@citolab/tspci 2.10.0 → 2.12.0

package/CHANGELOG.md

@@ -3,6 +3,28 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [2.12.0](/compare/v2.11.0...v2.12.0) (2026-08-19)
+
+
+### Features
+
+* include the SBOM in the exported package by default 376b89a
+
+
+
+
+
+# [2.11.0](/compare/v2.10.0...v2.11.0) (2026-08-19)
+
+
+### Features
+
+* generate a CycloneDX SBOM of the bundle fdc8cf7
+
+
+
+
+
 # [2.10.0](/compare/v2.9.13...v2.10.0) (2026-08-18)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@citolab/tspci",
-  "version": "2.10.0",
+  "version": "2.12.0",
   "description": "an opiniated typescript ims-pci builder with tao integration",
   "author": "patrick <patrick.deklein@cito.nl>",
   "repository": "@citolab/tspci",
@@ -55,5 +55,5 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
-  "gitHead": "7dbead5cfa41583d47bb503d40970df2d3444a1e"
+  "gitHead": "eb7676525e9bf75daa9b2f42f035faed9b8e9a70"
 }

package/readme.md

@@ -20,6 +20,7 @@
 - Postcss support, use CSS nesting out of the box.
 - First class (p)react and tailwind support
 - Extension for TAO, configuring icon, label, support for setting correct response and pci-properties
+- Generates a CycloneDX SBOM of the components that are actually in your bundle
 
 ## 🔧 Installation & Setup
 
@@ -81,6 +82,112 @@ Then build the package:
 
 For more info: [@citolab/tspci-qti3](https://github.com/Citolab/tspci/tree/main/lib/tspci-qti3)
 
+### SBOM
+
+Every production build (`tspci`, `tspci --target ...`) writes a [CycloneDX](https://cyclonedx.org/) 1.6
+SBOM to `dist/sbom.cdx.json`. A package export puts it in two places: inside the package next to the
+bundle it describes, and next to the package as `<package-name>.sbom.cdx.json` so you keep one SBOM per
+released version for your own technical documentation.
+
+The SBOM is built from the rollup module graph, so it lists the packages whose code actually ended up
+in the bundle. That is different from what `npm sbom`, `cyclonedx-npm` or Syft produce for a PCI: those
+read the dependency tree and would list build-time packages (rollup, typescript, tailwind, terser) that
+are never delivered, while missing dependencies that got inlined into the bundle.
+
+It also records a SHA-512 hash of the built bundle. A customer who integrates your PCI is the
+manufacturer of the complete product and has to do due diligence on integrated third party components;
+the hash lets them verify that the SBOM belongs to the bundle they received.
+
+The SBOM ships inside the package because a file next to the zip does not survive an import into an
+authoring system, and that system is exactly the party that needs it: it is the manufacturer of the
+complete product and has to document the components it integrates. The Cyber Resilience Act does not
+require in band delivery, so `--no-include-sbom` (or `config.tspci.sbom.includeInPackage: false`) keeps
+it out of the package while still writing it to `dist` and next to the package:
+
+```sh
+  tspci --target qti3 --no-include-sbom
+```
+
+Where it lands inside the package differs per target, always next to the bundle:
+
+| target | in the package |
+| --- | --- |
+| qti3 | `resources/pci/sbom.cdx.json`, listed as a file of the PCI resource in the manifest |
