@trustify-da/trustify-da-javascript-client 0.3.0-ea.6549d2a → 0.3.0-ea.68905d3

package/dist/src/license/license_utils.js

@@ -0,0 +1,137 @@
+/**
+ * License utilities: file reading, SPDX detection, normalization, compatibility.
+ * This module has NO dependencies on providers or backend to avoid circular dependencies.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+const LICENSE_FILES = ['LICENSE', 'LICENSE.md', 'LICENSE.txt'];
+/**
+ * Find LICENSE file path in the same directory as the manifest.
+ * @param {string} manifestPath
+ * @returns {string|null} - path to LICENSE file or null if not found
+ */
+export function findLicenseFilePath(manifestPath) {
+    const manifestDir = path.dirname(path.resolve(manifestPath));
+    for (const name of LICENSE_FILES) {
+        const filePath = path.join(manifestDir, name);
+        try {
+            if (fs.statSync(filePath).isFile()) {
+                return filePath;
+            }
+        }
+        catch {
+            // skip
+        }
+    }
+    return null;
+}
+/**
+ * Very simple SPDX detection from common license text (first ~500 chars).
+ * @param {string} text
+ * @returns {string|null}
+ */
+export function detectSpdxFromText(text) {
+    const head = text.slice(0, 500);
+    if (/Apache License,?\s*Version 2\.0/i.test(head)) {
+        return 'Apache-2.0';
+    }
+    if (/MIT License/i.test(head) && /Permission is hereby granted/i.test(head)) {
+        return 'MIT';
+    }
+    if (/GNU AFFERO GENERAL PUBLIC LICENSE\s+Version 3/i.test(head)) {
+        return 'AGPL-3.0-only';
+    }
+    if (/GNU LESSER GENERAL PUBLIC LICENSE\s+Version 3/i.test(head)) {
+        return 'LGPL-3.0-only';
+    }
+    if (/GNU LESSER GENERAL PUBLIC LICENSE\s+Version 2\.1/i.test(head)) {
+        return 'LGPL-2.1-only';
+    }
+    if (/GNU GENERAL PUBLIC LICENSE\s+Version 2/i.test(head)) {
+        return 'GPL-2.0-only';
+    }
+    if (/GNU GENERAL PUBLIC LICENSE\s+Version 3/i.test(head)) {
+        return 'GPL-3.0-only';
+    }
+    if (/BSD 2-Clause/i.test(head)) {
+        return 'BSD-2-Clause';
+    }
+    if (/BSD 3-Clause/i.test(head)) {
+        return 'BSD-3-Clause';
+    }
+    return null;
+}
+/**
+ * Read LICENSE file and detect SPDX identifier.
+ * @param {string} manifestPath - path to manifest
+ * @returns {string|null} - SPDX identifier from LICENSE file or null
+ */
+export function readLicenseFile(manifestPath) {
+    const licenseFilePath = findLicenseFilePath(manifestPath);
+    if (!licenseFilePath) {
+        return null;
+    }
+    try {
+        const content = fs.readFileSync(licenseFilePath, 'utf-8');
+        return detectSpdxFromText(content) || content.split('\n')[0]?.trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Get project license from manifest or LICENSE file.
+ * Returns manifestLicense if provided, otherwise tries LICENSE file.
+ * @param {string|null} manifestLicense - license from manifest (or null)
+ * @param {string} manifestPath - path to manifest
+ * @returns {string|null} - SPDX identifier or null
+ */
+export function getLicense(manifestLicense, manifestPath) {
+    return manifestLicense || readLicenseFile(manifestPath) || null;
+}
+/**
+ * Normalize SPDX identifier for comparison (lowercase, strip common suffixes).
+ * @param {string} spdxOrName
+ * @returns {string}
+ */
+export function normalizeSpdx(spdxOrName) {
+    const s = String(spdxOrName).trim().toLowerCase();
+    if (s.endsWith(' license')) {
+        return s.slice(0, -8);
+    }
+    return s;
+}
+/**
+ * Check if a dependency's license is compatible with the project license based on backend categories.
+ *
+ * @param {string} [projectCategory] - backend category for project license: PERMISSIVE | WEAK_COPYLEFT | STRONG_COPYLEFT | UNKNOWN
+ * @param {string} [dependencyCategory] - backend category for dependency license: PERMISSIVE | WEAK_COPYLEFT | STRONG_COPYLEFT | UNKNOWN
+ * @returns {'compatible'|'incompatible'|'unknown'}
+ */
+export function getCompatibility(projectCategory, dependencyCategory) {
+    if (!projectCategory || !dependencyCategory) {
+        return 'unknown';
+    }
+    const proj = projectCategory.toUpperCase();
+    const dep = dependencyCategory.toUpperCase();
+    if (proj === 'UNKNOWN') {
+        return 'unknown';
+    }
+    if (dep === 'UNKNOWN') {
+        return 'incompatible';
+    }
+    const restrictiveness = {
+        'PERMISSIVE': 1,
+        'WEAK_COPYLEFT': 2,
+        'STRONG_COPYLEFT': 3
+    };
+    const projLevel = restrictiveness[proj];
+    const depLevel = restrictiveness[dep];
+    if (projLevel === undefined || depLevel === undefined) {
+        return 'unknown';
+    }
+    if (depLevel > projLevel) {
+        return 'incompatible';
+    }
+    return 'compatible';
+}

