@trustify-da/trustify-da-javascript-client 0.3.0-ea.41d542e → 0.3.0-ea.43fdb9f

package/dist/src/index.js

@@ -1,21 +1,24 @@
+import fs from 'node:fs';
 import path from "node:path";
 import { EOL } from "os";
 import pLimit from 'p-limit';
-import { availableProviders, match } from './provider.js';
 import analysis from './analysis.js';
-import fs from 'node:fs';
-import { getCustom } from "./tools.js";
 import { resolveBatchMetadata, resolveContinueOnError } from './batch_opts.js';
-import { discoverMavenModules } from './providers/java_maven.js';
-import { discoverGradleSubprojects } from './providers/java_gradle.js';
+import { getPackageVersion } from './package_version.js';
+import { availableProviders, match } from './provider.js';
 import { discoverGoWorkspaceModules } from './providers/golang_gomodules.js';
+import { discoverGradleSubprojects } from './providers/java_gradle.js';
+import { discoverMavenModules } from './providers/java_maven.js';
 import { discoverUvWorkspaceMembers } from './providers/python_uv.js';
+import { getCustom } from "./tools.js";
 import { discoverWorkspaceCrates, discoverWorkspacePackages, filterManifestPathsByDiscoveryIgnore, resolveWorkspaceDiscoveryIgnore, validatePackageJson, } from './workspace.js';
-import.meta.dirname;
-import * as url from 'url';
 export { parseImageRef } from "./oci_image/utils.js";
 export { ImageRef } from "./oci_image/images.js";
 export { getProjectLicense, findLicenseFilePath, identifyLicense, getLicenseDetails, licensesFromReport, normalizeLicensesResponse, runLicenseCheck, getCompatibility } from "./license/index.js";
+export { extractRemediations, maxSeverity } from "./remediation.js";
+export { generateReport, generateDeduplicationKey } from './remediation_report.js';
+export { loadConfig, mergeConfig, resolveConfig, CONFIG_FILENAMES } from './config.js';
+export { runRemediation, findManifests } from './remediate.js';
 export default { componentAnalysis, stackAnalysis, stackAnalysisBatch, imageAnalysis, validateToken, generateSbom };
 export { discoverMavenModules, discoverGradleSubprojects, discoverGoWorkspaceModules, discoverUvWorkspaceMembers, discoverWorkspacePackages, discoverWorkspaceCrates, validatePackageJson, resolveWorkspaceDiscoveryIgnore, filterManifestPathsByDiscoveryIgnore, resolveContinueOnError, resolveBatchMetadata, };
 /**
@@ -39,7 +42,9 @@ export { discoverMavenModules, discoverGradleSubprojects, discoverGoWorkspaceMod
  * TRUSTIFY_DA_PYTHON_PATH?: string | undefined,
  * TRUSTIFY_DA_PYTHON_VIRTUAL_ENV?: string | undefined,
  * TRUSTIFY_DA_PYTHON3_PATH?: string | undefined,
- * TRUSTIFY_DA_RECOMMENDATIONS_ENABLED?: string | undefined,
+ * TRUSTIFY_DA_PROVIDERS?: string | undefined,
+ * TRUSTIFY_DA_RECOMMEND?: string | undefined,
+ * TRUSTIFY_DA_SOURCES?: string | undefined,
  * TRUSTIFY_DA_SKOPEO_CONFIG_PATH?: string | undefined,
  * TRUSTIFY_DA_SKOPEO_PATH?: string | undefined,
  * TRUSTIFY_DA_SYFT_CONFIG_PATH?: string | undefined,
@@ -47,11 +52,11 @@ export { discoverMavenModules, discoverGradleSubprojects, discoverGoWorkspaceMod
  * TRUSTIFY_DA_YARN_PATH?: string | undefined,
  * TRUSTIFY_DA_WORKSPACE_DIR?: string | undefined,
  * TRUSTIFY_DA_LICENSE_CHECK?: string | undefined,
+ * licenseCheck?: boolean | undefined,
  * MATCH_MANIFEST_VERSIONS?: string | undefined,
  * TRUSTIFY_DA_SOURCE?: string | undefined,
  * TRUSTIFY_DA_TOKEN?: string | undefined,
