Find the dependencies missing from a release SBOM

A release SBOM lists only direct dependencies. The shipped artifact also contains a bundled parser and a transitive helper. Repair the comparison so inventory omissions remain visible.

Requires Node.js 22 or newer. No package installation or server needed. To work in a container instead, open the folder with VS Code Dev Containers or GitHub Codespaces: .devcontainer/devcontainer.json uses the Dev Containers Node.js 24 image, pinned by digest.
1. Unzip all files into one folder.
2. In that folder, run: node --test exercise.test.mjs
3. Edit inventory.mjs, then run the same command again.

The starter deliberately fails some tests. A successful repair passes every case, including cases that catch common wrong fixes. The browser runs this same cases.mjs with the same fixtures; locally Node runs your code directly. If you completed the optional first stage in the browser, Download my work adds your input as stage1-input.json and the tests include it. Only run code you wrote or reviewed.

1. Read the two inventories
Run the starter. It misses bundled and transitive packages because it assumes the declared inventory is complete. Open the input for the bundled parser case.

2. Compare in the correct direction
Build a Set from documented. Filter shipped to identifiers the Set does not contain. Comparing documented against shipped finds extra entries, a different question.

3. Preserve identities
Do not compare just package names. A record for parser@1 cannot explain shipped parser@2. Deduplicate the missing identities and sort the output.

4. Verify a complete inventory
The complete and empty-artifact cases must return an empty array. Fix the generation process before merely adding manual rows to a real SBOM.

SUPPLIED CONTRACT
missingComponents(shipped, documented) receives two arrays of exact package URL strings produced for one build. Return sorted unique shipped identifiers absent from documented. Versions and qualifiers are part of identity. A documented development-only package cannot substitute for a shipped package.

REFERENCE
reference.mjs contains an explained solution: For shipped=[app@1,parser@2] and documented=[app@1], the missing set is [parser@2]. Documenting parser@1 does not cover parser@2. Repeated shipped observations produce one omission, and z-helper/a-helper results sort to a-helper then z-helper. A development-only documented package is an extra record, not a missing shipped component. An empty result means only that these two supplied sets have no omissions; it does not establish how completely shipped was discovered.

SCOPE
These are supplied inventory fixtures, not a package scanner. Full package URL normalization, license/vulnerability analysis and artifact discovery belong to dedicated tools. Real completeness claims need evidence of how the artifact inventory was produced.

NEXT TASK
Which build step can reveal vendored or bundled packages that never appear in your manifest?

SOURCE
https://cyclonedx.org/specification/overview/