package/dist/src/license/licenses_api.d.ts

@@ -6,7 +6,7 @@
  * @param {import('../index.js').Options} [opts={}] - options (proxy, token, TRUSTIFY_DA_BACKEND_URL, etc.)
  * @returns {Promise<Object|null>} License details or null if not found
  */
-export function getLicenseDetails(spdxId: string, opts?: import("../index.js").Options): Promise<any | null>;
+export function getLicenseDetails(spdxId: string, opts?: import("../index.js").Options): Promise<Object | null>;
 /**
  * Normalize the LicensesResponse shape (array of LicenseProviderResult) into a map of purl -> license info.
  * Each provider result has { status, summary, packages } where packages is { [purl]: { concluded, evidence } }.
@@ -28,7 +28,7 @@ export function normalizeLicensesResponse(data: unknown, purls?: string[]): Map<
  * @param {string[]} [purls] - optional list of purls to restrict to
  * @returns {Map<string, { licenses: string[], category?: string }>}
  */
-export function licensesFromReport(analysisReport: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport, purls?: string[]): Map<string, {
+export function licensesFromReport(analysisReport: any, purls?: string[]): Map<string, {
     licenses: string[];
     category?: string;
 }>;

package/dist/src/license/licenses_api.js

@@ -4,6 +4,7 @@
  * @see https://github.com/guacsec/trustify-dependency-analytics#license-analysis-apiv5licenses
  * @see https://github.com/guacsec/trustify-da-api-spec/blob/main/api/v5/openapi.yaml
  */
+import { PackageURL } from 'packageurl-js';
 import { selectTrustifyDABackend } from '../index.js';
 import { addProxyAgent, getTokenHeaders } from '../tools.js';
 /**
@@ -39,6 +40,10 @@ export async function getLicenseDetails(spdxId, opts = {}) {
         throw new Error(`Failed to fetch license details: ${err.message}`);
     }
 }
+function normalizePurlString(purl) {
+    const parsed = PackageURL.fromString(purl);
+    return new PackageURL(parsed.type, parsed.namespace, parsed.name, parsed.version, null, null).toString();
+}
 /**
  * Normalize the LicensesResponse shape (array of LicenseProviderResult) into a map of purl -> license info.
  * Each provider result has { status, summary, packages } where packages is { [purl]: { concluded, evidence } }.
@@ -53,6 +58,7 @@ export function normalizeLicensesResponse(data, purls = []) {
     if (!data || !Array.isArray(data)) {
         return map;
     }
+    const normalizedPurlsSet = purls.length > 0 ? new Set(purls.map(normalizePurlString)) : null;
     for (const providerResult of data) {
         const packages = providerResult?.packages;
         if (!packages || typeof packages !== 'object') {
@@ -64,8 +70,9 @@ export function normalizeLicensesResponse(data, purls = []) {
             const expression = concluded?.expression;
             const licenses = identifiers.length > 0 ? identifiers : (expression ? [expression] : []);
             const category = concluded?.category; // PERMISSIVE | WEAK_COPYLEFT | STRONG_COPYLEFT | UNKNOWN
-            if (purls.length === 0 || purls.includes(purl)) {
-                map.set(purl, { licenses: licenses.filter(Boolean), category });
+            const normalizedPurl = normalizePurlString(purl);
+            if (normalizedPurlsSet === null || normalizedPurlsSet.has(normalizedPurl)) {
+                map.set(normalizedPurl, { licenses: licenses.filter(Boolean), category });
             }
         }
         // Use first provider that has packages; backend may return multiple (e.g. deps.dev)

