@trustify-da/trustify-da-javascript-client 0.3.0-ea.dcb2120 → 0.3.0-ea.de62188

package/dist/src/providers/python_poetry.d.ts

@@ -1,18 +1,35 @@
 export default class Python_poetry extends Base_pyproject {
+    _verifyPoetryAccessible(poetryBin: any): void;
     /**
-     * Get poetry show --tree output.
      * @param {string} manifestDir
+     * @param {string} _workspaceDir - unused (poetry has no workspace support)
+     * @param {object} parsed - parsed pyproject.toml
      * @param {Object} opts
+     * @returns {Promise<{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}>}
+     */
+    _getDependencyData(manifestDir: string, _workspaceDir: string, parsed: object, opts: Object): Promise<{
+        directDeps: string[];
+        graph: Map<string, {
+            name: string;
+            version: string;
+            children: string[];
+        }>;
+    }>;
+    /**
+     * Get poetry show --tree output.
+     * @param {string} manifestDir
+     * @param {boolean} hasDevGroup
+     * @param {string} poetryBin
      * @returns {string}
      */
-    _getPoetryShowTreeOutput(manifestDir: string, opts: any): string;
+    _getPoetryShowTreeOutput(manifestDir: string, hasDevGroup: boolean, poetryBin: string): string;
     /**
      * Get poetry show --all output (flat list with resolved versions).
      * @param {string} manifestDir
-     * @param {Object} opts
+     * @param {string} poetryBin
      * @returns {string}
      */
-    _getPoetryShowAllOutput(manifestDir: string, opts: any): string;
+    _getPoetryShowAllOutput(manifestDir: string, poetryBin: string): string;
     /**
      * Parse poetry show --all output into a version map.
      * Lines look like: "name         (!) 1.2.3  Description text..."
@@ -21,21 +38,60 @@ export default class Python_poetry extends Base_pyproject {
      * @returns {Map<string, string>} canonical name -> version
      */
     _parsePoetryShowAll(output: string): Map<string, string>;
+    /**
+     * Collects PEP 508 marker expressions for direct and transitive deps.
+     * Direct markers come from pyproject.toml dependency strings, e.g.:
+     *   "pywin32>=311 ; sys_platform == 'win32'"  → directMarkers['pywin32'] = "sys_platform == 'win32'"
+     * Transitive markers come from poetry.lock [package.dependencies] entries, e.g.:
+     *   colorama = {version = "*", markers = "sys_platform == 'win32'"}
+     *   → transitiveMarkers['click']['colorama'] = "sys_platform == 'win32'"
+     * @param {string|null} lockDir
+     * @param {object} parsed - parsed pyproject.toml
+     * @returns {{directMarkers: Map<string, string>, transitiveMarkers: Map<string, Map<string, string>>, hashMap: Map<string, Array<{alg: string, content: string}>>}}
+     */
+    _extractMarkerData(lockDir: string | null, parsed: object): {
+        directMarkers: Map<string, string>;
+        transitiveMarkers: Map<string, Map<string, string>>;
+        hashMap: Map<string, Array<{
+            alg: string;
+            content: string;
+        }>>;
+    };
+    /**
+     * Extract a SHA-256 hex digest from poetry.lock files array.
+     * Prefers the sdist (.tar.gz) hash; falls back to the first wheel hash.
+     * @param {Array<{file: string, hash: string}>} [files]
+     * @returns {string|null}
+     */
+    _extractSha256FromFiles(files?: Array<{
+        file: string;
+        hash: string;
+    }>): string | null;
     /**
      * Parse poetry show --tree output into a dependency graph structure.