  * TRUSTIFY_DA_TELEMETRY_ID?: string | undefined,
- * TRUSTIFY_DA_WORKSPACE_DIR?: string | undefined,
  * batchConcurrency?: number | undefined,
  * TRUSTIFY_DA_BATCH_CONCURRENCY?: string | undefined,
  * workspaceDiscoveryIgnore?: string[] | undefined,
@@ -91,29 +96,11 @@ function logOptionsAndEnvironmentsVariables(alongsideText, valueToBePrinted) {
  * @private
  */
 function readAndPrintVersionFromPackageJson() {
-    let dirName;
-    // new ESM way in nodeJS ( since node version 22 ) to bring module directory.
-    dirName = import.meta.dirname;
-    // old ESM way in nodeJS ( before node versions 22.00 to bring module directory)
-    if (!dirName) {
-        dirName = url.fileURLToPath(new URL('.', import.meta.url));
-    }
-    try {
-        if (__dirname) {
-            dirName = __dirname;
-        }
-    }
-    catch (e) {
-        console.log("__dirname is not defined, continue with fileUrlPath");
-    }
-    let packageJson = JSON.parse(fs.readFileSync(path.join(dirName, "..", "package.json")).toString());
-    logOptionsAndEnvironmentsVariables("trustify-da-javascript-client analysis started, version: ", packageJson.version);
+    logOptionsAndEnvironmentsVariables("trustify-da-javascript-client analysis started, version: ", getPackageVersion());
 }
 /**
- * This function is used to determine the Trustify DA backend URL.
- * The TRUSTIFY_DA_BACKEND_URL is evaluated in the following order and selected when it finds it first:
- * 1. Environment Variable
- * 2. (key,value) from opts object
+ * Selects the Trustify DA backend URL from opts.TRUSTIFY_DA_BACKEND_URL, then environment
+ * variable TRUSTIFY_DA_BACKEND_URL. Options take precedence over environment variables.
  * If TRUSTIFY_DA_BACKEND_URL is not set, the function will throw an error.
  * @param {{TRUSTIFY_DA_DEBUG?: string | undefined; TRUSTIFY_DA_BACKEND_URL?: string | undefined}} [opts={}]
  * @return {string} - The selected Trustify DA backend URL
@@ -144,7 +131,7 @@ export function selectTrustifyDABackend(opts = {}) {
  * @param {string} manifest
  * @param {false} html
  * @param {Options} [opts={}]
- * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>}
+ * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>}
  * @throws {Error}
  */
 /**
@@ -153,7 +140,7 @@ export function selectTrustifyDABackend(opts = {}) {
  * @param {string} manifest - path for the manifest
  * @param {boolean} [html=false] - true will return a html string, false will return AnalysisReport object.
  * @param {Options} [opts={}] - optional various options to pass along the application
- * @returns {Promise<string|import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>}
+ * @returns {Promise<string|import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>}
  * @throws {Error} if manifest inaccessible, no matching provider, failed to get create content,
  * 		or backend request failed
  */
@@ -167,7 +154,7 @@ async function stackAnalysis(manifest, html = false, opts = {}) {
  * Get component analysis report for a manifest content.
  * @param {string} manifest - path to the manifest
  * @param {Options} [opts={}] - optional various options to pass along the application
- * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>}
+ * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>}
  * @throws {Error} if no matching provider, failed to get create content, or backend request failed
  */
