@trustify-da/trustify-da-javascript-client 0.3.0-ea.61444d4 → 0.3.0-ea.62b88e5

package/dist/src/providers/javascript_bun.js

@@ -1,11 +1,51 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { parse } from 'jsonc-parser';
-import Base_javascript from './base_javascript.js';
+import Base_javascript, { sriToHash } from './base_javascript.js';
 export default class Javascript_bun extends Base_javascript {
     _lockFileName() {
         return "bun.lock";
     }
+    /**
+     * Parses `bun.lock` into a hash map keyed by `name@version`. Each entry in
+     * the `packages` section is an array whose first element is the resolved id
+     * (`name@version`) and whose fourth element is the SRI integrity string.
+     * @param {string} lockDir - Directory containing bun.lock
+     * @returns {Map<string, Array<{alg: string, content: string}>>} Hash map
+     * @protected
+     */
+    _parseLockFileHashes(lockDir) {
+        const map = new Map();
+        const lockPath = path.join(lockDir, this._lockFileName());
+        if (!fs.existsSync(lockPath)) {
+            return map;
+        }
+        let lockData;
+        try {
+            lockData = parse(fs.readFileSync(lockPath, 'utf-8'));
+        }
+        catch (_) {
+            return map;
+        }
+        const packages = lockData?.packages || {};
+        for (const entry of Object.values(packages)) {
+            if (!Array.isArray(entry) || typeof entry[0] !== 'string' || typeof entry[3] !== 'string') {
+                continue;
+            }
+            const id = entry[0];
+            const at = id.lastIndexOf('@');
+            if (at <= 0) {
+                continue;
+            }
+            const name = id.slice(0, at);
+            const version = id.slice(at + 1);
+            const hash = sriToHash(entry[3]);
+            if (name && version && hash) {
+                map.set(`${name}@${version}`, [hash]);
+            }
+        }
+        return map;
+    }
     _cmdName() {
         return "bun";
     }
@@ -20,6 +60,7 @@ export default class Javascript_bun extends Base_javascript {
         const manifestDir = path.dirname(this._getManifest().manifestPath);
         const lockDir = this._findLockFileDir(manifestDir, opts) || manifestDir;
         this._createLockFile(lockDir);
+        this._loadHashes(lockDir);
         const lockContent = fs.readFileSync(path.join(lockDir, 'bun.lock'), 'utf-8');
         const lockData = parse(lockContent);
         const packages = lockData.packages || {};

package/dist/src/providers/javascript_npm.d.ts

@@ -1,4 +1,17 @@
 export default class Javascript_npm extends Base_javascript {
+    /**
+     * Parses `package-lock.json` (lockfileVersion 2/3) into a hash map keyed by
+     * `name@version`. Each `packages` entry is keyed by its install path
+     * (e.g. `node_modules/@hapi/joi`); the package name is the segment after the
+     * final `node_modules/`. The `integrity` field holds an SRI string.
+     * @param {string} lockDir - Directory containing package-lock.json
+     * @returns {Map<string, Array<{alg: string, content: string}>>} Hash map
+     * @protected
+     */
+    protected _parseLockFileHashes(lockDir: string): Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>;
     _listCmdArgs(includeTransitive: any): string[];
     _buildDependencyTree(includeTransitive: any, opts?: {}): Object | {
         name: any;

