@trustify-da/trustify-da-javascript-client 0.3.0-ea.cdf078c → 0.3.0-ea.d2fee6b

package/dist/src/providers/golang_gomodules.js

@@ -4,6 +4,7 @@ import { PackageURL } from 'packageurl-js';
 import { readLicenseFile } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
 import { getCustom, getCustomPath, invokeCommand } from "../tools.js";
+import { filterManifestPathsByDiscoveryIgnore, resolveWorkspaceDiscoveryIgnore } from '../workspace.js';
 import { getParser, getRequireQuery } from './gomod_parser.js';
 export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest };
 /** @typedef {import('../provider').Provider} */
@@ -399,3 +400,51 @@ function getLineSeparatorGolang() {
     let reg = /\n|\r\n/;
     return reg;
 }
+/**
+ * Discover all go.mod manifest paths in a Go workspace.
+ * Uses `go work edit -json` to get workspace members.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain go.work)
+ * @param {import('../index.js').Options} [opts={}]
+ * @returns {Promise<string[]>} Paths to go.mod files (absolute)
+ */
+export async function discoverGoWorkspaceModules(workspaceRoot, opts = {}) {
+    const root = path.resolve(workspaceRoot);
+    const goWork = path.join(root, 'go.work');
+    if (!fs.existsSync(goWork)) {
+        return [];
+    }
+    const goBin = getCustomPath('go', opts);
+    let output;
+    try {
+        output = invokeCommand(goBin, ['work', 'edit', '-json', goWork], { cwd: root });
+    }
+    catch {
+        return [];
+    }
+    let workspace;
+    try {
+        workspace = JSON.parse(output.toString().trim());
+    }
+    catch {
+        return [];
+    }
+    const useEntries = workspace.Use || [];
+    if (useEntries.length === 0) {
+        return [];
+    }
+    const manifestPaths = [];
+    for (const entry of useEntries) {
+        const diskPath = entry.DiskPath;
+        if (!diskPath) {
+            continue;
+        }
+        const moduleDir = path.resolve(root, diskPath);
+        const goMod = path.join(moduleDir, 'go.mod');
+        if (fs.existsSync(goMod)) {
+            manifestPaths.push(goMod);
+        }
+    }
+    const ignorePatterns = resolveWorkspaceDiscoveryIgnore(opts);
+    return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+}

package/dist/src/providers/java_gradle.d.ts

@@ -1,3 +1,22 @@
+/**
+ * Discover all build.gradle[.kts] manifest paths in a Gradle multi-project build.
+ * Uses a custom init script to get structured project listing.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain settings.gradle[.kts])
+ * @param {import('../index.js').Options} [opts={}]
+ * @returns {Promise<string[]>} Paths to build.gradle[.kts] files (absolute)
+ */
+export function discoverGradleSubprojects(workspaceRoot: string, opts?: import("../index.js").Options): Promise<string[]>;
+/**
+ * Parse the structured output from the Gradle init script.
+ *
+ * @param {string} raw - Raw stdout from gradle
+ * @returns {{ path: string, dir: string }[]}
+ */
+export function parseGradleInitScriptOutput(raw: string): {
+    path: string;
+    dir: string;
+}[];
 /**
  * This class provides common functionality for Groovy and Kotlin DSL files.
  */

