@pnpm/deps.compliance.sbom 1100.3.2 → 1100.3.4

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @pnpm/deps.compliance.sbom
 
+## 1100.3.4
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/store.pkg-finder@1100.0.21
+
+## 1100.3.3
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/lockfile.detect-dep-types@1100.0.14
+  - @pnpm/lockfile.types@1100.0.14
+  - @pnpm/lockfile.utils@1100.1.3
+  - @pnpm/lockfile.walker@1100.0.14
+  - @pnpm/pkg-manifest.reader@1100.0.10
+  - @pnpm/resolving.resolver-base@1100.5.2
+  - @pnpm/store.pkg-finder@1100.0.20
+  - @pnpm/types@1101.4.0
+
 ## 1100.3.2
 
 ### Patch Changes

package/LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2015-2016 Rico Sta. Cruz and other contributors
+Copyright (c) 2016-2026 Zoltan Kochan and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.compliance.sbom",
-  "version": "1100.3.2",
+  "version": "1100.3.4",
   "description": "Generate SBOM from pnpm lockfile",
   "keywords": [
     "pnpm",
@@ -32,15 +32,15 @@
   "dependencies": {
     "@cyclonedx/cyclonedx-library": "10.1.0",
     "@pnpm/deps.compliance.license-resolver": "1100.0.0",
-    "@pnpm/lockfile.detect-dep-types": "1100.0.13",
-    "@pnpm/lockfile.types": "1100.0.13",
-    "@pnpm/lockfile.utils": "1100.1.2",
-    "@pnpm/lockfile.walker": "1100.0.13",
-    "@pnpm/pkg-manifest.reader": "1100.0.9",
-    "@pnpm/resolving.resolver-base": "1100.5.1",
+    "@pnpm/lockfile.detect-dep-types": "1100.0.14",
+    "@pnpm/lockfile.types": "1100.0.14",
+    "@pnpm/lockfile.utils": "1100.1.3",
+    "@pnpm/lockfile.walker": "1100.0.14",
+    "@pnpm/pkg-manifest.reader": "1100.0.10",
+    "@pnpm/resolving.resolver-base": "1100.5.2",
     "@pnpm/store.index": "1100.2.1",
-    "@pnpm/store.pkg-finder": "1100.0.19",
-    "@pnpm/types": "1101.3.2",
+    "@pnpm/store.pkg-finder": "1100.0.21",
+    "@pnpm/types": "1101.4.0",
     "p-limit": "^7.3.0",
     "ssri": "13.0.1"
   },
@@ -49,9 +49,9 @@
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/deps.compliance.sbom": "1100.3.2",
+    "@pnpm/deps.compliance.sbom": "1100.3.4",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/store.cafs": "1100.1.12",
+    "@pnpm/store.cafs": "1100.1.13",
     "@types/ssri": "^7.1.5"
   },
   "engines": {

package/lib/collectComponents.d.ts

@@ -1,50 +0,0 @@
-import type { LockfileObject } from '@pnpm/lockfile.types';
-import type { Resolution } from '@pnpm/resolving.resolver-base';
-import type { DependenciesField, ProjectId, Registries } from '@pnpm/types';
-import type { SbomComponentType, SbomResult } from './types.js';
-export interface WorkspacePackageInfo {
-    name: string;
-    version: string;
-    license?: string;
-    description?: string;
-    author?: string;
-    repository?: string;
-}
-export interface CollectSbomComponentsOptions {
-    lockfile: LockfileObject;
-    rootName: string;
-    rootVersion: string;
-    rootLicense?: string;
-    rootDescription?: string;
-    rootAuthor?: string;
-    rootRepository?: string;
-    rootBugsUrl?: string;
-    sbomType?: SbomComponentType;
-    include?: {
-        [dependenciesField in DependenciesField]: boolean;
-    };
-    registries: Registries;
-    lockfileDir: string;
-    includedImporterIds?: ProjectId[];
-    lockfileOnly?: boolean;
-    storeDir?: string;
-    virtualStoreDirMaxLength?: number;
-    workspacePackages?: Record<ProjectId, WorkspacePackageInfo>;
-    resolvedWorkspaceDeps?: ReturnType<typeof resolveWorkspaceDeps>;
-    excludePeerNamesByImporter?: Map<string, Set<string>>;
-}
-export declare function collectSbomComponents(opts: CollectSbomComponentsOptions): Promise<SbomResult>;
-export declare function gitDownloadUrl(resolution: Resolution): string | undefined;
-interface WorkspaceLink {
-    sourceImporterId: ProjectId;
-    targetImporterId: ProjectId;
-    depName: string;
-    devOnly: boolean;
-}
-export declare function resolveWorkspaceDeps(lockfile: LockfileObject, importerIds: ProjectId[], include?: {
-    [dependenciesField in DependenciesField]: boolean;
-}): {
-    links: WorkspaceLink[];
-    additionalImporterIds: ProjectId[];
-};
-export {};

