@trustify-da/trustify-da-javascript-client 0.3.0-ea.a783c26 → 0.3.0-ea.ab5949f

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (54) hide show
  1. package/dist/package.json +19 -20
  2. package/dist/src/analysis.d.ts +7 -7
  3. package/dist/src/cyclone_dx_sbom.d.ts +7 -1
  4. package/dist/src/cyclone_dx_sbom.js +29 -8
  5. package/dist/src/index.d.ts +69 -10
  6. package/dist/src/index.js +73 -6
  7. package/dist/src/license/index.d.ts +3 -3
  8. package/dist/src/license/index.js +4 -1
  9. package/dist/src/license/license_utils.js +4 -1
  10. package/dist/src/license/licenses_api.d.ts +2 -2
  11. package/dist/src/oci_image/images.d.ts +1 -1
  12. package/dist/src/oci_image/utils.d.ts +5 -5
  13. package/dist/src/provider.d.ts +4 -3
  14. package/dist/src/provider.js +3 -1
  15. package/dist/src/providers/base_java.d.ts +14 -12
  16. package/dist/src/providers/base_java.js +18 -44
  17. package/dist/src/providers/base_javascript.d.ts +20 -9
  18. package/dist/src/providers/base_javascript.js +10 -3
  19. package/dist/src/providers/base_pyproject.d.ts +15 -6
  20. package/dist/src/providers/base_pyproject.js +12 -4
  21. package/dist/src/providers/golang_gomodules.d.ts +11 -1
  22. package/dist/src/providers/golang_gomodules.js +65 -8
  23. package/dist/src/providers/java_gradle.d.ts +19 -0
  24. package/dist/src/providers/java_gradle.js +116 -2
  25. package/dist/src/providers/java_gradle_groovy.d.ts +1 -1
  26. package/dist/src/providers/java_gradle_kotlin.d.ts +1 -1
  27. package/dist/src/providers/java_maven.d.ts +10 -2
  28. package/dist/src/providers/java_maven.js +165 -1
  29. package/dist/src/providers/javascript_bun.d.ts +10 -0
  30. package/dist/src/providers/javascript_bun.js +100 -0
  31. package/dist/src/providers/javascript_npm.d.ts +6 -1
  32. package/dist/src/providers/javascript_pnpm.js +6 -2
  33. package/dist/src/providers/marker_evaluator.d.ts +14 -0
  34. package/dist/src/providers/marker_evaluator.js +191 -0
  35. package/dist/src/providers/processors/yarn_berry_processor.d.ts +2 -2
  36. package/dist/src/providers/processors/yarn_classic_processor.d.ts +2 -2
  37. package/dist/src/providers/python_controller.d.ts +5 -1
  38. package/dist/src/providers/python_controller.js +58 -4
  39. package/dist/src/providers/python_pip.d.ts +5 -0
  40. package/dist/src/providers/python_pip.js +5 -5
  41. package/dist/src/providers/python_pip_pyproject.js +3 -1
  42. package/dist/src/providers/python_poetry.d.ts +63 -8
  43. package/dist/src/providers/python_poetry.js +132 -21
  44. package/dist/src/providers/python_uv.d.ts +20 -1
  45. package/dist/src/providers/python_uv.js +122 -2
  46. package/dist/src/providers/rust_cargo.d.ts +6 -2
  47. package/dist/src/providers/rust_cargo.js +31 -4
  48. package/dist/src/sbom.d.ts +7 -1
  49. package/dist/src/sbom.js +4 -2
  50. package/dist/src/tools.d.ts +28 -2
  51. package/dist/src/tools.js +58 -0
  52. package/dist/src/workspace.d.ts +9 -0
  53. package/dist/src/workspace.js +1 -1
  54. package/package.json +20 -21
@@ -3,6 +3,7 @@ import golangGomodulesProvider from './providers/golang_gomodules.js';
3
3
  import Java_gradle_groovy from "./providers/java_gradle_groovy.js";
4
4
  import Java_gradle_kotlin from "./providers/java_gradle_kotlin.js";
5
5
  import Java_maven from "./providers/java_maven.js";
6
+ import Javascript_bun from './providers/javascript_bun.js';
6
7
  import Javascript_npm from './providers/javascript_npm.js';
7
8
  import Javascript_pnpm from './providers/javascript_pnpm.js';
8
9
  import Javascript_yarn from './providers/javascript_yarn.js';
@@ -12,7 +13,7 @@ import Python_poetry from './providers/python_poetry.js';
12
13
  import Python_uv from './providers/python_uv.js';
13
14
  import rustCargoProvider from './providers/rust_cargo.js';
14
15
  /** @typedef {{ecosystem: string, contentType: string, content: string}} Provided */
15
- /** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string, Object): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string): string | null}} Provider */
16
+ /** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string, Object): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string, Object=): string | null, packageManagerName: function(): string}} Provider */
16
17
  /**
17
18
  * MUST include all providers here.
