@trustify-da/trustify-da-javascript-client 0.3.0-ea.9988076 → 0.3.0-ea.9a6adf7

package/dist/src/providers/rust_cargo.js

@@ -4,8 +4,8 @@ import { PackageURL } from 'packageurl-js';
 import { parse as parseToml } from 'smol-toml';
 import { getLicense } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
-import { getCustomPath, invokeCommand } from '../tools.js';
-export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest };
+import { getCustom, getCustomPath, invokeCommand } from '../tools.js';
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'cargo'; } };
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /**
@@ -71,15 +71,22 @@ function isSupported(manifestName) {
  * Read project license from Cargo.toml, with fallback to LICENSE file.
  * Supports the `license` field under `[package]` (single crate / workspace
  * with root) and under `[workspace.package]` (virtual workspaces).
+ * When a member crate uses `license = { workspace = true }`, the actual
+ * license is resolved from the workspace root Cargo.toml.
  * @param {string} manifestPath - path to Cargo.toml
+ * @param {object} [metadata] - cargo metadata output (needed for workspace license resolution)
  * @returns {string|null} SPDX identifier or null
  */
-function readLicenseFromManifest(manifestPath) {
+function readLicenseFromManifest(manifestPath, metadata) {
     let fromManifest = null;
     try {
         let content = fs.readFileSync(manifestPath, 'utf-8');
         let parsed = parseToml(content);
-        fromManifest = parsed.package?.license
+        let packageLicense = parsed.package?.license;
+        if (typeof packageLicense === 'object' && packageLicense?.workspace === true) {
+            packageLicense = resolveWorkspaceLicense(parsed, metadata);
+        }
+        fromManifest = packageLicense
             || parsed.workspace?.package?.license
             || null;
     }
@@ -88,6 +95,26 @@ function readLicenseFromManifest(manifestPath) {
     }
     return getLicense(fromManifest, manifestPath);
 }
+/**
+ * Resolve a workspace-inherited license from the workspace root Cargo.toml.
+ * @param {object} parsed - the parsed member crate Cargo.toml
+ * @param {object} [metadata] - cargo metadata output with workspace_root
+ * @returns {string|null} resolved license string or null
+ */
+function resolveWorkspaceLicense(parsed, metadata) {
+    if (metadata?.workspace_root) {
+        let cargoTomlPath = path.join(metadata.workspace_root, 'Cargo.toml');
+        try {
+            let content = fs.readFileSync(cargoTomlPath, 'utf-8');
+            let workspaceParsed = parseToml(content);
+            return workspaceParsed.workspace?.package?.license || null;
+        }
+        catch (_) {
+            // fall through
+        }
+    }
+    return parsed.workspace?.package?.license || null;
+}
 /**
  * Validates that Cargo.lock exists in the manifest directory or in a parent
  * workspace root directory.  In Cargo workspaces the lock file always lives at
@@ -95,10 +122,18 @@ function readLicenseFromManifest(manifestPath) {
  * up the directory tree looking for Cargo.lock (stopping when we find a
  * Cargo.toml that contains a [workspace] section, or when we reach the
  * filesystem root).
+ * When TRUSTIFY_DA_WORKSPACE_DIR is provided (via env var or opts),
+ * checks only that directory for Cargo.lock — no walk-up.
  * @param {string} manifestDir - the directory where the manifest lies
+ * @param {{TRUSTIFY_DA_WORKSPACE_DIR?: string}} [opts={}] - optional workspace root
  * @returns {boolean} true if Cargo.lock is found
  */
-function validateLockFile(manifestDir) {
+function validateLockFile(manifestDir, opts = {}) {
+    const workspaceDir = getCustom('TRUSTIFY_DA_WORKSPACE_DIR', null, opts);
+    if (workspaceDir) {
+        const dir = path.resolve(workspaceDir);
+        return fs.existsSync(path.join(dir, 'Cargo.lock'));
+    }
     let dir = path.resolve(manifestDir);
     let parent = dir;
     do {
@@ -165,7 +200,7 @@ function getSBOM(manifest, opts = {}, includeTransitive) {
     let metadata = executeCargoMetadata(cargoBin, manifestDir);
     let ignoredDeps = getIgnoredDeps(manifest, metadata);
     let crateType = detectCrateType(metadata);
-    let license = readLicenseFromManifest(manifest);
+    let license = readLicenseFromManifest(manifest, metadata);
     let sbom;
     if (crateType === CrateType.WORKSPACE_VIRTUAL) {
         sbom = handleVirtualWorkspace(manifest, metadata, ignoredDeps, includeTransitive, opts, license);

