@trustify-da/trustify-da-javascript-client 0.3.0-ea.a8c3942 → 0.3.0-ea.aaf5191

package/dist/src/providers/java_maven.d.ts

@@ -6,11 +6,11 @@
  * @returns {Promise<string[]>} Paths to pom.xml files (absolute)
  */
 export function discoverMavenModules(workspaceRoot: string, opts?: object): Promise<string[]>;
-/** @typedef {import('../provider').Provider} */
-/** @typedef {import('../provider').Provided} Provided */
-/** @typedef {{name: string, version: string}} Package */
-/** @typedef {{groupId: string, artifactId: string, version: string, scope: string, ignore: boolean}} Dependency */
 export default class Java_maven extends Base_java {
+    /** @type {Object<string, string>} Packaging types that produce .jar files despite non-jar packaging names. */
+    static PACKAGING_TO_JAR: {
+        [x: string]: string;
+    };
     constructor();
     /**
      * @param {string} manifestName - the subject manifest name-type
@@ -25,9 +25,9 @@ export default class Java_maven extends Base_java {
      * Provide content and content type for maven-maven stack analysis.
      * @param {string} manifest - the manifest path or name
      * @param {{}} [opts={}] - optional various options to pass along the application
-     * @returns {Provided}
+     * @returns {Promise<Provided>}
      */
-    provideStack(manifest: string, opts?: {}): Provided;
+    provideStack(manifest: string, opts?: {}): Promise<Provided>;
     /**
      * Provide content and content type for maven-maven component analysis.
      * @param {string} manifest - path to the manifest file
@@ -42,17 +42,37 @@ export default class Java_maven extends Base_java {
      */
     readLicenseFromManifest(manifestPath: string): string | null;
     /**
+     * Build a Map of PURL string → CycloneDX hash entries by reading artifact files from the local Maven repository.
+     *
+     * Both the artifact file path and the hash-map key are derived from the
+     * shared {@link Base_java#parseCoordinate} parser: the file path uses the
+     * resolved version and raw classifier, while the key uses the same canonical
+     * PURL builder as {@link Base_java#parseDep}. This guarantees the key always
+     * matches the PURL that {@link Base_java#parseDependencyTree} looks up.
      *
+     * @param {string} depTreeText Raw dependency tree text from mvn dependency:tree
+     * @param {{}} [opts={}] Options bag (may contain TRUSTIFY_DA_MVN_REPO)
+     * @returns {Promise<Map<string, Array<{alg: string, content: string}>>>}
+     */
+    _buildMavenHashMap(depTreeText: string, opts?: {}): Promise<Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>>;
+    /**
      * @param {String} textGraphList Text graph String of the manifest
      * @param {[String]} ignoredDeps List of ignored dependencies to be omitted from sbom
+     * @param {{}} opts Options
      * @param {String} manifestPath Path to the pom.xml manifest
+     * @param {Map<string, Array<{alg: string, content: string}>>} [hashMap] PURL→hashes map
      * @return {String} formatted sbom Json String with all dependencies
      */
-    createSbomFileFromTextFormat(textGraphList: string, ignoredDeps: [string], opts: any, manifestPath: string): string;
+    createSbomFileFromTextFormat(textGraphList: string, ignoredDeps: [string], opts: {}, manifestPath: string, hashMap?: Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>): string;
     #private;
 }
-export type Java_maven = import("../provider").Provider;
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 export type Package = {
     name: string;
     version: string;

