections are already in place, and return the parties to declare: the
+ * carried parties without derived agent parties, then the derived ones.
+ *
+ * @param {object} out The document being rendered
+ * @param {object[]} carriedParties Parties carried from a 2.0 read
+ * @param {object} internalBom The internal model the document renders
+ * @returns {object[]} The parties to declare before the cdxgen party
+ */
+export declare function appendDerivedSections(out: object, carriedParties: object[], internalBom: object): object[];
+/**
+ * Split the derived entries out of a list read from 2.0. An entry that is
+ * what the renderer derives again from the read model is dropped without a
+ * loss; a derived-looking entry that differs is dropped too (the renderer
+ * would replace it), and its index is returned so the reader reports the
+ * loss.
+ *
+ * @param {object[]} entries The 2.0 list (risks, blueprints, parties)
+ * @param {object[]} derived What the renderer derives from the read model
+ * @param {Function} isDerived Recogniser for derived entries
+ * @returns {{kept: object[], differing: number[]}} The entries to carry, and
+ *   the indexes of dropped entries that differ from the derivation
+ */
+export declare function splitDerivedEntries(entries: object[], derived: object[], isDerived: Function): {
+    kept: object[];
+    differing: number[];
+};
+//# sourceMappingURL=cyclonedx20Derived.d.ts.map

package/types/lib/inventory/cyclonedx20Derived.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20Derived.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20Derived.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAgBH,oEAAoE;AACpE,eAAO,MAAM,aAAa,wBACuB,CAAC;AAElD,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,6BACc,CAAC;AAE9C,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,yBAEC,CAAC;AAElC;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAHnC,MAGmC,GAFjC,OAAO,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAH1C,MAG0C,GAFxC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAC,CAY3E;AAWD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAL9B,MAK8B,EAAE,cAAc,EAJ9C,MAAM,EAIwC,EAAE,WAAW,EAH3D,MAG2D,GAFzD,MAAM,EAAE,CAqCpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EANhC,MAAM,EAM0B,EAAE,OAAO,EALzC,MAAM,EAKmC,EAAE,SAAS,UAAA,GAHlD;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,CAejD"}

package/types/lib/inventory/cyclonedx20Parties.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Conversions between the 1.x organizational entities and contacts and the
+ * CycloneDX 2.0 parties (#/$defs/cyclonedx-party-2.0) and common entities
+ * (#/$defs/cyclonedx-common-2.0).
+ */
+/**
+ * A person party playing `role` for a 1.x contact. The contact's `bom-ref`
+ * is the party's refId (#/$defs/cyclonedx-party-2.0/$defs/party).
+ *
+ * @param {object|string} contact 1.x organizationalContact
+ * @param {string} role Predefined role
+ * @param {object} stats Render counters
+ * @returns {object|undefined} 2.0 party
+ */
+export declare function contactToParty(contact: object | string, role: string, stats: object): object | undefined;
+/**
+ * Convert a 1.x organizationalEntity into 2.0 parties playing `role`
+ * (#/$defs/cyclonedx-party-2.0/$defs/party, required `[roles]`, exactly one
+ * identity sub-shape). The organization
+ * (#/$defs/cyclonedx-party-2.0/$defs/organization) takes `url` as
+ * `[{url}]` and `addresses` as an array and has no `bom-ref` or `contact`, so
+ * every 1.x contact becomes its own person party with the same role.
+ */
+export declare function entityToParties(entity: any, role: any, stats: any): object[];
+/**
+ * Convert a 1.x organizationalContact to the 2.0 common organizationalContact
+ * (#/$defs/cyclonedx-common-2.0/$defs/organizationalContact), which renames
+ * `bom-ref` to `refId`. Used by metadata authors and annotators.
+ */
+export declare function toCommonContact(contact: any, stats: any): {
+    name: any;
+} | {
+    refId: any;
+} | undefined;
+/**
+ * Convert a 1.x organizationalEntity to the 2.0 common organizationalEntity
+ * (#/$defs/cyclonedx-common-2.0/$defs/organizationalEntity), used by
+ * metadata.supplier, metadata.manufacturer and annotator.organization. It
+ * keeps `url` strings and `contact`, and renames `bom-ref` to `refId`.
+ */
+export declare function toCommonEntity(entity: any, stats: any): {
+    refId: any;
+    name: any;
+    address: {
+        refId: any;
+    };
+    url: any[];
+    contact: any;
+} | undefined;
+/**
+ * Convert the 1.x party-ish component fields into `parties`
+ * (#/$defs/cyclonedx-party-2.0/$defs/party). `author` strings and `authors`
+ * contacts become persons with the `author` role, `publisher` an organization
+ * with the `publisher` role, and supplier/manufacturer organizations keep
+ * their roles.
+ */
+export declare function collectParties(component: any, stats: any): object[];
+/**
+ * Read 2.0 component or service `parties` into the 1.x fields
+ * (`supplier`, `manufacturer`, `authors`, `publisher`, `provider`). A person
+ * playing the supplier, manufacturer or provider role becomes a contact of
+ * that organization, the inverse of entityToParties. Party references resolve
+ * against definitions.parties. Everything else is a loss.
+ *
+ * @param {object} ctx Reader context
+ * @param {Array} parties 2.0 parties
+ * @param {string} pointer JSON pointer of `parties`
+ * @param {object} roleFields Roles to read (subset of PARTY_ROLE_FIELDS_1X)
+ * @returns {object} 1.x fields by name
+ */
+export declare function reverseParties(ctx: object, parties: any[], pointer: string, roleFields: object): object;
+/**
+ * Read one 2.0 party (inline or a partyReference) whose roles `roleFields`
+ * lists: its roles, the 1.x organization or contact it describes, and the
+ * pointer of the party object. Unlisted roles and members are losses.
+ *
+ * @param {object} ctx Reader context
+ * @param {object} entry 2.0 party or partyReference
+ * @param {string} pointer JSON pointer of `entry`
+ * @param {object} roleFields Role names to read, as keys
+ * @returns {{roles: string[], identity: {kind: string, identity: object}, pointer: string}|undefined}
+ */
+export declare function readParty(ctx: object, entry: object, pointer: string, roleFields: object): {
+    roles: string[];
+    identity: {
+        kind: string;
+        identity: object;
+    };
+    pointer: string;
+} | undefined;
+//# sourceMappingURL=cyclonedx20Parties.d.ts.map