+| tao | `interaction/runtime/js/sbom.cdx.json` |
+| qbci | `ref/script/sbom.cdx.json` |
+
+For qti3 it is a `<file>` of the existing PCI resource rather than a resource of its own. QTI has no
+resource type for a bill of materials, and an unreferenced resource is what manifest driven tooling
+drops first.
+
+Generating the SBOM needs no flag either, it happens on every production build. Use `--no-sbom` to skip
+it for a single build, or `config.tspci.sbom.enabled: false` to switch it off for a project:
+
+```sh
+  tspci --target qti3 --no-sbom
+```
+
+#### Known limitations
+
+The SBOM can only describe what passes through the bundler. It does not cover:
+
+- code loaded at runtime from a CDN (MathJax, MathLive, chart libraries)
+- third party code that was copied into your own `src` folder
+- the delivery engine itself (`qtiCustomInteractionContext` is external on purpose)
+
+The build warns about the first two when it can detect them (a script url in the bundle or in
+`src/index.html`, a path that looks like `src/vendor/...` or a `*.min.js` file). Declare those
+components manually so they end up in the SBOM.
+
+#### Configuration
+
+All settings are optional and live in `config.tspci.sbom` in your `package.json`:
+
+```json
+{
+  "config": {
+    "tspci": {
+      "typeIdentifier": "myPci",
+      "sbom": {
+        "supplier": { "name": "Cito", "url": "https://www.cito.nl" },
+        "supportPeriodEnd": "2032-12-31",
+        "externalReferences": [
+          { "type": "vulnerability-disclosure", "url": "https://www.cito.nl/security" },
+          { "type": "security-contact", "url": "mailto:security@example.org" }
+        ],
+        "additionalComponents": [
+          {
+            "name": "mathjax",
+            "version": "3.2.2",
+            "license": "Apache-2.0",
+            "purl": "pkg:npm/mathjax@3.2.2",
+            "externalReferences": [
+              { "type": "distribution", "url": "https://cdn.jsdelivr.net/npm/mathjax@3.2.2/es5/tex-mml-chtml.js" }
+            ]
+          }
+        ]
+      }
+    }
+  }
+}
+```
+
+| Option | Default | Description |
+| --- | --- | --- |
+| `enabled` | `true` | Set to `false` to skip SBOM generation |
+| `fileName` | `sbom.cdx.json` | Name of the generated file |
+| `supplier` | `author` from `package.json` | Supplier of the PCI, as name or `{ name, url, contact }` |
+| `supportPeriodEnd` | - | Recorded as a property on the PCI component |
+| `externalReferences` | - | CycloneDX external references for the PCI, e.g. your disclosure policy |
+| `additionalComponents` | `[]` | Components the bundler cannot see, e.g. CDN or vendored code |
+| `includeInPackage` | `true` | Set to `false` to keep the SBOM out of the exported package |
+| `properties` | `[]` | Extra CycloneDX properties on the PCI component |
+| `warnings` | `true` | Set to `false` to silence the warnings about gaps |
+| `timestamp` | `false` | Include a build timestamp. Off by default so a rebuild of the same sources gives an identical document |
+
+Declaring a component in `additionalComponents` also silences the warning about the matching runtime
+url. Set `TSPCI_SBOM_TIMESTAMP=1` to add a timestamp for a single build.
+
 ### Manual
 
