@trustify-da/trustify-da-javascript-client 0.3.0-ea.e12bc82 → 0.3.0-ea.e348975

package/dist/src/providers/manifest.d.ts

@@ -2,6 +2,8 @@ export default class Manifest {
     constructor(manifestPath: any);
     manifestPath: any;
     dependencies: any[];
+    peerDependencies: any;
+    optionalDependencies: any;
     name: any;
     version: any;
     ignored: any[];

package/dist/src/providers/manifest.js

@@ -9,6 +9,8 @@ export default class Manifest {
         this.manifestPath = manifestPath;
         const content = this.loadManifest();
         this.dependencies = this.loadDependencies(content);
+        this.peerDependencies = content.peerDependencies || {};
+        this.optionalDependencies = content.optionalDependencies || {};
         this.name = content.name;
         this.version = content.version || DEFAULT_VERSION;
         this.ignored = this.loadIgnored(content);
@@ -27,11 +29,27 @@ export default class Manifest {
     }
     loadDependencies(content) {
         let deps = [];
-        if (!content.dependencies) {
-            return deps;
+        const depSources = [
+            content.dependencies,
+            content.peerDependencies,
+            content.optionalDependencies,
+        ];
+        for (const source of depSources) {
+            if (source) {
+                for (let dep in source) {
+                    if (!deps.includes(dep)) {
+                        deps.push(dep);
+                    }
+                }
+            }
         }
-        for (let dep in content.dependencies) {
-            deps.push(dep);
+        // bundledDependencies is an array of package names (subset of dependencies)
+        if (Array.isArray(content.bundledDependencies)) {
+            for (const dep of content.bundledDependencies) {
+                if (!deps.includes(dep)) {
+                    deps.push(dep);
+                }
+            }
         }
         return deps;
     }

package/dist/src/providers/marker_evaluator.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Maps Node.js/OS values to PEP 508 marker variables.
+ * Example: on Linux, sys_platform='linux', platform_system='Linux', os_name='posix'
+ * @returns {Record<string, string>}
+ */
+export function getEnvironmentMarkers(): Record<string, string>;
+/**
+ * Evaluates a full PEP 508 marker expression against the current platform.
+ * Example: "sys_platform == 'win32' and python_version >= '3.8'" → false on Linux
+ * Empty/missing markers return true (unconditional dependency).
+ * @param {string} markerExpr
+ * @returns {boolean}
+ */
+export function evaluateMarker(markerExpr: string): boolean;

