@trustify-da/trustify-da-javascript-client 0.3.0-ea.030d439 → 0.3.0-ea.0d78462

package/dist/src/providers/base_pyproject.js

@@ -7,9 +7,10 @@ import Sbom from '../sbom.js';
 import { getCustom } from '../tools.js';
 const ecosystem = 'pip';
 const IGNORE_MARKERS = ['exhortignore', 'trustify-da-ignore'];
+const NO_SCOPE = undefined;
 const DEFAULT_ROOT_NAME = 'default-pip-root';
 const DEFAULT_ROOT_VERSION = '0.0.0';
-/** @typedef {{name: string, version: string, children: string[]}} GraphEntry */
+/** @typedef {{name: string, version: string, children: string[], hashes?: Array<{alg: string, content: string}>}} GraphEntry */
 /** @typedef {{name: string, version: string, dependencies: DepTreeEntry[]}} DepTreeEntry */
 /** @typedef {{directDeps: string[], graph: Map<string, GraphEntry>}} DependencyData */
 /** @typedef {{ecosystem: string, content: string, contentType: string}} Provided */
@@ -144,6 +145,13 @@ export default class Base_pyproject {
     _cmdName() {
         throw new TypeError('_cmdName must be implemented');
     }
+    /**
+     * Returns the package manager name (e.g. pip, poetry, uv)
+     * @returns {string}
+     */
+    packageManagerName() {
+        return this._cmdName();
+    }
     /**
      * Resolve dependencies using the tool-specific command and parser.
      *
@@ -220,64 +228,29 @@ export default class Base_pyproject {
         return ignored;
     }
     /**
-     * Build dependency tree from graph, starting from direct deps.
-     * @param {Map<string, GraphEntry>} graph
-     * @param {string[]} directDeps - canonical names of direct deps
-     * @param {Set<string>} ignoredDeps
-     * @param {boolean} includeTransitive
-     * @returns {DepTreeEntry[]}
-     * @protected
-     */
-    _buildDependencyTree(graph, directDeps, ignoredDeps, includeTransitive) {
-        let result = [];
-        for (let key of directDeps) {
-            if (ignoredDeps.has(key)) {
-                continue;
-            }
-            let entry = graph.get(key);
-            if (!entry) {
-                continue;
-            }
-            let depTree = [];
-            if (includeTransitive) {
-                let visited = new Set();
-                visited.add(key);
-                this._collectTransitive(graph, entry.children, depTree, ignoredDeps, visited);
-            }
-            result.push({ name: entry.name, version: entry.version, dependencies: depTree });
-        }
-        result.sort((a, b) => a.name.toLowerCase().localeCompare(b.name.toLowerCase()));
-        return result;
-    }
-    /**
-     * Recursively collect transitive dependencies.
+     * Compute the set of graph nodes reachable from direct deps, excluding ignored.
      * @param {Map<string, GraphEntry>} graph
-     * @param {string[]} childKeys
-     * @param {DepTreeEntry[]} result - mutated in place
+     * @param {string[]} directDeps
      * @param {Set<string>} ignoredDeps
-     * @param {Set<string>} visited
-     * @returns {void}
+     * @returns {Set<string>}
      * @protected
      */
-    _collectTransitive(graph, childKeys, result, ignoredDeps, visited) {
-        for (let childKey of childKeys) {
-            let canonKey = this._canonicalize(childKey);
-            if (ignoredDeps.has(canonKey)) {
+    _reachableNodes(graph, directDeps, ignoredDeps) {
+        let reachable = new Set();
+        let queue = directDeps.filter(k => !ignoredDeps.has(k) && graph.has(k));
+        while (queue.length > 0) {
+            let key = queue.shift();
+            if (reachable.has(key)) {
                 continue;
             }
-            if (visited.has(canonKey)) {
-                continue;
-            }
-            visited.add(canonKey);
-            let entry = graph.get(canonKey);
-            if (!entry) {
-                continue;
+            reachable.add(key);
+            for (let child of graph.get(key).children) {
+                if (!ignoredDeps.has(child) && graph.has(child) && !reachable.has(child)) {
