@cdxgen/cdxgen 13.3.0 → 13.4.0

package/lib/cli/managedBom.js

@@ -13,6 +13,7 @@ import {
   hasAnyProjectType,
   isFeatureEnabled,
   shouldFetchLicense,
+  shouldFetchPackageMetadata,
 } from "../core/env.js";
 import {
   checksumFile,
@@ -33,14 +34,18 @@ import {
   parseBdistMetadata,
 } from "../ecosystems/ecosystems.js";
 import {
+  agreedNugetVersions,
+  dotnetManifestProjectDir,
   getCentralPackageVersions,
-  getPropertyGroupTextNodes,
+  indexPropsProperties,
   parseCsPkgData,
   parseCsPkgLockData,
   parseCsProjAssetsData,
   parseCsProjData,
   parseNupkg,
   parsePaketLockData,
+  projectPropertyCandidates,
+  resolveInstalledNugetVersion,
 } from "../ecosystems/parsers-dotnet.js";
 import { parseMinJs } from "../ecosystems/parsers-js.js";
 import {
@@ -52,7 +57,9 @@ import {
 } from "../ecosystems/parsers-misc.js";
 import { parseCpanSnapshot } from "../ecosystems/parsers-perl.js";
 import {
+  enrichFromInstalledMetadata,
   generatePixiLockFile,
+  installedMetadataKey,
   parseMojoProject,
   parsePiplockData,
   parsePixiLockFile,
@@ -63,7 +70,7 @@ import {
   parseSetupPyFile,
 } from "../ecosystems/parsers-python.js";
 import { parseRenvLock } from "../ecosystems/parsers-r.js";
-import { parseTerraformLockFile } from "../ecosystems/parsers-terraform.js";
+import { parseTerraformWorkspace } from "../ecosystems/parsers-terraform.js";
 import { collectEmbeddedSboms } from "../ecosystems/pep770.js";
 import { isPyLockFile } from "../ecosystems/pylockutils.js";
 import {
@@ -82,6 +89,7 @@ import {
   parseGemfileLockData,
   parseGemspecData,
 } from "../ecosystems/rubyutils.js";
+import { getTerraformRegistryMetadata } from "../ecosystems/terraformRegistry.js";
 import {
   collectAiInventory,
   summarizeAiInventory,
@@ -105,6 +113,7 @@ import {
   collectDosaiServiceComponents,
   collectDosaiServicesFromMethods,
   createDosaiMethodsSlice,
+  dosaiRunWasStopped,
   isDosaiDotnetLanguage,
   normalizeDosaiServiceMap,
   readDosaiMethodsReport,
@@ -404,6 +413,17 @@ export async function createPythonBom(path, options) {
     !pyLockFiles?.length;
   const poetryMode = poetryFiles?.length;
 
+  // The installed dist-info METADATA files describe the distributions this
+  // machine holds. They are read once, before any lockfile is parsed, so the
+  // lockfile entries they match are enriched before PyPI is asked and the
+  // registry is left only what the installations do not answer.
