@pnpm/deps.compliance.sbom 1000.0.0-0

package/lib/collectComponents.d.ts

@@ -0,0 +1,23 @@
+import type { LockfileObject } from '@pnpm/lockfile.types';
+import type { DependenciesField, ProjectId, Registries } from '@pnpm/types';
+import type { SbomComponentType, SbomResult } from './types.js';
+export interface CollectSbomComponentsOptions {
+    lockfile: LockfileObject;
+    rootName: string;
+    rootVersion: string;
+    rootLicense?: string;
+    rootDescription?: string;
+    rootAuthor?: string;
+    rootRepository?: string;
+    sbomType?: SbomComponentType;
+    include?: {
+        [dependenciesField in DependenciesField]: boolean;
+    };
+    registries: Registries;
+    lockfileDir: string;
+    includedImporterIds?: ProjectId[];
+    lockfileOnly?: boolean;
+    storeDir?: string;
+    virtualStoreDirMaxLength?: number;
+}
+export declare function collectSbomComponents(opts: CollectSbomComponentsOptions): Promise<SbomResult>;

package/lib/collectComponents.js

@@ -0,0 +1,75 @@
+import { DepType, detectDepTypes } from '@pnpm/lockfile.detect-dep-types';
+import { nameVerFromPkgSnapshot, pkgSnapshotToResolution } from '@pnpm/lockfile.utils';
+import { lockfileWalkerGroupImporterSteps, } from '@pnpm/lockfile.walker';
+import { StoreIndex } from '@pnpm/store.index';
+import { getPkgMetadata } from './getPkgMetadata.js';
+import { buildPurl, encodePurlName } from './purl.js';
+export async function collectSbomComponents(opts) {
+    const depTypes = detectDepTypes(opts.lockfile);
+    const importerIds = opts.includedImporterIds ?? Object.keys(opts.lockfile.importers);
+    const importerWalkers = lockfileWalkerGroupImporterSteps(opts.lockfile, importerIds, { include: opts.include });
+    const componentsMap = new Map();
+    const relationships = [];
+    const rootPurl = `pkg:npm/${encodePurlName(opts.rootName)}@${opts.rootVersion}`;
+    const storeIndex = (!opts.lockfileOnly && opts.storeDir)
+        ? new StoreIndex(opts.storeDir)
+        : undefined;
+    const metadataOpts = (storeIndex && opts.storeDir)
+        ? {
+            storeDir: opts.storeDir,
+            storeIndex,
+            lockfileDir: opts.lockfileDir,
+            virtualStoreDirMaxLength: opts.virtualStoreDirMaxLength ?? 120,
+        }
+        : undefined;
+    await Promise.all(importerWalkers.map(async ({ step }) => {
+        await walkStep(step, rootPurl, depTypes, componentsMap, relationships, opts, metadataOpts);
+    }));
+    storeIndex?.close();
+    return {
+        rootComponent: {
+            name: opts.rootName,
+            version: opts.rootVersion,
+            type: opts.sbomType ?? 'library',
+            license: opts.rootLicense,
+            description: opts.rootDescription,
+            author: opts.rootAuthor,
+            repository: opts.rootRepository,
+        },
+        components: Array.from(componentsMap.values()),
+        relationships,
+    };
+}
+async function walkStep(step, parentPurl, depTypes, componentsMap, relationships, opts, metadataOpts) {
+    await Promise.all(step.dependencies.map(async (dep) => {
+        const { depPath, pkgSnapshot, next } = dep;
+        const { name, version, nonSemverVersion } = nameVerFromPkgSnapshot(depPath, pkgSnapshot);
+        if (!name || !version)
+            return;
+        const purl = buildPurl({ name, version, nonSemverVersion: nonSemverVersion ?? undefined });
+        relationships.push({ from: parentPurl, to: purl });
+        if (componentsMap.has(purl))
+            return;
+        const integrity = pkgSnapshot.resolution.integrity;
+        const resolution = pkgSnapshotToResolution(depPath, pkgSnapshot, opts.registries);
+        const tarballUrl = resolution.tarball;
+        let metadata = {};
+        if (metadataOpts) {
+            metadata = await getPkgMetadata(depPath, pkgSnapshot, opts.registries, metadataOpts);
+        }
+        const component = {
+            name,
+            version,
+            purl,
+            depPath,
+            depType: depTypes[depPath] ?? DepType.ProdOnly,
+            integrity,
+            tarballUrl,
+            ...metadata,
+        };
+        componentsMap.set(purl, component);
+        const subStep = next();
+        await walkStep(subStep, purl, depTypes, componentsMap, relationships, opts, metadataOpts);
+    }));
+}
+//# sourceMappingURL=collectComponents.js.map

