@cdxgen/cdxgen 13.1.0 → 13.3.0

package/lib/cli/nativeBom.js

@@ -12,11 +12,13 @@ import { recordDegradation } from "../core/buildLedger.js";
 import { deferFailOnError } from "../core/deferredExit.js";
 import {
   CARGO_CMD,
+  CARGO_TARGET,
   CLJ_CMD,
   hasAnyProjectType,
   LEIN_CMD,
   SWIFT_CMD,
   shouldFetchLicense,
+  shouldFetchPackageMetadata,
 } from "../core/env.js";
 import {
   checksumFile,
@@ -29,15 +31,26 @@ import { dirNameStr, isMac } from "../core/paths.js";
 import {
   buildDependentPurl,
   collapseCmakeVersions,
+  preferFetchedCmakeDependencies,
   resolveCmakeContext,
+  withoutScrapedFetchDependency,
 } from "../ecosystems/cmakeResolver.js";
 import { getCppModules } from "../ecosystems/cppEvidence.js";
 import {
   getCratesMetadata,
   getSwiftPackageMetadata,
 } from "../ecosystems/ecosystems.js";
+import { parseShardsProject } from "../ecosystems/parsers-crystal.js";
+import {
+  createElmCacheReader,
+  getElmMetadata,
+  isElmProjectFile,
+  parseElmProject,
+  parseLegacyElmProject,
+} from "../ecosystems/parsers-elm.js";
 import { parseGleamProject } from "../ecosystems/parsers-gleam.js";
 import {
+  isGoModWhyNotNeeded,
   parseGoListDep,
   parseGoModData,
   parseGoModGraph,
@@ -46,14 +59,20 @@ import {
   parseGopkgData,
   parseGosumData,
 } from "../ecosystems/parsers-go.js";
+import { parseJuliaProject } from "../ecosystems/parsers-julia.js";
 import {
   parseCljDep,
   parseEdnData,
   parseLeinDep,
   parseLeiningenData,
 } from "../ecosystems/parsers-jvm.js";
+import {
+  parseLuaRocksLock,
+  parseRockspecFile,
+} from "../ecosystems/parsers-lua.js";
 import {
   buildObjectForCocoaPod,
+  classifySwiftDependencyScopes,
   executeAlpmList,
   executeApkList,
   executeDpkgList,
@@ -78,12 +97,24 @@ import {
   parseSwiftResolved,
   prefetchCocoaPodspecs,
 } from "../ecosystems/parsers-misc.js";
+import { parseNimProject } from "../ecosystems/parsers-nim.js";
+import { parseOpamLockedFile } from "../ecosystems/parsers-opam.js";
+import { parseRebarLock } from "../ecosystems/parsers-rebar.js";
 import {
+  applyCargoDependencyKindMetadata,
+  buildCargoLockDependencyGraph,
+  buildCargoNativeLibraryComponents,
+  cargoComponentKey,
   parseCargoData,
   parseCargoDependencyData,
   parseCargoManifestDependencyData,
+  parseCargoManifestDependencyKinds,
+  parseCargoMetadataResolve,
   parseCargoTomlData,
+  rollupCargoDependencyKinds,
 } from "../ecosystems/parsers-rust.js";
+import { parseSpackLock } from "../ecosystems/parsers-spack.js";
+import { parseStackProject } from "../ecosystems/parsers-stack.js";
 import { resolveZigGraph } from "../ecosystems/zigResolver.js";
 import { mergeDependencies, trimComponents } from "../inventory/depsUtils.js";
 import { convertOSQueryResults } from "../inventory/evidenceUtils.js";
@@ -169,7 +200,6 @@ export function getCargoCacheDir() {
 export async function createGoBom(path, options) {
   let pkgList = [];
   let dependencies = [];
-  const allImports = {};
   let parentComponent = createDefaultParentComponent(path, "golang", options);
   // Is this a binary file
   let maybeBinary;
@@ -209,6 +239,8 @@ export async function createGoBom(path, options) {
       }
     }
     const doneList = {};
+    const requiredModules = new Set();
+    const unneededModules = new Set();
     let circuitBreak = false;
     if (DEBUG_MODE) {
       console.log(
@@ -222,12 +254,12 @@ export async function createGoBom(path, options) {
       }
       const pkgFullName = `${apkg.name}`;
       if (apkg.scope === "required") {
-        allImports[pkgFullName] = true;
+        requiredModules.add(pkgFullName);
         continue;
       }
       if (
         apkg.scope === "optional" ||
-        allImports[pkgFullName] ||
+        requiredModules.has(pkgFullName) ||
         doneList[pkgFullName]
       ) {
         continue;
@@ -256,19 +288,40 @@ export async function createGoBom(path, options) {
         const mstdout = mresult.stdout;
         if (mstdout) {
           const cmdOutput = Buffer.from(mstdout).toString();
-          const whyPkg = parseGoModWhy(cmdOutput);
-          // whyPkg would include this package string
-          // github.com/golang/protobuf/proto github.com/golang/protobuf
-          // golang.org/x/tools/cmd/goimports golang.org/x/tools
-          if (whyPkg?.includes(pkgFullName)) {
-            allImports[pkgFullName] = true;
+          if (isGoModWhyNotNeeded(cmdOutput)) {
+            unneededModules.add(pkgFullName);
+          } else {
+            // The last line of the import chain is a package of the module:
+            // github.com/golang/protobuf/proto for github.com/golang/protobuf
+            const whyPkg = parseGoModWhy(cmdOutput);
+            if (
+              whyPkg === pkgFullName ||
+              whyPkg?.startsWith(`${pkgFullName}/`)
+            ) {
+              requiredModules.add(pkgFullName);
+            }
           }
           doneList[pkgFullName] = true;
         }
       }
     }
+    // A module go reports as unneeded is optional, but only when every module
+    // was checked: once go mod why fails, the answers are incomplete, and a
+    // tool failure is not evidence that a module is unused.