-     * Top-level lines (no indentation/tree chars) are direct deps: "name version description"
-     * Indented lines are transitive deps with tree chars: "├── name >=constraint"
      *
      * @param {string} treeOutput
      * @param {Map<string, string>} versionMap - canonical name -> resolved version
-     * @returns {{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}}
+     * @param {{directMarkers: Map<string, string>, transitiveMarkers: Map<string, Map<string, string>>, hashMap: Map<string, Array<{alg: string, content: string}>>}} markerData
+     * @returns {{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[], hashes?: Array<{alg: string, content: string}>}>}}
      */
-    _parsePoetryTree(treeOutput: string, versionMap: Map<string, string>): {
+    _parsePoetryTree(treeOutput: string, versionMap: Map<string, string>, markerData: {
+        directMarkers: Map<string, string>;
+        transitiveMarkers: Map<string, Map<string, string>>;
+        hashMap: Map<string, Array<{
+            alg: string;
+            content: string;
+        }>>;
+    }): {
         directDeps: string[];
         graph: Map<string, {
             name: string;
             version: string;
             children: string[];
+            hashes?: Array<{
+                alg: string;
+                content: string;
+            }>;
         }>;
     };
 }

package/dist/src/providers/python_poetry.js

@@ -1,7 +1,9 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { parse as parseToml } from 'smol-toml';
 import { environmentVariableIsPopulated, getCustom, getCustomPath, invokeCommand } from '../tools.js';
 import Base_pyproject from './base_pyproject.js';
+import { evaluateMarker } from './marker_evaluator.js';
 export default class Python_poetry extends Base_pyproject {
     /**
      * Poetry has no native workspace/monorepo support (python-poetry/poetry#2270).
@@ -30,6 +32,17 @@ export default class Python_poetry extends Base_pyproject {
     _cmdName() {
         return 'poetry';
     }
+    _verifyPoetryAccessible(poetryBin) {
+        try {
+            invokeCommand(poetryBin, ['--version']);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT') {
+                throw new Error(`poetry is not accessible at "${poetryBin}"`, { cause: error });
+            }
+            throw new Error('failed to check for poetry binary', { cause: error });
+        }
+    }
     /**
      * @param {string} manifestDir
      * @param {string} _workspaceDir - unused (poetry has no workspace support)
@@ -39,35 +52,47 @@ export default class Python_poetry extends Base_pyproject {
      */
     // eslint-disable-next-line no-unused-vars
     async _getDependencyData(manifestDir, _workspaceDir, parsed, opts) {
-        let treeOutput = this._getPoetryShowTreeOutput(manifestDir, opts);
-        let showAllOutput = this._getPoetryShowAllOutput(manifestDir, opts);
+        let poetryBin = getCustomPath('poetry', opts);
+        let envBypass = environmentVariableIsPopulated('TRUSTIFY_DA_POETRY_SHOW_TREE')
+            && environmentVariableIsPopulated('TRUSTIFY_DA_POETRY_SHOW_ALL');
+        if (!envBypass) {
+            this._verifyPoetryAccessible(poetryBin);
+        }
+        let hasDevGroup = !!(parsed.tool?.poetry?.group?.dev || parsed.tool?.poetry?.['dev-dependencies']);
+        let treeOutput = this._getPoetryShowTreeOutput(manifestDir, hasDevGroup, poetryBin);
+        let showAllOutput = this._getPoetryShowAllOutput(manifestDir, poetryBin);
         let versionMap = this._parsePoetryShowAll(showAllOutput);
-        return this._parsePoetryTree(treeOutput, versionMap);
+        let lockDir = this._findLockFileDir(manifestDir, opts);
+        let markerData = this._extractMarkerData(lockDir, parsed);
+        return this._parsePoetryTree(treeOutput, versionMap, markerData);
     }
     /**
      * Get poetry show --tree output.