18
19
  * @type {[Provider]}
@@ -21,6 +22,7 @@ export const availableProviders = [
21
22
  new Java_maven(),
22
23
  new Java_gradle_groovy(),
23
24
  new Java_gradle_kotlin(),
25
+ new Javascript_bun(),
24
26
  new Javascript_pnpm(),
25
27
  new Javascript_yarn(),
26
28
  new Javascript_npm(),
@@ -1,4 +1,4 @@
1
- export type ecosystem_maven = import("../provider").Provider;
1
+ export type ecosystem_maven = any;
2
2
  /** @typedef {import('../provider').Provider} */
3
3
  /** @typedef {import('../provider').Provided} Provided */
4
4
  /** @typedef {{name: string, version: string}} Package */
@@ -20,6 +20,11 @@ export default class Base_Java {
20
20
  CONFLICT_REGEX: RegExp;
21
21
  globalBinary: string;
22
22
  localWrapper: string;
23
+ /**
24
+ * Returns the package manager name (e.g. mvn, gradle)
25
+ * @returns {string}
26
+ */
27
+ packageManagerName(): string;
23
28
  /**
24
29
  * Recursively populates the SBOM instance with the parsed graph
25
30
  * @param {string} src - Source dependency to start the calculations from
@@ -28,6 +33,13 @@ export default class Base_Java {
28
33
  * @param {Sbom} sbom - The SBOM where the dependencies are being added
29
34
  */
30
35
  parseDependencyTree(src: string, srcDepth: number, lines: any[], sbom: Sbom): void;
36
+ /**
37
+ * Calculates how deep in the graph is the given line
38
+ * @param {string} line - line to calculate the depth from
39
+ * @returns {number} The calculated depth
40
+ * @protected
41
+ */
42
+ protected _getDepth(line: string): number;
31
43
  /**
32
44
  * Create a PackageURL from any line in a Text Graph dependency tree for a manifest path.
33
45
  * @param {string} line - line to parse from a dependencies.txt file
@@ -57,18 +69,8 @@ export default class Base_Java {
57
69
  * @returns string
58
70
  */
59
71
  selectToolBinary(manifestPath: string, opts: {}): string | null;
60
- /**
61
- *
62
- * @param {string} startingManifest - the path of the manifest from which to start searching for the wrapper
63
- * @param {string} repoRoot - the root of the repository at which point to stop searching for mvnw, derived via git if unset and then fallsback
64
- * to the root of the drive the manifest is on (assumes absolute path is given)
65
- * @returns {string|undefined}
66
- */
67
- traverseForWrapper(startingManifest: string, repoRoot?: string): string | undefined;
68
- normalizePath(thePath: any): string;
69
- #private;
70
72
  }
71
- export type Provided = import("../provider").Provided;
73
+ export type Provided = any;
72
74
  export type Package = {
73
75
  name: string;
74
76
  version: string;
@@ -1,7 +1,6 @@
1
- import fs from 'node:fs';
2
1
  import path from 'node:path';
3
2
  import { PackageURL } from 'packageurl-js';
4
- import { getCustomPath, getGitRootDir, getWrapperPreference, invokeCommand } from "../tools.js";
3
+ import { getCustomPath, getWrapperPreference, invokeCommand, traverseForWrapper } from "../tools.js";
5
4
  /** @typedef {import('../provider').Provider} */
6
5
  /** @typedef {import('../provider').Provided} Provided */
7
6
  /** @typedef {{name: string, version: string}} Package */
@@ -26,6 +25,13 @@ export default class Base_Java {
26