 1️. **Install** by running: `npm i -D @citolab/tspci`
@@ -199,6 +306,8 @@ Available Commands
   --targetExt -tx Same as -target but reffering to a fully qualified package (not in @citolab)
   init            Init PCI development environment.
   add --target    Add specific implementation to the PCI.
+  --no-include-sbom  Keep the SBOM out of the exported package (included by default)
+  --no-sbom          Do not generate an SBOM for this build
 
 Examples package.json scripts
 	$ "dev": "tspci --dev",

package/release-notes.md

@@ -1,3 +1,78 @@
+# 2.12.0
+
+- the SBOM is now included in the exported package by default, next to the bundle it describes: `resources/pci/sbom.cdx.json` (qti3), `interaction/runtime/js/sbom.cdx.json` (tao), `ref/script/sbom.cdx.json` (qbci)
+- a copy is still written next to the package as `<package-name>.sbom.cdx.json` for your own technical documentation
+- `--no-include-sbom` (or `config.tspci.sbom.includeInPackage: false`) keeps it out of the package, `--no-sbom` still skips it altogether
+- replaces `--include-sbom` from 2.11.0, which is now the default. The flag is still accepted and does nothing
+
+  A file next to the zip does not survive an import into an authoring system, and that system is exactly
+  the party that needs the SBOM: it is the manufacturer of the complete product and has to document the
+  components it integrates.
+
+# 2.11.0
+
+- every production build writes a CycloneDX 1.6 SBOM of the bundle to `dist/sbom.cdx.json`, and a package export copies it next to the package as `<package-name>.sbom.cdx.json`
+- the SBOM is built from the rollup module graph, so it lists the packages whose code is actually in the bundle instead of the build time dependency tree
+- `--include-sbom` also puts the SBOM inside the exported package, `--no-sbom` skips generating one
+- configurable with `config.tspci.sbom` in package.json: supplier, support period, external references (disclosure policy, security contact) and manually declared components
+- the build warns about code the bundler cannot see: vendored files, `*.min.js` and scripts that are loaded from a cdn at runtime
+
+_The notes for 2.4.0 up to and including 2.10.0 were reconstructed from the git history afterwards, so
+they list the highlights per minor version. The patch versions in between are mostly lockstep publishes
+of all packages in this repository; `CHANGELOG.md` has the complete list of published versions._
+
+# 2.10.0
+
+- a delivery engine can pass the response declaration of the response variable a PCI is bound to in the `getInstance` configuration, so the PCI can render the correct response itself in solution status (see 1EdTech/qti-project-management#210)
+- the cli detects a missing `tslib` dependency and reports it with an install hint
+- added `generate:pcis` and a dev startup smoke test to develop and test tspci changes against real PCIs
+- improved layout and styling of the generated example interaction
+- updated dependencies, added npm-check-updates settings
+
+# 2.9.0
+
+- added a local development app to test changes in @citolab/tspci against generated PCI variants
+- replaced inquirer with @inquirer/prompts
+- test scripts and npm path handling work on Windows, CI runs on a matrix of operating systems
+
+# 2.8.0
+
+- `tspci init` can run without prompts using `--name`, `--description`, `--project-type` and `--ci`
+- `--path` accepts both `--path=folder` and `--path folder` (or `-p`) and is resolved relative to the current directory, nested paths are created automatically
+- the project type is now a single choice instead of a multi select
+- added local test scripts to initialize and smoke test all project variants
+
+# 2.7.0
+
+- added QTI 3 package export: `tspci --target qti3` creates a QTI 3 package with an assessment item, an assessment test and a manifest
+- added `setResponse`, so a delivery engine can push a response into the PCI
+- completed the QTI type definitions
+- the preact preset uses a factory pattern with improved state management
+- added a GPL-3.0 LICENSE file to the package
+- fixed the tailwindcss version in the preset
+
+# 2.6.0
+
+- added a javascript project type next to typescript and preact+tailwind, including TAO support for javascript PCIs with `onCompleted` implemented by default
+- added `--targetExt` (`-tx`) to export with a plugin that is not published under @citolab
+- the PCI dispatches a `qti-interaction-changed` event
+- renamed the `Configuration` type to `ConfigProperties` and improved type safety of the PCI interfaces
+- tailwindcss is added to devDependencies with the version that matches @tailwindcss/postcss
+- switched to chokidar for watching, fixed watching assets and building for the selected target
+
+# 2.5.0
+
+- removed node-builtins and node-globals from the rollup configuration
+- TAO specific functions are ignored when a PCI only implements the IMS interface
+- fixed actions in the state of the development app
+
+# 2.4.0
+
+- added replay functionality with a scrubber to the development app
+- refactored the store, the presets are based on the new store
+- the development environment uses an html template
+- `typeIdentifier` is restricted to alphanumeric characters, because a hyphen breaks the PCI in TAO
+- fixed installing the right version of the dependencies
 
 # 2.3.0
 - added a cli to initialize a PCI workspace (```tspci init```)

package/src/cli.js

@@ -269,6 +269,10 @@ const run = async () => {
     console.log(`•\t${chalk.blueBright("--build")} build the project`);
     console.log(`•\t${chalk.blueBright("--watch")} watch the files`);
     console.log(`•\t${chalk.blueBright("--target")} build a prod item and bundle for platform`);
+    console.log(
+      `•\t${chalk.blueBright("--no-include-sbom")} keep the generated sbom out of the exported package (it is included by default)`
+    );
+    console.log(`•\t${chalk.blueBright("--no-sbom")} do not generate an sbom for this build`);
     console.log("\n");
     console.log(
       `${chalk.blueBright("tspci init")} creates a new project \n•\t${chalk.blueBright(

