@trustify-da/trustify-da-javascript-client 0.3.0-ea.de62188 → 0.3.0-ea.e258fba

package/README.md

@@ -103,14 +103,17 @@ Use as CLI Script
 ```shell
 $ npx @trustify-da/trustify-da-javascript-client help
 
-Usage: trustify-da-javascript-client {component|stack|image|validate-token|license}
+Usage: trustify-da-javascript-client {component|stack|stack-batch|image|validate-token|license|sbom|remediate}
 
 Commands:
   trustify-da-javascript-client stack </path/to/manifest> [--workspace-dir <path>] [--html|--summary]               produce stack report for manifest path
   trustify-da-javascript-client stack-batch </path/to/workspace-root> [--html|--summary]   produce stack report for all packages/crates in workspace
   trustify-da-javascript-client component <path/to/manifest> [--workspace-dir <path>]   produce component report for a manifest type and content
   trustify-da-javascript-client image <image-refs..> [--html|--summary]               produce image analysis report for OCI image references
+  trustify-da-javascript-client validate-token <token-provider> [--token-value <value>]   validate input token if authentic and authorized
   trustify-da-javascript-client license </path/to/manifest>               display project license information from manifest and LICENSE file in JSON format
+  trustify-da-javascript-client sbom </path/to/manifest> [--output <file>]               generate a CycloneDX SBOM from a manifest file
+  trustify-da-javascript-client remediate <path> [--dry-run] [--providers <list>] [--sources <list>] [--group-by <strategy>]   scan and apply vulnerability remediations
 
 Options:
   --help  Show help                                                    [boolean]
@@ -160,6 +163,27 @@ $ npx @trustify-da/trustify-da-javascript-client image httpd:2.4.49^^amd64
 
 # get project license information
 $ npx @trustify-da/trustify-da-javascript-client license /path/to/package.json
+
+# generate a CycloneDX SBOM from a manifest file
+$ npx @trustify-da/trustify-da-javascript-client sbom /path/to/pom.xml
+
+# generate SBOM and write to a file
+$ npx @trustify-da/trustify-da-javascript-client sbom /path/to/pom.xml --output sbom.json
+
+# scan a manifest and apply vulnerability remediations
+$ npx @trustify-da/trustify-da-javascript-client remediate /path/to/pom.xml
+
+# preview remediations without modifying files
+$ npx @trustify-da/trustify-da-javascript-client remediate /path/to/pom.xml --dry-run
+
+# scan a directory for all supported manifests
+$ npx @trustify-da/trustify-da-javascript-client remediate /path/to/project/
+
+# filter by vulnerability providers (order determines priority)
+$ npx @trustify-da/trustify-da-javascript-client remediate /path/to/pom.xml --providers provider1,provider2
+
+# group report output by bundle instead of per-dependency
+$ npx @trustify-da/trustify-da-javascript-client remediate /path/to/pom.xml --dry-run --group-by bundle
 ```
 </li>
 
@@ -213,6 +237,27 @@ $ trustify-da-javascript-client image httpd:2.4.49^^amd64
 
 # get project license information
 $ trustify-da-javascript-client license /path/to/package.json
+
+# generate a CycloneDX SBOM from a manifest file
+$ trustify-da-javascript-client sbom /path/to/pom.xml
+
+# generate SBOM and write to a file
+$ trustify-da-javascript-client sbom /path/to/pom.xml --output sbom.json
+
+# scan a manifest and apply vulnerability remediations
+$ trustify-da-javascript-client remediate /path/to/pom.xml
+
+# preview remediations without modifying files
+$ trustify-da-javascript-client remediate /path/to/pom.xml --dry-run
+
+# scan a directory for all supported manifests
+$ trustify-da-javascript-client remediate /path/to/project/
+
+# filter by vulnerability providers (order determines priority)
+$ trustify-da-javascript-client remediate /path/to/pom.xml --providers provider1,provider2
+
+# group report output by bundle instead of per-dependency
+$ trustify-da-javascript-client remediate /path/to/pom.xml --dry-run --group-by bundle
 ```
 </li>
 </ul>
@@ -688,7 +733,7 @@ This increasing the chances and the probability that the automatic installation
 ###### Usage
 A New setting is introduced - `TRUSTIFY_DA_PYTHON_INSTALL_BEST_EFFORTS` (as both env variable/key in `options` object)
 1. `TRUSTIFY_DA_PYTHON_INSTALL_BEST_EFFORTS`="false" - install requirements.txt while respecting declared versions for all packages.