      * @param {string} manifestDir
-     * @param {Object} opts
+     * @param {boolean} hasDevGroup
+     * @param {string} poetryBin
      * @returns {string}
      */
-    _getPoetryShowTreeOutput(manifestDir, opts) {
+    _getPoetryShowTreeOutput(manifestDir, hasDevGroup, poetryBin) {
         if (environmentVariableIsPopulated('TRUSTIFY_DA_POETRY_SHOW_TREE')) {
             return Buffer.from(process.env['TRUSTIFY_DA_POETRY_SHOW_TREE'], 'base64').toString('utf-8');
         }
-        let poetryBin = getCustomPath('poetry', opts);
-        return invokeCommand(poetryBin, ['show', '--tree', '--no-ansi'], { cwd: manifestDir }).toString();
+        let args = ['show', '--tree', '--no-ansi'];
+        if (hasDevGroup) {
+            args.push('--without', 'dev');
+        }
+        return invokeCommand(poetryBin, args, { cwd: manifestDir }).toString();
     }
     /**
      * Get poetry show --all output (flat list with resolved versions).
      * @param {string} manifestDir
-     * @param {Object} opts
+     * @param {string} poetryBin
      * @returns {string}
      */
-    _getPoetryShowAllOutput(manifestDir, opts) {
+    _getPoetryShowAllOutput(manifestDir, poetryBin) {
         if (environmentVariableIsPopulated('TRUSTIFY_DA_POETRY_SHOW_ALL')) {
             return Buffer.from(process.env['TRUSTIFY_DA_POETRY_SHOW_ALL'], 'base64').toString('utf-8');
         }
-        let poetryBin = getCustomPath('poetry', opts);
         return invokeCommand(poetryBin, ['show', '--no-ansi', '--all'], { cwd: manifestDir }).toString();
     }
     /**
@@ -92,16 +117,83 @@ export default class Python_poetry extends Base_pyproject {
         }
         return versions;
     }
+    /**
+     * Collects PEP 508 marker expressions for direct and transitive deps.
+     * Direct markers come from pyproject.toml dependency strings, e.g.:
+     *   "pywin32>=311 ; sys_platform == 'win32'"  → directMarkers['pywin32'] = "sys_platform == 'win32'"
+     * Transitive markers come from poetry.lock [package.dependencies] entries, e.g.:
+     *   colorama = {version = "*", markers = "sys_platform == 'win32'"}
+     *   → transitiveMarkers['click']['colorama'] = "sys_platform == 'win32'"
+     * @param {string|null} lockDir
+     * @param {object} parsed - parsed pyproject.toml
+     * @returns {{directMarkers: Map<string, string>, transitiveMarkers: Map<string, Map<string, string>>, hashMap: Map<string, Array<{alg: string, content: string}>>}}
+     */
+    _extractMarkerData(lockDir, parsed) {
+        let directMarkers = new Map();
+        let transitiveMarkers = new Map();
+        let hashMap = new Map();
+        // Extract markers from PEP 621 dependency strings: "name[extras]>=ver ; marker"
+        let deps = parsed.project?.dependencies || [];
+        for (let dep of deps) {
+            let m = dep.match(/^([A-Za-z0-9][A-Za-z0-9._-]*)\s*[^;]*;\s*(.+)$/);
+            if (m) {
+                directMarkers.set(this._canonicalize(m[1]), m[2].trim());
+            }
+        }
+        if (lockDir) {
+            let lockPath = path.join(lockDir, this._lockFileName());
+            if (fs.existsSync(lockPath)) {
+                let lockContent = fs.readFileSync(lockPath, 'utf-8');
+                let lock = parseToml(lockContent);
+                let packages = lock.package || [];
+                for (let pkg of packages) {
+                    let pkgKey = this._canonicalize(pkg.name);
+                    let pkgDeps = pkg.dependencies || {};
+                    for (let [depName, depSpec] of Object.entries(pkgDeps)) {
+                        let markers = typeof depSpec === 'object' && depSpec != null ? depSpec.markers : null;
+                        if (markers) {
+                            if (!transitiveMarkers.has(pkgKey)) {
+                                transitiveMarkers.set(pkgKey, new Map());
+                            }
+                            transitiveMarkers.get(pkgKey).set(this._canonicalize(depName), markers);
+                        }
+                    }
+                    let sha256Hex = this._extractSha256FromFiles(pkg.files);
+                    if (sha256Hex) {
+                        hashMap.set(pkgKey, [{ alg: "SHA-256", content: sha256Hex }]);
+                    }
+                }
+            }
+        }
+        return { directMarkers, transitiveMarkers, hashMap };
+    }
+    /**
+     * Extract a SHA-256 hex digest from poetry.lock files array.