 async function componentAnalysis(manifest, opts = {}) {
@@ -192,7 +179,7 @@ async function componentAnalysis(manifest, opts = {}) {
  * @param {Array<string>} imageRefs
  * @param {false} html
  * @param {Options} [opts={}]
- * @returns {Promise<Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>>}
+ * @returns {Promise<Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>>}
  * @throws {Error}
  */
 /**
@@ -201,7 +188,7 @@ async function componentAnalysis(manifest, opts = {}) {
  * @param {Array<string>} imageRefs - OCI image references
  * @param {boolean} [html=false] - true will return a html string, false will return AnalysisReport
  * @param {Options} [opts={}] - optional various options to pass along the application
- * @returns {Promise<string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>>}
+ * @returns {Promise<string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>>}
  * @throws {Error} if manifest inaccessible, no matching provider, failed to get create content,
  * 		or backend request failed
  */
@@ -210,7 +197,8 @@ async function imageAnalysis(imageRefs, html = false, opts = {}) {
     return await analysis.requestImages(imageRefs, theUrl, html, opts);
 }
 /**
- * Max concurrent SBOM generations for batch workspace analysis. Env/opts override default 10.
+ * Max concurrent SBOM generations for batch workspace analysis. Options override environment;
+ * environment overrides the default of 10.
  * @param {Options} opts
  * @returns {number}
  * @private
@@ -453,7 +441,7 @@ function batchError(message, wantMetadata, metadata) {
  * @param {string} workspaceRoot
  * @param {false} html
  * @param {Options & { batchMetadata: true }} opts
- * @returns {Promise<{ analysis: Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>, metadata: BatchAnalysisMetadata }>}
+ * @returns {Promise<{ analysis: Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>, metadata: BatchAnalysisMetadata }>}
  * @throws {Error}
  */
 /**
@@ -461,7 +449,7 @@ function batchError(message, wantMetadata, metadata) {
  * @param {string} workspaceRoot
  * @param {false} html
  * @param {Options & { batchMetadata?: false }} [opts={}]
- * @returns {Promise<Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>>}
+ * @returns {Promise<Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>>}
  * @throws {Error}
  */
 /**
@@ -474,7 +462,7 @@ function batchError(message, wantMetadata, metadata) {
  * @param {string} workspaceRoot - Path to workspace root (containing lock file and workspace config)
  * @param {boolean} [html=false] - true returns HTML, false returns JSON report
  * @param {Options} [opts={}] - `batchConcurrency`, discovery ignores, `continueOnError` (default true), `batchMetadata` (default false)
- * @returns {Promise<string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>|{ analysis: string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>, metadata: BatchAnalysisMetadata }>}
+ * @returns {Promise<string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>|{ analysis: string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>, metadata: BatchAnalysisMetadata }>}
  * @throws {Error} if workspace root invalid, no manifests found, no packages pass validation, no SBOMs produced, or backend request failed. When `opts.batchMetadata` is set, `error.batchMetadata` may be set on thrown errors.
  */
 async function stackAnalysisBatch(workspaceRoot, html = false, opts = {}) {

