@trustify-da/trustify-da-javascript-client 0.3.0-ea.e12bc82 → 0.3.0-ea.e348975

package/dist/src/providers/java_gradle.js

@@ -1,8 +1,13 @@
+import crypto from 'node:crypto';
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { EOL } from 'os';
-import TOML from 'fast-toml';
+import { parse as parseToml } from 'smol-toml';
+import { readLicenseFile } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
+import { invokeCommand } from '../tools.js';
+import { filterManifestPathsByDiscoveryIgnore, resolveWorkspaceDiscoveryIgnore } from '../workspace.js';
 import Base_java, { ecosystem_gradle } from "./base_java.js";
 /** @typedef {import('../provider.js').Provider} */
 /** @typedef {import('../provider.js').Provided} Provided */
@@ -49,6 +54,13 @@ export default class Java_gradle extends Base_java {
      * @param {string} manifestDir - the directory where the manifest lies
      */
     validateLockFile() { return true; }
+    /**
+     * Gradle manifests (build.gradle, build.gradle.kts) have no standard license field.
+     * @param {string} manifestPath - path to manifest
+     * @returns {null}
+     */
+    // eslint-disable-next-line no-unused-vars
+    readLicenseFromManifest(manifestPath) { return readLicenseFile(manifestPath); }
     /**
      * Provide content and content type for stack analysis.
      * @param {string} manifest - the manifest path or name
@@ -158,7 +170,8 @@ export default class Java_gradle extends Base_java {
         let sbom = new Sbom();
         let root = `${properties.group}:${properties[ROOT_PROJECT_KEY_NAME].match(/Root project '(.+)'/)[1]}:jar:${properties.version}`;
         let rootPurl = this.parseDep(root);
-        sbom.addRoot(rootPurl);
+        const license = this.readLicenseFromManifest(manifestPath);
+        sbom.addRoot(rootPurl, license);
         let ignoredDeps = this.#getIgnoredDeps(manifestPath);
         const [runtimeConfig, compileConfig] = this.#extractConfigurations(content);
         const processedDeps = new Set();
@@ -298,7 +311,8 @@ export default class Java_gradle extends Base_java {
         let sbom = new Sbom();
         let root = `${properties.group}:${properties[ROOT_PROJECT_KEY_NAME].match(/Root project '(.+)'/)[1]}:jar:${properties.version}`;
         let rootPurl = this.parseDep(root);
-        sbom.addRoot(rootPurl);
+        const license = this.readLicenseFromManifest(manifestPath);
+        sbom.addRoot(rootPurl, license);
         let ignoredDeps = this.#getIgnoredDeps(manifestPath);
         const [runtimeConfig, compileConfig] = this.#extractConfigurations(content);
         let directDependencies = new Map();
@@ -352,7 +366,7 @@ export default class Java_gradle extends Base_java {
         // Read and parse the TOML file
         let pathOfToml = path.join(path.dirname(manifestPath), "gradle", "libs.versions.toml");
         const tomlString = fs.readFileSync(pathOfToml).toString();
-        let tomlObject = TOML.parse(tomlString);
+        let tomlObject = parseToml(tomlString);
         let groupPlusArtifactObject = tomlObject.libraries[alias];
         let parts = groupPlusArtifactObject.module.split(":");
         let groupId = parts[0];
@@ -397,3 +411,113 @@ export default class Java_gradle extends Base_java {
         return undefined;
     }
 }
+const DEFAULT_GRADLE_DISCOVERY_IGNORE = [
+    '**/build/**',
+    '**/.gradle/**',
+];
+/** Gradle init script that emits structured project listing. */
+const GRADLE_INIT_SCRIPT = `allprojects {
+    task daListProjects {
+        doLast {
+            println "::DA_PROJECT::\${project.path}::\${project.projectDir}"
+        }
+    }
+}
+`;
+/**
+ * Discover all build.gradle[.kts] manifest paths in a Gradle multi-project build.