+    for (const apkg of pkgList) {
+      if (apkg.scope) {
+        continue;
+      }
+      if (requiredModules.has(apkg.name)) {
+        apkg.scope = "required";
+      } else if (!circuitBreak && unneededModules.has(apkg.name)) {
+        apkg.scope = "optional";
+      }
+    }
     if (DEBUG_MODE) {
-      console.log(`Required packages: ${Object.keys(allImports).length}`);
+      console.log(
+        `Required packages: ${requiredModules.size}, not needed: ${circuitBreak ? "unknown" : unneededModules.size}`,
+      );
     }
     return buildBomNSData(options, pkgList, "golang", {
       src: path,
@@ -533,7 +586,6 @@ export async function createGoBom(path, options) {
       }
       if (pkgList.length && !shouldManuallyParse) {
         return buildBomNSData(options, pkgList, "golang", {
-          allImports,
           dependencies,
           parentComponent,
           src: path,
@@ -664,6 +716,223 @@ function cargoAnswersVersion(cwd) {
  * @param {Object} options Parse options from the cli
  * @returns {Promise<Object|undefined>} Promise resolving to a BOM object or undefined
  */
+/**
+ * Run `cargo metadata` for a manifest and return its parsed resolve graph.
+ *
+ * The lock file is the union of every dependency kind and every target triple,
+ * so it cannot answer which crates are dev-only or platform-gated. Only
+ * `cargo metadata` carries that, per dependency edge, in `resolve.nodes[].deps[].dep_kinds`.
+ *
+ * @param {string} cargoTomlFile Manifest path
+ * @param {string} [filterPlatform] Target triple to resolve the graph for
+ * @returns {object|undefined} Parsed `cargo metadata` output
+ */
+function runCargoMetadata(cargoTomlFile, filterPlatform) {
+  const basePath = dirname(cargoTomlFile);
+  const platformArgs = filterPlatform
+    ? ["--filter-platform", filterPlatform]
+    : [];
+  // `--locked` keeps the user's lock file untouched; a workspace that is out of
+  // date with its lock file needs the retry without it.
+  for (const lockArgs of [["--locked"], []]) {
+    const cargoArgs = [
+      "metadata",
+      "--format-version",
+      "1",
+      "--manifest-path",
+      cargoTomlFile,
+      ...platformArgs,
+      ...lockArgs,
+    ];
+    if (DEBUG_MODE) {
+      console.log("Executing", CARGO_CMD, cargoArgs.join(" "), "in", basePath);
+    }
+    const result = safeSpawnSync(CARGO_CMD, cargoArgs, {
+      cwd: basePath,
+      shell: isWin,
+    });
+    if (result.status === 0 && !result.error && result.stdout) {
+      try {
+        return JSON.parse(result.stdout);
+      } catch (err) {
+        if (DEBUG_MODE) {
+          console.log(`Unable to parse the cargo metadata output: ${err}`);
+        }
+        return undefined;
+      }
+    }
+    if (DEBUG_MODE) {
+      console.log(result.error, result.stderr);
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Annotate cargo components with their dependency kind, platform gate and
+ * scope.
+ *
+ * With `--deep`, the edge kinds come from `cargo metadata` and are exact at
+ * every depth. Otherwise they are recovered from the manifests, which is exact
+ * for the dependencies a workspace member declares and inherited below them.