package/lib/getPkgMetadata.d.ts

@@ -0,0 +1,17 @@
+import { type PackageSnapshot } from '@pnpm/lockfile.utils';
+import type { StoreIndex } from '@pnpm/store.index';
+import type { Registries } from '@pnpm/types';
+export interface PkgMetadata {
+    license?: string;
+    description?: string;
+    author?: string;
+    homepage?: string;
+    repository?: string;
+}
+export interface GetPkgMetadataOptions {
+    storeDir: string;
+    storeIndex: StoreIndex;
+    lockfileDir: string;
+    virtualStoreDirMaxLength: number;
+}
+export declare function getPkgMetadata(depPath: string, snapshot: PackageSnapshot, registries: Registries, opts: GetPkgMetadataOptions): Promise<PkgMetadata>;

package/lib/getPkgMetadata.js

@@ -0,0 +1,71 @@
+import { pkgSnapshotToResolution } from '@pnpm/lockfile.utils';
+import { readPackageJson } from '@pnpm/pkg-manifest.reader';
+import { readPackageFileMap } from '@pnpm/store.pkg-finder';
+import pLimit from 'p-limit';
+const limitMetadataReads = pLimit(4);
+export async function getPkgMetadata(depPath, snapshot, registries, opts) {
+    return limitMetadataReads(() => getPkgMetadataUnclamped(depPath, snapshot, registries, opts));
+}
+async function getPkgMetadataUnclamped(depPath, snapshot, registries, opts) {
+    const id = snapshot.id ?? depPath;
+    const resolution = pkgSnapshotToResolution(depPath, snapshot, registries);
+    let files;
+    try {
+        const result = await readPackageFileMap(resolution, id, opts);
+        if (!result)
+            return {};
+        files = result;
+    }
+    catch {
+        return {};
+    }
+    const manifestPath = files.get('package.json');
+    if (!manifestPath)
+        return {};
+    const manifest = await readPackageJson(manifestPath);
+    return extractMetadata(manifest);
+}
+function extractMetadata(manifest) {
+    return {
+        license: parseLicenseField(manifest.license),
+        description: manifest.description,
+        author: parseAuthorField(manifest.author),
+        homepage: manifest.homepage,
+        repository: parseRepositoryField(manifest.repository),
+    };
+}
+function parseLicenseField(field) {
+    if (typeof field === 'string')
+        return field;
+    if (field && typeof field === 'object' && 'type' in field) {
+        return field.type;
+    }
+    if (Array.isArray(field)) {
+        return field
+            .map((l) => l.type)
+            .filter(Boolean)
+            .join(' OR ') || undefined;
+    }
+    return undefined;
+}
+function parseAuthorField(field) {
+    if (!field)
+        return undefined;
+    if (typeof field === 'string')
+        return field;
+    if (typeof field === 'object' && 'name' in field) {
+        return field.name;
+    }
+    return undefined;
+}
+function parseRepositoryField(field) {
+    if (!field)
+        return undefined;
+    if (typeof field === 'string')
+        return field;
+    if (typeof field === 'object' && 'url' in field) {
+        return field.url;
+    }
+    return undefined;
+}
+//# sourceMappingURL=getPkgMetadata.js.map