25
  this.globalBinary = globalBinary;
27
26
  this.localWrapper = localWrapper;
28
27
  }
28
+ /**
29
+ * Returns the package manager name (e.g. mvn, gradle)
30
+ * @returns {string}
31
+ */
32
+ packageManagerName() {
33
+ return this.globalBinary;
34
+ }
29
35
  /**
30
36
  * Recursively populates the SBOM instance with the parsed graph
31
37
  * @param {string} src - Source dependency to start the calculations from
@@ -42,7 +48,7 @@ export default class Base_Java {
42
48
  }
43
49
  let index = 0;
44
50
  let target = lines[index];
45
- let targetDepth = this.#getDepth(target);
51
+ let targetDepth = this._getDepth(target);
46
52
  while (targetDepth > srcDepth && index < lines.length) {
47
53
  if (targetDepth === srcDepth + 1) {
48
54
  let from = this.parseDep(src);
@@ -55,22 +61,25 @@ export default class Base_Java {
55
61
  }
56
62
  }
57
63
  else {
58
- this.parseDependencyTree(lines[index - 1], this.#getDepth(lines[index - 1]), lines.slice(index), sbom);
64
+ this.parseDependencyTree(lines[index - 1], this._getDepth(lines[index - 1]), lines.slice(index), sbom);
59
65
  }
60
66
  target = lines[++index];
61
- targetDepth = this.#getDepth(target);
67
+ targetDepth = this._getDepth(target);
62
68
  }
63
69
  }
64
70
  /**
65
71
  * Calculates how deep in the graph is the given line
66
72
  * @param {string} line - line to calculate the depth from
67
73
  * @returns {number} The calculated depth
68
- * @private
74
+ * @protected
69
75
  */
70
- #getDepth(line) {
71
- if (line === undefined) {
76
+ _getDepth(line) {
77
+ if (!line || line.trim() === '') {
72
78
  return -1;
73
79
  }
80
+ if (line.match(/^\w/)) {
81
+ return 0;
82
+ }
74
83
  return ((line.indexOf('-') - 1) / 3) + 1;
75
84
  }
76
85
  /**
@@ -131,7 +140,7 @@ export default class Base_Java {
131
140
  const toolPath = getCustomPath(this.globalBinary, opts);
132
141
  const useWrapper = getWrapperPreference(this.globalBinary, opts);
133
142
  if (useWrapper) {
134
- const wrapper = this.traverseForWrapper(manifestPath);
143
+ const wrapper = traverseForWrapper(manifestDir, this.localWrapper);
135
144
  if (wrapper !== undefined) {
136
145
  try {
137
146
  this._invokeCommand(wrapper, ['--version'], { cwd: manifestDir });
@@ -156,39 +165,4 @@ export default class Base_Java {
156
165
  }
157
166
  return toolPath;
158
167
  }
159
- /**
160
- *
161
- * @param {string} startingManifest - the path of the manifest from which to start searching for the wrapper
162
- * @param {string} repoRoot - the root of the repository at which point to stop searching for mvnw, derived via git if unset and then fallsback
163
- * to the root of the drive the manifest is on (assumes absolute path is given)
164
- * @returns {string|undefined}
165
- */
166
- traverseForWrapper(startingManifest, repoRoot = undefined) {
167
- const normalizedManifest = this.normalizePath(startingManifest);
168
- const currentDir = this.normalizePath(path.dirname(normalizedManifest));
169
- repoRoot = repoRoot || getGitRootDir(currentDir) || path.parse(normalizedManifest).root;
170
- const wrapperPath = path.join(currentDir, this.localWrapper);
171
- try {
172
- fs.accessSync(wrapperPath, fs.constants.X_OK);