package/dist/src/providers/java_maven.js

@@ -1,3 +1,4 @@
+import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -12,6 +13,10 @@ import Base_java, { ecosystem_maven } from "./base_java.js";
 /** @typedef {import('../provider').Provided} Provided */
 /** @typedef {{name: string, version: string}} Package */
 /** @typedef {{groupId: string, artifactId: string, version: string, scope: string, ignore: boolean}} Dependency */
+// Matches the legacy `exhortignore` and new `trustify-da-ignore` markers as whole
+// tokens. The trailing `(?![\w-])` boundary prevents lookalikes such as
+// `trustify-da-ignore-disabled` from being treated as ignore directives.
+const IGNORE_MARKER_REGEX = /(exhortignore|trustify-da-ignore)(?![\w-])/;
 export default class Java_maven extends Base_java {
     constructor() {
         super('mvn', 'mvnw' + (process.platform === 'win32' ? '.cmd' : ''));
@@ -31,12 +36,12 @@ export default class Java_maven extends Base_java {
      * Provide content and content type for maven-maven stack analysis.
      * @param {string} manifest - the manifest path or name
      * @param {{}} [opts={}] - optional various options to pass along the application
-     * @returns {Provided}
+     * @returns {Promise<Provided>}
      */
-    provideStack(manifest, opts = {}) {
+    async provideStack(manifest, opts = {}) {
         return {
             ecosystem: ecosystem_maven,
-            content: this.#createSbomStackAnalysis(manifest, opts),
+            content: await this.#createSbomStackAnalysis(manifest, opts),
             contentType: 'application/vnd.cyclonedx+json'
         };
     }
@@ -81,10 +86,10 @@ export default class Java_maven extends Base_java {
      * Create a Dot Graph dependency tree for a manifest path.
      * @param {string} manifest - path for pom.xml
      * @param {{}} [opts={}] - optional various options to pass along the application
-     * @returns {string} the Dot Graph content
+     * @returns {Promise<string>} the Dot Graph content
      * @private
      */
-    #createSbomStackAnalysis(manifest, opts = {}) {
+    async #createSbomStackAnalysis(manifest, opts = {}) {
         const manifestDir = path.dirname(manifest);
         const mvn = this.selectToolBinary(manifest, opts);
         const mvnArgs = JSON.parse(getCustom('TRUSTIFY_DA_MVN_ARGS', '[]', opts));
@@ -131,20 +136,105 @@ export default class Java_maven extends Base_java {
         if (process.env["TRUSTIFY_DA_DEBUG"] === "true") {
             console.error("Dependency tree that will be used as input for creating the BOM =>" + EOL + EOL + content.toString());
         }
-        let sbom = this.createSbomFileFromTextFormat(content.toString(), ignoredDeps, opts, manifest);
+        const depTreeContent = content.toString();
+        const hashMap = await this._buildMavenHashMap(depTreeContent, opts);
+        let sbom = this.createSbomFileFromTextFormat(depTreeContent, ignoredDeps, opts, manifest, hashMap);
         // delete temp file and directory
         fs.rmSync(tmpDir, { recursive: true, force: true });
         // return dependency graph as string
         return sbom;
     }
+    /** @type {Object<string, string>} Packaging types that produce .jar files despite non-jar packaging names. */
+    static PACKAGING_TO_JAR = { 'bundle': 'jar', 'eclipse-plugin': 'jar' };
     /**
+     * Build a Map of PURL string → CycloneDX hash entries by reading artifact files from the local Maven repository.
+     *
+     * Both the artifact file path and the hash-map key are derived from the
+     * shared {@link Base_java#parseCoordinate} parser: the file path uses the
+     * resolved version and raw classifier, while the key uses the same canonical
+     * PURL builder as {@link Base_java#parseDep}. This guarantees the key always
+     * matches the PURL that {@link Base_java#parseDependencyTree} looks up.
      *
+     * @param {string} depTreeText Raw dependency tree text from mvn dependency:tree
+     * @param {{}} [opts={}] Options bag (may contain TRUSTIFY_DA_MVN_REPO)
+     * @returns {Promise<Map<string, Array<{alg: string, content: string}>>>}
+     */
+    async _buildMavenHashMap(depTreeText, opts = {}) {
+        const m2Repo = getCustom('TRUSTIFY_DA_MVN_REPO', path.join(os.homedir(), '.m2', 'repository'), opts);
+        const hashMap = new Map();
+        const lines = depTreeText.split(EOL);
+        // Track hash coverage so an incomplete .m2 cache (e.g. ephemeral CI
+        // containers or resolve-only phases) surfaces a summary warning instead
+        // of silently producing an SBOM with missing hashes.
+        let attempted = 0;
+        let missed = 0;
+        for (const rawLine of lines) {
+            const trimmed = rawLine.trim();
+            // Strip leading tree-drawing characters (e.g. "\-", "+-", "|") so the
