@cdxgen/cdxgen 13.6.0 → 13.7.0

package/types/lib/inventory/cyclonedx20Render.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Render the 1.x-shaped internal model as a CycloneDX 2.0 document: the
+ * document sections, reference integrity and the render report. The public
+ * entry points are re-exported from cyclonedx20.js.
+ */
+/**
+ * Render the 1.x-shaped internal model as a CycloneDX 2.0 document and report
+ * what could not be carried. Pure: the input is never mutated and the output
+ * shares no objects with it. Deterministic: the same input renders to the
+ * same JSON.
+ *
+ * @param {object} internalBom BOM in the 1.x shape
+ * @param {{hardwareMapper?: Function, hardwareOptions?: {includeSensitiveIdentifiers?: boolean, identifierPolicy?: string}}} [context]
+ *   What the render may use besides the model: `hardwareMapper` is the
+ *   optional toCdx20HardwareComponent of @cdxgen/cdx-hbom and
+ *   `hardwareOptions` its identifier options (see hbomLoader.js:
+ *   hardwareRenderContext and cyclonedx20RenderHardware.js). The output
+ *   depends only on the model and this context.
+ * @returns {{bomJson: object, report: {drops: Object<string, number>, rewrites: Object<string, number>, customSchemes: string[], droppedMethods: Array<{reason: string, technique: string}>}}}
+ *   The 2.0 document, the counts of values the render could not carry
+ *   (`drops`) and of values it rewrote without losing data (`rewrites`), by
+ *   label
+ */
+export declare function renderCycloneDx20WithReport(internalBom: object, context?: {
+    hardwareMapper?: Function;
+    hardwareOptions?: {
+        includeSensitiveIdentifiers?: boolean;
+        identifierPolicy?: string;
+    };
+}): {
+    bomJson: object;
+    report: {
+        drops: Record<string, number>;
+        rewrites: Record<string, number>;
+        customSchemes: string[];
+        droppedMethods: Array<{
+            reason: string;
+            technique: string;
+        }>;
+    };
+};
+/**
+ * Render the 1.x-shaped internal model as a CycloneDX 2.0 document. Pure: the
+ * input is never mutated and the output shares no objects with it. What the
+ * render could not carry is logged through thoughtLog; use
+ * renderCycloneDx20WithReport for the counts.
+ *
+ * @param {object} internalBom BOM in the 1.x shape
+ * @param {object} [context] See renderCycloneDx20WithReport
+ * @returns {object} BOM in the 2.0 shape
+ */
+export declare function renderCycloneDx20(internalBom: object, context?: object): object;
+//# sourceMappingURL=cyclonedx20Render.d.ts.map

package/types/lib/inventory/cyclonedx20Render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20Render.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20Render.js"],"names":[],"mappings":"AAAA;;;;GAIG;AA+dH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAZ5C,MAY4C,EAAE,OAAO,AAX7D,CAEuC,EAF/B;IAAC,cAAc,CAAC,WAAW;IAAC,eAAe,CAAC,EAAE;QAAC,2BAA2B,CAAC,EAAE,OAAO,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAC,CAAA;CAWtD,GALxD;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE;QAAC,KAAK,yBAAyB;QAAC,QAAQ,yBAAyB;QAAC,aAAa,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,KAAK,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAC,CAAC,CAAA;KAAC,CAAA;CAAC,CA4C7L;AAwKD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAJlC,MAIkC,EAAE,OAAO,AAHnD,CACA,EADQ,MAGgD,GAF9C,MAAM,CAIlB"}