173
- return wrapperPath;
174
- }
175
- catch (error) {
176
- if (error.code === 'ENOENT') {
177
- const rootDir = path.parse(currentDir).root;
178
- if (currentDir === repoRoot || currentDir === rootDir) {
179
- return undefined;
180
- }
181
- const parentDir = path.dirname(currentDir);
182
- if (parentDir === currentDir || parentDir === rootDir) {
183
- return undefined;
184
- }
185
- return this.traverseForWrapper(path.join(parentDir, path.basename(normalizedManifest)), repoRoot);
186
- }
187
- throw new Error(`failure searching for ${this.localWrapper}`, { cause: error });
188
- }
189
- }
190
- normalizePath(thePath) {
191
- const normalized = path.resolve(thePath).normalize();
192
- return process.platform === 'win32' ? normalized.toLowerCase() : normalized;
193
- }
194
168
  }
@@ -1,4 +1,4 @@
1
- export type purlType = import("../provider").Provider;
1
+ export type purlType = any;
2
2
  /** @typedef {import('../provider').Provider} */
3
3
  /** @typedef {import('../provider').Provided} Provided */
4
4
  /**
@@ -19,7 +19,7 @@ export default class Base_javascript {
19
19
  * @param {Object} opts - Configuration options for the provider
20
20
  * @protected
21
21
  */
22
- protected _setUp(manifestPath: string, opts: any): void;
22
+ protected _setUp(manifestPath: string, opts: Object): void;
23
23
  /**
24
24
  * Gets the current manifest object
25
25
  * @returns {Manifest} The manifest object
@@ -47,6 +47,11 @@ export default class Base_javascript {
47
47
  */
48
48
  protected _cmdName(): string;
49
49
  /**
50
+ * Returns the package manager name (e.g. npm, yarn, pnpm, bun)
51
+ * @returns {string} The package manager name
52
+ */
53
+ packageManagerName(): string;
54
+ /**
50
55
  * Returns the command arguments for listing dependencies
51
56
  * @returns {Array<string>} The command arguments
52
57
  * @abstract
@@ -86,21 +91,21 @@ export default class Base_javascript {
86
91
  * @param {Object} [opts={}] - optional; may contain TRUSTIFY_DA_WORKSPACE_DIR
87
92
  * @returns {boolean} True if the lock file exists
88
93
  */
89
- validateLockFile(manifestDir: string, opts?: any): boolean;
94
+ validateLockFile(manifestDir: string, opts?: Object): boolean;
90
95
  /**
91
96
  * Provides content and content type for stack analysis
92
97
  * @param {string} manifestPath - The manifest path or name
93
98
  * @param {Object} [opts={}] - Optional configuration options
94
99
  * @returns {Provided} The provided data for stack analysis
95
100
  */
96
- provideStack(manifestPath: string, opts?: any): Provided;
101
+ provideStack(manifestPath: string, opts?: Object): Provided;
97
102
  /**
98
103
  * Provides content and content type for component analysis
99
104
  * @param {string} manifestPath - Path to package.json for component report
100
105
  * @param {Object} [opts={}] - Optional configuration options
101
106
  * @returns {Provided} The provided data for component analysis
102
107
  */
103
- provideComponent(manifestPath: string, opts?: any): Provided;
108
+ provideComponent(manifestPath: string, opts?: Object): Provided;
104
109
  /**
105
110
  * Read license from manifest (package.json). Reused by npm, pnpm, yarn.