package/dist/src/license/index.d.ts

@@ -6,10 +6,10 @@
  * @param {string} manifestPath - path to manifest
  * @param {string} url - the backend url to send the request to
  * @param {import('../index.js').Options} [opts={}]
- * @param {import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport} [analysisResult] - analysis result that includes licenses array from backend
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport} [analysisResult] - analysis result that includes licenses array from backend
  * @returns {Promise<{ projectLicense: { manifest: Object|null, file: Object|null, mismatch: boolean }, incompatibleDependencies: Array<{ purl: string, licenses: string[], category?: string, reason: string }>, error?: string }>}
  */
-export function runLicenseCheck(sbomContent: string, manifestPath: string, url: string, opts?: import("../index.js").Options, analysisResult?: any): Promise<{
+export function runLicenseCheck(sbomContent: string, manifestPath: string, url: string, opts?: import("../index.js").Options, analysisResult?: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts").AnalysisReport): Promise<{
     projectLicense: {
         manifest: Object | null;
         file: Object | null;

package/dist/src/license/index.js

@@ -1,9 +1,9 @@
 /**
  * License resolution and dependency license compatibility for component analysis.
  */
-import { getProjectLicense, findLicenseFilePath, identifyLicense } from './project_license.js';
-import { licensesFromReport, getLicenseDetails } from './licenses_api.js';
 import { getCompatibility } from './license_utils.js';
+import { licensesFromReport, getLicenseDetails } from './licenses_api.js';
+import { getProjectLicense, findLicenseFilePath, identifyLicense } from './project_license.js';
 export { getProjectLicense, findLicenseFilePath, identifyLicense } from './project_license.js';
 export { licensesFromReport, normalizeLicensesResponse, getLicenseDetails } from './licenses_api.js';
 export { getCompatibility } from './license_utils.js';
@@ -15,7 +15,7 @@ export { getCompatibility } from './license_utils.js';
  * @param {string} manifestPath - path to manifest
  * @param {string} url - the backend url to send the request to
  * @param {import('../index.js').Options} [opts={}]
- * @param {import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport} [analysisResult] - analysis result that includes licenses array from backend
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport} [analysisResult] - analysis result that includes licenses array from backend
  * @returns {Promise<{ projectLicense: { manifest: Object|null, file: Object|null, mismatch: boolean }, incompatibleDependencies: Array<{ purl: string, licenses: string[], category?: string, reason: string }>, error?: string }>}
  */
 export async function runLicenseCheck(sbomContent, manifestPath, url, opts = {}, analysisResult = null) {
@@ -39,10 +39,12 @@ export async function runLicenseCheck(sbomContent, manifestPath, url, opts = {},
     // Fetch detailed license info from backend (avoid duplicate calls if same license)
     const licenseDetailsCache = new Map();
     async function getDetails(spdxId) {
-        if (!spdxId || !url)
+        if (!spdxId || !url) {
             return null;
-        if (licenseDetailsCache.has(spdxId))
+        }
+        if (licenseDetailsCache.has(spdxId)) {
             return licenseDetailsCache.get(spdxId);
+        }
         try {
             const details = await getLicenseDetails(spdxId, { ...opts, TRUSTIFY_DA_BACKEND_URL: url });
             licenseDetailsCache.set(spdxId, details);
@@ -81,8 +83,9 @@ export async function runLicenseCheck(sbomContent, manifestPath, url, opts = {},
     const incompatibleDependencies = [];
     for (const purl of purls) {
         const entry = licenseByPurl.get(purl);
-        if (!entry)
+        if (!entry) {
             continue;
+        }
         const status = getCompatibility(projectCategory, entry.category);
         if (status === 'incompatible') {
             const reason = entry.category?.toUpperCase() === 'UNKNOWN'

package/dist/src/license/licenses_api.d.ts

@@ -24,11 +24,11 @@ export function normalizeLicensesResponse(data: unknown, purls?: string[]): Map<
  * Build license map from an analysis report that already includes license data (result.licenses).
  * Use this when the dependency analysis response already contains the licenses array to avoid a second request.
  *
- * @param {import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport} analysisReport - full analysis JSON
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport} analysisReport - full analysis JSON
  * @param {string[]} [purls] - optional list of purls to restrict to
  * @returns {Map<string, { licenses: string[], category?: string }>}
  */
-export function licensesFromReport(analysisReport: any, purls?: string[]): Map<string, {
+export function licensesFromReport(analysisReport: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts").AnalysisReport, purls?: string[]): Map<string, {
     licenses: string[];
     category?: string;
 }>;

package/dist/src/license/licenses_api.js

@@ -86,7 +86,7 @@ export function normalizeLicensesResponse(data, purls = []) {
  * Build license map from an analysis report that already includes license data (result.licenses).
  * Use this when the dependency analysis response already contains the licenses array to avoid a second request.
  *
- * @param {import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport} analysisReport - full analysis JSON
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport} analysisReport - full analysis JSON
  * @param {string[]} [purls] - optional list of purls to restrict to
  * @returns {Map<string, { licenses: string[], category?: string }>}
  */

package/dist/src/oci_image/images.js

@@ -242,8 +242,22 @@ export class ImageRef {
     getPackageURL() {
         /** @type {Object.<string, string>} */
         const qualifiers = {};
-        const repositoryUrl = this.image.getNameWithoutTag();
+        let repositoryUrl = this.image.getNameWithoutTag();
         const simpleName = this.image.getSimpleName();
+        // Normalize Docker Hub image references so all forms produce the same PURL:
+        //   node         → docker.io/node
+        //   docker.io/library/node → docker.io/node
+        if (repositoryUrl != null) {
+            const lower = repositoryUrl.toLowerCase();
+            if (lower === simpleName.toLowerCase()) {
+                // Bare name (e.g. "node") — default to docker.io
+                repositoryUrl = `docker.io/${simpleName}`;
+            }
+            else if (lower.startsWith('docker.io/library/')) {
+                // Official image with library/ prefix — strip it
+                repositoryUrl = `docker.io/${lower.substring('docker.io/library/'.length)}`;
+            }
+        }
         if (repositoryUrl != null && repositoryUrl.toLowerCase() !== simpleName.toLowerCase()) {
             qualifiers[ImageRef.REPOSITORY_QUALIFIER] = repositoryUrl.toLowerCase();
         }