package/lib/index.d.ts

@@ -0,0 +1,6 @@
+export { collectSbomComponents, type CollectSbomComponentsOptions } from './collectComponents.js';
+export { integrityToHashes } from './integrity.js';
+export { buildPurl, encodePurlName } from './purl.js';
+export { type CycloneDxOptions, serializeCycloneDx } from './serializeCycloneDx.js';
+export { serializeSpdx } from './serializeSpdx.js';
+export type { SbomComponent, SbomComponentType, SbomFormat, SbomRelationship, SbomResult } from './types.js';

package/lib/index.js

@@ -0,0 +1,6 @@
+export { collectSbomComponents } from './collectComponents.js';
+export { integrityToHashes } from './integrity.js';
+export { buildPurl, encodePurlName } from './purl.js';
+export { serializeCycloneDx } from './serializeCycloneDx.js';
+export { serializeSpdx } from './serializeSpdx.js';
+//# sourceMappingURL=index.js.map

package/lib/integrity.d.ts

@@ -0,0 +1,9 @@
+export interface HashDigest {
+    algorithm: string;
+    digest: string;
+}
+/**
+ * Convert an SRI integrity string to a list of algorithm + hex digest pairs.
+ * e.g. "sha512-abc123..." → [{ algorithm: "SHA-512", digest: "..." }]
+ */
+export declare function integrityToHashes(integrity: string | undefined): HashDigest[];

package/lib/integrity.js

@@ -0,0 +1,38 @@
+import ssri from 'ssri';
+/**
+ * Convert an SRI integrity string to a list of algorithm + hex digest pairs.
+ * e.g. "sha512-abc123..." → [{ algorithm: "SHA-512", digest: "..." }]
+ */
+export function integrityToHashes(integrity) {
+    if (!integrity)
+        return [];
+    const parsed = ssri.parse(integrity);
+    const hashes = [];
+    for (const [algo, entries] of Object.entries(parsed)) {
+        if (!entries?.length)
+            continue;
+        for (const entry of entries) {
+            const hexDigest = Buffer.from(entry.digest, 'base64').toString('hex');
+            hashes.push({
+                algorithm: normalizeShaAlgorithm(algo),
+                digest: hexDigest,
+            });
+        }
+    }
+    return hashes;
+}
+function normalizeShaAlgorithm(algo) {
+    switch (algo) {
+        case 'sha1':
+            return 'SHA-1';
+        case 'sha256':
+            return 'SHA-256';
+        case 'sha384':
+            return 'SHA-384';
+        case 'sha512':
+            return 'SHA-512';
+        default:
+            return algo.toUpperCase();
+    }
+}
+//# sourceMappingURL=integrity.js.map

package/lib/license.d.ts

@@ -0,0 +1,11 @@
+export declare function classifyLicense(license: string): {
+    license: {
+        id: string;
+    };
+} | {
+    license: {
+        name: string;
+    };
+} | {
+    expression: string;
+};

package/lib/license.js

@@ -0,0 +1,18 @@
+// Sub-path import to pull only the SPDX module — avoids dragging in the
+// validation/serialize layers with optional native deps that break esbuild bundling.
+import { isSupportedSpdxId, isValidSpdxLicenseExpression } from '@cyclonedx/cyclonedx-library/SPDX';
+// Classifies a license string into the appropriate CycloneDX representation.
+// Uses the CycloneDX library's own SPDX list rather than spdx-license-ids,
+// since CycloneDX maintains its own subset of recognized IDs.
+// Order matters: check ID first because "MIT" matches both isSupportedSpdxId
+// and isValidSpdxLicenseExpression, but we prefer the more specific license.id form.
+export function classifyLicense(license) {
+    if (isSupportedSpdxId(license)) {
+        return { license: { id: license } };
+    }
+    if (isValidSpdxLicenseExpression(license)) {
+        return { expression: license };
+    }
+    return { license: { name: license } };
+}
+//# sourceMappingURL=license.js.map