package/lib/collectComponents.js

@@ -1,209 +0,0 @@
-import path from 'node:path';
-import { DepType, detectDepTypes } from '@pnpm/lockfile.detect-dep-types';
-import { nameVerFromPkgSnapshot, pkgSnapshotToResolution } from '@pnpm/lockfile.utils';
-import { lockfileWalkerGroupImporterSteps, } from '@pnpm/lockfile.walker';
-import { StoreIndex } from '@pnpm/store.index';
-import pLimit from 'p-limit';
-import { getPkgMetadata } from './getPkgMetadata.js';
-import { buildPurl, encodePurlName } from './purl.js';
-const IMPORTER_WALK_CONCURRENCY = 8;
-export async function collectSbomComponents(opts) {
-    const depTypes = detectDepTypes(opts.lockfile);
-    const importerIds = opts.includedImporterIds ?? Object.keys(opts.lockfile.importers);
-    const componentsMap = new Map();
-    const relationships = [];
-    const rootPurl = `pkg:npm/${encodePurlName(opts.rootName)}@${opts.rootVersion}`;
-    const workspaceDeps = opts.resolvedWorkspaceDeps
-        ?? (opts.lockfileOnly
-            ? { links: [], additionalImporterIds: [] }
-            : resolveWorkspaceDeps(opts.lockfile, importerIds, opts.include));
-    const allImporterIds = [...importerIds, ...workspaceDeps.additionalImporterIds];
-    // When excluding peers, walk each importer with its own `walked` set so one
-    // importer's peer can't suppress another's real dependency.
-    const importerWalkers = opts.excludePeerNamesByImporter
-        ? allImporterIds.flatMap((importerId) => lockfileWalkerGroupImporterSteps(opts.lockfile, [importerId], { include: opts.include }))
-        : lockfileWalkerGroupImporterSteps(opts.lockfile, allImporterIds, { include: opts.include });
-    const importerIdSet = new Set(importerIds);
-    if (opts.workspacePackages) {
-        const workspaceDepTypes = new Map();
-        for (const dep of workspaceDeps.links) {
-            const info = opts.workspacePackages[dep.targetImporterId];
-            if (!info)
-                continue;
-            const purl = buildPurl({ name: info.name, version: info.version });
-            const current = workspaceDepTypes.get(purl);
-            if (!dep.devOnly) {
-                workspaceDepTypes.set(purl, DepType.ProdOnly);
-            }
-            else if (current === undefined) {
-                workspaceDepTypes.set(purl, DepType.DevOnly);
-            }
-        }
-        for (const dep of workspaceDeps.links) {
-            const info = opts.workspacePackages[dep.targetImporterId];
-            if (!info)
-                continue;
-            const purl = buildPurl({ name: info.name, version: info.version });
-            let parentPurl;
-            if (importerIdSet.has(dep.sourceImporterId)) {
-                parentPurl = rootPurl;
-            }
-            else {
-                const sourceInfo = opts.workspacePackages[dep.sourceImporterId];
-                parentPurl = sourceInfo
-                    ? buildPurl({ name: sourceInfo.name, version: sourceInfo.version })
-                    : rootPurl;
-            }
-            relationships.push({ from: parentPurl, to: purl });
-            if (!componentsMap.has(purl)) {
-                componentsMap.set(purl, {
-                    name: info.name,
-                    version: info.version,
-                    purl,
-                    depPath: `link:${dep.targetImporterId}`,
-                    depType: workspaceDepTypes.get(purl) ?? DepType.ProdOnly,
-                    license: info.license,
-                    description: info.description,
-                    author: info.author,
-                    repository: info.repository,
-                });
-            }
-        }
-    }
-    const storeIndex = (!opts.lockfileOnly && opts.storeDir)
-        ? new StoreIndex(opts.storeDir)
-        : undefined;
-    const metadataOpts = (storeIndex && opts.storeDir)
-        ? {
-            storeDir: opts.storeDir,
-            storeIndex,
-            lockfileDir: opts.lockfileDir,
-            virtualStoreDirMaxLength: opts.virtualStoreDirMaxLength ?? 120,
-        }
-        : undefined;
-    const walkImporter = pLimit(IMPORTER_WALK_CONCURRENCY);
-    await Promise.all(importerWalkers.map(({ importerId, step }) => walkImporter(async () => {
-        let parentPurl = rootPurl;
-        if (!importerIdSet.has(importerId)) {
-            const info = opts.workspacePackages?.[importerId];
-            // A reachable workspace importer with no resolved package info (e.g. its
-            // manifest could not be read) is skipped entirely; walking it would
-            // misattribute its dependencies to the root component.
-            if (!info)
-                return;
-            parentPurl = buildPurl({ name: info.name, version: info.version });
-        }
-        // Drop this importer's peer entries before walking. With the per-importer
-        // walk above, this prunes a peer's exclusive subtree without hiding a
-        // package that is also a real dependency here or in another importer.
-        const peerNames = opts.excludePeerNamesByImporter?.get(importerId);