-2. `TRUSTIFY_DA_PYTHON_INSTALL_BEST_EFFORTS`="true" - install all packages from requirements.txt, not respecting the declared version, but trying to install a version tailored for the used python version. When using this setting, you must set setting `MATCH_MANIFEST_VERSIONS` to 'false'.
+2. `TRUSTIFY_DA_PYTHON_INSTALL_BEST_EFFORTS`="true" - install all packages from requirements.txt, not respecting the declared version, but trying to install a version tailored for the used python version. When using this setting, you must set `TRUSTIFY_DA_PYTHON_VIRTUAL_ENV` to 'true' and `MATCH_MANIFEST_VERSIONS` to 'false'.
 
 ##### Using `pipdeptree`
 By default, The API algorithm will use native commands of PIP installer as data source to build the dependency tree.
@@ -705,6 +750,135 @@ For some ecosystems we support passing additional CLI arguments to the underlyin
 |Maven    |TRUSTIFY_DA_MVN_ARGS|
 
 
+<h3>Remediation</h3>
+<p>
+The <code>remediate</code> command scans manifest files for known vulnerabilities and applies version upgrades to resolve them. By default, it modifies manifest files in place. Use <code>--dry-run</code> to preview changes without modifying any files.
+</p>
+
+<h4>Supported Manifest Formats</h4>
+<ul>
+<li><strong>Maven</strong> — <code>pom.xml</code> (single-module projects; updates dependency version elements and resolves property references)</li>
+<li><strong>Gradle Version Catalog</strong> — <code>libs.versions.toml</code> or any <code>*.versions.toml</code> file (updates centralized version references and inline version declarations)</li>
+</ul>
+
+<h4>CLI Flags</h4>
+<table>
+<tr>
+<th>Flag</th>
+<th>Alias</th>
+<th>Type</th>
+<th>Default</th>
+<th>Description</th>
+</tr>
+<tr>
+<td><code>&lt;path&gt;</code></td>
+<td>—</td>
+<td>string (positional)</td>
+<td><em>required</em></td>
+<td>Path to a manifest file or directory to scan recursively</td>
+</tr>
+<tr>
+<td><code>--dry-run</code></td>
+<td><code>-d</code></td>
+<td>boolean</td>
+<td><code>false</code></td>
+<td>Preview changes without modifying files</td>
+</tr>
+<tr>
+<td><code>--providers</code></td>
+<td>—</td>
+<td>string</td>
+<td>—</td>
+<td>Comma-separated list of vulnerability providers (env: <code>TRUSTIFY_DA_PROVIDERS</code>)</td>
+</tr>
+<tr>
+<td><code>--sources</code></td>
+<td>—</td>
+<td>string</td>
+<td>—</td>
+<td>Comma-separated list of vulnerability sources (env: <code>TRUSTIFY_DA_SOURCES</code>)</td>
+</tr>
+<tr>
+<td><code>--group-by</code></td>
+<td>—</td>
+<td>string</td>
+<td><code>dependency</code></td>
+<td>Report grouping strategy (<code>dependency</code> or <code>bundle</code>)</td>
+</tr>
+</table>
+
+<h4>Provider Priority Resolution</h4>
+<p>
+When multiple vulnerability providers suggest different remediation versions for the same dependency, the <code>--providers</code> flag determines priority. Providers listed first have the highest priority.