package/dist/src/providers/javascript_npm.js

@@ -1,8 +1,47 @@
-import Base_javascript from './base_javascript.js';
+import fs from 'node:fs';
+import path from 'node:path';
+import Base_javascript, { sriToHash } from './base_javascript.js';
 export default class Javascript_npm extends Base_javascript {
     _lockFileName() {
         return "package-lock.json";
     }
+    /**
+     * Parses `package-lock.json` (lockfileVersion 2/3) into a hash map keyed by
+     * `name@version`. Each `packages` entry is keyed by its install path
+     * (e.g. `node_modules/@hapi/joi`); the package name is the segment after the
+     * final `node_modules/`. The `integrity` field holds an SRI string.
+     * @param {string} lockDir - Directory containing package-lock.json
+     * @returns {Map<string, Array<{alg: string, content: string}>>} Hash map
+     * @protected
+     */
+    _parseLockFileHashes(lockDir) {
+        const map = new Map();
+        const lockPath = path.join(lockDir, this._lockFileName());
+        if (!fs.existsSync(lockPath)) {
+            return map;
+        }
+        let lock;
+        try {
+            lock = JSON.parse(fs.readFileSync(lockPath, 'utf-8'));
+        }
+        catch (_) {
+            return map;
+        }
+        const packages = lock.packages || {};
+        for (const [pkgPath, entry] of Object.entries(packages)) {
+            if (!pkgPath || !entry || !entry.integrity || !entry.version) {
+                continue;
+            }
+            const marker = 'node_modules/';
+            const idx = pkgPath.lastIndexOf(marker);
+            const name = idx < 0 ? pkgPath : pkgPath.slice(idx + marker.length);
+            const hash = sriToHash(entry.integrity);
+            if (name && hash) {
+                map.set(`${name}@${entry.version}`, [hash]);
+            }
+        }
+        return map;
+    }
     _cmdName() {
         return "npm";
     }

package/dist/src/providers/javascript_pnpm.d.ts

@@ -1,4 +1,17 @@
 export default class Javascript_pnpm extends Base_javascript {
+    /**
+     * Parses `pnpm-lock.yaml` (lockfileVersion 9) into a hash map keyed by
+     * `name@version`. Entries in the `packages` section are keyed by
+     * `<name>@<version>` (optionally followed by a `(peer@x)` suffix); the
+     * `resolution.integrity` field holds an SRI string.
+     * @param {string} lockDir - Directory containing pnpm-lock.yaml
+     * @returns {Map<string, Array<{alg: string, content: string}>>} Hash map
+     * @protected
+     */
+    protected _parseLockFileHashes(lockDir: string): Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>;
     _listCmdArgs(includeTransitive: any): string[];
     _buildDependencyTree(includeTransitive: any, opts?: {}): any;
 }

package/dist/src/providers/javascript_pnpm.js

@@ -1,8 +1,54 @@
-import Base_javascript from './base_javascript.js';
+import fs from 'node:fs';
+import path from 'node:path';
+import { load as yamlLoad } from 'js-yaml';
+import Base_javascript, { sriToHash } from './base_javascript.js';
 export default class Javascript_pnpm extends Base_javascript {
     _lockFileName() {
         return "pnpm-lock.yaml";
     }
+    /**
+     * Parses `pnpm-lock.yaml` (lockfileVersion 9) into a hash map keyed by
+     * `name@version`. Entries in the `packages` section are keyed by
+     * `<name>@<version>` (optionally followed by a `(peer@x)` suffix); the
+     * `resolution.integrity` field holds an SRI string.
+     * @param {string} lockDir - Directory containing pnpm-lock.yaml
+     * @returns {Map<string, Array<{alg: string, content: string}>>} Hash map
+     * @protected
+     */
+    _parseLockFileHashes(lockDir) {
+        const map = new Map();
+        const lockPath = path.join(lockDir, this._lockFileName());
+        if (!fs.existsSync(lockPath)) {
+            return map;
+        }
+        let lock;
+        try {
+            lock = yamlLoad(fs.readFileSync(lockPath, 'utf-8'));
+        }
+        catch (_) {
+            return map;
+        }
+        const packages = lock?.packages || {};
+        for (const [key, entry] of Object.entries(packages)) {
+            const integrity = entry?.resolution?.integrity;
+            if (!key || !integrity) {
+                continue;
+            }
+            // Strip any peer-dependency suffix, then split name from version
+            const base = key.split('(')[0];
+            const at = base.lastIndexOf('@');
+            if (at <= 0) {
+                continue;
+            }
+            const name = base.slice(0, at);
+            const version = base.slice(at + 1);
+            const hash = sriToHash(integrity);
+            if (name && version && hash) {
+                map.set(`${name}@${version}`, [hash]);
+            }
+        }
+        return map;
+    }
     _cmdName() {
         return "pnpm";
     }