+ * Uses a custom init script to get structured project listing.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain settings.gradle[.kts])
+ * @param {import('../index.js').Options} [opts={}]
+ * @returns {Promise<string[]>} Paths to build.gradle[.kts] files (absolute)
+ */
+export async function discoverGradleSubprojects(workspaceRoot, opts = {}) {
+    const root = path.resolve(workspaceRoot);
+    const hasSettings = fs.existsSync(path.join(root, 'settings.gradle'))
+        || fs.existsSync(path.join(root, 'settings.gradle.kts'));
+    if (!hasSettings) {
+        return [];
+    }
+    const manifestPaths = [];
+    const rootBuildKts = path.join(root, 'build.gradle.kts');
+    const rootBuild = path.join(root, 'build.gradle');
+    const rootManifest = fs.existsSync(rootBuildKts) ? rootBuildKts : fs.existsSync(rootBuild) ? rootBuild : null;
+    if (rootManifest) {
+        manifestPaths.push(rootManifest);
+    }
+    let gradleBin;
+    try {
+        gradleBin = new Java_gradle().selectToolBinary(rootManifest || rootBuild, opts);
+    }
+    catch {
+        const ignorePatterns = [...resolveWorkspaceDiscoveryIgnore(opts), ...DEFAULT_GRADLE_DISCOVERY_IGNORE];
+        return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+    }
+    const initScriptPath = path.join(os.tmpdir(), `da-list-projects-${crypto.randomUUID()}.gradle`);
+    try {
+        fs.writeFileSync(initScriptPath, GRADLE_INIT_SCRIPT);
+        let output;
+        try {
+            output = invokeCommand(gradleBin, [
+                '-q', '--no-daemon',
+                '--init-script', initScriptPath,
+                'daListProjects',
+            ], { cwd: root });
+        }
+        catch {
+            const ignorePatterns = [...resolveWorkspaceDiscoveryIgnore(opts), ...DEFAULT_GRADLE_DISCOVERY_IGNORE];
+            return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+        }
+        const projects = parseGradleInitScriptOutput(output.toString());
+        for (const proj of projects) {
+            if (proj.path === ':') {
+                continue;
+            }
+            const projDir = path.resolve(proj.dir);
+            const buildKts = path.join(projDir, 'build.gradle.kts');
+            const buildGroovy = path.join(projDir, 'build.gradle');
+            if (fs.existsSync(buildKts)) {
+                manifestPaths.push(buildKts);
+            }
+            else if (fs.existsSync(buildGroovy)) {
+                manifestPaths.push(buildGroovy);
+            }
+        }
+    }
+    finally {
+        try {
+            fs.unlinkSync(initScriptPath);
+        }
+        catch { /* ignore */ }
+    }
+    const ignorePatterns = [...resolveWorkspaceDiscoveryIgnore(opts), ...DEFAULT_GRADLE_DISCOVERY_IGNORE];
+    return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+}
+/**
+ * Parse the structured output from the Gradle init script.
+ *
+ * @param {string} raw - Raw stdout from gradle
+ * @returns {{ path: string, dir: string }[]}
+ */
+export function parseGradleInitScriptOutput(raw) {
+    const projects = [];
+    for (const rawLine of raw.split('\n')) {
+        const line = rawLine.trimEnd();
+        if (!line.startsWith('::DA_PROJECT::')) {
+            continue;
+        }
+        const prefix = '::DA_PROJECT::';
+        const remainder = line.substring(prefix.length);
+        const lastSep = remainder.lastIndexOf('::');
+        if (lastSep < 0) {
+            continue;
+        }
+        const projPath = remainder.substring(0, lastSep);
+        const dir = remainder.substring(lastSep + 2);
+        if (projPath && dir) {
+            projects.push({ path: projPath, dir });
+        }
+    }
+    return projects;
+}