+</p>
+<ul>
+<li>The provider ordering in <code>--providers</code> determines rank (first = highest priority).</li>
+<li>Trustify vendor trusted packages always take precedence over non-trusted content at equal provider rank.</li>
+<li>Two version selection strategies are used internally:
+  <ul>
+  <li><strong>Closest coverage</strong> (default) — prefers the remediation version closest to the current version within the same major version.</li>
+  <li><strong>Highest</strong> — always selects the highest available remediation version.</li>
+  </ul>
+</li>
+</ul>
+
+<h4>Exit Codes</h4>
+<ul>
+<li><code>0</code> — no remediations needed, or remediations applied successfully</li>
+<li><code>1</code> — error during execution</li>
+<li><code>2</code> — remediations available (only returned in <code>--dry-run</code> mode when changes would be made; never returned when changes are applied)</li>
+</ul>
+
+<h4>Known Limitations</h4>
+<ul>
+<li>Gradle DSL files (<code>build.gradle</code>, <code>build.gradle.kts</code>) are not supported — only version catalog files (<code>*.versions.toml</code>).</li>
+<li>Multi-module Maven projects with inherited dependency versions from parent POMs are not supported — only versions declared directly in the scanned <code>pom.xml</code> are updated.</li>
+</ul>
+
+<h4>Example: GitHub Action Workflow</h4>
+<p>
+The following workflow runs a scheduled remediation scan using the container image and opens a pull request with any version updates. Save this as <code>.github/workflows/trustify-da-remediation.yml</code> in your repository:
+</p>
+
+```yaml
+name: Trustify DA Remediation Scan
+
+on:
+  schedule:
+    # Run weekly on Monday at 08:00 UTC
+    - cron: '0 8 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  remediate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run remediation scan
+        uses: docker://ghcr.io/guacsec/trustify-da-javascript-client:latest
+        env:
+          TRUSTIFY_DA_BACKEND_URL: ${{ secrets.TRUSTIFY_DA_BACKEND_URL }}
+        with:
+          entrypoint: trustify-da-javascript-client
+          args: remediate . --providers provider1,provider2
+
+      - name: Create pull request
+        uses: peter-evans/create-pull-request@v7
+        with:
+          title: 'fix(deps): apply Trustify DA vulnerability remediations'
+          body: |
+            Automated dependency version updates from Trustify Dependency Analytics.
+
+            This PR was generated by a scheduled remediation scan.
+          branch: trustify-da-remediation
+          commit-message: 'fix(deps): apply Trustify DA vulnerability remediations'
+```
+
 <!-- Badge links -->
 [0]: https://img.shields.io/github/v/release/guacsec/trustify-da-javascript-client?color=green&label=latest
 [1]: https://img.shields.io/github/v/release/guacsec/trustify-da-javascript-client?color=yellow&include_prereleases&label=early-access

package/dist/package.json

@@ -25,7 +25,9 @@
         "provenance": true
     },
     "type": "module",
-    "bin": "dist/src/cli.js",
+    "bin": {
+        "trustify-da": "dist/src/cli.js"
+    },
     "main": "dist/src/index.js",
     "module": "dist/src/index.js",
     "types": "dist/src/index.d.ts",
@@ -48,7 +50,7 @@
     },
     "dependencies": {
         "@babel/core": "^7.23.2",
-        "@cyclonedx/cyclonedx-library": "^10.0.0",
+        "@yarnpkg/parsers": "^3.1.0",
         "eslint-import-resolver-typescript": "^4.4.4",
         "fast-glob": "^3.3.3",
         "fast-xml-parser": "^5.3.4",
@@ -69,10 +71,12 @@
     },
     "devDependencies": {
         "@babel/core": "^7.23.2",
+        "@cyclonedx/cyclonedx-library": "^10.2.0",
         "@eslint/js": "^10.0.0",
         "@trustify-da/trustify-da-api-model": "^2.0.12",
         "@types/node": "^25.9.1",
         "@types/which": "^3.0.4",
+        "ajv": "^8.20.0",
         "babel-plugin-rewire": "^1.2.0",
         "c8": "^11.0.0",
         "chai": "^6.2.2",

package/dist/src/cli.js

@@ -4,6 +4,7 @@ import * as path from "path";
 import yargs from 'yargs';
 import { hideBin } from 'yargs/helpers';
 import { getProjectLicense, getLicenseDetails } from './license/index.js';
+import { runRemediation } from './remediate.js';
 import client, { selectTrustifyDABackend, generateSbom } from './index.js';
 // command for component analysis take manifest type and content
 const component = {
@@ -430,9 +431,54 @@ const sbom = {
         }
     }
 };
+const remediate = {
+    command: 'remediate <path>',
+    desc: 'Scan and apply vulnerability remediations to manifest files',
+    builder: yargs => yargs.positional('path', {
+        desc: 'Path to manifest file or directory',