package/dist/src/providers/java_gradle.js

@@ -1,9 +1,13 @@
+import crypto from 'node:crypto';
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { EOL } from 'os';
 import TOML from 'fast-toml';
 import { readLicenseFile } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
+import { invokeCommand } from '../tools.js';
+import { filterManifestPathsByDiscoveryIgnore, resolveWorkspaceDiscoveryIgnore } from '../workspace.js';
 import Base_java, { ecosystem_gradle } from "./base_java.js";
 /** @typedef {import('../provider.js').Provider} */
 /** @typedef {import('../provider.js').Provided} Provided */
@@ -407,3 +411,113 @@ export default class Java_gradle extends Base_java {
         return undefined;
     }
 }
+const DEFAULT_GRADLE_DISCOVERY_IGNORE = [
+    '**/build/**',
+    '**/.gradle/**',
+];
+/** Gradle init script that emits structured project listing. */
+const GRADLE_INIT_SCRIPT = `allprojects {
+    task daListProjects {
+        doLast {
+            println "::DA_PROJECT::\${project.path}::\${project.projectDir}"
+        }
+    }
+}
+`;
+/**
+ * Discover all build.gradle[.kts] manifest paths in a Gradle multi-project build.
+ * Uses a custom init script to get structured project listing.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain settings.gradle[.kts])
+ * @param {import('../index.js').Options} [opts={}]
+ * @returns {Promise<string[]>} Paths to build.gradle[.kts] files (absolute)
+ */
+export async function discoverGradleSubprojects(workspaceRoot, opts = {}) {
+    const root = path.resolve(workspaceRoot);
+    const hasSettings = fs.existsSync(path.join(root, 'settings.gradle'))
+        || fs.existsSync(path.join(root, 'settings.gradle.kts'));
+    if (!hasSettings) {
+        return [];
+    }
+    const manifestPaths = [];
+    const rootBuildKts = path.join(root, 'build.gradle.kts');
+    const rootBuild = path.join(root, 'build.gradle');
+    const rootManifest = fs.existsSync(rootBuildKts) ? rootBuildKts : fs.existsSync(rootBuild) ? rootBuild : null;
+    if (rootManifest) {
+        manifestPaths.push(rootManifest);
+    }
+    let gradleBin;
+    try {
+        gradleBin = new Java_gradle().selectToolBinary(rootManifest || rootBuild, opts);
+    }
+    catch {
+        const ignorePatterns = [...resolveWorkspaceDiscoveryIgnore(opts), ...DEFAULT_GRADLE_DISCOVERY_IGNORE];
+        return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+    }
+    const initScriptPath = path.join(os.tmpdir(), `da-list-projects-${crypto.randomUUID()}.gradle`);
+    try {
+        fs.writeFileSync(initScriptPath, GRADLE_INIT_SCRIPT);
+        let output;
+        try {
+            output = invokeCommand(gradleBin, [
+                '-q', '--no-daemon',
+                '--init-script', initScriptPath,
+                'daListProjects',
+            ], { cwd: root });
+        }
+        catch {
+            const ignorePatterns = [...resolveWorkspaceDiscoveryIgnore(opts), ...DEFAULT_GRADLE_DISCOVERY_IGNORE];
+            return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+        }
+        const projects = parseGradleInitScriptOutput(output.toString());
+        for (const proj of projects) {
+            if (proj.path === ':') {
+                continue;
+            }
+            const projDir = path.resolve(proj.dir);
+            const buildKts = path.join(projDir, 'build.gradle.kts');
+            const buildGroovy = path.join(projDir, 'build.gradle');
+            if (fs.existsSync(buildKts)) {
+                manifestPaths.push(buildKts);
+            }
+            else if (fs.existsSync(buildGroovy)) {
+                manifestPaths.push(buildGroovy);
+            }
+        }
+    }
+    finally {
+        try {
+            fs.unlinkSync(initScriptPath);
+        }
+        catch { /* ignore */ }
+    }
+    const ignorePatterns = [...resolveWorkspaceDiscoveryIgnore(opts), ...DEFAULT_GRADLE_DISCOVERY_IGNORE];
+    return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+}
+/**
+ * Parse the structured output from the Gradle init script.
+ *
+ * @param {string} raw - Raw stdout from gradle
+ * @returns {{ path: string, dir: string }[]}
+ */
+export function parseGradleInitScriptOutput(raw) {
+    const projects = [];
+    for (const rawLine of raw.split('\n')) {
+        const line = rawLine.trimEnd();
+        if (!line.startsWith('::DA_PROJECT::')) {
+            continue;
+        }
+        const prefix = '::DA_PROJECT::';
+        const remainder = line.substring(prefix.length);
+        const lastSep = remainder.lastIndexOf('::');
+        if (lastSep < 0) {
+            continue;
+        }
+        const projPath = remainder.substring(0, lastSep);
+        const dir = remainder.substring(lastSep + 2);
+        if (projPath && dir) {
+            projects.push({ path: projPath, dir });
+        }
+    }
+    return projects;
+}