package/dist/src/package_version.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Reads this package's version from package.json, resolving the path relative
+ * to this module. Works under ESM (node >= 22 import.meta.dirname, older via
+ * import.meta.url) and CommonJS (__dirname). Returns undefined if the file
+ * cannot be read, so callers never fail on a missing version.
+ * @return {string|undefined} the package version, or undefined
+ */
+export function getPackageVersion(): string | undefined;

package/dist/src/package_version.js

@@ -0,0 +1,31 @@
+import fs from "node:fs";
+import path from "node:path";
+import * as url from "url";
+/**
+ * Reads this package's version from package.json, resolving the path relative
+ * to this module. Works under ESM (node >= 22 import.meta.dirname, older via
+ * import.meta.url) and CommonJS (__dirname). Returns undefined if the file
+ * cannot be read, so callers never fail on a missing version.
+ * @return {string|undefined} the package version, or undefined
+ */
+export function getPackageVersion() {
+    try {
+        let dirName = import.meta.dirname;
+        if (!dirName) {
+            dirName = url.fileURLToPath(new URL('.', import.meta.url));
+        }
+        try {
+            if (__dirname) {
+                dirName = __dirname;
+            }
+        }
+        catch {
+            // __dirname not defined under ESM, continue with fileURLToPath
+        }
+        const packageJson = JSON.parse(fs.readFileSync(path.join(dirName, "..", "package.json")).toString());
+        return packageJson.version;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/src/provider.js

@@ -7,6 +7,7 @@ import Javascript_bun from './providers/javascript_bun.js';
 import Javascript_npm from './providers/javascript_npm.js';
 import Javascript_pnpm from './providers/javascript_pnpm.js';
 import Javascript_yarn from './providers/javascript_yarn.js';
+import dockerfileProvider from './providers/oci_dockerfile.js';
 import pythonPipProvider from './providers/python_pip.js';
 import Python_pip_pyproject from './providers/python_pip_pyproject.js';
 import Python_poetry from './providers/python_poetry.js';
@@ -31,7 +32,8 @@ export const availableProviders = [
     new Python_poetry(),
     new Python_uv(),
     new Python_pip_pyproject(),
-    rustCargoProvider
+    rustCargoProvider,
+    dockerfileProvider
 ];
 /**
  * Match a provider by manifest type only (no lock file check). Used for license reading.

package/dist/src/providers/base_java.d.ts

@@ -10,6 +10,13 @@ export type ecosystem_maven = any;
 export const ecosystem_maven: string;
 export const ecosystem_gradle: "gradle";
 export default class Base_Java {
+    /**
+     * Maven dependency scopes. Used to detect whether the trailing column of a
+     * dependency-tree line is a scope keyword — which in turn signals that an
+     * optional classifier column is present between the packaging and version.
+     * @type {string[]}
+     */
+    static MAVEN_SCOPES: string[];
     /**
      *
      * @param {string} globalBinary name of the global binary
@@ -40,6 +47,52 @@ export default class Base_Java {
      * @protected
      */
     protected _getDepth(line: string): number;
+    /**
+     * Parse a single dependency-tree line into its Maven coordinate parts.
+     *
+     * This is the single source of truth for interpreting a dependency-tree
+     * line. Both {@link parseDep} (used to build SBOM component PURLs) and the
+     * Maven hash-map builder rely on it, so the PURL key and the artifact file
+     * path can never drift from one another.
+     *
+     * A line has the shape `groupId:artifactId:packaging[:classifier]:version[:scope]`.
+     * The classifier column is only present when a sixth column holds a known
+     * Maven scope keyword; otherwise the fourth column is the version.
+     *
+     * @param {string} line - line to parse from a dependency tree
+     * @returns {{groupId: string, artifactId: string, packaging: string, classifier: (string|null), version: string, scope: (string|null), overridden: boolean}}
+     *   Parsed coordinate. `version` is the resolved concrete version — when the
+     *   line carries a conflict override the override version replaces it and
+     *   `overridden` is set, mirroring how Maven records the winning version.
+     */
+    parseCoordinate(line: string): {
+        groupId: string;
+        artifactId: string;
+        packaging: string;
+        classifier: (string | null);
+        version: string;
+        scope: (string | null);
+        overridden: boolean;
+    };
+    /**
+     * Build the canonical PackageURL for a parsed coordinate.
+     *
+     * The classifier is folded into the version component (e.g.
+     * `4.1.0-linux-x86_64`) except when the version came from a conflict
+     * override, in which case the override version stands alone — matching the
+     * historical behavior of {@link parseDep}.
+     *
+     * @param {{groupId: string, artifactId: string, classifier: (string|null), version: string, overridden: boolean}} coord
+     * @returns {PackageURL} The canonical packageURL for the coordinate
+     * @protected
+     */
+    protected _coordinateToPurl(coord: {
+        groupId: string;
+        artifactId: string;
+        classifier: (string | null);
+        version: string;
+        overridden: boolean;
+    }): PackageURL;
     /**
      * Create a PackageURL from any line in a Text Graph dependency tree for a manifest path.
      * @param {string} line - line to parse from a dependencies.txt file

