@trustify-da/trustify-da-javascript-client 0.3.0-ea.2ea1d77 → 0.3.0-ea.38515a7

package/dist/src/providers/python_poetry.js

@@ -0,0 +1,146 @@
+import { environmentVariableIsPopulated, getCustomPath, invokeCommand } from '../tools.js';
+import Base_pyproject from './base_pyproject.js';
+export default class Python_poetry extends Base_pyproject {
+    /** @returns {string} */
+    _lockFileName() {
+        return 'poetry.lock';
+    }
+    /** @returns {string} */
+    _cmdName() {
+        return 'poetry';
+    }
+    /**
+     * @param {string} manifestDir
+     * @param {object} parsed - parsed pyproject.toml
+     * @param {Object} opts
+     * @returns {Promise<{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}>}
+     */
+    async _getDependencyData(manifestDir, parsed, opts) {
+        let treeOutput = this._getPoetryShowTreeOutput(manifestDir, opts);
+        let showAllOutput = this._getPoetryShowAllOutput(manifestDir, opts);
+        let versionMap = this._parsePoetryShowAll(showAllOutput);
+        return this._parsePoetryTree(treeOutput, versionMap);
+    }
+    /**
+     * Get poetry show --tree output.
+     * @param {string} manifestDir
+     * @param {Object} opts
+     * @returns {string}
+     */
+    _getPoetryShowTreeOutput(manifestDir, opts) {
+        if (environmentVariableIsPopulated('TRUSTIFY_DA_POETRY_SHOW_TREE')) {
+            return Buffer.from(process.env['TRUSTIFY_DA_POETRY_SHOW_TREE'], 'base64').toString('utf-8');
+        }
+        let poetryBin = getCustomPath('poetry', opts);
+        return invokeCommand(poetryBin, ['show', '--tree', '--no-ansi'], { cwd: manifestDir }).toString();
+    }
+    /**
+     * Get poetry show --all output (flat list with resolved versions).
+     * @param {string} manifestDir
+     * @param {Object} opts
+     * @returns {string}
+     */
+    _getPoetryShowAllOutput(manifestDir, opts) {
+        if (environmentVariableIsPopulated('TRUSTIFY_DA_POETRY_SHOW_ALL')) {
+            return Buffer.from(process.env['TRUSTIFY_DA_POETRY_SHOW_ALL'], 'base64').toString('utf-8');
+        }
+        let poetryBin = getCustomPath('poetry', opts);
+        return invokeCommand(poetryBin, ['show', '--no-ansi', '--all'], { cwd: manifestDir }).toString();
+    }
+    /**
+     * Parse poetry show --all output into a version map.
+     * Lines look like: "name         (!) 1.2.3  Description text..."
+     * or:              "name             1.2.3  Description text..."
+     * @param {string} output
+     * @returns {Map<string, string>} canonical name -> version
+     */
+    _parsePoetryShowAll(output) {
+        let versions = new Map();
+        let lines = output.split(/\r?\n/);
+        for (let line of lines) {
+            let trimmed = line.trim();
+            if (!trimmed) {
+                continue;
+            }
+            let match = trimmed.match(/^([A-Za-z0-9][A-Za-z0-9._-]*)\s+(?:\(!\)\s+)?(\S+)/);
+            if (match) {
+                versions.set(this._canonicalize(match[1]), match[2]);
+            }
+        }
+        return versions;
+    }
+    /**
+     * Parse poetry show --tree output into a dependency graph structure.
