@trustify-da/trustify-da-javascript-client 0.3.0-ea.030d439 → 0.3.0-ea.0d78462

package/dist/src/providers/base_java.d.ts

@@ -1,4 +1,4 @@
-export type ecosystem_maven = import("../provider").Provider;
+export type ecosystem_maven = any;
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /** @typedef {{name: string, version: string}} Package */
@@ -10,6 +10,13 @@ export type ecosystem_maven = import("../provider").Provider;
 export const ecosystem_maven: string;
 export const ecosystem_gradle: "gradle";
 export default class Base_Java {
+    /**
+     * Maven dependency scopes. Used to detect whether the trailing column of a
+     * dependency-tree line is a scope keyword — which in turn signals that an
+     * optional classifier column is present between the packaging and version.
+     * @type {string[]}
+     */
+    static MAVEN_SCOPES: string[];
     /**
      *
      * @param {string} globalBinary name of the global binary
@@ -20,6 +27,11 @@ export default class Base_Java {
     CONFLICT_REGEX: RegExp;
     globalBinary: string;
     localWrapper: string;
+    /**
+     * Returns the package manager name (e.g. mvn, gradle)
+     * @returns {string}
+     */
+    packageManagerName(): string;
     /**
      * Recursively populates the SBOM instance with the parsed graph
      * @param {string} src - Source dependency to start the calculations from
@@ -28,6 +40,59 @@ export default class Base_Java {
      * @param {Sbom} sbom - The SBOM where the dependencies are being added
      */
     parseDependencyTree(src: string, srcDepth: number, lines: any[], sbom: Sbom): void;
+    /**
+     * Calculates how deep in the graph is the given line
+     * @param {string} line - line to calculate the depth from
+     * @returns {number} The calculated depth
+     * @protected
+     */
+    protected _getDepth(line: string): number;
+    /**
+     * Parse a single dependency-tree line into its Maven coordinate parts.
+     *
+     * This is the single source of truth for interpreting a dependency-tree
+     * line. Both {@link parseDep} (used to build SBOM component PURLs) and the
+     * Maven hash-map builder rely on it, so the PURL key and the artifact file
+     * path can never drift from one another.
+     *
+     * A line has the shape `groupId:artifactId:packaging[:classifier]:version[:scope]`.
+     * The classifier column is only present when a sixth column holds a known
+     * Maven scope keyword; otherwise the fourth column is the version.
+     *
+     * @param {string} line - line to parse from a dependency tree
+     * @returns {{groupId: string, artifactId: string, packaging: string, classifier: (string|null), version: string, scope: (string|null), overridden: boolean}}
+     *   Parsed coordinate. `version` is the resolved concrete version — when the
+     *   line carries a conflict override the override version replaces it and
+     *   `overridden` is set, mirroring how Maven records the winning version.
+     */
+    parseCoordinate(line: string): {
+        groupId: string;
+        artifactId: string;
+        packaging: string;
+        classifier: (string | null);
+        version: string;
+        scope: (string | null);
+        overridden: boolean;
+    };
+    /**
+     * Build the canonical PackageURL for a parsed coordinate.
+     *
+     * The classifier is folded into the version component (e.g.
+     * `4.1.0-linux-x86_64`) except when the version came from a conflict
+     * override, in which case the override version stands alone — matching the
+     * historical behavior of {@link parseDep}.
+     *
+     * @param {{groupId: string, artifactId: string, classifier: (string|null), version: string, overridden: boolean}} coord
+     * @returns {PackageURL} The canonical packageURL for the coordinate
+     * @protected
+     */
+    protected _coordinateToPurl(coord: {
+        groupId: string;
+        artifactId: string;
+        classifier: (string | null);
+        version: string;
+        overridden: boolean;
+    }): PackageURL;
     /**
      * Create a PackageURL from any line in a Text Graph dependency tree for a manifest path.