package/types/lib/inventory/cyclonedx20RenderComponents.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Render-side conversion of 1.x components, services and tools to CycloneDX
+ * 2.0 components (#/$defs/cyclonedx-component-2.0/$defs/component).
+ */
+/**
+ * Convert license choices: 1.x license objects and expressions may carry
+ * `bom-ref`, which the 2.0 licenseDeclaration renames to `refId`
+ * (#/$defs/cyclonedx-license-2.0/$defs/licenseDeclaration), and a license
+ * `text` is an attachment.
+ *
+ * @param {object[]} licenses 1.x license choices
+ * @param {object} stats Render counters
+ * @returns {object[]|undefined} 2.0 license choices
+ */
+export declare function convertLicenses(licenses: object[], stats: object): object[] | undefined;
+/**
+ * Convert a 1.x attachment ({contentType, encoding, content}) to the 2.0
+ * attachment (#/$defs/cyclonedx-common-2.0/$defs/attachment, `mediaType`
+ * instead of `contentType`, `content` required). A content type that is not
+ * a media type the 2.0 pattern accepts is counted and left out.
+ *
+ * @param {object} attachment 1.x attachment
+ * @param {object} stats Render counters
+ * @param {string} label Counter label of the attachment's position
+ * @returns {object|undefined} 2.0 attachment, or undefined without content
+ */
+export declare function convertAttachment(attachment: object, stats: object, label: string): object | undefined;
+/**
+ * Convert release notes
+ * (#/$defs/cyclonedx-release-notes-2.0/$defs/releaseNotes): the members are
+ * the same, but each note's `text` is an attachment and a note requires it.
+ *
+ * @param {object} releaseNotes 1.x release notes
+ * @param {object} stats Render counters
+ * @returns {object|undefined} 2.0 release notes
+ */
+export declare function convertReleaseNotes(releaseNotes: object, stats: object): object | undefined;
+/** Map a 1.x free-text data classification onto the 2.0 enum or `{name}`. */
+export declare function toDataClassification(classification: any): any;
+/**
+ * Convert 1.x dataGovernance ({custodians, stewards, owners} of
+ * organization-or-contact entries) into the 2.0 array of parties
+ * (#/$defs/cyclonedx-data-2.0/$defs/dataGovernance) with the matching roles.
+ */
+export declare function convertGovernance(governance: any, stats: any): any[] | undefined;
+/** Convert 1.x data contents ({attachment, url, properties}). */
+export declare function convertDataContents(contents: any, stats: any): {
+    attachment: object;
+} | undefined;
+/**
+ * Convert one 1.x component to the 2.0 component shape
+ * (#/$defs/cyclonedx-component-2.0/$defs/component). Fields with no 2.0
+ * home (`signature`, the deprecated `modified`, …) are counted.
+ */
+export declare function convertComponent(component: any, stats: any): any;
+/**
+ * Convert one 1.x service into a 2.0 component of type `service`
+ * (#/$defs/cyclonedx-component-2.0/$defs/component/properties/type). The
+ * provider becomes a party with the `provider` role. `authenticated`,
+ * `x-trust-boundary` and `trustZone` have no 2.0 field; they ride as the
+ * cdx:service:* properties of CARRIED_SERVICE_PROPERTIES, after the service's
+ * own properties, and the reader turns them back into the 1.x fields.
+ */
+export declare function convertService(service: any, stats: any): any;
+/**
+ * Convert metadata.tools: the 1.x {components, services} object, or the
+ * legacy 1.5 array. 2.0 tools hold only `components`
+ * (#/$defs/cyclonedx-metadata-2.0/$defs/metadata/properties/tools).
+ */
+export declare function convertTools(tools: any, stats: any): {
+    components: any[];
+} | undefined;
+//# sourceMappingURL=cyclonedx20RenderComponents.d.ts.map

package/types/lib/inventory/cyclonedx20RenderComponents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20RenderComponents.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20RenderComponents.js"],"names":[],"mappings":"AAAA;;;GAGG;AAwEH;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAJ7B,MAAM,EAIuB,EAAE,KAAK,EAHpC,MAGoC,GAFlC,MAAM,EAAE,GAAC,SAAS,CAiC9B;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EALjC,MAKiC,EAAE,KAAK,EAJxC,MAIwC,EAAE,KAAK,EAH/C,MAG+C,GAF7C,MAAM,GAAC,SAAS,CAkC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAJrC,MAIqC,EAAE,KAAK,EAH5C,MAG4C,GAF1C,MAAM,GAAC,SAAS,CA0B5B;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,cAAc,KAAA,OAUlD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,KAAA,EAAE,KAAK,KAAA,qBA2BlD;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,CAAC,QAAQ,KAAA,EAAE,KAAK,KAAA;;cAuBlD;AA0ND;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,KAAA,EAAE,KAAK,KAAA,OAyChD;AA8DD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,KAAA,EAAE,KAAK,KAAA,OA4C5C;AAwCD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,KAAA,EAAE,KAAK,KAAA;;cAmBxC"}

package/types/lib/inventory/cyclonedx20RenderDefinitions.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Render-side conversion of the 1.x definitions standards and the root
+ * `declarations` (#/$defs/cyclonedx-standard-2.0 and
+ * #/$defs/cyclonedx-declaration-2.0). Their members keep their names; the
+ * 1.x `bom-ref` becomes `refId`, organizations and contacts take the 2.0
+ * common shapes, attachments the 2.0 attachment, and a 1.x JSF `signature`
+ * is counted and left out (see countSignatureDrop).
+ */
+/**
+ * Convert 1.x definitions.standards
+ * (#/$defs/cyclonedx-standard-2.0/$defs/standards). Requirement `parent`
+ * and level `requirements` are refLinkType values; the refIds keep the
+ * bom-ref values, so they still resolve.
+ *
+ * @param {object[]} standards 1.x standards
+ * @param {object} stats Render counters
+ * @returns {object[]|undefined} 2.0 standards
+ */
+export declare function convertStandards(standards: object[], stats: object): object[] | undefined;
+/**
+ * Render the root `declarations`
+ * (#/$defs/cyclonedx-declaration-2.0/$defs/declarations).
+ *
+ * @param {object} declarations 1.x declarations
+ * @param {object} stats Render counters
+ * @returns {object|undefined} 2.0 declarations
+ */
+export declare function renderDeclarations(declarations: object, stats: object): object | undefined;
+//# sourceMappingURL=cyclonedx20RenderDefinitions.d.ts.map