package/dist/src/sbom.d.ts

@@ -25,9 +25,14 @@ export default class Sbom {
     /**
      * @param {component} sourceRef current source Component ( Starting from root component by clients)
      * @param {PackageURL} targetRef current dependency to add to Dependencies list of component sourceRef
+     * @param {string} [scope] - Scope of the dependency
+     * @param {Array<{alg: string, content: string}>} [targetHashes] - Optional hashes for the target component
      * @return Sbom
      */
-    addDependency(sourceRef: component, targetRef: PackageURL, scope: any): CycloneDxSbom;
+    addDependency(sourceRef: component, targetRef: PackageURL, scope?: string, targetHashes?: Array<{
+        alg: string;
+        content: string;
+    }>): CycloneDxSbom;
     /**
      * @return String sbom json in a string format
      */
@@ -45,6 +50,7 @@ export default class Sbom {
         version: any;
         scope: any;
         licenses?: any;
+        hashes?: any;
     };
     /** This method gets a component object, and a string name, and checks if the name is a substring of the component' purl.
      * @param {} component to search in its dependencies
@@ -53,6 +59,13 @@ export default class Sbom {
      * @return {boolean}
      */
     checkIfPackageInsideDependsOnList(component: any, name: string): boolean;
+    /**
+     * Checks if any entry in the dependsOn list of sourceRef starts with the given purl prefix.
+     * @param {PackageURL} sourceRef - The source component to check
+     * @param {string} purlPrefix - The purl prefix to match (e.g. "pkg:npm/minimist@")
+     * @return {boolean}
+     */
+    checkDependsOnByPurlPrefix(sourceRef: PackageURL, purlPrefix: string): boolean;
     /** Removes the root component from the sbom
      */
     removeRootComponent(): void;

package/dist/src/sbom.js

@@ -43,10 +43,12 @@ export default class Sbom {
     /**
      * @param {component} sourceRef current source Component ( Starting from root component by clients)
      * @param {PackageURL} targetRef current dependency to add to Dependencies list of component sourceRef
+     * @param {string} [scope] - Scope of the dependency
+     * @param {Array<{alg: string, content: string}>} [targetHashes] - Optional hashes for the target component
      * @return Sbom
      */
-    addDependency(sourceRef, targetRef, scope) {
-        return this.sbomModel.addDependency(sourceRef, targetRef, scope);
+    addDependency(sourceRef, targetRef, scope, targetHashes) {
+        return this.sbomModel.addDependency(sourceRef, targetRef, scope, targetHashes);
     }
     /**
      * @return String sbom json in a string format
@@ -77,6 +79,15 @@ export default class Sbom {
     checkIfPackageInsideDependsOnList(component, name) {
         return this.sbomModel.checkIfPackageInsideDependsOnList(component, name);
     }
+    /**
+     * Checks if any entry in the dependsOn list of sourceRef starts with the given purl prefix.
+     * @param {PackageURL} sourceRef - The source component to check
+     * @param {string} purlPrefix - The purl prefix to match (e.g. "pkg:npm/minimist@")
+     * @return {boolean}
+     */
+    checkDependsOnByPurlPrefix(sourceRef, purlPrefix) {
+        return this.sbomModel.checkDependsOnByPurlPrefix(sourceRef, purlPrefix);
+    }
     /** Removes the root component from the sbom
      */
     removeRootComponent() {