package/dist/src/providers/marker_evaluator.js

@@ -0,0 +1,191 @@
+// PEP 508 environment marker evaluator.
+// Filters Python dependencies by platform/version markers so that e.g.
+// "pywin32 ; sys_platform == 'win32'" is excluded on Linux/macOS.
+// See https://peps.python.org/pep-0508/#environment-markers
+import os from 'node:os';
+import { getCustomPath, invokeCommand } from '../tools.js';
+let cachedPythonVersions = undefined;
+function getPythonVersions() {
+    if (cachedPythonVersions !== undefined) {
+        return cachedPythonVersions;
+    }
+    try {
+        let python = getCustomPath('python3');
+        let out = invokeCommand(python, ['-c', "import sys; v=sys.version_info; print(f'{v.major}.{v.minor} {v.major}.{v.minor}.{v.micro}')"], { timeout: 5000 }).toString().trim();
+        let [short, full] = out.split(' ');
+        cachedPythonVersions = { short, full };
+    }
+    catch {
+        cachedPythonVersions = null;
+    }
+    return cachedPythonVersions;
+}
+/**
+ * Maps Node.js/OS values to PEP 508 marker variables.
+ * Example: on Linux, sys_platform='linux', platform_system='Linux', os_name='posix'
+ * @returns {Record<string, string>}
+ */
+export function getEnvironmentMarkers() {
+    let platform = process.platform;
+    let systemMap = { win32: 'Windows', linux: 'Linux', darwin: 'Darwin' };
+    let machine = typeof os.machine === 'function' ? os.machine() : process.arch;
+    let pyVer = getPythonVersions();
+    return {
+        sys_platform: platform,
+        platform_system: systemMap[platform] || platform,
+        os_name: platform === 'win32' ? 'nt' : 'posix',
+        platform_machine: machine,
+        platform_release: os.release(),
+        platform_version: os.version?.() || '',
+        python_version: pyVer?.short || '',
+        python_full_version: pyVer?.full || '',
+        implementation_name: 'cpython',
+    };
+}
+function compareVersions(left, right) {
+    let lParts = left.split('.').map(Number);
+    let rParts = right.split('.').map(Number);
+    let len = Math.max(lParts.length, rParts.length);
+    for (let i = 0; i < len; i++) {
+        let l = lParts[i] || 0;
+        let r = rParts[i] || 0;
+        if (l < r) {
+            return -1;
+        }
+        if (l > r) {
+            return 1;
+        }
+    }
+    return 0;
+}
+// Evaluates a single comparison like sys_platform == 'win32' or python_version >= '3.8'.
+// Version-bearing variables (python_version, python_full_version) use numeric comparison;
+// all others use string equality. Returns false when the env value is missing.
+function evaluateComparison(variable, op, value, env) {
+    let envVal = env[variable];
+    if (envVal === undefined || envVal === '') {
+        return false;
+    }
+    let isVersion = variable.includes('version');
+    if (isVersion) {
+        let cmp = compareVersions(envVal, value);
+        switch (op) {
+            case '==': return cmp === 0;
+            case '!=': return cmp !== 0;
+            case '>=': return cmp >= 0;
+            case '<=': return cmp <= 0;
+            case '>': return cmp > 0;
+            case '<': return cmp < 0;
+            case '~=': {
+                let parts = value.split('.');
+                parts.pop();
+                let prefix = parts.join('.');
+                return envVal.startsWith(prefix) && cmp >= 0;
+            }
+            default: return true;
+        }
+    }
+    switch (op) {
+        case '==': return envVal === value;
+        case '!=': return envVal !== value;
