refactor(output): consolidate normalization and validation into BaseOutput._prepare()

Both JSON and XML serializers now share a single _prepare() hook that runs
dependency graph normalization (register_dependency) and ModelValidator before
serialization, eliminating duplicated logic.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Saquib Saifee <saquibsaifee2@gmail.com>

Author: saquibsaifee

cyclonedx/output/__init__.py

@@ -27,8 +27,10 @@
 from itertools import chain
 from random import random
 from typing import TYPE_CHECKING, Any, Literal, Optional, Union, overload
+from warnings import warn as _warn
 
 from ..schema import OutputFormat, SchemaVersion
+from ..validation.model import ModelValidationErrorSeverity, ModelValidator
 
 if TYPE_CHECKING:  # pragma: no cover
     from ..model.bom import Bom
@@ -68,6 +70,20 @@ def get_bom(self) -> 'Bom':
     def set_bom(self, bom: 'Bom') -> None:
         self._bom = bom
 
+    def _prepare(self) -> None:
+        """Normalize dependency graph and validate model integrity before serialization."""
+        bom = self._bom
+        if bom.metadata.component:
+            bom.register_dependency(target=bom.metadata.component)
+        for _c in bom.components:
+            bom.register_dependency(target=_c)
+        for _s in bom.services:
+            bom.register_dependency(target=_s)
+        for _err in ModelValidator().validate(bom):
+            if _err.severity is ModelValidationErrorSeverity.ERROR:
+                raise _err.data
+            _warn(str(_err.data), stacklevel=3)
+
     @abstractmethod
     def generate(self, force_regeneration: bool = False) -> None:
         ...  # pragma: no cover

cyclonedx/output/json.py

@@ -68,8 +68,8 @@ def generate(self, force_regeneration: bool = False) -> None:
             'specVersion': self.schema_version.to_version()
         }
         _view = SCHEMA_VERSIONS.get(self.schema_version_enum)
+        self._prepare()
         bom = self.get_bom()
-        bom.validate()
         with BomRefDiscriminator.from_bom(bom):
             bom_json: dict[str, Any] = json_loads(
                 bom.as_json(  # type:ignore[attr-defined]

cyclonedx/output/xml.py

@@ -57,8 +57,8 @@ def generate(self, force_regeneration: bool = False) -> None:
             return
 
         _view = SCHEMA_VERSIONS[self.schema_version_enum]
+        self._prepare()
         bom = self.get_bom()
-        bom.validate()
         xmlns = self.get_target_namespace()
         with BomRefDiscriminator.from_bom(bom):
             self._bom_xml = '<?xml version="1.0" ?>\n' + xml_dumps(  # type:ignore[call-overload]