+  const installedLists = (metadataFiles || []).map((mf) =>
+    parseBdistMetadata(mf),
+  );
+  const installedMetadata = installedLists
+    .map((dlist) => dlist?.[0])
+    .filter((md) => md?.name);
+
   // TODO: Support for nested directories
   const setupPy = join(path, "setup.py");
   const setupPyMode = safeExistsSync(setupPy);
@@ -416,7 +436,9 @@ export async function createPythonBom(path, options) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
-      let retMap = await parsePyLockData(lockData, f);
+      let retMap = await parsePyLockData(lockData, f, undefined, {
+        installedMetadata,
+      });
       if (retMap?.workspaceWarningShown) {
         deferFailOnError(options, {
           ecosystem: "python",
@@ -508,7 +530,11 @@ export async function createPythonBom(path, options) {
               `exported-${basename(basePath)}-reqs.txt`,
             );
             safeWriteSync(tmpReqFile, exportedReqs);
-            const dlist = await parseReqFile(tmpReqFile, false);
+            const dlist = await parseReqFile(
+              tmpReqFile,
+              false,
+              installedMetadata,
+            );
             if (dlist?.length) {
               pkgList = pkgList.concat(dlist);
             }
@@ -518,15 +544,6 @@ export async function createPythonBom(path, options) {
     }
     options.parentComponent = parentComponent;
   } // poetryMode
-  if (metadataFiles?.length) {
-    // dist-info directories
-    for (const mf of metadataFiles) {
-      const dlist = parseBdistMetadata(mf);
-      if (dlist?.length) {
-        pkgList = pkgList.concat(dlist);
-      }
-    }
-  }
   // .whl files. Zip file containing dist-info directory
   if (whlFiles?.length) {
     for (const wf of whlFiles) {
@@ -592,7 +609,7 @@ export async function createPythonBom(path, options) {
         let dlist;
         try {
           const lockData = JSON.parse(readFileSync(piplockFile));
-          dlist = await parsePiplockData(lockData);
+          dlist = await parsePiplockData(lockData, installedMetadata);
         } catch (err) {
           recordDegradation("python.lockfile-unparseable.pipenv", {
             ecosystem: "python",
@@ -617,7 +634,7 @@ export async function createPythonBom(path, options) {
     } else if (reqDirFiles?.length) {
       for (const j in reqDirFiles) {
         const f = reqDirFiles[j];
-        const dlist = await parseReqFile(f, false);
+        const dlist = await parseReqFile(f, false, installedMetadata);
         if (dlist?.length) {
           pkgList = pkgList.concat(dlist);
         }
@@ -625,13 +642,30 @@ export async function createPythonBom(path, options) {
       metadataFilename = reqDirFiles.join(", ");
     } else if (reqFiles?.length) {
       for (const f of reqFiles) {
-        const dlist = await parseReqFile(f, false);
+        const dlist = await parseReqFile(f, false, installedMetadata);
         if (dlist?.length) {
           pkgList = pkgList.concat(dlist);
         }
       }
     }
   }
+  if (metadataFiles?.length) {
+    // dist-info directories, after every manifest block has added its
+    // entries. An installation whose package a lockfile, Pipfile.lock or
+    // requirements entry already lists enriched that entry, so it is not
+    // also emitted as a component of its own; an installation nothing else
+    // covers still is one. This pass is the emission decision only: each
+    // parser enriched its own entries before it asked PyPI.
+    const enriched = enrichFromInstalledMetadata(pkgList, installedMetadata);
+    for (const dlist of installedLists) {
+      if (dlist?.length) {
+        if (enriched.has(installedMetadataKey(dlist[0]))) {
+          continue;
+        }
+        pkgList = pkgList.concat(dlist);
+      }
+    }
+  }
 
   const parentDependsOn = new Set();
 
@@ -742,79 +776,81 @@ export async function createPythonBom(path, options) {
           );
         }
       }
-      // ATOM parsedeps block
-      // Atom parsedeps slices can be used to identify packages that are not declared in manifests
-      // Since it is a slow operation, we only use it as a fallback or in deep mode
-      // This change was made in 10.9.2 release onwards
-      if (options.deep || !pkgList.length) {
-        if (!pkgList.length) {
-          thoughtLog(
-            "I couldn't find any components yet. Let's try static analysis with atom parsedeps command.",
-          );
-        }
-        const retMap = await getPyModules(path, pkgList, options);
-        // We need to patch the existing package list to add ImportedModules for evinse to work
-        if (retMap.modList?.length) {
-          const iSymbolsMap = {};
-          retMap.modList.forEach((v) => {
-            iSymbolsMap[v.name] = v.importedSymbols;
-            iSymbolsMap[v.name.replace(/_/g, "-")] = v.importedSymbols;
-          });
-          for (const apkg of pkgList) {
-            if (iSymbolsMap[apkg.name]) {
-              apkg.scope = "required";
-              apkg.properties = apkg.properties || [];
-              apkg.properties.push({
-                name: "internal:ImportedModules",
-                value: iSymbolsMap[apkg.name],
-              });
-            }
+    }
+    // ATOM parsedeps block
+    // Atom parsedeps slices can be used to identify packages that are not declared in manifests
+    // Since it is a slow operation, we only use it as a fallback or in deep mode
+    // This change was made in 10.9.2 release onwards. It reads the sources and
+    // installs nothing, so it runs whether or not dependencies are installed.
