@trustify-da/trustify-da-javascript-client 0.3.0-ea.030d439 → 0.3.0-ea.071e51e

package/dist/src/index.js

@@ -1,19 +1,24 @@
+import fs from 'node:fs';
 import path from "node:path";
 import { EOL } from "os";
 import pLimit from 'p-limit';
-import { availableProviders, match } from './provider.js';
 import analysis from './analysis.js';
-import fs from 'node:fs';
-import { getCustom } from "./tools.js";
 import { resolveBatchMetadata, resolveContinueOnError } from './batch_opts.js';
+import { getPackageVersion } from './package_version.js';
+import { availableProviders, match } from './provider.js';
+import { discoverGoWorkspaceModules } from './providers/golang_gomodules.js';
+import { discoverGradleSubprojects } from './providers/java_gradle.js';
+import { discoverMavenModules } from './providers/java_maven.js';
+import { discoverUvWorkspaceMembers } from './providers/python_uv.js';
+import { getCustom } from "./tools.js";
 import { discoverWorkspaceCrates, discoverWorkspacePackages, filterManifestPathsByDiscoveryIgnore, resolveWorkspaceDiscoveryIgnore, validatePackageJson, } from './workspace.js';
-import.meta.dirname;
-import * as url from 'url';
 export { parseImageRef } from "./oci_image/utils.js";
 export { ImageRef } from "./oci_image/images.js";
 export { getProjectLicense, findLicenseFilePath, identifyLicense, getLicenseDetails, licensesFromReport, normalizeLicensesResponse, runLicenseCheck, getCompatibility } from "./license/index.js";
+export { extractRemediations } from "./remediation.js";
+export { generateReport, generateDeduplicationKey } from './remediation_report.js';
 export default { componentAnalysis, stackAnalysis, stackAnalysisBatch, imageAnalysis, validateToken, generateSbom };
-export { discoverWorkspacePackages, discoverWorkspaceCrates, validatePackageJson, resolveWorkspaceDiscoveryIgnore, filterManifestPathsByDiscoveryIgnore, resolveContinueOnError, resolveBatchMetadata, };
+export { discoverMavenModules, discoverGradleSubprojects, discoverGoWorkspaceModules, discoverUvWorkspaceMembers, discoverWorkspacePackages, discoverWorkspaceCrates, validatePackageJson, resolveWorkspaceDiscoveryIgnore, filterManifestPathsByDiscoveryIgnore, resolveContinueOnError, resolveBatchMetadata, };
 /**
  * @typedef {{
  * TRUSTIFY_DA_CARGO_PATH?: string | undefined,
@@ -35,7 +40,9 @@ export { discoverWorkspacePackages, discoverWorkspaceCrates, validatePackageJson
  * TRUSTIFY_DA_PYTHON_PATH?: string | undefined,
  * TRUSTIFY_DA_PYTHON_VIRTUAL_ENV?: string | undefined,
  * TRUSTIFY_DA_PYTHON3_PATH?: string | undefined,
- * TRUSTIFY_DA_RECOMMENDATIONS_ENABLED?: string | undefined,
+ * TRUSTIFY_DA_PROVIDERS?: string | undefined,
+ * TRUSTIFY_DA_RECOMMEND?: string | undefined,
+ * TRUSTIFY_DA_SOURCES?: string | undefined,
  * TRUSTIFY_DA_SKOPEO_CONFIG_PATH?: string | undefined,
  * TRUSTIFY_DA_SKOPEO_PATH?: string | undefined,
  * TRUSTIFY_DA_SYFT_CONFIG_PATH?: string | undefined,
@@ -64,7 +71,7 @@ export { discoverWorkspacePackages, discoverWorkspaceCrates, validatePackageJson
 /**
  * @typedef {{
  *   workspaceRoot: string,
- *   ecosystem: 'javascript' | 'cargo' | 'unknown',
+ *   ecosystem: 'javascript' | 'cargo' | 'pyproject' | 'unknown',
  *   total: number,
  *   successful: number,
  *   failed: number,
@@ -87,23 +94,7 @@ function logOptionsAndEnvironmentsVariables(alongsideText, valueToBePrinted) {
  * @private
  */
 function readAndPrintVersionFromPackageJson() {
-    let dirName;
-    // new ESM way in nodeJS ( since node version 22 ) to bring module directory.
-    dirName = import.meta.dirname;
-    // old ESM way in nodeJS ( before node versions 22.00 to bring module directory)
-    if (!dirName) {
-        dirName = url.fileURLToPath(new URL('.', import.meta.url));
-    }
-    try {
-        if (__dirname) {
-            dirName = __dirname;
-        }
-    }
-    catch (e) {
-        console.log("__dirname is not defined, continue with fileUrlPath");
-    }
-    let packageJson = JSON.parse(fs.readFileSync(path.join(dirName, "..", "package.json")).toString());
-    logOptionsAndEnvironmentsVariables("trustify-da-javascript-client analysis started, version: ", packageJson.version);
+    logOptionsAndEnvironmentsVariables("trustify-da-javascript-client analysis started, version: ", getPackageVersion());
 }
 /**
  * This function is used to determine the Trustify DA backend URL.
@@ -171,7 +162,9 @@ async function componentAnalysis(manifest, opts = {}) {
     fs.accessSync(manifest, fs.constants.R_OK);
     opts["manifest-type"] = path.basename(manifest);
     let provider = match(manifest, availableProviders, opts); // throws error if no matching provider
-    return await analysis.requestComponent(provider, manifest, theUrl, opts); // throws error request sending failed
+    const result = await analysis.requestComponent(provider, manifest, theUrl, opts); // throws error request sending failed