106
111
  * @param {string} manifestPath - path to package.json
@@ -114,21 +119,21 @@ export default class Base_javascript {
114
119
  * @returns {Object} The dependency tree
115
120
  * @protected
116
121
  */
117
- protected _buildDependencyTree(includeTransitive: boolean, opts?: any): any;
122
+ protected _buildDependencyTree(includeTransitive: boolean, opts?: Object): Object;
118
123
  /**
119
124
  * Recursively builds the Sbom from the JSON that npm listing returns
120
125
  * @param {Sbom} sbom - The SBOM object to add dependencies to
121
126
  * @param {Object} depTree - The current dependency tree
122
127
  * @protected
123
128
  */
124
- protected _addDependenciesToSbom(sbom: Sbom, depTree: any): void;
129
+ protected _addDependenciesToSbom(sbom: Sbom, depTree: Object): void;
125
130
  /**
126
131
  * Extracts root dependencies from the dependency tree
127
132
  * @param {Object} depTree - The dependency tree object
128
133
  * @returns {Map<string, PackageURL>} Map of dependency names to their PackageURL objects
129
134
  * @protected
130
135
  */
131
- protected _getRootDependencies(depTree: any): Map<string, PackageURL>;
136
+ protected _getRootDependencies(depTree: Object): Map<string, PackageURL>;
132
137
  /**
133
138
  * Gets the version of the package manager
134
139
  * @returns {string} The version string of the package manager
@@ -136,6 +141,12 @@ export default class Base_javascript {
136
141
  */
137
142
  protected _version(): string;
138
143
  /**
144
+ * Creates or updates the lock file for the package manager
145
+ * @param {string} manifestDir - Directory containing the manifest file
146
+ * @protected
147
+ */
148
+ protected _createLockFile(manifestDir: string): void;
149
+ /**
139
150
  * Parses the dependency tree output
140
151
  * @param {string} output - The output to parse
141
152
  * @returns {string} The parsed output
@@ -144,6 +155,6 @@ export default class Base_javascript {
144
155
  protected _parseDepTreeOutput(output: string): string;
145
156
  #private;
146
157
  }
147
- export type Provided = import("../provider").Provided;
158
+ export type Provided = any;
148
159
  import Manifest from './manifest.js';
149
160
  import Sbom from '../sbom.js';
@@ -71,6 +71,13 @@ export default class Base_javascript {
71
71
  throw new TypeError("_cmdName must be implemented");
72
72
  }
73
73
  /**
74
+ * Returns the package manager name (e.g. npm, yarn, pnpm, bun)
75
+ * @returns {string} The package manager name
76
+ */
77
+ packageManagerName() {
78
+ return this._cmdName();
79
+ }
80
+ /**
74
81
  * Returns the command arguments for listing dependencies
75
82
  * @returns {Array<string>} The command arguments
76
83
  * @abstract
@@ -217,7 +224,7 @@ export default class Base_javascript {
217
224
  this._version();
218
225
  const manifestDir = path.dirname(this.#manifest.manifestPath);
219
226
  const cmdDir = this._findLockFileDir(manifestDir, opts) || manifestDir;
220
- this.#createLockFile(cmdDir);
227
+ this._createLockFile(cmdDir);
221
228
  let output = this.#executeListCmd(includeTransitive, cmdDir);
222
229
  output = this._parseDepTreeOutput(output);
223
230
  return JSON.parse(output);
@@ -363,9 +370,9 @@ export default class Base_javascript {
363
370
  /**
364
371
  * Creates or updates the lock file for the package manager
365
372
  * @param {string} manifestDir - Directory containing the manifest file
366
- * @private
373
+ * @protected
367
374
  */
368
- #createLockFile(manifestDir) {
375
+ _createLockFile(manifestDir) {
369
376
  const originalDir = process.cwd();
370
377
  const isWindows = os.platform() === 'win32';
371
378
  if (isWindows) {
@@ -1,4 +1,4 @@
1
- /** @typedef {{name: string, version: string, children: string[]}} GraphEntry */
1
+ /** @typedef {{name: string, version: string, children: string[], hashes?: Array<{alg: string, content: string}>}} GraphEntry */
2
2
  /** @typedef {{name: string, version: string, dependencies: DepTreeEntry[]}} DepTreeEntry */
3
3
  /** @typedef {{directDeps: string[], graph: Map<string, GraphEntry>}} DependencyData */
4
4
  /** @typedef {{ecosystem: string, content: string, contentType: string}} Provided */
@@ -13,7 +13,7 @@ export default class Base_pyproject {
13
13
  * @param {Object} [opts={}]
14
14
  * @returns {boolean}
15
15
  */
16
- validateLockFile(manifestDir: string, opts?: any): boolean;
16
+ validateLockFile(manifestDir: string, opts?: Object): boolean;
17
17
  /**
18
18
  * Walk up from manifestDir to find the directory containing the lock file.