+        type: 'string',
+        normalize: true,
+    }).options({
+        'dry-run': {
+            alias: 'd',
+            type: 'boolean',
+            desc: 'Preview changes without modifying files',
+        },
+        providers: {
+            desc: 'Comma-separated list of vulnerability providers (env: TRUSTIFY_DA_PROVIDERS)',
+            type: 'string',
+        },
+        sources: {
+            desc: 'Comma-separated list of vulnerability sources (env: TRUSTIFY_DA_SOURCES)',
+            type: 'string',
+        },
+        'group-by': {
+            type: 'string',
+            choices: ['dependency', 'bundle'],
+            default: 'dependency',
+            desc: 'Report grouping strategy',
+        },
+    }),
+    handler: async (args) => {
+        try {
+            const result = await runRemediation(args.path, {
+                dryRun: args['dry-run'],
+                providers: args.providers,
+                sources: args.sources,
+                groupBy: args['group-by'],
+            });
+            console.log(result.output);
+            process.exit(result.exitCode);
+        }
+        catch (err) {
+            console.error(err.message);
+            process.exit(1);
+        }
+    }
+};
 // parse and invoke the command
 yargs(hideBin(process.argv))
-    .usage(`Usage: ${process.argv[0].includes("node") ? path.parse(process.argv[1]).base : path.parse(process.argv[0]).base} {component|stack|stack-batch|image|validate-token|license|sbom}`)
+    .usage(`Usage: ${process.argv[0].includes("node") ? path.parse(process.argv[1]).base : path.parse(process.argv[0]).base} {component|stack|stack-batch|image|validate-token|license|sbom|remediate}`)
     .command(stack)
     .command(stackBatch)
     .command(component)
@@ -440,6 +486,7 @@ yargs(hideBin(process.argv))
     .command(validateToken)
     .command(license)
     .command(sbom)
+    .command(remediate)
     .scriptName('')
     .version(false)
     .demandCommand(1)

package/dist/src/cyclone_dx_sbom.d.ts

@@ -26,6 +26,19 @@ export default class CycloneDxSbom {
         alg: string;
         content: string;
     }>): CycloneDxSbom;
+    /**
+     * Attach hashes to already-added components by matching their PURL. This is a
+     * post-processing step so ecosystem-specific hash sources (e.g. Maven reading
+     * the local .m2 cache) can enrich the SBOM without threading their concern
+     * through the shared dependency-tree parser. Components without a matching
+     * entry, or whose hashes are already set, are left untouched.
+     * @param {Map<string, Array<{alg: string, content: string}>>} hashMap - PURL→hashes map
+     * @return {CycloneDxSbom} the updated SBOM
+     */
+    attachHashes(hashMap: Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>): CycloneDxSbom;
     /** @param {{}} opts - various options, settings and configuration of application.
      * @return String CycloneDx Sbom json object in a string format
      */

package/dist/src/cyclone_dx_sbom.js

@@ -1,5 +1,12 @@
 import { EOL } from "os";
 import { PackageURL } from "packageurl-js";
+import { getPackageVersion } from "./package_version.js";
+/**
+ * This client's version, read once at module load, used to populate
+ * metadata.tools.components[].version in the generated SBOM.
+ * @type {string|undefined}
+ */
+const PACKAGE_VERSION = getPackageVersion();
 /**
  *
  * @param component {PackageURL}
@@ -135,6 +142,30 @@ export default class CycloneDxSbom {
         }
         return this;
     }
+    /**
+     * Attach hashes to already-added components by matching their PURL. This is a
+     * post-processing step so ecosystem-specific hash sources (e.g. Maven reading
+     * the local .m2 cache) can enrich the SBOM without threading their concern
+     * through the shared dependency-tree parser. Components without a matching
+     * entry, or whose hashes are already set, are left untouched.
+     * @param {Map<string, Array<{alg: string, content: string}>>} hashMap - PURL→hashes map
+     * @return {CycloneDxSbom} the updated SBOM
+     */
+    attachHashes(hashMap) {
+        if (!hashMap || hashMap.size === 0) {
+            return this;
+        }
+        for (const component of this.components) {
+            if (component.hashes) {
+                continue;
+            }
+            const hashes = hashMap.get(component.purl);
+            if (hashes && hashes.length > 0) {
+                component.hashes = hashes;
+            }
+        }
+        return this;
+    }
     /** @param {{}} opts - various options, settings and configuration of application.