package/src/rollup-plugin-sbom.js

@@ -0,0 +1,511 @@
+import chalk from "chalk";
+import crypto from "crypto";
+import fs from "fs";
+import path from "path";
+
+// Generates a CycloneDX 1.6 SBOM from the modules that actually ended up in the
+// bundle. This is deliberately based on the rollup module graph and not on
+// package.json: a PCI ships as a single inlined UMD file, so a dependency-tree
+// based SBOM would list build-time packages (rollup, typescript, tailwind, ...)
+// that are never delivered, while missing what got inlined.
+//
+// See readme.md ("SBOM") for the configuration options and known limitations.
+
+const NODE_MODULES_SEGMENT = `${path.sep}node_modules${path.sep}`;
+const DEFAULT_FILE_NAME = "sbom.cdx.json";
+const SPDX_ID_PATTERN = /^[A-Za-z0-9-.+]+$/;
+const VENDORED_PATTERNS = [/[\\/]vendors?[\\/]/i, /[\\/]vendored[\\/]/i, /[\\/](?:3rd|third)[-_]?party[\\/]/i, /\.min\.[cm]?js$/i];
+const REMOTE_SCRIPT_PATTERN = /https?:\/\/[^\s"'`)]+?\.[cm]?js\b/g;
+
+const toPosix = (value) => value.split(path.sep).join("/");
+
+const readJsonSafe = (file) => {
+  try {
+    return JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+};
+
+// Resolve the owning package directory of a module inside node_modules by
+// taking one path segment after the last node_modules (two for scoped
+// packages). Walking up to the nearest package.json is unreliable there:
+// many packages ship sub-folder package.json files with only "main"/"module".
+const resolveNodeModulesPackageDir = (modulePath) => {
+  const index = modulePath.lastIndexOf(NODE_MODULES_SEGMENT);
+  if (index === -1) {
+    return null;
+  }
+  const base = modulePath.slice(0, index + NODE_MODULES_SEGMENT.length);
+  const parts = modulePath
+    .slice(index + NODE_MODULES_SEGMENT.length)
+    .split(path.sep)
+    .filter(Boolean);
+  if (parts.length === 0) {
+    return null;
+  }
+  const segments = parts[0].startsWith("@") ? 2 : 1;
+  if (parts.length < segments) {
+    return null;
+  }
+  return path.join(base, ...parts.slice(0, segments));
+};
+
+// Fallback for modules outside node_modules: linked workspace packages resolve
+// to their real path, so walk up until a package.json shows up.
+const resolveLinkedPackageDir = (modulePath, projectRoot) => {
+  let dir = path.dirname(modulePath);
+  for (;;) {
+    if (fs.existsSync(path.join(dir, "package.json"))) {
+      return dir;
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir || dir === projectRoot) {
+      return null;
+    }
+    dir = parent;
+  }
+};
+
+const purlFor = (name, version) => {
+  const encodedName = name.startsWith("@")
+    ? `${encodeURIComponent(name.slice(0, name.indexOf("/")))}/${name.slice(name.indexOf("/") + 1)}`
+    : name;
+  return version ? `pkg:npm/${encodedName}@${version}` : `pkg:npm/${encodedName}`;
+};
+
+const licensesFor = (packageJson) => {
+  const raw = packageJson.license || packageJson.licenses;
+  const values = Array.isArray(raw)
+    ? raw.map((entry) => (typeof entry === "string" ? entry : entry?.type)).filter(Boolean)
+    : [typeof raw === "string" ? raw : raw?.type].filter(Boolean);
+  if (values.length === 0) {
+    return null;
+  }
+  return values.map((value) =>
+    SPDX_ID_PATTERN.test(value) ? { license: { id: value } } : { expression: value }
+  );
+};
+
+// package.json repository values are often shorthand ("preactjs/preact",
+// "github:preactjs/preact"), which is not a usable url in an SBOM.
+const normalizeRepositoryUrl = (value) => {
+  if (typeof value !== "string" || value.length === 0) {
+    return null;
+  }
+  const shorthand = value.match(/^(?:(github|gitlab|bitbucket):)?([\w.-]+\/[\w.-]+)$/);
+  if (shorthand) {
+    const host = { gitlab: "gitlab.com", bitbucket: "bitbucket.org" }[shorthand[1]] || "github.com";
+    return `https://${host}/${shorthand[2]}`;
+  }
+  return value;
+};
+
+const externalReferencesFor = (packageJson, lockEntry) => {
+  const references = [];
+  const repositoryUrl = normalizeRepositoryUrl(
+    typeof packageJson.repository === "string" ? packageJson.repository : packageJson.repository?.url
+  );