+     * Top-level lines (no indentation/tree chars) are direct deps: "name version description"
+     * Indented lines are transitive deps with tree chars: "├── name >=constraint"
+     *
+     * @param {string} treeOutput
+     * @param {Map<string, string>} versionMap - canonical name -> resolved version
+     * @returns {{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}}
+     */
+    _parsePoetryTree(treeOutput, versionMap) {
+        let lines = treeOutput.split(/\r?\n/);
+        let graph = new Map();
+        let directDeps = [];
+        let stack = []; // [{key, depth}]
+        let currentDirectDep = null;
+        for (let line of lines) {
+            if (!line.trim()) {
+                continue;
+            }
+            // top-level line: "name version description..."
+            let topMatch = line.match(/^([A-Za-z0-9][A-Za-z0-9._-]*)\s+(\S+)\s/);
+            if (topMatch) {
+                let name = topMatch[1];
+                let version = topMatch[2];
+                let key = this._canonicalize(name);
+                directDeps.push(key);
+                if (!graph.has(key)) {
+                    graph.set(key, { name, version, children: [] });
+                }
+                currentDirectDep = key;
+                stack = [{ key, depth: -1 }];
+                continue;
+            }
+            if (!currentDirectDep) {
+                continue;
+            }
+            // indented line with tree chars (UTF-8 box-drawing: ├── └── │)
+            let nameStart = line.search(/[A-Za-z0-9]/);
+            if (nameStart < 0) {
+                continue;
+            }
+            let rest = line.substring(nameStart);
+            let depMatch = rest.match(/^([A-Za-z0-9][A-Za-z0-9._-]*)/);
+            if (!depMatch) {
+                continue;
+            }
+            let depName = depMatch[1];
+            let depKey = this._canonicalize(depName);
+            // determine depth by counting tree-drawing groups in the prefix
+            let prefix = line.substring(0, nameStart);
+            let depth = (prefix.match(/(?:[├└│ ][\s─]{2} ?)/g) || []).length;
+            // resolve version from the version map
+            let version = versionMap.get(depKey) || null;
+            if (!version) {
+                throw new Error(`poetry: package '${depName}' has no resolved version`);
+            }
+            if (!graph.has(depKey)) {
+                graph.set(depKey, { name: depName, version, children: [] });
+            }
+            // pop stack back to find the parent at depth-1
+            while (stack.length > 0 && stack[stack.length - 1].depth >= depth) {
+                stack.pop();
+            }
+            if (stack.length > 0) {
+                let parentKey = stack[stack.length - 1].key;
+                let parentEntry = graph.get(parentKey);
+                if (parentEntry && !parentEntry.children.includes(depKey)) {
+                    parentEntry.children.push(depKey);
+                }
+            }
+            stack.push({ key: depKey, depth });
+        }
+        return { directDeps, graph };
+    }
+}