+    if (options.deep || !pkgList.length) {
+      if (!pkgList.length) {
+        thoughtLog(
+          "I couldn't find any components yet. Let's try static analysis with atom parsedeps command.",
+        );
+      }
+      const retMap = await getPyModules(path, pkgList, options);
+      // We need to patch the existing package list to add ImportedModules for evinse to work
+      if (retMap.modList?.length) {
+        const iSymbolsMap = {};
+        retMap.modList.forEach((v) => {
+          iSymbolsMap[v.name] = v.importedSymbols;
+          iSymbolsMap[v.name.replace(/_/g, "-")] = v.importedSymbols;
+        });
+        for (const apkg of pkgList) {
+          if (iSymbolsMap[apkg.name]) {
+            apkg.scope = "required";
+            apkg.properties = apkg.properties || [];
+            apkg.properties.push({
+              name: "internal:ImportedModules",
+              value: iSymbolsMap[apkg.name],
+            });
           }
         }
-        if (retMap.pkgList?.length) {
-          pkgList = pkgList.concat(retMap.pkgList);
-          for (const p of retMap.pkgList) {
-            if (
-              !p.version ||
-              (parentComponent &&
-                p.name === parentComponent.name &&
-                (p.version === parentComponent.version ||
-                  p.version === "latest"))
-            ) {
-              continue;
-            }
-            parentDependsOn.add(pypiBomRef(p.name, p.version));
+      }
+      if (retMap.pkgList?.length) {
+        pkgList = pkgList.concat(retMap.pkgList);
+        for (const p of retMap.pkgList) {
+          if (
+            !p.version ||
+            (parentComponent &&
+              p.name === parentComponent.name &&
+              (p.version === parentComponent.version || p.version === "latest"))
+          ) {
+            continue;
           }
-        }
-        if (retMap.dependenciesList) {
-          dependencies = mergeDependencies(
-            dependencies,
-            retMap.dependenciesList,
-            parentComponent,
-          );
-        }
-        if (retMap.allImports) {
-          allImports = { ...allImports, ...retMap.allImports };
+          parentDependsOn.add(pypiBomRef(p.name, p.version));
         }
       }
-      // ATOM parsedeps block
-      let parentPresent = false;
-      for (const d of dependencies) {
-        if (d.ref === parentComponent["bom-ref"]) {
-          parentPresent = true;
-          break;
-        }
+      if (retMap.dependenciesList) {
+        dependencies = mergeDependencies(
+          dependencies,
+          retMap.dependenciesList,
+          parentComponent,
+        );
       }
-      if (!parentPresent) {
-        const pdependencies = {
-          ref: parentComponent["bom-ref"],
-          dependsOn: Array.from(parentDependsOn).filter(
-            (r) => parentComponent && r !== parentComponent["bom-ref"],
-          ),
-        };
-        dependencies.splice(0, 0, pdependencies);
+      if (retMap.allImports) {
+        allImports = { ...allImports, ...retMap.allImports };
+      }
+    }
+    // ATOM parsedeps block
+    let parentPresent = false;
+    for (const d of dependencies) {
+      if (d.ref === parentComponent["bom-ref"]) {
+        parentPresent = true;
+        break;
       }
     }
+    // Without an install, the parent's dependencies are known only when the
+    // import scan found some: an empty list would claim it has none.