      * @param {string} line - line to parse from a dependencies.txt file
@@ -57,18 +122,8 @@ export default class Base_Java {
      * @returns string
      */
     selectToolBinary(manifestPath: string, opts: {}): string | null;
-    /**
-     *
-     * @param {string} startingManifest - the path of the manifest from which to start searching for the wrapper
-     * @param {string} repoRoot - the root of the repository at which point to stop searching for mvnw, derived via git if unset and then fallsback
-     * to the root of the drive the manifest is on (assumes absolute path is given)
-     * @returns {string|undefined}
-     */
-    traverseForWrapper(startingManifest: string, repoRoot?: string): string | undefined;
-    normalizePath(thePath: any): string;
-    #private;
 }
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 export type Package = {
     name: string;
     version: string;

package/dist/src/providers/base_java.js

@@ -1,7 +1,6 @@
-import fs from 'node:fs';
 import path from 'node:path';
 import { PackageURL } from 'packageurl-js';
-import { getCustomPath, getGitRootDir, getWrapperPreference, invokeCommand } from "../tools.js";
+import { getCustomPath, getWrapperPreference, invokeCommand, traverseForWrapper } from "../tools.js";
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /** @typedef {{name: string, version: string}} Package */
@@ -15,6 +14,13 @@ export const ecosystem_gradle = 'gradle';
 export default class Base_Java {
     DEP_REGEX = /(([-a-zA-Z0-9._]{2,})|[0-9])/g;
     CONFLICT_REGEX = /.*omitted for conflict with (\S+)\)/;
+    /**
+     * Maven dependency scopes. Used to detect whether the trailing column of a
+     * dependency-tree line is a scope keyword — which in turn signals that an
+     * optional classifier column is present between the packaging and version.
+     * @type {string[]}
+     */
+    static MAVEN_SCOPES = ['compile', 'provided', 'runtime', 'test', 'system', 'import'];
     globalBinary;
     localWrapper;
     /**
@@ -26,6 +32,13 @@ export default class Base_Java {
         this.globalBinary = globalBinary;
         this.localWrapper = localWrapper;
     }
+    /**
+     * Returns the package manager name (e.g. mvn, gradle)
+     * @returns {string}
+     */
+    packageManagerName() {
+        return this.globalBinary;
+    }
     /**
      * Recursively populates the SBOM instance with the parsed graph
      * @param {string} src - Source dependency to start the calculations from
@@ -42,7 +55,7 @@ export default class Base_Java {
         }
         let index = 0;
         let target = lines[index];
-        let targetDepth = this.#getDepth(target);
+        let targetDepth = this._getDepth(target);
         while (targetDepth > srcDepth && index < lines.length) {
             if (targetDepth === srcDepth + 1) {
                 let from = this.parseDep(src);
@@ -55,49 +68,92 @@ export default class Base_Java {
                 }
             }
             else {
-                this.parseDependencyTree(lines[index - 1], this.#getDepth(lines[index - 1]), lines.slice(index), sbom);
+                this.parseDependencyTree(lines[index - 1], this._getDepth(lines[index - 1]), lines.slice(index), sbom);
             }
             target = lines[++index];
-            targetDepth = this.#getDepth(target);
+            targetDepth = this._getDepth(target);
         }
     }
     /**
      * Calculates how deep in the graph is the given line
      * @param {string} line - line to calculate the depth from
      * @returns {number} The calculated depth
-     * @private
+     * @protected
      */
-    #getDepth(line) {
-        if (line === undefined) {
+    _getDepth(line) {
+        if (!line || line.trim() === '') {
             return -1;
         }
+        if (line.match(/^\w/)) {
+            return 0;
+        }
         return ((line.indexOf('-') - 1) / 3) + 1;
     }
+    /**
+     * Parse a single dependency-tree line into its Maven coordinate parts.
+     *
+     * This is the single source of truth for interpreting a dependency-tree
+     * line. Both {@link parseDep} (used to build SBOM component PURLs) and the
+     * Maven hash-map builder rely on it, so the PURL key and the artifact file
+     * path can never drift from one another.
+     *
+     * A line has the shape `groupId:artifactId:packaging[:classifier]:version[:scope]`.
+     * The classifier column is only present when a sixth column holds a known
+     * Maven scope keyword; otherwise the fourth column is the version.