+    result.packageManager = provider.packageManagerName();
+    return result;
 }
 /**
  * @overload
@@ -279,17 +272,45 @@ async function generateOneSbom(manifestPath, workspaceOpts) {
  *
  * @param {string} root - Resolved workspace root
  * @param {Options} opts
- * @returns {Promise<{ ecosystem: 'javascript' | 'cargo' | 'unknown', manifestPaths: string[] }>}
+ * @returns {Promise<{ ecosystem: 'javascript' | 'cargo' | 'maven' | 'gradle' | 'gomodules' | 'pyproject' | 'unknown', manifestPaths: string[] }>}
  * @private
  */
 async function detectWorkspaceManifests(root, opts) {
     const cargoToml = path.join(root, 'Cargo.toml');
     const cargoLock = path.join(root, 'Cargo.lock');
     const packageJson = path.join(root, 'package.json');
+    const pomXml = path.join(root, 'pom.xml');
     if (fs.existsSync(cargoToml) && fs.existsSync(cargoLock)) {
         return { ecosystem: 'cargo', manifestPaths: await discoverWorkspaceCrates(root, opts) };
     }
-    const hasJsLock = fs.existsSync(path.join(root, 'pnpm-lock.yaml'))
+    if (fs.existsSync(pomXml)) {
+        const manifestPaths = await discoverMavenModules(root, opts);
+        if (manifestPaths.length > 0) {
+            return { ecosystem: 'maven', manifestPaths };
+        }
+    }
+    const hasGradleSettings = fs.existsSync(path.join(root, 'settings.gradle'))
+        || fs.existsSync(path.join(root, 'settings.gradle.kts'));
+    if (hasGradleSettings) {
+        const manifestPaths = await discoverGradleSubprojects(root, opts);
+        if (manifestPaths.length > 0) {
+            return { ecosystem: 'gradle', manifestPaths };
+        }
+    }
+    if (fs.existsSync(path.join(root, 'go.work'))) {
+        const manifestPaths = await discoverGoWorkspaceModules(root, opts);
+        if (manifestPaths.length > 0) {
+            return { ecosystem: 'gomodules', manifestPaths };
+        }
+    }
+    if (fs.existsSync(path.join(root, 'pyproject.toml')) && fs.existsSync(path.join(root, 'uv.lock'))) {
+        const manifestPaths = await discoverUvWorkspaceMembers(root, opts);
+        if (manifestPaths.length > 0) {
+            return { ecosystem: 'pyproject', manifestPaths };
+        }
+    }
+    const hasJsLock = fs.existsSync(path.join(root, 'bun.lock'))
+        || fs.existsSync(path.join(root, 'pnpm-lock.yaml'))
         || fs.existsSync(path.join(root, 'yarn.lock'))
         || fs.existsSync(path.join(root, 'package-lock.json'));
     if (fs.existsSync(packageJson) && hasJsLock) {
@@ -398,12 +419,45 @@ function batchError(message, wantMetadata, metadata) {
     }
     return err;
 }
+/**
+ * @overload
+ * @param {string} workspaceRoot
+ * @param {true} html
+ * @param {Options & { batchMetadata: true }} opts
+ * @returns {Promise<{ analysis: string, metadata: BatchAnalysisMetadata }>}
+ * @throws {Error}
+ */
+/**
+ * @overload
+ * @param {string} workspaceRoot
+ * @param {true} html
+ * @param {Options & { batchMetadata?: false }} [opts={}]
+ * @returns {Promise<string>}
+ * @throws {Error}
+ */
+/**
+ * @overload
+ * @param {string} workspaceRoot
+ * @param {false} html
+ * @param {Options & { batchMetadata: true }} opts
+ * @returns {Promise<{ analysis: Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>, metadata: BatchAnalysisMetadata }>}
+ * @throws {Error}
+ */
+/**
+ * @overload
+ * @param {string} workspaceRoot
+ * @param {false} html
+ * @param {Options & { batchMetadata?: false }} [opts={}]
+ * @returns {Promise<Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>>}
+ * @throws {Error}
+ */
 /**
  * Get stack analysis for all workspace packages/crates (batch).
  * Detects ecosystem from workspace root: Cargo (Cargo.toml + Cargo.lock) or JS/TS (package.json + lock file).
  * SBOMs are generated in parallel (see `batchConcurrency`) unless `continueOnError: false` (fail-fast sequential).
  * With `opts.batchMetadata` / `TRUSTIFY_DA_BATCH_METADATA`, returns `{ analysis, metadata }` including validation and SBOM errors.
  *
+ * @overload
  * @param {string} workspaceRoot - Path to workspace root (containing lock file and workspace config)
  * @param {boolean} [html=false] - true returns HTML, false returns JSON report
  * @param {Options} [opts={}] - `batchConcurrency`, discovery ignores, `continueOnError` (default true), `batchMetadata` (default false)
@@ -434,7 +488,7 @@ async function stackAnalysisBatch(workspaceRoot, html = false, opts = {}) {
         }
     }
     if (manifestPaths.length === 0) {
-        throw new Error(`No workspace manifests found at ${root}. Ensure Cargo.toml+Cargo.lock or package.json+lock file exist.`);
+        throw new Error(`No workspace manifests found at ${root}. Ensure a supported workspace root exists (Cargo.toml+Cargo.lock, pom.xml, build.gradle, go.work, pyproject.toml+uv.lock, or package.json+lock file).`);
     }
     const workspaceOpts = { ...opts, TRUSTIFY_DA_WORKSPACE_DIR: root };
     const concurrency = resolveBatchConcurrency(opts);