package/dist/src/providers/java_gradle_groovy.d.ts

@@ -3,5 +3,5 @@ export default class Java_gradle_groovy extends Java_gradle {
     _parseAliasForLibsNotation(alias: any): any;
     _extractDepToBeIgnored(dep: any): any;
 }
-export type Provided = import('../provider').Provided;
+export type Provided = any;
 import Java_gradle from './java_gradle.js';

package/dist/src/providers/java_gradle_kotlin.d.ts

@@ -7,5 +7,5 @@ export default class Java_gradle_kotlin extends Java_gradle {
     _parseAliasForLibsNotation(alias: any): any;
     _extractDepToBeIgnored(dep: any): string | null;
 }
-export type Provided = import('../provider').Provided;
+export type Provided = any;
 import Java_gradle from './java_gradle.js';

package/dist/src/providers/java_maven.d.ts

@@ -1,3 +1,11 @@
+/**
+ * Discover all pom.xml manifest paths in a Maven multi-module project.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain pom.xml)
+ * @param {object} [opts={}]
+ * @returns {Promise<string[]>} Paths to pom.xml files (absolute)
+ */
+export function discoverMavenModules(workspaceRoot: string, opts?: object): Promise<string[]>;
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /** @typedef {{name: string, version: string}} Package */
@@ -19,25 +27,32 @@ export default class Java_maven extends Base_java {
      * @param {{}} [opts={}] - optional various options to pass along the application
      * @returns {Provided}
      */
-    provideStack(manifest: string, opts?: {} | undefined): Provided;
+    provideStack(manifest: string, opts?: {}): Provided;
     /**
      * Provide content and content type for maven-maven component analysis.
      * @param {string} manifest - path to the manifest file
      * @param {{}} [opts={}] - optional various options to pass along the application
      * @returns {Provided}
      */
-    provideComponent(manifest: string, opts?: {} | undefined): Provided;
+    provideComponent(manifest: string, opts?: {}): Provided;
+    /**
+     * Read license from pom.xml manifest, with fallback to LICENSE file
+     * @param {string} manifestPath - path to pom.xml
+     * @returns {string|null}
+     */
+    readLicenseFromManifest(manifestPath: string): string | null;
     /**
      *
      * @param {String} textGraphList Text graph String of the manifest
      * @param {[String]} ignoredDeps List of ignored dependencies to be omitted from sbom
+     * @param {String} manifestPath Path to the pom.xml manifest
      * @return {String} formatted sbom Json String with all dependencies
      */
-    createSbomFileFromTextFormat(textGraphList: string, ignoredDeps: [string], opts: any): string;
+    createSbomFileFromTextFormat(textGraphList: string, ignoredDeps: [string], opts: any, manifestPath: string): string;
     #private;
 }
-export type Java_maven = import('../provider').Provider;
-export type Provided = import('../provider').Provided;
+export type Java_maven = any;
+export type Provided = any;
 export type Package = {
     name: string;
     version: string;