+     * Prefers the sdist (.tar.gz) hash; falls back to the first wheel hash.
+     * @param {Array<{file: string, hash: string}>} [files]
+     * @returns {string|null}
+     */
+    _extractSha256FromFiles(files) {
+        if (!Array.isArray(files) || files.length === 0) {
+            return null;
+        }
+        let sdist = files.find(f => f.file.endsWith('.tar.gz'));
+        let entry = sdist || files[0];
+        let hash = entry.hash;
+        if (hash && hash.startsWith('sha256:')) {
+            return hash.slice(7);
+        }
+        return null;
+    }
     /**
      * Parse poetry show --tree output into a dependency graph structure.
-     * Top-level lines (no indentation/tree chars) are direct deps: "name version description"
-     * Indented lines are transitive deps with tree chars: "├── name >=constraint"
      *
      * @param {string} treeOutput
      * @param {Map<string, string>} versionMap - canonical name -> resolved version
-     * @returns {{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}}
+     * @param {{directMarkers: Map<string, string>, transitiveMarkers: Map<string, Map<string, string>>, hashMap: Map<string, Array<{alg: string, content: string}>>}} markerData
+     * @returns {{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[], hashes?: Array<{alg: string, content: string}>}>}}
      */
-    _parsePoetryTree(treeOutput, versionMap) {
+    _parsePoetryTree(treeOutput, versionMap, markerData) {
         let lines = treeOutput.split(/\r?\n/);
         let graph = new Map();
         let directDeps = [];
@@ -117,9 +209,20 @@ export default class Python_poetry extends Base_pyproject {
                 let name = topMatch[1];
                 let version = topMatch[2];
                 let key = this._canonicalize(name);
+                let marker = markerData.directMarkers.get(key);
+                if (marker && !evaluateMarker(marker)) {
+                    currentDirectDep = null;
+                    stack = [];
+                    continue;
+                }
                 directDeps.push(key);
                 if (!graph.has(key)) {
-                    graph.set(key, { name, version, children: [] });
+                    let entry = { name, version, children: [] };
+                    let hashes = markerData.hashMap.get(key);
+                    if (hashes) {
+                        entry.hashes = hashes;
+                    }
+                    graph.set(key, entry);
                 }
                 currentDirectDep = key;
                 stack = [{ key, depth: -1 }];
@@ -143,20 +246,34 @@ export default class Python_poetry extends Base_pyproject {
             // determine depth by counting tree-drawing groups in the prefix
             let prefix = line.substring(0, nameStart);
             let depth = (prefix.match(/(?:[├└│ ][\s─]{2} ?)/g) || []).length;
+            // pop stack back to find the parent at depth-1
+            while (stack.length > 0 && stack[stack.length - 1].depth >= depth) {
+                stack.pop();
+            }
+            let parentKey = stack.length > 0 ? stack[stack.length - 1].key : null;
+            if (parentKey) {
+                let parentMarkers = markerData.transitiveMarkers.get(parentKey);
+                if (parentMarkers) {
+                    let marker = parentMarkers.get(depKey);
+                    if (marker && !evaluateMarker(marker)) {
+                        continue;
+                    }
+                }
+            }
             // resolve version from the version map
             let version = versionMap.get(depKey) || null;
             if (!version) {
                 throw new Error(`poetry: package '${depName}' has no resolved version`);
             }
             if (!graph.has(depKey)) {
-                graph.set(depKey, { name: depName, version, children: [] });
-            }
-            // pop stack back to find the parent at depth-1
-            while (stack.length > 0 && stack[stack.length - 1].depth >= depth) {
-                stack.pop();
+                let entry = { name: depName, version, children: [] };
+                let hashes = markerData.hashMap.get(depKey);
+                if (hashes) {
+                    entry.hashes = hashes;
+                }
+                graph.set(depKey, entry);
             }
-            if (stack.length > 0) {
-                let parentKey = stack[stack.length - 1].key;
+            if (parentKey) {
                 let parentEntry = graph.get(parentKey);
                 if (parentEntry && !parentEntry.children.includes(depKey)) {
                     parentEntry.children.push(depKey);

package/dist/src/providers/python_uv.d.ts

@@ -1,11 +1,30 @@
+/**
+ * Discover all pyproject.toml manifest paths in a uv workspace.