package/dist/src/providers/python_uv.d.ts

@@ -0,0 +1,26 @@
+export default class Python_uv extends Base_pyproject {
+    /**
+     * Get the uv export output, either from env var or by running the command.
+     * @param {string} manifestDir
+     * @param {Object} opts
+     * @returns {string}
+     */
+    _getUvExportOutput(manifestDir: string, opts: any): string;
+    /**
+     * Parse uv export output into a dependency graph using tree-sitter-requirements
+     * for package/version extraction and string parsing for "# via" comments.
+     *
+     * @param {string} output
+     * @param {string} projectName - canonical project name to identify direct deps
+     * @returns {Promise<{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}>}
+     */
+    _parseUvExport(output: string, projectName: string): Promise<{
+        directDeps: string[];
+        graph: Map<string, {
+            name: string;
+            version: string;
+            children: string[];
+        }>;
+    }>;
+}
+import Base_pyproject from './base_pyproject.js';

package/dist/src/providers/python_uv.js

@@ -0,0 +1,118 @@
+import { environmentVariableIsPopulated, getCustomPath, invokeCommand } from '../tools.js';
+import Base_pyproject from './base_pyproject.js';
+import { getParser, getPinnedVersionQuery } from './requirements_parser.js';
+export default class Python_uv extends Base_pyproject {
+    /** @returns {string} */
+    _lockFileName() {
+        return 'uv.lock';
+    }
+    /** @returns {string} */
+    _cmdName() {
+        return 'uv';
+    }
+    /**
+     * @param {string} manifestDir
+     * @param {object} parsed - parsed pyproject.toml
+     * @param {Object} opts
+     * @returns {Promise<{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}>}
+     */
+    async _getDependencyData(manifestDir, parsed, opts) {
+        let projectName = this._getProjectName(parsed);
+        let uvOutput = this._getUvExportOutput(manifestDir, opts);
+        return this._parseUvExport(uvOutput, projectName);
+    }
+    /**
+     * Get the uv export output, either from env var or by running the command.
+     * @param {string} manifestDir
+     * @param {Object} opts
+     * @returns {string}
+     */
+    _getUvExportOutput(manifestDir, opts) {
+        if (environmentVariableIsPopulated('TRUSTIFY_DA_UV_EXPORT')) {
+            return Buffer.from(process.env['TRUSTIFY_DA_UV_EXPORT'], 'base64').toString('ascii');
+        }
+        let uvBin = getCustomPath('uv', opts);
+        return invokeCommand(uvBin, ['export', '--format', 'requirements.txt', '--frozen', '--no-hashes'], { cwd: manifestDir }).toString();
+    }
+    /**
+     * Parse uv export output into a dependency graph using tree-sitter-requirements
+     * for package/version extraction and string parsing for "# via" comments.
+     *
+     * @param {string} output
+     * @param {string} projectName - canonical project name to identify direct deps
+     * @returns {Promise<{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}>}
+     */
+    async _parseUvExport(output, projectName) {
+        let [parser, pinnedVersionQuery] = await Promise.all([
+            getParser(), getPinnedVersionQuery()
+        ]);
+        let tree = parser.parse(output);
+        let root = tree.rootNode;
+        let canonProjectName = this._canonicalize(projectName);
+        let packages = new Map(); // canonical name -> {name, version, parents: Set}
+        let currentPkg = null;
+        let collectingVia = false;
+        for (let child of root.children) {
+            if (child.type === 'requirement') {
+                let nameNode = child.children.find(c => c.type === 'package');
+                if (!nameNode) {
+                    continue;
+                }
+                let name = nameNode.text;
+                let version = null;
+                let versionMatches = pinnedVersionQuery.matches(child);
+                if (versionMatches.length > 0) {
+                    version = versionMatches[0].captures.find(c => c.name === 'version').node.text;
+                }
+                if (!version) {
+                    throw new Error(`uv export: package '${name}' has no pinned version`);
+                }
+                let key = this._canonicalize(name);
+                currentPkg = { name, version, parents: new Set() };
+                packages.set(key, currentPkg);
+                collectingVia = false;
+                continue;
+            }
+            if (child.type === 'comment' && currentPkg) {
+                let text = child.text.trim();
+                let viaSingle = text.match(/^# via ([A-Za-z0-9][A-Za-z0-9._-]*)$/);
+                if (viaSingle) {
+                    currentPkg.parents.add(this._canonicalize(viaSingle[1]));
+                    collectingVia = false;
+                    continue;
+                }
+                if (text === '# via') {
+                    collectingVia = true;
+                    continue;
+                }
+                if (collectingVia) {
+                    let parentMatch = text.match(/^#\s+([A-Za-z0-9][A-Za-z0-9._-]*)$/);
+                    if (parentMatch) {
+                        currentPkg.parents.add(this._canonicalize(parentMatch[1]));
+                        continue;
+                    }
+                    collectingVia = false;
+                }
+            }
+        }
+        // Build forward dependency map and extract direct deps in one pass
+        let graph = new Map();
+        let directDeps = [];
+        for (let [key, pkg] of packages) {
+            graph.set(key, { name: pkg.name, version: pkg.version, children: [] });
+        }
+        for (let [childKey, pkg] of packages) {
+            for (let parentKey of pkg.parents) {
+                if (parentKey === canonProjectName) {
+                    directDeps.push(childKey);
+                    continue;
+                }
+                let parentEntry = graph.get(parentKey);
+                if (parentEntry) {
+                    parentEntry.children.push(childKey);
+                }
+            }
+        }
+        return { directDeps, graph };
+    }
+}