+     *
+     * @param {string} line - line to parse from a dependency tree
+     * @returns {{groupId: string, artifactId: string, packaging: string, classifier: (string|null), version: string, scope: (string|null), overridden: boolean}}
+     *   Parsed coordinate. `version` is the resolved concrete version — when the
+     *   line carries a conflict override the override version replaces it and
+     *   `overridden` is set, mirroring how Maven records the winning version.
+     */
+    parseCoordinate(line) {
+        const parts = line.split(':').map(part => part ? part.match(this.DEP_REGEX)?.[0] ?? '' : '');
+        const groupId = parts[0] ?? '';
+        const artifactId = parts[1] ?? '';
+        const packaging = parts[2] ?? '';
+        // A classifier column exists only when a sixth column holds a scope keyword.
+        const hasClassifier = parts.length >= 6 && Base_Java.MAVEN_SCOPES.includes(parts[5]);
+        const classifier = hasClassifier ? parts[3] : null;
+        let version = (hasClassifier ? parts[4] : parts[3]) ?? '';
+        const scope = hasClassifier ? parts[5] : (parts.length >= 5 ? parts[4] : null);
+        // A conflict override replaces the resolved version entirely.
+        const override = line.match(this.CONFLICT_REGEX);
+        const overridden = Boolean(override);
+        if (overridden) {
+            version = override[1];
+        }
+        return { groupId, artifactId, packaging, classifier, version, scope, overridden };
+    }
+    /**
+     * Build the canonical PackageURL for a parsed coordinate.
+     *
+     * The classifier is folded into the version component (e.g.
+     * `4.1.0-linux-x86_64`) except when the version came from a conflict
+     * override, in which case the override version stands alone — matching the
+     * historical behavior of {@link parseDep}.
+     *
+     * @param {{groupId: string, artifactId: string, classifier: (string|null), version: string, overridden: boolean}} coord
+     * @returns {PackageURL} The canonical packageURL for the coordinate
+     * @protected
+     */
+    _coordinateToPurl(coord) {
+        const purlVersion = (coord.classifier && !coord.overridden)
+            ? `${coord.version}-${coord.classifier}`
+            : coord.version;
+        return this.toPurl(coord.groupId, coord.artifactId, purlVersion);
+    }
     /**
      * Create a PackageURL from any line in a Text Graph dependency tree for a manifest path.
      * @param {string} line - line to parse from a dependencies.txt file
      * @returns {PackageURL} The parsed packageURL
      */
     parseDep(line) {
-        let match = line.split(':').map(part => part ? part.match(this.DEP_REGEX)[0] : '');
-        if (!match) {
-            throw new Error(`Unable generate SBOM from dependency tree. Line: ${line} cannot be parsed into a PackageURL`);
-        }
-        let version;
-        if (match.length >= 5 && ['compile', 'provided', 'runtime'].includes(match[5])) {
-            version = `${match[4]}-${match[3]}`;
-        }
-        else {
-            version = match[3];
-        }
-        let override = line.match(this.CONFLICT_REGEX);
-        if (override) {
-            version = override[1];
-        }
-        if (match[0].trim() === '') {
+        const coord = this.parseCoordinate(line);
+        if (coord.groupId.trim() === '') {
             throw new Error(`Artifact coordinates should have a non-empty group ID: ${line}`);
         }
-        return this.toPurl(match[0], match[1], version);
+        return this._coordinateToPurl(coord);
     }
     /**
      * Returns a PackageUrl For Java maven dependencies
@@ -131,7 +187,7 @@ export default class Base_Java {
         const toolPath = getCustomPath(this.globalBinary, opts);
         const useWrapper = getWrapperPreference(this.globalBinary, opts);
         if (useWrapper) {
-            const wrapper = this.traverseForWrapper(manifestPath);
+            const wrapper = traverseForWrapper(manifestDir, this.localWrapper);
             if (wrapper !== undefined) {
                 try {
                     this._invokeCommand(wrapper, ['--version'], { cwd: manifestDir });