-        const filteredStep = (peerNames?.size)
-            ? {
-                ...step,
-                dependencies: step.dependencies.filter((dep) => {
-                    const { name } = nameVerFromPkgSnapshot(dep.depPath, dep.pkgSnapshot);
-                    return !name || !peerNames.has(name);
-                }),
-            }
-            : step;
-        await walkStep(filteredStep, parentPurl, depTypes, componentsMap, relationships, opts, metadataOpts);
-    })));
-    storeIndex?.close();
-    return {
-        rootComponent: {
-            name: opts.rootName,
-            version: opts.rootVersion,
-            type: opts.sbomType ?? 'library',
-            license: opts.rootLicense,
-            description: opts.rootDescription,
-            author: opts.rootAuthor,
-            repository: opts.rootRepository,
-            bugsUrl: opts.rootBugsUrl,
-        },
-        components: Array.from(componentsMap.values()),
-        relationships,
-    };
-}
-async function walkStep(step, parentPurl, depTypes, componentsMap, relationships, opts, metadataOpts) {
-    await Promise.all(step.dependencies.map(async (dep) => {
-        const { depPath, pkgSnapshot, next } = dep;
-        const { name, version, nonSemverVersion } = nameVerFromPkgSnapshot(depPath, pkgSnapshot);
-        if (!name || !version)
-            return;
-        const purl = buildPurl({ name, version, nonSemverVersion: nonSemverVersion ?? undefined });
-        relationships.push({ from: parentPurl, to: purl });
-        if (componentsMap.has(purl))
-            return;
-        const integrity = pkgSnapshot.resolution.integrity;
-        const resolution = pkgSnapshotToResolution(depPath, pkgSnapshot, opts.registries);
-        const tarballUrl = resolution.tarball ?? gitDownloadUrl(resolution);
-        let metadata = {};
-        if (metadataOpts) {
-            metadata = await getPkgMetadata(depPath, pkgSnapshot, opts.registries, metadataOpts);
-        }
-        const component = {
-            name,
-            version,
-            purl,
-            depPath,
-            depType: depTypes[depPath] ?? DepType.ProdOnly,
-            integrity,
-            tarballUrl,
-            ...metadata,
-        };
-        componentsMap.set(purl, component);
-        const subStep = next();
-        await walkStep(subStep, purl, depTypes, componentsMap, relationships, opts, metadataOpts);
-    }));
-}
-export function gitDownloadUrl(resolution) {
-    if (resolution.type !== 'git')
-        return undefined;
-    const needsGitPlusPrefix = resolution.repo.includes('://') && !resolution.repo.startsWith('git+');
-    const prefix = needsGitPlusPrefix ? 'git+' : '';
-    return `${prefix}${resolution.repo}#${resolution.commit}`;
-}
-export function resolveWorkspaceDeps(lockfile, importerIds, include) {
-    const links = [];
-    const visited = new Set(importerIds);
-    const queue = [...importerIds];
-    const additionalImporterIds = [];
-    for (let head = 0; head < queue.length; head++) {
-        const importerId = queue[head];
-        const snapshot = lockfile.importers[importerId];
-        if (!snapshot)
-            continue;
-        const devDepNames = new Set(Object.keys(snapshot.devDependencies ?? {}));
-        const prodDeps = {
-            ...(include?.dependencies !== false ? snapshot.dependencies : {}),
-            ...(include?.optionalDependencies !== false ? snapshot.optionalDependencies : {}),
-        };
-        const allDeps = {
-            ...prodDeps,
-            ...(include?.devDependencies !== false ? snapshot.devDependencies : {}),
-        };
-        for (const [depName, reference] of Object.entries(allDeps)) {
-            if (!reference.startsWith('link:'))
-                continue;
-            const linkPath = reference.slice(5);
-            const targetId = path.posix.normalize(importerId === '.' ? linkPath : path.posix.join(importerId, linkPath));
-            // A crafted lockfile can point a `link:` target outside the workspace root;
-            // such importer IDs must never be followed, as they later become filesystem reads.
-            if (path.posix.isAbsolute(targetId) || targetId === '..' || targetId.startsWith('../'))
-                continue;
-            // `in` would also match inherited keys (e.g. "toString"); a crafted lockfile
-            // must not be able to enqueue importer IDs that are not actually present.
-            if (!Object.prototype.hasOwnProperty.call(lockfile.importers, targetId))
-                continue;
-            const devOnly = devDepNames.has(depName) && !(depName in prodDeps);
-            links.push({ sourceImporterId: importerId, targetImporterId: targetId, depName, devOnly });
-            if (!visited.has(targetId)) {
-                visited.add(targetId);
-                additionalImporterIds.push(targetId);
-                queue.push(targetId);
-            }
-        }
-    }
-    return { links, additionalImporterIds };
-}
-//# sourceMappingURL=collectComponents.js.map