package/dist/src/sbom.d.ts

@@ -53,6 +53,13 @@ export default class Sbom {
      * @return {boolean}
      */
     checkIfPackageInsideDependsOnList(component: any, name: string): boolean;
+    /**
+     * Checks if any entry in the dependsOn list of sourceRef starts with the given purl prefix.
+     * @param {PackageURL} sourceRef - The source component to check
+     * @param {string} purlPrefix - The purl prefix to match (e.g. "pkg:npm/minimist@")
+     * @return {boolean}
+     */
+    checkDependsOnByPurlPrefix(sourceRef: PackageURL, purlPrefix: string): boolean;
     /** Removes the root component from the sbom
      */
     removeRootComponent(): void;

package/dist/src/sbom.js

@@ -77,6 +77,15 @@ export default class Sbom {
     checkIfPackageInsideDependsOnList(component, name) {
         return this.sbomModel.checkIfPackageInsideDependsOnList(component, name);
     }
+    /**
+     * Checks if any entry in the dependsOn list of sourceRef starts with the given purl prefix.
+     * @param {PackageURL} sourceRef - The source component to check
+     * @param {string} purlPrefix - The purl prefix to match (e.g. "pkg:npm/minimist@")
+     * @return {boolean}
+     */
+    checkDependsOnByPurlPrefix(sourceRef, purlPrefix) {
+        return this.sbomModel.checkDependsOnByPurlPrefix(sourceRef, purlPrefix);
+    }
     /** Removes the root component from the sbom
      */
     removeRootComponent() {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@trustify-da/trustify-da-javascript-client",
-	"version": "0.3.0-ea.2ea1d77",
+	"version": "0.3.0-ea.38515a7",
 	"description": "Code-Ready Dependency Analytics JavaScript API.",
 	"license": "Apache-2.0",
 	"homepage": "https://github.com/guacsec/trustify-da-javascript-client#README.md",
@@ -38,13 +38,13 @@
 		"lint": "eslint src test --ext js",
 		"lint:fix": "eslint src test --ext js --fix",
 		"test": "c8 npm run tests",
-		"tests": "mocha --config .mocharc.json --grep \".*analysis module.*\" --invert",
+		"tests": "mocha --config .mocharc.json",
 		"tests:rep": "mocha --reporter-option maxDiffSize=0 --reporter json > unit-tests-result.json",
-		"pretest": "cp node_modules/tree-sitter-requirements/tree-sitter-requirements.wasm src/providers/tree-sitter-requirements.wasm",
+		"pretest": "cp node_modules/tree-sitter-requirements/tree-sitter-requirements.wasm src/providers/tree-sitter-requirements.wasm && cp node_modules/tree-sitter-gomod/tree-sitter-gomod.wasm src/providers/tree-sitter-gomod.wasm",
 		"precompile": "rm -rf dist",
 		"compile": "tsc -p tsconfig.json",
 		"compile:dev": "tsc -p tsconfig.dev.json",
-		"postcompile": "cp node_modules/tree-sitter-requirements/tree-sitter-requirements.wasm dist/src/providers/tree-sitter-requirements.wasm"
+		"postcompile": "cp node_modules/tree-sitter-requirements/tree-sitter-requirements.wasm dist/src/providers/tree-sitter-requirements.wasm && cp node_modules/tree-sitter-gomod/tree-sitter-gomod.wasm dist/src/providers/tree-sitter-gomod.wasm"
 	},
 	"dependencies": {
 		"@babel/core": "^7.23.2",
@@ -58,11 +58,12 @@
 		"js-yaml": "^4.1.1",
 		"micromatch": "^4.0.8",
 		"node-fetch": "^3.3.2",
-		"p-limit": "^5.0.0",
+		"p-limit": "^4.0.0",
 		"packageurl-js": "~1.0.2",
 		"smol-toml": "^1.6.0",
+		"tree-sitter-gomod": "github:strum355/tree-sitter-go-mod#56326f2ad478892ace58ff247a97d492a3cbcdda",
 		"tree-sitter-requirements": "github:Strum355/tree-sitter-requirements#d0261ee76b84253997fe70d7d397e78c006c3801",
-		"web-tree-sitter": "^0.26.6",
+		"web-tree-sitter": "^0.26.7",
 		"yargs": "^18.0.0"
 	},
 	"devDependencies": {