+            // parenthesized-line check sees the coordinate itself. Omitted
+            // duplicate/conflict lines start with these characters after trim(),
+            // then an opening "(" — without stripping, the "(" check never fires.
+            const cleaned = trimmed.replace(/^[|+\\\- ]+/, '');
+            if (!cleaned || cleaned.startsWith('(')) {
+                continue;
+            }
+            const coord = this.parseCoordinate(rawLine);
+            if (!coord.groupId || !coord.artifactId || !coord.packaging) {
+                continue;
+            }
+            if (coord.packaging === 'pom') {
+                continue;
+            }
+            // Key by the exact PURL parseDep() produces, so the lookup in
+            // parseDependencyTree (hashMap.get(to.toString())) always hits.
+            const purl = this._coordinateToPurl(coord).toString();
+            // The same artifact recurs across dependency-tree branches — notably in
+            // multi-module reactor builds, where every module re-lists shared deps.
+            // The digest is deterministic per PURL, so skip the redundant file read
+            // and SHA-256 computation once this PURL is already hashed.
+            if (hashMap.has(purl)) {
+                continue;
+            }
+            const ext = Java_maven.PACKAGING_TO_JAR[coord.packaging] || coord.packaging;
+            const groupPath = coord.groupId.replaceAll('.', path.sep);
+            const fileName = coord.classifier
+                ? `${coord.artifactId}-${coord.version}-${coord.classifier}.${ext}`
+                : `${coord.artifactId}-${coord.version}.${ext}`;
+            const artifactPath = path.join(m2Repo, groupPath, coord.artifactId, coord.version, fileName);
+            attempted++;
+            try {
+                const stream = fs.createReadStream(artifactPath);
+                const hash = crypto.createHash('sha256');
+                for await (const chunk of stream) {
+                    hash.update(chunk);
+                }
+                const digest = hash.digest('hex');
+                hashMap.set(purl, [{ alg: 'SHA-256', content: digest }]);
+            }
+            catch {
+                missed++;
+                if (process.env['TRUSTIFY_DA_DEBUG'] === 'true') {
+                    console.error(`Maven hash: artifact not found at ${artifactPath}, omitting hash`);
+                }
+            }
+        }
+        // Mirror the pip provider's convention (python_controller.js): surface an
+        // unconditional warning when hashes could not be computed, so incomplete
+        // hash coverage is visible even without TRUSTIFY_DA_DEBUG.
+        if (missed > 0) {
+            console.warn(`Maven hash: ${missed} of ${attempted} artifacts could not be read from the local .m2 cache; SBOM will be generated without hashes for those components.`);
+        }
+        return hashMap;
+    }
+    /**
      * @param {String} textGraphList Text graph String of the manifest
      * @param {[String]} ignoredDeps List of ignored dependencies to be omitted from sbom
+     * @param {{}} opts Options
      * @param {String} manifestPath Path to the pom.xml manifest
+     * @param {Map<string, Array<{alg: string, content: string}>>} [hashMap] PURL→hashes map
      * @return {String} formatted sbom Json String with all dependencies
      */
-    createSbomFileFromTextFormat(textGraphList, ignoredDeps, opts, manifestPath) {
+    createSbomFileFromTextFormat(textGraphList, ignoredDeps, opts, manifestPath, hashMap) {
         let lines = textGraphList.split(EOL);
         // get root component
         let root = lines[0];
@@ -153,6 +243,9 @@ export default class Java_maven extends Base_java {
         let sbom = new Sbom();
         sbom.addRoot(rootPurl, license);
         this.parseDependencyTree(root, 0, lines.slice(1), sbom);
+        // Attach Maven artifact hashes as a post-processing step, keeping this
+        // Maven-specific concern out of the shared dependency-tree parser.
+        sbom.attachHashes(hashMap);
         return sbom.filterIgnoredDeps(ignoredDeps).getAsJsonString(opts);
     }
     /**
@@ -181,6 +274,7 @@ export default class Java_maven extends Base_java {
         /** @type [Dependency] */
         let dependencies = this.#getDependencies(tmpEffectivePom)
             .filter(d => !this.#dependencyIn(d, ignored));
+        dependencies = this.#resolveVersionRanges(dependencies, manifestPath, opts);
         let sbom = new Sbom();
         let rootDependency = this.#getRootFromPom(tmpEffectivePom, manifestPath);
         let purlRoot = this.toPurl(rootDependency.groupId, rootDependency.artifactId, rootDependency.version);
@@ -228,7 +322,8 @@ export default class Java_maven extends Base_java {
         return rootDependency;