package/dist/src/providers/java_maven.d.ts

@@ -1,3 +1,11 @@
+/**
+ * Discover all pom.xml manifest paths in a Maven multi-module project.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain pom.xml)
+ * @param {object} [opts={}]
+ * @returns {Promise<string[]>} Paths to pom.xml files (absolute)
+ */
+export function discoverMavenModules(workspaceRoot: string, opts?: object): Promise<string[]>;
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /** @typedef {{name: string, version: string}} Package */

package/dist/src/providers/java_maven.js

@@ -5,7 +5,8 @@ import { EOL } from 'os';
 import { XMLParser } from 'fast-xml-parser';
 import { getLicense } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
-import { getCustom } from '../tools.js';
+import { getCustom, invokeCommand } from '../tools.js';
+import { filterManifestPathsByDiscoveryIgnore, resolveWorkspaceDiscoveryIgnore } from '../workspace.js';
 import Base_java, { ecosystem_maven } from "./base_java.js";
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
@@ -289,3 +290,94 @@ export default class Java_maven extends Base_java {
         return deps.filter(d => dep.artifactId === d.artifactId && dep.groupId === d.groupId && dep.scope === d.scope).length > 0;
     }
 }
+const DEFAULT_MAVEN_DISCOVERY_IGNORE = [
+    '**/target/**',
+];
+/**
+ * Discover all pom.xml manifest paths in a Maven multi-module project.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain pom.xml)
+ * @param {object} [opts={}]
+ * @returns {Promise<string[]>} Paths to pom.xml files (absolute)
+ */
+export async function discoverMavenModules(workspaceRoot, opts = {}) {
+    const root = path.resolve(workspaceRoot);
+    const rootPom = path.join(root, 'pom.xml');
+    if (!fs.existsSync(rootPom)) {
+        return [];
+    }
+    let mvnBin;
+    try {
+        mvnBin = new Java_maven().selectToolBinary(rootPom, opts);
+    }
+    catch {
+        return [rootPom];
+    }
+    const visited = new Set();
+    const manifestPaths = [rootPom];
+    collectMavenModules(root, mvnBin, visited, manifestPaths);
+    const ignorePatterns = [...resolveWorkspaceDiscoveryIgnore(opts), ...DEFAULT_MAVEN_DISCOVERY_IGNORE];
+    return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+}
+/**
+ * @param {string} dir - Absolute path to directory containing pom.xml
+ * @param {string} mvnBin - Maven binary path
+ * @param {Set<string>} visited - Already-visited directories (cycle guard)
+ * @param {string[]} manifestPaths - Accumulator for discovered pom.xml paths
+ */
+function collectMavenModules(dir, mvnBin, visited, manifestPaths) {
+    const resolvedDir = path.resolve(dir);
+    if (visited.has(resolvedDir)) {
+        return;
+    }
+    visited.add(resolvedDir);
+    const modules = listMavenModules(resolvedDir, mvnBin);
+    for (const mod of modules) {
+        const moduleDir = path.resolve(resolvedDir, mod);
+        const modulePom = path.join(moduleDir, 'pom.xml');
+        if (fs.existsSync(modulePom)) {
+            manifestPaths.push(modulePom);
+            collectMavenModules(moduleDir, mvnBin, visited, manifestPaths);
+        }
+    }
+}
+/**
+ * @param {string} dir - Directory containing pom.xml
+ * @param {string} mvnBin - Maven binary path
+ * @returns {string[]} Module directory names (relative to `dir`)
+ */
+function listMavenModules(dir, mvnBin) {
+    let output;
+    try {
+        output = invokeCommand(mvnBin, [
+            'help:evaluate',
+            '-Dexpression=project.modules',
+            '-q',
+            '-DforceStdout',
+            '-f', path.join(dir, 'pom.xml'),
+            '--batch-mode',
+        ], { cwd: dir });
+    }
+    catch {
+        return [];
+    }
+    const raw = output.toString().trim();
+    if (!raw || raw.startsWith('<modules')) {
+        return [];
+    }
+    return parseMavenModuleList(raw);
+}
+/**
+ * @param {string} raw - Raw stdout from mvn help:evaluate -DforceStdout
+ * @returns {string[]}
+ */
+function parseMavenModuleList(raw) {
+    const parser = new XMLParser();
+    const parsed = parser.parse(raw);
+    const entries = parsed?.strings?.string;
+    if (!entries) {
+        return [];
+    }
+    const list = Array.isArray(entries) ? entries : [entries];
+    return list.map(s => String(s).trim()).filter(Boolean);
+}