package/dist/src/providers/javascript_yarn.d.ts

@@ -1,5 +1,17 @@
 export default class Javascript_yarn extends Base_javascript {
     static VERSION_PATTERN: RegExp;
+    /**
+     * Parses `yarn.lock` into a hash map keyed by `name@version`. Supports both
+     * Yarn Classic (v1) entries with an `integrity` SRI field and Yarn Berry
+     * (v2+) entries with a `checksum` field.
+     * @param {string} lockDir - Directory containing yarn.lock
+     * @returns {Map<string, Array<{alg: string, content: string}>>} Hash map
+     * @protected
+     */
+    protected _parseLockFileHashes(lockDir: string): Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>;
     _listCmdArgs(includeTransitive: any, manifestDir: any): any;
     _updateLockFileCmdArgs(manifestDir: any): any;
     _setUp(manifestPath: any, opts: any): void;

package/dist/src/providers/javascript_yarn.js

@@ -1,12 +1,85 @@
-import Base_javascript from './base_javascript.js';
+import fs from 'node:fs';
+import path from 'node:path';
+import { parseSyml } from '@yarnpkg/parsers';
+import Base_javascript, { sriToHash } from './base_javascript.js';
 import Yarn_berry_processor from './processors/yarn_berry_processor.js';
 import Yarn_classic_processor from './processors/yarn_classic_processor.js';
+/**
+ * Converts a Yarn Berry `checksum` value to a CycloneDX hash object. Berry
+ * checksums are formatted as `<cacheKey>/<hex-sha512>`; the digest is the
+ * hex-encoded SHA-512 following the final slash.
+ * @param {string} checksum - The checksum field value
+ * @returns {{alg: string, content: string}|null} CycloneDX hash, or null
+ */
+function berryChecksumToHash(checksum) {
+    if (typeof checksum !== 'string') {
+        return null;
+    }
+    const slash = checksum.lastIndexOf('/');
+    const hex = (slash >= 0 ? checksum.slice(slash + 1) : checksum).trim();
+    if (!/^[0-9a-f]+$/i.test(hex)) {
+        return null;
+    }
+    return { alg: 'SHA-512', content: hex.toLowerCase() };
+}
 export default class Javascript_yarn extends Base_javascript {
     static VERSION_PATTERN = /^([0-9]+)\./;
     #processor;
     _lockFileName() {
         return "yarn.lock";
     }
+    /**
+     * Parses `yarn.lock` into a hash map keyed by `name@version`. Supports both
+     * Yarn Classic (v1) entries with an `integrity` SRI field and Yarn Berry
+     * (v2+) entries with a `checksum` field.
+     * @param {string} lockDir - Directory containing yarn.lock
+     * @returns {Map<string, Array<{alg: string, content: string}>>} Hash map
+     * @protected
+     */
+    _parseLockFileHashes(lockDir) {
+        const map = new Map();
+        const lockPath = path.join(lockDir, this._lockFileName());
+        if (!fs.existsSync(lockPath)) {
+            return map;
+        }
+        let content;
+        try {
+            content = fs.readFileSync(lockPath, 'utf-8');
+        }
+        catch (_) {
+            return map;
+        }
+        const parsed = parseSyml(content);
+        for (const [spec, entry] of Object.entries(parsed)) {
+            if (spec === '__metadata') {
+                continue;
+            }
+            const version = entry.version;
+            if (!version) {
+                continue;
+            }
+            let hash = null;
+            if (entry.integrity) {
+                hash = sriToHash(entry.integrity);
+            }
+            else if (entry.checksum) {
+                hash = berryChecksumToHash(entry.checksum);
+            }
+            if (!hash) {
+                continue;
+            }
+            // Handle comma-separated specifiers (e.g., "pkg@^1.0.0, pkg@^2.0.0")
+            for (const rawSpec of spec.split(',')) {
+                const trimmed = rawSpec.trim();
+                const atIndex = trimmed.lastIndexOf('@');
+                if (atIndex > 0) {
+                    const name = trimmed.slice(0, atIndex);
+                    map.set(`${name}@${version}`, [hash]);
+                }
+            }
+        }
+        return map;
+    }
     _cmdName() {
         return "yarn";
     }
@@ -34,6 +107,6 @@ export default class Javascript_yarn extends Base_javascript {
         return this.#processor.parseDepTreeOutput(output);
     }
     _addDependenciesToSbom(sbom, depTree) {
-        this.#processor.addDependenciesToSbom(sbom, depTree);
+        this.#processor.addDependenciesToSbom(sbom, depTree, purl => this._hashesForPurl(purl));
     }
 }