+  if (repositoryUrl) {
+    references.push({ type: "vcs", url: repositoryUrl });
+  }
+  if (packageJson.homepage) {
+    references.push({ type: "website", url: packageJson.homepage });
+  }
+  if (lockEntry?.resolved) {
+    references.push({ type: "distribution", url: lockEntry.resolved });
+  }
+  return references.length > 0 ? references : null;
+};
+
+// npm records integrity as "<alg>-<base64>", CycloneDX expects hex.
+const hashesFromIntegrity = (integrity) => {
+  if (typeof integrity !== "string") {
+    return null;
+  }
+  const hashes = [];
+  for (const entry of integrity.split(/\s+/).filter(Boolean)) {
+    const separator = entry.indexOf("-");
+    if (separator === -1) {
+      continue;
+    }
+    const algorithm = entry.slice(0, separator).toLowerCase();
+    const alg = { sha512: "SHA-512", sha384: "SHA-384", sha256: "SHA-256", sha1: "SHA-1" }[algorithm];
+    if (!alg) {
+      continue;
+    }
+    const content = Buffer.from(entry.slice(separator + 1), "base64").toString("hex");
+    hashes.push({ alg, content });
+  }
+  return hashes.length > 0 ? hashes : null;
+};
+
+const loadLockPackages = (projectRoot) => {
+  const lock = readJsonSafe(path.join(projectRoot, "package-lock.json"));
+  return lock?.packages && typeof lock.packages === "object" ? lock.packages : {};
+};
+
+// Deterministic serial number: a rebuild of the same sources gives the same
+// document, so an SBOM in version control does not produce diff noise.
+const serialNumberFor = (seed) => {
+  const digest = crypto.createHash("sha256").update(seed).digest("hex");
+  return `urn:uuid:${digest.slice(0, 8)}-${digest.slice(8, 12)}-${digest.slice(12, 16)}-${digest.slice(
+    16,
+    20
+  )}-${digest.slice(20, 32)}`;
+};
+
+const normalizeAdditionalComponent = (component) => {
+  if (!component || typeof component !== "object" || !component.name) {
+    return null;
+  }
+  const licenses =
+    component.licenses ||
+    (component.license
+      ? SPDX_ID_PATTERN.test(component.license)
+        ? [{ license: { id: component.license } }]
+        : [{ expression: component.license }]
+      : null);
+  const normalized = {
+    type: component.type || "library",
+    "bom-ref": component["bom-ref"] || component.purl || purlFor(component.name, component.version),
+    name: component.name,
+    ...(component.version ? { version: component.version } : {}),
+    ...(component.description ? { description: component.description } : {}),
+    ...(component.purl ? { purl: component.purl } : {}),
+    ...(licenses ? { licenses } : {}),
+    ...(component.hashes ? { hashes: component.hashes } : {}),
+    ...(component.externalReferences ? { externalReferences: component.externalReferences } : {}),
+  };
+  const declaredManually = { name: "tspci:origin", value: "declared-manually" };
+  normalized.properties = [...(component.properties || []), declaredManually];
+  return normalized;
+};
+
+const supplierFrom = (value) => {
+  if (!value) {
+    return null;
+  }
+  if (typeof value === "string") {
+    return { name: value };
+  }
+  const name = value.name;
+  if (!name) {
+    return null;
+  }
+  return {
+    name,
+    ...(value.url ? { url: Array.isArray(value.url) ? value.url : [value.url] } : {}),
+    ...(value.contact ? { contact: Array.isArray(value.contact) ? value.contact : [value.contact] } : {}),
+  };
+};
+
+export function sbom(options = {}) {
+  const projectRoot = options.projectRoot || process.cwd();
+  const cliPackageJson = options.cliPackageJson || null;
+
+  return {
+    name: "sbom",
+    writeBundle(outputOptions, bundle) {
+      const projectPackageJson = readJsonSafe(path.join(projectRoot, "package.json"));
+      if (!projectPackageJson) {
+        warn("cannot read package.json, skipping SBOM generation");
+        return;
+      }
+      const settings = projectPackageJson.config?.tspci?.sbom || {};
+      // an SBOM is generated for every production build, --no-sbom opts out
+      if (settings.enabled === false || process.argv.includes("--no-sbom")) {
+        return;
+      }
+
+      const outputDir = outputOptions.dir