package/dist/src/providers/javascript_npm.d.ts

@@ -1,4 +1,5 @@
 export default class Javascript_npm extends Base_javascript {
     _listCmdArgs(includeTransitive: any): string[];
+    _buildDependencyTree(includeTransitive: any, opts?: {}): any;
 }
 import Base_javascript from './base_javascript.js';

package/dist/src/providers/javascript_npm.js

@@ -12,4 +12,25 @@ export default class Javascript_npm extends Base_javascript {
     _updateLockFileCmdArgs() {
         return ['install', '--package-lock-only'];
     }
+    _buildDependencyTree(includeTransitive, opts = {}) {
+        // npm ls --json returns a single tree rooted at the workspace root.
+        // When analyzing a workspace member, its deps are nested under the
+        // root's dependencies keyed by the member name — extract that subtree
+        // so downstream analysis sees only the member's dependencies.
+        const tree = super._buildDependencyTree(includeTransitive, opts);
+        const memberName = this._getManifest().name;
+        if (tree.name === memberName) {
+            return tree;
+        }
+        const memberEntry = tree.dependencies?.[memberName];
+        if (memberEntry) {
+            return {
+                name: memberName,
+                version: memberEntry.version || this._getManifest().version,
+                dependencies: memberEntry.dependencies,
+                optionalDependencies: memberEntry.optionalDependencies,
+            };
+        }
+        return tree;
+    }
 }

package/dist/src/providers/javascript_pnpm.js

@@ -7,15 +7,19 @@ export default class Javascript_pnpm extends Base_javascript {
         return "pnpm";
     }
     _listCmdArgs(includeTransitive) {
-        return ['ls', includeTransitive ? '--depth=Infinity' : '--depth=0', '--prod', '--json'];
+        return ['ls', includeTransitive ? '--depth=Infinity' : '--depth=0', '--prod', '--json', '-r'];
     }
     _updateLockFileCmdArgs() {
         return ['install', '--frozen-lockfile'];
     }
     _buildDependencyTree(includeTransitive, opts = {}) {
+        // pnpm ls --json returns an array with one entry per workspace package.
+        // When analyzing a workspace member, find its entry by name instead of
+        // blindly taking the first element (which is the workspace root).
         const tree = super._buildDependencyTree(includeTransitive, opts);
         if (Array.isArray(tree) && tree.length > 0) {
-            return tree[0];
+            const memberName = this._getManifest().name;
+            return tree.find(pkg => pkg.name === memberName) || tree[0];
         }
         return {};
     }