package/dist/src/providers/java_maven.js

@@ -3,8 +3,10 @@ import os from 'node:os';
 import path from 'node:path';
 import { EOL } from 'os';
 import { XMLParser } from 'fast-xml-parser';
+import { getLicense } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
-import { getCustom } from '../tools.js';
+import { getCustom, invokeCommand } from '../tools.js';
+import { filterManifestPathsByDiscoveryIgnore, resolveWorkspaceDiscoveryIgnore } from '../workspace.js';
 import Base_java, { ecosystem_maven } from "./base_java.js";
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
@@ -51,6 +53,30 @@ export default class Java_maven extends Base_java {
             contentType: 'application/vnd.cyclonedx+json'
         };
     }
+    /**
+     * Read license from pom.xml manifest, with fallback to LICENSE file
+     * @param {string} manifestPath - path to pom.xml
+     * @returns {string|null}
+     */
+    readLicenseFromManifest(manifestPath) {
+        let fromPom = null;
+        try {
+            const xml = fs.readFileSync(manifestPath, 'utf-8');
+            const parser = new XMLParser({ ignoreAttributes: false });
+            const obj = parser.parse(xml);
+            const project = obj?.project;
+            if (project?.licenses?.license) {
+                const license = Array.isArray(project.licenses.license)
+                    ? project.licenses.license[0]
+                    : project.licenses.license;
+                fromPom = (license?.name && license.name.trim()) || null;
+            }
+        }
+        catch {
+            // leave fromPom as null
+        }
+        return getLicense(fromPom, manifestPath);
+    }
     /**
      * Create a Dot Graph dependency tree for a manifest path.
      * @param {string} manifest - path for pom.xml
@@ -105,7 +131,7 @@ export default class Java_maven extends Base_java {
         if (process.env["TRUSTIFY_DA_DEBUG"] === "true") {
             console.error("Dependency tree that will be used as input for creating the BOM =>" + EOL + EOL + content.toString());
         }
-        let sbom = this.createSbomFileFromTextFormat(content.toString(), ignoredDeps, opts);
+        let sbom = this.createSbomFileFromTextFormat(content.toString(), ignoredDeps, opts, manifest);
         // delete temp file and directory
         fs.rmSync(tmpDir, { recursive: true, force: true });
         // return dependency graph as string
@@ -115,15 +141,17 @@ export default class Java_maven extends Base_java {
      *
      * @param {String} textGraphList Text graph String of the manifest
      * @param {[String]} ignoredDeps List of ignored dependencies to be omitted from sbom
+     * @param {String} manifestPath Path to the pom.xml manifest
      * @return {String} formatted sbom Json String with all dependencies
      */
-    createSbomFileFromTextFormat(textGraphList, ignoredDeps, opts) {
+    createSbomFileFromTextFormat(textGraphList, ignoredDeps, opts, manifestPath) {
         let lines = textGraphList.split(EOL);
         // get root component
         let root = lines[0];
         let rootPurl = this.parseDep(root);
+        const license = this.readLicenseFromManifest(manifestPath);
         let sbom = new Sbom();
-        sbom.addRoot(rootPurl);
+        sbom.addRoot(rootPurl, license);
         this.parseDependencyTree(root, 0, lines.slice(1), sbom);
         return sbom.filterIgnoredDeps(ignoredDeps).getAsJsonString(opts);
     }
@@ -153,10 +181,12 @@ export default class Java_maven extends Base_java {
         /** @type [Dependency] */
         let dependencies = this.#getDependencies(tmpEffectivePom)
             .filter(d => !this.#dependencyIn(d, ignored));
+        dependencies = this.#resolveVersionRanges(dependencies, manifestPath, opts);
         let sbom = new Sbom();
         let rootDependency = this.#getRootFromPom(tmpEffectivePom, manifestPath);
         let purlRoot = this.toPurl(rootDependency.groupId, rootDependency.artifactId, rootDependency.version);
-        sbom.addRoot(purlRoot);
+        const license = this.readLicenseFromManifest(manifestPath);
+        sbom.addRoot(purlRoot, license);
         dependencies.forEach(dep => {
             let currentPurl = this.toPurl(dep.groupId, dep.artifactId, dep.version);
             sbom.addDependency(purlRoot, currentPurl);
@@ -209,7 +239,7 @@ export default class Java_maven extends Base_java {
         let ignored = [];
         // build xml parser with options
         let parser = new XMLParser({
-            commentPropName: '#comment',
+            commentPropName: '#comment', // mark comments with #comment
             isArray: (_, jpath) => 'project.dependencies.dependency' === jpath,
             parseTagValue: false
         });
@@ -260,4 +290,166 @@ export default class Java_maven extends Base_java {
     #dependencyIn(dep, deps) {
         return deps.filter(d => dep.artifactId === d.artifactId && dep.groupId === d.groupId && dep.scope === d.scope).length > 0;
     }
+    /**
+     * Returns true if the given version string is a Maven version range
+     * (starts with '[' or '(').
+     * @param {string} version
+     * @returns {boolean}
+     * @private
+     */
+    #isVersionRange(version) {
+        return typeof version === 'string' && (version.startsWith('[') || version.startsWith('('));
+    }
+    /**
+     * Resolves Maven version ranges in the given dependency list by running
+     * maven-dependency-plugin:tree and reading the concrete versions it selects.
+     * If no dependency uses a version range, returns the list unchanged.