package/dist/src/tools.d.ts

@@ -61,6 +61,32 @@ export function toPurlFromString(strPurl: any): PackageURL | null;
  * @param {string} cwd - directory for which to find the root of the git repository.
  */
 export function getGitRootDir(cwd: string): string | undefined;
+/**
+ * Normalize a filesystem path, lowercasing on Windows for case-insensitive comparison.
+ *
+ * @param {string} thePath
+ * @returns {string}
+ */
+export function normalizePath(thePath: string): string;
+/**
+ * Walk up from `startDir` to `repoRoot` looking for an executable wrapper script.
+ *
+ * @param {string} startDir - Absolute directory to start from
+ * @param {string} wrapperName - Wrapper filename (e.g. `mvnw`, `gradlew`)
+ * @param {string} [repoRoot] - Stop boundary (defaults to git root or filesystem root)
+ * @returns {string | undefined}
+ */
+export function traverseForWrapper(startDir: string, wrapperName: string, repoRoot?: string): string | undefined;
+/**
+ * Resolve a build-tool binary, preferring a wrapper when configured.
+ *
+ * @param {string} globalBinary - Global binary name (e.g. `mvn`, `gradle`)
+ * @param {string} localWrapper - Wrapper filename (e.g. `mvnw`, `gradlew.bat`)
+ * @param {string} startDir - Directory from which to start the wrapper search
+ * @param {import('./index.js').Options} [opts={}]
+ * @returns {string} Path to the resolved binary
+ */
+export function resolveBinary(globalBinary: string, localWrapper: string, startDir: string, opts?: import("./index.js").Options): string;
 /** this method invokes command string in a process in a synchronous way.
  * @param {string} bin - the command to be invoked
  * @param {Array<string>} args - the args to pass to the binary
@@ -74,13 +100,13 @@ export function invokeCommand(bin: string, args: Array<string>, opts?: import("c
  * @param {import("index.js").Options} opts - The trustify DA options that may contain proxy configuration
  * @returns {RequestInit} The fetch options with proxy agent if applicable
  */
-export function addProxyAgent(options: RequestInit, opts: import("index.js").Options): RequestInit;
+export function addProxyAgent(options: RequestInit, opts: any): RequestInit;
 /**
  * Utility function for fetching vendor tokens
  * @param {import("index.js").Options} [opts={}] - optional various options to pass along the application
  * @returns {{}}
  */
-export function getTokenHeaders(opts?: import("index.js").Options): {};
+export function getTokenHeaders(opts?: any): {};
 export const RegexNotToBeLogged: RegExp;
 export const TRUSTIFY_DA_TOKEN_HEADER: "trust-da-token";
 export const TRUSTIFY_DA_TELEMETRY_ID_HEADER: "telemetry-anonymous-id";