+                    queue.push(child);
+                }
             }
-            let childDeps = [];
-            this._collectTransitive(graph, entry.children, childDeps, ignoredDeps, visited);
-            result.push({ name: entry.name, version: entry.version, dependencies: childDeps });
         }
-        result.sort((a, b) => a.name.toLowerCase().localeCompare(b.name.toLowerCase()));
+        return reachable;
     }
     /**
      * @param {string} name
@@ -288,21 +261,6 @@ export default class Base_pyproject {
     _toPurl(name, version) {
         return new PackageURL('pypi', undefined, name, version, undefined, undefined);
     }
-    /**
-     * Recursively add a dependency and its transitive deps to the SBOM.
-     * @param {PackageURL} source
-     * @param {DepTreeEntry} dep
-     * @param {Sbom} sbom
-     * @returns {void}
-     * @private
-     */
-    _addAllDependencies(source, dep, sbom) {
-        let targetPurl = this._toPurl(dep.name, dep.version);
-        sbom.addDependency(source, targetPurl);
-        if (dep.dependencies && dep.dependencies.length > 0) {
-            dep.dependencies.forEach(child => this._addAllDependencies(this._toPurl(dep.name, dep.version), child, sbom));
-        }
-    }
     /**
      * Create SBOM json string for a pyproject.toml project.
      * @param {string} manifest - path to pyproject.toml
@@ -318,21 +276,47 @@ export default class Base_pyproject {
         let workspaceDir = this._findLockFileDir(manifestDir, opts) || manifestDir;
         let { directDeps, graph } = await this._getDependencyData(manifestDir, workspaceDir, parsed, opts);
         let ignoredDeps = this._getIgnoredDeps(manifest);
-        let dependencies = this._buildDependencyTree(graph, directDeps, ignoredDeps, includeTransitive);
         let sbom = new Sbom();
         let rootName = this._getProjectName(parsed) || DEFAULT_ROOT_NAME;
         let rootVersion = this._getProjectVersion(parsed) || DEFAULT_ROOT_VERSION;
         let rootPurl = this._toPurl(rootName, rootVersion);
         let license = this.readLicenseFromManifest(manifest);
         sbom.addRoot(rootPurl, license);
-        dependencies.forEach(dep => {
-            if (includeTransitive) {
-                this._addAllDependencies(rootPurl, dep, sbom);
+        if (includeTransitive) {
+            let reachable = this._reachableNodes(graph, directDeps, ignoredDeps);
+            for (let key of directDeps) {
+                if (!reachable.has(key)) {
+                    continue;
+                }
+                let entry = graph.get(key);
+                sbom.addDependency(rootPurl, this._toPurl(entry.name, entry.version), NO_SCOPE, entry.hashes);
+            }
+            for (let [key, entry] of graph) {
+                if (!reachable.has(key)) {
+                    continue;
+                }
+                let parentPurl = this._toPurl(entry.name, entry.version);
+                for (let child of entry.children) {
+                    if (!reachable.has(child)) {
+                        continue;
+                    }
+                    let childEntry = graph.get(child);
+                    sbom.addDependency(parentPurl, this._toPurl(childEntry.name, childEntry.version), NO_SCOPE, childEntry.hashes);
+                }
             }
-            else {
-                sbom.addDependency(rootPurl, this._toPurl(dep.name, dep.version));
+        }
+        else {
+            for (let key of directDeps) {
+                if (ignoredDeps.has(key)) {
+                    continue;
+                }
+                let entry = graph.get(key);
+                if (!entry) {
+                    continue;
+                }
+                sbom.addDependency(rootPurl, this._toPurl(entry.name, entry.version), NO_SCOPE, entry.hashes);
             }
-        });
+        }
         return sbom.getAsJsonString(opts);
     }
 }