package/dist/src/license/project_license.d.ts

@@ -10,12 +10,6 @@ export function getProjectLicense(manifestPath: string): {
     fromFile: string | null;
     mismatch: boolean;
 };
-/**
- * Find LICENSE file path in the same directory as the manifest.
- * @param {string} manifestPath
- * @returns {string|null} - path to LICENSE file or null if not found
- */
-export function findLicenseFilePath(manifestPath: string): string | null;
 /**
  * Call backend /licenses/identify endpoint to identify license from file.
  * @param {string} licenseFilePath - path to LICENSE file
@@ -23,3 +17,4 @@ export function findLicenseFilePath(manifestPath: string): string | null;
  * @returns {Promise<string|null>} - SPDX identifier or null
  */
 export function identifyLicense(licenseFilePath: string, opts?: {}): Promise<string | null>;
+export { findLicenseFilePath, readLicenseFile } from "./license_utils.js";

package/dist/src/license/project_license.js

@@ -7,7 +7,7 @@ import path from 'node:path';
 import { selectTrustifyDABackend } from '../index.js';
 import { matchForLicense, availableProviders } from '../provider.js';
 import { addProxyAgent, getTokenHeaders } from '../tools.js';
-const LICENSE_FILES = ['LICENSE', 'LICENSE.md', 'LICENSE.txt'];
+import { normalizeSpdx, readLicenseFile } from './license_utils.js';
 /**
  * Resolve project license from manifest and from LICENSE / LICENSE.md in manifest dir or git root.
  * Uses local pattern matching for LICENSE file identification (synchronous).
@@ -19,7 +19,7 @@ export function getProjectLicense(manifestPath) {
     const resolved = path.resolve(manifestPath);
     const provider = matchForLicense(resolved, availableProviders);
     const fromManifest = provider.readLicenseFromManifest(resolved);
-    const fromFile = readLicenseFromFile(resolved);
+    const fromFile = readLicenseFile(resolved);
     const mismatch = Boolean(fromManifest && fromFile && normalizeSpdx(fromManifest) !== normalizeSpdx(fromFile));
     return {
         fromManifest: fromManifest || null,
@@ -27,26 +27,7 @@ export function getProjectLicense(manifestPath) {
         mismatch
     };
 }
-/**
- * Find LICENSE file path in the same directory as the manifest.
- * @param {string} manifestPath
- * @returns {string|null} - path to LICENSE file or null if not found
- */
-export function findLicenseFilePath(manifestPath) {
-    const manifestDir = path.dirname(path.resolve(manifestPath));
-    for (const name of LICENSE_FILES) {
-        const filePath = path.join(manifestDir, name);
-        try {
-            if (fs.statSync(filePath).isFile()) {
-                return filePath;
-            }
-        }
-        catch {
-            // skip
-        }
-    }
-    return null;
-}
+export { findLicenseFilePath, readLicenseFile } from './license_utils.js';
 /**
  * Call backend /licenses/identify endpoint to identify license from file.
  * @param {string} licenseFilePath - path to LICENSE file
@@ -57,7 +38,7 @@ export async function identifyLicense(licenseFilePath, opts = {}) {
     try {
         const fileContent = fs.readFileSync(licenseFilePath);
         const backendUrl = selectTrustifyDABackend(opts);
-        const url = new URL(`${backendUrl}/licenses/identify`);
+        const url = new URL(`${backendUrl}/api/v5/licenses/identify`);
         const tokenHeaders = getTokenHeaders(opts);
         const fetchOptions = addProxyAgent({
             method: 'POST',
@@ -79,61 +60,3 @@ export async function identifyLicense(licenseFilePath, opts = {}) {
         return null; // Fallback to local detection on error
     }
 }
-/**
- * Find and read LICENSE or LICENSE.md; use local pattern matching for identification.
- * @param {string} manifestPath
- * @returns {string|null}
- */
-function readLicenseFromFile(manifestPath) {
-    const licenseFilePath = findLicenseFilePath(manifestPath);
-    if (!licenseFilePath) {
-        return null;
-    }
-    try {
-        const content = fs.readFileSync(licenseFilePath, 'utf-8');
-        return detectSpdxFromText(content) || content.split('\n')[0]?.trim() || null;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Very simple SPDX detection from common license text (first ~500 chars).
- * @param {string} text
- * @returns {string|null}
- */
-function detectSpdxFromText(text) {
-    const head = text.slice(0, 500);
-    if (/Apache License,?\s*Version 2\.0/i.test(head)) {
-        return 'Apache-2.0';
-    }
-    if (/MIT License/i.test(head) && /Permission is hereby granted/i.test(head)) {
-        return 'MIT';
-    }
-    if (/GNU GENERAL PUBLIC LICENSE\s+Version 2/i.test(head)) {
-        return 'GPL-2.0-only';
-    }
-    if (/GNU GENERAL PUBLIC LICENSE\s+Version 3/i.test(head)) {
-        return 'GPL-3.0-only';
-    }
-    if (/BSD 2-Clause/i.test(head)) {
-        return 'BSD-2-Clause';
-    }
-    if (/BSD 3-Clause/i.test(head)) {
-        return 'BSD-3-Clause';
-    }
-    return null;
-}
-/**
- * Normalize for comparison (lowercase, strip common suffixes).
- * @param {string} spdxOrName
- * @returns {string}
- */
-function normalizeSpdx(spdxOrName) {
-    const s = String(spdxOrName).trim().toLowerCase();
-    // e.g. "MIT" vs "MIT License"
-    if (s.endsWith(' license')) {
-        return s.slice(0, -8);
-    }
-    return s;
-}