package/dist/src/tools.js

@@ -1,4 +1,6 @@
 import { execFileSync } from "child_process";
+import fs from 'node:fs';
+import path from 'node:path';
 import { EOL } from "os";
 import { HttpsProxyAgent } from "https-proxy-agent";
 import { PackageURL } from "packageurl-js";
@@ -128,6 +130,62 @@ export function getGitRootDir(cwd) {
         return undefined;
     }
 }
+/**
+ * Normalize a filesystem path, lowercasing on Windows for case-insensitive comparison.
+ *
+ * @param {string} thePath
+ * @returns {string}
+ */
+export function normalizePath(thePath) {
+    const normalized = path.resolve(thePath).normalize();
+    return process.platform === 'win32' ? normalized.toLowerCase() : normalized;
+}
+/**
+ * Walk up from `startDir` to `repoRoot` looking for an executable wrapper script.
+ *
+ * @param {string} startDir - Absolute directory to start from
+ * @param {string} wrapperName - Wrapper filename (e.g. `mvnw`, `gradlew`)
+ * @param {string} [repoRoot] - Stop boundary (defaults to git root or filesystem root)
+ * @returns {string | undefined}
+ */
+export function traverseForWrapper(startDir, wrapperName, repoRoot = undefined) {
+    const currentDir = normalizePath(startDir);
+    repoRoot = repoRoot || getGitRootDir(currentDir) || path.parse(currentDir).root;
+    const wrapperPath = path.join(currentDir, wrapperName);
+    try {
+        fs.accessSync(wrapperPath, fs.constants.X_OK);
+        return wrapperPath;
+    }
+    catch {
+        const rootDir = path.parse(currentDir).root;
+        if (currentDir === repoRoot || currentDir === rootDir) {
+            return undefined;
+        }
+        const parentDir = path.dirname(currentDir);
+        if (parentDir === currentDir || parentDir === rootDir) {
+            return undefined;
+        }
+        return traverseForWrapper(parentDir, wrapperName, repoRoot);
+    }
+}
+/**
+ * Resolve a build-tool binary, preferring a wrapper when configured.
+ *
+ * @param {string} globalBinary - Global binary name (e.g. `mvn`, `gradle`)
+ * @param {string} localWrapper - Wrapper filename (e.g. `mvnw`, `gradlew.bat`)
+ * @param {string} startDir - Directory from which to start the wrapper search
+ * @param {import('./index.js').Options} [opts={}]
+ * @returns {string} Path to the resolved binary
+ */
+export function resolveBinary(globalBinary, localWrapper, startDir, opts = {}) {
+    if (getWrapperPreference(globalBinary, opts)) {
+        const wrapper = traverseForWrapper(startDir, localWrapper);
+        if (wrapper !== undefined) {
+            return wrapper;
+        }
+    }
+    return getCustomPath(globalBinary, opts);
+}
 /** this method invokes command string in a process in a synchronous way.
  * @param {string} bin - the command to be invoked
  * @param {Array<string>} args - the args to pass to the binary

package/dist/src/workspace.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Resolve ignore globs for workspace discovery: defaults + `TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE` + `opts.workspaceDiscoveryIgnore`.
+ * Patterns are fast-glob / micromatch style, relative to the workspace root (forward slashes).
+ *
+ * @param {{ workspaceDiscoveryIgnore?: string[], TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string, [key: string]: unknown }} [opts={}]
+ * @returns {string[]}
+ */
+export function resolveWorkspaceDiscoveryIgnore(opts?: {
+    workspaceDiscoveryIgnore?: string[];
+    TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string;
+    [key: string]: unknown;
+}): string[];
+/**
+ * Drop manifest paths whose location matches an ignore pattern (e.g. root unshift, Cargo paths).
+ *
+ * @param {string[]} manifestPaths
+ * @param {string} root
+ * @param {string[]} ignorePatterns
+ * @returns {string[]}
+ */
+export function filterManifestPathsByDiscoveryIgnore(manifestPaths: string[], root: string, ignorePatterns: string[]): string[];
+/**
+ * @typedef {{ valid: true, name: string, version: string } | { valid: false, error: string }} ValidatePackageJsonResult
+ */
+/**
+ * Validate a package.json has non-empty `name` and `version` (required for stable SBOM root identity in batch).
+ *
+ * @param {string} packageJsonPath - Absolute or relative path to package.json
+ * @returns {ValidatePackageJsonResult}
+ */
+export function validatePackageJson(packageJsonPath: string): ValidatePackageJsonResult;
+/**
+ * Discover all package.json paths in a JS/TS workspace.
+ * Reads pnpm-workspace.yaml or package.json workspaces.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root
+ * @param {{ workspaceDiscoveryIgnore?: string[], TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string, [key: string]: unknown }} [opts={}] - optional `workspaceDiscoveryIgnore` globs (merged with defaults and env)
+ * @returns {Promise<string[]>} Paths to package.json files (absolute)
+ */
+export function discoverWorkspacePackages(workspaceRoot: string, opts?: {
+    workspaceDiscoveryIgnore?: string[];
+    TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string;
+    [key: string]: unknown;
+}): Promise<string[]>;
+/**
+ * Convert workspace glob patterns to manifest-file glob patterns,
+ * correctly handling negation prefixes.
+ *
+ * @param {string[]} patterns - Workspace glob patterns (may include negations)
+ * @param {string} manifestFileName - e.g. 'package.json' or 'Cargo.toml'
+ * @returns {string[]}
+ */
+export function toManifestGlobPatterns(patterns: string[], manifestFileName: string): string[];
+/**
+ * Discover all Cargo.toml manifest paths in a Cargo workspace.
+ * Uses `cargo metadata` to get workspace members.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain Cargo.toml and Cargo.lock)
+ * @param {import('./index.js').Options} [opts={}]
+ * @returns {Promise<string[]>} Paths to Cargo.toml files (absolute)
+ */
+export function discoverWorkspaceCrates(workspaceRoot: string, opts?: import("./index.js").Options): Promise<string[]>;
+export type ValidatePackageJsonResult = {
+    valid: true;
+    name: string;
+    version: string;
+} | {
+    valid: false;
+    error: string;
+};