      * @return String CycloneDx Sbom json object in a string format
      */
@@ -144,11 +175,18 @@ export default class CycloneDxSbom {
         const rootPurl = this.rootComponent?.purl;
         this.sbomObject = {
             "bomFormat": "CycloneDX",
-            "specVersion": "1.4",
+            "specVersion": "1.6",
             "version": 1,
             "metadata": {
                 "timestamp": new Date(),
                 "component": this.rootComponent,
+                "tools": {
+                    "components": [{
+                            "type": "application",
+                            "name": "trustify-da-javascript-client",
+                            "version": PACKAGE_VERSION
+                        }]
+                },
                 "properties": new Array()
             },
             "components": this.components.filter(c => c.purl !== rootPurl),

package/dist/src/index.d.ts

@@ -24,6 +24,7 @@ export function selectTrustifyDABackend(opts?: {
 export function generateSbom(manifestPath: string, opts?: Options): Promise<object>;
 export { parseImageRef } from "./oci_image/utils.js";
 export { ImageRef } from "./oci_image/images.js";
+export { extractRemediations } from "./remediation.js";
 declare namespace _default {
     export { componentAnalysis };
     export { stackAnalysis };
@@ -266,3 +267,4 @@ import { resolveContinueOnError } from './batch_opts.js';
 import { resolveBatchMetadata } from './batch_opts.js';
 export { discoverMavenModules, discoverGradleSubprojects, discoverGoWorkspaceModules, discoverUvWorkspaceMembers, discoverWorkspacePackages, discoverWorkspaceCrates, validatePackageJson, resolveWorkspaceDiscoveryIgnore, filterManifestPathsByDiscoveryIgnore, resolveContinueOnError, resolveBatchMetadata };
 export { getProjectLicense, findLicenseFilePath, identifyLicense, getLicenseDetails, licensesFromReport, normalizeLicensesResponse, runLicenseCheck, getCompatibility } from "./license/index.js";
+export { generateReport, generateDeduplicationKey } from "./remediation_report.js";

package/dist/src/index.js

@@ -1,21 +1,22 @@
+import fs from 'node:fs';
 import path from "node:path";
 import { EOL } from "os";
 import pLimit from 'p-limit';
-import { availableProviders, match } from './provider.js';
 import analysis from './analysis.js';
-import fs from 'node:fs';
-import { getCustom } from "./tools.js";
 import { resolveBatchMetadata, resolveContinueOnError } from './batch_opts.js';
-import { discoverMavenModules } from './providers/java_maven.js';
-import { discoverGradleSubprojects } from './providers/java_gradle.js';
+import { getPackageVersion } from './package_version.js';
+import { availableProviders, match } from './provider.js';
 import { discoverGoWorkspaceModules } from './providers/golang_gomodules.js';
+import { discoverGradleSubprojects } from './providers/java_gradle.js';
+import { discoverMavenModules } from './providers/java_maven.js';
 import { discoverUvWorkspaceMembers } from './providers/python_uv.js';
+import { getCustom } from "./tools.js";
 import { discoverWorkspaceCrates, discoverWorkspacePackages, filterManifestPathsByDiscoveryIgnore, resolveWorkspaceDiscoveryIgnore, validatePackageJson, } from './workspace.js';
-import.meta.dirname;
-import * as url from 'url';
 export { parseImageRef } from "./oci_image/utils.js";
 export { ImageRef } from "./oci_image/images.js";
 export { getProjectLicense, findLicenseFilePath, identifyLicense, getLicenseDetails, licensesFromReport, normalizeLicensesResponse, runLicenseCheck, getCompatibility } from "./license/index.js";
+export { extractRemediations } from "./remediation.js";
+export { generateReport, generateDeduplicationKey } from './remediation_report.js';
 export default { componentAnalysis, stackAnalysis, stackAnalysisBatch, imageAnalysis, validateToken, generateSbom };
 export { discoverMavenModules, discoverGradleSubprojects, discoverGoWorkspaceModules, discoverUvWorkspaceMembers, discoverWorkspacePackages, discoverWorkspaceCrates, validatePackageJson, resolveWorkspaceDiscoveryIgnore, filterManifestPathsByDiscoveryIgnore, resolveContinueOnError, resolveBatchMetadata, };
 /**
@@ -93,23 +94,7 @@ function logOptionsAndEnvironmentsVariables(alongsideText, valueToBePrinted) {
  * @private
  */
 function readAndPrintVersionFromPackageJson() {
-    let dirName;
-    // new ESM way in nodeJS ( since node version 22 ) to bring module directory.
-    dirName = import.meta.dirname;
-    // old ESM way in nodeJS ( before node versions 22.00 to bring module directory)
-    if (!dirName) {
-        dirName = url.fileURLToPath(new URL('.', import.meta.url));
-    }
-    try {
-        if (__dirname) {
-            dirName = __dirname;
-        }
-    }
-    catch (e) {
-        console.log("__dirname is not defined, continue with fileUrlPath");
-    }
-    let packageJson = JSON.parse(fs.readFileSync(path.join(dirName, "..", "package.json")).toString());
-    logOptionsAndEnvironmentsVariables("trustify-da-javascript-client analysis started, version: ", packageJson.version);
+    logOptionsAndEnvironmentsVariables("trustify-da-javascript-client analysis started, version: ", getPackageVersion());
 }
 /**
  * This function is used to determine the Trustify DA backend URL.