package/dist/src/oci_image/images.d.ts

@@ -78,7 +78,7 @@ export class ImageRef {
      * @param {string} [platform]
      * @param {import("index.js").Options} [opts={}]
      */
-    constructor(image: string, platform?: string, opts?: import("index.js").Options);
+    constructor(image: string, platform?: string, opts?: any);
     /** @type {Image} */
     image: Image;
     /** @type {Platform} */

package/dist/src/oci_image/images.js

@@ -242,8 +242,22 @@ export class ImageRef {
     getPackageURL() {
         /** @type {Object.<string, string>} */
         const qualifiers = {};
-        const repositoryUrl = this.image.getNameWithoutTag();
+        let repositoryUrl = this.image.getNameWithoutTag();
         const simpleName = this.image.getSimpleName();
+        // Normalize Docker Hub image references so all forms produce the same PURL:
+        //   node         → docker.io/node
+        //   docker.io/library/node → docker.io/node
+        if (repositoryUrl != null) {
+            const lower = repositoryUrl.toLowerCase();
+            if (lower === simpleName.toLowerCase()) {
+                // Bare name (e.g. "node") — default to docker.io
+                repositoryUrl = `docker.io/${simpleName}`;
+            }
+            else if (lower.startsWith('docker.io/library/')) {
+                // Official image with library/ prefix — strip it
+                repositoryUrl = `docker.io/${lower.substring('docker.io/library/'.length)}`;
+            }
+        }
         if (repositoryUrl != null && repositoryUrl.toLowerCase() !== simpleName.toLowerCase()) {
             qualifiers[ImageRef.REPOSITORY_QUALIFIER] = repositoryUrl.toLowerCase();
         }