+ *
+ * @param {object[]} pkgList Components to annotate
+ * @param {object[]} dependencyTree Lockfile dependency relationships
+ * @param {string[]} cargoFiles Manifest paths
+ * @param {Map<string, string>} manifestRootKeys Manifest path to root component key
+ * @param {object} options CLI options
+ */
+function annotateCargoDependencyKinds(
+  pkgList,
+  dependencyTree,
+  cargoFiles,
+  manifestRootKeys,
+  options,
+) {
+  if (!pkgList?.length) {
+    return;
+  }
+  const allEdges = new Map();
+  if (options?.deep) {
+    const rollups = new Map();
+    const packageInfo = new Map();
+    const visitedWorkspaceRoots = new Set();
+    // The keys that survive resolution for the requested target triple. The
+    // unfiltered graph still supplies the kinds, because a crate's kind does
+    // not change with the triple.
+    const targetIncludedKeys = CARGO_TARGET ? new Set() : undefined;
+    let targetFilterApplied = !CARGO_TARGET;
+    let anyMetadata = false;
+    let everyMetadata = true;
+    for (const cargoTomlFile of cargoFiles) {
+      const metadata = runCargoMetadata(cargoTomlFile);
+      if (!metadata) {
+        everyMetadata = false;
+        continue;
+      }
+      // Every member of a workspace answers with the same resolve graph.
+      const workspaceRoot = metadata.workspace_root || cargoTomlFile;
+      if (visitedWorkspaceRoots.has(workspaceRoot)) {
+        anyMetadata = true;
+        continue;
+      }
+      visitedWorkspaceRoots.add(workspaceRoot);
+      anyMetadata = true;
+      if (CARGO_TARGET) {
+        const targetMetadata = runCargoMetadata(cargoTomlFile, CARGO_TARGET);
+        if (targetMetadata) {
+          for (const key of parseCargoMetadataResolve(targetMetadata)
+            .resolvedKeys) {
+            targetIncludedKeys.add(key);
+          }
+          targetFilterApplied = true;
+        } else {
+          console.warn(
+            `cargo metadata could not resolve the dependency graph for the target ${CARGO_TARGET}. The components are not filtered by target.`,
+          );
+        }
+      }
+      const graph = parseCargoMetadataResolve(metadata);
+      for (const [key, value] of graph.packageInfo) {
+        packageInfo.set(key, value);
+      }
+      for (const [key, value] of graph.edges) {
+        allEdges.set(key, [...(allEdges.get(key) || []), ...value]);
+      }
+      for (const [key, value] of rollupCargoDependencyKinds(graph)) {
+        const existing = rollups.get(key);
+        if (!existing) {
+          rollups.set(key, value);
+          continue;
+        }
+        // A crate that is a runtime dependency of any workspace in the scan is
+        // a runtime dependency of the BOM.
+        for (const kind of value.kinds) {
+          existing.kinds.add(kind);
+        }
+        for (const target of value.targets) {
+          existing.targets.add(target);
+        }
+        const precedence = ["root", "runtime", "build", "dev"];
+        if (
+          precedence.indexOf(value.kind) < precedence.indexOf(existing.kind)
+        ) {
+          existing.kind = value.kind;
+          existing.targetGated = value.targetGated;
+        } else if (value.kind === existing.kind && !value.targetGated) {
+          existing.targetGated = false;
+        }
+      }
+    }
+    if (anyMetadata && rollups.size) {
+      applyCargoDependencyKindMetadata(pkgList, rollups, packageInfo, {
+        resolveIsComplete: everyMetadata,
+        filterPlatform: targetFilterApplied ? CARGO_TARGET : undefined,
+        targetIncludedKeys: targetFilterApplied
+          ? targetIncludedKeys
+          : undefined,
+      });
+      // A `-sys` crate puts a C library into the artifact that the cargo
+      // dependency graph itself cannot describe.