package/lib/getPkgMetadata.d.ts

@@ -1,19 +0,0 @@
-import { type PackageSnapshot } from '@pnpm/lockfile.utils';
-import type { StoreIndex } from '@pnpm/store.index';
-import type { DepPath, Registries } from '@pnpm/types';
-export interface PkgMetadata {
-    license?: string;
-    description?: string;
-    author?: string;
-    homepage?: string;
-    repository?: string;
-    bugsUrl?: string;
-}
-export interface GetPkgMetadataOptions {
-    storeDir: string;
-    storeIndex: StoreIndex;
-    lockfileDir: string;
-    virtualStoreDirMaxLength: number;
-}
-export declare function getPkgMetadata(depPath: DepPath, snapshot: PackageSnapshot, registries: Registries, opts: GetPkgMetadataOptions): Promise<PkgMetadata>;
-export declare function bugsUrlFromField(field: unknown): string | undefined;

package/lib/getPkgMetadata.js

@@ -1,109 +0,0 @@
-import { isSpdxLicenseExpression, resolveLicense } from '@pnpm/deps.compliance.license-resolver';
-import { packageIdFromSnapshot, pkgSnapshotToResolution } from '@pnpm/lockfile.utils';
-import { readPackageJson } from '@pnpm/pkg-manifest.reader';
-import { readPackageFileMap } from '@pnpm/store.pkg-finder';
-import pLimit from 'p-limit';
-const limitMetadataReads = pLimit(4);
-export async function getPkgMetadata(depPath, snapshot, registries, opts) {
-    return limitMetadataReads(() => getPkgMetadataUnclamped(depPath, snapshot, registries, opts));
-}
-async function getPkgMetadataUnclamped(depPath, snapshot, registries, opts) {
-    const id = packageIdFromSnapshot(depPath, snapshot);
-    const resolution = pkgSnapshotToResolution(depPath, snapshot, registries);
-    let files;
-    try {
-        const result = await readPackageFileMap(resolution, id, opts);
-        if (!result)
-            return {};
-        files = result;
-    }
-    catch {
-        return {};
-    }
-    const manifestPath = files.get('package.json');
-    if (!manifestPath)
-        return {};
-    const manifest = await readPackageJson(manifestPath);
-    return extractMetadata(manifest, files);
-}
-async function extractMetadata(manifest, files) {
-    const license = await resolveLicense({ manifest, files });
-    return {
-        license: serializableLicense(license),
-        description: manifest.description,
-        author: parseAuthorField(manifest.author),
-        homepage: manifest.homepage,
-        repository: parseRepositoryField(manifest.repository),
-        bugsUrl: bugsUrlFromField(manifest.bugs),
-    };
-}
-// Drop:
-//   - missing / "Unknown" — so serializers emit NOASSERTION / absence.
-//   - LICENSE-file-detected values that aren't SPDX-valid (e.g. "Eclipse Public
-//     License 1.0") — would produce non-compliant SPDX output. Manifest-declared
-//     licenses are trusted as-is; authors use SPDX expressions there.
-function serializableLicense(license) {
-    if (!license || license.name === 'Unknown')
-        return undefined;
-    if (license.licenseFile && !isSpdxLicenseExpression(license.name))
-        return undefined;
-    return license.name;
-}
-function parseAuthorField(field) {
-    if (!field)
-        return undefined;
-    if (typeof field === 'string')
-        return field;
-    if (typeof field === 'object' && 'name' in field) {
-        return field.name;
-    }
-    return undefined;
-}
-function parseRepositoryField(field) {
-    if (!field)
-        return undefined;
-    if (typeof field === 'string')
-        return field;
-    if (typeof field === 'object' && 'url' in field) {
-        return field.url;
-    }
-    return undefined;
-}
-// `bugs` may be a URL string, a bare email, or `{ url, email }`. The CycloneDX
-// issue-tracker reference expects a URL, so parse the candidate and keep it only
-// when it is a well-formed http(s) URL — dropping email-only bug contacts and
-// malformed values like "https://". Exported so the command's root-package
-// handling uses the same rule.
-export function bugsUrlFromField(field) {
-    let candidate;
-    if (typeof field === 'string') {
-        candidate = field.trim();
-    }
-    else if (field && typeof field === 'object' && 'url' in field) {
-        const value = field.url;
-        if (typeof value === 'string')
-            candidate = value.trim();
-    }
-    if (!candidate)
-        return undefined;
-    let parsed;
-    try {
-        parsed = new URL(candidate);
-    }
-    catch {
-        return undefined;
-    }
-    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
-        return undefined;
-    // Drop any embedded credentials: an SBOM is a shareable/published artifact,
-    // so a `bugs` URL like `https://user:token@tracker/...` must not leak the
-    // secret into externalReferences[].url. The tracker URL itself is still useful.
-    parsed.username = '';
-    parsed.password = '';
-    // Emit the normalized URL, not the raw input: `new URL` strips CR/LF/tab and
-    // percent-encodes spaces and control characters, so a crafted `bugs` value
-    // can't push raw whitespace or control chars into the CycloneDX
-    // `externalReferences[].url` (whose format is an `iri-reference`).
-    return parsed.href;
-}
-//# sourceMappingURL=getPkgMetadata.js.map