+ * Parses `[tool.uv.workspace]` from root pyproject.toml and glob-expands member patterns.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain pyproject.toml and uv.lock)
+ * @param {{ workspaceDiscoveryIgnore?: string[], TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string, [key: string]: unknown }} [opts={}]
+ * @returns {Promise<string[]>} Paths to pyproject.toml files (absolute)
+ */
+export function discoverUvWorkspaceMembers(workspaceRoot: string, opts?: {
+    workspaceDiscoveryIgnore?: string[];
+    TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string;
+    [key: string]: unknown;
+}): Promise<string[]>;
 export default class Python_uv extends Base_pyproject {
+    /**
+     * Parse uv.lock and attach SHA-256 hashes to graph entries.
+     * @param {string} lockFilePath - path to uv.lock
+     * @param {Map<string, import('./base_pyproject.js').GraphEntry>} graph
+     */
+    _attachHashesFromLockFile(lockFilePath: string, graph: Map<string, import("./base_pyproject.js").GraphEntry>): Promise<void>;
     /**
      * Get the uv export output, either from env var or by running the command.
      * @param {string} manifestDir
      * @param {Object} opts
      * @returns {string}
      */
-    _getUvExportOutput(manifestDir: string, opts: any): string;
+    _getUvExportOutput(manifestDir: string, opts: Object): string;
     /**
      * Parse uv export output into a dependency graph using tree-sitter-requirements
      * for package/version extraction and string parsing for "# via" comments.

package/dist/src/providers/python_uv.js

@@ -1,8 +1,11 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import fg from 'fast-glob';
 import { parse as parseToml } from 'smol-toml';
 import { environmentVariableIsPopulated, getCustomPath, invokeCommand } from '../tools.js';
+import { filterManifestPathsByDiscoveryIgnore, resolveWorkspaceDiscoveryIgnore, toManifestGlobPatterns } from '../workspace.js';
 import Base_pyproject from './base_pyproject.js';
+import { evaluateMarker } from './marker_evaluator.js';
 import { getParser, getPinnedVersionQuery } from './requirements_parser.js';
 export default class Python_uv extends Base_pyproject {
     /** @returns {string} */
@@ -18,12 +21,54 @@ export default class Python_uv extends Base_pyproject {
      * @param {string} workspaceDir - workspace root (for resolving editable install paths)
      * @param {object} parsed - parsed pyproject.toml
      * @param {Object} opts
-     * @returns {Promise<{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}>}
+     * @returns {Promise<{directDeps: string[], graph: Map<string, import('./base_pyproject.js').GraphEntry>}>}
      */
     async _getDependencyData(manifestDir, workspaceDir, parsed, opts) {
         let projectName = this._getProjectName(parsed);
         let uvOutput = this._getUvExportOutput(manifestDir, opts);
-        return this._parseUvExport(uvOutput, projectName, workspaceDir);
+        let { directDeps, graph } = await this._parseUvExport(uvOutput, projectName, workspaceDir);
+        await this._attachHashesFromLockFile(path.join(workspaceDir, 'uv.lock'), graph);
+        return { directDeps, graph };
+    }
+    /**
+     * Parse uv.lock and attach SHA-256 hashes to graph entries.