+     * @param {Dependency[]} dependencies
+     * @param {string} manifestPath
+     * @param {object} opts
+     * @returns {Dependency[]}
+     * @private
+     */
+    #resolveVersionRanges(dependencies, manifestPath, opts = {}) {
+        // short-circuit if no dependency has a version range
+        if (!dependencies.some(dep => this.#isVersionRange(dep.version))) {
+            return dependencies;
+        }
+        const mvn = this.selectToolBinary(manifestPath, opts);
+        const mvnArgs = JSON.parse(getCustom('TRUSTIFY_DA_MVN_ARGS', '[]', opts));
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'trustify_da_range_'));
+        const tmpDepTree = path.join(tmpDir, 'mvn_deptree_ranges.txt');
+        try {
+            this._invokeCommand(mvn, [
+                '-q',
+                'org.apache.maven.plugins:maven-dependency-plugin:3.6.0:tree',
+                '-Dscope=compile',
+                '-DoutputType=text',
+                `-DoutputFile=${tmpDepTree}`,
+                ...mvnArgs
+            ], { cwd: path.dirname(manifestPath) });
+            const content = fs.readFileSync(tmpDepTree);
+            const lines = content.toString().split(EOL).filter(l => l.trim() !== '');
+            // Build a map of groupId:artifactId -> resolved version from depth-1 entries
+            /** @type {Map<string, string>} */
+            const resolvedVersions = new Map();
+            for (const line of lines) {
+                if (this._getDepth(line) === 1) {
+                    const purl = this.parseDep(line);
+                    resolvedVersions.set(`${purl.namespace}:${purl.name}`, purl.version);
+                }
+            }
+            // Replace version ranges with resolved concrete versions
+            return dependencies.map(dep => {
+                if (this.#isVersionRange(dep.version)) {
+                    const key = `${dep.groupId}:${dep.artifactId}`;
+                    const resolved = resolvedVersions.get(key);
+                    if (resolved) {
+                        return { ...dep, version: resolved };
+                    }
+                }
+                return dep;
+            });
+        }
+        catch (error) {
+            if (process.env["TRUSTIFY_DA_DEBUG"] === "true") {
+                console.error("Failed to resolve Maven version ranges: " + error.message);
+            }
+            return dependencies;
+        }
+        finally {
+            fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
+    }
+}
+const DEFAULT_MAVEN_DISCOVERY_IGNORE = [
+    '**/target/**',
+];
+/**
+ * Discover all pom.xml manifest paths in a Maven multi-module project.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain pom.xml)
+ * @param {object} [opts={}]
+ * @returns {Promise<string[]>} Paths to pom.xml files (absolute)
+ */
+export async function discoverMavenModules(workspaceRoot, opts = {}) {
+    const root = path.resolve(workspaceRoot);
+    const rootPom = path.join(root, 'pom.xml');
+    if (!fs.existsSync(rootPom)) {
+        return [];
+    }
+    let mvnBin;
+    try {
+        mvnBin = new Java_maven().selectToolBinary(rootPom, opts);
+    }
+    catch {
+        return [rootPom];
+    }
+    const visited = new Set();
+    const manifestPaths = [rootPom];
+    collectMavenModules(root, mvnBin, visited, manifestPaths);
+    const ignorePatterns = [...resolveWorkspaceDiscoveryIgnore(opts), ...DEFAULT_MAVEN_DISCOVERY_IGNORE];
+    return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+}
+/**
+ * @param {string} dir - Absolute path to directory containing pom.xml
+ * @param {string} mvnBin - Maven binary path
+ * @param {Set<string>} visited - Already-visited directories (cycle guard)
+ * @param {string[]} manifestPaths - Accumulator for discovered pom.xml paths
+ */
+function collectMavenModules(dir, mvnBin, visited, manifestPaths) {
+    const resolvedDir = path.resolve(dir);
+    if (visited.has(resolvedDir)) {
+        return;
+    }
+    visited.add(resolvedDir);
+    const modules = listMavenModules(resolvedDir, mvnBin);
+    for (const mod of modules) {
+        const moduleDir = path.resolve(resolvedDir, mod);
+        const modulePom = path.join(moduleDir, 'pom.xml');
+        if (fs.existsSync(modulePom)) {
+            manifestPaths.push(modulePom);
+            collectMavenModules(moduleDir, mvnBin, visited, manifestPaths);
+        }
+    }
+}
+/**
+ * @param {string} dir - Directory containing pom.xml
+ * @param {string} mvnBin - Maven binary path
+ * @returns {string[]} Module directory names (relative to `dir`)
+ */
+function listMavenModules(dir, mvnBin) {
+    let output;
+    try {
+        output = invokeCommand(mvnBin, [
+            'help:evaluate',
+            '-Dexpression=project.modules',
+            '-q',
+            '-DforceStdout',
+            '-f', path.join(dir, 'pom.xml'),
+            '--batch-mode',
+        ], { cwd: dir });
+    }
+    catch {
+        return [];
+    }
+    const raw = output.toString().trim();
+    if (!raw || raw.startsWith('<modules')) {
+        return [];
+    }
+    return parseMavenModuleList(raw);
+}
+/**
+ * @param {string} raw - Raw stdout from mvn help:evaluate -DforceStdout
+ * @returns {string[]}
+ */
+function parseMavenModuleList(raw) {
+    const parser = new XMLParser();
+    const parsed = parser.parse(raw);
+    const entries = parsed?.strings?.string;
+    if (!entries) {
+        return [];
+    }
+    const list = Array.isArray(entries) ? entries : [entries];
+    return list.map(s => String(s).trim()).filter(Boolean);
 }