+      const nativeLibraries = buildCargoNativeLibraryComponents(
+        packageInfo,
+        allEdges,
+        rollups,
+      );
+      if (nativeLibraries.components.length) {
+        pkgList.push(...nativeLibraries.components);
+        if (dependencyTree) {
+          dependencyTree.push(...nativeLibraries.dependencies);
+        }
+      }
+      return;
+    }
+    recordDegradation("rust.cargo-metadata-unavailable", {
+      ecosystem: "rust",
+      tool: "cargo",
+      impact: "components",
+      command: `${basename(CARGO_CMD)} metadata`,
+      detail:
+        "cargo metadata could not be executed, so dependency kinds and platform gates were recovered from the manifests alone.",
+    });
+  }
+  if (!dependencyTree?.length || !manifestRootKeys.size) {
+    return;
+  }
+  const declaredEdgesByRoot = new Map();
+  for (const [cargoTomlFile, rootKey] of manifestRootKeys) {
+    if (!rootKey) {
+      continue;
+    }
+    const declaredEdges = parseCargoManifestDependencyKinds(cargoTomlFile, {
+      includeWorkspaceMembers: !options.multiProject,
+    });
+    const existing = declaredEdgesByRoot.get(rootKey);
+    if (!existing) {
+      declaredEdgesByRoot.set(rootKey, declaredEdges);
+      continue;
+    }
+    for (const [name, value] of declaredEdges) {
+      const knownEdge = existing.get(name);
+      if (!knownEdge) {
+        existing.set(name, value);
+        continue;
+      }
+      for (const kind of value.kinds) {
+        knownEdge.kinds.add(kind);
+      }
+      for (const target of value.targets) {
+        knownEdge.targets.add(target);
+      }
+    }
+  }
+  const graph = buildCargoLockDependencyGraph(
+    dependencyTree,
+    declaredEdgesByRoot,
+  );
+  applyCargoDependencyKindMetadata(pkgList, rollupCargoDependencyKinds(graph));
+}
+
 export async function createRustBom(path, options) {
   let pkgList = [];
   let parentComponent = {};
@@ -769,6 +1038,7 @@ export async function createRustBom(path, options) {
         "No Cargo.lock was found beside the manifest, so components carry the declared dependencies without locked versions or the resolved crate graph.",
     });
   }
+  const manifestRootKeys = new Map();
   for (const f of cargoFiles) {
     if (DEBUG_MODE) {
       console.log(`Parsing ${f}`);
@@ -777,6 +1047,7 @@ export async function createRustBom(path, options) {
       includeWorkspaceMembers: !options.multiProject,
     });
     if (dlist?.length) {
+      manifestRootKeys.set(f, cargoComponentKey(dlist[0]));
       if (!cargoLockMode) {
         pkgList = pkgList.concat(dlist);
       } else {
@@ -832,6 +1103,15 @@ export async function createRustBom(path, options) {
       );
     }
   }
+  if (cargoLockMode) {
+    annotateCargoDependencyKinds(
+      pkgList,
+      dependencyTree,
+      cargoFiles,
+      manifestRootKeys,
+      options,
+    );
+  }
   return buildBomNSData(options, pkgList, "cargo", {
     src: path,
     filename: cargoLockFiles.join(", "),
@@ -1160,22 +1440,31 @@ export function createCppBom(path, options) {
   }
   if (cmakeLikeFiles.length) {
     const beforeCmake = pkgList.length;
+    // The files at the scan root name the project, so they are read before
+    // the files of any sub-project (the sort is stable otherwise). The scan
+    // root may be given as a relative path while the files come back absolute.
+    const scanRoot = resolve(path);
+    const atScanRoot = (f) => resolve(dirname(f)) === scanRoot;
+    cmakeLikeFiles.sort(
+      (a, b) => (atScanRoot(a) ? 0 : 1) - (atScanRoot(b) ? 0 : 1),
+    );
     for (const f of cmakeLikeFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
-      const basePath = dirname(f);
       const retMap = parseCmakeLikeFile(f, "generic");
       if (retMap.pkgList?.length) {
         pkgList = pkgList.concat(retMap.pkgList);
       }
       if (
-        basePath === path &&
+        atScanRoot(f) &&
         retMap.parentComponent &&
         Object.keys(retMap.parentComponent).length
       ) {
         if (!parentComponent) {
           parentComponent = retMap.parentComponent;
+          // a sub-project reusing the root project's name is the root itself
+          addedParentComponentsMap[retMap.parentComponent.name] = true;
         } else {
           parentComponent.components = parentComponent.components || [];
           if (!addedParentComponentsMap[retMap.parentComponent.name]) {
@@ -1190,6 +1479,7 @@ export function createCppBom(path, options) {
       ) {
         retMap.parentComponent.type = "library";
         pkgList.push(retMap.parentComponent);
+        addedParentComponentsMap[retMap.parentComponent.name] = true;
       }
       // Retain the dependency tree from cmake
       if (retMap.dependenciesList) {
@@ -1209,7 +1499,11 @@ export function createCppBom(path, options) {
     // resolved versions and are left as they are.
     pkgList = pkgList
       .slice(0, beforeCmake)
-      .concat(collapseCmakeVersions(pkgList.slice(beforeCmake)));
+      .concat(
+        collapseCmakeVersions(
+          preferFetchedCmakeDependencies(pkgList.slice(beforeCmake)),
+        ),
+      );
   }
   // CMake describes how a project is built from source. An image or an OS
   // installation carries build output, not a build tree, so resolving CMake
@@ -1299,6 +1593,7 @@ export function createCppBom(path, options) {
         { name: "cdx:cmake:resolvedVia", value: "gitclone-script" },
       ],
     };
+    pkgList = withoutScrapedFetchDependency(pkgList, dep.name);
     if (dep.sourceDir) {
       depComponent.properties.push({
         name: "cdx:cmake:sourceDir",
@@ -1596,6 +1891,44 @@ export function createClojureBom(path, options) {
   return {};
 }
 
+/**
+ * Locate the Stack lock files under a path.
