Supply chain

Every TradeScript Pro Charts build writes a CycloneDX software bill of materials into the package. Supply it to your third-party risk, procurement, and vulnerability-management processes, and use it to prove that the files you received are the files the build produced.

Outcome

Your security review holds a machine-readable bill of materials for the exact build you deployed, and your pipeline can re-verify the delivered files at any time.

Before you start

• An installed customer SDK build
• A checksum tool such as shasum or sha256sum

Done when

Every shipped file matches the digest recorded in the bill of materials, and the recorded build fingerprint matches your deployment record.

Typical time

15 minutes

What the document contains

The bill of materials is written to dist/sbom.cyclonedx.json in CycloneDX 1.6 JSON format.

Section	Contents
metadata.component	The delivered package, its version, its licence, and the build mode
metadata.component.properties	The customer build fingerprint, present on customer builds
metadata.component.components	Every shipped file with its SHA-256 digest
components	The complete production dependency graph with package URLs and licences
dependencies	The resolved graph edges between the package and its dependencies

Development dependencies are excluded. Only packages that reach a browser are listed.

The serialNumber is derived from the document contents. Two builds of the same code with the same fingerprint produce the same serial number, and any change to the delivered files or the dependency graph produces a different one. The metadata.timestamp field records when the document was written and is the only field that changes between rebuilds of identical content.

1. Locate the document

Read it from the installed package:

cat node_modules/@tradescript/pro/dist/sbom.cyclonedx.json

Archive this file alongside your deployment record. It describes one build, so retain one copy per release you run in production.

2. Confirm it describes your build

Compare the recorded package version and build fingerprint against the values in your deployment record:

jq '{
  package: .metadata.component.name,
  version: .metadata.component.version,
  properties: .metadata.component.properties
}' node_modules/@tradescript/pro/dist/sbom.cyclonedx.json

A customer build reports tradescript:buildMode as customer and carries a tradescript:customerBuildFingerprint property. That fingerprint must match the one recorded for your deployment. A build reporting base is not licensed for a customer origin — request the correct artifact before continuing.

3. Verify the delivered files

Run the recorded digests against the files on disk from the package root:

cd node_modules/@tradescript/pro && jq -r '.metadata.component.components[] | "\(.hashes[0].content)  \(.name)"' dist/sbom.cyclonedx.json | shasum -a 256 -c

Every line must report OK. A mismatch means the delivered files differ from the files the build produced. Stop the deployment and contact your TradeScript deployment contact.

4. Load it into your scanner

CycloneDX 1.6 is accepted directly by common vulnerability and licence scanners, including Dependency-Track, Grype, Trivy, and Snyk. Ingest the file as part of release intake so the dependency graph is monitored for new advisories after deployment.

Production dependency profile

The browser runtime carries one production dependency:

Package	Version	Licence	Purpose
csstype	3.1.1	MIT	TypeScript definitions for CSS property names and values

The chart engine, indicators, drawing tools, workers, and trading surfaces are first-party code. Installing @tradescript/pro does not install React or ReactDOM.

React applications use the included @tradescript/pro/react subpaths. React and ReactDOM are optional peer dependencies and come from the host application.

Next steps

Complete Production deployment to configure asset delivery, data-provider access, Content Security Policy, and the deployment lease for the build described by this document.