+    if (!parentPresent && (options.installDeps || parentDependsOn.size)) {
+      const pdependencies = {
+        ref: parentComponent["bom-ref"],
+        dependsOn: Array.from(parentDependsOn).filter(
+          (r) => parentComponent && r !== parentComponent["bom-ref"],
+        ),
+      };
+      dependencies.splice(0, 0, pdependencies);
+    }
   }
   // Final fallback is to manually parse setup.py if we still
   // have an empty list
@@ -1403,7 +1439,7 @@ export async function createRubyBom(path, options) {
         console.log(`Parsing ${f}`);
       }
       const gemLockData = readFileSync(f, { encoding: "utf-8" });
-      const retMap = await parseGemfileLockData(gemLockData, f);
+      const retMap = await parseGemfileLockData(gemLockData, f, { gemHome });
       if (retMap.pkgList?.length) {
         pkgList = pkgList.concat(retMap.pkgList);
         pkgList = trimComponents(pkgList);
@@ -1457,7 +1493,7 @@ export async function createRubyBom(path, options) {
       const gpkgList = await parseGemspecData(
         gemspecData,
         f,
-        isRootGemspec ? { lockedVersions } : {},
+        isRootGemspec ? { lockedVersions, projectGemspec: true } : {},
       );
       if (!gpkgList.length) {
         continue;
@@ -1821,49 +1857,88 @@ export async function createCsharpBom(path, options) {
   const parentDependsOn = new Set();
   if (nupkgFiles.length && projAssetsFiles.length === 0) {
     manifestFiles = manifestFiles.concat(nupkgFiles);
-    // When parsing nupkg files, only version ranges will be specified under dependencies
-    // To resolve the version, we need to track the mapping between name and resolved versions here
-    let dependenciesMap = {};
-    const pkgNameVersions = {};
+    // A nuspec states the range each dependency accepts, not the version
+    // installed. The installed packages are the components, and a dependency
+    // edge points at the installed version its range resolves to; a minimum
+    // version nobody installed is not a component.
+    const installedVersions = {};
+    const installedNames = {};
+    let dependencyRanges = {};
     for (const nf of nupkgFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${nf}`);
       }
       const retMap = await parseNupkg(nf);
-      if (retMap?.pkgList?.length) {
-        pkgList = pkgList.concat(retMap.pkgList);
-        for (const d of retMap.pkgList) {
-          parentDependsOn.add(d["bom-ref"]);
-          pkgNameVersions[d.name] = d.version;
+      const installed = retMap?.pkgList?.[0];
+      if (installed) {
+        pkgList.push(installed);
+        parentDependsOn.add(installed["bom-ref"]);
+        const key = installed.name.toLowerCase();
+        installedNames[key] ??= installed.name;
+        installedVersions[key] ??= [];
+        if (installed.version) {
+          installedVersions[key].push(installed.version);
         }
       }
-      if (retMap?.dependenciesMap) {
-        dependenciesMap = { ...dependenciesMap, ...retMap.dependenciesMap };
+      if (retMap?.dependencyRanges) {
+        dependencyRanges = { ...dependencyRanges, ...retMap.dependencyRanges };
       }
     } // end for
-    for (const k of Object.keys(dependenciesMap)) {
-      const dependsOn = dependenciesMap[k].map((p) => {
-        const ver = pkgNameVersions[p] || "latest";
-        const purl = nugetPurl(p, ver);
-        return purl ? decodeURIComponent(purl) : `library:${p}:${ver}`;
-      });
-      dependencies.push({ ref: k, dependsOn: [...new Set(dependsOn)].sort() });
+    for (const [ref, ranges] of Object.entries(dependencyRanges)) {
+      const dependsOn = new Set();
+      for (const [name, range] of Object.entries(ranges)) {
+        const key = name.toLowerCase();
+        const version = resolveInstalledNugetVersion(
+          range,
+          installedVersions[key],
+        );
+        const purl = version ? nugetPurl(installedNames[key], version) : null;
+        if (purl) {
+          dependsOn.add(decodeURIComponent(purl));
+        }
+      }
+      dependencies.push({ ref, dependsOn: [...dependsOn].sort() });
     }
   }
+  // Versions each project restored, by project directory and lowercased
+  // package id. Two projects of one tree routinely restore different versions
+  // of a package, so a version missing from one project's manifest is taken
+  // from that project's restore output, never from another project's.
+  // The restore output also spells each package id the way its nuspec does.