package/types/lib/inventory/cyclonedx20RenderDefinitions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20RenderDefinitions.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20RenderDefinitions.js"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA2FH;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAJ/B,MAAM,EAIyB,EAAE,KAAK,EAHtC,MAGsC,GAFpC,MAAM,EAAE,GAAC,SAAS,CA6C9B;AA8GD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAJpC,MAIoC,EAAE,KAAK,EAH3C,MAG2C,GAFzC,MAAM,GAAC,SAAS,CAyI5B"}

package/types/lib/inventory/cyclonedx20RenderEvidence.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Render-side conversion of 1.x component evidence and cryptoProperties to
+ * the CycloneDX 2.0 shapes (#/$defs/cyclonedx-component-2.0/$defs/componentEvidence,
+ * #/$defs/cyclonedx-cryptography-2.0/$defs/cryptoProperties).
+ */
+/**
+ * The refId prefix of the party derived for a tool other than cdxgen. Any
+ * refId that starts with it is a valid refIdType
+ * (#/$defs/cyclonedx-common-2.0/$defs/refIdType: non-empty and not starting
+ * with the BOM-Link intro `urn:cdx:`), whatever the tool's own refId is, so
+ * the tool refId is appended unchanged and the party refId stays readable and
+ * deterministic.
+ */
+export declare const TOOL_PARTY_REF_ID_PREFIX = "party-tool-";
+/**
+ * What the claims cdxgen writes at 2.0 are attributed with (#4591). cdxgen
+ * claims only analysis it did:
+ *
+ * - `toolRefId` is the refId of the cdxgen tool component, present only when
+ *   the BOM's `metadata.tools` lists cdxgen with a `bom-ref` (the tool named
+ *   "cdxgen", the same match findCdxgenToolBomRef in
+ *   lib/inventory/citations.js makes). Identity evidence carries cdxgen's
+ *   assertion, its tool and method results only when this is set.
+ * - `assertingTool` is set only without `toolRefId`: the first other tool
+ *   component with a `bom-ref` (`{refId, toolRefId, label?}`), whose party
+ *   asserts the component identifiers (`identifiers[].party` is required).
+ *   With neither, cdxgen, as the converting tool, asserts the identifiers it
+ *   wrote.
+ * - `timestamp` is the BOM timestamp when it has one.
+ *
+ * Nothing is invented: absent members stay absent.
+ *
+ * @param {object} bom BOM in the 1.x shape (only `metadata` is read)
+ * @returns {{toolRefId?: string, assertingTool?: {refId: string, toolRefId: string, label?: string}, timestamp?: string}} Claim context
+ */
+export declare function identityClaimContext(bom: object): {
+    toolRefId?: string;
+    assertingTool?: {
+        refId: string;
+        toolRefId: string;
+        label?: string;
+    };
+    timestamp?: string;
+};
+/**
+ * The refId of the party asserting the component identifiers: the cdxgen
+ * party when cdxgen is the listed tool or no tool is listed, else the party
+ * of the first other listed tool (see identityClaimContext).
+ *
+ * @param {object} claims Claim context from identityClaimContext
+ * @returns {string} Party refId
+ */
+export declare function identifierPartyRefId(claims: object): string;
+/**
+ * The parties the renderer derives from the claim context, in the order it
+ * appends them: the cdxgen party, then the asserting tool's party when there
+ * is one. Each is a party (#/$defs/cyclonedx-party-2.0/$defs/party) with the
+ * `asserter` role and a system identity
+ * (#/$defs/cyclonedx-party-2.0/$defs/system, kind `automation`) whose `ref`
+ * names the tool component only when that refId is declared. The renderer
+ * declares one only when the document references it; the reader drops one
+ * that matches exactly, since the render derives it again.
+ *
+ * @param {object} claims Claim context from identityClaimContext
+ * @param {Set<string>} declared refIds declared in the document
+ * @returns {object[]} Party declarations
+ */
+export declare function derivedPartyDeclarations(claims: object, declared: Set<string>): object[];
+/**
+ * Convert one 1.x identity entry to componentIdentityEvidence
+ * (#/$defs/cyclonedx-component-2.0/$defs/componentIdentityEvidence). When
+ * cdxgen is the listed tool (#4591), the entry is cdxgen's attributed claim:
+ * `tools` names the helper recorded on the entry or, failing that, the cdxgen
+ * tool; `assertion` credits the cdxgen party as asserter
+ * (#/$defs/cyclonedx-evidence-2.0/$defs/assertion); and a method with a
+ * matched value has the result `detected`. For another tool's BOM cdxgen did
+ * not do that analysis, so none of these is added; the entry's own `tools`
+ * are kept. `timestamp` is the BOM's own when it has one.
+ *
+ * @param {object} entry 1.x identity evidence entry
+ * @param {object} stats Render counters from createRenderStats
+ * @returns {object|undefined} The 2.0 entry, or undefined without a field
+ */
+export declare function convertIdentityEntry(entry: object, stats: object): object | undefined;
+/**
+ * Convert component evidence
+ * (#/$defs/cyclonedx-component-2.0/$defs/componentEvidence). The 1.x
+ * `callstack` object becomes the `callStacks` array; identity `field` becomes
+ * `scheme`. Every nested object is cloned, so nothing is shared with the
+ * input.
+ */
+export declare function convertComponentEvidence(evidence: any, stats: any): {
+    identity: any[];
+    occurrences: any[];
+    callStacks: {
+        frames: any[];
+    }[];
+    licenses: any[];
+    copyright: any[];
+} | undefined;
+/**
+ * Convert cryptoProperties
+ * (#/$defs/cyclonedx-cryptography-2.0/$defs/cryptoProperties, required
+ * `[assetType]`): drop the deprecated free-text `curve` (2.0 keeps only
+ * `ellipticCurve`) and the algorithm families and protocol types the pinned
+ * 2.0 enums do not list, move the deprecated 1.x reference members into
+ * `relatedCryptographicAssets`, and count every member 2.0 has no field for.
+ */
+export declare function convertCryptoProperties(cryptoProperties: any, stats: any): any;
+//# sourceMappingURL=cyclonedx20RenderEvidence.d.ts.map