     }
     /**
-     * Get a list of dependencies with marking of dependencies commented with <!--exhortignore-->.
+     * Get a list of dependencies with marking of dependencies commented with
+     * <!--exhortignore--> or <!--trustify-da-ignore-->.
      * @param {string} manifest - path for pom.xml
      * @returns {[Dependency]} an array of dependencies
      * @private
@@ -246,7 +341,7 @@ export default class Java_maven extends Base_java {
         let buf = fs.readFileSync(manifest);
         // parse manifest pom.xml to json
         let pomJson = parser.parse(buf.toString());
-        // iterate over all dependencies and chery pick dependencies with a exhortignore comment
+        // iterate over all dependencies and chery pick dependencies with an ignore comment
         let pomXml;
         // project without modules
         if (pomJson['project']) {
@@ -262,7 +357,7 @@ export default class Java_maven extends Base_java {
         }
         pomXml.forEach(dep => {
             let ignore = false;
-            if (dep['#comment'] && dep['#comment'].includes('exhortignore')) { // #comment is an array or a string
+            if (dep['#comment'] && [].concat(dep['#comment']).some(comment => IGNORE_MARKER_REGEX.test(comment))) { // #comment is an array or a string
                 ignore = true;
             }
             if (dep['scope'] !== 'test') {
@@ -289,6 +384,77 @@ export default class Java_maven extends Base_java {
     #dependencyIn(dep, deps) {
         return deps.filter(d => dep.artifactId === d.artifactId && dep.groupId === d.groupId && dep.scope === d.scope).length > 0;
     }
+    /**
+     * Returns true if the given version string is a Maven version range
+     * (starts with '[' or '(').
+     * @param {string} version
+     * @returns {boolean}
+     * @private
+     */
+    #isVersionRange(version) {
+        return typeof version === 'string' && (version.startsWith('[') || version.startsWith('('));
+    }
+    /**
+     * Resolves Maven version ranges in the given dependency list by running
+     * maven-dependency-plugin:tree and reading the concrete versions it selects.
+     * If no dependency uses a version range, returns the list unchanged.
+     * @param {Dependency[]} dependencies
+     * @param {string} manifestPath
+     * @param {object} opts
+     * @returns {Dependency[]}
+     * @private
+     */
+    #resolveVersionRanges(dependencies, manifestPath, opts = {}) {
+        // short-circuit if no dependency has a version range
+        if (!dependencies.some(dep => this.#isVersionRange(dep.version))) {
+            return dependencies;
+        }
+        const mvn = this.selectToolBinary(manifestPath, opts);
+        const mvnArgs = JSON.parse(getCustom('TRUSTIFY_DA_MVN_ARGS', '[]', opts));
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'trustify_da_range_'));
+        const tmpDepTree = path.join(tmpDir, 'mvn_deptree_ranges.txt');
+        try {
+            this._invokeCommand(mvn, [
+                '-q',
+                'org.apache.maven.plugins:maven-dependency-plugin:3.6.0:tree',
+                '-Dscope=compile',
+                '-DoutputType=text',
+                `-DoutputFile=${tmpDepTree}`,
+                ...mvnArgs
+            ], { cwd: path.dirname(manifestPath) });
+            const content = fs.readFileSync(tmpDepTree);
+            const lines = content.toString().split(EOL).filter(l => l.trim() !== '');
+            // Build a map of groupId:artifactId -> resolved version from depth-1 entries
+            /** @type {Map<string, string>} */
+            const resolvedVersions = new Map();
+            for (const line of lines) {
+                if (this._getDepth(line) === 1) {
+                    const purl = this.parseDep(line);
+                    resolvedVersions.set(`${purl.namespace}:${purl.name}`, purl.version);
+                }
+            }
+            // Replace version ranges with resolved concrete versions
+            return dependencies.map(dep => {
+                if (this.#isVersionRange(dep.version)) {
+                    const key = `${dep.groupId}:${dep.artifactId}`;
+                    const resolved = resolvedVersions.get(key);
+                    if (resolved) {
+                        return { ...dep, version: resolved };
+                    }
+                }
+                return dep;
+            });
+        }
+        catch (error) {
+            if (process.env["TRUSTIFY_DA_DEBUG"] === "true") {
+                console.error("Failed to resolve Maven version ranges: " + error.message);
+            }
+            return dependencies;
+        }
+        finally {
+            fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
+    }
 }
 const DEFAULT_MAVEN_DISCOVERY_IGNORE = [
     '**/target/**',

