@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/supply-chain/sbom.js

@@ -0,0 +1,826 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CYCLONEDX_INVENTORY_SCOPES = exports.SUPPLY_CHAIN_RELEASE_BINDING_KIND = exports.SUPPLY_CHAIN_SBOM_SCHEMA_VERSION = exports.CYCLONEDX_SPEC_VERSION = void 0;
+exports.createCycloneDxComponentsFromInventory = createCycloneDxComponentsFromInventory;
+exports.createCycloneDxPlatformSbomUnion = createCycloneDxPlatformSbomUnion;
+exports.createCycloneDxSbom = createCycloneDxSbom;
+exports.validateCycloneDxSbom = validateCycloneDxSbom;
+exports.createSupplyChainReleaseBinding = createSupplyChainReleaseBinding;
+exports.validateSupplyChainReleaseBinding = validateSupplyChainReleaseBinding;
+const deterministic_order_js_1 = require("../deterministic-order.js");
+const validation_js_1 = require("../validation.js");
+const common_js_1 = require("./common.js");
+const errors_js_1 = require("./errors.js");
+const license_expression_js_1 = require("./license-expression.js");
+exports.CYCLONEDX_SPEC_VERSION = '1.6';
+exports.SUPPLY_CHAIN_SBOM_SCHEMA_VERSION = 1;
+exports.SUPPLY_CHAIN_RELEASE_BINDING_KIND = 'ebk-supply-chain-release-binding';
+exports.CYCLONEDX_INVENTORY_SCOPES = [
+    'source-build-inputs',
+    'build-output-contents',
+    'deployable-bundle-contents',
+    'final-oci-contents',
+];
+function packageReference(value, path) {
+    const withoutPeers = value.replace(/\(.+$/, '');
+    const separator = withoutPeers.lastIndexOf('@');
+    if (separator <= 0) {
+        throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', path, `cannot resolve dependency reference ${value}`);
+    }
+    const name = withoutPeers.slice(0, separator);
+    const version = withoutPeers.slice(separator + 1);
+    if (!common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(name) ||
+        !common_js_1.SUPPLY_CHAIN_EXACT_VERSION.test(version)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', path, `does not identify one exact npm component: ${value}`);
+    }
+    return { name, version };
+}
+function npmPurl(name, version) {
+    return `pkg:npm/${encodeURIComponent(name)}@${version}`;
+}
+/**
+ * Derive the exact production source/build dependency closure for one
+ * workspace importer.
+ *
+ * pnpm can retain multiple peer-context lock keys for the same package bytes.
+ * CycloneDX identifies those bytes by package URL, so this projection merges
+ * peer contexts while retaining the union of their dependency edges. Any
+ * unresolved edge fails as an omission instead of producing a partial SBOM.
+ */
+function createCycloneDxComponentsFromInventory(input) {
+    if (typeof input.importer !== 'string' ||
+        input.importer.trim() === '' ||
+        input.importer !== input.importer.trim()) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'importer', 'must name one exact workspace importer');
+    }
+    const packages = new Map(input.inventory.resolvedPackages.map((entry) => [entry.lockKey, entry]));
+    const packagesByIdentity = new Map();
+    for (const entry of input.inventory.resolvedPackages) {
+        const identity = `${entry.name}@${entry.version}`;
+        packagesByIdentity.set(identity, [
+            ...(packagesByIdentity.get(identity) ?? []),
+            entry.lockKey,
+        ]);
+    }
+    const resolveKeys = (name, resolved, path) => {
+        const exact = `${name}@${resolved}`;
+        if (packages.has(exact))
+            return [exact];
+        if (/^(?:file|link|workspace):/.test(resolved)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', path, `workspace dependency ${name}@${resolved} has no final registry component`);
+        }
+        const reference = packageReference(`${name}@${resolved}`, path);
+        const candidates = packagesByIdentity.get(`${reference.name}@${reference.version}`) ?? [];
+        if (candidates.length === 0) {
+            throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', path, `resolved package ${name}@${resolved} is absent from the lock inventory`);
+        }
+        return candidates;
+    };
+    const visited = new Map();
+    const pending = [];
+    const directDependencies = input.inventory.dependencies.filter(({ importer, scope }) => importer === input.importer &&
+        (scope === 'production' || scope === 'optional'));
+    if (directDependencies.length === 0) {
+        throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', `inventory.dependencies.${input.importer}`, 'has no production dependency closure');
+    }
+    for (const dependency of directDependencies) {
+        for (const key of resolveKeys(dependency.name, dependency.resolved, `inventory.dependencies.${input.importer}.${dependency.name}`)) {
+            pending.push({
+                direct: true,
+                key,
+                required: dependency.scope === 'production',
+            });
+        }
+    }
+    while (pending.length > 0) {
+        const current = pending.pop();
+        if (!current)
+            break;
+        const previous = visited.get(current.key);
+        const next = {
+            direct: (previous?.direct ?? false) || current.direct,
+            required: (previous?.required ?? false) || current.required,
+        };
+        if (previous?.direct === next.direct &&
+            previous.required === next.required) {