+        case 'in': return value.includes(envVal);
+        case 'not in': return !value.includes(envVal);
+        default: return envVal === value;
+    }
+}
+// Parses a single marker comparison into {variable, op, value}.
+// Handles both normal and reversed forms:
+//   "sys_platform == 'linux'"  → { variable: 'sys_platform', op: '==', value: 'linux' }
+//   "'linux' == sys_platform"  → { variable: 'sys_platform', op: '==', value: 'linux' }
+function parseAtom(expr) {
+    // Normal form: variable op 'value'
+    let m = expr.match(/^\s*([\w.]+)\s*(~=|!=|==|>=|<=|>|<|not\s+in|in)\s*["']([^"']*)["']\s*$/);
+    if (m) {
+        return { variable: m[1], op: m[2].replace(/\s+/g, ' '), value: m[3] };
+    }
+    // Reversed form: 'value' op variable — reverse directional operators
+    let mReverse = expr.match(/^\s*["']([^"']*)['"]\s*(~=|!=|==|>=|<=|>|<|not\s+in|in)\s*([\w.]+)\s*$/);
+    if (mReverse) {
+        let reverseOp = { '<': '>', '>': '<', '<=': '>=', '>=': '<=' };
+        let op = mReverse[2].replace(/\s+/g, ' ');
+        return { variable: mReverse[3], op: reverseOp[op] || op, value: mReverse[1] };
+    }
+    return null;
+}
+/**
+ * Evaluates a full PEP 508 marker expression against the current platform.
+ * Example: "sys_platform == 'win32' and python_version >= '3.8'" → false on Linux
+ * Empty/missing markers return true (unconditional dependency).
+ * @param {string} markerExpr
+ * @returns {boolean}
+ */
+export function evaluateMarker(markerExpr) {
+    if (!markerExpr || !markerExpr.trim()) {
+        return true;
+    }
+    let env = getEnvironmentMarkers();
+    return evaluateExpr(markerExpr.trim(), env);
+}
+function evaluateExpr(expr, env) {
+    let orParts = splitLogical(expr, ' or ');
+    if (orParts.length > 1) {
+        return orParts.some(part => evaluateExpr(part, env));
+    }
+    let andParts = splitLogical(expr, ' and ');
+    if (andParts.length > 1) {
+        return andParts.every(part => evaluateExpr(part, env));
+    }
+    let trimmed = expr.trim();
+    if (trimmed.startsWith('(') && trimmed.endsWith(')')) {
+        return evaluateExpr(trimmed.slice(1, -1), env);
+    }
+    let atom = parseAtom(trimmed);
+    if (!atom) {
+        return true;
+    }
+    return evaluateComparison(atom.variable, atom.op, atom.value, env);
+}
+// Splits an expression by " and " or " or " at the top level, skipping
+// separators inside parentheses or quoted strings.
+// Example: splitLogical("a == 'x' and (b == 'y' or c == 'z')", " and ")
+//        → ["a == 'x'", "(b == 'y' or c == 'z')"]
+function splitLogical(expr, sep) {
+    let parts = [];
+    let depth = 0;
+    let current = '';
+    let i = 0;
+    let quoteChar = null;
+    while (i < expr.length) {
+        let ch = expr[i];
+        if (quoteChar) {
+            if (ch === quoteChar) {
+                quoteChar = null;
+            }
+            current += ch;
+            i++;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quoteChar = ch;
+            current += ch;
+            i++;
+            continue;
+        }
+        if (ch === '(') {
+            depth++;
+        }
+        if (ch === ')') {
+            depth--;
+        }
+        if (depth === 0 && expr.substring(i, i + sep.length) === sep) {
+            parts.push(current);
+            current = '';
+            i += sep.length;
+            continue;
+        }
+        current += ch;
+        i++;
+    }
+    parts.push(current);
+    return parts.filter(p => p.trim());
+}