package/dist/src/providers/marker_evaluator.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Maps Node.js/OS values to PEP 508 marker variables.
+ * Example: on Linux, sys_platform='linux', platform_system='Linux', os_name='posix'
+ * @returns {Record<string, string>}
+ */
+export function getEnvironmentMarkers(): Record<string, string>;
+/**
+ * Evaluates a full PEP 508 marker expression against the current platform.
+ * Example: "sys_platform == 'win32' and python_version >= '3.8'" → false on Linux
+ * Empty/missing markers return true (unconditional dependency).
+ * @param {string} markerExpr
+ * @returns {boolean}
+ */
+export function evaluateMarker(markerExpr: string): boolean;

package/dist/src/providers/marker_evaluator.js

@@ -0,0 +1,191 @@
+// PEP 508 environment marker evaluator.
+// Filters Python dependencies by platform/version markers so that e.g.
+// "pywin32 ; sys_platform == 'win32'" is excluded on Linux/macOS.
+// See https://peps.python.org/pep-0508/#environment-markers
+import os from 'node:os';
+import { getCustomPath, invokeCommand } from '../tools.js';
+let cachedPythonVersions = undefined;
+function getPythonVersions() {
+    if (cachedPythonVersions !== undefined) {
+        return cachedPythonVersions;
+    }
+    try {
+        let python = getCustomPath('python3');
+        let out = invokeCommand(python, ['-c', "import sys; v=sys.version_info; print(f'{v.major}.{v.minor} {v.major}.{v.minor}.{v.micro}')"], { timeout: 5000 }).toString().trim();
+        let [short, full] = out.split(' ');
+        cachedPythonVersions = { short, full };
+    }
+    catch {
+        cachedPythonVersions = null;
+    }
+    return cachedPythonVersions;
+}
+/**
+ * Maps Node.js/OS values to PEP 508 marker variables.
+ * Example: on Linux, sys_platform='linux', platform_system='Linux', os_name='posix'
+ * @returns {Record<string, string>}
+ */
+export function getEnvironmentMarkers() {
+    let platform = process.platform;
+    let systemMap = { win32: 'Windows', linux: 'Linux', darwin: 'Darwin' };
+    let machine = typeof os.machine === 'function' ? os.machine() : process.arch;
+    let pyVer = getPythonVersions();
+    return {
+        sys_platform: platform,
+        platform_system: systemMap[platform] || platform,
+        os_name: platform === 'win32' ? 'nt' : 'posix',
+        platform_machine: machine,
+        platform_release: os.release(),
+        platform_version: os.version?.() || '',
+        python_version: pyVer?.short || '',
+        python_full_version: pyVer?.full || '',
+        implementation_name: 'cpython',
+    };
+}
+function compareVersions(left, right) {
+    let lParts = left.split('.').map(Number);
+    let rParts = right.split('.').map(Number);
+    let len = Math.max(lParts.length, rParts.length);
+    for (let i = 0; i < len; i++) {
+        let l = lParts[i] || 0;
+        let r = rParts[i] || 0;
+        if (l < r) {
+            return -1;
+        }
+        if (l > r) {
+            return 1;
+        }
+    }
+    return 0;
+}
+// Evaluates a single comparison like sys_platform == 'win32' or python_version >= '3.8'.
+// Version-bearing variables (python_version, python_full_version) use numeric comparison;
+// all others use string equality. Returns false when the env value is missing.
+function evaluateComparison(variable, op, value, env) {
+    let envVal = env[variable];
+    if (envVal === undefined || envVal === '') {
+        return false;
+    }
+    let isVersion = variable.includes('version');
+    if (isVersion) {
+        let cmp = compareVersions(envVal, value);
+        switch (op) {
+            case '==': return cmp === 0;
+            case '!=': return cmp !== 0;
+            case '>=': return cmp >= 0;
+            case '<=': return cmp <= 0;
+            case '>': return cmp > 0;
+            case '<': return cmp < 0;
+            case '~=': {