package/dist/src/package_version.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Reads this package's version from package.json, resolving the path relative
+ * to this module. Works under ESM (node >= 22 import.meta.dirname, older via
+ * import.meta.url) and CommonJS (__dirname). Returns undefined if the file
+ * cannot be read, so callers never fail on a missing version.
+ * @return {string|undefined} the package version, or undefined
+ */
+export function getPackageVersion(): string | undefined;

package/dist/src/package_version.js

@@ -0,0 +1,31 @@
+import fs from "node:fs";
+import path from "node:path";
+import * as url from "url";
+/**
+ * Reads this package's version from package.json, resolving the path relative
+ * to this module. Works under ESM (node >= 22 import.meta.dirname, older via
+ * import.meta.url) and CommonJS (__dirname). Returns undefined if the file
+ * cannot be read, so callers never fail on a missing version.
+ * @return {string|undefined} the package version, or undefined
+ */
+export function getPackageVersion() {
+    try {
+        let dirName = import.meta.dirname;
+        if (!dirName) {
+            dirName = url.fileURLToPath(new URL('.', import.meta.url));
+        }
+        try {
+            if (__dirname) {
+                dirName = __dirname;
+            }
+        }
+        catch {
+            // __dirname not defined under ESM, continue with fileURLToPath
+        }
+        const packageJson = JSON.parse(fs.readFileSync(path.join(dirName, "..", "package.json")).toString());
+        return packageJson.version;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/src/providers/base_java.d.ts

@@ -10,6 +10,13 @@ export type ecosystem_maven = any;
 export const ecosystem_maven: string;
 export const ecosystem_gradle: "gradle";
 export default class Base_Java {
+    /**
+     * Maven dependency scopes. Used to detect whether the trailing column of a
+     * dependency-tree line is a scope keyword — which in turn signals that an
+     * optional classifier column is present between the packaging and version.
+     * @type {string[]}
+     */
+    static MAVEN_SCOPES: string[];
     /**
      *
      * @param {string} globalBinary name of the global binary
@@ -40,6 +47,52 @@ export default class Base_Java {
      * @protected
      */
     protected _getDepth(line: string): number;
+    /**
+     * Parse a single dependency-tree line into its Maven coordinate parts.
+     *
+     * This is the single source of truth for interpreting a dependency-tree
+     * line. Both {@link parseDep} (used to build SBOM component PURLs) and the
+     * Maven hash-map builder rely on it, so the PURL key and the artifact file
+     * path can never drift from one another.
+     *
+     * A line has the shape `groupId:artifactId:packaging[:classifier]:version[:scope]`.
+     * The classifier column is only present when a sixth column holds a known
+     * Maven scope keyword; otherwise the fourth column is the version.
+     *
+     * @param {string} line - line to parse from a dependency tree
+     * @returns {{groupId: string, artifactId: string, packaging: string, classifier: (string|null), version: string, scope: (string|null), overridden: boolean}}
+     *   Parsed coordinate. `version` is the resolved concrete version — when the
+     *   line carries a conflict override the override version replaces it and
+     *   `overridden` is set, mirroring how Maven records the winning version.
+     */
+    parseCoordinate(line: string): {
+        groupId: string;
+        artifactId: string;
+        packaging: string;
+        classifier: (string | null);
+        version: string;
+        scope: (string | null);
+        overridden: boolean;
+    };
+    /**
+     * Build the canonical PackageURL for a parsed coordinate.
+     *
+     * The classifier is folded into the version component (e.g.
+     * `4.1.0-linux-x86_64`) except when the version came from a conflict
+     * override, in which case the override version stands alone — matching the
+     * historical behavior of {@link parseDep}.
+     *
+     * @param {{groupId: string, artifactId: string, classifier: (string|null), version: string, overridden: boolean}} coord
+     * @returns {PackageURL} The canonical packageURL for the coordinate
+     * @protected
+     */
+    protected _coordinateToPurl(coord: {
+        groupId: string;
+        artifactId: string;
+        classifier: (string | null);
+        version: string;
+        overridden: boolean;
+    }): PackageURL;
     /**
      * Create a PackageURL from any line in a Text Graph dependency tree for a manifest path.
      * @param {string} line - line to parse from a dependencies.txt file