package/dist/src/providers/javascript_bun.d.ts

@@ -0,0 +1,10 @@
+export default class Javascript_bun extends Base_javascript {
+    _listCmdArgs(): void;
+    _buildDependencyTree(includeTransitive: any, opts?: {}): {
+        name: any;
+        version: any;
+        dependencies: {};
+    };
+    #private;
+}
+import Base_javascript from './base_javascript.js';

package/dist/src/providers/javascript_bun.js

@@ -0,0 +1,100 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { parse } from 'jsonc-parser';
+import Base_javascript from './base_javascript.js';
+export default class Javascript_bun extends Base_javascript {
+    _lockFileName() {
+        return "bun.lock";
+    }
+    _cmdName() {
+        return "bun";
+    }
+    _listCmdArgs() {
+        throw new Error("not supported by Bun");
+    }
+    _updateLockFileCmdArgs() {
+        return ['install', '--lockfile-only'];
+    }
+    _buildDependencyTree(includeTransitive, opts = {}) {
+        this._version();
+        const manifestDir = path.dirname(this._getManifest().manifestPath);
+        const lockDir = this._findLockFileDir(manifestDir, opts) || manifestDir;
+        this._createLockFile(lockDir);
+        const lockContent = fs.readFileSync(path.join(lockDir, 'bun.lock'), 'utf-8');
+        const lockData = parse(lockContent);
+        const packages = lockData.packages || {};
+        const memberName = this._getManifest().name;
+        const workspaceEntry = this.#findWorkspaceEntry(lockData, lockDir, manifestDir, memberName);
+        const directDeps = workspaceEntry?.dependencies || {};
+        const tree = { name: memberName, version: this._getManifest().version, dependencies: {} };
+        const visited = new Set();
+        for (const depName of Object.keys(directDeps)) {
+            const resolved = this.#resolvePackage(depName, '', packages);
+            if (resolved) {
+                tree.dependencies[depName] = this.#buildNode(depName, resolved, packages, includeTransitive, visited);
+            }
+        }
+        return tree;
+    }
+    #findWorkspaceEntry(lockData, lockDir, manifestDir, memberName) {
+        const workspaces = lockData.workspaces || {};
+        const relPath = path.relative(lockDir, path.resolve(manifestDir));
+        if (!relPath || relPath === '.') {
+            return workspaces[''] || {};
+        }
+        const normalised = relPath.split(path.sep).join('/');
+        if (workspaces[normalised]) {
+            return workspaces[normalised];
+        }
+        for (const [wsPath, entry] of Object.entries(workspaces)) {
+            if (entry.name === memberName && wsPath !== '') {
+                return entry;
+            }
+        }
+        return workspaces[''] || {};
+    }
+    #resolvePackage(depName, parentKey, packages) {
+        if (parentKey) {
+            const scopedKey = `${parentKey}/${depName}`;
+            if (packages[scopedKey]) {
+                return packages[scopedKey];
+            }
+        }
+        return packages[depName] || null;
+    }
+    #buildNode(depName, resolved, packages, includeTransitive, visited) {
+        const resolvedId = Array.isArray(resolved) ? resolved[0] : resolved;
+        const version = this.#extractVersion(resolvedId);
+        const node = { version };
+        if (!includeTransitive) {
+            return node;
+        }
+        const metadata = Array.isArray(resolved) ? (resolved[2] || {}) : {};
+        const subDeps = metadata.dependencies || {};
+        if (Object.keys(subDeps).length > 0) {
+            const visitKey = `${depName}@${version}`;
+            if (visited.has(visitKey)) {
+                return node;
+            }
+            visited.add(visitKey);
+            node.dependencies = {};
+            for (const subName of Object.keys(subDeps)) {
+                const subResolved = this.#resolvePackage(subName, depName, packages);
+                if (subResolved) {
+                    node.dependencies[subName] = this.#buildNode(subName, subResolved, packages, true, visited);
+                }
+            }
+        }
+        return node;
+    }
+    #extractVersion(resolvedId) {
+        if (typeof resolvedId !== 'string') {
+            return '0.0.0';
+        }
+        const atIdx = resolvedId.lastIndexOf('@');
+        if (atIdx > 0) {
+            return resolvedId.substring(atIdx + 1);
+        }
+        return '0.0.0';
+    }
+}