+ *
+ * Stack names the lock after the configuration file it completes, so the
+ * default `stack.yaml` produces `stack.yaml.lock` and a project with several
+ * configurations produces one lock per configuration. `stack.lock` is also
+ * accepted because tooling and documentation examples have used that name.
+ *
+ * @param {string} path Project path
+ * @param {Object} options Parse options from the cli
+ * @returns {string[]} Lock file paths, deduplicated
+ */
+export function findStackLockFiles(path, options) {
+  const prefix = options.multiProject ? "**/" : "";
+  const candidates = new Set([
+    ...getAllFiles(path, `${prefix}*.yaml.lock`, options),
+    ...getAllFiles(path, `${prefix}stack.lock`, options),
+  ]);
+  return [...candidates].filter((lockFile) => {
+    if (/(^|[\\/])stack\.(yaml\.)?lock$/u.test(lockFile)) {
+      return true;
+    }
+    // `*.yaml.lock` is not a name Stack owns, so a custom configuration is
+    // accepted only when the file it completes names a snapshot.
+    const configFile = lockFile.replace(/\.lock$/u, "");
+    if (!safeExistsSync(configFile)) {
+      return false;
+    }
+    try {
+      return /^\s*(snapshot|resolver)\s*:/mu.test(
+        readFileSync(configFile, "utf-8"),
+      );
+    } catch {
+      return false;
+    }
+  });
+}
+
 /**
  * Function to create bom string for Haskell projects
  *
@@ -1626,12 +1959,44 @@ export function createHaskellBom(path, options) {
       filename: cabalFiles.join(", "),
     });
   }
+  // Stack projects keep the resolved extra-deps in a lock file named after
+  // the configuration file, so `stack.yaml` locks to `stack.yaml.lock`.
+  const stackLockFiles = findStackLockFiles(path, options);
+  if (stackLockFiles.length) {
+    const dependencies = [];
+    let parentComponent = {};
+    for (const stackLockFile of stackLockFiles) {
+      if (DEBUG_MODE) {
+        console.log(`Parsing ${stackLockFile}`);
+      }
+      const stackYamlFile = stackLockFile.replace(/\.lock$/u, "");
+      const result = parseStackProject(
+        stackLockFile,
+        safeExistsSync(stackYamlFile) ? stackYamlFile : undefined,
+      );
+      if (result.pkgList?.length) {
+        pkgList = pkgList.concat(result.pkgList);
+      }
+      if (!Object.keys(parentComponent).length) {
+        parentComponent = result.parentComponent;
+        attachRootEdge(result, parentComponent, dependencies);
+      }
+    }
+    if (pkgList.length) {
+      return buildBomNSData(options, pkgList, "hackage", {
+        src: path,
+        filename: stackLockFiles.join(", "),
+        dependencies,
+        parentComponent,
+      });
+    }
+  }
   recordDegradation("haskell.freeze-missing", {
     ecosystem: "haskell",
     tool: "cabal",
     impact: "components",
     detail:
-      "No cabal.project.freeze was found, and the freeze file is the source the parser reads for the package set.",
+      "No cabal.project.freeze or stack.yaml.lock was found; those lock files are the sources the parsers read for the package set.",
   });
   return {};
 }
@@ -1699,6 +2064,50 @@ export async function createSwiftBom(path, options) {
   let parentComponent = {};
   const completedPath = [];
   let packageArgsMessageShown = false;
+  // Packages that only the root package's tests use are scoped optional so
+  // that `--required-only` can narrow the BOM. A package some project (or
+  // some production path) needs stays required.
+  const swiftScopes = {
+    optionalRefs: new Set(),
+    requiredRefs: new Set(),
+    optionalNames: new Set(),
+    requiredNames: new Set(),
+  };
+  const classifiedPaths = new Set();
+  const classifyScopes = (basePath, swiftCommand, treeData) => {
+    if (classifiedPaths.has(basePath)) {
+      return;
+    }
+    classifiedPaths.add(basePath);
+    const dumpArgs =
+      swiftCommand === "xcrun"
+        ? ["swift", "package", "dump-package"]
+        : ["package", "dump-package"];
+    const dumpResult = safeSpawnSync(swiftCommand, dumpArgs, {
+      cwd: basePath,
+    });
+    if (!dumpResult?.stdout) {
+      return;
+    }
+    let dumpJson;
+    let treeJson;
+    try {
+      dumpJson = JSON.parse(Buffer.from(dumpResult.stdout).toString());
+    } catch (_e) {
+      return;
+    }
+    try {
+      treeJson = treeData ? JSON.parse(treeData) : undefined;
+    } catch (_e) {
+      treeJson = undefined;
+    }
+    const scopes = classifySwiftDependencyScopes(dumpJson, treeJson);
+    for (const key of Object.keys(swiftScopes)) {
+      for (const value of scopes[key]) {
+        swiftScopes[key].add(value);
+      }
+    }
+  };
   if (pkgResolvedFiles.length) {
     for (const f of pkgResolvedFiles) {
       if (!parentComponent || !Object.keys(parentComponent).length) {
@@ -1822,6 +2231,33 @@ export async function createSwiftBom(path, options) {
           detail: "the swift package command failed",
         });
       }
+      // Scope classification also works without the dependency graph
+      classifyScopes(basePath, swiftCommand, treeData);
+    }
+  }
+  // Scope packages that only tests use as optional. A package some project or
+  // production path needs keeps its default (required) scope; evidence-based
+  // filtering after generation can still promote an optional package when
+  // the sources are found to use it.