package/dist/src/providers/containerfile_parser.d.ts

@@ -0,0 +1,5 @@
+export function getParser(): Promise<Parser>;
+export function getFromQuery(): Promise<Query>;
+export function getArgQuery(): Promise<Query>;
+import { Parser } from 'web-tree-sitter';
+import { Query } from 'web-tree-sitter';

package/dist/src/providers/containerfile_parser.js

@@ -0,0 +1,20 @@
+import { readFile } from 'node:fs/promises';
+import { Language, Parser, Query } from 'web-tree-sitter';
+const wasmUrl = new URL('./tree-sitter-containerfile.wasm', import.meta.url);
+async function init() {
+    await Parser.init();
+    const wasmBytes = new Uint8Array(await readFile(wasmUrl));
+    return await Language.load(wasmBytes);
+}
+export async function getParser() {
+    const language = await init();
+    return new Parser().setLanguage(language);
+}
+export async function getFromQuery() {
+    const language = await init();
+    return new Query(language, '(from_instruction (image_spec) @image)');
+}
+export async function getArgQuery() {
+    const language = await init();
+    return new Query(language, '(arg_instruction (arg_pair name: (_) @name default: (_) @default))');
+}

package/dist/src/providers/golang_gomodules.d.ts

@@ -1,12 +1,22 @@
+/**
+ * Discover all go.mod manifest paths in a Go workspace.
+ * Uses `go work edit -json` to get workspace members.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain go.work)
+ * @param {import('../index.js').Options} [opts={}]
+ * @returns {Promise<string[]>} Paths to go.mod files (absolute)
+ */
+export function discoverGoWorkspaceModules(workspaceRoot: string, opts?: import("../index.js").Options): Promise<string[]>;
 declare namespace _default {
     export { isSupported };
     export { validateLockFile };
     export { provideComponent };
     export { provideStack };
     export { readLicenseFromManifest };
+    export function packageManagerName(): string;
 }
 export default _default;
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 export type Package = {
     name: string;
     version: string;