+  const projectVersions = {};
+  const projectNames = {};
+  const recordProjectVersions = (projectDir, pkgs) => {
+    projectVersions[projectDir] ??= {};
+    projectNames[projectDir] ??= {};
+    for (const p of pkgs || []) {
+      if (
+        p?.name &&
+        p.version &&
+        !["application", "project"].includes(p.type)
+      ) {
+        projectVersions[projectDir][p.name.toLowerCase()] ??= p.version;
+        projectNames[projectDir][p.name.toLowerCase()] ??= p.name;
+      }
+    }
+  };
+  // Direct dependencies of each project directory from its lock file or
+  // packages.config, attached to that project once the project files are read.
+  const rootsByProjectDir = {};
+  const recordRoots = (projectDir, pkgs) => {
+    rootsByProjectDir[projectDir] ??= new Set();
+    for (const p of pkgs || []) {
+      if (p?.["bom-ref"]) {
+        rootsByProjectDir[projectDir].add(p["bom-ref"]);
+      }
+    }
+  };
   // In a multi-project scan, different projects may use different manifest
   // formats: modern SDK-style (project.assets.json / packages.lock.json) or
   // legacy (packages.config). Apply the assets > lock > config precedence per
   // project directory instead of across the whole scan, so dependencies from
   // one project's manifest are not dropped just because another format exists
   // elsewhere in the scan.
-  const assetsProjectDirs = new Set(
-    projAssetsFiles.map((af) => {
-      // project.assets.json is generated under <project>/obj/
-      const d = dirname(af);
-      return basename(d) === "obj" ? dirname(d) : d;
-    }),
-  );
-  const lockProjectDirs = new Set(pkgLockFiles.map((af) => dirname(af)));
+  const assetsProjectDirs = new Set();
   // project.assets.json parsing
   if (projAssetsFiles.length) {
     manifestFiles = manifestFiles.concat(projAssetsFiles);
@@ -1875,6 +1950,11 @@ export async function createCsharpBom(path, options) {
       const results = parseCsProjAssetsData(pkgData, af);
       const deps = results["dependenciesList"];
       const dlist = results["pkgList"];
+      // Restore output names its project; an artifacts layout keeps it outside
+      // the project directory.
+      const projectDir = dotnetManifestProjectDir(af, results.projectPath);
+      assetsProjectDirs.add(projectDir);
+      recordProjectVersions(projectDir, dlist);
       if (dlist?.length) {
         pkgList = pkgList.concat(dlist);
       }
@@ -1907,9 +1987,12 @@ export async function createCsharpBom(path, options) {
       });
     }
   }
+  const lockProjectDirs = new Set(
+    pkgLockFiles.map((af) => dotnetManifestProjectDir(af)),
+  );
   // packages.lock.json parsing for any project without a project.assets.json
   const pkgLockToParse = pkgLockFiles.filter(
-    (af) => !assetsProjectDirs.has(dirname(af)),
+    (af) => !assetsProjectDirs.has(dotnetManifestProjectDir(af)),
   );
   if (pkgLockToParse.length) {
     manifestFiles = manifestFiles.concat(pkgLockToParse);
@@ -1923,37 +2006,29 @@ export async function createCsharpBom(path, options) {
       const deps = results["dependenciesList"];
       const dlist = results["pkgList"];
       const rootList = results["rootList"];
+      const projectDir = dotnetManifestProjectDir(af);
+      recordProjectVersions(projectDir, dlist);
       if (dlist?.length) {
         pkgList = pkgList.concat(dlist);
       }
       if (deps?.length) {
         dependencies = mergeDependencies(dependencies, deps, parentComponent);
       }
-      // Keep track of the direct dependencies so that we can construct one complete
-      // list after processing all lock files
-      if (rootList?.length) {
-        for (const p of rootList) {
-          parentDependsOn.add(p["bom-ref"]);
-        }
-      }
+      recordRoots(projectDir, rootList);
     }
   }
   // packages.config parsing for any project without a modern manifest
   // (project.assets.json / packages.lock.json) covering the same directory
   const pkgConfigToParse = pkgConfigFiles.filter((f) => {
-    const projDir = dirname(f);
+    const projDir = dotnetManifestProjectDir(f);
     return !assetsProjectDirs.has(projDir) && !lockProjectDirs.has(projDir);
   });
   if (pkgConfigToParse.length) {
     manifestFiles = manifestFiles.concat(pkgConfigToParse);
-    // Versions already resolved from project.assets.json / packages.lock.json
-    // can backfill templated or missing versions in packages.config
-    const resolvedVersions = {};
-    for (const p of pkgList) {
-      if (p.name && p.version) {
-        resolvedVersions[p.name] = p.version;
-      }
-    }
+    // A templated or missing version is backfilled only from a version every
+    // other manifest of the scan agrees on: these projects restored nothing of
+    // their own, and another project's version may not be theirs.