package/types/lib/inventory/cyclonedx20Parties.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20Parties.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20Parties.js"],"names":[],"mappings":"AAAA;;;;GAIG;AAoFH;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAL3B,MAAM,GAAC,MAKoB,EAAE,IAAI,EAJjC,MAIiC,EAAE,KAAK,EAHxC,MAGwC,GAFtC,MAAM,GAAC,SAAS,CAc5B;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,KAAA,EAAE,IAAI,KAAA,EAAE,KAAK,KAAA,YA4DlD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,KAAA,EAAE,KAAK,KAAA;;;;cAwB7C;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,KAAA,EAAE,KAAK,KAAA;;;;;;;;cAiC3C;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,SAAS,KAAA,EAAE,KAAK,KAAA,YA0B9C;AAiND;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,GAAG,EANvB,MAMuB,EAAE,OAAO,OAAA,EAAE,OAAO,EAJzC,MAIyC,EAAE,UAAU,EAHrD,MAGqD,GAFnD,MAAM,CAqBlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,GAAG,EANlB,MAMkB,EAAE,KAAK,EALzB,MAKyB,EAAE,OAAO,EAJlC,MAIkC,EAAE,UAAU,EAH9C,MAG8C,GAF5C;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CAapG"}

package/types/lib/inventory/cyclonedx20Read.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Read a CycloneDX 2.0 document into the 1.x-shaped internal model. The
+ * public entry point is re-exported from cyclonedx20.js.
+ *
+ * Where definitions.components entries go (2.0 records no membership, so the
+ * rule is fixed and deterministic, applied in document order):
+ *
+ * 0. An entry whose refId a formula lists in its
+ *    `cdx:formulation:componentRefs` property (a JSON array of refIds, which
+ *    renderCycloneDx20 writes for a subject-less document) is a component of
+ *    every formula that lists it.
+ * 1. An entry whose refId a formula references (a `ref` member, such as a
+ *    resource reference, anywhere in its tree) is a component of the first
+ *    such formula. Other strings that happen to equal the refId, such as a
+ *    task type, do not count.
+ * 2. In a document with inventories, an entry a componentReference the
+ *    reader resolves points to (from an inventory, a tool, an annotator, a
+ *    vulnerability or another definitions component) stays in definitions
+ *    (kept for 2.0 output); its content reaches 1.x through the referencing
+ *    entries.
+ * 3. In a document with inventories, any other entry is a formula component
+ *    when the document has a formulation (the renderer moves 1.x
+ *    formula.components there), and otherwise stays in definitions with a
+ *    loss: 1.x has no home for it.
+ * 4. In a document without inventories (the renderer puts a subject-less
+ *    document's components there), any other entry is a root component.
+ *    Entries without a refId follow the same rules and are never dropped.
+ * 5. Before all of these, an entry whose type 1.x does not have (`material`)
+ *    stays in definitions with a loss.
+ */
+/**
+ * Read a 2.0 document into the internal 1.x-shaped model. Never throws on a
+ * schema-valid 2.0 document. Objects nested deeper than MAX_READ_DEPTH are
+ * left out, each with a loss. The returned model carries the internal model
+ * mark (markInternalModel), which loadBomForAnalysis checks. Every member the reader sees but cannot carry
+ * into 1.x is reported in `losses` as `{pointer, reason}`, where `pointer` is
+ * an RFC 6901 JSON pointer into the input. Objects whose 1.x form would not
+ * render back to the same 2.0 object are kept under the internal sections
+ * key, so renderCycloneDx20 restores them while they are unchanged.
+ *
+ * @param {object} bom20 BOM in the 2.0 shape
+ * @returns {{internalBom: object, losses: Array<{pointer: string, reason: string}>}}
+ */
+export declare function readCycloneDx20(bom20: object): {
+    internalBom: object;
+    losses: Array<{
+        pointer: string;
+        reason: string;
+    }>;
+};