@@ -156,39 +212,4 @@ export default class Base_Java {
         }
         return toolPath;
     }
-    /**
-     *
-     * @param {string} startingManifest - the path of the manifest from which to start searching for the wrapper
-     * @param {string} repoRoot - the root of the repository at which point to stop searching for mvnw, derived via git if unset and then fallsback
-     * to the root of the drive the manifest is on (assumes absolute path is given)
-     * @returns {string|undefined}
-     */
-    traverseForWrapper(startingManifest, repoRoot = undefined) {
-        const normalizedManifest = this.normalizePath(startingManifest);
-        const currentDir = this.normalizePath(path.dirname(normalizedManifest));
-        repoRoot = repoRoot || getGitRootDir(currentDir) || path.parse(normalizedManifest).root;
-        const wrapperPath = path.join(currentDir, this.localWrapper);
-        try {
-            fs.accessSync(wrapperPath, fs.constants.X_OK);
-            return wrapperPath;
-        }
-        catch (error) {
-            if (error.code === 'ENOENT') {
-                const rootDir = path.parse(currentDir).root;
-                if (currentDir === repoRoot || currentDir === rootDir) {
-                    return undefined;
-                }
-                const parentDir = path.dirname(currentDir);
-                if (parentDir === currentDir || parentDir === rootDir) {
-                    return undefined;
-                }
-                return this.traverseForWrapper(path.join(parentDir, path.basename(normalizedManifest)), repoRoot);
-            }
-            throw new Error(`failure searching for ${this.localWrapper}`, { cause: error });
-        }
-    }
-    normalizePath(thePath) {
-        const normalized = path.resolve(thePath).normalize();
-        return process.platform === 'win32' ? normalized.toLowerCase() : normalized;
-    }
 }

package/dist/src/providers/base_javascript.d.ts

@@ -1,4 +1,4 @@
-export type purlType = import("../provider").Provider;
+export type purlType = any;
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /**
@@ -19,7 +19,7 @@ export default class Base_javascript {
    * @param {Object} opts - Configuration options for the provider
    * @protected
    */
-    protected _setUp(manifestPath: string, opts: any): void;
+    protected _setUp(manifestPath: string, opts: Object): void;
     /**
      * Gets the current manifest object
      * @returns {Manifest} The manifest object
@@ -47,6 +47,11 @@ export default class Base_javascript {
    */
     protected _cmdName(): string;
     /**
+   * Returns the package manager name (e.g. npm, yarn, pnpm, bun)
+   * @returns {string} The package manager name
+   */
+    packageManagerName(): string;
+    /**
    * Returns the command arguments for listing dependencies
    * @returns {Array<string>} The command arguments
    * @abstract
@@ -86,21 +91,21 @@ export default class Base_javascript {
    * @param {Object} [opts={}] - optional; may contain TRUSTIFY_DA_WORKSPACE_DIR
    * @returns {boolean} True if the lock file exists
    */
-    validateLockFile(manifestDir: string, opts?: any): boolean;
+    validateLockFile(manifestDir: string, opts?: Object): boolean;
     /**
    * Provides content and content type for stack analysis
    * @param {string} manifestPath - The manifest path or name
    * @param {Object} [opts={}] - Optional configuration options
    * @returns {Provided} The provided data for stack analysis
    */
-    provideStack(manifestPath: string, opts?: any): Provided;
+    provideStack(manifestPath: string, opts?: Object): Provided;
     /**
    * Provides content and content type for component analysis
    * @param {string} manifestPath - Path to package.json for component report
    * @param {Object} [opts={}] - Optional configuration options
    * @returns {Provided} The provided data for component analysis
    */
-    provideComponent(manifestPath: string, opts?: any): Provided;
+    provideComponent(manifestPath: string, opts?: Object): Provided;
     /**
      * Read license from manifest (package.json). Reused by npm, pnpm, yarn.