19
19
  * Follows the same pattern as Base_javascript._findLockFileDir().
@@ -22,7 +22,7 @@ export default class Base_pyproject {
22
22
  * @returns {string|null}
23
23
  * @protected
24
24
  */
25
- protected _findLockFileDir(manifestDir: string, opts?: any): string | null;
25
+ protected _findLockFileDir(manifestDir: string, opts?: Object): string | null;
26
26
  /**
27
27
  * Detect workspace root boundaries.
28
28
  * Currently only uv has native workspace support ([tool.uv.workspace] in pyproject.toml).
@@ -44,13 +44,13 @@ export default class Base_pyproject {
44
44
  * @param {Object} [opts={}]
45
45
  * @returns {Promise<Provided>}
46
46
  */
47
- provideStack(manifest: string, opts?: any): Promise<Provided>;
47
+ provideStack(manifest: string, opts?: Object): Promise<Provided>;
48
48
  /**
49
49
  * @param {string} manifest - path to pyproject.toml
50
50
  * @param {Object} [opts={}]
51
51
  * @returns {Promise<Provided>}
52
52
  */
53
- provideComponent(manifest: string, opts?: any): Promise<Provided>;
53
+ provideComponent(manifest: string, opts?: Object): Promise<Provided>;
54
54
  /**
55
55
  * @returns {string}
56
56
  * @protected
@@ -61,6 +61,11 @@ export default class Base_pyproject {
61
61
  * @protected
62
62
  */
63
63
  protected _cmdName(): string;
64
+ /**
65
+ * Returns the package manager name (e.g. pip, poetry, uv)
66
+ * @returns {string}
67
+ */
68
+ packageManagerName(): string;
64
69
  /**
65
70
  * Resolve dependencies using the tool-specific command and parser.
66
71
  *
@@ -72,7 +77,7 @@ export default class Base_pyproject {
72
77
  * @returns {Promise<DependencyData>}
73
78
  * @protected
74
79
  */
75
- protected _getDependencyData(manifestDir: string, workspaceDir: string, parsed: object, opts: any): Promise<DependencyData>;
80
+ protected _getDependencyData(manifestDir: string, workspaceDir: string, parsed: object, opts: Object): Promise<DependencyData>;
76
81
  /**
77
82
  * Canonicalize a Python package name per PEP 503.
78
83
  * @param {string} name
@@ -131,6 +136,10 @@ export type GraphEntry = {
131
136
  name: string;
132
137
  version: string;
133
138
  children: string[];
139
+ hashes?: Array<{
140
+ alg: string;
141
+ content: string;
142
+ }>;
134
143
  };
135
144
  export type DepTreeEntry = {
136
145
  name: string;
@@ -7,9 +7,10 @@ import Sbom from '../sbom.js';
7
7
  import { getCustom } from '../tools.js';
8
8
  const ecosystem = 'pip';
9
9
  const IGNORE_MARKERS = ['exhortignore', 'trustify-da-ignore'];
10
+ const NO_SCOPE = undefined;
10
11
  const DEFAULT_ROOT_NAME = 'default-pip-root';
11
12
  const DEFAULT_ROOT_VERSION = '0.0.0';
12
- /** @typedef {{name: string, version: string, children: string[]}} GraphEntry */
13
+ /** @typedef {{name: string, version: string, children: string[], hashes?: Array<{alg: string, content: string}>}} GraphEntry */
13
14
  /** @typedef {{name: string, version: string, dependencies: DepTreeEntry[]}} DepTreeEntry */
14
15
  /** @typedef {{directDeps: string[], graph: Map<string, GraphEntry>}} DependencyData */
15
16
  /** @typedef {{ecosystem: string, content: string, contentType: string}} Provided */
@@ -144,6 +145,13 @@ export default class Base_pyproject {
144
145
  _cmdName() {
145
146
  throw new TypeError('_cmdName must be implemented');
146
147
  }
148
+ /**
149
+ * Returns the package manager name (e.g. pip, poetry, uv)
150
+ * @returns {string}
151
+ */
152
+ packageManagerName() {
153
+ return this._cmdName();
154
+ }
147
155
  /**
148
156
  * Resolve dependencies using the tool-specific command and parser.