package/dist/src/providers/oci_dockerfile.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Parse all FROM instructions from a Dockerfile using tree-sitter to extract base image references.
+ * In multi-stage builds, every FROM line is returned so each image can be analyzed independently.
+ * ARG substitutions are resolved using declared default values. FROM lines with unresolvable
+ * variables (ARGs without defaults) are silently skipped.
+ * @param {string} manifestContent the content of the Dockerfile
+ * @returns {Promise<string[]>} array of image references from all resolvable FROM instructions
+ * @throws {Error} when no FROM instruction is found or when no FROM lines can be resolved
+ */
+export function parseAllFromImages(manifestContent: string): Promise<string[]>;
+declare namespace _default {
+    export { isSupported };
+    export { validateLockFile };
+    export { provideComponent };
+    export { provideStack };
+    export { readLicenseFromManifest };
+    export function packageManagerName(): string;
+}
+export default _default;
+export type Provided = any;
+/**
+ * Check if the given manifest name is a Dockerfile or Containerfile.
+ * Supports dot-suffixed variants such as Dockerfile.dev or Containerfile.prod.
+ * @param {string} manifestName the manifest file name to check
+ * @returns {boolean} true if the manifest is a Dockerfile or Containerfile
+ */
+declare function isSupported(manifestName: string): boolean;
+/**
+ * Dockerfiles have no lock file, so validation always passes.
+ * @returns {boolean} always true
+ */
+declare function validateLockFile(): boolean;
+/**
+ * Provide content and content type for Dockerfile component analysis.
+ * @param {string} manifest path to the Dockerfile
+ * @param {{}} [opts={}] optional various options to pass along the application
+ * @returns {Promise<Provided>}
+ */
+declare function provideComponent(manifest: string, opts?: {}): Promise<Provided>;
+/**
+ * Provide content and content type for Dockerfile stack analysis.
+ * @param {string} manifest path to the Dockerfile
+ * @param {{}} [opts={}] optional various options to pass along the application
+ * @returns {Promise<Provided>}
+ */
+declare function provideStack(manifest: string, opts?: {}): Promise<Provided>;
+/**
+ * Dockerfiles contain no license information.
+ * @returns {null} always null
+ */
+declare function readLicenseFromManifest(): null;