+                let parts = value.split('.');
+                parts.pop();
+                let prefix = parts.join('.');
+                return envVal.startsWith(prefix) && cmp >= 0;
+            }
+            default: return true;
+        }
+    }
+    switch (op) {
+        case '==': return envVal === value;
+        case '!=': return envVal !== value;
+        case 'in': return value.includes(envVal);
+        case 'not in': return !value.includes(envVal);
+        default: return envVal === value;
+    }
+}
+// Parses a single marker comparison into {variable, op, value}.
+// Handles both normal and reversed forms:
+//   "sys_platform == 'linux'"  → { variable: 'sys_platform', op: '==', value: 'linux' }
+//   "'linux' == sys_platform"  → { variable: 'sys_platform', op: '==', value: 'linux' }
+function parseAtom(expr) {
+    // Normal form: variable op 'value'
+    let m = expr.match(/^\s*([\w.]+)\s*(~=|!=|==|>=|<=|>|<|not\s+in|in)\s*["']([^"']*)["']\s*$/);
+    if (m) {
+        return { variable: m[1], op: m[2].replace(/\s+/g, ' '), value: m[3] };
+    }
+    // Reversed form: 'value' op variable — reverse directional operators
+    let mReverse = expr.match(/^\s*["']([^"']*)['"]\s*(~=|!=|==|>=|<=|>|<|not\s+in|in)\s*([\w.]+)\s*$/);
+    if (mReverse) {
+        let reverseOp = { '<': '>', '>': '<', '<=': '>=', '>=': '<=' };
+        let op = mReverse[2].replace(/\s+/g, ' ');
+        return { variable: mReverse[3], op: reverseOp[op] || op, value: mReverse[1] };
+    }
+    return null;
+}
+/**
+ * Evaluates a full PEP 508 marker expression against the current platform.
+ * Example: "sys_platform == 'win32' and python_version >= '3.8'" → false on Linux
+ * Empty/missing markers return true (unconditional dependency).
+ * @param {string} markerExpr
+ * @returns {boolean}
+ */
+export function evaluateMarker(markerExpr) {
+    if (!markerExpr || !markerExpr.trim()) {
+        return true;
+    }
+    let env = getEnvironmentMarkers();
+    return evaluateExpr(markerExpr.trim(), env);
+}
+function evaluateExpr(expr, env) {
+    let orParts = splitLogical(expr, ' or ');
+    if (orParts.length > 1) {
+        return orParts.some(part => evaluateExpr(part, env));
+    }
+    let andParts = splitLogical(expr, ' and ');
+    if (andParts.length > 1) {
+        return andParts.every(part => evaluateExpr(part, env));
+    }
+    let trimmed = expr.trim();
+    if (trimmed.startsWith('(') && trimmed.endsWith(')')) {
+        return evaluateExpr(trimmed.slice(1, -1), env);
+    }
+    let atom = parseAtom(trimmed);
+    if (!atom) {
+        return true;
+    }
+    return evaluateComparison(atom.variable, atom.op, atom.value, env);
+}
+// Splits an expression by " and " or " or " at the top level, skipping
+// separators inside parentheses or quoted strings.
+// Example: splitLogical("a == 'x' and (b == 'y' or c == 'z')", " and ")
+//        → ["a == 'x'", "(b == 'y' or c == 'z')"]
+function splitLogical(expr, sep) {
+    let parts = [];
+    let depth = 0;
+    let current = '';
+    let i = 0;
+    let quoteChar = null;
+    while (i < expr.length) {
+        let ch = expr[i];
+        if (quoteChar) {
+            if (ch === quoteChar) {
+                quoteChar = null;
+            }
+            current += ch;
+            i++;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quoteChar = ch;
+            current += ch;
+            i++;
+            continue;
+        }
+        if (ch === '(') {
+            depth++;
+        }
+        if (ch === ')') {
+            depth--;
+        }
+        if (depth === 0 && expr.substring(i, i + sep.length) === sep) {
+            parts.push(current);
+            current = '';
+            i += sep.length;
+            continue;
+        }
+        current += ch;
+        i++;
+    }
+    parts.push(current);
+    return parts.filter(p => p.trim());
+}