package/dist/src/providers/golang_gomodules.js

@@ -4,8 +4,9 @@ import { PackageURL } from 'packageurl-js';
 import { readLicenseFile } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
 import { getCustom, getCustomPath, invokeCommand } from "../tools.js";
+import { filterManifestPathsByDiscoveryIgnore, resolveWorkspaceDiscoveryIgnore } from '../workspace.js';
 import { getParser, getRequireQuery } from './gomod_parser.js';
-export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest };
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'go'; } };
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /** @typedef {{name: string, version: string}} Package */
@@ -186,6 +187,36 @@ function performManifestVersionsCheck(rootElementName, goModGraphOutputRows, man
         throw error;
     }
 }
+/** Parses go.sum to build a hash map of module@version to CycloneDX hashes. */
+function parseGoSumHashes(manifestDir) {
+    let goSumPath = path.join(manifestDir, 'go.sum');
+    if (!fs.existsSync(goSumPath)) {
+        return new Map();
+    }
+    let hashMap = new Map();
+    let content = fs.readFileSync(goSumPath, 'utf-8');
+    for (let line of content.split('\n')) {
+        line = line.trim();
+        if (!line) {
+            continue;
+        }
+        let parts = line.split(/\s+/);
+        if (parts.length < 3) {
+            continue;
+        }
+        let [mod, version, hash] = parts;
+        if (version.endsWith('/go.mod')) {
+            continue;
+        }
+        if (!hash.startsWith('h1:')) {
+            continue;
+        }
+        let base64Part = hash.slice(3);
+        let hexDigest = Buffer.from(base64Part, 'base64').toString('hex');
+        hashMap.set(`${mod}@${version}`, [{ alg: "SHA-256", content: hexDigest }]);
+    }
+    return hashMap;
+}
 /**
  * Create SBOM json string for go Module.
  * @param {string} manifest - path for go.mod
@@ -240,6 +271,7 @@ async function getSBOM(manifest, opts = {}, includeTransitive) {
     if (matchManifestVersions === "true") {
         performManifestVersionsCheck(root, rows, manifestContent, parser, requireQuery);
     }
+    let goSumHashes = parseGoSumHashes(manifestDir);
     const mainModule = toPurl(root, "@");
     const license = readLicenseFromManifest(manifest);
     sbom.addRoot(mainModule, license);
@@ -261,7 +293,7 @@ async function getSBOM(manifest, opts = {}, includeTransitive) {
             if (getParentVertexFromEdge(row) === root && !directDepPaths.has(getPackageName(child))) {
                 return;
             }
-            sbom.addDependency(source, target);
+            sbom.addDependency(source, target, undefined, goSumHashes.get(child));
         });
         // at the end, filter out all ignored dependencies including versions.
         sbom.filterIgnoredDepsIncludingVersion(allIgnoredDeps);
@@ -274,12 +306,22 @@ async function getSBOM(manifest, opts = {}, includeTransitive) {
             let target = toPurl(child, "@");
             if (dependencyNotIgnored(ignoredDeps, target)) {
                 if (directDepPaths.has(getPackageName(child))) {
-                    sbom.addDependency(mainModule, target);
+                    sbom.addDependency(mainModule, target, undefined, goSumHashes.get(child));
                 }
             }
         });
         enforceRemovingIgnoredDepsInCaseOfAutomaticVersionUpdate(ignoredDeps, sbom);
     }
+    // Backfill hashes for components that were only seen as dependency sources