package/dist/src/oci_image/utils.d.ts

@@ -4,7 +4,7 @@
  * @param {import("../index.js").Options} [opts={}] - optional various options to pass along the application
  * @returns {{}}
  */
-export function generateImageSBOM(imageRef: import("./images").ImageRef, opts?: import("../index.js").Options): {};
+export function generateImageSBOM(imageRef: any, opts?: import("../index.js").Options): {};
 /**
  *
  * @param {string} image
@@ -25,7 +25,7 @@ export function getImagePlatform(opts?: import("../index.js").Options): Platform
  * @returns {Object.<string, string>} - The image digests
  * @throws {Error} If the image info is invalid
  */
-export function getImageDigests(imageRef: import("./images").ImageRef, opts?: import("../index.js").Options): {
+export function getImageDigests(imageRef: any, opts?: import("../index.js").Options): {
     [x: string]: string;
 };
 export type SyftImageSource = {
@@ -34,9 +34,9 @@ export type SyftImageSource = {
     getVariant: () => string;
 };
 export type SyftImageSourceType = {
-    getOs: (arg0: any) => string;
-    getArch: (arg0: any) => string;
-    getVariant: (arg0: any) => string;
+    getOs: (arg0: Object) => string;
+    getArch: (arg0: Object) => string;
+    getVariant: (arg0: Object) => string;
 };
 import { ImageRef } from './images.js';
 import { Platform } from './platform.js';

package/dist/src/oci_image/utils.js

@@ -135,7 +135,7 @@ function execSyft(imageRef, opts = {}) {
 function getSyftEnvs(dockerPath, podmanPath) {
     let path = null;
     if (dockerPath && podmanPath) {
-        path = `${dockerPath}${File.pathSeparator}${podmanPath}`;
+        path = `${dockerPath}${delimiter}${podmanPath}`;
     }
     else if (dockerPath) {
         path = dockerPath;
@@ -276,7 +276,16 @@ function podmanGetVariant(opts = {}) {
  * @returns {string} - The information
  */
 function dockerPodmanInfo(dockerSupplier, podmanSupplier, opts = {}) {
-    return dockerSupplier(opts) || podmanSupplier(opts);
+    try {
+        const result = dockerSupplier(opts);
+        if (result) {
+            return result;
+        }
+    }
+    catch (_) {
+        // docker not available, fall through to podman
+    }
+    return podmanSupplier(opts);
 }
 /**
  * Gets the digests for an image

package/dist/src/package_version.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Reads this package's version from package.json, resolving the path relative
+ * to this module. Works under ESM (node >= 22 import.meta.dirname, older via
+ * import.meta.url) and CommonJS (__dirname). Returns undefined if the file
+ * cannot be read, so callers never fail on a missing version.
+ * @return {string|undefined} the package version, or undefined
+ */
+export function getPackageVersion(): string | undefined;

package/dist/src/package_version.js

@@ -0,0 +1,31 @@
+import fs from "node:fs";
+import path from "node:path";
+import * as url from "url";
+/**
+ * Reads this package's version from package.json, resolving the path relative
+ * to this module. Works under ESM (node >= 22 import.meta.dirname, older via
+ * import.meta.url) and CommonJS (__dirname). Returns undefined if the file
+ * cannot be read, so callers never fail on a missing version.
+ * @return {string|undefined} the package version, or undefined
+ */
+export function getPackageVersion() {
+    try {
+        let dirName = import.meta.dirname;
+        if (!dirName) {
+            dirName = url.fileURLToPath(new URL('.', import.meta.url));
+        }
+        try {
+            if (__dirname) {
+                dirName = __dirname;
+            }
+        }
+        catch {
+            // __dirname not defined under ESM, continue with fileURLToPath
+        }
+        const packageJson = JSON.parse(fs.readFileSync(path.join(dirName, "..", "package.json")).toString());
+        return packageJson.version;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/src/provider.d.ts

@@ -13,12 +13,15 @@ export function matchForLicense(manifestPath: string, providers: [Provider]): Pr
  * Each provider MUST export 'provideStack' taking manifest path returning a {@link Provided}.
  * @param {string} manifest - the name-type or path of the manifest
  * @param {[Provider]} providers - list of providers to iterate over
+ * @param {{TRUSTIFY_DA_WORKSPACE_DIR?: string}} [opts={}] - optional; TRUSTIFY_DA_WORKSPACE_DIR overrides lock file location for workspaces
  * @returns {Provider}
  * @throws {Error} when the manifest is not supported and no provider was matched
  */
-export function match(manifest: string, providers: [Provider]): Provider;
+export function match(manifest: string, providers: [Provider], opts?: {
+    TRUSTIFY_DA_WORKSPACE_DIR?: string;
+}): Provider;
 /** @typedef {{ecosystem: string, contentType: string, content: string}} Provided */
-/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string): string | null}} Provider */
+/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string, Object): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string, Object=): string | null, packageManagerName: function(): string}} Provider */
 /**
  * MUST include all providers here.
  * @type {[Provider]}
@@ -31,8 +34,9 @@ export type Provided = {
 };
 export type Provider = {
     isSupported: (arg0: string) => boolean;
-    validateLockFile: (arg0: string) => void;
+    validateLockFile: (arg0: string, arg1: Object) => void;
     provideComponent: (arg0: string, arg1: {}) => Provided | Promise<Provided>;
     provideStack: (arg0: string, arg1: {}) => Provided | Promise<Provided>;
-    readLicenseFromManifest: (arg0: string) => string | null;
+    readLicenseFromManifest: (arg0: string, arg1: Object | undefined) => string | null;
+    packageManagerName: () => string;
 };