+            continue;
+        }
+        visited.set(current.key, next);
+        const entry = packages.get(current.key);
+        if (!entry) {
+            throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', `inventory.resolvedPackages.${current.key}`, 'is absent from the exact lock inventory');
+        }
+        for (const [index, dependency] of entry.dependencies.entries()) {
+            const reference = packageReference(dependency, `inventory.resolvedPackages.${current.key}.dependencies[${index}]`);
+            for (const key of resolveKeys(reference.name, reference.version, `inventory.resolvedPackages.${current.key}.dependencies[${index}]`)) {
+                pending.push({
+                    direct: false,
+                    key,
+                    required: next.required,
+                });
+            }
+        }
+    }
+    const grouped = new Map();
+    for (const [key, reachability] of visited) {
+        const entry = packages.get(key);
+        if (!entry)
+            continue;
+        const identity = `${entry.name}@${entry.version}`;
+        const component = grouped.get(identity) ?? {
+            dependencies: new Set(),
+            direct: false,
+            name: entry.name,
+            required: false,
+            version: entry.version,
+        };
+        component.direct ||= reachability.direct;
+        component.required ||= reachability.required;
+        for (const [index, dependency] of entry.dependencies.entries()) {
+            const reference = packageReference(dependency, `inventory.resolvedPackages.${key}.dependencies[${index}]`);
+            component.dependencies.add(npmPurl(reference.name, reference.version));
+        }
+        grouped.set(identity, component);
+    }
+    return [...grouped.entries()]
+        .sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))
+        .map(([identity, component]) => ({
+        dependencies: [...component.dependencies].sort(),
+        direct: component.direct,
+        licenses: input.licenses?.[identity]?.length === 0
+            ? ['LicenseRef-Unknown']
+            : [...(input.licenses?.[identity] ?? ['LicenseRef-Unknown'])].sort(),
+        name: component.name,
+        purl: npmPurl(component.name, component.version),
+        scope: component.required ? 'required' : 'optional',
+        type: component.name.startsWith('@empire-builder-kit/')
+            ? 'framework'
+            : 'library',
+        version: component.version,
+    }));
+}
+function canonicalTimestamp(value, path) {
+    if (!Number.isFinite(Date.parse(value)) ||
+        new Date(value).toISOString() !== value) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', path, 'must be a canonical ISO-8601 timestamp');
+    }
+}
+function uuidFromDigest(digest) {
+    const chars = digest.slice(0, 32).split('');
+    chars[12] = '5';
+    chars[16] = ['8', '9', 'a', 'b'][Number.parseInt(chars[16] ?? '0', 16) % 4];
+    const value = chars.join('');
+    return [
+        value.slice(0, 8),
+        value.slice(8, 12),
+        value.slice(12, 16),
+        value.slice(16, 20),
+        value.slice(20, 32),
+    ].join('-');
+}
+function canonicalClone(value) {
+    return JSON.parse((0, common_js_1.canonicalizeSupplyChainValue)(value));
+}
+/**
+ * Create one deterministic CycloneDX inventory for a multi-architecture OCI
+ * index from the independently scanned child manifests.
+ *
+ * Architecture-specific operating-system packages are retained as a union.
+ * The npm identities must remain identical because the container-release
+ * contract proves one architecture-neutral production dependency closure.
+ */
+function createCycloneDxPlatformSbomUnion(input) {
+    canonicalTimestamp(input.generatedAt, 'generatedAt');
+    const expectedPlatforms = ['linux/amd64', 'linux/arm64'];
+    const platforms = [...input.platforms].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.platform, right.platform));
+    if (platforms.length !== expectedPlatforms.length ||
+        platforms.some(({ platform }, index) => platform !== expectedPlatforms[index]) ||
+        typeof input.artifact['bom-ref'] !== 'string' ||
+        input.artifact['bom-ref'].length === 0 ||
+        input.artifact.type !== 'container' ||
+        typeof input.artifact.name !== 'string' ||
+        input.artifact.name.length === 0 ||
+        typeof input.artifact.version !== 'string' ||
+        input.artifact.version.length === 0 ||
+        !Array.isArray(input.artifact.hashes) ||
+        input.artifact.hashes.length !== 1 ||
+        input.artifact.hashes[0]?.alg !== 'SHA-256' ||
+        !common_js_1.SUPPLY_CHAIN_SHA256.test(input.artifact.hashes[0]?.content ?? '')) {
+        throw new errors_js_1.SupplyChainError('supply-chain-sbom-invalid', 'platformUnion', 'must bind exactly linux/amd64 and linux/arm64 to one OCI index');
+    }
+    const propertyNames = new Set();
+    const properties = [...input.properties]
+        .map((property, index) => {
+        if (!(0, validation_js_1.isRecord)(property) ||
+            typeof property.name !== 'string' ||
+            property.name.length === 0 ||
+            property.name.length > 256 ||
+            typeof property.value !== 'string' ||
+            property.value.length === 0 ||
+            property.value.length > 2_048 ||