+    for (const comp of sbom.sbomModel.components) {
+        if (!comp.hashes && comp.purl) {
+            let key = decodeURIComponent(comp.purl.replace('pkg:golang/', ''));
+            let hashes = goSumHashes.get(key);
+            if (hashes) {
+                comp.hashes = hashes;
+            }
+        }
+    }
     return sbom.getAsJsonString(opts);
 }
 /**
@@ -328,13 +370,7 @@ function getFinalPackagesVersionsForModule(rows, manifestPath, goBin) {
     catch (error) {
         throw new Error('failed to list all modules', { cause: error });
     }
-    let finalVersionModules = new Map();
-    finalVersionsForAllModules.split(getLineSeparatorGolang()).filter(string => string.trim() !== "")
-        .filter(string => string.trim().split(" ").length === 2)
-        .forEach((dependency) => {
-        let dep = dependency.split(" ");
-        finalVersionModules[dep[0]] = dep[1];
-    });
+    let finalVersionModules = parseModuleVersions(finalVersionsForAllModules);
     let finalVersionModulesArray = new Array();
     rows.filter(string => string.trim() !== "").forEach(module => {
         let child = getChildVertexFromEdge(module);
@@ -395,7 +431,69 @@ function getVersionOfPackage(fullPackage) {
     let parts = fullPackage.split("@");
     return parts.length > 1 ? parts[1] : undefined;
 }
+function parseModuleVersions(goListOutput) {
+    let modules = {};
+    goListOutput.split(getLineSeparatorGolang()).filter(string => string.trim() !== "")
+        .forEach((line) => {
+        let parts = line.trim().split(" ");
+        if (parts.length === 2) {
+            modules[parts[0]] = parts[1];
+        }
+        else if (parts.length >= 4 && parts[2] === "=>") {
+            modules[parts[0]] = parts[parts.length - 1];
+        }
+    });
+    return modules;
+}
 function getLineSeparatorGolang() {
     let reg = /\n|\r\n/;
     return reg;
 }
+/**
+ * Discover all go.mod manifest paths in a Go workspace.
+ * Uses `go work edit -json` to get workspace members.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain go.work)
+ * @param {import('../index.js').Options} [opts={}]
+ * @returns {Promise<string[]>} Paths to go.mod files (absolute)
+ */
+export async function discoverGoWorkspaceModules(workspaceRoot, opts = {}) {
+    const root = path.resolve(workspaceRoot);
+    const goWork = path.join(root, 'go.work');
+    if (!fs.existsSync(goWork)) {
+        return [];
+    }
+    const goBin = getCustomPath('go', opts);
+    let output;
+    try {
+        output = invokeCommand(goBin, ['work', 'edit', '-json', goWork], { cwd: root });
+    }
+    catch {
+        return [];
+    }
+    let workspace;
+    try {
+        workspace = JSON.parse(output.toString().trim());
+    }
+    catch {
+        return [];
+    }
+    const useEntries = workspace.Use || [];
+    if (useEntries.length === 0) {
+        return [];
+    }
+    const manifestPaths = [];
+    for (const entry of useEntries) {
+        const diskPath = entry.DiskPath;
+        if (!diskPath) {
+            continue;
+        }
+        const moduleDir = path.resolve(root, diskPath);
+        const goMod = path.join(moduleDir, 'go.mod');
+        if (fs.existsSync(goMod)) {
+            manifestPaths.push(goMod);
+        }
+    }
+    const ignorePatterns = resolveWorkspaceDiscoveryIgnore(opts);
+    return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+}