+     * @param {string} lockFilePath - path to uv.lock
+     * @param {Map<string, import('./base_pyproject.js').GraphEntry>} graph
+     */
+    async _attachHashesFromLockFile(lockFilePath, graph) {
+        let lockContent;
+        try {
+            lockContent = await fs.promises.readFile(lockFilePath, 'utf-8');
+        }
+        catch {
+            return;
+        }
+        let parsed;
+        try {
+            parsed = parseToml(lockContent);
+        }
+        catch {
+            return;
+        }
+        let packages = parsed.package;
+        if (!Array.isArray(packages)) {
+            return;
+        }
+        for (let pkg of packages) {
+            if (!pkg.name) {
+                continue;
+            }
+            let hashStr = pkg.sdist?.hash || pkg.wheels?.[0]?.hash;
+            if (!hashStr || !hashStr.startsWith('sha256:')) {
+                continue;
+            }
+            let key = this._canonicalize(pkg.name);
+            let entry = graph.get(key);
+            if (!entry || entry.hashes) {
+                continue;
+            }
+            entry.hashes = [{ alg: "SHA-256", content: hashStr.slice(7) }];
+        }
     }
     /**
      * Get the uv export output, either from env var or by running the command.
@@ -36,7 +81,7 @@ export default class Python_uv extends Base_pyproject {
             return Buffer.from(process.env['TRUSTIFY_DA_UV_EXPORT'], 'base64').toString('ascii');
         }
         let uvBin = getCustomPath('uv', opts);
-        return invokeCommand(uvBin, ['export', '--format', 'requirements.txt', '--frozen', '--no-hashes'], { cwd: manifestDir }).toString();
+        return invokeCommand(uvBin, ['export', '--format', 'requirements.txt', '--frozen', '--no-hashes', '--no-dev', '--no-emit-project'], { cwd: manifestDir }).toString();
     }
     /**
      * Parse uv export output into a dependency graph using tree-sitter-requirements
@@ -70,6 +115,9 @@ export default class Python_uv extends Base_pyproject {
                         let version = memberParsed.project?.version || memberParsed.tool?.poetry?.version;
                         if (name && version) {
                             let key = this._canonicalize(name);
+                            if (key === canonProjectName) {
+                                continue;
+                            }
                             currentPkg = { name, version, parents: new Set() };
                             packages.set(key, currentPkg);
                             collectingVia = false;
@@ -86,6 +134,16 @@ export default class Python_uv extends Base_pyproject {
                 if (!nameNode) {
                     continue;
                 }
+                // Skip packages with non-matching PEP 508 markers, e.g. "pywin32==311 ; sys_platform == 'win32'"
+                let markerNode = child.children.find(c => c.type === 'marker_spec');
+                if (markerNode) {
+                    let markerText = markerNode.text.replace(/^\s*;\s*/, '');
+                    if (!evaluateMarker(markerText)) {
+                        currentPkg = null;
+                        collectingVia = false;
+                        continue;
+                    }
+                }
                 let name = nameNode.text;
                 let version = null;
                 let versionMatches = pinnedVersionQuery.matches(child);
@@ -144,3 +202,68 @@ export default class Python_uv extends Base_pyproject {
         return { directDeps, graph };
     }
 }
+const DEFAULT_UV_DISCOVERY_IGNORE = [
+    '**/__pycache__/**',
+    '**/.venv/**',
+];
+/**
+ * Discover all pyproject.toml manifest paths in a uv workspace.