+        ? path.resolve(projectRoot, outputOptions.dir)
+        : path.dirname(path.resolve(projectRoot, outputOptions.file));
+
+      // Collect the modules that contributed code to the output.
+      const includedModules = new Set();
+      const entryChunks = [];
+      for (const chunk of Object.values(bundle)) {
+        if (chunk.type !== "chunk") {
+          continue;
+        }
+        if (chunk.isEntry) {
+          entryChunks.push(chunk);
+        }
+        for (const [moduleId, moduleInfo] of Object.entries(chunk.modules || {})) {
+          if ((moduleInfo?.renderedLength ?? 0) > 0) {
+            includedModules.add(moduleId);
+          }
+        }
+      }
+
+      const packages = new Map(); // package dir -> { packageJson, packageDir }
+      const moduleOwner = new Map(); // module id -> bom-ref
+      const projectModules = [];
+      const unknownModules = [];
+      const lockPackages = loadLockPackages(projectRoot);
+
+      const rootRef = purlFor(
+        projectPackageJson.name || "pci",
+        projectPackageJson.version || "0.0.0"
+      );
+
+      for (const moduleId of includedModules) {
+        if (!path.isAbsolute(moduleId) || !fs.existsSync(moduleId)) {
+          continue; // virtual modules and plugin helpers, no upstream component
+        }
+        const packageDir = moduleId.includes(NODE_MODULES_SEGMENT)
+          ? resolveNodeModulesPackageDir(moduleId)
+          : resolveLinkedPackageDir(moduleId, projectRoot);
+
+        if (!packageDir || packageDir === projectRoot) {
+          moduleOwner.set(moduleId, rootRef);
+          projectModules.push(moduleId);
+          continue;
+        }
+        let entry = packages.get(packageDir);
+        if (!entry) {
+          const packageJson = readJsonSafe(path.join(packageDir, "package.json"));
+          if (!packageJson?.name) {
+            moduleOwner.set(moduleId, rootRef);
+            unknownModules.push(moduleId);
+            continue;
+          }
+          entry = { packageJson, packageDir };
+          packages.set(packageDir, entry);
+        }
+        moduleOwner.set(moduleId, purlFor(entry.packageJson.name, entry.packageJson.version));
+      }
+
+      const components = [];
+      const seenRefs = new Set();
+      for (const { packageJson, packageDir } of [...packages.values()].sort((a, b) =>
+        a.packageJson.name.localeCompare(b.packageJson.name)
+      )) {
+        // the same name and version can be installed in more than one place,
+        // a bom-ref has to stay unique
+        const ref = purlFor(packageJson.name, packageJson.version);
+        if (seenRefs.has(ref)) {
+          continue;
+        }
+        seenRefs.add(ref);
+        const lockKey = toPosix(path.relative(projectRoot, packageDir));
+        const lockEntry = lockPackages[lockKey] || null;
+        const licenses = licensesFor(packageJson);
+        const references = externalReferencesFor(packageJson, lockEntry);
+        const hashes = hashesFromIntegrity(lockEntry?.integrity);
+        components.push({
+          type: "library",
+          "bom-ref": ref,
+          name: packageJson.name,
+          ...(packageJson.version ? { version: packageJson.version } : {}),
+          ...(packageJson.description ? { description: packageJson.description } : {}),
+          purl: ref,
+          ...(licenses ? { licenses } : {}),
+          ...(hashes ? { hashes } : {}),
+          ...(references ? { externalReferences: references } : {}),
+          properties: [
+            { name: "tspci:origin", value: lockKey.startsWith("node_modules/") ? "bundled" : "bundled-linked" },
+          ],
+        });
+      }
+
+      for (const additional of settings.additionalComponents || []) {
+        const normalized = normalizeAdditionalComponent(additional);
+        if (normalized) {
+          components.push(normalized);
+        } else {
+          warn("ignoring an entry in config.tspci.sbom.additionalComponents without a name");
+        }
+      }
+
+      // Package level dependency graph, derived from the module level imports.