149
157
  *
@@ -281,7 +289,7 @@ export default class Base_pyproject {
281
289
  continue;
282
290
  }
283
291
  let entry = graph.get(key);
284
- sbom.addDependency(rootPurl, this._toPurl(entry.name, entry.version));
292
+ sbom.addDependency(rootPurl, this._toPurl(entry.name, entry.version), NO_SCOPE, entry.hashes);
285
293
  }
286
294
  for (let [key, entry] of graph) {
287
295
  if (!reachable.has(key)) {
@@ -293,7 +301,7 @@ export default class Base_pyproject {
293
301
  continue;
294
302
  }
295
303
  let childEntry = graph.get(child);
296
- sbom.addDependency(parentPurl, this._toPurl(childEntry.name, childEntry.version));
304
+ sbom.addDependency(parentPurl, this._toPurl(childEntry.name, childEntry.version), NO_SCOPE, childEntry.hashes);
297
305
  }
298
306
  }
299
307
  }
@@ -306,7 +314,7 @@ export default class Base_pyproject {
306
314
  if (!entry) {
307
315
  continue;
308
316
  }
309
- sbom.addDependency(rootPurl, this._toPurl(entry.name, entry.version));
317
+ sbom.addDependency(rootPurl, this._toPurl(entry.name, entry.version), NO_SCOPE, entry.hashes);
310
318
  }
311
319
  }
312
320
  return sbom.getAsJsonString(opts);
@@ -1,12 +1,22 @@
1
+ /**
2
+ * Discover all go.mod manifest paths in a Go workspace.
3
+ * Uses `go work edit -json` to get workspace members.
4
+ *
5
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain go.work)
6
+ * @param {import('../index.js').Options} [opts={}]
7
+ * @returns {Promise<string[]>} Paths to go.mod files (absolute)
8
+ */
9
+ export function discoverGoWorkspaceModules(workspaceRoot: string, opts?: import("../index.js").Options): Promise<string[]>;
1
10
  declare namespace _default {
2
11
  export { isSupported };
3
12
  export { validateLockFile };
4
13
  export { provideComponent };
5
14
  export { provideStack };
6
15
  export { readLicenseFromManifest };
16
+ export function packageManagerName(): string;
7
17
  }
8
18
  export default _default;
9
- export type Provided = import("../provider").Provided;
19
+ export type Provided = any;
10
20
  export type Package = {
11
21
  name: string;
12
22
  version: string;
@@ -4,8 +4,9 @@ import { PackageURL } from 'packageurl-js';
4
4
  import { readLicenseFile } from '../license/license_utils.js';
5
5
  import Sbom from '../sbom.js';
6
6
  import { getCustom, getCustomPath, invokeCommand } from "../tools.js";
7
+ import { filterManifestPathsByDiscoveryIgnore, resolveWorkspaceDiscoveryIgnore } from '../workspace.js';
7
8
  import { getParser, getRequireQuery } from './gomod_parser.js';
8
- export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest };
9
+ export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'go'; } };
9
10
  /** @typedef {import('../provider').Provider} */
10
11
  /** @typedef {import('../provider').Provided} Provided */
11
12
  /** @typedef {{name: string, version: string}} Package */
@@ -328,13 +329,7 @@ function getFinalPackagesVersionsForModule(rows, manifestPath, goBin) {
328
329
  catch (error) {
329
330
  throw new Error('failed to list all modules', { cause: error });
330
331
  }
331
- let finalVersionModules = new Map();
332
- finalVersionsForAllModules.split(getLineSeparatorGolang()).filter(string => string.trim() !== "")
333
- .filter(string => string.trim().split(" ").length === 2)
334
- .forEach((dependency) => {
335
- let dep = dependency.split(" ");
336
- finalVersionModules[dep[0]] = dep[1];
337
- });
332
+ let finalVersionModules = parseModuleVersions(finalVersionsForAllModules);