package/dist/src/providers/oci_dockerfile.js

@@ -0,0 +1,177 @@
+import fs from 'node:fs';
+import { generateImageSBOM, parseImageRef } from '../oci_image/utils.js';
+import { getArgQuery, getFromQuery, getParser } from './containerfile_parser.js';
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'oci'; } };
+/** @typedef {import('../provider').Provider} */
+/** @typedef {import('../provider').Provided} Provided */
+/**
+ * @type {string} ecosystem identifier for OCI image packages
+ * @private
+ */
+const ecosystem = 'oci';
+/**
+ * Check if the given manifest name is a Dockerfile or Containerfile.
+ * Supports dot-suffixed variants such as Dockerfile.dev or Containerfile.prod.
+ * @param {string} manifestName the manifest file name to check
+ * @returns {boolean} true if the manifest is a Dockerfile or Containerfile
+ */
+function isSupported(manifestName) {
+    return /^(Dockerfile|Containerfile)(\..+)?$/.test(manifestName);
+}
+/**
+ * Dockerfiles have no lock file, so validation always passes.
+ * @returns {boolean} always true
+ */
+function validateLockFile() { return true; }
+/**
+ * Check whether a syntax node contains any expansion (variable substitution) children.
+ * @param {import('web-tree-sitter').SyntaxNode} node
+ * @returns {boolean}
+ * @private
+ */
+function containsExpansion(node) {
+    if (node.type === 'expansion') {
+        return true;
+    }
+    for (let i = 0; i < node.childCount; i++) {
+        if (containsExpansion(node.child(i))) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Strip surrounding single or double quotes from a string.
+ * @param {string} text
+ * @returns {string}
+ * @private
+ */
+function stripQuotes(text) {
+    if ((text.startsWith('"') && text.endsWith('"')) || (text.startsWith("'") && text.endsWith("'"))) {
+        return text.slice(1, -1);
+    }
+    return text;
+}
+/**
+ * Collect ARG key-value pairs from the Dockerfile AST.
+ * Only ARGs with a default value are collected (ARGs without defaults cannot be resolved statically).
+ * @param {import('web-tree-sitter').Tree} tree the parsed Dockerfile tree
+ * @param {import('web-tree-sitter').Query} argQuery the tree-sitter query for arg_instruction nodes
+ * @returns {Map<string, string>} map of ARG names to their default values
+ * @private
+ */
+function collectArgs(tree, argQuery) {
+    const args = new Map();
+    for (const match of argQuery.matches(tree.rootNode)) {
+        const name = match.captures.find(c => c.name === 'name')?.node.text;
+        const defaultValue = match.captures.find(c => c.name === 'default')?.node.text;
+        if (name && defaultValue) {
+            args.set(name, stripQuotes(defaultValue));
+        }
+    }
+    return args;
+}
+/**
+ * Resolve ARG substitutions in an image spec text using the collected ARG map.
+ * Replaces ${VAR} and $VAR patterns with their ARG default values.
+ * @param {string} text the image spec text potentially containing variable references
+ * @param {Map<string, string>} args map of ARG names to their default values
+ * @returns {string|null} the resolved text, or null if any variable could not be resolved
+ * @private
+ */
+function resolveArgs(text, args) {
+    let resolved = text;
+    let hasUnresolved = false;
+    resolved = resolved.replace(/\$\{([^}]+)\}|\$([A-Za-z_]\w*)/g, (_match, braced, plain) => {
+        const key = braced || plain;
+        if (args.has(key)) {
+            return args.get(key);
+        }
+        hasUnresolved = true;
+        return _match;
+    });
+    return hasUnresolved ? null : resolved;
+}
+/**
+ * Parse all FROM instructions from a Dockerfile using tree-sitter to extract base image references.
+ * In multi-stage builds, every FROM line is returned so each image can be analyzed independently.
+ * ARG substitutions are resolved using declared default values. FROM lines with unresolvable
+ * variables (ARGs without defaults) are silently skipped.
+ * @param {string} manifestContent the content of the Dockerfile
+ * @returns {Promise<string[]>} array of image references from all resolvable FROM instructions
+ * @throws {Error} when no FROM instruction is found or when no FROM lines can be resolved
+ */
+export async function parseAllFromImages(manifestContent) {
+    const [parser, fromQuery, argQuery] = await Promise.all([getParser(), getFromQuery(), getArgQuery()]);
+    const tree = parser.parse(manifestContent);
+    const matches = fromQuery.matches(tree.rootNode);
+    if (matches.length === 0) {
+        throw new Error('No FROM line found in Dockerfile');
+    }
+    const args = collectArgs(tree, argQuery);
+    const images = [];
+    for (const match of matches) {
+        const imageSpec = match.captures.find(c => c.name === 'image').node;
+        if (containsExpansion(imageSpec)) {
+            const resolved = resolveArgs(imageSpec.text, args);
+            if (resolved != null) {
+                images.push(resolved);
+            }
+            continue;
+        }
+        images.push(imageSpec.text);
+    }
+    if (images.length === 0) {
+        throw new Error('Dockerfile uses ARG substitution in all FROM lines — cannot resolve variable references');
+    }
+    return images;
+}
+/**
+ * Generate image SBOMs for all FROM instructions in a Dockerfile manifest using syft.
+ * Returns a batch result with a purl-to-SBOM map suitable for the batch-analysis endpoint.
+ * @param {string} manifest path to the Dockerfile
+ * @param {{}} [opts={}] optional various options to pass along the application
+ * @returns {Promise<{ecosystem: string, content: string, contentType: string, batch: boolean}>}
+ * @private
+ */
+async function getImageSBOM(manifest, opts = {}) {
+    const manifestContent = fs.readFileSync(manifest, 'utf-8');
+    const images = await parseAllFromImages(manifestContent);
+    const sbomByPurl = {};
+    for (const image of images) {
+        const imageRef = parseImageRef(image, opts);
+        const purl = imageRef.getPackageURL().toString();
+        if (purl in sbomByPurl)
+            continue;
+        sbomByPurl[purl] = generateImageSBOM(imageRef, opts);
+    }
+    return {
+        ecosystem,
+        content: JSON.stringify(sbomByPurl),
+        contentType: 'application/vnd.cyclonedx+json',
+        batch: true
+    };
+}
+/**
+ * Provide content and content type for Dockerfile component analysis.
+ * @param {string} manifest path to the Dockerfile
+ * @param {{}} [opts={}] optional various options to pass along the application
+ * @returns {Promise<Provided>}
+ */
+async function provideComponent(manifest, opts = {}) {
+    return getImageSBOM(manifest, opts);
+}
+/**
+ * Provide content and content type for Dockerfile stack analysis.
+ * @param {string} manifest path to the Dockerfile
+ * @param {{}} [opts={}] optional various options to pass along the application
+ * @returns {Promise<Provided>}
+ */
+async function provideStack(manifest, opts = {}) {
+    return getImageSBOM(manifest, opts);
+}
+/**
+ * Dockerfiles contain no license information.
+ * @returns {null} always null
+ */
+function readLicenseFromManifest() { return null; }