package/types/lib/inventory/cyclonedx20RenderEvidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20RenderEvidence.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20RenderEvidence.js"],"names":[],"mappings":"AAAA;;;;GAIG;AA6FH;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,gBAAgB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAH7B,MAG6B,GAF3B;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAC,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAC,CAgCxH;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAHhC,MAGgC,GAF9B,MAAM,CAIlB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAJpC,MAIoC,EAAE,QAAQ,EAH9C,GAAG,CAAC,MAAM,CAGoC,GAF5C,MAAM,EAAE,CA0BpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAJ/B,MAI+B,EAAE,KAAK,EAHtC,MAGsC,GAFpC,MAAM,GAAC,SAAS,CA6C5B;AAoID;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,KAAA,EAAE,KAAK,KAAA;;;;;;;;cAkDvD;AAiPD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,gBAAgB,KAAA,EAAE,KAAK,KAAA,OAiB9D"}

package/types/lib/inventory/cyclonedx20RenderHardware.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Hardware components at 2.0 (cdxgen/cdxgen#4755). What each `cdx:hbom:*`
+ * property means in the 2.0 draft is owned by @cdxgen/cdx-hbom, whose
+ * optional `./cdx20` export provides `toCdx20HardwareComponent(component,
+ * {partyRefId, includeSensitiveIdentifiers, identifierPolicy})`. The caller
+ * loads it (lib/inventory/hbomLoader.js: hardwareRenderContext) and passes
+ * it, with those options, to renderCycloneDx20 in the render context, so the
+ * render stays a pure function of its arguments.
+ *
+ * The renderer converts the component as usual and then takes only these
+ * members from the mapper's result, each checked against the pinned schema:
+ *
+ * - `identifiers`: only groups asserted by the party the renderer passed
+ *   (the one its own identifiers use, which it declares when referenced).
+ *   Their identities are appended to that party's group, or added as a new
+ *   group, so a purl identity is never replaced. Only identities with a
+ *   scheme from the identityScheme enum (or a custom `{name}`) and a
+ *   non-empty value are taken.
+ * - `classification` (#/$defs/cyclonedx-physical-2.0/$defs/classification):
+ *   `category`, `subcategory`, and `codes` that are taxonomyCode objects
+ *   (`{standard, value}`); a bare string code is dropped and counted.
+ * - a manufacturer party, when the generic conversion produced none.
+ *
+ * Every `cdx:hbom:*` property stays: the hbom audit rules read them.
+ */
+/** True when the 1.x component carries at least one cdx:hbom:* property. */
+export declare function isHardwareComponent(component: any): any;
+/**
+ * Add the hardware mapper's 2.0 members to a converted hardware component.
+ * Without a mapper, or for a component without cdx:hbom:* properties, the
+ * converted component is returned unchanged. The mapper gets a clone of the
+ * 1.x component, the asserting party refId the generic identifiers use (so
+ * its identifiers resolve to the party the renderer declares) and the
+ * identifier options of the render context (`stats.hardwareOptions`).
+ *
+ * @param {object} component The 1.x component
+ * @param {object} converted Its generic 2.0 conversion, extended in place
+ * @param {object} stats Render counters with the optional `hardwareMapper`
+ * @returns {object} The converted component
+ */
+export declare function applyHardwareMapping(component: object, converted: object, stats: object): object;
+//# sourceMappingURL=cyclonedx20RenderHardware.d.ts.map