package/dist/src/providers/java_gradle.d.ts

@@ -1,3 +1,22 @@
+/**
+ * Discover all build.gradle[.kts] manifest paths in a Gradle multi-project build.
+ * Uses a custom init script to get structured project listing.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain settings.gradle[.kts])
+ * @param {import('../index.js').Options} [opts={}]
+ * @returns {Promise<string[]>} Paths to build.gradle[.kts] files (absolute)
+ */
+export function discoverGradleSubprojects(workspaceRoot: string, opts?: import("../index.js").Options): Promise<string[]>;
+/**
+ * Parse the structured output from the Gradle init script.
+ *
+ * @param {string} raw - Raw stdout from gradle
+ * @returns {{ path: string, dir: string }[]}
+ */
+export function parseGradleInitScriptOutput(raw: string): {
+    path: string;
+    dir: string;
+}[];
 /**
  * This class provides common functionality for Groovy and Kotlin DSL files.
  */

package/dist/src/providers/java_gradle.js

@@ -1,9 +1,13 @@
+import crypto from 'node:crypto';
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { EOL } from 'os';
-import TOML from 'fast-toml';
+import { parse as parseToml } from 'smol-toml';
 import { readLicenseFile } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
+import { invokeCommand } from '../tools.js';
+import { filterManifestPathsByDiscoveryIgnore, resolveWorkspaceDiscoveryIgnore } from '../workspace.js';
 import Base_java, { ecosystem_gradle } from "./base_java.js";
 /** @typedef {import('../provider.js').Provider} */
 /** @typedef {import('../provider.js').Provided} Provided */
@@ -362,7 +366,7 @@ export default class Java_gradle extends Base_java {
         // Read and parse the TOML file
         let pathOfToml = path.join(path.dirname(manifestPath), "gradle", "libs.versions.toml");
         const tomlString = fs.readFileSync(pathOfToml).toString();
-        let tomlObject = TOML.parse(tomlString);
+        let tomlObject = parseToml(tomlString);
         let groupPlusArtifactObject = tomlObject.libraries[alias];
         let parts = groupPlusArtifactObject.module.split(":");
         let groupId = parts[0];
@@ -407,3 +411,113 @@ export default class Java_gradle extends Base_java {
         return undefined;
     }
 }
+const DEFAULT_GRADLE_DISCOVERY_IGNORE = [
+    '**/build/**',
+    '**/.gradle/**',
+];
+/** Gradle init script that emits structured project listing. */
+const GRADLE_INIT_SCRIPT = `allprojects {
+    task daListProjects {
+        doLast {
+            println "::DA_PROJECT::\${project.path}::\${project.projectDir}"
+        }
+    }
+}
+`;
+/**
+ * Discover all build.gradle[.kts] manifest paths in a Gradle multi-project build.
+ * Uses a custom init script to get structured project listing.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain settings.gradle[.kts])
+ * @param {import('../index.js').Options} [opts={}]
+ * @returns {Promise<string[]>} Paths to build.gradle[.kts] files (absolute)
+ */
+export async function discoverGradleSubprojects(workspaceRoot, opts = {}) {
+    const root = path.resolve(workspaceRoot);
+    const hasSettings = fs.existsSync(path.join(root, 'settings.gradle'))
+        || fs.existsSync(path.join(root, 'settings.gradle.kts'));
+    if (!hasSettings) {
+        return [];
+    }
+    const manifestPaths = [];
+    const rootBuildKts = path.join(root, 'build.gradle.kts');
+    const rootBuild = path.join(root, 'build.gradle');
+    const rootManifest = fs.existsSync(rootBuildKts) ? rootBuildKts : fs.existsSync(rootBuild) ? rootBuild : null;
+    if (rootManifest) {
+        manifestPaths.push(rootManifest);
+    }
+    let gradleBin;
+    try {
+        gradleBin = new Java_gradle().selectToolBinary(rootManifest || rootBuild, opts);
+    }
+    catch {
+        const ignorePatterns = [...resolveWorkspaceDiscoveryIgnore(opts), ...DEFAULT_GRADLE_DISCOVERY_IGNORE];
+        return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+    }
+    const initScriptPath = path.join(os.tmpdir(), `da-list-projects-${crypto.randomUUID()}.gradle`);
+    try {
+        fs.writeFileSync(initScriptPath, GRADLE_INIT_SCRIPT);
+        let output;
+        try {
+            output = invokeCommand(gradleBin, [
+                '-q', '--no-daemon',
+                '--init-script', initScriptPath,
+                'daListProjects',
+            ], { cwd: root });
+        }
+        catch {
+            const ignorePatterns = [...resolveWorkspaceDiscoveryIgnore(opts), ...DEFAULT_GRADLE_DISCOVERY_IGNORE];
+            return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+        }
+        const projects = parseGradleInitScriptOutput(output.toString());
+        for (const proj of projects) {
+            if (proj.path === ':') {
+                continue;
+            }
+            const projDir = path.resolve(proj.dir);
+            const buildKts = path.join(projDir, 'build.gradle.kts');
+            const buildGroovy = path.join(projDir, 'build.gradle');
+            if (fs.existsSync(buildKts)) {
+                manifestPaths.push(buildKts);
+            }
+            else if (fs.existsSync(buildGroovy)) {
+                manifestPaths.push(buildGroovy);
+            }
+        }
+    }
+    finally {
+        try {
+            fs.unlinkSync(initScriptPath);
+        }
+        catch { /* ignore */ }
+    }
+    const ignorePatterns = [...resolveWorkspaceDiscoveryIgnore(opts), ...DEFAULT_GRADLE_DISCOVERY_IGNORE];
+    return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+}
+/**
+ * Parse the structured output from the Gradle init script.
+ *
+ * @param {string} raw - Raw stdout from gradle
+ * @returns {{ path: string, dir: string }[]}
+ */
+export function parseGradleInitScriptOutput(raw) {
+    const projects = [];
+    for (const rawLine of raw.split('\n')) {
+        const line = rawLine.trimEnd();
+        if (!line.startsWith('::DA_PROJECT::')) {
+            continue;
+        }
+        const prefix = '::DA_PROJECT::';
+        const remainder = line.substring(prefix.length);
+        const lastSep = remainder.lastIndexOf('::');
+        if (lastSep < 0) {
+            continue;
+        }
+        const projPath = remainder.substring(0, lastSep);
+        const dir = remainder.substring(lastSep + 2);
+        if (projPath && dir) {
+            projects.push({ path: projPath, dir });
+        }
+    }
+    return projects;
+}

package/dist/src/providers/java_gradle_groovy.d.ts

@@ -3,5 +3,5 @@ export default class Java_gradle_groovy extends Java_gradle {
     _parseAliasForLibsNotation(alias: any): any;
     _extractDepToBeIgnored(dep: any): any;
 }
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 import Java_gradle from './java_gradle.js';