package/dist/src/providers/processors/yarn_berry_processor.d.ts

@@ -29,13 +29,13 @@ export default class Yarn_berry_processor extends Yarn_processor {
    * @param {Object} depTree - The dependency tree object
    * @returns {Map<string, PackageURL>} Map of dependency names to their PackageURL objects
    */
-    getRootDependencies(depTree: any): Map<string, PackageURL>;
+    getRootDependencies(depTree: Object): Map<string, PackageURL>;
     /**
    * Adds dependencies to the SBOM
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The dependency tree object
    */
-    addDependenciesToSbom(sbom: Sbom, depTree: any): void;
+    addDependenciesToSbom(sbom: Sbom, depTree: Object): void;
     #private;
 }
 import Yarn_processor from "./yarn_processor.js";

package/dist/src/providers/processors/yarn_berry_processor.js

@@ -15,7 +15,10 @@ export default class Yarn_berry_processor extends Yarn_processor {
      * @returns {string[]} Command arguments for listing dependencies
      */
     listCmdArgs(includeTransitive) {
-        return ['info', includeTransitive ? '--recursive' : '--all', '--json'];
+        // --all is needed to include workspace members in the output
+        return includeTransitive
+            ? ['info', '--recursive', '--all', '--json']
+            : ['info', '--all', '--json'];
     }
     /**
      * Returns the command arguments for updating the lock file
@@ -48,13 +51,15 @@ export default class Yarn_berry_processor extends Yarn_processor {
         if (!depTree) {
             return new Map();
         }
-        return new Map(depTree.filter(dep => !this.#isRoot(dep.value)).map(dep => {
+        return new Map(depTree.filter(dep => !this.#isRoot(dep.value))
+            .map(dep => {
             const depName = dep.value;
             const idx = depName.lastIndexOf('@');
             const name = depName.substring(0, idx);
             const version = dep.children.Version;
             return [name, toPurl(purlType, name, version)];
-        }));
+        })
+            .filter(([name]) => this._manifest.dependencies.includes(name)));
     }
     /**
    * Checks if a dependency is the root package
@@ -66,7 +71,8 @@ export default class Yarn_berry_processor extends Yarn_processor {
         if (!name) {
             return false;
         }
-        return name.endsWith("@workspace:.");
+        // Workspace members use paths like "member-a@workspace:packages/member-a", not just "@workspace:."
+        return name.startsWith(`${this._manifest.name}@workspace:`);
     }
     /**
    * Adds dependencies to the SBOM
@@ -77,14 +83,58 @@ export default class Yarn_berry_processor extends Yarn_processor {
         if (!depTree) {
             return;
         }
+        // Build index of nodes by their value for quick lookup
+        const nodeIndex = new Map();
+        depTree.forEach(n => nodeIndex.set(n.value, n));
+        // Determine the set of node values reachable from root via production deps
+        const prodDeps = new Set(this._manifest.dependencies);
+        const reachable = new Set();
+        const queue = [];
+        // Seed with root's production dependencies
+        const rootNode = depTree.find(n => this.#isRoot(n.value));
+        if (rootNode?.children?.Dependencies) {
+            for (const d of rootNode.children.Dependencies) {
+                const to = this.#purlFromLocator(d.locator);
+                if (to) {
+                    const fullName = to.namespace ? `${to.namespace}/${to.name}` : to.name;
+                    if (prodDeps.has(fullName)) {
+                        queue.push(d.locator);
+                    }
+                }
+            }
+        }
+        // BFS to find all transitively reachable packages
+        while (queue.length > 0) {
+            const locator = queue.shift();
+            if (reachable.has(locator)) {
+                continue;
+            }
+            reachable.add(locator);
+            const node = nodeIndex.get(this.#nodeValueFromLocator(locator));
+            if (node?.children?.Dependencies) {
+                for (const d of node.children.Dependencies) {
+                    if (!reachable.has(d.locator)) {
+                        queue.push(d.locator);
+                    }
+                }
+            }
+        }
+        // Only emit edges for root and reachable nodes
         depTree.forEach(n => {
             const depName = n.value;
-            const from = this.#isRoot(depName) ? toPurlFromString(sbom.getRoot().purl) : this.#purlFromNode(depName, n);
+            const isRoot = this.#isRoot(depName);
+            if (!isRoot && !this.#isReachableNode(depName, reachable)) {
+                return;
+            }
+            const from = isRoot ? toPurlFromString(sbom.getRoot().purl) : this.#purlFromNode(depName, n);
             const deps = n.children?.Dependencies;
             if (!deps) {
                 return;
             }
             deps.forEach(d => {
+                if (!reachable.has(d.locator)) {
+                    return;
+                }
                 const to = this.#purlFromLocator(d.locator);
                 if (to) {
                     sbom.addDependency(from, to);
@@ -92,6 +142,39 @@ export default class Yarn_berry_processor extends Yarn_processor {
             });
         });
     }
+    /**
+     * Converts a locator to the node value format used in yarn info output
+     * @param {string} locator - e.g. "express@npm:4.17.1"
+     * @returns {string} The node value, same as locator for non-virtual
+     * @private
+     */
+    #nodeValueFromLocator(locator) {
+        // Virtual locators: "@scope/name@virtual:hash#npm:version" → "@scope/name@npm:version"
+        const virtualMatch = Yarn_berry_processor.VIRTUAL_LOCATOR_PATTERN.exec(locator);
+        if (virtualMatch) {
+            return `${virtualMatch[1]}@npm:${virtualMatch[2]}`;
+        }
+        return locator;
+    }
+    /**
+     * Checks if a node is in the reachable set by matching its value against reachable locators
+     * @param {string} depName - The node value (e.g. "express@npm:4.17.1")
+     * @param {Set<string>} reachable - Set of reachable locators
+     * @returns {boolean}
+     * @private
+     */
+    #isReachableNode(depName, reachable) {
+        if (reachable.has(depName)) {
+            return true;
+        }
+        // Check if any reachable locator resolves to this node value
+        for (const locator of reachable) {
+            if (this.#nodeValueFromLocator(locator) === depName) {
+                return true;
+            }
+        }
+        return false;
+    }
     /**
    * Creates a PackageURL from a dependency locator
    * @param {string} locator - The dependency locator

package/dist/src/providers/processors/yarn_classic_processor.d.ts

@@ -25,13 +25,13 @@ export default class Yarn_classic_processor extends Yarn_processor {
    * @param {Object} depTree - The dependency tree object
    * @returns {Map<string, PackageURL>} Map of dependency names to their PackageURL objects
    */
-    getRootDependencies(depTree: any): Map<string, PackageURL>;
+    getRootDependencies(depTree: Object): Map<string, PackageURL>;
     /**
    * Adds dependencies to the SBOM
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The dependency tree object
    */
-    addDependenciesToSbom(sbom: Sbom, depTree: any): void;
+    addDependenciesToSbom(sbom: Sbom, depTree: Object): void;
     #private;
 }
 import Yarn_processor from "./yarn_processor.js";