      * @param {string} manifestPath - path to package.json
@@ -114,21 +119,21 @@ export default class Base_javascript {
    * @returns {Object} The dependency tree
    * @protected
    */
-    protected _buildDependencyTree(includeTransitive: boolean, opts?: any): any;
+    protected _buildDependencyTree(includeTransitive: boolean, opts?: Object): Object;
     /**
    * Recursively builds the Sbom from the JSON that npm listing returns
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The current dependency tree
    * @protected
    */
-    protected _addDependenciesToSbom(sbom: Sbom, depTree: any): void;
+    protected _addDependenciesToSbom(sbom: Sbom, depTree: Object): void;
     /**
    * Extracts root dependencies from the dependency tree
    * @param {Object} depTree - The dependency tree object
    * @returns {Map<string, PackageURL>} Map of dependency names to their PackageURL objects
    * @protected
    */
-    protected _getRootDependencies(depTree: any): Map<string, PackageURL>;
+    protected _getRootDependencies(depTree: Object): Map<string, PackageURL>;
     /**
    * Gets the version of the package manager
    * @returns {string} The version string of the package manager
@@ -136,6 +141,12 @@ export default class Base_javascript {
    */
     protected _version(): string;
     /**
+   * Creates or updates the lock file for the package manager
+   * @param {string} manifestDir - Directory containing the manifest file
+   * @protected
+   */
+    protected _createLockFile(manifestDir: string): void;
+    /**
    * Parses the dependency tree output
    * @param {string} output - The output to parse
    * @returns {string} The parsed output
@@ -144,6 +155,6 @@ export default class Base_javascript {
     protected _parseDepTreeOutput(output: string): string;
     #private;
 }
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 import Manifest from './manifest.js';
 import Sbom from '../sbom.js';

package/dist/src/providers/base_javascript.js

@@ -71,6 +71,13 @@ export default class Base_javascript {
         throw new TypeError("_cmdName must be implemented");
     }
     /**
+   * Returns the package manager name (e.g. npm, yarn, pnpm, bun)
+   * @returns {string} The package manager name
+   */
+    packageManagerName() {
+        return this._cmdName();
+    }
+    /**
    * Returns the command arguments for listing dependencies
    * @returns {Array<string>} The command arguments
    * @abstract
@@ -217,7 +224,7 @@ export default class Base_javascript {
         this._version();
         const manifestDir = path.dirname(this.#manifest.manifestPath);
         const cmdDir = this._findLockFileDir(manifestDir, opts) || manifestDir;
-        this.#createLockFile(cmdDir);
+        this._createLockFile(cmdDir);
         let output = this.#executeListCmd(includeTransitive, cmdDir);
         output = this._parseDepTreeOutput(output);
         return JSON.parse(output);
@@ -363,9 +370,9 @@ export default class Base_javascript {
     /**
    * Creates or updates the lock file for the package manager
    * @param {string} manifestDir - Directory containing the manifest file
-   * @private
+   * @protected
    */
-    #createLockFile(manifestDir) {
+    _createLockFile(manifestDir) {
         const originalDir = process.cwd();
         const isWindows = os.platform() === 'win32';
         if (isWindows) {

package/dist/src/providers/base_pyproject.d.ts

@@ -1,4 +1,4 @@
-/** @typedef {{name: string, version: string, children: string[]}} GraphEntry */
+/** @typedef {{name: string, version: string, children: string[], hashes?: Array<{alg: string, content: string}>}} GraphEntry */
 /** @typedef {{name: string, version: string, dependencies: DepTreeEntry[]}} DepTreeEntry */
 /** @typedef {{directDeps: string[], graph: Map<string, GraphEntry>}} DependencyData */
 /** @typedef {{ecosystem: string, content: string, contentType: string}} Provided */
@@ -13,7 +13,7 @@ export default class Base_pyproject {
      * @param {Object} [opts={}]
      * @returns {boolean}
      */
-    validateLockFile(manifestDir: string, opts?: any): boolean;
+    validateLockFile(manifestDir: string, opts?: Object): boolean;
     /**
      * Walk up from manifestDir to find the directory containing the lock file.
      * Follows the same pattern as Base_javascript._findLockFileDir().
@@ -22,7 +22,7 @@ export default class Base_pyproject {
      * @returns {string|null}
      * @protected
      */
-    protected _findLockFileDir(manifestDir: string, opts?: any): string | null;
+    protected _findLockFileDir(manifestDir: string, opts?: Object): string | null;
     /**
      * Detect workspace root boundaries.