package/dist/src/workspace.js

@@ -0,0 +1,256 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import fg from 'fast-glob';
+import { load as yamlLoad } from 'js-yaml';
+import micromatch from 'micromatch';
+import { getCustom, getCustomPath, invokeCommand } from './tools.js';
+/** Default paths skipped during JS workspace discovery (merged with user patterns). */
+const DEFAULT_WORKSPACE_DISCOVERY_IGNORE = [
+    '**/node_modules/**',
+    '**/.git/**',
+];
+/**
+ * Resolve ignore globs for workspace discovery: defaults + `TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE` + `opts.workspaceDiscoveryIgnore`.
+ * Patterns are fast-glob / micromatch style, relative to the workspace root (forward slashes).
+ *
+ * @param {{ workspaceDiscoveryIgnore?: string[], TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string, [key: string]: unknown }} [opts={}]
+ * @returns {string[]}
+ */
+export function resolveWorkspaceDiscoveryIgnore(opts = {}) {
+    const merged = [...DEFAULT_WORKSPACE_DISCOVERY_IGNORE];
+    const fromEnv = getCustom('TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE', null, opts);
+    if (fromEnv && String(fromEnv).trim()) {
+        merged.push(...String(fromEnv).split(',').map(s => s.trim()).filter(Boolean));
+    }
+    const extra = opts.workspaceDiscoveryIgnore;
+    if (Array.isArray(extra)) {
+        for (const p of extra) {
+            if (typeof p === 'string' && p.trim()) {
+                merged.push(p.trim());
+            }
+        }
+    }
+    return [...new Set(merged)];
+}
+/**
+ * @param {string} root - Workspace root (absolute)
+ * @param {string[]} ignorePatterns
+ */
+function buildWorkspaceDiscoveryGlobOptions(root, ignorePatterns) {
+    return {
+        cwd: root,
+        absolute: true,
+        onlyFiles: true,
+        ignore: ignorePatterns,
+        followSymbolicLinks: false,
+    };
+}
+/**
+ * @param {string} filePath - Absolute path
+ * @param {string} root - Workspace root (absolute)
+ * @returns {string} Relative path with forward slashes
+ */
+function relativePathForGlobMatch(filePath, root) {
+    const rel = path.relative(root, filePath);
+    return rel.split(path.sep).join('/');
+}
+/**
+ * Drop manifest paths whose location matches an ignore pattern (e.g. root unshift, Cargo paths).
+ *
+ * @param {string[]} manifestPaths
+ * @param {string} root
+ * @param {string[]} ignorePatterns
+ * @returns {string[]}
+ */
+export function filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns) {
+    if (!ignorePatterns.length) {
+        return manifestPaths;
+    }
+    const resolvedRoot = path.resolve(root);
+    return manifestPaths.filter(absPath => {
+        const rel = relativePathForGlobMatch(absPath, resolvedRoot);
+        if (rel === '') {
+            return true;
+        }
+        return !ignorePatterns.some(pattern => micromatch.isMatch(rel, pattern, { dot: true }));
+    });
+}
+/**
+ * @typedef {{ valid: true, name: string, version: string } | { valid: false, error: string }} ValidatePackageJsonResult
+ */
+/**
+ * Validate a package.json has non-empty `name` and `version` (required for stable SBOM root identity in batch).
+ *
+ * @param {string} packageJsonPath - Absolute or relative path to package.json