+            propertyNames.has(property.name)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-sbom-invalid', `platformUnion.properties[${index}]`, 'must be one bounded unique name/value binding');
+        }
+        propertyNames.add(property.name);
+        return { name: property.name, value: property.value };
+    })
+        .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.name, right.name) ||
+        (0, deterministic_order_js_1.compareUtf16)(left.value, right.value));
+    const componentByRef = new Map();
+    const dependencyByRef = new Map();
+    const toolByIdentity = new Map();
+    const npmClosures = [];
+    const childIdentities = [];
+    for (const [platformIndex, platform] of platforms.entries()) {
+        const path = `platformUnion.platforms[${platformIndex}].sbom`;
+        const sbom = platform.sbom;
+        if (!(0, validation_js_1.isRecord)(sbom) ||
+            sbom.bomFormat !== 'CycloneDX' ||
+            sbom.specVersion !== exports.CYCLONEDX_SPEC_VERSION ||
+            sbom.version !== 1 ||
+            typeof sbom.serialNumber !== 'string' ||
+            !/^urn:uuid:[a-fA-F0-9-]{36}$/.test(sbom.serialNumber) ||
+            !Array.isArray(sbom.components) ||
+            sbom.components.length === 0 ||
+            !Array.isArray(sbom.dependencies) ||
+            !(0, validation_js_1.isRecord)(sbom.metadata)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-sbom-invalid', path, 'must be complete CycloneDX 1.6 child-manifest evidence');
+        }
+        const seenChildRefs = new Set();
+        const npmComponents = [];
+        for (const [componentIndex, candidate] of sbom.components.entries()) {
+            if (!(0, validation_js_1.isRecord)(candidate)) {
+                throw new errors_js_1.SupplyChainError('supply-chain-sbom-invalid', `${path}.components[${componentIndex}]`, 'must be one component object');
+            }
+            const ref = typeof candidate['bom-ref'] === 'string'
+                ? candidate['bom-ref']
+                : candidate.purl;
+            if (typeof ref !== 'string' ||
+                ref.length === 0 ||
+                ref.length > 2_048 ||
+                seenChildRefs.has(ref) ||
+                typeof candidate.name !== 'string' ||
+                candidate.name.length === 0 ||
+                typeof candidate.type !== 'string' ||
+                candidate.type.length === 0 ||
+                typeof candidate.version !== 'string' ||
+                candidate.version.length === 0) {
+                throw new errors_js_1.SupplyChainError('supply-chain-sbom-invalid', `${path}.components[${componentIndex}]`, 'must have one unique bounded component identity');
+            }
+            seenChildRefs.add(ref);
+            const component = canonicalClone({ ...candidate, 'bom-ref': ref });
+            const prior = componentByRef.get(ref);
+            if (prior !== undefined &&
+                (0, common_js_1.canonicalizeSupplyChainValue)(prior) !==
+                    (0, common_js_1.canonicalizeSupplyChainValue)(component)) {
+                throw new errors_js_1.SupplyChainError('supply-chain-sbom-invalid', `${path}.components[${componentIndex}]`, 'conflicts with the same component reference on another platform');
+            }
+            componentByRef.set(ref, component);
+            if (typeof candidate.purl === 'string' &&
+                candidate.purl.startsWith('pkg:npm/')) {
+                npmComponents.push({
+                    name: candidate.name,
+                    purl: candidate.purl,
+                    type: candidate.type,
+                    version: candidate.version,
+                });
+            }
+        }
+        npmClosures.push((0, common_js_1.canonicalizeSupplyChainValue)(npmComponents.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.purl, right.purl))));
+        const seenDependencyRefs = new Set();
+        for (const [dependencyIndex, candidate] of sbom.dependencies.entries()) {
+            if (!(0, validation_js_1.isRecord)(candidate) ||
+                typeof candidate.ref !== 'string' ||
+                candidate.ref.length === 0 ||
+                candidate.ref.length > 2_048 ||
+                seenDependencyRefs.has(candidate.ref) ||
+                !Array.isArray(candidate.dependsOn) ||
+                candidate.dependsOn.some((dependency) => typeof dependency !== 'string' ||
+                    dependency.length === 0 ||
+                    dependency.length > 2_048)) {
+                throw new errors_js_1.SupplyChainError('supply-chain-sbom-invalid', `${path}.dependencies[${dependencyIndex}]`, 'must have one unique reference and bounded dependency set');
+            }
+            seenDependencyRefs.add(candidate.ref);
+            const targets = dependencyByRef.get(candidate.ref) ?? new Set();
+            for (const dependency of candidate.dependsOn) {
+                targets.add(dependency);
+            }
+            dependencyByRef.set(candidate.ref, targets);
+        }
+        const tools = (0, validation_js_1.isRecord)(sbom.metadata.tools)
+            ? sbom.metadata.tools.components
+            : undefined;
+        if (tools !== undefined) {
+            if (!Array.isArray(tools) || tools.some((tool) => !(0, validation_js_1.isRecord)(tool))) {