      * Currently only uv has native workspace support ([tool.uv.workspace] in pyproject.toml).
@@ -44,13 +44,13 @@ export default class Base_pyproject {
      * @param {Object} [opts={}]
      * @returns {Promise<Provided>}
      */
-    provideStack(manifest: string, opts?: any): Promise<Provided>;
+    provideStack(manifest: string, opts?: Object): Promise<Provided>;
     /**
      * @param {string} manifest - path to pyproject.toml
      * @param {Object} [opts={}]
      * @returns {Promise<Provided>}
      */
-    provideComponent(manifest: string, opts?: any): Promise<Provided>;
+    provideComponent(manifest: string, opts?: Object): Promise<Provided>;
     /**
      * @returns {string}
      * @protected
@@ -61,6 +61,11 @@ export default class Base_pyproject {
      * @protected
      */
     protected _cmdName(): string;
+    /**
+     * Returns the package manager name (e.g. pip, poetry, uv)
+     * @returns {string}
+     */
+    packageManagerName(): string;
     /**
      * Resolve dependencies using the tool-specific command and parser.
      *
@@ -72,7 +77,7 @@ export default class Base_pyproject {
      * @returns {Promise<DependencyData>}
      * @protected
      */
-    protected _getDependencyData(manifestDir: string, workspaceDir: string, parsed: object, opts: any): Promise<DependencyData>;
+    protected _getDependencyData(manifestDir: string, workspaceDir: string, parsed: object, opts: Object): Promise<DependencyData>;
     /**
      * Canonicalize a Python package name per PEP 503.
      * @param {string} name
@@ -102,26 +107,14 @@ export default class Base_pyproject {
      */
     protected _getIgnoredDeps(manifestPath: string): Set<string>;
     /**
-     * Build dependency tree from graph, starting from direct deps.
+     * Compute the set of graph nodes reachable from direct deps, excluding ignored.
      * @param {Map<string, GraphEntry>} graph
-     * @param {string[]} directDeps - canonical names of direct deps
+     * @param {string[]} directDeps
      * @param {Set<string>} ignoredDeps
-     * @param {boolean} includeTransitive
-     * @returns {DepTreeEntry[]}
-     * @protected
-     */
-    protected _buildDependencyTree(graph: Map<string, GraphEntry>, directDeps: string[], ignoredDeps: Set<string>, includeTransitive: boolean): DepTreeEntry[];
-    /**
-     * Recursively collect transitive dependencies.
-     * @param {Map<string, GraphEntry>} graph
-     * @param {string[]} childKeys
-     * @param {DepTreeEntry[]} result - mutated in place
-     * @param {Set<string>} ignoredDeps
-     * @param {Set<string>} visited
-     * @returns {void}
+     * @returns {Set<string>}
      * @protected
      */
-    protected _collectTransitive(graph: Map<string, GraphEntry>, childKeys: string[], result: DepTreeEntry[], ignoredDeps: Set<string>, visited: Set<string>): void;
+    protected _reachableNodes(graph: Map<string, GraphEntry>, directDeps: string[], ignoredDeps: Set<string>): Set<string>;
     /**
      * @param {string} name
      * @param {string} version
@@ -129,15 +122,6 @@ export default class Base_pyproject {
      * @protected
      */
     protected _toPurl(name: string, version: string): PackageURL;
-    /**
-     * Recursively add a dependency and its transitive deps to the SBOM.
-     * @param {PackageURL} source
-     * @param {DepTreeEntry} dep
-     * @param {Sbom} sbom
-     * @returns {void}
-     * @private
-     */
-    private _addAllDependencies;
     /**
      * Create SBOM json string for a pyproject.toml project.
      * @param {string} manifest - path to pyproject.toml
@@ -152,6 +136,10 @@ export type GraphEntry = {
     name: string;
     version: string;
     children: string[];
+    hashes?: Array<{
+        alg: string;
+        content: string;
+    }>;
 };
 export type DepTreeEntry = {
     name: string;