+ * @returns {ValidatePackageJsonResult}
+ */
+export function validatePackageJson(packageJsonPath) {
+    let content;
+    try {
+        const raw = fs.readFileSync(packageJsonPath, 'utf-8');
+        content = JSON.parse(raw);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { valid: false, error: `Invalid package.json: ${msg}` };
+    }
+    if (!content || typeof content !== 'object') {
+        return { valid: false, error: 'package.json must be a JSON object' };
+    }
+    const name = content.name;
+    const version = content.version;
+    if (typeof name !== 'string' || !name.trim()) {
+        return { valid: false, error: 'Missing or invalid name' };
+    }
+    if (typeof version !== 'string' || !version.trim()) {
+        return { valid: false, error: 'Missing or invalid version' };
+    }
+    return { valid: true, name: name.trim(), version: version.trim() };
+}
+/**
+ * Discover all package.json paths in a JS/TS workspace.
+ * Reads pnpm-workspace.yaml or package.json workspaces.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root
+ * @param {{ workspaceDiscoveryIgnore?: string[], TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string, [key: string]: unknown }} [opts={}] - optional `workspaceDiscoveryIgnore` globs (merged with defaults and env)
+ * @returns {Promise<string[]>} Paths to package.json files (absolute)
+ */
+export async function discoverWorkspacePackages(workspaceRoot, opts = {}) {
+    const root = path.resolve(workspaceRoot);
+    const ignorePatterns = resolveWorkspaceDiscoveryIgnore(opts);
+    const globOpts = buildWorkspaceDiscoveryGlobOptions(root, ignorePatterns);
+    const pnpmWorkspace = path.join(root, 'pnpm-workspace.yaml');
+    const packageJson = path.join(root, 'package.json');
+    if (fs.existsSync(pnpmWorkspace)) {
+        return discoverFromPnpmWorkspace(root, pnpmWorkspace, globOpts, ignorePatterns);
+    }
+    if (fs.existsSync(packageJson)) {
+        return discoverFromPackageJsonWorkspaces(root, packageJson, globOpts, ignorePatterns);
+    }
+    return [];
+}
+/**
+ * @param {string} root
+ * @param {string} pnpmWorkspacePath
+ * @param {object} globOpts - fast-glob options (cwd, ignore, followSymbolicLinks, …)
+ * @param {string[]} ignorePatterns - for post-filter
+ * @returns {Promise<string[]>}
+ */
+async function discoverFromPnpmWorkspace(root, pnpmWorkspacePath, globOpts, ignorePatterns) {
+    const content = fs.readFileSync(pnpmWorkspacePath, 'utf-8');
+    const packages = parsePnpmPackages(content);
+    if (packages.length === 0) {
+        return [];
+    }
+    const patterns = toManifestGlobPatterns(packages, 'package.json');
+    const manifestPaths = await fg(patterns, globOpts);
+    return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+}
+/**
+ * Parse the `packages` array from pnpm-workspace.yaml content.
+ * @param {string} content - Raw YAML content
+ * @returns {string[]}
+ */
+function parsePnpmPackages(content) {
+    let doc;
+    try {
+        doc = yamlLoad(content);
+    }
+    catch {
+        return [];
+    }
+    if (!doc || typeof doc !== 'object' || !Array.isArray(doc.packages)) {
+        return [];
+    }