+//# sourceMappingURL=cyclonedx20Read.d.ts.map

package/types/lib/inventory/cyclonedx20Read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20Read.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20Read.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAmGH;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAH1B,MAG0B,GAFxB;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAC,CAAC,CAAA;CAAC,CA2CnF"}

package/types/lib/inventory/cyclonedx20ReadCommon.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Reader converters for the CycloneDX 2.0 common objects
+ * (#/$defs/cyclonedx-common-2.0, #/$defs/cyclonedx-license-2.0,
+ * #/$defs/cyclonedx-release-notes-2.0) back to their 1.x shapes. Each frozen
+ * spec is the allowlist of the members 1.x carries; anything else is a loss.
+ */
+/** hash (#/$defs/cyclonedx-common-2.0/$defs/hash) → 1.x hash. */
+export declare function reverseHash(ctx: any, value: any, pointer: any): object | undefined;
+/** A list of hashes. */
+export declare const HASHES_RULE: Readonly<{
+    to: any;
+    convert: (ctx: any, value: any, pointer: any) => any[] | undefined;
+}>;
+/** property (#/$defs/cyclonedx-common-2.0/$defs/property) → 1.x property. */
+export declare function reverseProperty(ctx: any, value: any, pointer: any): object | undefined;
+/** A list of properties. */
+export declare const PROPERTIES_RULE: Readonly<{
+    to: any;
+    convert: (ctx: any, value: any, pointer: any) => any[] | undefined;
+}>;
+/** externalReference → 1.x externalReference. */
+export declare function reverseExternalReference(ctx: any, value: any, pointer: any): object | undefined;
+/** A list of external references. */
+export declare const EXTERNAL_REFERENCES_RULE: Readonly<{
+    to: any;
+    convert: (ctx: any, value: any, pointer: any) => any[] | undefined;
+}>;
+/** attachment: `mediaType` is the 1.x `contentType`. */
+export declare function reverseAttachment(ctx: any, value: any, pointer: any): object | undefined;
+/** An attachment-valued member. */
+export declare const ATTACHMENT_RULE: Readonly<{
+    convert: typeof reverseAttachment;
+}>;
+/** postalAddress (common or party) → 1.x postalAddress. */
+export declare function reverseAddress(ctx: any, value: any, pointer: any): object | undefined;
+/** organizationalContact → 1.x organizationalContact. */
+export declare function reverseContact(ctx: any, value: any, pointer: any): object | undefined;
+/** organizationalEntity (common) → 1.x organizationalEntity. */
+export declare function reverseEntity(ctx: any, value: any, pointer: any): object | undefined;
+/**
+ * One licenseChoice entry. A licenseReference (`{ref}`) resolves against
+ * definitions.licenses; 1.x has no license references, so the declaration
+ * is inlined and the reference itself reported.
+ */
+export declare function reverseLicenseChoice(ctx: any, value: any, pointer: any): object | undefined;
+/** A licenses member. */
+export declare const LICENSES_RULE: Readonly<{
+    to: any;
+    convert: (ctx: any, value: any, pointer: any) => any[] | undefined;
+}>;
+/**
+ * Issues a patch or release resolves. 1.x lists issues only; a reference to a
+ * weakness, vulnerability or requirement has no 1.x form.
+ */
+export declare const RESOLVES_RULE: Readonly<{
+    to: any;
+    convert: (ctx: any, value: any, pointer: any) => any[] | undefined;
+}>;
+/**
+ * releaseNotes, inline or a releaseNotesReference resolved against
+ * definitions.releaseNotes (1.x has no reference form).
+ */
+export declare function reverseReleaseNotes(ctx: any, value: any, pointer: any): object | undefined;
+/** A patentAssertions member; 1.x requires `asserter` and `assertionType`. */
+export declare const PATENT_ASSERTIONS_RULE: Readonly<{
+    to: any;
+    convert: (ctx: any, value: any, pointer: any) => any[] | undefined;
+}>;
+//# sourceMappingURL=cyclonedx20ReadCommon.d.ts.map