package/dist/src/providers/manifest.js

@@ -55,11 +55,14 @@ export default class Manifest {
     }
     loadIgnored(content) {
         let deps = [];
-        if (!content.exhortignore) {
+        // Prefer the new 'trustify-da-ignore' key, falling back to the legacy
+        // 'exhortignore' key for backwards compatibility.
+        let ignored = content['trustify-da-ignore'] || content.exhortignore;
+        if (!ignored) {
             return deps;
         }
-        for (let i = 0; i < content.exhortignore.length; i++) {
-            deps.push(toPurl("npm", content.exhortignore[i]));
+        for (let i = 0; i < ignored.length; i++) {
+            deps.push(toPurl("npm", ignored[i]));
         }
         return deps;
     }

package/dist/src/providers/processors/yarn_berry_processor.d.ts

@@ -34,8 +34,12 @@ export default class Yarn_berry_processor extends Yarn_processor {
    * Adds dependencies to the SBOM
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The dependency tree object
+   * @param {function(PackageURL): (Array<{alg: string, content: string}>|undefined)} [hashesForPurl] - Resolves lock-file hashes for a purl
    */
-    addDependenciesToSbom(sbom: Sbom, depTree: Object): void;
+    addDependenciesToSbom(sbom: Sbom, depTree: Object, hashesForPurl?: (arg0: PackageURL) => (Array<{
+        alg: string;
+        content: string;
+    }> | undefined)): void;
     #private;
 }
 import Yarn_processor from "./yarn_processor.js";

package/dist/src/providers/processors/yarn_berry_processor.js

@@ -78,8 +78,9 @@ export default class Yarn_berry_processor extends Yarn_processor {
    * Adds dependencies to the SBOM
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The dependency tree object
+   * @param {function(PackageURL): (Array<{alg: string, content: string}>|undefined)} [hashesForPurl] - Resolves lock-file hashes for a purl
    */
-    addDependenciesToSbom(sbom, depTree) {
+    addDependenciesToSbom(sbom, depTree, hashesForPurl = () => undefined) {
         if (!depTree) {
             return;
         }
@@ -137,7 +138,7 @@ export default class Yarn_berry_processor extends Yarn_processor {
                 }
                 const to = this.#purlFromLocator(d.locator);
                 if (to) {
-                    sbom.addDependency(from, to);
+                    sbom.addDependency(from, to, undefined, hashesForPurl(to));
                 }
             });
         });

package/dist/src/providers/processors/yarn_classic_processor.d.ts

@@ -30,8 +30,12 @@ export default class Yarn_classic_processor extends Yarn_processor {
    * Adds dependencies to the SBOM
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The dependency tree object
+   * @param {function(PackageURL): (Array<{alg: string, content: string}>|undefined)} [hashesForPurl] - Resolves lock-file hashes for a purl
    */
-    addDependenciesToSbom(sbom: Sbom, depTree: Object): void;
+    addDependenciesToSbom(sbom: Sbom, depTree: Object, hashesForPurl?: (arg0: PackageURL) => (Array<{
+        alg: string;
+        content: string;
+    }> | undefined)): void;
     #private;
 }
 import Yarn_processor from "./yarn_processor.js";