+                throw new errors_js_1.SupplyChainError('supply-chain-sbom-invalid', `${path}.metadata.tools.components`, 'must be a component list when present');
+            }
+            for (const tool of tools) {
+                const normalized = canonicalClone(tool);
+                toolByIdentity.set((0, common_js_1.canonicalizeSupplyChainValue)(normalized), normalized);
+            }
+        }
+        childIdentities.push({
+            digest: (0, common_js_1.supplyChainDigest)(sbom),
+            platform: platform.platform,
+            serialNumber: sbom.serialNumber.toLowerCase(),
+        });
+    }
+    if (npmClosures.some((closure) => closure !== npmClosures[0])) {
+        throw new errors_js_1.SupplyChainError('supply-chain-sbom-invalid', 'platformUnion.platforms', 'must retain one exact npm component closure across both architectures');
+    }
+    const components = [...componentByRef.entries()]
+        .sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))
+        .map(([, component]) => component);
+    const dependencies = [...dependencyByRef.entries()]
+        .sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))
+        .map(([ref, dependsOn]) => ({ dependsOn: [...dependsOn].sort(), ref }));
+    const unionIdentity = (0, common_js_1.supplyChainDigest)({
+        artifact: input.artifact,
+        childIdentities,
+        components,
+        dependencies,
+        generatedAt: input.generatedAt,
+        properties,
+    });
+    const serialNumber = `urn:uuid:${uuidFromDigest(unionIdentity)}`;
+    if (childIdentities.some((identity) => identity.serialNumber === serialNumber)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-sbom-invalid', 'platformUnion.serialNumber', 'must be distinct from every child-manifest SBOM serial');
+    }
+    const tools = [...toolByIdentity.entries()]
+        .sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))
+        .map(([, tool]) => tool);
+    return {
+        bomFormat: 'CycloneDX',
+        components,
+        dependencies,
+        metadata: {
+            component: canonicalClone(input.artifact),
+            properties,
+            timestamp: input.generatedAt,
+            ...(tools.length > 0 ? { tools: { components: tools } } : {}),
+        },
+        serialNumber,
+        specVersion: exports.CYCLONEDX_SPEC_VERSION,
+        version: 1,
+    };
+}
+function componentRef(component) {
+    return component.purl;
+}
+function validateComponentInput(component, index) {
+    const path = `components[${index}]`;
+    const licenses = Array.isArray(component.licenses) ? component.licenses : [];
+    if (!(0, validation_js_1.isRecord)(component) ||
+        !['application', 'container', 'framework', 'library'].includes(component.type) ||
+        !common_js_1.SUPPLY_CHAIN_EXACT_VERSION.test(component.version) ||
+        typeof component.name !== 'string' ||
+        component.name.trim() === '' ||
+        !/^pkg:(?:npm|oci)\/[A-Za-z0-9.%_@/+~-]+@\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?(?:\?.*)?$/.test(component.purl) ||
+        !['excluded', 'optional', 'required'].includes(component.scope) ||
+        !Array.isArray(component.dependencies) ||
+        licenses.length === 0 ||
+        licenses.some((license) => {
+            try {
+                return (typeof license !== 'string' ||
+                    license !== (0, license_expression_js_1.normalizeSpdxLicenseExpression)(license));
+            }
+            catch {
+                return true;
+            }
+        }) ||
+        (0, common_js_1.hasSensitiveSupplyChainShape)(component)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-sbom-invalid', path, 'must completely identify one supported exact-version component');
+    }
+    for (const [hashIndex, hash] of (component.hashes ?? []).entries()) {
+        if (hash.algorithm !== 'SHA-256' || !common_js_1.SUPPLY_CHAIN_SHA256.test(hash.value)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-sbom-invalid', `${path}.hashes[${hashIndex}]`, 'must be a lowercase SHA-256 hash');
+        }
+    }
+}
+function createCycloneDxSbom(input) {
+    canonicalTimestamp(input.generatedAt, 'generatedAt');
+    if (!common_js_1.SUPPLY_CHAIN_SHA256.test(input.artifact.digest) ||
+        !common_js_1.SUPPLY_CHAIN_EXACT_VERSION.test(input.artifact.version) ||
+        !['application', 'container', 'framework', 'library'].includes(input.artifact.type) ||
+        typeof input.artifact.name !== 'string' ||
+        input.artifact.name.trim() === '' ||
+        !common_js_1.SUPPLY_CHAIN_SHA256.test(input.release.manifestDigest) ||
+        !common_js_1.SUPPLY_CHAIN_REFERENCE.test(input.release.id) ||
+        !/^[a-f0-9]{40}$/.test(input.source.commit) ||
+        !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(input.source.repository) ||
+        !common_js_1.SUPPLY_CHAIN_EXACT_VERSION.test(input.generationTool.version) ||
+        !input.generationTool.purl.startsWith('pkg:npm/') ||
+        !exports.CYCLONEDX_INVENTORY_SCOPES.includes(input.inventoryScope) ||
+        (['build-output-contents', 'deployable-bundle-contents'].includes(input.inventoryScope) &&
+            input.artifact.type !== 'application') ||
+        (input.inventoryScope === 'final-oci-contents' &&
+            input.artifact.type !== 'container') ||
+        input.components.length === 0 ||