package/types/lib/inventory/cyclonedx20ReadCommon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20ReadCommon.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20ReadCommon.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AAmBH,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,GAAG,KAAA,EAAE,KAAK,KAAA,EAAE,OAAO,KAAA,sBAE9C;AAED,wBAAwB;AACxB,eAAO,MAAM,WAAW;;;EAAsB,CAAC;AAI/C,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,GAAG,KAAA,EAAE,KAAK,KAAA,EAAE,OAAO,KAAA,sBAElD;AAED,4BAA4B;AAC5B,eAAO,MAAM,eAAe;;;EAA0B,CAAC;AA0BvD,iDAAiD;AACjD,wBAAgB,wBAAwB,CAAC,GAAG,KAAA,EAAE,KAAK,KAAA,EAAE,OAAO,KAAA,sBAQ3D;AAED,qCAAqC;AACrC,eAAO,MAAM,wBAAwB;;;EAAmC,CAAC;AAQzE,wDAAwD;AACxD,wBAAgB,iBAAiB,CAAC,GAAG,KAAA,EAAE,KAAK,KAAA,EAAE,OAAO,KAAA,sBAEpD;AAED,mCAAmC;AACnC,eAAO,MAAM,eAAe;;EAAgD,CAAC;AAY7E,2DAA2D;AAC3D,wBAAgB,cAAc,CAAC,GAAG,KAAA,EAAE,KAAK,KAAA,EAAE,OAAO,KAAA,sBAEjD;AASD,yDAAyD;AACzD,wBAAgB,cAAc,CAAC,GAAG,KAAA,EAAE,KAAK,KAAA,EAAE,OAAO,KAAA,sBAQjD;AAUD,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,GAAG,KAAA,EAAE,KAAK,KAAA,EAAE,OAAO,KAAA,sBAQhD;AAyDD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,KAAA,EAAE,KAAK,KAAA,EAAE,OAAO,KAAA,sBAwCvD;AAED,yBAAyB;AACzB,eAAO,MAAM,aAAa;;;EAA+B,CAAC;AAE1D;;;GAGG;AACH,eAAO,MAAM,aAAa;;;EAMxB,CAAC;AAoBH;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,KAAA,EAAE,KAAK,KAAA,EAAE,OAAO,KAAA,sBA2BtD;AA+CD,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB;;;EAajC,CAAC"}

