@citolab/tspci-qbci 2.9.13 → 2.11.0

package/CHANGELOG.md

@@ -3,6 +3,25 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [2.11.0](https://github.com/Citolab/tspci/compare/v2.10.0...v2.11.0) (2026-08-19)
+
+
+### Features
+
+* generate a CycloneDX SBOM of the bundle ([fdc8cf7](https://github.com/Citolab/tspci/commit/fdc8cf7caf8d25b58737866d654315e6cb2e6fcf))
+
+
+
+
+
+# [2.10.0](https://github.com/Citolab/tspci/compare/v2.9.13...v2.10.0) (2026-08-18)
+
+**Note:** Version bump only for package @citolab/tspci-qbci
+
+
+
+
+
 ## [2.9.13](https://github.com/Citolab/tspci/compare/v2.9.12...v2.9.13) (2026-03-18)
 
 **Note:** Version bump only for package @citolab/tspci-qbci

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@citolab/tspci-qbci",
-  "version": "2.9.13",
+  "version": "2.11.0",
   "description": "create a .ci file that can be imported into Questify",
   "author": "patrick <patrick.deklein@cito.nl>, Marcel Hoekstra <marcel.hoekstra@cito.nl>",
   "repository": "",
@@ -11,7 +11,7 @@
     "yazl": "^3.3.1"
   },
   "scripts": {},
-  "gitHead": "81bf2cf80de144c2ea6cd1c256fc59e5b637c962",
+  "gitHead": "ad0858f9b665b6778cdf19685e858e167847e930",
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"

package/readme.md

@@ -14,3 +14,11 @@ In the package.json of the pci:
 - label (if empty, package name will be used)
 - config: { tspci: { width: '500' }} (optional, default: 500)
 - config: { tspci: { height: '500' }} (optional, default: 500)
+
+## sbom
+
+A CycloneDX SBOM of the bundle is copied next to the `.ci` package in `ci-dist/` as
+`<name>_<version>.sbom.cdx.json`. Pass `--include-sbom` to also add `sbom.cdx.json` to the package
+itself; note that Questify does not expect the extra file, so only do that when a customer asks for it.
+Pass `--no-sbom` to skip generating one.
+See [@citolab/tspci](https://github.com/Citolab/tspci/tree/main/lib/tspci#sbom) for the configuration.

package/release-notes.md

@@ -1,3 +1,31 @@
+# 2.11.0
+
+- a CycloneDX SBOM of the bundle is copied next to the `.ci` package in `ci-dist/` as `<name>_<version>.sbom.cdx.json`
+- `--include-sbom` also adds `sbom.cdx.json` to the package itself, `--no-sbom` skips generating one
+
+_The notes for 2.5.0 up to and including 2.10.0 were reconstructed from the git history afterwards, so
+they list the highlights per minor version. Versions without an entry contained no changes for this
+package: all packages in this repository are published in lockstep. `CHANGELOG.md` has the complete
+list of published versions._
+
+# 2.7.0
+
+- added a GPL-3.0 LICENSE file to the package
+- updated the development index.html
+
+# 2.6.0
+
+- images can be used with the native `CES.getMedia()` of the player
+- media files from the assets folder are copied to `ref/media` and registered in `ref/json/manifest.json`
+- a warning is shown when the bundled js file is too large for the player
+- replaced the deprecated `fs.rmdir` with `fs.rm`
+
+# 2.5.0
+
+- dropped the `ci` prefix from the package name and export to a separate `ci-dist` folder
+- the metadata.json of the PCI is picked up, `typeIdentifier` is also read from `config.tspci` in package.json
+- the script folder is created when it does not exist
+
 
 # 2.1.1
 tspci

package/src/createPackage.mjs

@@ -112,6 +112,15 @@ export const bundle = () => {
 
   isMaxFileSize(maxJsFileSize, minifiedFilePath);
 
+  // SBOM: delivered next to the package by default, optionally inside it
+  handleSbom({
+    distDirectory: path.join(PACKAGE_ROOT_PATH, path.dirname((packageData.main || "dist/index.js").replace(/^\//, ""))),
+    outputDirectory,
+    packageTempDirectory: outputDirectoryTemp,
+    baseName: `${name}_${packageData.version}`,
+    packageData,
+  });
+
   // zip the folder
   const zipName = `${name}_${packageData.version}.ci`;
   zipDirectory(outputDirectoryTemp, path.join(outputDirectory, zipName)).then(() =>
@@ -203,3 +212,29 @@ function addDirectoryToZip(zipFile, rootDir, currentDir) {
     zipFile.addFile(fullPath, relativePath, { compress: true });
   }
 }
+
+// The CRA requires an SBOM as part of the technical documentation, not as part
+// of the delivery to the customer, so it is written next to the package per
+// version. Use --include-sbom (or config.tspci.sbom.includeInPackage) to also
+// ship it inside the package, and --no-sbom to skip it altogether.
+function handleSbom({ distDirectory, outputDirectory, packageTempDirectory, baseName, packageData }) {
+  const settings = packageData?.config?.tspci?.sbom || {};
+  if (settings.enabled === false || process.argv.includes("--no-sbom")) {
+    return "";
+  }
+  const fileName = settings.fileName || "sbom.cdx.json";
+  const source = path.join(distDirectory, fileName);
+  if (!fs.existsSync(source)) {
+    console.warn(chalk.yellow(`no SBOM found at ${source}, skipping it`));
+    return "";
+  }
+  fs.copyFileSync(source, path.join(outputDirectory, `${baseName}.${fileName}`));
+  console.log(chalk.green(`created sbom: ${baseName}.${fileName}`));
+
+  const includeInPackage = process.argv.includes("--include-sbom") || settings.includeInPackage === true;
+  if (!includeInPackage) {
+    return "";
+  }
+  fs.copyFileSync(source, path.join(packageTempDirectory, fileName));
+  return fileName;
+}