package/dist/src/providers/javascript_bun.d.ts

@@ -0,0 +1,22 @@
+export default class Javascript_bun extends Base_javascript {
+    /**
+     * Parses `bun.lock` into a hash map keyed by `name@version`. Each entry in
+     * the `packages` section is an array whose first element is the resolved id
+     * (`name@version`) and whose fourth element is the SRI integrity string.
+     * @param {string} lockDir - Directory containing bun.lock
+     * @returns {Map<string, Array<{alg: string, content: string}>>} Hash map
+     * @protected
+     */
+    protected _parseLockFileHashes(lockDir: string): Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>;
+    _listCmdArgs(): void;
+    _buildDependencyTree(includeTransitive: any, opts?: {}): {
+        name: any;
+        version: any;
+        dependencies: {};
+    };
+    #private;
+}
+import Base_javascript from './base_javascript.js';

package/dist/src/providers/javascript_bun.js

@@ -0,0 +1,141 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { parse } from 'jsonc-parser';
+import Base_javascript, { sriToHash } from './base_javascript.js';
+export default class Javascript_bun extends Base_javascript {
+    _lockFileName() {
+        return "bun.lock";
+    }
+    /**
+     * Parses `bun.lock` into a hash map keyed by `name@version`. Each entry in
+     * the `packages` section is an array whose first element is the resolved id
+     * (`name@version`) and whose fourth element is the SRI integrity string.
+     * @param {string} lockDir - Directory containing bun.lock
+     * @returns {Map<string, Array<{alg: string, content: string}>>} Hash map
+     * @protected
+     */
+    _parseLockFileHashes(lockDir) {
+        const map = new Map();
+        const lockPath = path.join(lockDir, this._lockFileName());
+        if (!fs.existsSync(lockPath)) {
+            return map;
+        }
+        let lockData;
+        try {
+            lockData = parse(fs.readFileSync(lockPath, 'utf-8'));
+        }
+        catch (_) {
+            return map;
+        }
+        const packages = lockData?.packages || {};
+        for (const entry of Object.values(packages)) {
+            if (!Array.isArray(entry) || typeof entry[0] !== 'string' || typeof entry[3] !== 'string') {
+                continue;
+            }
+            const id = entry[0];
+            const at = id.lastIndexOf('@');
+            if (at <= 0) {
+                continue;
+            }
+            const name = id.slice(0, at);
+            const version = id.slice(at + 1);
+            const hash = sriToHash(entry[3]);
+            if (name && version && hash) {
+                map.set(`${name}@${version}`, [hash]);
+            }
+        }
+        return map;
+    }
+    _cmdName() {
+        return "bun";
+    }
+    _listCmdArgs() {
+        throw new Error("not supported by Bun");
+    }
+    _updateLockFileCmdArgs() {
+        return ['install', '--lockfile-only'];
+    }
+    _buildDependencyTree(includeTransitive, opts = {}) {
+        this._version();
+        const manifestDir = path.dirname(this._getManifest().manifestPath);
+        const lockDir = this._findLockFileDir(manifestDir, opts) || manifestDir;
+        this._createLockFile(lockDir);
+        this._loadHashes(lockDir);
+        const lockContent = fs.readFileSync(path.join(lockDir, 'bun.lock'), 'utf-8');
+        const lockData = parse(lockContent);
+        const packages = lockData.packages || {};
+        const memberName = this._getManifest().name;
+        const workspaceEntry = this.#findWorkspaceEntry(lockData, lockDir, manifestDir, memberName);
+        const directDeps = workspaceEntry?.dependencies || {};
+        const tree = { name: memberName, version: this._getManifest().version, dependencies: {} };
+        const visited = new Set();
+        for (const depName of Object.keys(directDeps)) {
+            const resolved = this.#resolvePackage(depName, '', packages);
+            if (resolved) {
+                tree.dependencies[depName] = this.#buildNode(depName, resolved, packages, includeTransitive, visited);
+            }
+        }
+        return tree;
+    }
+    #findWorkspaceEntry(lockData, lockDir, manifestDir, memberName) {
+        const workspaces = lockData.workspaces || {};
+        const relPath = path.relative(lockDir, path.resolve(manifestDir));
+        if (!relPath || relPath === '.') {
+            return workspaces[''] || {};
+        }
+        const normalised = relPath.split(path.sep).join('/');
+        if (workspaces[normalised]) {
+            return workspaces[normalised];
+        }
+        for (const [wsPath, entry] of Object.entries(workspaces)) {
+            if (entry.name === memberName && wsPath !== '') {
+                return entry;
+            }
+        }
+        return workspaces[''] || {};
+    }
+    #resolvePackage(depName, parentKey, packages) {
+        if (parentKey) {
+            const scopedKey = `${parentKey}/${depName}`;
+            if (packages[scopedKey]) {
+                return packages[scopedKey];
+            }
+        }
+        return packages[depName] || null;
+    }
+    #buildNode(depName, resolved, packages, includeTransitive, visited) {
+        const resolvedId = Array.isArray(resolved) ? resolved[0] : resolved;
+        const version = this.#extractVersion(resolvedId);
+        const node = { version };
+        if (!includeTransitive) {
+            return node;
+        }
+        const metadata = Array.isArray(resolved) ? (resolved[2] || {}) : {};
+        const subDeps = metadata.dependencies || {};
+        if (Object.keys(subDeps).length > 0) {
+            const visitKey = `${depName}@${version}`;
+            if (visited.has(visitKey)) {
+                return node;
+            }
+            visited.add(visitKey);
+            node.dependencies = {};
+            for (const subName of Object.keys(subDeps)) {
+                const subResolved = this.#resolvePackage(subName, depName, packages);
+                if (subResolved) {
+                    node.dependencies[subName] = this.#buildNode(subName, subResolved, packages, true, visited);
+                }
+            }
+        }
+        return node;
+    }
+    #extractVersion(resolvedId) {
+        if (typeof resolvedId !== 'string') {
+            return '0.0.0';
+        }
+        const atIdx = resolvedId.lastIndexOf('@');
+        if (atIdx > 0) {
+            return resolvedId.substring(atIdx + 1);
+        }
+        return '0.0.0';
+    }
+}