package/lib/index.d.ts

@@ -1,7 +0,0 @@
-export { collectSbomComponents, type CollectSbomComponentsOptions, gitDownloadUrl, resolveWorkspaceDeps, type WorkspacePackageInfo } from './collectComponents.js';
-export { bugsUrlFromField } from './getPkgMetadata.js';
-export { integrityToHashes } from './integrity.js';
-export { buildPurl, encodePurlName } from './purl.js';
-export { type CycloneDxOptions, serializeCycloneDx } from './serializeCycloneDx.js';
-export { serializeSpdx } from './serializeSpdx.js';
-export type { SbomComponent, SbomComponentType, SbomFormat, SbomRelationship, SbomResult } from './types.js';

package/lib/integrity.d.ts

@@ -1,9 +0,0 @@
-export interface HashDigest {
-    algorithm: string;
-    digest: string;
-}
-/**
- * Convert an SRI integrity string to a list of algorithm + hex digest pairs.
- * e.g. "sha512-abc123..." → [{ algorithm: "SHA-512", digest: "..." }]
- */
-export declare function integrityToHashes(integrity: string | undefined): HashDigest[];

package/lib/integrity.js

@@ -1,38 +0,0 @@
-import ssri from 'ssri';
-/**
- * Convert an SRI integrity string to a list of algorithm + hex digest pairs.
- * e.g. "sha512-abc123..." → [{ algorithm: "SHA-512", digest: "..." }]
- */
-export function integrityToHashes(integrity) {
-    if (!integrity)
-        return [];
-    const parsed = ssri.parse(integrity);
-    const hashes = [];
-    for (const [algo, entries] of Object.entries(parsed)) {
-        if (!entries?.length)
-            continue;
-        for (const entry of entries) {
-            const hexDigest = Buffer.from(entry.digest, 'base64').toString('hex');
-            hashes.push({
-                algorithm: normalizeShaAlgorithm(algo),
-                digest: hexDigest,
-            });
-        }
-    }
-    return hashes;
-}
-function normalizeShaAlgorithm(algo) {
-    switch (algo) {
-        case 'sha1':
-            return 'SHA-1';
-        case 'sha256':
-            return 'SHA-256';
-        case 'sha384':
-            return 'SHA-384';
-        case 'sha512':
-            return 'SHA-512';
-        default:
-            return algo.toUpperCase();
-    }
-}
-//# sourceMappingURL=integrity.js.map

package/lib/license.d.ts

@@ -1,11 +0,0 @@
-export declare function classifyLicense(license: string): {
-    license: {
-        id: string;
-    };
-} | {
-    license: {
-        name: string;
-    };
-} | {
-    expression: string;
-};

package/lib/license.js

@@ -1,23 +0,0 @@
-// Sub-path import to pull only the SPDX module — avoids dragging in the
-// validation/serialize layers with optional native deps that break esbuild bundling.
-import { fixupSpdxId, isSupportedSpdxId } from '@cyclonedx/cyclonedx-library/SPDX';
-// Classifies a license string into the appropriate CycloneDX representation.
-// Uses the CycloneDX library's own SPDX list rather than spdx-license-ids,
-// since CycloneDX maintains its own subset of recognized IDs.
-// Order matters: check ID first because "MIT" matches both isSupportedSpdxId
-// and isSpdxExpression, but we prefer the more specific license.id form.
-export function classifyLicense(license) {
-    const fixedId = fixupSpdxId(license);
-    if (fixedId != null && isSupportedSpdxId(fixedId)) {
-        return { license: { id: fixedId } };
-    }
-    if (isSpdxExpression(license)) {
-        return { expression: license };
-    }
-    return { license: { name: license } };
-}
-// Checks if a string looks like an SPDX license expression (compound with operators).
-function isSpdxExpression(license) {
-    return /\b(?:AND|OR|WITH)\b/.test(license);
-}
-//# sourceMappingURL=license.js.map

package/lib/purl.d.ts

@@ -1,14 +0,0 @@
-/**
- * Encode a package name for use in a PURL.
- * Scoped packages: @scope/name → %40scope/name
- */
-export declare function encodePurlName(name: string): string;
-/**
- * Build a Package URL (PURL) for a given package.
- * Spec: https://github.com/package-url/purl-spec
- */
-export declare function buildPurl(opts: {
-    name: string;
-    version: string;
-    nonSemverVersion?: string;
-}): string;