+        (0, common_js_1.hasSensitiveSupplyChainShape)(input)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-sbom-invalid', 'sbom', 'must bind a supported artifact to source, release, and exact tool identity');
+    }
+    if (input.omissions.length > 0) {
+        throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', 'omissions', `SBOM generation cannot omit ${input.omissions
+            .map(({ ecosystem }) => ecosystem)
+            .join(', ')}`);
+    }
+    input.components.forEach(validateComponentInput);
+    const refs = new Set(input.components.map(componentRef));
+    if (refs.size !== input.components.length) {
+        throw new errors_js_1.SupplyChainError('supply-chain-sbom-invalid', 'components', 'component package URLs must be unique');
+    }
+    for (const [index, component] of input.components.entries()) {
+        for (const dependency of component.dependencies) {
+            if (!refs.has(dependency)) {
+                throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', `components[${index}].dependencies`, `${dependency} is absent from the declared component inventory`);
+            }
+        }
+    }
+    const artifactRef = `urn:ebk:artifact:${input.artifact.digest}`;
+    const components = [...input.components]
+        .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.purl, right.purl))
+        .map((component) => ({
+        'bom-ref': componentRef(component),
+        ...(component.hashes?.length
+            ? {
+                hashes: [...component.hashes]
+                    .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.value, right.value))
+                    .map(({ value }) => ({
+                    alg: 'SHA-256',
+                    content: value,
+                })),
+            }
+            : {}),
+        licenses: [...component.licenses]
+            .sort()
+            .map((expression) => /^(?:[A-Za-z0-9-.+]+|LicenseRef-[A-Za-z0-9-.]+)$/.test(expression)
+            ? { license: { id: expression } }
+            : { expression }),
+        name: component.name,
+        properties: [
+            {
+                name: 'ebk:dependency:direct',
+                value: String(component.direct),
+            },
+        ],
+        purl: component.purl,
+        scope: component.scope,
+        ...(component.supplier ? { supplier: { name: component.supplier } } : {}),
+        type: component.type,
+        version: component.version,
+    }));
+    const dependencies = [
+        {
+            dependsOn: input.components
+                .filter(({ direct }) => direct)
+                .map(componentRef)
+                .sort(),
+            ref: artifactRef,
+        },
+        ...input.components
+            .map((component) => ({
+            dependsOn: [...component.dependencies].sort(),
+            ref: componentRef(component),
+        }))
+            .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.ref, right.ref)),
+    ];
+    const identity = (0, common_js_1.supplyChainDigest)({
+        artifact: input.artifact,
+        components,
+        generatedAt: input.generatedAt,
+        generationTool: input.generationTool,
+        inventoryScope: input.inventoryScope,
+        release: input.release,
+        source: input.source,
+    });
+    const componentGraphDigest = (0, common_js_1.supplyChainDigest)(input.components
+        .map(({ dependencies, direct, purl }) => ({
+        dependencies: [...dependencies].sort(),
+        direct,
+        purl,
+    }))
+        .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.purl, right.purl)));
+    return {
+        bomFormat: 'CycloneDX',
+        components,
+        dependencies,
+        metadata: {
+            component: {
+                'bom-ref': artifactRef,
+                hashes: [{ alg: 'SHA-256', content: input.artifact.digest }],
+                name: input.artifact.name,
+                type: input.artifact.type,
+                version: input.artifact.version,
+            },
+            properties: [
+                { name: 'ebk:release:id', value: input.release.id },
+                {
+                    name: 'ebk:release:manifest:sha256',
+                    value: input.release.manifestDigest,
+                },
+                { name: 'ebk:source:commit', value: input.source.commit },
+                { name: 'ebk:source:repository', value: input.source.repository },
+                {
+                    name: 'ebk:inventory:component-graph:sha256',
+                    value: componentGraphDigest,
+                },
+                { name: 'ebk:inventory:scope', value: input.inventoryScope },
+            ],
+            timestamp: input.generatedAt,
+            tools: {
+                components: [
+                    {
+                        name: input.generationTool.name,
+                        purl: input.generationTool.purl,
+                        type: 'application',
+                        version: input.generationTool.version,
+                    },
+                ],
+            },
+        },
+        serialNumber: `urn:uuid:${uuidFromDigest(identity)}`,
+        specVersion: exports.CYCLONEDX_SPEC_VERSION,
+        version: 1,
+    };
+}
+function validateCycloneDxSbom(value, expected) {
+    if (!(0, validation_js_1.isRecord)(value) ||