package/types/lib/inventory/cyclonedx20RenderHardware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20RenderHardware.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20RenderHardware.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAeH,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,SAAS,KAAA,OAQ5C;AAqHD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EALnC,MAKmC,EAAE,SAAS,EAJ9C,MAI8C,EAAE,KAAK,EAHrD,MAGqD,GAFnD,MAAM,CA0BlB"}

package/types/lib/inventory/cyclonedx20RenderPatents.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Render-side conversion of 1.x patents, patent families and patent
+ * assertions (#/$defs/cyclonedx-patent-2.0). The members are the same; the
+ * 1.x `bom-ref` becomes `refId`, and organizations and contacts take the
+ * 2.0 common shapes.
+ */
+/**
+ * Convert 1.x definitions.patents: patents and patent families.
+ *
+ * @param {object[]} patents 1.x patents and patent families
+ * @param {object} stats Render counters
+ * @returns {object[]|undefined} 2.0 patents
+ */
+export declare function convertPatents(patents: object[], stats: object): object[] | undefined;
+/**
+ * Convert 1.x patentAssertions
+ * (#/$defs/cyclonedx-patent-2.0/$defs/patentAssertions): the asserter is an
+ * organization, a contact or a refLinkType string.
+ *
+ * @param {object[]} assertions 1.x patent assertions
+ * @param {object} stats Render counters
+ * @returns {object[]|undefined} 2.0 patent assertions, or undefined when
+ *   none is left
+ */
+export declare function convertPatentAssertions(assertions: object[], stats: object): object[] | undefined;
+//# sourceMappingURL=cyclonedx20RenderPatents.d.ts.map

package/types/lib/inventory/cyclonedx20RenderPatents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20RenderPatents.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20RenderPatents.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AA4EH;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAJ3B,MAAM,EAIqB,EAAE,KAAK,EAHlC,MAGkC,GAFhC,MAAM,EAAE,GAAC,SAAS,CA6C9B;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EALvC,MAAM,EAKiC,EAAE,KAAK,EAJ9C,MAI8C,GAH5C,MAAM,EAAE,GAAC,SAAS,CAiC9B"}

package/types/lib/inventory/cyclonedx20RenderRefIds.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Reference integrity of a rendered CycloneDX 2.0 document: every refId is
+ * unique (the 2.0 refIdType rule "Every `refId` shall be unique within the
+ * document", which JSON Schema cannot check), and dependency and
+ * vulnerability references resolve to a declared refId or a BOM-Link.
+ */
+/**
+ * Make every refId unique. The roots are walked in order, so the earliest
+ * root keeps a repeated refId; pass the inventories before metadata so the
+ * subject of a self-scan keeps its members when it repeats the refId of the
+ * tool. A later declaration with an already declared refId becomes:
+ *
+ * - a componentReference or partyReference `{ref}` when it sits in a slot
+ *   that accepts one and an earlier declaration of the same kind already
+ *   holds every member it has (nothing is lost);
+ * - nothing, in the definitions registry, under the same condition (counted
+ *   as already declared), and also when an inventory declares the refId
+ *   with other members (the members only the registry entry had are
+ *   counted as dropped);
+ * - unchanged, when neither it nor an earlier declaration sits in a
+ *   component or party slot (counted);
+ * - otherwise the same object under a new refId `<refId>-dup-<n>`, so no data
+ *   is lost and references to the refId keep resolving to the first
+ *   declaration.
+ *
+ * @param {Array<{section: string, value: *}>} roots Rendered sections, the
+ *   definitions root marked with `section: "definitions"`
+ * @param {object} stats Render counters
+ */
+export declare function dedupeRefIds(roots: Array<{
+    section: string;
+    value: any;
+}>, stats: object): void;
+/**
+ * Keep only dependency references that resolve: an entry whose `ref` names
+ * nothing declared is dropped, and so is each such `dependsOn` and
+ * `provides` member. An emptied `dependsOn` stays, since an empty list says
+ * the component has no dependencies.
+ *
+ * @param {object[]|undefined} dependencies Rendered dependencies
+ * @param {Set<string>} declared Every declared refId
+ * @param {object} stats Render counters
+ * @returns {object[]|undefined} The dependencies left, or undefined
+ */
+export declare function resolveDependencyRefs(dependencies: object[] | undefined, declared: Set<string>, stats: object): object[] | undefined;
+/**
+ * Drop vulnerability `affects` entries whose `ref` resolves to nothing, and
+ * an `affects` list left empty.
+ *
+ * @param {object[]|undefined} vulnerabilities Rendered vulnerabilities
+ * @param {Set<string>} declared Every declared refId
+ * @param {object} stats Render counters
+ */
+export declare function resolveAffectsRefs(vulnerabilities: object[] | undefined, declared: Set<string>, stats: object): void;
+//# sourceMappingURL=cyclonedx20RenderRefIds.d.ts.map