package/dist/src/providers/java_gradle_kotlin.d.ts

@@ -7,5 +7,5 @@ export default class Java_gradle_kotlin extends Java_gradle {
     _parseAliasForLibsNotation(alias: any): any;
     _extractDepToBeIgnored(dep: any): string | null;
 }
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 import Java_gradle from './java_gradle.js';

package/dist/src/providers/java_maven.d.ts

@@ -1,8 +1,20 @@
+/**
+ * Discover all pom.xml manifest paths in a Maven multi-module project.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain pom.xml)
+ * @param {object} [opts={}]
+ * @returns {Promise<string[]>} Paths to pom.xml files (absolute)
+ */
+export function discoverMavenModules(workspaceRoot: string, opts?: object): Promise<string[]>;
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /** @typedef {{name: string, version: string}} Package */
 /** @typedef {{groupId: string, artifactId: string, version: string, scope: string, ignore: boolean}} Dependency */
 export default class Java_maven extends Base_java {
+    /** @type {Object<string, string>} Packaging types that produce .jar files despite non-jar packaging names. */
+    static PACKAGING_TO_JAR: {
+        [x: string]: string;
+    };
     constructor();
     /**
      * @param {string} manifestName - the subject manifest name-type
@@ -17,9 +29,9 @@ export default class Java_maven extends Base_java {
      * Provide content and content type for maven-maven stack analysis.
      * @param {string} manifest - the manifest path or name
      * @param {{}} [opts={}] - optional various options to pass along the application
-     * @returns {Provided}
+     * @returns {Promise<Provided>}
      */
-    provideStack(manifest: string, opts?: {}): Provided;
+    provideStack(manifest: string, opts?: {}): Promise<Provided>;
     /**
      * Provide content and content type for maven-maven component analysis.
      * @param {string} manifest - path to the manifest file
@@ -34,17 +46,38 @@ export default class Java_maven extends Base_java {
      */
     readLicenseFromManifest(manifestPath: string): string | null;
     /**
+     * Build a Map of PURL string → CycloneDX hash entries by reading artifact files from the local Maven repository.
+     *
+     * Both the artifact file path and the hash-map key are derived from the
+     * shared {@link Base_java#parseCoordinate} parser: the file path uses the
+     * resolved version and raw classifier, while the key uses the same canonical
+     * PURL builder as {@link Base_java#parseDep}. This guarantees the key always
+     * matches the PURL that {@link Base_java#parseDependencyTree} looks up.
      *
+     * @param {string} depTreeText Raw dependency tree text from mvn dependency:tree
+     * @param {{}} [opts={}] Options bag (may contain TRUSTIFY_DA_MVN_REPO)
+     * @returns {Promise<Map<string, Array<{alg: string, content: string}>>>}
+     */
+    _buildMavenHashMap(depTreeText: string, opts?: {}): Promise<Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>>;
+    /**
      * @param {String} textGraphList Text graph String of the manifest
      * @param {[String]} ignoredDeps List of ignored dependencies to be omitted from sbom
+     * @param {{}} opts Options
      * @param {String} manifestPath Path to the pom.xml manifest
+     * @param {Map<string, Array<{alg: string, content: string}>>} [hashMap] PURL→hashes map
      * @return {String} formatted sbom Json String with all dependencies
      */
-    createSbomFileFromTextFormat(textGraphList: string, ignoredDeps: [string], opts: any, manifestPath: string): string;
+    createSbomFileFromTextFormat(textGraphList: string, ignoredDeps: [string], opts: {}, manifestPath: string, hashMap?: Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>): string;
     #private;
 }
-export type Java_maven = import("../provider").Provider;
-export type Provided = import("../provider").Provided;
+export type Java_maven = any;
+export type Provided = any;
 export type Package = {
     name: string;
     version: string;