package/dist/src/providers/javascript_npm.d.ts

@@ -1,5 +1,23 @@
 export default class Javascript_npm extends Base_javascript {
+    /**
+     * Parses `package-lock.json` (lockfileVersion 2/3) into a hash map keyed by
+     * `name@version`. Each `packages` entry is keyed by its install path
+     * (e.g. `node_modules/@hapi/joi`); the package name is the segment after the
+     * final `node_modules/`. The `integrity` field holds an SRI string.
+     * @param {string} lockDir - Directory containing package-lock.json
+     * @returns {Map<string, Array<{alg: string, content: string}>>} Hash map
+     * @protected
+     */
+    protected _parseLockFileHashes(lockDir: string): Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>;
     _listCmdArgs(includeTransitive: any): string[];
-    _buildDependencyTree(includeTransitive: any, opts?: {}): any;
+    _buildDependencyTree(includeTransitive: any, opts?: {}): Object | {
+        name: any;
+        version: any;
+        dependencies: any;
+        optionalDependencies: any;
+    };
 }
 import Base_javascript from './base_javascript.js';

package/dist/src/providers/javascript_npm.js

@@ -1,8 +1,47 @@
-import Base_javascript from './base_javascript.js';
+import fs from 'node:fs';
+import path from 'node:path';
+import Base_javascript, { sriToHash } from './base_javascript.js';
 export default class Javascript_npm extends Base_javascript {
     _lockFileName() {
         return "package-lock.json";
     }
+    /**
+     * Parses `package-lock.json` (lockfileVersion 2/3) into a hash map keyed by
+     * `name@version`. Each `packages` entry is keyed by its install path
+     * (e.g. `node_modules/@hapi/joi`); the package name is the segment after the
+     * final `node_modules/`. The `integrity` field holds an SRI string.
+     * @param {string} lockDir - Directory containing package-lock.json
+     * @returns {Map<string, Array<{alg: string, content: string}>>} Hash map
+     * @protected
+     */
+    _parseLockFileHashes(lockDir) {
+        const map = new Map();
+        const lockPath = path.join(lockDir, this._lockFileName());
+        if (!fs.existsSync(lockPath)) {
+            return map;
+        }
+        let lock;
+        try {
+            lock = JSON.parse(fs.readFileSync(lockPath, 'utf-8'));
+        }
+        catch (_) {
+            return map;
+        }
+        const packages = lock.packages || {};
+        for (const [pkgPath, entry] of Object.entries(packages)) {
+            if (!pkgPath || !entry || !entry.integrity || !entry.version) {
+                continue;
+            }
+            const marker = 'node_modules/';
+            const idx = pkgPath.lastIndexOf(marker);
+            const name = idx < 0 ? pkgPath : pkgPath.slice(idx + marker.length);
+            const hash = sriToHash(entry.integrity);
+            if (name && hash) {
+                map.set(`${name}@${entry.version}`, [hash]);
+            }
+        }
+        return map;
+    }
     _cmdName() {
         return "npm";
     }