package/dist/src/providers/processors/yarn_classic_processor.js

@@ -50,8 +50,9 @@ export default class Yarn_classic_processor extends Yarn_processor {
    * Adds dependencies to the SBOM
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The dependency tree object
+   * @param {function(PackageURL): (Array<{alg: string, content: string}>|undefined)} [hashesForPurl] - Resolves lock-file hashes for a purl
    */
-    addDependenciesToSbom(sbom, depTree) {
+    addDependenciesToSbom(sbom, depTree, hashesForPurl = () => undefined) {
         if (!depTree?.data?.trees) {
             return;
         }
@@ -60,12 +61,12 @@ export default class Yarn_classic_processor extends Yarn_processor {
         depTree.data.trees.forEach(n => {
             const dep = new NodeMetaData(n);
             if (this._manifest.dependencies.includes(dep.name)) {
-                sbom.addDependency(rootPurl, dep.purl);
+                sbom.addDependency(rootPurl, dep.purl, undefined, hashesForPurl(dep.purl));
             }
             purls.set(dep.name, dep.purl);
         });
         depTree.data.trees.forEach(n => {
-            this.#addChildrenToSbom(sbom, n, purls);
+            this.#addChildrenToSbom(sbom, n, purls, hashesForPurl);
         });
     }
     /**
@@ -73,9 +74,10 @@ export default class Yarn_classic_processor extends Yarn_processor {
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} node - The current dependency node
    * @param {Map<string, PackageURL>} purls - Map of dependency names to their PackageURL objects
+   * @param {function(PackageURL): (Array<{alg: string, content: string}>|undefined)} hashesForPurl - Resolves lock-file hashes for a purl
    * @private
    */
-    #addChildrenToSbom(sbom, node, purls) {
+    #addChildrenToSbom(sbom, node, purls, hashesForPurl) {
         const dep = new NodeMetaData(node);
         const children = node.children ? node.children : [];
         children.forEach(c => {
@@ -83,9 +85,9 @@ export default class Yarn_classic_processor extends Yarn_processor {
             const from = dep.shadow ? purls.get(dep.name) : dep.purl;
             const to = child.shadow ? purls.get(child.name) : child.purl;
             if (from && to) {
-                sbom.addDependency(from, to);
+                sbom.addDependency(from, to, undefined, hashesForPurl(to));
             }
-            this.#addChildrenToSbom(sbom, c, purls);
+            this.#addChildrenToSbom(sbom, c, purls, hashesForPurl);
         });
     }
 }

package/dist/src/providers/python_uv.js

@@ -144,6 +144,12 @@ export default class Python_uv extends Base_pyproject {
                         continue;
                     }
                 }
+                // PEP 440 direct references (name @ url) — skip, no pinned version available
+                if (child.children.find(c => c.type === 'url_spec')) {
+                    currentPkg = null;
+                    collectingVia = false;
+                    continue;
+                }
                 let name = nameNode.text;
                 let version = null;
                 let versionMatches = pinnedVersionQuery.matches(child);

package/dist/src/providers/requirements_parser.js

@@ -16,7 +16,7 @@ export async function getRequirementQuery() {
 }
 export async function getIgnoreQuery() {
     const language = await init();
-    return new Query(language, '((requirement (package) @name) @req . (comment) @comment (#match? @comment "^#[\\t ]*exhortignore"))');
+    return new Query(language, '((requirement (package) @name) @req . (comment) @comment (#match? @comment "^#[\\t ]*(exhortignore|trustify-da-ignore)(?![\\w-])"))');
 }
 export async function getPinnedVersionQuery() {
     const language = await init();