package/dist/src/providers/base_java.js

@@ -14,6 +14,13 @@ export const ecosystem_gradle = 'gradle';
 export default class Base_Java {
     DEP_REGEX = /(([-a-zA-Z0-9._]{2,})|[0-9])/g;
     CONFLICT_REGEX = /.*omitted for conflict with (\S+)\)/;
+    /**
+     * Maven dependency scopes. Used to detect whether the trailing column of a
+     * dependency-tree line is a scope keyword — which in turn signals that an
+     * optional classifier column is present between the packaging and version.
+     * @type {string[]}
+     */
+    static MAVEN_SCOPES = ['compile', 'provided', 'runtime', 'test', 'system', 'import'];
     globalBinary;
     localWrapper;
     /**
@@ -82,31 +89,71 @@ export default class Base_Java {
         }
         return ((line.indexOf('-') - 1) / 3) + 1;
     }
+    /**
+     * Parse a single dependency-tree line into its Maven coordinate parts.
+     *
+     * This is the single source of truth for interpreting a dependency-tree
+     * line. Both {@link parseDep} (used to build SBOM component PURLs) and the
+     * Maven hash-map builder rely on it, so the PURL key and the artifact file
+     * path can never drift from one another.
+     *
+     * A line has the shape `groupId:artifactId:packaging[:classifier]:version[:scope]`.
+     * The classifier column is only present when a sixth column holds a known
+     * Maven scope keyword; otherwise the fourth column is the version.
+     *
+     * @param {string} line - line to parse from a dependency tree
+     * @returns {{groupId: string, artifactId: string, packaging: string, classifier: (string|null), version: string, scope: (string|null), overridden: boolean}}
+     *   Parsed coordinate. `version` is the resolved concrete version — when the
+     *   line carries a conflict override the override version replaces it and
+     *   `overridden` is set, mirroring how Maven records the winning version.
+     */
+    parseCoordinate(line) {
+        const parts = line.split(':').map(part => part ? part.match(this.DEP_REGEX)?.[0] ?? '' : '');
+        const groupId = parts[0] ?? '';
+        const artifactId = parts[1] ?? '';
+        const packaging = parts[2] ?? '';
+        // A classifier column exists only when a sixth column holds a scope keyword.
+        const hasClassifier = parts.length >= 6 && Base_Java.MAVEN_SCOPES.includes(parts[5]);
+        const classifier = hasClassifier ? parts[3] : null;
+        let version = (hasClassifier ? parts[4] : parts[3]) ?? '';
+        const scope = hasClassifier ? parts[5] : (parts.length >= 5 ? parts[4] : null);
+        // A conflict override replaces the resolved version entirely.
+        const override = line.match(this.CONFLICT_REGEX);
+        const overridden = Boolean(override);
+        if (overridden) {
+            version = override[1];
+        }
+        return { groupId, artifactId, packaging, classifier, version, scope, overridden };
+    }
+    /**
+     * Build the canonical PackageURL for a parsed coordinate.
+     *
+     * The classifier is folded into the version component (e.g.
+     * `4.1.0-linux-x86_64`) except when the version came from a conflict
+     * override, in which case the override version stands alone — matching the
+     * historical behavior of {@link parseDep}.
+     *
+     * @param {{groupId: string, artifactId: string, classifier: (string|null), version: string, overridden: boolean}} coord
+     * @returns {PackageURL} The canonical packageURL for the coordinate
+     * @protected
+     */
+    _coordinateToPurl(coord) {
+        const purlVersion = (coord.classifier && !coord.overridden)
+            ? `${coord.version}-${coord.classifier}`
+            : coord.version;
+        return this.toPurl(coord.groupId, coord.artifactId, purlVersion);
+    }
     /**
      * Create a PackageURL from any line in a Text Graph dependency tree for a manifest path.
      * @param {string} line - line to parse from a dependencies.txt file
      * @returns {PackageURL} The parsed packageURL
      */
     parseDep(line) {
-        let match = line.split(':').map(part => part ? part.match(this.DEP_REGEX)[0] : '');
-        if (!match) {
-            throw new Error(`Unable generate SBOM from dependency tree. Line: ${line} cannot be parsed into a PackageURL`);
-        }
-        let version;
-        if (match.length >= 5 && ['compile', 'provided', 'runtime'].includes(match[5])) {
-            version = `${match[4]}-${match[3]}`;
-        }
-        else {
-            version = match[3];
-        }
-        let override = line.match(this.CONFLICT_REGEX);
-        if (override) {
-            version = override[1];
-        }
-        if (match[0].trim() === '') {
+        const coord = this.parseCoordinate(line);
+        if (coord.groupId.trim() === '') {
             throw new Error(`Artifact coordinates should have a non-empty group ID: ${line}`);
         }
-        return this.toPurl(match[0], match[1], version);
+        return this._coordinateToPurl(coord);
     }
     /**
      * Returns a PackageUrl For Java maven dependencies