package/dist/src/providers/javascript_pnpm.d.ts

@@ -1,4 +1,17 @@
 export default class Javascript_pnpm extends Base_javascript {
+    /**
+     * Parses `pnpm-lock.yaml` (lockfileVersion 9) into a hash map keyed by
+     * `name@version`. Entries in the `packages` section are keyed by
+     * `<name>@<version>` (optionally followed by a `(peer@x)` suffix); the
+     * `resolution.integrity` field holds an SRI string.
+     * @param {string} lockDir - Directory containing pnpm-lock.yaml
+     * @returns {Map<string, Array<{alg: string, content: string}>>} Hash map
+     * @protected
+     */
+    protected _parseLockFileHashes(lockDir: string): Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>;
     _listCmdArgs(includeTransitive: any): string[];
     _buildDependencyTree(includeTransitive: any, opts?: {}): any;
 }

package/dist/src/providers/javascript_pnpm.js

@@ -1,8 +1,54 @@
-import Base_javascript from './base_javascript.js';
+import fs from 'node:fs';
+import path from 'node:path';
+import { load as yamlLoad } from 'js-yaml';
+import Base_javascript, { sriToHash } from './base_javascript.js';
 export default class Javascript_pnpm extends Base_javascript {
     _lockFileName() {
         return "pnpm-lock.yaml";
     }
+    /**
+     * Parses `pnpm-lock.yaml` (lockfileVersion 9) into a hash map keyed by
+     * `name@version`. Entries in the `packages` section are keyed by
+     * `<name>@<version>` (optionally followed by a `(peer@x)` suffix); the
+     * `resolution.integrity` field holds an SRI string.
+     * @param {string} lockDir - Directory containing pnpm-lock.yaml
+     * @returns {Map<string, Array<{alg: string, content: string}>>} Hash map
+     * @protected
+     */
+    _parseLockFileHashes(lockDir) {
+        const map = new Map();
+        const lockPath = path.join(lockDir, this._lockFileName());
+        if (!fs.existsSync(lockPath)) {
+            return map;
+        }
+        let lock;
+        try {
+            lock = yamlLoad(fs.readFileSync(lockPath, 'utf-8'));
+        }
+        catch (_) {
+            return map;
+        }
+        const packages = lock?.packages || {};
+        for (const [key, entry] of Object.entries(packages)) {
+            const integrity = entry?.resolution?.integrity;
+            if (!key || !integrity) {
+                continue;
+            }
+            // Strip any peer-dependency suffix, then split name from version
+            const base = key.split('(')[0];
+            const at = base.lastIndexOf('@');
+            if (at <= 0) {
+                continue;
+            }
+            const name = base.slice(0, at);
+            const version = base.slice(at + 1);
+            const hash = sriToHash(integrity);
+            if (name && version && hash) {
+                map.set(`${name}@${version}`, [hash]);
+            }
+        }
+        return map;
+    }
     _cmdName() {
         return "pnpm";
     }

package/dist/src/providers/javascript_yarn.d.ts

@@ -1,5 +1,17 @@
 export default class Javascript_yarn extends Base_javascript {
     static VERSION_PATTERN: RegExp;
+    /**
+     * Parses `yarn.lock` into a hash map keyed by `name@version`. Supports both
+     * Yarn Classic (v1) entries with an `integrity` SRI field and Yarn Berry
+     * (v2+) entries with a `checksum` field.
+     * @param {string} lockDir - Directory containing yarn.lock
+     * @returns {Map<string, Array<{alg: string, content: string}>>} Hash map
+     * @protected
+     */
+    protected _parseLockFileHashes(lockDir: string): Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>;
     _listCmdArgs(includeTransitive: any, manifestDir: any): any;
     _updateLockFileCmdArgs(manifestDir: any): any;
     _setUp(manifestPath: any, opts: any): void;