+ * Parses `[tool.uv.workspace]` from root pyproject.toml and glob-expands member patterns.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain pyproject.toml and uv.lock)
+ * @param {{ workspaceDiscoveryIgnore?: string[], TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string, [key: string]: unknown }} [opts={}]
+ * @returns {Promise<string[]>} Paths to pyproject.toml files (absolute)
+ */
+export async function discoverUvWorkspaceMembers(workspaceRoot, opts = {}) {
+    const root = path.resolve(workspaceRoot);
+    const rootPyproject = path.join(root, 'pyproject.toml');
+    const uvLock = path.join(root, 'uv.lock');
+    if (!fs.existsSync(rootPyproject) || !fs.existsSync(uvLock)) {
+        return [];
+    }
+    let parsed;
+    try {
+        parsed = parseToml(fs.readFileSync(rootPyproject, 'utf-8'));
+    }
+    catch {
+        return [];
+    }
+    const workspaceConfig = parsed?.tool?.uv?.workspace;
+    if (!workspaceConfig) {
+        return [];
+    }
+    const memberPatterns = workspaceConfig.members;
+    if (!Array.isArray(memberPatterns) || memberPatterns.length === 0) {
+        return [];
+    }
+    const excludePatterns = Array.isArray(workspaceConfig.exclude) ? workspaceConfig.exclude : [];
+    const excludeGlobs = excludePatterns
+        .filter(p => typeof p === 'string' && p.trim())
+        .map(p => `${p.trim()}/pyproject.toml`);
+    const ignorePatterns = [...resolveWorkspaceDiscoveryIgnore(opts), ...DEFAULT_UV_DISCOVERY_IGNORE];
+    const globOpts = {
+        cwd: root,
+        absolute: true,
+        onlyFiles: true,
+        ignore: [...ignorePatterns, ...excludeGlobs],
+        followSymbolicLinks: false,
+    };
+    const patterns = toManifestGlobPatterns(memberPatterns.filter(p => typeof p === 'string'), 'pyproject.toml');
+    const manifestPaths = await fg(patterns, globOpts);
+    if (!manifestPaths.includes(rootPyproject) && hasProjectMetadata(parsed)) {
+        manifestPaths.unshift(rootPyproject);
+    }
+    return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+}
+/**
+ * @param {import('smol-toml').TomlTable} parsedPyProject
+ * @returns {boolean}
+ */
+function hasProjectMetadata(parsedPyProject) {
+    try {
+        return typeof parsedPyProject?.project?.name === 'string' && parsedPyProject.project.name.trim() !== '';
+    }
+    catch {
+        return false;
+    }
+}

package/dist/src/providers/rust_cargo.d.ts

@@ -4,9 +4,10 @@ declare namespace _default {
     export { provideComponent };
     export { provideStack };
     export { readLicenseFromManifest };
+    export function packageManagerName(): string;
 }
 export default _default;
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 /**
  * @param {string} manifestName - the subject manifest name-type
  * @returns {boolean} - return true if `Cargo.toml` is the manifest name-type
@@ -46,7 +47,10 @@ declare function provideStack(manifest: string, opts?: {}): Provided;
  * Read project license from Cargo.toml, with fallback to LICENSE file.
  * Supports the `license` field under `[package]` (single crate / workspace
  * with root) and under `[workspace.package]` (virtual workspaces).
+ * When a member crate uses `license = { workspace = true }`, the actual
+ * license is resolved from the workspace root Cargo.toml.
  * @param {string} manifestPath - path to Cargo.toml
+ * @param {object} [metadata] - cargo metadata output (needed for workspace license resolution)
  * @returns {string|null} SPDX identifier or null
  */
-declare function readLicenseFromManifest(manifestPath: string): string | null;
+declare function readLicenseFromManifest(manifestPath: string, metadata?: object): string | null;

package/dist/src/providers/rust_cargo.js

@@ -5,7 +5,7 @@ import { parse as parseToml } from 'smol-toml';
 import { getLicense } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
 import { getCustom, getCustomPath, invokeCommand } from '../tools.js';
-export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest };
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'cargo'; } };
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /**
@@ -71,15 +71,22 @@ function isSupported(manifestName) {
  * Read project license from Cargo.toml, with fallback to LICENSE file.