+    const resolvedVersions = agreedNugetVersions(pkgList);
     // packages.config parsing
     for (const f of pkgConfigToParse) {
       if (DEBUG_MODE) {
@@ -1961,11 +2036,11 @@ export async function createCsharpBom(path, options) {
       }
       pkgData = readFileSync(f, { encoding: "utf-8" });
       const dlist = parseCsPkgData(pkgData, f, resolvedVersions);
+      const projectDir = dotnetManifestProjectDir(f);
+      recordProjectVersions(projectDir, dlist);
       if (dlist?.length) {
         pkgList = pkgList.concat(dlist);
-        for (const d of dlist) {
-          parentDependsOn.add(d["bom-ref"]);
-        }
+        recordRoots(projectDir, dlist);
       }
     }
   }
@@ -1988,27 +2063,26 @@ export async function createCsharpBom(path, options) {
       }
     }
   }
-  const pkgNameVersions = {};
+  const projectRefByDir = {};
   let services = [];
   if (csProjFiles.length) {
     manifestFiles = manifestFiles.concat(csProjFiles);
-    // Parsing csproj is quite error-prone. Some project files may not have versions specified
-    // To work around this, we make use of the version from the existing list
-    for (const p of pkgList) {
-      if (p.version) {
-        pkgNameVersions[p.name] = p.version;
-      }
-    }
+    // Parsing csproj is quite error-prone. Some project files may not have
+    // versions specified. Such a version comes from what this project restored,
+    // then from central package management, and only then from a version the
+    // whole scan agrees on.
+    const agreedVersions = agreedNugetVersions(pkgList);
     let msbuildInstalled = false;
-    let pkgVersionLabelCandidates = {};
-    const result = safeSpawnSync(DOTNET_CMD, ["msbuild --version"], {
+    const result = safeSpawnSync(DOTNET_CMD, ["msbuild", "--version"], {
       shell: isWin,
     });
-    if (result.status === 0 && !result.error && result.stdout.trim()) {
+    if (result.status === 0 && !result.error && result.stdout?.trim()) {
       msbuildInstalled = true;
-    } else {
-      pkgVersionLabelCandidates = getPropertyGroupTextNodes(propsFiles);
     }
+    // `$(Name)` version labels resolve from the props files that can apply to
+    // each project (beside and above it), read once for the whole scan.
+    // msbuild evaluates only what they leave unresolved.
+    const propsIndex = indexPropsProperties(propsFiles);
     // Directory.Packages.props can sit above the directory being scanned, so it is
     // resolved per project file by walking up rather than from the props glob below.
     // The cache keeps a repository with many projects from re-parsing the same file.
@@ -2019,15 +2093,19 @@ export async function createCsharpBom(path, options) {
         console.log(`Parsing ${f}`);
       }
       const csProjData = readFileSync(f, { encoding: "utf-8" });
+      const projectDir = dotnetManifestProjectDir(f);
       const retMap = parseCsProjData(
         csProjData,
         f,
-        pkgNameVersions,
+        projectVersions[projectDir] || {},
         msbuildInstalled,
-        pkgVersionLabelCandidates,
+        projectPropertyCandidates(f, propsIndex),
         getCentralPackageVersions(f, centralVersionsCache),
+        agreedVersions,
+        projectNames[projectDir] || {},
       );
       if (retMap?.parentComponent?.purl) {
+        projectRefByDir[projectDir] ??= retMap.parentComponent["bom-ref"];
         // If there are multiple project files, track the parent components using nested components
         if (csProjFiles.length > 1) {
           if (!parentComponent.components) {
@@ -2051,6 +2129,25 @@ export async function createCsharpBom(path, options) {
       }
     }
   }
+  // A lock file's or packages.config's direct dependencies belong to the
+  // project in that directory; without a project file there, to the parent.