package/types/lib/inventory/cyclonedx20RenderRefIds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20RenderRefIds.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20RenderRefIds.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AAqGH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAJvB,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,GAAC,CAAA;CAAC,CAIV,EAAE,KAAK,EAF9B,MAE8B,QA2GxC;AAKD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EALvC,MAAM,EAAE,GAAC,SAK8B,EAAE,QAAQ,EAJjD,GAAG,CAAC,MAAM,CAIuC,EAAE,KAAK,EAHxD,MAGwD,GAFtD,MAAM,EAAE,GAAC,SAAS,CA6B9B;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,eAAe,EAJvC,MAAM,EAAE,GAAC,SAI8B,EAAE,QAAQ,EAHjD,GAAG,CAAC,MAAM,CAGuC,EAAE,KAAK,EAFxD,MAEwD,QAwBlE"}

package/types/lib/inventory/cyclonedx20RenderSections.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Render the CycloneDX 2.0 sections that sit beside the inventory:
+ * compositions, annotations, citations, vulnerabilities and formulation.
+ * Each converter restores an entry readCycloneDx20 kept as a shadow while
+ * the entry is unchanged.
+ */
+/**
+ * Render compositions (#/$defs/cyclonedx-composition-2.0/$defs/composition,
+ * required `[kind, aggregate, targets]`). The composition's own 1.x
+ * `bom-ref` (cdxgen sets it to the subject's bom-ref) is not carried, so it
+ * cannot collide with the subject's refId.
+ */
+export declare function renderCompositions(compositions: any, inventory: any, carried: any, stats: any): any[] | undefined;
+/**
+ * Render annotations (#/$defs/cyclonedx-annotation-2.0/$defs/annotation,
+ * required `[subjects, annotator, timestamp, text]`). Subjects are checked
+ * against the declared refIds once the whole document exists
+ * (see resolveAnnotationSubjects).
+ */
+export declare function renderAnnotations(annotations: any, stats: any): any[] | undefined;
+/**
+ * Render citations (#/$defs/cyclonedx-citation-2.0/$defs/citation).
+ * `attributedTo` is a refLinkType, so it names a declared object's refId; the
+ * cdxgen tool's bom-ref becomes exactly that refId. A citation may carry
+ * `attributedTo`, `process` or both, so only the ref rename and the
+ * expression rewrite are targeted.
+ */
+export declare function renderCitations(citations: any, usesInventory: any, stats: any): any[] | undefined;
+/**
+ * Render vulnerabilities: `bom-ref` → `refId`, `cwes` → `weaknesses`, the
+ * tools object, credits as 2.0 organizations and contacts and the proof of
+ * concept's attachments. Members 2.0 has no field for are counted; `affects`
+ * references are resolved once every refId is known (resolveAffectsRefs).
+ */
+export declare function renderVulnerabilities(vulnerabilities: any, stats: any): any[] | undefined;
+/**
+ * formulation → workflows/tasks/triggers with refId renames. The 2.0 formula
+ * allows only refId, properties and workflows
+ * (#/$defs/cyclonedx-formulation-2.0/$defs/formula), so the 1.x
+ * formula.components move to definitions.components (upstream's
+ * valid-formulation-2.0.json declares them there too) and are collected in
+ * `stats.formulaComponents`.
+ */
+export declare function convertFormulation(formulation: any, stats: any): any;
+//# sourceMappingURL=cyclonedx20RenderSections.d.ts.map

package/types/lib/inventory/cyclonedx20RenderSections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20RenderSections.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20RenderSections.js"],"names":[],"mappings":"AAAA;;;;;GAKG;AAsEH;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,KAAA,EAAE,SAAS,KAAA,EAAE,OAAO,KAAA,EAAE,KAAK,KAAA,qBAwCzE;AAwBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,KAAA,EAAE,KAAK,KAAA,qBAiCnD;AA4BD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,SAAS,KAAA,EAAE,aAAa,KAAA,EAAE,KAAK,KAAA,qBAqB9D;AAkHD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,eAAe,KAAA,EAAE,KAAK,KAAA,qBA+C3D;AAgBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,KAAA,EAAE,KAAK,KAAA,OA8DpD"}