package/dist/src/providers/base_javascript.d.ts

@@ -1,3 +1,16 @@
+/**
+ * Converts a Subresource Integrity (SRI) string to a CycloneDX hash object.
+ * SRI is formatted as `<alg>-<base64>` (e.g. `sha512-Ab3d...`). CycloneDX
+ * expects an uppercased algorithm label (e.g. `SHA-512`) and a hex-encoded
+ * digest. When the SRI string contains multiple space-separated hashes, only
+ * the first is used.
+ * @param {string} integrity - SRI string from a lock file
+ * @returns {{alg: string, content: string}|null} CycloneDX hash, or null when unparseable
+ */
+export function sriToHash(integrity: string): {
+    alg: string;
+    content: string;
+} | null;
 export type purlType = any;
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
@@ -65,6 +78,47 @@ export default class Base_javascript {
    * @protected
    */
     protected _updateLockFileCmdArgs(): Array<string>;
+    /**
+     * Parses the provider's lock file into a hash map keyed by `name@version`.
+     * Subclasses override this (accepting the lock directory) to support their
+     * lock file format. The default implementation returns an empty map so
+     * providers without lock parsing (or without a lock file present) gracefully
+     * omit hashes.
+     * @returns {Map<string, Array<{alg: string, content: string}>>} Hash map
+     * @protected
+     */
+    protected _parseLockFileHashes(): Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>;
+    /**
+     * Loads lock-file hashes for the given directory into internal state.
+     * Parsing failures degrade gracefully to an empty map (no hashes emitted).
+     * @param {string} lockDir - Directory containing the lock file
+     * @protected
+     */
+    protected _loadHashes(lockDir: string): void;
+    /**
+     * Looks up CycloneDX hashes for a package by name and resolved version.
+     * @param {string} name - The package name (including scope, e.g. `@hapi/joi`)
+     * @param {string} version - The resolved package version
+     * @returns {Array<{alg: string, content: string}>|undefined} Hashes, or undefined
+     * @protected
+     */
+    protected _hashesFor(name: string, version: string): Array<{
+        alg: string;
+        content: string;
+    }> | undefined;
+    /**
+     * Looks up CycloneDX hashes for a package described by a PackageURL.
+     * @param {PackageURL} purl - The package URL
+     * @returns {Array<{alg: string, content: string}>|undefined} Hashes, or undefined
+     * @protected
+     */
+    protected _hashesForPurl(purl: PackageURL): Array<{
+        alg: string;
+        content: string;
+    }> | undefined;
     /**
    * Checks if the provider supports the given manifest name
    * @param {string} manifestName - The manifest name to check