package/dist/src/provider.js

@@ -3,12 +3,18 @@ import golangGomodulesProvider from './providers/golang_gomodules.js';
 import Java_gradle_groovy from "./providers/java_gradle_groovy.js";
 import Java_gradle_kotlin from "./providers/java_gradle_kotlin.js";
 import Java_maven from "./providers/java_maven.js";
+import Javascript_bun from './providers/javascript_bun.js';
 import Javascript_npm from './providers/javascript_npm.js';
 import Javascript_pnpm from './providers/javascript_pnpm.js';
 import Javascript_yarn from './providers/javascript_yarn.js';
+import dockerfileProvider from './providers/oci_dockerfile.js';
 import pythonPipProvider from './providers/python_pip.js';
+import Python_pip_pyproject from './providers/python_pip_pyproject.js';
+import Python_poetry from './providers/python_poetry.js';
+import Python_uv from './providers/python_uv.js';
+import rustCargoProvider from './providers/rust_cargo.js';
 /** @typedef {{ecosystem: string, contentType: string, content: string}} Provided */
-/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string): string | null}} Provider */
+/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string, Object): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string, Object=): string | null, packageManagerName: function(): string}} Provider */
 /**
  * MUST include all providers here.
  * @type {[Provider]}
@@ -17,11 +23,17 @@ export const availableProviders = [
     new Java_maven(),
     new Java_gradle_groovy(),
     new Java_gradle_kotlin(),
-    new Javascript_npm(),
+    new Javascript_bun(),
     new Javascript_pnpm(),
     new Javascript_yarn(),
+    new Javascript_npm(),
     golangGomodulesProvider,
-    pythonPipProvider
+    pythonPipProvider,
+    new Python_poetry(),
+    new Python_uv(),
+    new Python_pip_pyproject(),
+    rustCargoProvider,
+    dockerfileProvider
 ];
 /**
  * Match a provider by manifest type only (no lock file check). Used for license reading.
@@ -45,16 +57,17 @@ export function matchForLicense(manifestPath, providers) {
  * Each provider MUST export 'provideStack' taking manifest path returning a {@link Provided}.
  * @param {string} manifest - the name-type or path of the manifest
  * @param {[Provider]} providers - list of providers to iterate over
+ * @param {{TRUSTIFY_DA_WORKSPACE_DIR?: string}} [opts={}] - optional; TRUSTIFY_DA_WORKSPACE_DIR overrides lock file location for workspaces
  * @returns {Provider}
  * @throws {Error} when the manifest is not supported and no provider was matched
  */
-export function match(manifest, providers) {
+export function match(manifest, providers, opts = {}) {
     const manifestPath = path.parse(manifest);
     const supported = providers.filter(prov => prov.isSupported(manifestPath.base));
     if (supported.length === 0) {
         throw new Error(`${manifestPath.base} is not supported`);
     }
-    const provider = supported.find(prov => prov.validateLockFile(manifestPath.dir));
+    const provider = supported.find(prov => prov.validateLockFile(manifestPath.dir, opts));
     if (!provider) {
         throw new Error(`${manifestPath.base} requires a lock file. Use your preferred package manager to generate the lock file.`);
     }

