@effected/sbom 0.5.0 → 0.6.1

package/index.d.ts

@@ -252,7 +252,7 @@ export declare class InTotoStatement extends InTotoStatement_base {
    * be read by a person.
    */
   toJson(options?: {
-    readonly space?: number;
+    readonly space?: number | undefined;
   }): string;
 }
 //#endregion
@@ -484,7 +484,7 @@ interface SbomInput {
   /** Its dependencies, in any order — the document sorts them. */
   readonly components: ReadonlyArray<Component>;
   /** Document metadata. `root` is threaded onto it automatically. */
-  readonly metadata?: SbomMetadata;
+  readonly metadata?: SbomMetadata | undefined;
 }
 /**
  * Options for {@link Sbom.toJson}.
@@ -493,7 +493,7 @@ interface SbomInput {
  */
 interface SbomJsonOptions {
   /** `JSON.stringify` indentation. Defaults to `2`; `0` emits one line. */
-  readonly space?: number;
+  readonly space?: number | undefined;
 }
 declare const SbomWriteError_base: Schema.Class<SbomWriteError, Schema.TaggedStruct<"SbomWriteError", {
   /** The path that could not be written. */
@@ -571,19 +571,19 @@ export declare class Sbom {
  */
 interface SbomMetadataOptions {
   /** The supplying organization — NTIA minimum element 1. */
-  readonly supplier?: Supplier;
+  readonly supplier?: Supplier | undefined;
   /** Who assembled the BOM — NTIA minimum element 6. */
-  readonly authors?: ReadonlyArray<Contact>;
+  readonly authors?: ReadonlyArray<Contact> | undefined;
   /** When it was assembled — NTIA minimum element 7, as an ISO 8601 string. */
-  readonly timestamp?: string;
+  readonly timestamp?: string | undefined;
   /** The publishing entity. Falls back to the supplier, then the manifest's author. */
-  readonly publisher?: string;
+  readonly publisher?: string | undefined;
   /** A copyright statement; {@link SbomMetadataSource.formatCopyright} builds one. */
-  readonly copyright?: string;
+  readonly copyright?: string | undefined;
   /** The documentation URL, winning over the manifest's `homepage`. */
-  readonly documentationUrl?: string;
+  readonly documentationUrl?: string | undefined;
   /** The root component's type. Defaults to `library`. */
-  readonly type?: ComponentType;
+  readonly type?: ComponentType | undefined;
 }
 /**
  * The fields a dependency contributes to its component entry.
@@ -593,14 +593,19 @@ interface SbomMetadataOptions {
 interface ComponentInput {
   /** The package name, scope included. */
   readonly name: string;
-  /** Its resolved version. Absent produces a component with no version and no purl version segment. */
-  readonly version?: string;
+  /**
+   * Its resolved version. Absent produces a component with no version and no
+   * purl version segment. Typed `string | undefined` so a caller forwarding a
+   * statically optional version (e.g. `WorkspacePackage.version` from
+   * `@effected/workspaces`) compiles under `exactOptionalPropertyTypes`.
+   */
+  readonly version?: string | undefined;
   /** An SPDX identifier or expression. */
-  readonly license?: string;
+  readonly license?: string | undefined;
   /** A short description. */
-  readonly description?: string;
+  readonly description?: string | undefined;
   /** The component type. Defaults to `library`. */
-  readonly type?: ComponentType;
+  readonly type?: ComponentType | undefined;
 }
 /**
  * The years a copyright statement spans.
@@ -609,7 +614,7 @@ interface ComponentInput {
  */
 interface CopyrightYears {
   /** The first year of the range. Omit for a single-year statement. */
-  readonly startYear?: number;
+  readonly startYear?: number | undefined;
   /** The year the statement is current through — the caller's clock read, never ours. */
   readonly year: number;
 }
@@ -817,13 +822,13 @@ export declare class SigningError extends SigningError_base {
  */
 interface SigstoreSignerOptions {
   /** Fulcio's base URL. Defaults to the public-good instance. */
-  readonly fulcioBaseUrl?: string;
+  readonly fulcioBaseUrl?: string | undefined;
   /** Rekor's base URL. Defaults to the public-good instance. */
-  readonly rekorBaseUrl?: string;
+  readonly rekorBaseUrl?: string | undefined;
   /** Replace the certificate signer. */
-  readonly signer?: Signer;
+  readonly signer?: Signer | undefined;
   /** Replace the witnesses. An empty array signs without a transparency log. */
-  readonly witnesses?: ReadonlyArray<Witness>;
+  readonly witnesses?: ReadonlyArray<Witness> | undefined;
 }
 /**
  * The signing surface.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@effected/sbom",
-	"version": "0.5.0",
+	"version": "0.6.1",
 	"private": false,
 	"description": "CycloneDX 1.6 SBOM construction, SLSA provenance, NTIA validation and Sigstore signing as typed services.",
 	"keywords": [
@@ -39,13 +39,13 @@
 		"./package.json": "./package.json"
 	},
 	"dependencies": {
-		"@effected/package-json": "^0.14.0",
-		"@effected/spdx": "^0.6.0",
+		"@effected/package-json": "^0.15.0",
+		"@effected/spdx": "^0.7.0",
 		"@sigstore/bundle": "^5.0.0",
 		"@sigstore/sign": "^5.0.0"
 	},
 	"peerDependencies": {
-		"effect": "4.0.0-rc.112"
+		"effect": "4.0.0-rc.115"
 	},
 	"engines": {
 		"node": ">=24.11.0"

package/tsdoc-metadata.json

@@ -5,7 +5,7 @@
   "toolPackages": [
     {
       "packageName": "@microsoft/api-extractor",
-      "packageVersion": "7.59.0"
+      "packageVersion": "7.59.1"
     }
   ]
 }