+      const edges = new Map([[rootRef, new Set()]]);
+      for (const ref of components.map((component) => component["bom-ref"])) {
+        if (!edges.has(ref)) {
+          edges.set(ref, new Set());
+        }
+      }
+      for (const moduleId of includedModules) {
+        const from = moduleOwner.get(moduleId);
+        if (!from) {
+          continue;
+        }
+        const moduleInfo = this.getModuleInfo(moduleId);
+        const imported = [
+          ...(moduleInfo?.importedIds || []),
+          ...(moduleInfo?.dynamicallyImportedIds || []),
+        ];
+        for (const importedId of imported) {
+          const to = moduleOwner.get(importedId);
+          if (to && to !== from && edges.has(from)) {
+            edges.get(from).add(to);
+          }
+        }
+      }
+      const dependencies = [...edges.entries()]
+        .map(([ref, dependsOn]) => ({ ref, dependsOn: [...dependsOn].sort() }))
+        .sort((a, b) => (a.ref === rootRef ? -1 : b.ref === rootRef ? 1 : a.ref.localeCompare(b.ref)));
+
+      // Hash the delivered artefacts so a consumer can verify which build this
+      // SBOM describes.
+      const bundleHashes = [];
+      for (const chunk of entryChunks) {
+        bundleHashes.push({
+          fileName: chunk.fileName,
+          alg: "SHA-512",
+          content: crypto.createHash("sha512").update(chunk.code, "utf8").digest("hex"),
+        });
+      }
+
+      const typeIdentifier = projectPackageJson.config?.tspci?.typeIdentifier;
+      const componentProperties = [
+        ...(typeIdentifier ? [{ name: "tspci:typeIdentifier", value: typeIdentifier }] : []),
+        ...bundleHashes.map((hash) => ({ name: "tspci:bundleFile", value: hash.fileName })),
+        ...(settings.supportPeriodEnd
+          ? [{ name: "tspci:supportPeriodEnd", value: String(settings.supportPeriodEnd) }]
+          : []),
+        ...(settings.properties || []),
+      ];
+      const supplier = supplierFrom(settings.supplier || projectPackageJson.author);
+      const projectLicenses = licensesFor(projectPackageJson);
+
+      const includeTimestamp =
+        settings.timestamp === true || process.env.TSPCI_SBOM_TIMESTAMP === "1";
+
+      const document = {
+        bomFormat: "CycloneDX",
+        specVersion: "1.6",
+        version: 1,
+        serialNumber: serialNumberFor(
+          `${rootRef}:${bundleHashes.map((hash) => hash.content).join(":")}:${components.length}`
+        ),
+        metadata: {
+          ...(includeTimestamp ? { timestamp: new Date().toISOString() } : {}),
+          tools: {
+            components: [
+              {
+                type: "application",
+                name: cliPackageJson?.name || "@citolab/tspci",
+                ...(cliPackageJson?.version ? { version: cliPackageJson.version } : {}),
+              },
+            ],
+          },
+          component: {
+            type: "library",
+            "bom-ref": rootRef,
+            name: projectPackageJson.name || "pci",
+            version: projectPackageJson.version || "0.0.0",
+            ...(projectPackageJson.description ? { description: projectPackageJson.description } : {}),
+            purl: rootRef,
+            ...(supplier ? { supplier } : {}),
+            ...(projectLicenses ? { licenses: projectLicenses } : {}),
+            ...(bundleHashes.length > 0
+              ? { hashes: bundleHashes.map(({ alg, content }) => ({ alg, content })) }
+              : {}),
+            ...(settings.externalReferences ? { externalReferences: settings.externalReferences } : {}),
+            ...(componentProperties.length > 0 ? { properties: componentProperties } : {}),
+          },
+        },
+        components,
+        dependencies,
+      };
+
+      const fileName = settings.fileName || DEFAULT_FILE_NAME;
+      const outputFile = path.join(outputDir, fileName);
+      fs.mkdirSync(outputDir, { recursive: true });
+      fs.writeFileSync(outputFile, `${JSON.stringify(document, null, 2)}\n`, "utf8");
+      console.log(
+        `SBOM written to ${path.relative(projectRoot, outputFile)} (${components.length} bundled component${