+  for (const apkg of pkgList) {
+    if (apkg?.scope || !apkg?.name) {
+      continue;
+    }
+    const refs = [apkg["bom-ref"], apkg.purl].filter(Boolean);
+    const names = [String(apkg.name).toLowerCase()];
+    for (const aproperty of apkg.properties || []) {
+      if (aproperty?.name === "cdx:swift:packageName" && aproperty.value) {
+        names.push(String(aproperty.value).toLowerCase());
+      }
+    }
+    const isOptional =
+      refs.some((r) => swiftScopes.optionalRefs.has(r)) ||
+      names.some((n) => swiftScopes.optionalNames.has(n));
+    const isRequired =
+      refs.some((r) => swiftScopes.requiredRefs.has(r)) ||
+      names.some((n) => swiftScopes.requiredNames.has(n));
+    if (isOptional && !isRequired) {
+      apkg.scope = "optional";
     }
   }
   if (shouldFetchLicense()) {
@@ -2302,3 +2738,475 @@ export async function createGleamBom(path, options) {
 
   return {};
 }
+
+/**
+ * Function to create bom string for Julia projects.
+ *
+ * The resolved `Manifest.toml` is preferred over the declared `Project.toml`
+ * so the BOM carries pinned versions and the package graph.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export async function createJuliaBom(path, options) {
+  let pkgList = [];
+  let dependencies = [];
+  let parentComponent = {};
+
+  const projectTomlFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}Project.toml`,
+    options,
+  );
+  const manifestOnly = !projectTomlFiles.length;
+
+  for (const projectTomlFile of projectTomlFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${projectTomlFile}`);
+    }
+    const baseDir = dirname(projectTomlFile);
+    const manifestTomlFile = join(baseDir, "Manifest.toml");
+    const result = parseJuliaProject(
+      projectTomlFile,
+      safeExistsSync(manifestTomlFile) ? manifestTomlFile : undefined,
+    );
+    collectProjectResult(result);
+  }
+  if (manifestOnly) {
+    for (const manifestTomlFile of getAllFiles(
+      path,
+      `${options.multiProject ? "**/" : ""}Manifest.toml`,
+      options,
+    )) {
+      if (DEBUG_MODE) {
+        console.log(`Parsing ${manifestTomlFile}`);
+      }
+      // Gleam also writes a `manifest.toml`; on case-insensitive filesystems
+      // the lookup above can surface it, so only accept files that parse as
+      // a Julia manifest.
+      const parsed = parseJuliaProject(undefined, manifestTomlFile);
+      if (parsed.pkgList.length) {
+        collectProjectResult(parsed);
+      }
+    }
+  }
+
+  function collectProjectResult(result) {
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+    if (result.dependencies?.length) {
+      dependencies = dependencies.concat(result.dependencies);
+    }
+    if (
+      !Object.keys(parentComponent).length &&
+      Object.keys(result.parentComponent).length
+    ) {
+      parentComponent = result.parentComponent;
+      attachRootEdge(result, parentComponent, dependencies);
+    }
+  }
+
+  if (pkgList.length || Object.keys(parentComponent).length) {
+    return buildBomNSData(options, pkgList, "julia", {
+      src: path,
+      filename: projectTomlFiles.join(", "),
+      dependencies,
+      parentComponent,
+    });
+  }
+  return {};
+}
+
+/**
+ * Attach a root dependency edge from the parent component to its direct
+ * dependencies, following the shape used by the Gleam and Nix flows.