package/dist/src/license/index.d.ts

@@ -9,10 +9,10 @@
  * @param {import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport} [analysisResult] - analysis result that includes licenses array from backend
  * @returns {Promise<{ projectLicense: { manifest: Object|null, file: Object|null, mismatch: boolean }, incompatibleDependencies: Array<{ purl: string, licenses: string[], category?: string, reason: string }>, error?: string }>}
  */
-export function runLicenseCheck(sbomContent: string, manifestPath: string, url: string, opts?: import("../index.js").Options, analysisResult?: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport): Promise<{
+export function runLicenseCheck(sbomContent: string, manifestPath: string, url: string, opts?: import("../index.js").Options, analysisResult?: any): Promise<{
     projectLicense: {
-        manifest: any | null;
-        file: any | null;
+        manifest: Object | null;
+        file: Object | null;
         mismatch: boolean;
     };
     incompatibleDependencies: Array<{

package/dist/src/license/index.js

@@ -85,11 +85,14 @@ export async function runLicenseCheck(sbomContent, manifestPath, url, opts = {},
             continue;
         const status = getCompatibility(projectCategory, entry.category);
         if (status === 'incompatible') {
+            const reason = entry.category?.toUpperCase() === 'UNKNOWN'
+                ? 'License not recognized as a standard SPDX identifier. Manual review recommended to verify compatibility.'
+                : 'Dependency license(s) are incompatible with the project license.';
             incompatibleDependencies.push({
                 purl,
                 licenses: entry.licenses,
                 category: entry.category,
-                reason: 'Dependency license(s) are incompatible with the project license.'
+                reason
             });
         }
     }

package/dist/src/license/license_utils.js

@@ -114,9 +114,12 @@ export function getCompatibility(projectCategory, dependencyCategory) {
     }
     const proj = projectCategory.toUpperCase();
     const dep = dependencyCategory.toUpperCase();
-    if (proj === 'UNKNOWN' || dep === 'UNKNOWN') {
+    if (proj === 'UNKNOWN') {
         return 'unknown';
     }
+    if (dep === 'UNKNOWN') {
+        return 'incompatible';
+    }
     const restrictiveness = {
         'PERMISSIVE': 1,
         'WEAK_COPYLEFT': 2,