+          components.length === 1 ? "" : "s"
+        })`
+      );
+
+      warnAboutGaps({
+        projectRoot,
+        settings,
+        unknownModules,
+        projectModules,
+        entryChunks,
+        components,
+      });
+    },
+  };
+}
+
+// Everything the module graph cannot see stays invisible in the SBOM. Making
+// that explicit is the point: a silently missing component is worse than a
+// warning at build time.
+// Rollup warnings raised from an output hook are collected by loadConfigFile
+// and never flushed by the cli, so these are printed directly.
+const warn = (message) => console.warn(chalk.yellow(`SBOM: ${message}`));
+
+function warnAboutGaps({ projectRoot, settings, unknownModules, projectModules, entryChunks, components }) {
+  if (settings.warnings === false) {
+    return;
+  }
+  const relative = (moduleId) => toPosix(path.relative(projectRoot, moduleId));
+
+  for (const moduleId of unknownModules) {
+    warn(
+      `cannot determine the package of ${relative(
+        moduleId
+      )}, its code is bundled but not listed as a component`
+    );
+  }
+
+  const vendored = projectModules.filter((moduleId) =>
+    VENDORED_PATTERNS.some((pattern) => pattern.test(moduleId))
+  );
+  for (const moduleId of vendored) {
+    warn(
+      `${relative(
+        moduleId
+      )} looks like vendored third party code. Add it to config.tspci.sbom.additionalComponents so it is documented.`
+    );
+  }
+
+  const remoteScripts = new Set();
+  for (const chunk of entryChunks) {
+    for (const match of chunk.code.matchAll(REMOTE_SCRIPT_PATTERN)) {
+      remoteScripts.add(match[0]);
+    }
+  }
+  const indexHtml = path.join(projectRoot, "src", "index.html");
+  if (fs.existsSync(indexHtml)) {
+    const html = fs.readFileSync(indexHtml, "utf8");
+    for (const match of html.matchAll(/<script[^>]+src=["'](https?:\/\/[^"']+)["']/gi)) {
+      remoteScripts.add(match[1]);
+    }
+  }
+  // A runtime dependency that is already declared manually needs no warning.
+  const declared = new Set();
+  for (const component of settings.additionalComponents || []) {
+    if (component?.name) {
+      declared.add(String(component.name).toLowerCase());
+    }
+    for (const reference of component?.externalReferences || []) {
+      if (reference?.url) {
+        declared.add(String(reference.url).toLowerCase());
+      }
+    }
+  }
+  for (const url of remoteScripts) {
+    const lowered = url.toLowerCase();
+    if ([...declared].some((value) => lowered === value || lowered.includes(value))) {
+      continue;
+    }
+    warn(
+      `${url} is loaded at runtime and is not part of the bundle. Add it to config.tspci.sbom.additionalComponents so it is documented.`
+    );
+  }
+
+  const withoutLicense = components.filter((component) => !component.licenses).length;
+  if (withoutLicense > 0) {
+    warn(
+      `${withoutLicense} bundled component${
+        withoutLicense === 1 ? " has" : "s have"
+      } no license information in their package.json`
+    );
+  }
+}

package/src/rollup.config.prod.js

@@ -1,17 +1,25 @@
 import terser from '@rollup/plugin-terser'
 import rollupConfig from "./rollup.config.js";
+import { sbom } from "./rollup-plugin-sbom.js";
 
 // PK: WORKADOUND FOR ERROR IN TERSER
 // PK: REMOVE when fixed
 // PK: see https://github.com/rollup/plugins/issues/1366#issuecomment-1345358157
 import { fileURLToPath } from 'url';
+import fs from 'fs';
+import path from 'path';
 const __filename = fileURLToPath(import.meta.url);
 global['__filename'] = __filename;
 
-const newRollupConfig = { 
-  ...rollupConfig, 
+const cliPackageJson = JSON.parse(
+  fs.readFileSync(path.resolve(path.dirname(__filename), "../package.json"), "utf-8")
+);
+
+const newRollupConfig = {
+  ...rollupConfig,
   output: rollupConfig.output.map((output) => ({ ...output, sourcemap: false })),
-  plugins: [...rollupConfig.plugins, terser()],
+  // sbom() runs after terser so it hashes the code that is actually delivered
+  plugins: [...rollupConfig.plugins, terser(), sbom({ cliPackageJson })],
 };
 
 export default newRollupConfig;