package/types/lib/inventory/cyclonedx20ReadComponents.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Reader converters for CycloneDX 2.0 components
+ * (#/$defs/cyclonedx-component-2.0/$defs/component) back to 1.x components
+ * and, for `type: service`, 1.x services. Each frozen spec is the allowlist
+ * of the members 1.x carries; everything else is reported as a loss.
+ */
+/**
+ * A 2.0 component (not a service) → a 1.x component, or undefined when its
+ * type has no 1.x equivalent (a loss).
+ *
+ * @param {object} ctx Reader context
+ * @param {object} component 2.0 component
+ * @param {string} pointer JSON pointer of `component`
+ * @returns {object|undefined} 1.x component
+ */
+export declare function reverseComponent(ctx: object, component: object, pointer: string): object | undefined;
+/**
+ * A 2.0 component of type `service` → a 1.x service.
+ *
+ * @param {object} ctx Reader context
+ * @param {object} component 2.0 service component
+ * @param {string} pointer JSON pointer of `component`
+ * @returns {object} 1.x service
+ */
+export declare function reverseService(ctx: object, component: object, pointer: string): object;
+/**
+ * Resolve a componentEntry (component, componentReference or
+ * component-choice) to a concrete component. A reference resolves against
+ * every declared component; a choice keeps its first resolvable member.
+ *
+ * @param {object} ctx Reader context (with `componentIndex`)
+ * @param {object} entry 2.0 componentEntry
+ * @param {string} pointer JSON pointer of `entry`
+ * @returns {{component: object, pointer: string}|undefined}
+ */
+export declare function resolveComponentEntry(ctx: object, entry: object, pointer: string, depth?: number): {
+    component: object;
+    pointer: string;
+} | undefined;
+/**
+ * Read one top-level component entry (an inventory entry, subject, tool,
+ * definitions component, formula component or annotator) into 1.x, as a
+ * component or a service. `needsShadow` is set when the 1.x value does not
+ * render back to the same 2.0 entry; a caller that keeps the entry passes the
+ * result to keepComponentShadow.
+ *
+ * @param {object} ctx Reader context
+ * @param {object} entry 2.0 componentEntry
+ * @param {string} pointer JSON pointer of `entry`
+ * @returns {{internal: object, isService: boolean, refId?: string, entry: object, needsShadow: boolean}|undefined}
+ */
+export declare function readComponentEntry(ctx: object, entry: object, pointer: string): {
+    internal: object;
+    isService: boolean;
+    refId?: string;
+    entry: object;
+    needsShadow: boolean;
+} | undefined;
+/**
+ * Note a kept component entry for the shadows. Entries read inside a section
+ * entry that is itself restored whole (annotations, vulnerabilities) are not
+ * noted, since the renderer never converts them.
+ *
+ * @param {object} ctx Reader context
+ * @param {object} read Result of readComponentEntry
+ */
+export declare function keepComponentShadow(ctx: object, read: object): void;
+/**
+ * Register the component shadows. Kept entries whose 1.x values are
+ * identical share a key; when any of them needs a shadow, all of them are
+ * registered in document order, which is the order the renderer converts
+ * them in, so each gets its own original back.
+ *
+ * @param {object} ctx Reader context
+ */
+export declare function flushComponentShadows(ctx: object): void;
+//# sourceMappingURL=cyclonedx20ReadComponents.d.ts.map

package/types/lib/inventory/cyclonedx20ReadComponents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20ReadComponents.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20ReadComponents.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AA2aH;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EALzB,MAKyB,EAAE,SAAS,EAJpC,MAIoC,EAAE,OAAO,EAH7C,MAG6C,GAF3C,MAAM,GAAC,SAAS,CAY5B;AA8FD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EALvB,MAKuB,EAAE,SAAS,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC,MAAM,CAIlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAL9B,MAK8B,EAAE,KAAK,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,EAAE,KAAK,SAAI,GAFvD;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAAC,SAAS,CA+C1D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAL3B,MAK2B,EAAE,KAAK,EAJlC,MAIkC,EAAE,OAAO,EAH3C,MAG2C,GAFzC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAC,GAAC,SAAS,CA2BjH;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAH5B,MAG4B,EAAE,IAAI,EAFlC,MAEkC,QAS5C;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAF9B,MAE8B,QAWxC"}