package/types/lib/inventory/cyclonedx20Tables.d.ts

@@ -0,0 +1,134 @@
+/**
+ * Frozen lookup tables for the CycloneDX 2.0 renderer and reader: schema enums,
+ * the aggregate spelling table, the pinned 2.0 cryptography enums and the field
+ * lists that say which 1.x members each converter carries. Every value is
+ * quoted from the pinned draft schema
+ * (data/cyclonedx-2.0-bundled.schema.json, CycloneDX/specification 2.0-dev at
+ * ea8c3605829d1da13339a0790b6da73548e42a6b).
+ */
+/**
+ * Internal key that carries 2.0-only sections (risks, blueprints, threats,
+ * controls, perspectives, profiles, declarations and definitions.parties)
+ * through the 1.x-shaped model so a read-then-render round trip preserves
+ * them. Never serialized: renderCycloneDx20 re-emits them and
+ * applySpecVersionCompatibility strips the key for 1.x output.
+ */
+export declare const CDX20_INTERNAL_SECTIONS_KEY = "cdx20Sections";
+/**
+ * The formula property that names, as a JSON array of refIds, the
+ * definitions components of a subject-less 2.0 document that belong to the
+ * formula (2.0 has no formula member for them).
+ */
+export declare const FORMULA_COMPONENT_REFS_PROPERTY = "cdx:formulation:componentRefs";
+/** refId of the cdxgen party declared in definitions.parties. */
+export declare const CDXGEN_PARTY_REF_ID = "party-cdxgen";
+/**
+ * Message shown when a CycloneDX 2.0 document would be uploaded to
+ * Dependency-Track, which ingests CycloneDX 1.x only.
+ */
+export declare const DEPENDENCY_TRACK_CDX20_ERROR = "Dependency-Track does not ingest the CycloneDX 2.0 draft, so a 2.0 document cannot be uploaded with --server-url. Generate with --spec-version 1.7 to upload to Dependency-Track.";
+/** identityScheme enum (#/$defs/cyclonedx-component-2.0/$defs/identityScheme). */
+export declare const IDENTITY_SCHEME_ENUM: Set<string>;
+export declare const FORBIDDEN_IDENTITY_TECHNIQUES: Set<string>;
+export declare const ANALYSIS_TECHNIQUE_ENUM: Set<string>;
+export declare const AGGREGATE_1X_TO_20: Readonly<{
+    complete: "complete";
+    incomplete: "incomplete";
+    incomplete_first_party_only: "incomplete-first-party-only";
+    incomplete_first_party_proprietary_only: "incomplete-first-party-proprietary-only";
+    incomplete_first_party_opensource_only: "incomplete-first-party-opensource-only";
+    incomplete_third_party_only: "incomplete-third-party-only";
+    incomplete_third_party_proprietary_only: "incomplete-third-party-proprietary-only";
+    incomplete_third_party_opensource_only: "incomplete-third-party-opensource-only";
+    unknown: "unknown";
+    not_specified: "not-specified";
+}>;
+/** The inverse of AGGREGATE_1X_TO_20. */
+export declare const AGGREGATE_20_TO_1X: Readonly<{
+    [k: string]: string;
+}>;
+/** 2.0 algorithmFamily values (pinned 2.0 cryptography defs). */
+export declare const ALGORITHM_FAMILY_ENUM: Readonly<Set<any>>;
+/** 2.0 protocolProperties.type values (pinned 2.0 cryptography defs). */
+export declare const PROTOCOL_FAMILY_ENUM: Readonly<Set<any>>;
+export declare const COMPONENT_DATA_TYPE_ENUM: Set<string>;
+export declare const DATA_CLASSIFICATION_ENUM: Set<string>;
+export declare const POSTAL_ADDRESS_FIELDS: string[];
+export declare const COMPONENT_ENTRY_ARRAY_KEYS: Set<string>;
+export declare const LICENSE_EVIDENCE_DETAIL_FIELDS: string[];
+/** 1.x componentData members the renderer handles. */
+export declare const COMPONENT_DATA_FIELDS: Set<string>;
+export declare const COMPONENT_COPY_FIELDS: string[];
+/** 1.x component members the renderer handles; the rest are counted. */
+export declare const COMPONENT_HANDLED_FIELDS: Set<string>;
+export declare const SERVICE_COPY_FIELDS: string[];
+/**
+ * 1.x service members without a 2.0 field, carried at 2.0 as the documented
+ * cdx:service:* properties (docs/CUSTOM_PROPERTIES.md) so the mcp-server
+ * audit rules keep firing on a document read back from 2.0. Each entry is
+ * [1.x field, property name, value kind]; the renderer appends them in this
+ * order and the reader turns them back into the 1.x fields.
+ */
+export declare const CARRIED_SERVICE_PROPERTIES: readonly (readonly string[])[];
+/** 1.x service members the renderer handles; the rest are counted. */
+export declare const SERVICE_HANDLED_FIELDS: Set<string>;
+/** 1.x algorithmFamily values (cryptography-defs algorithmFamiliesEnum). */
+export declare const ALGORITHM_FAMILY_1X: Readonly<Set<any>>;
+/** 1.x ellipticCurve values (cryptography-defs ellipticCurvesEnum). */
+export declare const ELLIPTIC_CURVE_1X: Readonly<Set<any>>;
+/** 1.7 externalReference.type values. */
+export declare const EXTERNAL_REFERENCE_TYPES_1X: Readonly<Set<string>>;
+/** 1.7 component.type values. */
+export declare const COMPONENT_TYPES_1X: Readonly<Set<string>>;
+/** 1.7 componentIdentityEvidence.field values. */
+export declare const IDENTITY_FIELDS_1X: Readonly<Set<string>>;
+/** 1.7 identity-evidence method techniques. */
+export declare const IDENTITY_TECHNIQUES_1X: Readonly<Set<string>>;
+/** 1.7 vulnerability rating `method` values (scoreMethod). */
+export declare const SCORE_METHODS_1X: Readonly<Set<string>>;
+/**
+ * 1.7 cryptoProperties algorithmProperties enums, by member name. Members
+ * whose 2.0 value is a list in 1.7 too are checked entry by entry.
+ */
+export declare const ALGORITHM_PROPERTY_ENUMS_1X: Readonly<{
+    primitive: Readonly<Set<string>>;
+    executionEnvironment: Readonly<Set<string>>;
+    implementationPlatform: Readonly<Set<string>>;
+    mode: Readonly<Set<string>>;
+    padding: Readonly<Set<string>>;
+    cryptoFunctions: Readonly<Set<string>>;
+}>;
+/** 1.7 protocolProperties.type values. */
+export declare const PROTOCOL_TYPES_1X: Readonly<Set<string>>;
+/**
+ * Party roles (#/$defs/cyclonedx-party-2.0/$defs/preDefinedRole) the 1.x
+ * component and service fields can hold, with the 1.x field.
+ */
+export declare const PARTY_ROLE_FIELDS_1X: Readonly<{
+    supplier: "supplier";
+    manufacturer: "manufacturer";
+    author: "authors";
+    publisher: "publisher";
+    provider: "provider";
+}>;
+/**
+ * Identity schemes (#/$defs/cyclonedx-component-2.0/$defs/identityScheme) the
+ * 1.x identifier fields hold, with the 1.x field. `omniborid` and `swhid` are
+ * lists in 1.x; the others hold one value.
+ */
+export declare const IDENTITY_SCHEME_FIELDS_1X: Readonly<{
+    purl: "purl";
+    cpe: "cpe";
+    swid: "swid";
+    omniborid: "omniborId";
+    swhid: "swhid";
+}>;
+/** 2.0 identity-evidence scheme → 1.x field, for the predefined schemes. */
+export declare const IDENTITY_EVIDENCE_SCHEME_TO_FIELD: Readonly<{
+    purl: "purl";
+    cpe: "cpe";
+    swid: "swid";
+    swhid: "swhid";
+    omniborid: "omniborId";
+}>;
+//# sourceMappingURL=cyclonedx20Tables.d.ts.map