+        value.bomFormat !== 'CycloneDX' ||
+        value.specVersion !== exports.CYCLONEDX_SPEC_VERSION ||
+        value.version !== 1 ||
+        typeof value.serialNumber !== 'string' ||
+        !/^urn:uuid:[a-f0-9-]{36}$/.test(value.serialNumber) ||
+        !Array.isArray(value.components) ||
+        !Array.isArray(value.dependencies) ||
+        !(0, validation_js_1.isRecord)(value.metadata) ||
+        !(0, validation_js_1.isRecord)(value.metadata.component) ||
+        !Array.isArray(value.metadata.properties) ||
+        (0, common_js_1.hasSensitiveSupplyChainShape)(value)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-sbom-invalid', 'sbom', 'does not satisfy the CycloneDX v1.6 EBK profile');
+    }
+    const artifactHashes = value.metadata.component.hashes;
+    if (!Array.isArray(artifactHashes) ||
+        !artifactHashes.some((hash) => (0, validation_js_1.isRecord)(hash) &&
+            hash.alg === 'SHA-256' &&
+            hash.content === expected.artifact.digest)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-artifact-mismatch', 'sbom.metadata.component.hashes', 'does not bind the independently computed artifact digest');
+    }
+    const artifactRef = `urn:ebk:artifact:${expected.artifact.digest}`;
+    if (value.metadata.component['bom-ref'] !== artifactRef ||
+        value.metadata.component.name !== expected.artifact.name ||
+        value.metadata.component.type !== expected.artifact.type ||
+        value.metadata.component.version !== expected.artifact.version) {
+        throw new errors_js_1.SupplyChainError('supply-chain-artifact-mismatch', 'sbom.metadata.component', 'does not identify the independently expected release artifact');
+    }
+    const properties = new Map(value.metadata.properties
+        .filter((property) => (0, validation_js_1.isRecord)(property) &&
+        typeof property.name === 'string' &&
+        typeof property.value === 'string')
+        .map(({ name, value: propertyValue }) => [name, propertyValue]));
+    if (!exports.CYCLONEDX_INVENTORY_SCOPES.includes(expected.inventoryScope) ||
+        !common_js_1.SUPPLY_CHAIN_SHA256.test(expected.artifact.digest) ||
+        !common_js_1.SUPPLY_CHAIN_EXACT_VERSION.test(expected.artifact.version) ||
+        typeof expected.artifact.name !== 'string' ||
+        expected.artifact.name.trim() === '' ||
+        !['application', 'container', 'framework', 'library'].includes(expected.artifact.type) ||
+        expected.components.length === 0) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'expected.components', 'must independently identify one exact nonempty component graph and inventory scope');
+    }
+    const expectedGraph = [...expected.components]
+        .map((component, index) => {
+        if (!(0, validation_js_1.isRecord)(component) ||
+            typeof component.purl !== 'string' ||
+            !/^pkg:(?:npm|oci)\/[A-Za-z0-9.%_@/+~-]+@\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?(?:\?.*)?$/.test(component.purl) ||
+            !Array.isArray(component.dependencies) ||
+            component.dependencies.some((dependency) => typeof dependency !== 'string') ||
+            new Set(component.dependencies).size !==
+                component.dependencies.length ||
+            typeof component.direct !== 'boolean' ||
+            !Array.isArray(component.licenses) ||
+            component.licenses.length === 0 ||
+            component.licenses.some((license) => {
+                try {
+                    return (typeof license !== 'string' ||
+                        license !== (0, license_expression_js_1.normalizeSpdxLicenseExpression)(license));
+                }
+                catch {
+                    return true;
+                }
+            }) ||
+            typeof component.name !== 'string' ||
+            component.name.trim() === '' ||
+            !['excluded', 'optional', 'required'].includes(component.scope) ||
+            !['application', 'container', 'framework', 'library'].includes(component.type) ||
+            !common_js_1.SUPPLY_CHAIN_EXACT_VERSION.test(component.version)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `expected.components[${index}]`, 'must independently identify one component and its exact dependency edges');
+        }
+        return {
+            dependencies: [...component.dependencies].sort(),
+            direct: component.direct,
+            licenses: [...component.licenses].sort(),
+            name: component.name,
+            purl: component.purl,
+            scope: component.scope,
+            type: component.type,
+            version: component.version,
+        };
+    })
+        .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.purl, right.purl));
+    if (new Set(expectedGraph.map(({ purl }) => purl)).size !== expectedGraph.length) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'expected.components', 'must not contain duplicate component identities');
+    }
+    const expectedPurlSet = new Set(expectedGraph.map(({ purl }) => purl));
+    if (expectedGraph.some(({ dependencies }) => dependencies.some((dependency) => !expectedPurlSet.has(dependency)))) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'expected.components', 'must close every expected dependency edge within the component graph');
+    }