package/lib/purl.js

@@ -1,23 +0,0 @@
-/**
- * Encode a package name for use in a PURL.
- * Scoped packages: @scope/name → %40scope/name
- */
-export function encodePurlName(name) {
-    if (name.startsWith('@')) {
-        return `%40${name.slice(1)}`;
-    }
-    return name;
-}
-/**
- * Build a Package URL (PURL) for a given package.
- * Spec: https://github.com/package-url/purl-spec
- */
-export function buildPurl(opts) {
-    if (opts.nonSemverVersion) {
-        // Git-hosted or tarball dep — encode the raw version as a qualifier
-        const encodedUrl = encodeURIComponent(opts.nonSemverVersion);
-        return `pkg:npm/${encodePurlName(opts.name)}@${encodeURIComponent(opts.version)}?vcs_url=${encodedUrl}`;
-    }
-    return `pkg:npm/${encodePurlName(opts.name)}@${opts.version}`;
-}
-//# sourceMappingURL=purl.js.map

package/lib/serializeCycloneDx.d.ts

@@ -1,10 +0,0 @@
-import type { SbomResult } from './types.js';
-export interface CycloneDxOptions {
-    pnpmVersion?: string;
-    lockfileOnly?: boolean;
-    sbomAuthors?: string[];
-    sbomSupplier?: string;
-    specVersion?: string;
-    compact?: boolean;
-}
-export declare function serializeCycloneDx(result: SbomResult, opts?: CycloneDxOptions): string;

package/lib/serializeCycloneDx.js

@@ -1,174 +0,0 @@
-import crypto from 'node:crypto';
-import { DepType } from '@pnpm/lockfile.detect-dep-types';
-import { integrityToHashes } from './integrity.js';
-import { classifyLicense } from './license.js';
-import { encodePurlName } from './purl.js';
-export function serializeCycloneDx(result, opts) {
-    const { rootComponent, components, relationships } = result;
-    const rootBomRef = `pkg:npm/${encodePurlName(rootComponent.name)}@${rootComponent.version}`;
-    const bomComponents = components.map((comp) => {
-        const { group, name } = splitScopedName(comp.name);
-        const cdxComp = {
-            type: 'library',
-            name,
-            version: comp.version,
-            purl: comp.purl,
-            'bom-ref': comp.purl,
-        };
-        // CycloneDX `excluded` scope (valid in every exported spec version):
-        // "component usage for test and other non-runtime purposes", which is the
-        // semantics of a devDependency.
-        // Components reachable through prod (ProdOnly/DevAndProd) omit scope and
-        // default to `required`. Installed optionalDependencies are runtime-reachable,
-        // so they stay `required` too, not `optional`.
-        if (comp.depType === DepType.DevOnly) {
-            cdxComp.scope = 'excluded';
-            // Also emit the CycloneDX npm-taxonomy marker. `scope` is the modern
-            // signal; `cdx:npm:package:development` is what @cyclonedx/cyclonedx-npm
-            // emits and what older consumers read, so we provide both.
-            cdxComp.properties = [{ name: 'cdx:npm:package:development', value: 'true' }];
-        }
-        if (group) {
-            cdxComp.group = group;
-        }
-        if (comp.description) {
-            cdxComp.description = comp.description;
-        }
-        // CycloneDX supplier is the registry/distributor, not the package author
-        if (comp.author) {
-            cdxComp.authors = [{ name: comp.author }];
-        }
-        if (comp.license) {
-            cdxComp.licenses = [classifyLicense(comp.license)];
-        }
-        const externalRefs = [];
-        // Lockfile integrity is a tarball hash, not a source hash — belongs on the
-        // distribution reference, not component.hashes
-        if (comp.tarballUrl) {
-            const hashes = integrityToHashes(comp.integrity);
-            const distRef = {
-                type: 'distribution',
-                url: comp.tarballUrl,
-            };
-            if (hashes.length > 0) {
-                distRef.hashes = hashes.map((h) => ({
-                    alg: h.algorithm,
-                    content: h.digest,