package/lib/purl.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Encode a package name for use in a PURL.
+ * Scoped packages: @scope/name → %40scope/name
+ */
+export declare function encodePurlName(name: string): string;
+/**
+ * Build a Package URL (PURL) for a given package.
+ * Spec: https://github.com/package-url/purl-spec
+ */
+export declare function buildPurl(opts: {
+    name: string;
+    version: string;
+    nonSemverVersion?: string;
+}): string;

package/lib/purl.js

@@ -0,0 +1,23 @@
+/**
+ * Encode a package name for use in a PURL.
+ * Scoped packages: @scope/name → %40scope/name
+ */
+export function encodePurlName(name) {
+    if (name.startsWith('@')) {
+        return `%40${name.slice(1)}`;
+    }
+    return name;
+}
+/**
+ * Build a Package URL (PURL) for a given package.
+ * Spec: https://github.com/package-url/purl-spec
+ */
+export function buildPurl(opts) {
+    if (opts.nonSemverVersion) {
+        // Git-hosted or tarball dep — encode the raw version as a qualifier
+        const encodedUrl = encodeURIComponent(opts.nonSemverVersion);
+        return `pkg:npm/${encodePurlName(opts.name)}@${encodeURIComponent(opts.version)}?vcs_url=${encodedUrl}`;
+    }
+    return `pkg:npm/${encodePurlName(opts.name)}@${opts.version}`;
+}
+//# sourceMappingURL=purl.js.map

package/lib/serializeCycloneDx.d.ts

@@ -0,0 +1,8 @@
+import type { SbomResult } from './types.js';
+export interface CycloneDxOptions {
+    pnpmVersion?: string;
+    lockfileOnly?: boolean;
+    sbomAuthors?: string[];
+    sbomSupplier?: string;
+}
+export declare function serializeCycloneDx(result: SbomResult, opts?: CycloneDxOptions): string;