package/dist/src/providers/javascript_npm.d.ts

@@ -1,4 +1,10 @@
 export default class Javascript_npm extends Base_javascript {
     _listCmdArgs(includeTransitive: any): string[];
+    _buildDependencyTree(includeTransitive: any, opts?: {}): Object | {
+        name: any;
+        version: any;
+        dependencies: any;
+        optionalDependencies: any;
+    };
 }
 import Base_javascript from './base_javascript.js';

package/dist/src/providers/javascript_npm.js

@@ -12,4 +12,25 @@ export default class Javascript_npm extends Base_javascript {
     _updateLockFileCmdArgs() {
         return ['install', '--package-lock-only'];
     }
+    _buildDependencyTree(includeTransitive, opts = {}) {
+        // npm ls --json returns a single tree rooted at the workspace root.
+        // When analyzing a workspace member, its deps are nested under the
+        // root's dependencies keyed by the member name — extract that subtree
+        // so downstream analysis sees only the member's dependencies.
+        const tree = super._buildDependencyTree(includeTransitive, opts);
+        const memberName = this._getManifest().name;
+        if (tree.name === memberName) {
+            return tree;
+        }
+        const memberEntry = tree.dependencies?.[memberName];
+        if (memberEntry) {
+            return {
+                name: memberName,
+                version: memberEntry.version || this._getManifest().version,
+                dependencies: memberEntry.dependencies,
+                optionalDependencies: memberEntry.optionalDependencies,
+            };
+        }
+        return tree;
+    }
 }

package/dist/src/providers/javascript_pnpm.d.ts

@@ -1,5 +1,5 @@
 export default class Javascript_pnpm extends Base_javascript {
     _listCmdArgs(includeTransitive: any): string[];
-    _buildDependencyTree(includeTransitive: any, manifest: any): any;
+    _buildDependencyTree(includeTransitive: any, opts?: {}): any;
 }
 import Base_javascript from './base_javascript.js';

package/dist/src/providers/javascript_pnpm.js

@@ -7,15 +7,19 @@ export default class Javascript_pnpm extends Base_javascript {
         return "pnpm";
     }
     _listCmdArgs(includeTransitive) {
-        return ['ls', includeTransitive ? '--depth=Infinity' : '--depth=0', '--prod', '--json'];
+        return ['ls', includeTransitive ? '--depth=Infinity' : '--depth=0', '--prod', '--json', '-r'];
     }
     _updateLockFileCmdArgs() {
         return ['install', '--frozen-lockfile'];
     }
-    _buildDependencyTree(includeTransitive, manifest) {
-        const tree = super._buildDependencyTree(includeTransitive, manifest);
+    _buildDependencyTree(includeTransitive, opts = {}) {
+        // pnpm ls --json returns an array with one entry per workspace package.
+        // When analyzing a workspace member, find its entry by name instead of
+        // blindly taking the first element (which is the workspace root).
+        const tree = super._buildDependencyTree(includeTransitive, opts);
         if (Array.isArray(tree) && tree.length > 0) {
-            return tree[0];
+            const memberName = this._getManifest().name;
+            return tree.find(pkg => pkg.name === memberName) || tree[0];
         }
         return {};
     }