package/types/lib/inventory/cyclonedx20ReadContext.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Shared state and the field-mapping engine of the CycloneDX 2.0 reader.
+ *
+ * Every 2.0 object kind the reader converts has a frozen field spec: the
+ * allowlist of the members the 1.x model carries, with the 1.x name or the
+ * converter for each. `reverseFields` walks the object's own members in
+ * document order and reports every member the spec does not list as a loss,
+ * so a field the reader has no mapping for can never vanish silently.
+ *
+ * Loss pointers are RFC 6901 JSON pointers into the 2.0 input, with array
+ * indexes and `~`/`/` escaped.
+ */
+/**
+ * Mark `bom` as cdxgen's 1.x-shaped internal model. The mark is a
+ * non-enumerable symbol property, so it never reaches JSON output, and a
+ * copy made with JSON or structuredClone does not carry it.
+ *
+ * @param {object} bom The internal model
+ * @returns {object} The same object
+ */
+export declare function markInternalModel(bom: object): object;
+/**
+ * Whether `bom` carries the internal model mark of markInternalModel.
+ *
+ * @param {object} bom Any value
+ * @returns {boolean} True for a marked internal model
+ */
+export declare function isMarkedInternalModel(bom: object): boolean;
+export declare const MAX_READ_DEPTH = 256;
+/**
+ * Copy a parsed JSON value, leaving out every object nested deeper than
+ * `maxDepth` objects and recording its JSON pointer. Arrays do not count
+ * towards the depth, so every object entry of one array sits at the same
+ * depth and is cut with the rest; an array left empty by the cut is left out
+ * of its parent object too. Iterative, so no input depth can exhaust the
+ * call stack.
+ *
+ * @param {*} value Parsed JSON value
+ * @param {number} [maxDepth] Deepest object level kept
+ * @returns {{value: *, truncated: string[]}} The copy and the pointers of the
+ *   objects that were cut
+ */
+export declare function cloneWithDepthLimit(value: any, maxDepth?: number): {
+    value: any;
+    truncated: string[];
+};
+/**
+ * A fresh reader context for one 2.0 document.
+ *
+ * @param {object} doc The (private, cloned) 2.0 document
+ * @returns {object} Reader context
+ */
+export declare function createReadContext(doc: object): object;
+/**
+ * Append reference tokens to a JSON pointer (RFC 6901): `~` becomes `~0` and
+ * `/` becomes `~1`; array indexes are plain numbers.
+ *
+ * @param {string} base Pointer so far ("" is the whole document)
+ * @param {...(string|number)} tokens Member names or array indexes
+ * @returns {string} The extended pointer
+ */
+export declare function jsonPointer(base: string, ...tokens: (string | number)[]): string;
+/** Record one loss. */
+export declare function addLoss(ctx: any, pointer: any, reason: any): void;
+/**
+ * Report every defined member of `source` that `carried` does not list.
+ *
+ * @param {object} ctx Reader context
+ * @param {string} kind 2.0 object kind, used in the reason
+ * @param {object} source 2.0 object
+ * @param {string} pointer JSON pointer of `source`
+ * @param {Set<string>|object} carried Member names (a Set or spec keys)
+ */
+export declare function reportUnmapped(ctx: object, kind: string, source: object, pointer: string, carried: Set<string> | object): void;
+/**
+ * Convert one 2.0 object with a field spec. A spec maps each carried 2.0
+ * member to `true` (copied under the same name), a string (copied under that
+ * 1.x name) or `{to?, spread?, convert}` where
+ * `convert(ctx, value, pointer, source)` returns the 1.x value or undefined
+ * (and reports its own losses); a `spread` rule returns an object of 1.x
+ * members to merge (one 2.0 member feeding several 1.x fields). Members
+ * the spec does not list are reported through reportUnmapped.
+ *
+ * @param {object} ctx Reader context
+ * @param {string} kind 2.0 object kind
+ * @param {object} source 2.0 object
+ * @param {string} pointer JSON pointer of `source`
+ * @param {object} spec Frozen field spec
+ * @returns {object} The 1.x object
+ */
+export declare function reverseFields(ctx: object, kind: string, source: object, pointer: string, spec: object): object;
+/**
+ * Convert each entry of a 2.0 array with `convertEntry(ctx, entry, pointer)`,
+ * dropping entries that convert to undefined. A non-array is a loss.
+ */
+export declare function reverseList(ctx: any, value: any, pointer: any, convertEntry: any): any[] | undefined;
+/** A spec rule converting an array entry by entry. */
+export declare function listOf(convertEntry: any, to: any): Readonly<{
+    to: any;
+    convert: (ctx: any, value: any, pointer: any) => any[] | undefined;
+}>;
+/** A spec rule converting a nested object with its own spec. */
+export declare function objectOf(kind: any, spec: any, to: any): Readonly<{
+    to: any;
+    convert: (ctx: any, value: any, pointer: any) => object | undefined;
+}>;
+/** reverseFields for a value that must be an object; a loss otherwise. */
+export declare function reverseObject(ctx: any, kind: any, value: any, pointer: any, spec: any): object | undefined;
+/** Keep `original` for the 1.x value `internal` in namespace `kind`. */
+export declare function registerShadow(ctx: any, kind: any, internal: any, original: any): void;
+/** Keep `original` under a precomputed shadow key. */
+export declare function registerShadowKey(ctx: any, kind: any, key: any, original: any): void;
+/**
+ * Run `read()` with component shadows suspended: for section entries that
+ * are restored whole, whose nested components the renderer never converts.
+ */
+export declare function withoutComponentShadows(ctx: any, read: any): any;
+//# sourceMappingURL=cyclonedx20ReadContext.d.ts.map