package/lib/serializeCycloneDx.js

@@ -0,0 +1,149 @@
+import crypto from 'node:crypto';
+import { integrityToHashes } from './integrity.js';
+import { classifyLicense } from './license.js';
+import { encodePurlName } from './purl.js';
+export function serializeCycloneDx(result, opts) {
+    const { rootComponent, components, relationships } = result;
+    const rootBomRef = `pkg:npm/${encodePurlName(rootComponent.name)}@${rootComponent.version}`;
+    const bomComponents = components.map((comp) => {
+        const { group, name } = splitScopedName(comp.name);
+        const cdxComp = {
+            type: 'library',
+            name,
+            version: comp.version,
+            purl: comp.purl,
+            'bom-ref': comp.purl,
+        };
+        if (group) {
+            cdxComp.group = group;
+        }
+        if (comp.description) {
+            cdxComp.description = comp.description;
+        }
+        // CycloneDX supplier is the registry/distributor, not the package author
+        if (comp.author) {
+            cdxComp.authors = [{ name: comp.author }];
+        }
+        if (comp.license) {
+            cdxComp.licenses = [classifyLicense(comp.license)];
+        }
+        const externalRefs = [];
+        // Lockfile integrity is a tarball hash, not a source hash — belongs on the
+        // distribution reference, not component.hashes
+        if (comp.tarballUrl) {
+            const hashes = integrityToHashes(comp.integrity);
+            const distRef = {
+                type: 'distribution',
+                url: comp.tarballUrl,
+            };
+            if (hashes.length > 0) {
+                distRef.hashes = hashes.map((h) => ({
+                    alg: h.algorithm,
+                    content: h.digest,
+                }));
+            }
+            externalRefs.push(distRef);
+        }
+        if (comp.homepage) {
+            externalRefs.push({
+                type: 'website',
+                url: comp.homepage,
+            });
+        }
+        if (comp.repository) {
+            externalRefs.push({
+                type: 'vcs',
+                url: comp.repository,
+            });
+        }
+        if (externalRefs.length > 0) {
+            cdxComp.externalReferences = externalRefs;
+        }
+        return cdxComp;
+    });
+    // Group relationships by source
+    const depMap = new Map();
+    depMap.set(rootBomRef, []);
+    for (const comp of components) {
+        depMap.set(comp.purl, []);
+    }
+    for (const rel of relationships) {
+        const deps = depMap.get(rel.from);
+        if (deps) {
+            deps.push(rel.to);
+        }
+    }
+    const bomDependencies = Array.from(depMap.entries()).map(([ref, dependsOn]) => ({
+        ref,
+        dependsOn: [...new Set(dependsOn)],
+    }));
+    const { group: rootGroup, name: rootName } = splitScopedName(rootComponent.name);
+    const rootCdxComponent = {
+        type: rootComponent.type,
+        name: rootName,
+        version: rootComponent.version,
+        purl: rootBomRef,
+        'bom-ref': rootBomRef,
+    };
+    if (rootGroup) {
+        rootCdxComponent.group = rootGroup;
+    }
+    if (rootComponent.author) {
+        rootCdxComponent.authors = [{ name: rootComponent.author }];
+    }
+    if (rootComponent.license) {
+        rootCdxComponent.licenses = [classifyLicense(rootComponent.license)];
+    }
+    if (rootComponent.description) {
+        rootCdxComponent.description = rootComponent.description;
+    }
+    if (rootComponent.repository) {
+        rootCdxComponent.externalReferences = [{
+                type: 'vcs',
+                url: rootComponent.repository,
+            }];
+    }
+    const toolComponents = [];
+    if (opts?.pnpmVersion) {
+        toolComponents.push({
+            type: 'application',
+            name: 'pnpm',
+            version: opts.pnpmVersion,
+        });
+    }
+    const metadata = {
+        timestamp: new Date().toISOString(),
+        lifecycles: [{ phase: opts?.lockfileOnly ? 'pre-build' : 'build' }],
+        tools: { components: toolComponents },
+        component: rootCdxComponent,
+    };
+    // authors/supplier describe who authored/supplies the BOM document,
+    // not the tool — opt-in via --sbom-authors and --sbom-supplier
+    if (opts?.sbomAuthors?.length) {
+        metadata.authors = opts.sbomAuthors.map((name) => ({ name }));
+    }
+    if (opts?.sbomSupplier) {
+        metadata.supplier = { name: opts.sbomSupplier };
+    }
+    const bom = {
+        $schema: 'http://cyclonedx.org/schema/bom-1.7.schema.json',
+        bomFormat: 'CycloneDX',
+        specVersion: '1.7',
+        serialNumber: `urn:uuid:${crypto.randomUUID()}`,
+        version: 1,
+        metadata,
+        components: bomComponents,
+        dependencies: bomDependencies,
+    };
+    return JSON.stringify(bom, null, 2);
+}
+function splitScopedName(fullName) {
+    if (fullName.startsWith('@')) {
+        const slashIdx = fullName.indexOf('/');
+        if (slashIdx > 0) {
+            return { group: fullName.slice(0, slashIdx), name: fullName.slice(slashIdx + 1) };
+        }
+    }
+    return { group: undefined, name: fullName };
+}
+//# sourceMappingURL=serializeCycloneDx.js.map

package/lib/serializeSpdx.d.ts

@@ -0,0 +1,2 @@
+import type { SbomResult } from './types.js';
+export declare function serializeSpdx(result: SbomResult): string;