package/dist/src/license/licenses_api.d.ts

@@ -6,7 +6,7 @@
  * @param {import('../index.js').Options} [opts={}] - options (proxy, token, TRUSTIFY_DA_BACKEND_URL, etc.)
  * @returns {Promise<Object|null>} License details or null if not found
  */
-export function getLicenseDetails(spdxId: string, opts?: import("../index.js").Options): Promise<any | null>;
+export function getLicenseDetails(spdxId: string, opts?: import("../index.js").Options): Promise<Object | null>;
 /**
  * Normalize the LicensesResponse shape (array of LicenseProviderResult) into a map of purl -> license info.
  * Each provider result has { status, summary, packages } where packages is { [purl]: { concluded, evidence } }.
@@ -28,7 +28,7 @@ export function normalizeLicensesResponse(data: unknown, purls?: string[]): Map<
  * @param {string[]} [purls] - optional list of purls to restrict to
  * @returns {Map<string, { licenses: string[], category?: string }>}
  */
-export function licensesFromReport(analysisReport: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport, purls?: string[]): Map<string, {
+export function licensesFromReport(analysisReport: any, purls?: string[]): Map<string, {
     licenses: string[];
     category?: string;
 }>;

package/dist/src/oci_image/images.d.ts

@@ -78,7 +78,7 @@ export class ImageRef {
      * @param {string} [platform]
      * @param {import("index.js").Options} [opts={}]
      */
-    constructor(image: string, platform?: string, opts?: import("index.js").Options);
+    constructor(image: string, platform?: string, opts?: any);
     /** @type {Image} */
     image: Image;
     /** @type {Platform} */

package/dist/src/oci_image/images.js

@@ -242,8 +242,22 @@ export class ImageRef {
     getPackageURL() {
         /** @type {Object.<string, string>} */
         const qualifiers = {};
-        const repositoryUrl = this.image.getNameWithoutTag();
+        let repositoryUrl = this.image.getNameWithoutTag();
         const simpleName = this.image.getSimpleName();
+        // Normalize Docker Hub image references so all forms produce the same PURL:
+        //   node         → docker.io/node
+        //   docker.io/library/node → docker.io/node
+        if (repositoryUrl != null) {
+            const lower = repositoryUrl.toLowerCase();
+            if (lower === simpleName.toLowerCase()) {
+                // Bare name (e.g. "node") — default to docker.io
+                repositoryUrl = `docker.io/${simpleName}`;
+            }
+            else if (lower.startsWith('docker.io/library/')) {
+                // Official image with library/ prefix — strip it
+                repositoryUrl = `docker.io/${lower.substring('docker.io/library/'.length)}`;
+            }
+        }
         if (repositoryUrl != null && repositoryUrl.toLowerCase() !== simpleName.toLowerCase()) {
             qualifiers[ImageRef.REPOSITORY_QUALIFIER] = repositoryUrl.toLowerCase();
         }

package/dist/src/oci_image/utils.d.ts

@@ -4,7 +4,7 @@
  * @param {import("../index.js").Options} [opts={}] - optional various options to pass along the application
  * @returns {{}}
  */
-export function generateImageSBOM(imageRef: import("./images").ImageRef, opts?: import("../index.js").Options): {};
+export function generateImageSBOM(imageRef: any, opts?: import("../index.js").Options): {};
 /**
  *
  * @param {string} image
@@ -25,7 +25,7 @@ export function getImagePlatform(opts?: import("../index.js").Options): Platform
  * @returns {Object.<string, string>} - The image digests
  * @throws {Error} If the image info is invalid
  */
-export function getImageDigests(imageRef: import("./images").ImageRef, opts?: import("../index.js").Options): {
+export function getImageDigests(imageRef: any, opts?: import("../index.js").Options): {
     [x: string]: string;
 };
 export type SyftImageSource = {
@@ -34,9 +34,9 @@ export type SyftImageSource = {
     getVariant: () => string;
 };
 export type SyftImageSourceType = {
-    getOs: (arg0: any) => string;
-    getArch: (arg0: any) => string;
-    getVariant: (arg0: any) => string;
+    getOs: (arg0: Object) => string;
+    getArch: (arg0: Object) => string;
+    getVariant: (arg0: Object) => string;
 };
 import { ImageRef } from './images.js';
 import { Platform } from './platform.js';