+    const expectedGraphDigest = (0, common_js_1.supplyChainDigest)(expectedGraph.map(({ dependencies, direct, purl }) => ({
+        dependencies,
+        direct,
+        purl,
+    })));
+    if (properties.get('ebk:release:manifest:sha256') !==
+        expected.releaseManifestDigest ||
+        properties.get('ebk:source:commit') !== expected.sourceCommit ||
+        properties.get('ebk:inventory:scope') !== expected.inventoryScope) {
+        throw new errors_js_1.SupplyChainError('supply-chain-artifact-mismatch', 'sbom.metadata.properties', 'source or release identity does not match the expected candidate');
+    }
+    const componentIdentities = value.components
+        .map((component, index) => {
+        if (!(0, validation_js_1.isRecord)(component) ||
+            typeof component.purl !== 'string' ||
+            component['bom-ref'] !== component.purl ||
+            typeof component.name !== 'string' ||
+            component.name.trim() === '' ||
+            typeof component.version !== 'string' ||
+            !common_js_1.SUPPLY_CHAIN_EXACT_VERSION.test(component.version) ||
+            !['application', 'container', 'framework', 'library'].includes(String(component.type)) ||
+            !['excluded', 'optional', 'required'].includes(String(component.scope)) ||
+            !Array.isArray(component.licenses) ||
+            component.licenses.length === 0) {
+            throw new errors_js_1.SupplyChainError('supply-chain-sbom-invalid', `sbom.components[${index}]`, 'does not satisfy the exact-component EBK profile');
+        }
+        const licenses = component.licenses.map((license, licenseIndex) => {
+            if ((0, validation_js_1.isRecord)(license) &&
+                Object.keys(license).length === 1 &&
+                (0, validation_js_1.isRecord)(license.license) &&
+                Object.keys(license.license).length === 1 &&
+                typeof license.license.id === 'string' &&
+                /^(?:[A-Za-z0-9-.+]+|LicenseRef-[A-Za-z0-9-.]+)$/.test(license.license.id)) {
+                return (0, license_expression_js_1.normalizeSpdxLicenseExpression)(license.license.id);
+            }
+            if ((0, validation_js_1.isRecord)(license) &&
+                Object.keys(license).length === 1 &&
+                typeof license.expression === 'string') {
+                const normalized = (0, license_expression_js_1.normalizeSpdxLicenseExpression)(license.expression);
+                if (normalized === license.expression)
+                    return normalized;
+            }
+            throw new errors_js_1.SupplyChainError('supply-chain-sbom-invalid', `sbom.components[${index}].licenses[${licenseIndex}]`, 'must be one canonical SPDX identifier or expression');
+        });
+        return {
+            licenses: [...licenses].sort(),
+            name: component.name,
+            purl: component.purl,
+            scope: component.scope,
+            type: component.type,
+            version: component.version,
+        };
+    })
+        .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.purl, right.purl));
+    const expectedPurls = expectedGraph.map(({ purl }) => purl);
+    if (componentIdentities.length !== expectedGraph.length ||
+        componentIdentities.some((identity, index) => {
+            const expectedIdentity = expectedGraph[index];
+            return (expectedIdentity === undefined ||
+                identity.name !== expectedIdentity.name ||
+                JSON.stringify(identity.licenses) !==
+                    JSON.stringify(expectedIdentity.licenses) ||
+                identity.purl !== expectedIdentity.purl ||
+                identity.scope !== expectedIdentity.scope ||
+                identity.type !== expectedIdentity.type ||
+                identity.version !== expectedIdentity.version);
+        })) {
+        throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', 'sbom.components', 'does not exactly match the independently derived component inventory');
+    }
+    const dependencyRefs = new Set();
+    const dependencyGraph = new Map();
+    value.dependencies.forEach((entry, index) => {
+        if (!(0, validation_js_1.isRecord)(entry) ||
+            typeof entry.ref !== 'string' ||
+            !Array.isArray(entry.dependsOn) ||
+            entry.dependsOn.some((target) => typeof target !== 'string') ||
+            new Set(entry.dependsOn).size !== entry.dependsOn.length ||
+            dependencyRefs.has(entry.ref)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-sbom-invalid', `sbom.dependencies[${index}]`, 'must uniquely identify a dependency node and its exact targets');
+        }
+        dependencyRefs.add(entry.ref);
+        dependencyGraph.set(entry.ref, [...entry.dependsOn].sort());
+    });
+    if (dependencyRefs.size !== expectedPurls.length + 1 ||
+        !dependencyRefs.has(artifactRef) ||
+        expectedPurls.some((purl) => !dependencyRefs.has(purl))) {
+        throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', 'sbom.dependencies', 'must include the artifact and every component dependency node');
+    }
+    const expectedDependencyGraph = new Map([
+        [
+            artifactRef,
+            expectedGraph
+                .filter(({ direct }) => direct)
+                .map(({ purl }) => purl)
+                .sort(),
+        ],