  * Supports the `license` field under `[package]` (single crate / workspace
  * with root) and under `[workspace.package]` (virtual workspaces).
+ * When a member crate uses `license = { workspace = true }`, the actual
+ * license is resolved from the workspace root Cargo.toml.
  * @param {string} manifestPath - path to Cargo.toml
+ * @param {object} [metadata] - cargo metadata output (needed for workspace license resolution)
  * @returns {string|null} SPDX identifier or null
  */
-function readLicenseFromManifest(manifestPath) {
+function readLicenseFromManifest(manifestPath, metadata) {
     let fromManifest = null;
     try {
         let content = fs.readFileSync(manifestPath, 'utf-8');
         let parsed = parseToml(content);
-        fromManifest = parsed.package?.license
+        let packageLicense = parsed.package?.license;
+        if (typeof packageLicense === 'object' && packageLicense?.workspace === true) {
+            packageLicense = resolveWorkspaceLicense(parsed, metadata);
+        }
+        fromManifest = packageLicense
             || parsed.workspace?.package?.license
             || null;
     }
@@ -88,6 +95,26 @@ function readLicenseFromManifest(manifestPath) {
     }
     return getLicense(fromManifest, manifestPath);
 }
+/**
+ * Resolve a workspace-inherited license from the workspace root Cargo.toml.
+ * @param {object} parsed - the parsed member crate Cargo.toml
+ * @param {object} [metadata] - cargo metadata output with workspace_root
+ * @returns {string|null} resolved license string or null
+ */
+function resolveWorkspaceLicense(parsed, metadata) {
+    if (metadata?.workspace_root) {
+        let cargoTomlPath = path.join(metadata.workspace_root, 'Cargo.toml');
+        try {
+            let content = fs.readFileSync(cargoTomlPath, 'utf-8');
+            let workspaceParsed = parseToml(content);
+            return workspaceParsed.workspace?.package?.license || null;
+        }
+        catch (_) {
+            // fall through
+        }
+    }
+    return parsed.workspace?.package?.license || null;
+}
 /**
  * Validates that Cargo.lock exists in the manifest directory or in a parent
  * workspace root directory.  In Cargo workspaces the lock file always lives at
@@ -173,7 +200,7 @@ function getSBOM(manifest, opts = {}, includeTransitive) {
     let metadata = executeCargoMetadata(cargoBin, manifestDir);
     let ignoredDeps = getIgnoredDeps(manifest, metadata);
     let crateType = detectCrateType(metadata);
-    let license = readLicenseFromManifest(manifest);
+    let license = readLicenseFromManifest(manifest, metadata);
     let sbom;
     if (crateType === CrateType.WORKSPACE_VIRTUAL) {
         sbom = handleVirtualWorkspace(manifest, metadata, ignoredDeps, includeTransitive, opts, license);

package/dist/src/sbom.d.ts

@@ -25,9 +25,14 @@ export default class Sbom {
     /**
      * @param {component} sourceRef current source Component ( Starting from root component by clients)
      * @param {PackageURL} targetRef current dependency to add to Dependencies list of component sourceRef
+     * @param {string} [scope] - Scope of the dependency
+     * @param {Array<{alg: string, content: string}>} [targetHashes] - Optional hashes for the target component
      * @return Sbom
      */
-    addDependency(sourceRef: component, targetRef: PackageURL, scope: any): CycloneDxSbom;
+    addDependency(sourceRef: component, targetRef: PackageURL, scope?: string, targetHashes?: Array<{
+        alg: string;
+        content: string;
+    }>): CycloneDxSbom;
     /**
      * @return String sbom json in a string format
      */
@@ -45,6 +50,7 @@ export default class Sbom {
         version: any;
         scope: any;
         licenses?: any;
+        hashes?: any;
     };
     /** This method gets a component object, and a string name, and checks if the name is a substring of the component' purl.
      * @param {} component to search in its dependencies