+  for (const [projectDir, roots] of Object.entries(rootsByProjectDir)) {
+    if (!roots.size) {
+      continue;
+    }
+    const projectRef = projectRefByDir[projectDir];
+    if (projectRef && projectRef !== parentComponent?.["bom-ref"]) {
+      dependencies = mergeDependencies(
+        dependencies,
+        [{ ref: projectRef, dependsOn: [...roots].sort() }],
+        parentComponent,
+      );
+    } else {
+      for (const ref of roots) {
+        parentDependsOn.add(ref);
+      }
+    }
+  }
   if (pkgList.length) {
     pkgList = trimComponents(pkgList);
     // Perform deep analysis using dosai
@@ -2059,44 +2156,60 @@ export async function createCsharpBom(path, options) {
       // as-is: join would append it to the scan path, which is never a valid
       // path on Windows and silently loses the .NET evidence elsewhere
       // (issue 4394). A relative value still resolves against the scan path.
-      const slicesFile = resolve(
-        options.depsSlicesFile
-          ? resolve(path, options.depsSlicesFile)
-          : join(getTmpDir(), "dosai.json"),
-      );
-      // Create the slices file if it doesn't exist
-      if (!safeExistsSync(slicesFile)) {
-        thoughtLog(
-          "Alright, the next step is to invoke the dosai command to identify evidence of occurrences for various components.",
-        );
-        const sliceResult = createDosaiMethodsSlice(
-          resolve(path),
-          resolve(slicesFile),
-          options,
-        );
-        if (!sliceResult) {
-          // Visible without --debug: otherwise the components silently lose
-          // the dependency-slice evidence while the scan still exits 0.
-          // --evidence (which implies --deep) runs dosai again during evinse
-          // and can still add occurrences, so this names only what is lost.
-          console.warn(
-            "Slicing with dosai was unsuccessful, so the .NET components get no occurrence, reachability, or services evidence from the dependency slice. Re-run with --debug for the dosai errors.",
+      // Without --deps-slices-file the slice goes to a directory of this run:
+      // a fixed name in the shared temp directory was reused by every later
+      // scan, of any project, as if it were that project's evidence.
+      const slicesDir = options.depsSlicesFile
+        ? undefined
+        : safeMkdtempSync(join(getTmpDir(), "cdxgen-dosai-"));
+      const slicesFile = options.depsSlicesFile
+        ? resolve(path, options.depsSlicesFile)
+        : join(slicesDir, "dosai.json");
+      try {
+        // Create the slices file if it doesn't exist
+        if (!safeExistsSync(slicesFile)) {
+          thoughtLog(
+            "Alright, the next step is to invoke the dosai command to identify evidence of occurrences for various components.",
+          );
+          const sliceResult = createDosaiMethodsSlice(
+            resolve(path),
+            resolve(slicesFile),
+            options,
+          );
+          // A stopped run has already said so and what to change; the debug
+          // output would show no dosai error for it (issue 4438).
+          if (!sliceResult && !dosaiRunWasStopped(resolve(slicesFile))) {
+            // Visible without debug output: otherwise the components silently
+            // lose the dependency-slice evidence while the scan still exits 0.
+            // --evidence (which implies --deep) runs dosai again during evinse
+            // and can still add occurrences, so this names only what is lost.
+            // Debug output comes from the environment, not a CLI flag (issue
+            // 4438).