+        ...expectedGraph.map(({ dependencies, purl }) => [purl, dependencies]),
+    ]);
+    if ([...expectedDependencyGraph].some(([ref, targets]) => JSON.stringify(dependencyGraph.get(ref)) !== JSON.stringify(targets))) {
+        throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', 'sbom.dependencies', 'does not exactly match the independently derived dependency graph');
+    }
+    if (properties.get('ebk:inventory:component-graph:sha256') !==
+        expectedGraphDigest) {
+        throw new errors_js_1.SupplyChainError('supply-chain-artifact-mismatch', 'sbom.metadata.properties', 'component-graph identity does not match the independently derived inventory');
+    }
+    return value;
+}
+function bindingInput(value) {
+    return {
+        artifacts: value.artifacts,
+        createdAt: value.createdAt,
+        releaseId: value.releaseId,
+        releaseManifestDigest: value.releaseManifestDigest,
+    };
+}
+function createSupplyChainReleaseBinding(input) {
+    canonicalTimestamp(input.createdAt, 'createdAt');
+    if (!common_js_1.SUPPLY_CHAIN_REFERENCE.test(input.releaseId) ||
+        !common_js_1.SUPPLY_CHAIN_SHA256.test(input.releaseManifestDigest) ||
+        input.artifacts.length === 0 ||
+        (0, common_js_1.hasSensitiveSupplyChainShape)(input)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'releaseBinding', 'must bind at least one artifact to an exact release manifest');
+    }
+    const seen = new Set();
+    const artifacts = [...input.artifacts]
+        .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.bindingId, right.bindingId))
+        .map((artifact, index) => {
+        if (!common_js_1.SUPPLY_CHAIN_REFERENCE.test(artifact.bindingId) ||
+            !common_js_1.SUPPLY_CHAIN_SHA256.test(artifact.candidateDigest) ||
+            !common_js_1.SUPPLY_CHAIN_SHA256.test(artifact.contentDigest) ||
+            !common_js_1.SUPPLY_CHAIN_SHA256.test(artifact.sbomDigest) ||
+            !/^urn:uuid:[a-f0-9-]{36}$/.test(artifact.sbomSerialNumber) ||
+            seen.has(artifact.bindingId)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `releaseBinding.artifacts[${index}]`, 'must uniquely bind artifact and SBOM digests');
+        }
+        seen.add(artifact.bindingId);
+        return artifact;
+    });
+    const normalized = {
+        artifacts,
+        createdAt: input.createdAt,
+        releaseId: input.releaseId,
+        releaseManifestDigest: input.releaseManifestDigest,
+    };
+    return {
+        ...normalized,
+        kind: exports.SUPPLY_CHAIN_RELEASE_BINDING_KIND,
+        materialDigest: (0, common_js_1.supplyChainDigest)(normalized),
+        schemaVersion: exports.SUPPLY_CHAIN_SBOM_SCHEMA_VERSION,
+    };
+}
+function validateSupplyChainReleaseBinding(value, expected) {
+    if (!(0, validation_js_1.isRecord)(value) ||
+        value.kind !== exports.SUPPLY_CHAIN_RELEASE_BINDING_KIND ||
+        value.schemaVersion !== exports.SUPPLY_CHAIN_SBOM_SCHEMA_VERSION ||
+        !common_js_1.SUPPLY_CHAIN_SHA256.test(String(value.materialDigest)) ||
+        !Array.isArray(value.artifacts)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'releaseBinding', 'must be an EBK supply-chain release binding v1');
+    }
+    const recreated = createSupplyChainReleaseBinding(value);
+    if (recreated.materialDigest !== value.materialDigest) {
+        throw new errors_js_1.SupplyChainError('supply-chain-artifact-mismatch', 'releaseBinding.materialDigest', 'does not match the canonical binding bytes');
+    }
+    if (recreated.releaseId !== expected.releaseId ||
+        recreated.releaseManifestDigest !== expected.releaseManifestDigest) {
+        throw new errors_js_1.SupplyChainError('supply-chain-artifact-mismatch', 'releaseBinding', 'does not name the expected release candidate');
+    }
+    const expectedBindingIds = Object.keys(expected.contentDigests).sort();
+    const expectedCandidateBindingIds = Object.keys(expected.candidateDigests).sort();
+    const actualBindingIds = recreated.artifacts.map(({ bindingId }) => bindingId);
+    if (expectedBindingIds.length === 0 ||
+        expectedCandidateBindingIds.length !== expectedBindingIds.length ||
+        expectedCandidateBindingIds.some((bindingId, index) => bindingId !== expectedBindingIds[index]) ||
+        actualBindingIds.length !== expectedBindingIds.length ||
+        actualBindingIds.some((bindingId, index) => bindingId !== expectedBindingIds[index])) {
+        throw new errors_js_1.SupplyChainError('supply-chain-artifact-mismatch', 'releaseBinding.artifacts', 'must bind every independently expected SBOM binding ID exactly once');
+    }
+    for (const artifact of recreated.artifacts) {
+        const contentDigest = expected.contentDigests[artifact.bindingId];
+        const candidateDigest = expected.candidateDigests[artifact.bindingId];
+        if (contentDigest !== artifact.contentDigest ||
+            candidateDigest !== artifact.candidateDigest) {
+            throw new errors_js_1.SupplyChainError('supply-chain-artifact-mismatch', `releaseBinding.artifacts.${artifact.bindingId}`, 'does not match independently computed content and candidate digests');
+        }
+    }
+    return {
+        ...recreated,
+        materialDigest: (0, common_js_1.supplyChainDigest)(bindingInput(recreated)),
+    };
+}
+//# sourceMappingURL=sbom.js.map