package/types/lib/inventory/cyclonedx20ReadContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20ReadContext.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20ReadContext.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAH1B,MAG0B,GAFxB,MAAM,CAUlB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAH9B,MAG8B,GAF5B,OAAO,CAInB;AAKD,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAL9B,GAK8B,EAAE,QAAQ,AAJhD,CACA,EADQ,MAIyD,GAHvD;IAAC,KAAK,EAAE,GAAC,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAC,CAiE3C;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAH1B,MAG0B,GAFxB,MAAM,CAgBlB;AAsED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAJrB,MAIqB,EAAE,GAAG,MAAM,EAH7B,CAAC,MAAM,GAAC,MAAM,CAAC,EAGc,GAF9B,MAAM,CAQlB;AAED,uBAAuB;AACvB,wBAAgB,OAAO,CAAC,GAAG,KAAA,EAAE,OAAO,KAAA,EAAE,MAAM,KAAA,QAE3C;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EANvB,MAMuB,EAAE,IAAI,EAL7B,MAK6B,EAAE,MAAM,EAJrC,MAIqC,EAAE,OAAO,EAH9C,MAG8C,EAAE,OAAO,EAFvD,GAAG,CAAC,MAAM,CAAC,GAAC,MAE2C,QAYjE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAPtB,MAOsB,EAAE,IAAI,EAN5B,MAM4B,EAAE,MAAM,EALpC,MAKoC,EAAE,OAAO,EAJ7C,MAI6C,EAAE,IAAI,EAHnD,MAGmD,GAFjD,MAAM,CA6BlB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,KAAA,EAAE,KAAK,KAAA,EAAE,OAAO,KAAA,EAAE,YAAY,KAAA,qBAa5D;AAED,sDAAsD;AACtD,wBAAgB,MAAM,CAAC,YAAY,KAAA,EAAE,EAAE,KAAA;;;GAMtC;AAED,gEAAgE;AAChE,wBAAgB,QAAQ,CAAC,IAAI,KAAA,EAAE,IAAI,KAAA,EAAE,EAAE,KAAA;;;GAMtC;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,GAAG,KAAA,EAAE,IAAI,KAAA,EAAE,KAAK,KAAA,EAAE,OAAO,KAAA,EAAE,IAAI,KAAA,sBAO5D;AAED,wEAAwE;AACxE,wBAAgB,cAAc,CAAC,GAAG,KAAA,EAAE,IAAI,KAAA,EAAE,QAAQ,KAAA,EAAE,QAAQ,KAAA,QAE3D;AAED,sDAAsD;AACtD,wBAAgB,iBAAiB,CAAC,GAAG,KAAA,EAAE,IAAI,KAAA,EAAE,GAAG,KAAA,EAAE,QAAQ,KAAA,QAGzD;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,KAAA,EAAE,IAAI,KAAA,OAQhD"}

package/types/lib/inventory/cyclonedx20ReadEvidence.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Reader converters for CycloneDX 2.0 component evidence
+ * (#/$defs/cyclonedx-component-2.0/$defs/componentEvidence and
+ * #/$defs/cyclonedx-evidence-2.0) and cryptoProperties
+ * (#/$defs/cyclonedx-cryptography-2.0/$defs/cryptoProperties) back to the 1.x
+ * shapes. Each frozen spec is the allowlist of the members 1.x carries.
+ */
+/**
+ * Register the identity shadows. An identity shadow is looked up by its 1.x
+ * projection alone, whichever component carries it, so a key is registered
+ * only when every identity entry read under it needs the same original; a
+ * key shared with an entry that renders back by itself, or with a different
+ * original, is left to the component shadows.
+ *
+ * @param {object} ctx Reader context
+ */
+export declare function flushIdentityShadows(ctx: object): void;
+/**
+ * componentEvidence → 1.x evidence.
+ *
+ * @param {object} ctx Reader context
+ * @param {object} value 2.0 componentEvidence
+ * @param {string} pointer JSON pointer of `value`
+ * @returns {object|undefined} 1.x evidence
+ */
+export declare function reverseEvidence(ctx: object, value: object, pointer: string): object | undefined;
+/**
+ * cryptoProperties → 1.x cryptoProperties: list-valued
+ * `implementationPlatform` and `securedBy.algorithmRef` become one value,
+ * enum values 1.7 does not list are dropped, and 2.0-only members
+ * (`secProperties`, `renewal`, `rotation`, `keyUsage`, non-hash
+ * fingerprints) are losses.
+ *
+ * @param {object} ctx Reader context
+ * @param {object} value 2.0 cryptoProperties
+ * @param {string} pointer JSON pointer of `value`
+ * @returns {object|undefined} 1.x cryptoProperties
+ */
+export declare function reverseCryptoProperties(ctx: object, value: object, pointer: string): object | undefined;
+//# sourceMappingURL=cyclonedx20ReadEvidence.d.ts.map