+    return doc.packages.filter(p => typeof p === 'string' && p.trim()).map(p => p.trim());
+}
+/**
+ * Convert workspace glob patterns to manifest-file glob patterns,
+ * correctly handling negation prefixes.
+ *
+ * @param {string[]} patterns - Workspace glob patterns (may include negations)
+ * @param {string} manifestFileName - e.g. 'package.json' or 'Cargo.toml'
+ * @returns {string[]}
+ */
+export function toManifestGlobPatterns(patterns, manifestFileName) {
+    return patterns.map(p => {
+        if (p.startsWith('!')) {
+            return `!${p.slice(1)}/${manifestFileName}`;
+        }
+        return `${p}/${manifestFileName}`;
+    });
+}
+/**
+ * @param {string} root
+ * @param {string} packageJsonPath
+ * @param {object} globOpts
+ * @param {string[]} ignorePatterns
+ * @returns {Promise<string[]>}
+ */
+async function discoverFromPackageJsonWorkspaces(root, packageJsonPath, globOpts, ignorePatterns) {
+    let pkg;
+    try {
+        pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
+    }
+    catch {
+        return [];
+    }
+    const workspaces = pkg.workspaces;
+    if (!workspaces) {
+        return [];
+    }
+    const raw = Array.isArray(workspaces) ? workspaces : workspaces.packages || [];
+    const patterns = toManifestGlobPatterns(raw.filter(p => typeof p === 'string'), 'package.json');
+    if (patterns.length === 0) {
+        return [];
+    }
+    const manifestPaths = await fg(patterns, globOpts);
+    const rootPkg = path.join(root, 'package.json');
+    if (fs.existsSync(rootPkg) && !manifestPaths.includes(rootPkg)) {
+        manifestPaths.unshift(rootPkg);
+    }
+    return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+}
+/**
+ * Discover all Cargo.toml manifest paths in a Cargo workspace.
+ * Uses `cargo metadata` to get workspace members.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain Cargo.toml and Cargo.lock)
+ * @param {import('./index.js').Options} [opts={}]
+ * @returns {Promise<string[]>} Paths to Cargo.toml files (absolute)
+ */
+export async function discoverWorkspaceCrates(workspaceRoot, opts = {}) {
+    const root = path.resolve(workspaceRoot);
+    const cargoToml = path.join(root, 'Cargo.toml');
+    const cargoLock = path.join(root, 'Cargo.lock');
+    if (!fs.existsSync(cargoToml) || !fs.existsSync(cargoLock)) {
+        return [];
+    }
+    const cargoBin = getCustomPath('cargo', opts);
+    let output;
+    try {
+        output = invokeCommand(cargoBin, ['metadata', '--format-version', '1', '--no-deps'], { cwd: root });
+    }
+    catch {
+        return [];
+    }
+    let metadata;
+    try {
+        metadata = JSON.parse(output.toString().trim());
+    }
+    catch {
+        return [];
+    }
+    const memberIds = new Set(metadata.workspace_members || []);
+    const manifestPaths = [];
+    for (const pkg of metadata.packages || []) {
+        if (memberIds.has(pkg.id) && pkg.manifest_path) {
+            const manifestPath = path.resolve(pkg.manifest_path);
+            if (fs.existsSync(manifestPath)) {
+                manifestPaths.push(manifestPath);
+            }
+        }
+    }
+    const ignorePatterns = resolveWorkspaceDiscoveryIgnore(opts);
+    return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+}