package/dist/src/package_version.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Reads this package's version from package.json, resolving the path relative
+ * to this module. Works under ESM (node >= 22 import.meta.dirname, older via
+ * import.meta.url) and CommonJS (__dirname). Returns undefined if the file
+ * cannot be read, so callers never fail on a missing version.
+ * @return {string|undefined} the package version, or undefined
+ */
+export function getPackageVersion(): string | undefined;

package/dist/src/package_version.js

@@ -0,0 +1,31 @@
+import fs from "node:fs";
+import path from "node:path";
+import * as url from "url";
+/**
+ * Reads this package's version from package.json, resolving the path relative
+ * to this module. Works under ESM (node >= 22 import.meta.dirname, older via
+ * import.meta.url) and CommonJS (__dirname). Returns undefined if the file
+ * cannot be read, so callers never fail on a missing version.
+ * @return {string|undefined} the package version, or undefined
+ */
+export function getPackageVersion() {
+    try {
+        let dirName = import.meta.dirname;
+        if (!dirName) {
+            dirName = url.fileURLToPath(new URL('.', import.meta.url));
+        }
+        try {
+            if (__dirname) {
+                dirName = __dirname;
+            }
+        }
+        catch {
+            // __dirname not defined under ESM, continue with fileURLToPath
+        }
+        const packageJson = JSON.parse(fs.readFileSync(path.join(dirName, "..", "package.json")).toString());
+        return packageJson.version;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/src/provider.d.ts

@@ -21,7 +21,7 @@ export function match(manifest: string, providers: [Provider], opts?: {
     TRUSTIFY_DA_WORKSPACE_DIR?: string;
 }): Provider;
 /** @typedef {{ecosystem: string, contentType: string, content: string}} Provided */
-/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string, Object): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string): string | null}} Provider */
+/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string, Object): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string, Object=): string | null, packageManagerName: function(): string}} Provider */
 /**
  * MUST include all providers here.
  * @type {[Provider]}
@@ -34,8 +34,9 @@ export type Provided = {
 };
 export type Provider = {
     isSupported: (arg0: string) => boolean;
-    validateLockFile: (arg0: string, arg1: any) => void;
+    validateLockFile: (arg0: string, arg1: Object) => void;
     provideComponent: (arg0: string, arg1: {}) => Provided | Promise<Provided>;
     provideStack: (arg0: string, arg1: {}) => Provided | Promise<Provided>;
-    readLicenseFromManifest: (arg0: string) => string | null;
+    readLicenseFromManifest: (arg0: string, arg1: Object | undefined) => string | null;
+    packageManagerName: () => string;
 };

package/dist/src/provider.js

@@ -3,15 +3,18 @@ import golangGomodulesProvider from './providers/golang_gomodules.js';
 import Java_gradle_groovy from "./providers/java_gradle_groovy.js";
 import Java_gradle_kotlin from "./providers/java_gradle_kotlin.js";
 import Java_maven from "./providers/java_maven.js";
+import Javascript_bun from './providers/javascript_bun.js';
 import Javascript_npm from './providers/javascript_npm.js';
 import Javascript_pnpm from './providers/javascript_pnpm.js';
 import Javascript_yarn from './providers/javascript_yarn.js';
+import dockerfileProvider from './providers/oci_dockerfile.js';
 import pythonPipProvider from './providers/python_pip.js';
+import Python_pip_pyproject from './providers/python_pip_pyproject.js';
 import Python_poetry from './providers/python_poetry.js';
 import Python_uv from './providers/python_uv.js';
 import rustCargoProvider from './providers/rust_cargo.js';
 /** @typedef {{ecosystem: string, contentType: string, content: string}} Provided */
-/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string, Object): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string): string | null}} Provider */
+/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string, Object): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string, Object=): string | null, packageManagerName: function(): string}} Provider */
 /**
  * MUST include all providers here.
  * @type {[Provider]}
@@ -20,6 +23,7 @@ export const availableProviders = [
     new Java_maven(),
     new Java_gradle_groovy(),
     new Java_gradle_kotlin(),
+    new Javascript_bun(),
     new Javascript_pnpm(),
     new Javascript_yarn(),
     new Javascript_npm(),
@@ -27,7 +31,9 @@ export const availableProviders = [
     pythonPipProvider,
     new Python_poetry(),
     new Python_uv(),
-    rustCargoProvider
+    new Python_pip_pyproject(),
+    rustCargoProvider,
+    dockerfileProvider
 ];
 /**
  * Match a provider by manifest type only (no lock file check). Used for license reading.