package/types/lib/inventory/cyclonedx20ReadEvidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20ReadEvidence.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20ReadEvidence.js"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA4JH;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAF7B,MAE6B,QAmBvC;AA0GD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EALxB,MAKwB,EAAE,KAAK,EAJ/B,MAI+B,EAAE,OAAO,EAHxC,MAGwC,GAFtC,MAAM,GAAC,SAAS,CAI5B;AAiJD;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EALhC,MAKgC,EAAE,KAAK,EAJvC,MAIuC,EAAE,OAAO,EAHhD,MAGgD,GAF9C,MAAM,GAAC,SAAS,CAI5B"}

package/types/lib/inventory/cyclonedx20ReadSections.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Reader converters for the CycloneDX 2.0 document sections other than the
+ * inventories: metadata, compositions, annotations, vulnerabilities,
+ * citations and formulation. Each frozen spec is the allowlist of the
+ * members 1.x carries; everything else is a loss. Every converted section
+ * entry is kept as a shadow, so a read-then-render round trip restores the
+ * 2.0 members the 1.x model has no field for while the entry is unchanged.
+ */
+/**
+ * metadata → 1.x metadata without `component` (the inventory subject) and
+ * `tools` (read separately, so each tool component has its own shadow).
+ *
+ * @param {object} ctx Reader context
+ * @param {object} metadata 2.0 metadata
+ * @returns {object} 1.x metadata
+ */
+export declare function readMetadata(ctx: object, metadata: object): object;
+/**
+ * compositions → 1.x compositions.
+ *
+ * @param {object} ctx Reader context
+ * @param {Array} compositions 2.0 compositions
+ * @param {Map<string, string|undefined>} inventorySubjects inventory refId →
+ *   subject refId
+ * @returns {Array|undefined} 1.x compositions
+ */
+export declare function readCompositions(ctx: object, compositions: any[], inventorySubjects: Map<string, string | undefined>): any[] | undefined;
+/** annotations → 1.x annotations. */
+export declare function readAnnotations(ctx: any, annotations: any): any[] | undefined;
+/** vulnerabilities → 1.x vulnerabilities. */
+export declare function readVulnerabilities(ctx: any, vulnerabilities: any): any[] | undefined;
+/** A 2.0 citation JSONPath expression → its 1.x form. */
+export declare function reverseCitationExpression(expression: any): any;
+/** citations → 1.x citations. */
+export declare function readCitations(ctx: any, citations: any): any[] | undefined;
+/**
+ * formulation → 1.x formulas without their components (the reader puts the
+ * formula components back from definitions afterwards).
+ *
+ * @param {object} ctx Reader context
+ * @param {Array} formulation 2.0 formulation
+ * @returns {Array|undefined} 1.x formulas
+ */
+export declare function readFormulation(ctx: object, formulation: any[]): any[] | undefined;
+//# sourceMappingURL=cyclonedx20ReadSections.d.ts.map

package/types/lib/inventory/cyclonedx20ReadSections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20ReadSections.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20ReadSections.js"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA2EH;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAJrB,MAIqB,EAAE,QAAQ,EAH/B,MAG+B,GAF7B,MAAM,CAsBlB;AAkED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EANzB,MAMyB,EAAE,YAAY,OAAA,EAAE,iBAAiB,EAJ1D,GAAG,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAI8B,GAFxD,QAAM,SAAS,CAU3B;AAkCD,qCAAqC;AACrC,wBAAgB,eAAe,CAAC,GAAG,KAAA,EAAE,WAAW,KAAA,qBAI/C;AA0JD,6CAA6C;AAC7C,wBAAgB,mBAAmB,CAAC,GAAG,KAAA,EAAE,eAAe,KAAA,qBAQvD;AAED,yDAAyD;AACzD,wBAAgB,yBAAyB,CAAC,UAAU,KAAA,OAgBnD;AAeD,iCAAiC;AACjC,wBAAgB,aAAa,CAAC,GAAG,KAAA,EAAE,SAAS,KAAA,qBAI3C;AA+HD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAJxB,MAIwB,EAAE,WAAW,OAAA,GAFnC,QAAM,SAAS,CA+B3B"}