package/dist/src/providers/rust_cargo.js

@@ -116,30 +116,25 @@ function resolveWorkspaceLicense(parsed, metadata) {
     return parsed.workspace?.package?.license || null;
 }
 /**
- * Validates that Cargo.lock exists in the manifest directory or in a parent
- * workspace root directory.  In Cargo workspaces the lock file always lives at
- * the workspace root, so when a member crate's Cargo.toml is provided we walk
- * up the directory tree looking for Cargo.lock (stopping when we find a
- * Cargo.toml that contains a [workspace] section, or when we reach the
- * filesystem root).
- * When TRUSTIFY_DA_WORKSPACE_DIR is provided (via env var or opts),
- * checks only that directory for Cargo.lock — no walk-up.
+ * Finds the directory containing Cargo.lock, honoring TRUSTIFY_DA_WORKSPACE_DIR.
+ * Walks up from manifestDir looking for Cargo.lock, stopping at workspace root or filesystem root.
  * @param {string} manifestDir - the directory where the manifest lies
  * @param {{TRUSTIFY_DA_WORKSPACE_DIR?: string}} [opts={}] - optional workspace root
- * @returns {boolean} true if Cargo.lock is found
+ * @returns {string|null} the directory path containing Cargo.lock, or null if not found
+ * @private
  */
-function validateLockFile(manifestDir, opts = {}) {
+function _findCargoLockDir(manifestDir, opts = {}) {
     const workspaceDir = getCustom('TRUSTIFY_DA_WORKSPACE_DIR', null, opts);
     if (workspaceDir) {
         const dir = path.resolve(workspaceDir);
-        return fs.existsSync(path.join(dir, 'Cargo.lock'));
+        return fs.existsSync(path.join(dir, 'Cargo.lock')) ? dir : null;
     }
     let dir = path.resolve(manifestDir);
     let parent = dir;
     do {
         dir = parent;
         if (fs.existsSync(path.join(dir, 'Cargo.lock'))) {
-            return true;
+            return dir;
         }
         // If this directory has a Cargo.toml with [workspace], the lock file
         // should have been here — stop searching.
@@ -148,7 +143,7 @@ function validateLockFile(manifestDir, opts = {}) {
             try {
                 let content = fs.readFileSync(cargoToml, 'utf-8');
                 if (/\[workspace\]/.test(content)) {
-                    return false;
+                    return null;
                 }
             }
             catch (_) {
@@ -157,7 +152,23 @@ function validateLockFile(manifestDir, opts = {}) {
         }
         parent = path.dirname(dir);
     } while (parent !== dir);
-    return false;
+    return null;
+}
+/**
+ * Validates that Cargo.lock exists in the manifest directory or in a parent
+ * workspace root directory.  In Cargo workspaces the lock file always lives at
+ * the workspace root, so when a member crate's Cargo.toml is provided we walk
+ * up the directory tree looking for Cargo.lock (stopping when we find a
+ * Cargo.toml that contains a [workspace] section, or when we reach the
+ * filesystem root).
+ * When TRUSTIFY_DA_WORKSPACE_DIR is provided (via env var or opts),
+ * checks only that directory for Cargo.lock — no walk-up.
+ * @param {string} manifestDir - the directory where the manifest lies
+ * @param {{TRUSTIFY_DA_WORKSPACE_DIR?: string}} [opts={}] - optional workspace root
+ * @returns {boolean} true if Cargo.lock is found
+ */
+function validateLockFile(manifestDir, opts = {}) {
+    return _findCargoLockDir(manifestDir, opts) !== null;
 }
 /**
  * Provide content and content type for Cargo stack analysis.
@@ -201,7 +212,7 @@ function getSBOM(manifest, opts = {}, includeTransitive) {
     let ignoredDeps = getIgnoredDeps(manifest, metadata);
     let crateType = detectCrateType(metadata);
     let license = readLicenseFromManifest(manifest, metadata);
-    let hashMap = parseCargoLockHashes(manifestDir);
+    let hashMap = parseCargoLockHashes(manifestDir, opts);