+            console.warn(
+              "Slicing with dosai was unsuccessful, so the .NET components get no occurrence, reachability, or services evidence from the dependency slice. Re-run with CDXGEN_DEBUG_MODE=debug for the dosai errors.",
+            );
+          }
+        } else if (DEBUG_MODE) {
+          console.log(
+            `Reusing the existing dosai methods slice "${slicesFile}" without checking whether it honours the current --exclude patterns. Delete the file to force a fresh run.`,
           );
         }
-      } else if (DEBUG_MODE) {
-        console.log(
-          `Reusing the existing dosai methods slice "${slicesFile}" without checking whether it honours the current --exclude patterns. Delete the file to force a fresh run.`,
-        );
+        pkgList = addEvidenceForDotnet(pkgList, slicesFile, {
+          srcPath: resolve(path),
+        });
+        const methodsSlice = readDosaiMethodsReport(slicesFile, {
+          sections: ["Metadata", "Services", "ApiEndpoints"],
+        });
+        // Provider-backed Services[] first so bom-refs, trust zones, and data
+        // classifications survive; ApiEndpoints derivation fills in the rest.
+        const servicesMap = collectDosaiServiceComponents(methodsSlice, {});
+        collectDosaiServicesFromMethods(methodsSlice, servicesMap);
+        services = normalizeDosaiServiceMap(servicesMap);
+      } finally {
+        if (slicesDir) {
+          safeRmSync(slicesDir, { recursive: true, force: true });
+        }
       }
-      pkgList = addEvidenceForDotnet(pkgList, slicesFile);
-      const methodsSlice = readDosaiMethodsReport(slicesFile, {
-        sections: ["Metadata", "Services", "ApiEndpoints"],
-      });
-      // Provider-backed Services[] first so bom-refs, trust zones, and data
-      // classifications survive; ApiEndpoints derivation fills in the rest.
-      const servicesMap = collectDosaiServiceComponents(methodsSlice, {});
-      collectDosaiServicesFromMethods(methodsSlice, servicesMap);
-      services = normalizeDosaiServiceMap(servicesMap);
     }
   }
   // Parent dependency tree. A single project file already contributed an
@@ -2342,34 +2455,41 @@ export function createPerlBom(path, options) {
 /**
  * Function to create bom string for Terraform and OpenTofu projects.
  *
- * The `.terraform.lock.hcl` file pins the providers the configuration
- * resolves to, with content hashes suitable for the CycloneDX hashes array.
+ * The workspace assembly turns the provider lock file, the module manifest
+ * `init` writes and the configuration files into module and provider
+ * components with a dependency graph and offline licenses. When metadata
+ * fetching is enabled, the public registries add licenses, repository URLs
+ * and registry flags to components the offline pass could not resolve.
  *
  * @param {string} path to the project
  * @param {Object} options Parse options from the cli
- * @returns {Object} BOM object
+ * @returns {Promise<Object>} BOM object
  */
-export function createTerraformBom(path, options) {
-  let pkgList = [];
-  const lockFiles = getAllFiles(
+export async function createTerraformBom(path, options) {
+  const parentComponent = createDefaultParentComponent(
     path,
-    `${options.multiProject ? "**/" : ""}.terraform.lock.hcl`,
+    "generic",
     options,
   );
-  for (const lockFile of lockFiles) {
-    if (DEBUG_MODE) {
-      console.log(`Parsing ${lockFile}`);
-    }
-    const result = parseTerraformLockFile(lockFile);
-    if (result.pkgList?.length) {
-      pkgList = pkgList.concat(result.pkgList);
-    }
+  const { pkgList, dependencies, parentProperties, srcFiles } =
+    parseTerraformWorkspace(path, options, parentComponent["bom-ref"]);
+  // No module or provider found (for example, resources only, or a stray
+  // .tf in a JS repo): emit nothing, including no root applications, so
+  // multi-type scans do not gain an empty Terraform parent.
+  if (!pkgList.some((p) => p.type === "library")) {
+    return {};
   }
-  if (pkgList.length) {
-    return buildBomNSData(options, pkgList, "terraform", {
-      src: path,
-      filename: lockFiles.join(", "),
-    });
+  parentComponent.properties = [
+    ...(parentComponent.properties || []),
+    ...parentProperties,
+  ];
+  if (pkgList.length && shouldFetchPackageMetadata()) {
+    await getTerraformRegistryMetadata(pkgList);
   }
-  return {};
+  return buildBomNSData(options, pkgList, "terraform", {
+    src: path,
+    filename: srcFiles.join(", "),
+    dependencies,
+    parentComponent,
+  });
 }