package/dist/src/providers/base_java.d.ts

@@ -1,4 +1,4 @@
-export type ecosystem_maven = import("../provider").Provider;
+export type ecosystem_maven = any;
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /** @typedef {{name: string, version: string}} Package */
@@ -10,6 +10,13 @@ export type ecosystem_maven = import("../provider").Provider;
 export const ecosystem_maven: string;
 export const ecosystem_gradle: "gradle";
 export default class Base_Java {
+    /**
+     * Maven dependency scopes. Used to detect whether the trailing column of a
+     * dependency-tree line is a scope keyword — which in turn signals that an
+     * optional classifier column is present between the packaging and version.
+     * @type {string[]}
+     */
+    static MAVEN_SCOPES: string[];
     /**
      *
      * @param {string} globalBinary name of the global binary
@@ -20,6 +27,11 @@ export default class Base_Java {
     CONFLICT_REGEX: RegExp;
     globalBinary: string;
     localWrapper: string;
+    /**
+     * Returns the package manager name (e.g. mvn, gradle)
+     * @returns {string}
+     */
+    packageManagerName(): string;
     /**
      * Recursively populates the SBOM instance with the parsed graph
      * @param {string} src - Source dependency to start the calculations from
@@ -28,6 +40,59 @@ export default class Base_Java {
      * @param {Sbom} sbom - The SBOM where the dependencies are being added
      */
     parseDependencyTree(src: string, srcDepth: number, lines: any[], sbom: Sbom): void;
+    /**
+     * Calculates how deep in the graph is the given line
+     * @param {string} line - line to calculate the depth from
+     * @returns {number} The calculated depth
+     * @protected
+     */
+    protected _getDepth(line: string): number;
+    /**
+     * Parse a single dependency-tree line into its Maven coordinate parts.
+     *
+     * This is the single source of truth for interpreting a dependency-tree
+     * line. Both {@link parseDep} (used to build SBOM component PURLs) and the
+     * Maven hash-map builder rely on it, so the PURL key and the artifact file
+     * path can never drift from one another.
+     *
+     * A line has the shape `groupId:artifactId:packaging[:classifier]:version[:scope]`.
+     * The classifier column is only present when a sixth column holds a known
+     * Maven scope keyword; otherwise the fourth column is the version.
+     *
+     * @param {string} line - line to parse from a dependency tree
+     * @returns {{groupId: string, artifactId: string, packaging: string, classifier: (string|null), version: string, scope: (string|null), overridden: boolean}}
+     *   Parsed coordinate. `version` is the resolved concrete version — when the
+     *   line carries a conflict override the override version replaces it and
+     *   `overridden` is set, mirroring how Maven records the winning version.
+     */
+    parseCoordinate(line: string): {
+        groupId: string;
+        artifactId: string;
+        packaging: string;
+        classifier: (string | null);
+        version: string;
+        scope: (string | null);
+        overridden: boolean;
+    };
+    /**
+     * Build the canonical PackageURL for a parsed coordinate.
+     *
+     * The classifier is folded into the version component (e.g.
+     * `4.1.0-linux-x86_64`) except when the version came from a conflict
+     * override, in which case the override version stands alone — matching the
+     * historical behavior of {@link parseDep}.
+     *
+     * @param {{groupId: string, artifactId: string, classifier: (string|null), version: string, overridden: boolean}} coord
+     * @returns {PackageURL} The canonical packageURL for the coordinate
+     * @protected
+     */
+    protected _coordinateToPurl(coord: {
+        groupId: string;
+        artifactId: string;
+        classifier: (string | null);
+        version: string;
+        overridden: boolean;
+    }): PackageURL;
     /**
      * Create a PackageURL from any line in a Text Graph dependency tree for a manifest path.
      * @param {string} line - line to parse from a dependencies.txt file
@@ -57,18 +122,8 @@ export default class Base_Java {
      * @returns string
      */
     selectToolBinary(manifestPath: string, opts: {}): string | null;
-    /**
-     *
-     * @param {string} startingManifest - the path of the manifest from which to start searching for the wrapper
-     * @param {string} repoRoot - the root of the repository at which point to stop searching for mvnw, derived via git if unset and then fallsback
-     * to the root of the drive the manifest is on (assumes absolute path is given)
-     * @returns {string|undefined}
-     */
-    traverseForWrapper(startingManifest: string, repoRoot?: string): string | undefined;
-    normalizePath(thePath: any): string;
-    #private;
 }
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 export type Package = {
     name: string;
     version: string;