+ *
+ * @param {{rootInputs?: string[]}} result Parser result with root inputs
+ * @param {Object} parentComponent Parent component to give a bom-ref
+ * @param {Object[]} dependencies Dependency edge list to append to
+ */
+function attachRootEdge(result, parentComponent, dependencies) {
+  if (result.rootInputs?.length && parentComponent.name) {
+    const rootRef = `application:${parentComponent.name}:${parentComponent.version || "latest"}`;
+    parentComponent["bom-ref"] = rootRef;
+    dependencies.push({
+      ref: rootRef,
+      dependsOn: [...new Set(result.rootInputs)],
+    });
+  }
+}
+
+/**
+ * Function to create bom string for Erlang projects using rebar3.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export async function createErlangBom(path, options) {
+  let pkgList = [];
+  const rebarLockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}rebar.lock`,
+    options,
+  );
+  for (const rebarLockFile of rebarLockFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${rebarLockFile}`);
+    }
+    const result = parseRebarLock(rebarLockFile);
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+  }
+  if (pkgList.length) {
+    return buildBomNSData(options, pkgList, "erlang", {
+      src: path,
+      filename: rebarLockFiles.join(", "),
+    });
+  }
+  return {};
+}
+
+/**
+ * Function to create bom string for OCaml projects using opam.
+ *
+ * Resolved `.opam.locked` files are preferred; a plain `.opam` file is used
+ * as a declared fallback with unpinned versions.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export async function createOCamlBom(path, options) {
+  let pkgList = [];
+  const opamLockedFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}*.opam.locked`,
+    options,
+  );
+  const opamFiles = opamLockedFiles.length
+    ? []
+    : getAllFiles(path, `${options.multiProject ? "**/" : ""}*.opam`, options);
+  for (const opamFile of [...opamLockedFiles, ...opamFiles]) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${opamFile}`);
+    }
+    const result = parseOpamLockedFile(opamFile);
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+  }
+  if (pkgList.length) {
+    return buildBomNSData(options, pkgList, "ocaml", {
+      src: path,
+      filename: [...opamLockedFiles, ...opamFiles].join(", "),
+    });
+  }
+  return {};
+}
+
+/**
+ * Function to create bom string for Elm projects.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export async function createElmBom(path, options) {
+  let pkgList = [];
+  let dependencies = [];
+  let parentComponent = {};
+
+  const elmJsonFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}elm.json`,
+    options,
+  ).filter(isElmProjectFile);
+  // A single reader memoises the cache lookups shared by every manifest.
+  const cacheReader = createElmCacheReader();
+  for (const elmJsonFile of elmJsonFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${elmJsonFile}`);
+    }
+    const result = parseElmProject(elmJsonFile, cacheReader);
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+    if (result.dependencies?.length) {
+      dependencies = dependencies.concat(result.dependencies);
+    }
+    if (!Object.keys(parentComponent).length) {
+      parentComponent = result.parentComponent;
+      attachRootEdge(result, parentComponent, dependencies);
+    }
+  }
+  const legacyFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}elm-package.json`,
+    options,
+  );
+  for (const legacyFile of legacyFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${legacyFile}`);
+    }
+    const baseDir = dirname(legacyFile);
+    const exactDepsFile = join(baseDir, "elm-stuff", "exact-dependencies.json");
+    const result = parseLegacyElmProject(
+      legacyFile,
+      safeExistsSync(exactDepsFile) ? exactDepsFile : undefined,
+    );
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+    if (result.dependencies?.length) {
+      dependencies = dependencies.concat(result.dependencies);
+    }
+    if (!Object.keys(parentComponent).length) {
+      parentComponent = result.parentComponent;
+      attachRootEdge(result, parentComponent, dependencies);
+    }
+  }
+  if (pkgList.length && shouldFetchPackageMetadata()) {
+    pkgList = await getElmMetadata(pkgList, dependencies);
+  }
+  if (pkgList.length || Object.keys(parentComponent).length) {
+    return buildBomNSData(options, pkgList, "elm", {
+      src: path,
+      filename: [...elmJsonFiles, ...legacyFiles].join(", "),
+      dependencies,
+      parentComponent,
+    });
+  }
+  return {};
+}
+
+/**
+ * Function to create bom string for Crystal projects using shards.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export async function createCrystalBom(path, options) {
+  let pkgList = [];
+  const dependencies = [];
+  let parentComponent = {};
+
+  const shardYmlFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}shard.yml`,
+    options,
+  );
+  for (const shardYmlFile of shardYmlFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${shardYmlFile}`);
+    }
+    const baseDir = dirname(shardYmlFile);
+    const shardLockFile = join(baseDir, "shard.lock");
+    const result = parseShardsProject(
+      shardYmlFile,
+      safeExistsSync(shardLockFile) ? shardLockFile : undefined,
+    );
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+    if (!Object.keys(parentComponent).length) {
+      parentComponent = result.parentComponent;
+      attachRootEdge(result, parentComponent, dependencies);
+    }
+  }
+  if (pkgList.length || Object.keys(parentComponent).length) {
+    return buildBomNSData(options, pkgList, "crystal", {
+      src: path,
+      filename: shardYmlFiles.join(", "),
+      dependencies,
+      parentComponent,
+    });
+  }
+  return {};
+}
+
+/**
+ * Function to create bom string for Nim projects using nimble.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export async function createNimBom(path, options) {
+  let pkgList = [];
+  let dependencies = [];
+  let parentComponent = {};
+
+  const nimbleFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}*.nimble`,
+    options,
+  );
+  for (const nimbleFile of nimbleFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${nimbleFile}`);
+    }
+    const baseDir = dirname(nimbleFile);
+    const nimbleLockFile = join(baseDir, "nimble.lock");
+    const result = parseNimProject(
+      nimbleFile,
+      safeExistsSync(nimbleLockFile) ? nimbleLockFile : undefined,
+    );
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+    if (result.dependencies?.length) {
+      dependencies = dependencies.concat(result.dependencies);
+    }
+    if (!Object.keys(parentComponent).length) {
+      parentComponent = result.parentComponent;
+      attachRootEdge(result, parentComponent, dependencies);
+    }
+  }
+  if (pkgList.length || Object.keys(parentComponent).length) {
+    return buildBomNSData(options, pkgList, "nim", {
+      src: path,
+      filename: nimbleFiles.join(", "),
+      dependencies,
+      parentComponent,
+    });
+  }
+  return {};
+}
+
+/**
+ * Function to create bom string for Lua projects using LuaRocks.