package/lib/serializeSpdx.js

@@ -0,0 +1,145 @@
+import crypto from 'node:crypto';
+import { integrityToHashes } from './integrity.js';
+import { encodePurlName } from './purl.js';
+export function serializeSpdx(result) {
+    const { rootComponent, components, relationships } = result;
+    const rootSpdxId = 'SPDXRef-RootPackage';
+    const documentNamespace = `https://spdx.org/spdxdocs/${sanitizeSpdxId(rootComponent.name)}-${rootComponent.version}-${crypto.randomUUID()}`;
+    const rootPurl = `pkg:npm/${encodePurlName(rootComponent.name)}@${rootComponent.version}`;
+    const rootPackage = {
+        SPDXID: rootSpdxId,
+        name: rootComponent.name,
+        versionInfo: rootComponent.version,
+        downloadLocation: 'NOASSERTION',
+        filesAnalyzed: false,
+        primaryPackagePurpose: rootComponent.type === 'application' ? 'APPLICATION' : 'LIBRARY',
+        externalRefs: [
+            {
+                referenceCategory: 'PACKAGE-MANAGER',
+                referenceType: 'purl',
+                referenceLocator: rootPurl,
+            },
+        ],
+    };
+    if (rootComponent.license) {
+        rootPackage.licenseConcluded = rootComponent.license;
+        rootPackage.licenseDeclared = rootComponent.license;
+    }
+    else {
+        rootPackage.licenseConcluded = 'NOASSERTION';
+        rootPackage.licenseDeclared = 'NOASSERTION';
+    }
+    rootPackage.copyrightText = 'NOASSERTION';
+    if (rootComponent.description) {
+        rootPackage.description = rootComponent.description;
+    }
+    if (rootComponent.author) {
+        rootPackage.supplier = `Person: ${rootComponent.author}`;
+    }
+    if (rootComponent.repository) {
+        rootPackage.homepage = rootComponent.repository;
+    }
+    const purlToSpdxId = new Map();
+    purlToSpdxId.set(rootPurl, rootSpdxId);
+    const spdxPackages = components.map((comp, idx) => {
+        const spdxId = `SPDXRef-Package-${sanitizeSpdxId(comp.name)}-${sanitizeSpdxId(comp.version)}-${idx}`;
+        purlToSpdxId.set(comp.purl, spdxId);
+        const pkg = {
+            SPDXID: spdxId,
+            name: comp.name,
+            versionInfo: comp.version,
+            downloadLocation: comp.tarballUrl ?? 'NOASSERTION',
+            filesAnalyzed: false,
+            externalRefs: [
+                {
+                    referenceCategory: 'PACKAGE-MANAGER',
+                    referenceType: 'purl',
+                    referenceLocator: comp.purl,
+                },
+            ],
+        };
+        if (comp.license) {
+            pkg.licenseConcluded = comp.license;
+            pkg.licenseDeclared = comp.license;
+        }
+        else {
+            pkg.licenseConcluded = 'NOASSERTION';
+            pkg.licenseDeclared = 'NOASSERTION';
+        }
+        pkg.copyrightText = 'NOASSERTION';
+        if (comp.description) {
+            pkg.description = comp.description;
+        }
+        if (comp.homepage) {
+            pkg.homepage = comp.homepage;
+        }
+        if (comp.author) {
+            pkg.supplier = `Person: ${comp.author}`;
+        }
+        const hashes = integrityToHashes(comp.integrity);
+        if (hashes.length > 0) {
+            pkg.checksums = hashes.map((h) => ({
+                algorithm: spdxHashAlgorithm(h.algorithm),
+                checksumValue: h.digest,
+            }));
+        }
+        return pkg;
+    });
+    const spdxRelationships = [
+        {
+            spdxElementId: 'SPDXRef-DOCUMENT',
+            relatedSpdxElement: rootSpdxId,
+            relationshipType: 'DESCRIBES',
+        },
+    ];
+    const seenRelationships = new Set();
+    for (const rel of relationships) {
+        const fromId = purlToSpdxId.get(rel.from);
+        const toId = purlToSpdxId.get(rel.to);
+        if (fromId && toId) {
+            const key = `${fromId}|${toId}`;
+            if (seenRelationships.has(key))
+                continue;
+            seenRelationships.add(key);
+            spdxRelationships.push({
+                spdxElementId: fromId,
+                relatedSpdxElement: toId,
+                relationshipType: 'DEPENDS_ON',
+            });
+        }
+    }
+    const doc = {
+        spdxVersion: 'SPDX-2.3',
+        dataLicense: 'CC0-1.0',
+        SPDXID: 'SPDXRef-DOCUMENT',
+        name: rootComponent.name,
+        documentNamespace,
+        creationInfo: {
+            created: new Date().toISOString(),
+            creators: [
+                'Tool: pnpm',
+            ],
+        },
+        packages: [rootPackage, ...spdxPackages],
+        relationships: spdxRelationships,
+    };
+    return JSON.stringify(doc, null, 2);
+}
+function sanitizeSpdxId(value) {
+    return value.replace(/[^a-z0-9.-]/gi, '-');
+}
+function spdxHashAlgorithm(algo) {
+    switch (algo) {
+        case 'SHA-1':
+            return 'SHA1';
+        case 'SHA-256':
+            return 'SHA256';
+        case 'SHA-384':
+            return 'SHA384';
+        case 'SHA-512':
+            return 'SHA512';
+        default:
+            return algo;
+    }
+}
+//# sourceMappingURL=serializeSpdx.js.map