-                }));
-            }
-            externalRefs.push(distRef);
-        }
-        if (comp.homepage) {
-            externalRefs.push({
-                type: 'website',
-                url: comp.homepage,
-            });
-        }
-        if (comp.repository) {
-            externalRefs.push({
-                type: 'vcs',
-                url: comp.repository,
-            });
-        }
-        if (comp.bugsUrl) {
-            externalRefs.push({
-                type: 'issue-tracker',
-                url: comp.bugsUrl,
-            });
-        }
-        if (externalRefs.length > 0) {
-            cdxComp.externalReferences = externalRefs;
-        }
-        return cdxComp;
-    });
-    // Group relationships by source
-    const depMap = new Map();
-    depMap.set(rootBomRef, []);
-    for (const comp of components) {
-        depMap.set(comp.purl, []);
-    }
-    for (const rel of relationships) {
-        const deps = depMap.get(rel.from);
-        if (deps) {
-            deps.push(rel.to);
-        }
-    }
-    const bomDependencies = Array.from(depMap.entries()).map(([ref, dependsOn]) => ({
-        ref,
-        dependsOn: [...new Set(dependsOn)],
-    }));
-    const { group: rootGroup, name: rootName } = splitScopedName(rootComponent.name);
-    const rootCdxComponent = {
-        type: rootComponent.type,
-        name: rootName,
-        version: rootComponent.version,
-        purl: rootBomRef,
-        'bom-ref': rootBomRef,
-    };
-    if (rootGroup) {
-        rootCdxComponent.group = rootGroup;
-    }
-    if (rootComponent.author) {
-        rootCdxComponent.authors = [{ name: rootComponent.author }];
-    }
-    if (rootComponent.license) {
-        rootCdxComponent.licenses = [classifyLicense(rootComponent.license)];
-    }
-    if (rootComponent.description) {
-        rootCdxComponent.description = rootComponent.description;
-    }
-    const rootExternalRefs = [];
-    if (rootComponent.repository) {
-        rootExternalRefs.push({ type: 'vcs', url: rootComponent.repository });
-    }
-    if (rootComponent.bugsUrl) {
-        rootExternalRefs.push({ type: 'issue-tracker', url: rootComponent.bugsUrl });
-    }
-    if (rootExternalRefs.length > 0) {
-        rootCdxComponent.externalReferences = rootExternalRefs;
-    }
-    const toolComponents = [];
-    if (opts?.pnpmVersion) {
-        toolComponents.push({
-            type: 'application',
-            name: 'pnpm',
-            version: opts.pnpmVersion,
-        });
-    }
-    const metadata = {
-        timestamp: new Date().toISOString(),
-        lifecycles: [{ phase: opts?.lockfileOnly ? 'pre-build' : 'build' }],
-        tools: { components: toolComponents },
-        component: rootCdxComponent,
-    };
-    // authors/supplier describe who authored/supplies the BOM document,
-    // not the tool — opt-in via --sbom-authors and --sbom-supplier
-    if (opts?.sbomAuthors?.length) {
-        metadata.authors = opts.sbomAuthors.map((name) => ({ name }));
-    }
-    if (opts?.sbomSupplier) {
-        metadata.supplier = { name: opts.sbomSupplier };
-    }
-    const version = opts?.specVersion || '1.7';
-    const bom = {
-        $schema: `http://cyclonedx.org/schema/bom-${version}.schema.json`,
-        bomFormat: 'CycloneDX',
-        specVersion: version,
-        serialNumber: `urn:uuid:${crypto.randomUUID()}`,
-        version: 1,
-        metadata,
-        components: bomComponents,
-        dependencies: bomDependencies,
-    };
-    return JSON.stringify(bom, null, opts?.compact ? undefined : 2);
-}
-function splitScopedName(fullName) {
-    if (fullName.startsWith('@')) {
-        const slashIdx = fullName.indexOf('/');
-        if (slashIdx > 0) {
-            return { group: fullName.slice(0, slashIdx), name: fullName.slice(slashIdx + 1) };
-        }
-    }
-    return { group: undefined, name: fullName };
-}
-//# sourceMappingURL=serializeCycloneDx.js.map