+ *
+ * When a `luarocks.lock` is present next to a rockspec it supplies the
+ * resolved versions; otherwise the rockspec's declared dependencies are
+ * inventoried without versions.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export async function createLuaBom(path, options) {
+  let pkgList = [];
+  let parentComponent = {};
+  const seenLockFiles = new Set();
+  const rockspecFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}*.rockspec`,
+    options,
+  );
+  for (const rockspecFile of rockspecFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${rockspecFile}`);
+    }
+    const baseDir = dirname(rockspecFile);
+    const lockFile = join(baseDir, "luarocks.lock");
+    // The rockspec names the project and its declared set either way; the
+    // lock, when present, supplies the resolved versions.
+    const declared = parseRockspecFile(rockspecFile);
+    if (!Object.keys(parentComponent).length) {
+      parentComponent = declared.parentComponent;
+    }
+    let resolved;
+    if (safeExistsSync(lockFile)) {
+      seenLockFiles.add(lockFile);
+      resolved = parseLuaRocksLock(lockFile, rockspecFile);
+    }
+    const chosen = resolved?.pkgList?.length ? resolved : declared;
+    if (chosen.pkgList?.length) {
+      pkgList = pkgList.concat(chosen.pkgList);
+    }
+  }
+  // A lock can also stand alone, in a project whose rockspec is generated at
+  // release time rather than committed.
+  for (const lockFile of getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}luarocks.lock`,
+    options,
+  )) {
+    if (seenLockFiles.has(lockFile)) {
+      continue;
+    }
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${lockFile}`);
+    }
+    const result = parseLuaRocksLock(lockFile);
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+  }
+  if (pkgList.length) {
+    return buildBomNSData(options, pkgList, "lua", {
+      src: path,
+      filename: rockspecFiles.join(", "),
+      parentComponent,
+    });
+  }
+  return {};
+}
+
+/**
+ * Function to create bom string for Spack environments.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export async function createSpackBom(path, options) {
+  let pkgList = [];
+  let dependencies = [];
+  let rootInputs = [];
+  const spackLockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}spack.lock`,
+    options,
+  );
+  for (const spackLockFile of spackLockFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${spackLockFile}`);
+    }
+    const result = parseSpackLock(spackLockFile);
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+    if (result.dependencies?.length) {
+      dependencies = dependencies.concat(result.dependencies);
+    }
+    if (result.rootInputs?.length) {
+      rootInputs = rootInputs.concat(result.rootInputs);
+    }
+  }
+  if (!pkgList.length) {
+    return {};
+  }
+  // The lock names no project component, so the environment directory is the
+  // name the environment is already known by. Its roots are the specs the
+  // lock records as requested, which is why they are linked explicitly rather
+  // than inferred from which nodes have no incoming edge: a build-only tool
+  // such as gmake also has none, and it is not a root.
+  const envName = basename(resolve(path));
+  const parentComponent = {
+    type: "application",
+    name: envName,
+    "bom-ref": `application:${envName}:latest`,
+    description: `Spack environment: ${envName}`,
+    properties: [
+      { name: "internal:SrcFile", value: spackLockFiles.join(", ") },
+    ],
+  };
+  if (rootInputs.length) {
+    dependencies.push({
+      ref: parentComponent["bom-ref"],
+      dependsOn: [...new Set(rootInputs)].sort(),
+    });
+  }
+  return buildBomNSData(options, pkgList, "spack", {
+    src: path,
+    filename: spackLockFiles.join(", "),
+    dependencies,
+    parentComponent,
+  });
+}