package/dist/src/providers/processors/yarn_berry_processor.js

@@ -15,7 +15,10 @@ export default class Yarn_berry_processor extends Yarn_processor {
      * @returns {string[]} Command arguments for listing dependencies
      */
     listCmdArgs(includeTransitive) {
-        return ['info', includeTransitive ? '--recursive' : '--all', '--json'];
+        // --all is needed to include workspace members in the output
+        return includeTransitive
+            ? ['info', '--recursive', '--all', '--json']
+            : ['info', '--all', '--json'];
     }
     /**
      * Returns the command arguments for updating the lock file
@@ -68,7 +71,8 @@ export default class Yarn_berry_processor extends Yarn_processor {
         if (!name) {
             return false;
         }
-        return name.endsWith("@workspace:.");
+        // Workspace members use paths like "member-a@workspace:packages/member-a", not just "@workspace:."
+        return name.startsWith(`${this._manifest.name}@workspace:`);
     }
     /**
    * Adds dependencies to the SBOM

package/dist/src/providers/python_controller.d.ts

@@ -1,4 +1,4 @@
-/** @typedef {{name: string, version: string, dependencies: DependencyEntry[]}} DependencyEntry */
+/** @typedef {{name: string, version: string, dependencies: DependencyEntry[], hashes?: Array<{alg: string, content: string}>}} DependencyEntry */
 export default class Python_controller {
     /**
      * Constructor to create new python controller instance to interact with pip package manager
@@ -31,4 +31,8 @@ export type DependencyEntry = {
     name: string;
     version: string;
     dependencies: DependencyEntry[];
+    hashes?: Array<{
+        alg: string;
+        content: string;
+    }>;
 };

package/dist/src/providers/python_controller.js

@@ -19,7 +19,7 @@ function getPipShowOutput(depNames) {
         throw new Error('fail invoking \'pip show\' to fetch metadata for all installed packages in environment', { cause: error });
     }
 }
-/** @typedef {{name: string, version: string, dependencies: DependencyEntry[]}} DependencyEntry */
+/** @typedef {{name: string, version: string, dependencies: DependencyEntry[], hashes?: Array<{alg: string, content: string}>}} DependencyEntry */
 export default class Python_controller {
     pythonEnvDir;
     pathToPipBin;
@@ -95,7 +95,7 @@ export default class Python_controller {
     }
     /**
      * Parse the requirements.txt file using tree-sitter and return structured requirement data.
-     * @return {Promise<{name: string, version: string|null}[]>}
+     * @return {Promise<{name: string, version: string|null, hasMarker: boolean}[]>}
      */
     async #parseRequirements() {
         const content = fs.readFileSync(this.pathToRequirements).toString();
@@ -107,7 +107,8 @@ export default class Python_controller {
             const version = versionMatches.length > 0
                 ? versionMatches[0].captures.find(c => c.name === 'version').node.text
                 : null;
-            return { name, version };
+            const hasMarker = reqNode.children.some(c => c.type === 'marker_spec');
+            return { name, version, hasMarker };
         }));
     }
     #decideIfWindowsOrLinuxPath(fileName) {
@@ -224,7 +225,10 @@ export default class Python_controller {
                 CachedEnvironmentDeps[packageName.replace("_", "-")] = pipDepTreeEntryForCache;
             });
         }
-        parsedRequirements.forEach(({ name: depName, version: manifestVersion }) => {
+        parsedRequirements.forEach(({ name: depName, version: manifestVersion, hasMarker }) => {
+            if (hasMarker && CachedEnvironmentDeps[depName.toLowerCase()] === undefined) {
+                return;
+            }
             if (matchManifestVersions === "true" && manifestVersion != null) {
                 let installedVersion;
                 if (CachedEnvironmentDeps[depName.toLowerCase()] !== undefined) {