package/lib/serializeSpdx.d.ts

@@ -1,5 +0,0 @@
-import type { SbomResult } from './types.js';
-export interface SpdxOptions {
-    compact?: boolean;
-}
-export declare function serializeSpdx(result: SbomResult, opts?: SpdxOptions): string;

package/lib/serializeSpdx.js

@@ -1,145 +0,0 @@
-import crypto from 'node:crypto';
-import { integrityToHashes } from './integrity.js';
-import { encodePurlName } from './purl.js';
-export function serializeSpdx(result, opts) {
-    const { rootComponent, components, relationships } = result;
-    const rootSpdxId = 'SPDXRef-RootPackage';
-    const documentNamespace = `https://spdx.org/spdxdocs/${sanitizeSpdxId(rootComponent.name)}-${rootComponent.version}-${crypto.randomUUID()}`;
-    const rootPurl = `pkg:npm/${encodePurlName(rootComponent.name)}@${rootComponent.version}`;
-    const rootPackage = {
-        SPDXID: rootSpdxId,
-        name: rootComponent.name,
-        versionInfo: rootComponent.version,
-        downloadLocation: 'NOASSERTION',
-        filesAnalyzed: false,
-        primaryPackagePurpose: rootComponent.type === 'application' ? 'APPLICATION' : 'LIBRARY',
-        externalRefs: [
-            {
-                referenceCategory: 'PACKAGE-MANAGER',
-                referenceType: 'purl',
-                referenceLocator: rootPurl,
-            },
-        ],
-    };
-    if (rootComponent.license) {
-        rootPackage.licenseConcluded = rootComponent.license;
-        rootPackage.licenseDeclared = rootComponent.license;
-    }
-    else {
-        rootPackage.licenseConcluded = 'NOASSERTION';
-        rootPackage.licenseDeclared = 'NOASSERTION';
-    }
-    rootPackage.copyrightText = 'NOASSERTION';
-    if (rootComponent.description) {
-        rootPackage.description = rootComponent.description;
-    }
-    if (rootComponent.author) {
-        rootPackage.supplier = `Person: ${rootComponent.author}`;
-    }
-    if (rootComponent.repository) {
-        rootPackage.homepage = rootComponent.repository;
-    }
-    const purlToSpdxId = new Map();
-    purlToSpdxId.set(rootPurl, rootSpdxId);
-    const spdxPackages = components.map((comp, idx) => {
-        const spdxId = `SPDXRef-Package-${sanitizeSpdxId(comp.name)}-${sanitizeSpdxId(comp.version)}-${idx}`;
-        purlToSpdxId.set(comp.purl, spdxId);
-        const pkg = {
-            SPDXID: spdxId,
-            name: comp.name,
-            versionInfo: comp.version,
-            downloadLocation: comp.tarballUrl ?? 'NOASSERTION',
-            filesAnalyzed: false,
-            externalRefs: [
-                {
-                    referenceCategory: 'PACKAGE-MANAGER',
-                    referenceType: 'purl',
-                    referenceLocator: comp.purl,
-                },
-            ],
-        };
-        if (comp.license) {
-            pkg.licenseConcluded = comp.license;
-            pkg.licenseDeclared = comp.license;
-        }
-        else {
-            pkg.licenseConcluded = 'NOASSERTION';
-            pkg.licenseDeclared = 'NOASSERTION';
-        }
-        pkg.copyrightText = 'NOASSERTION';
-        if (comp.description) {
-            pkg.description = comp.description;
-        }
-        if (comp.homepage) {
-            pkg.homepage = comp.homepage;
-        }
-        if (comp.author) {
-            pkg.supplier = `Person: ${comp.author}`;
-        }
-        const hashes = integrityToHashes(comp.integrity);
-        if (hashes.length > 0) {
-            pkg.checksums = hashes.map((h) => ({
-                algorithm: spdxHashAlgorithm(h.algorithm),
-                checksumValue: h.digest,
-            }));
-        }
-        return pkg;
-    });
-    const spdxRelationships = [
-        {
-            spdxElementId: 'SPDXRef-DOCUMENT',
-            relatedSpdxElement: rootSpdxId,
-            relationshipType: 'DESCRIBES',
-        },
-    ];
-    const seenRelationships = new Set();
-    for (const rel of relationships) {
-        const fromId = purlToSpdxId.get(rel.from);
-        const toId = purlToSpdxId.get(rel.to);
-        if (fromId && toId) {
-            const key = `${fromId}|${toId}`;
-            if (seenRelationships.has(key))
-                continue;
-            seenRelationships.add(key);
-            spdxRelationships.push({
-                spdxElementId: fromId,
-                relatedSpdxElement: toId,
-                relationshipType: 'DEPENDS_ON',
-            });
-        }
-    }
-    const doc = {
-        spdxVersion: 'SPDX-2.3',
-        dataLicense: 'CC0-1.0',
-        SPDXID: 'SPDXRef-DOCUMENT',
-        name: rootComponent.name,
-        documentNamespace,
-        creationInfo: {
-            created: new Date().toISOString(),
-            creators: [
-                'Tool: pnpm',
-            ],
-        },
-        packages: [rootPackage, ...spdxPackages],
-        relationships: spdxRelationships,
-    };
-    return JSON.stringify(doc, null, opts?.compact ? undefined : 2);
-}
-function sanitizeSpdxId(value) {
-    return value.replace(/[^a-z0-9.-]/gi, '-');
-}
-function spdxHashAlgorithm(algo) {
-    switch (algo) {
-        case 'SHA-1':
-            return 'SHA1';
-        case 'SHA-256':
-            return 'SHA256';
-        case 'SHA-384':
-            return 'SHA384';
-        case 'SHA-512':
-            return 'SHA512';
-        default:
-            return algo;
-    }
-}
-//# sourceMappingURL=serializeSpdx.js.map

package/lib/types.d.ts

@@ -1,36 +0,0 @@
-import type { DepType } from '@pnpm/lockfile.detect-dep-types';
-export interface SbomComponent {
-    name: string;
-    version: string;
-    purl: string;
-    depPath: string;
-    depType: DepType;
-    integrity?: string;
-    tarballUrl?: string;
-    license?: string;
-    description?: string;
-    author?: string;
-    homepage?: string;
-    repository?: string;
-    bugsUrl?: string;
-}
-export interface SbomRelationship {
-    from: string;
-    to: string;
-}
-export interface SbomResult {
-    rootComponent: {
-        name: string;
-        version: string;
-        type: 'library' | 'application';
-        license?: string;
-        description?: string;
-        author?: string;
-        repository?: string;
-        bugsUrl?: string;
-    };
-    components: SbomComponent[];
-    relationships: SbomRelationship[];
-}
-export type SbomFormat = 'cyclonedx' | 'spdx';
-export type SbomComponentType = 'library' | 'application';

package/lib/types.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=types.js.map