package/types/lib/inventory/cyclonedx20Tables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx20Tables.d.ts","sourceRoot":"","sources":["../../../lib/inventory/cyclonedx20Tables.js"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,kBAAkB,CAAC;AAE3D;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,kCAAkC,CAAC;AAE/E,iEAAiE;AACjE,eAAO,MAAM,mBAAmB,iBAAiB,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,sLAC4I,CAAC;AAEtL,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,aA0B/B,CAAC;AAKH,eAAO,MAAM,6BAA6B,aAWxC,CAAC;AAGH,eAAO,MAAM,uBAAuB,aA6BlC,CAAC;AAKH,eAAO,MAAM,kBAAkB;;;;;;;;;;;EAe7B,CAAC;AAEH,yCAAyC;AACzC,eAAO,MAAM,kBAAkB;;EAI9B,CAAC;AAgBF,iEAAiE;AACjE,eAAO,MAAM,qBAAqB,oBAEjC,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,oBAEhC,CAAC;AAGF,eAAO,MAAM,wBAAwB,aAMnC,CAAC;AAIH,eAAO,MAAM,wBAAwB,aAMnC,CAAC;AAIH,eAAO,MAAM,qBAAqB,UAOjC,CAAC;AAKF,eAAO,MAAM,0BAA0B,aAKrC,CAAC;AAIH,eAAO,MAAM,8BAA8B,UAQ1C,CAAC;AAEF,sDAAsD;AACtD,eAAO,MAAM,qBAAqB,aAShC,CAAC;AAIH,eAAO,MAAM,qBAAqB,UAoBjC,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,wBAAwB,aAuBnC,CAAC;AAGH,eAAO,MAAM,mBAAmB,UAY/B,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,gCAIrC,CAAC;AAEH,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,aAQjC,CAAC;AAgBH,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,oBAE/B,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,oBAE7B,CAAC;AAEF,yCAAyC;AACzC,eAAO,MAAM,2BAA2B,uBAkDvC,CAAC;AAEF,iCAAiC;AACjC,eAAO,MAAM,kBAAkB,uBAgB9B,CAAC;AAEF,kDAAkD;AAClD,eAAO,MAAM,kBAAkB,uBAY9B,CAAC;AAEF,+CAA+C;AAC/C,eAAO,MAAM,sBAAsB,uBAalC,CAAC;AAEF,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB,uBAE5B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;EAkFtC,CAAC;AAEH,0CAA0C;AAC1C,eAAO,MAAM,iBAAiB,uBAiB7B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,oBAAoB;;;;;;EAM/B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB;;;;;;EAMpC,CAAC;AAEH,4EAA4E;AAC5E,eAAO,MAAM,iCAAiC;;;;;;EAM5C,CAAC"}