package/lib/types.d.ts

@@ -0,0 +1,34 @@
+import type { DepType } from '@pnpm/lockfile.detect-dep-types';
+export interface SbomComponent {
+    name: string;
+    version: string;
+    purl: string;
+    depPath: string;
+    depType: DepType;
+    integrity?: string;
+    tarballUrl?: string;
+    license?: string;
+    description?: string;
+    author?: string;
+    homepage?: string;
+    repository?: string;
+}
+export interface SbomRelationship {
+    from: string;
+    to: string;
+}
+export interface SbomResult {
+    rootComponent: {
+        name: string;
+        version: string;
+        type: 'library' | 'application';
+        license?: string;
+        description?: string;
+        author?: string;
+        repository?: string;
+    };
+    components: SbomComponent[];
+    relationships: SbomRelationship[];
+}
+export type SbomFormat = 'cyclonedx' | 'spdx';
+export type SbomComponentType = 'library' | 'application';

package/lib/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "@pnpm/deps.compliance.sbom",
+  "version": "1000.0.0-0",
+  "description": "Generate SBOM from pnpm lockfile",
+  "keywords": [
+    "pnpm",
+    "pnpm11",
+    "cyclonedx",
+    "sbom",
+    "spdx"
+  ],
+  "license": "MIT",
+  "funding": "https://opencollective.com/pnpm",
+  "repository": "https://github.com/pnpm/pnpm/tree/main/deps/compliance/sbom",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/deps/compliance/sbom#readme",
+  "bugs": {
+    "url": "https://github.com/pnpm/pnpm/issues"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": "./lib/index.js"
+  },
+  "files": [
+    "lib",
+    "!*.map"
+  ],
+  "dependencies": {
+    "@cyclonedx/cyclonedx-library": "9.4.1",
+    "p-limit": "^7.1.0",
+    "ssri": "13.0.0",
+    "@pnpm/lockfile.detect-dep-types": "1001.0.16",
+    "@pnpm/lockfile.utils": "1003.0.3",
+    "@pnpm/lockfile.types": "1002.0.2",
+    "@pnpm/pkg-manifest.reader": "1000.1.2",
+    "@pnpm/types": "1000.9.0",
+    "@pnpm/lockfile.walker": "1001.0.16",
+    "@pnpm/store.index": "1000.0.0-0",
+    "@pnpm/store.pkg-finder": "1000.0.0-0"
+  },
+  "peerDependencies": {
+    "@pnpm/logger": ">=1001.0.0 <1002.0.0"
+  },
+  "devDependencies": {
+    "@jest/globals": "30.0.5",
+    "@types/ssri": "^7.1.5",
+    "@pnpm/deps.compliance.sbom": "1000.0.0-0",
+    "@pnpm/logger": "1001.0.1"
+  },
+  "engines": {
+    "node": ">=22.13"
+  },
+  "jest": {
+    "preset": "@pnpm/jest-config"
+  },
+  "scripts": {
+    "test": "pnpm run compile && pnpm run _test",
+    "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
+    "_test": "cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest",
+    "compile": "tsgo --build && pnpm run lint --fix"
+  }
+}