     let sbom;
     if (crateType === CrateType.WORKSPACE_VIRTUAL) {
         sbom = handleVirtualWorkspace(manifest, metadata, ignoredDeps, includeTransitive, opts, license, hashMap);
@@ -248,15 +259,17 @@ function executeCargoMetadata(cargoBin, manifestDir) {
 /**
  * Parses Cargo.lock to extract SHA-256 checksums for each package.
  * @param {string} manifestDir - directory containing Cargo.toml (Cargo.lock is searched upward)
+ * @param {{TRUSTIFY_DA_WORKSPACE_DIR?: string}} [opts={}] - optional workspace root
  * @returns {Map<string, Array<{alg: string, content: string}>>} map of "name@version" to CycloneDX hashes
  * @private
  */
-function parseCargoLockHashes(manifestDir) {
+function parseCargoLockHashes(manifestDir, opts = {}) {
     let hashMap = new Map();
-    let lockPath = findCargoLock(manifestDir);
-    if (!lockPath) {
+    let lockDir = _findCargoLockDir(manifestDir, opts);
+    if (!lockDir) {
         return hashMap;
     }
+    let lockPath = path.join(lockDir, 'Cargo.lock');
     try {
         let content = fs.readFileSync(lockPath, 'utf-8');
         let parsed = parseToml(content);
@@ -267,41 +280,10 @@ function parseCargoLockHashes(manifestDir) {
         }
     }
     catch (error) {
-        console.warn('Failed to parse Cargo.lock for hashes, SBOM will be generated without hashes');
+        console.warn(`Failed to parse Cargo.lock at ${lockPath} for hashes: ${error.message}. SBOM will be generated without hashes.`);
     }
     return hashMap;
 }
-/**
- * Searches upward from the manifest directory to find the nearest Cargo.lock.
- * @param {string} manifestDir - starting directory
- * @returns {string|null} absolute path to Cargo.lock or null if not found
- * @private
- */
-function findCargoLock(manifestDir) {
-    let dir = path.resolve(manifestDir);
-    let parent = dir;
-    do {
-        dir = parent;
-        let lockFile = path.join(dir, 'Cargo.lock');
-        if (fs.existsSync(lockFile)) {
-            return lockFile;
-        }
-        let cargoToml = path.join(dir, 'Cargo.toml');
-        if (fs.existsSync(cargoToml)) {
-            try {
-                let content = fs.readFileSync(cargoToml, 'utf-8');
-                if (/\[workspace\]/.test(content)) {
-                    return null;
-                }
-            }
-            catch (_) {
-                // ignore read errors, keep searching
-            }
-        }
-        parent = path.dirname(dir);
-    } while (parent !== dir);
-    return null;
-}
 /**
  * Detects the type of Cargo project from metadata.
  * @param {object} metadata - parsed cargo metadata
@@ -459,7 +441,7 @@ function addTransitiveDeps(sbom, metadata, packageId, ignoredDeps, visited, hash
         let depPurl = depPackage.source == null
             ? toPathDepPurl(depPackage.name, depPackage.version)
             : toPurl(depPackage.name, depPackage.version);
-        let hashes = hashMap ? hashMap.get(`${depPackage.name}@${depPackage.version}`) : undefined;
+        let hashes = hashMap.get(`${depPackage.name}@${depPackage.version}`);
         sbom.addDependency(sourcePurl, depPurl, undefined, hashes);
         addTransitiveDeps(sbom, metadata, depId, ignoredDeps, visited, hashMap);
     }
@@ -491,7 +473,7 @@ function addDirectDeps(sbom, metadata, packageId, parentPurl, ignoredDeps, hashM
         let depPurl = depPackage.source == null
             ? toPathDepPurl(depPackage.name, depPackage.version)
             : toPurl(depPackage.name, depPackage.version);
-        let hashes = hashMap ? hashMap.get(`${depPackage.name}@${depPackage.version}`) : undefined;
+        let hashes = hashMap.get(`${depPackage.name}@${depPackage.version}`);
         sbom.addDependency(parentPurl, depPurl, undefined, hashes);
     }
 }