package/dist/src/providers/base_java.d.ts

@@ -1,4 +1,4 @@
-export type ecosystem_maven = import("../provider").Provider;
+export type ecosystem_maven = any;
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /** @typedef {{name: string, version: string}} Package */
@@ -10,6 +10,13 @@ export type ecosystem_maven = import("../provider").Provider;
 export const ecosystem_maven: string;
 export const ecosystem_gradle: "gradle";
 export default class Base_Java {
+    /**
+     * Maven dependency scopes. Used to detect whether the trailing column of a
+     * dependency-tree line is a scope keyword — which in turn signals that an
+     * optional classifier column is present between the packaging and version.
+     * @type {string[]}
+     */
+    static MAVEN_SCOPES: string[];
     /**
      *
      * @param {string} globalBinary name of the global binary
@@ -20,6 +27,11 @@ export default class Base_Java {
     CONFLICT_REGEX: RegExp;
     globalBinary: string;
     localWrapper: string;
+    /**
+     * Returns the package manager name (e.g. mvn, gradle)
+     * @returns {string}
+     */
+    packageManagerName(): string;
     /**
      * Recursively populates the SBOM instance with the parsed graph
      * @param {string} src - Source dependency to start the calculations from
@@ -28,6 +40,59 @@ export default class Base_Java {
      * @param {Sbom} sbom - The SBOM where the dependencies are being added
      */
     parseDependencyTree(src: string, srcDepth: number, lines: any[], sbom: Sbom): void;
+    /**
+     * Calculates how deep in the graph is the given line
+     * @param {string} line - line to calculate the depth from
+     * @returns {number} The calculated depth
+     * @protected
+     */
+    protected _getDepth(line: string): number;
+    /**
+     * Parse a single dependency-tree line into its Maven coordinate parts.
+     *
+     * This is the single source of truth for interpreting a dependency-tree
+     * line. Both {@link parseDep} (used to build SBOM component PURLs) and the
+     * Maven hash-map builder rely on it, so the PURL key and the artifact file
+     * path can never drift from one another.
+     *
+     * A line has the shape `groupId:artifactId:packaging[:classifier]:version[:scope]`.
+     * The classifier column is only present when a sixth column holds a known
+     * Maven scope keyword; otherwise the fourth column is the version.
+     *
+     * @param {string} line - line to parse from a dependency tree
+     * @returns {{groupId: string, artifactId: string, packaging: string, classifier: (string|null), version: string, scope: (string|null), overridden: boolean}}
+     *   Parsed coordinate. `version` is the resolved concrete version — when the
+     *   line carries a conflict override the override version replaces it and
+     *   `overridden` is set, mirroring how Maven records the winning version.
+     */
+    parseCoordinate(line: string): {
+        groupId: string;
+        artifactId: string;
+        packaging: string;
+        classifier: (string | null);
+        version: string;
+        scope: (string | null);
+        overridden: boolean;
+    };
+    /**
+     * Build the canonical PackageURL for a parsed coordinate.
+     *
+     * The classifier is folded into the version component (e.g.
+     * `4.1.0-linux-x86_64`) except when the version came from a conflict
+     * override, in which case the override version stands alone — matching the
+     * historical behavior of {@link parseDep}.
+     *
+     * @param {{groupId: string, artifactId: string, classifier: (string|null), version: string, overridden: boolean}} coord
+     * @returns {PackageURL} The canonical packageURL for the coordinate
+     * @protected
+     */
+    protected _coordinateToPurl(coord: {
+        groupId: string;
+        artifactId: string;
+        classifier: (string | null);
+        version: string;
+        overridden: boolean;
+    }): PackageURL;
     /**
      * Create a PackageURL from any line in a Text Graph dependency tree for a manifest path.
      * @param {string} line - line to parse from a dependencies.txt file
@@ -57,18 +122,8 @@ export default class Base_Java {
      * @returns string
      */
     selectToolBinary(manifestPath: string, opts: {}): string | null;
-    /**
-     *
-     * @param {string} startingManifest - the path of the manifest from which to start searching for the wrapper
-     * @param {string} repoRoot - the root of the repository at which point to stop searching for mvnw, derived via git if unset and then fallsback
-     * to the root of the drive the manifest is on (assumes absolute path is given)
-     * @returns {string|undefined}
-     */
-    traverseForWrapper(startingManifest: string, repoRoot?: string): string | undefined;
-    normalizePath(thePath: any): string;
-    #private;
 }
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 export type Package = {
     name: string;
     version: string;