338
333
  let finalVersionModulesArray = new Array();
339
334
  rows.filter(string => string.trim() !== "").forEach(module => {
340
335
  let child = getChildVertexFromEdge(module);
@@ -395,7 +390,69 @@ function getVersionOfPackage(fullPackage) {
395
390
  let parts = fullPackage.split("@");
396
391
  return parts.length > 1 ? parts[1] : undefined;
397
392
  }
393
+ function parseModuleVersions(goListOutput) {
394
+ let modules = {};
395
+ goListOutput.split(getLineSeparatorGolang()).filter(string => string.trim() !== "")
396
+ .forEach((line) => {
397
+ let parts = line.trim().split(" ");
398
+ if (parts.length === 2) {
399
+ modules[parts[0]] = parts[1];
400
+ }
401
+ else if (parts.length >= 4 && parts[2] === "=>") {
402
+ modules[parts[0]] = parts[parts.length - 1];
403
+ }
404
+ });
405
+ return modules;
406
+ }
398
407
  function getLineSeparatorGolang() {
399
408
  let reg = /\n|\r\n/;
400
409
  return reg;
401
410
  }
411
+ /**
412
+ * Discover all go.mod manifest paths in a Go workspace.
413
+ * Uses `go work edit -json` to get workspace members.
414
+ *
415
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain go.work)
416
+ * @param {import('../index.js').Options} [opts={}]
417
+ * @returns {Promise<string[]>} Paths to go.mod files (absolute)
418
+ */
419
+ export async function discoverGoWorkspaceModules(workspaceRoot, opts = {}) {
420
+ const root = path.resolve(workspaceRoot);
421
+ const goWork = path.join(root, 'go.work');
422
+ if (!fs.existsSync(goWork)) {
423
+ return [];
424
+ }
425
+ const goBin = getCustomPath('go', opts);
426
+ let output;
427
+ try {
428
+ output = invokeCommand(goBin, ['work', 'edit', '-json', goWork], { cwd: root });
429
+ }
430
+ catch {
431
+ return [];
432
+ }
433
+ let workspace;
434
+ try {
435
+ workspace = JSON.parse(output.toString().trim());
436
+ }
437
+ catch {
438
+ return [];
439
+ }
440
+ const useEntries = workspace.Use || [];
441
+ if (useEntries.length === 0) {
442
+ return [];
443
+ }
444
+ const manifestPaths = [];
445
+ for (const entry of useEntries) {
446
+ const diskPath = entry.DiskPath;
447
+ if (!diskPath) {
448
+ continue;
449
+ }
450
+ const moduleDir = path.resolve(root, diskPath);
451
+ const goMod = path.join(moduleDir, 'go.mod');
452
+ if (fs.existsSync(goMod)) {
453
+ manifestPaths.push(goMod);
454
+ }
455
+ }
456
+ const ignorePatterns = resolveWorkspaceDiscoveryIgnore(opts);
457
+ return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
458
+ }
@@ -1,3 +1,22 @@
1
+ /**
2
+ * Discover all build.gradle[.kts] manifest paths in a Gradle multi-project build.
3
+ * Uses a custom init script to get structured project listing.
4
+ *
5
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain settings.gradle[.kts])
6
+ * @param {import('../index.js').Options} [opts={}]
7
+ * @returns {Promise<string[]>} Paths to build.gradle[.kts] files (absolute)
8
+ */
9
+ export function discoverGradleSubprojects(workspaceRoot: string, opts?: import("../index.js").Options): Promise<string[]>;
10
+ /**
11
+ * Parse the structured output from the Gradle init script.
12
+ *
13
+ * @param {string} raw - Raw stdout from gradle
14
+ * @returns {{ path: string, dir: string }[]}
15
+ */
16
+ export function parseGradleInitScriptOutput(raw: string): {
17
+ path: string;
18
+ dir: string;
19
+ }[];
1
20
  /**
2
21
  * This class provides common functionality for Groovy and Kotlin DSL files.
3
22
  */