@trustify-da/trustify-da-javascript-client 0.3.0-ea.e12bc82 → 0.3.0-ea.e348975

package/dist/src/provider.d.ts

@@ -1,3 +1,11 @@
+/**
+ * Match a provider by manifest type only (no lock file check). Used for license reading.
+ * @param {string} manifestPath - path or name of the manifest
+ * @param {[Provider]} providers - list of providers to iterate over
+ * @returns {Provider}
+ * @throws {Error} when the manifest is not supported and no provider was matched
+ */
+export function matchForLicense(manifestPath: string, providers: [Provider]): Provider;
 /**
  * Match a provider from a list or providers based on file type.
  * Each provider MUST export 'isSupported' taking a file name-type and returning true if supported.
@@ -5,12 +13,15 @@
  * Each provider MUST export 'provideStack' taking manifest path returning a {@link Provided}.
  * @param {string} manifest - the name-type or path of the manifest
  * @param {[Provider]} providers - list of providers to iterate over
+ * @param {{TRUSTIFY_DA_WORKSPACE_DIR?: string}} [opts={}] - optional; TRUSTIFY_DA_WORKSPACE_DIR overrides lock file location for workspaces
  * @returns {Provider}
  * @throws {Error} when the manifest is not supported and no provider was matched
  */
-export function match(manifest: string, providers: [Provider]): Provider;
+export function match(manifest: string, providers: [Provider], opts?: {
+    TRUSTIFY_DA_WORKSPACE_DIR?: string;
+}): Provider;
 /** @typedef {{ecosystem: string, contentType: string, content: string}} Provided */
-/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string): void, provideComponent: function(string, {}): Provided, provideStack: function(string, {}): Provided}} Provider */
+/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string, Object): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string, Object=): string | null, packageManagerName: function(): string}} Provider */
 /**
  * MUST include all providers here.
  * @type {[Provider]}
@@ -23,7 +34,9 @@ export type Provided = {
 };
 export type Provider = {
     isSupported: (arg0: string) => boolean;
-    validateLockFile: (arg0: string) => void;
-    provideComponent: (arg0: string, arg1: {}) => Provided;
-    provideStack: (arg0: string, arg1: {}) => Provided;
+    validateLockFile: (arg0: string, arg1: Object) => void;
+    provideComponent: (arg0: string, arg1: {}) => Provided | Promise<Provided>;
+    provideStack: (arg0: string, arg1: {}) => Provided | Promise<Provided>;
+    readLicenseFromManifest: (arg0: string, arg1: Object | undefined) => string | null;
+    packageManagerName: () => string;
 };

package/dist/src/provider.js

@@ -3,12 +3,18 @@ import golangGomodulesProvider from './providers/golang_gomodules.js';
 import Java_gradle_groovy from "./providers/java_gradle_groovy.js";
 import Java_gradle_kotlin from "./providers/java_gradle_kotlin.js";
 import Java_maven from "./providers/java_maven.js";
+import Javascript_bun from './providers/javascript_bun.js';
 import Javascript_npm from './providers/javascript_npm.js';
 import Javascript_pnpm from './providers/javascript_pnpm.js';
 import Javascript_yarn from './providers/javascript_yarn.js';
+import dockerfileProvider from './providers/oci_dockerfile.js';
 import pythonPipProvider from './providers/python_pip.js';
+import Python_pip_pyproject from './providers/python_pip_pyproject.js';
+import Python_poetry from './providers/python_poetry.js';
+import Python_uv from './providers/python_uv.js';
+import rustCargoProvider from './providers/rust_cargo.js';
 /** @typedef {{ecosystem: string, contentType: string, content: string}} Provided */
-/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string): void, provideComponent: function(string, {}): Provided, provideStack: function(string, {}): Provided}} Provider */
+/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string, Object): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string, Object=): string | null, packageManagerName: function(): string}} Provider */
 /**
  * MUST include all providers here.
  * @type {[Provider]}
@@ -17,12 +23,33 @@ export const availableProviders = [
     new Java_maven(),
     new Java_gradle_groovy(),
     new Java_gradle_kotlin(),
-    new Javascript_npm(),
+    new Javascript_bun(),
     new Javascript_pnpm(),
     new Javascript_yarn(),
+    new Javascript_npm(),
     golangGomodulesProvider,
-    pythonPipProvider
+    pythonPipProvider,
+    new Python_poetry(),
+    new Python_uv(),
+    new Python_pip_pyproject(),
+    rustCargoProvider,
+    dockerfileProvider
 ];
+/**
+ * Match a provider by manifest type only (no lock file check). Used for license reading.
+ * @param {string} manifestPath - path or name of the manifest
+ * @param {[Provider]} providers - list of providers to iterate over
+ * @returns {Provider}
+ * @throws {Error} when the manifest is not supported and no provider was matched
+ */
+export function matchForLicense(manifestPath, providers) {
+    const base = path.parse(manifestPath).base;
+    const provider = providers.find(prov => prov.isSupported(base));
+    if (!provider) {
+        throw new Error(`${base} is not supported`);
+    }
+    return provider;
+}
 /**
  * Match a provider from a list or providers based on file type.
  * Each provider MUST export 'isSupported' taking a file name-type and returning true if supported.
@@ -30,16 +57,17 @@ export const availableProviders = [
  * Each provider MUST export 'provideStack' taking manifest path returning a {@link Provided}.
  * @param {string} manifest - the name-type or path of the manifest
  * @param {[Provider]} providers - list of providers to iterate over
+ * @param {{TRUSTIFY_DA_WORKSPACE_DIR?: string}} [opts={}] - optional; TRUSTIFY_DA_WORKSPACE_DIR overrides lock file location for workspaces
  * @returns {Provider}
  * @throws {Error} when the manifest is not supported and no provider was matched
  */
-export function match(manifest, providers) {
+export function match(manifest, providers, opts = {}) {
     const manifestPath = path.parse(manifest);
     const supported = providers.filter(prov => prov.isSupported(manifestPath.base));
     if (supported.length === 0) {
         throw new Error(`${manifestPath.base} is not supported`);
     }
-    const provider = supported.find(prov => prov.validateLockFile(manifestPath.dir));
+    const provider = supported.find(prov => prov.validateLockFile(manifestPath.dir, opts));
     if (!provider) {
         throw new Error(`${manifestPath.base} requires a lock file. Use your preferred package manager to generate the lock file.`);
     }

package/dist/src/providers/base_java.d.ts

@@ -1,6 +1,4 @@
-/// <reference types="node" />
-/// <reference types="packageurl-js/src/package-url.js" />
-export type ecosystem_maven = import('../provider').Provider;
+export type ecosystem_maven = any;
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /** @typedef {{name: string, version: string}} Package */
@@ -22,6 +20,11 @@ export default class Base_Java {
     CONFLICT_REGEX: RegExp;
     globalBinary: string;
     localWrapper: string;
+    /**
+     * Returns the package manager name (e.g. mvn, gradle)
+     * @returns {string}
+     */
+    packageManagerName(): string;
     /**
      * Recursively populates the SBOM instance with the parsed graph
      * @param {string} src - Source dependency to start the calculations from
@@ -30,6 +33,13 @@ export default class Base_Java {
      * @param {Sbom} sbom - The SBOM where the dependencies are being added
      */
     parseDependencyTree(src: string, srcDepth: number, lines: any[], sbom: Sbom): void;
+    /**
+     * Calculates how deep in the graph is the given line
+     * @param {string} line - line to calculate the depth from
+     * @returns {number} The calculated depth
+     * @protected
+     */
+    protected _getDepth(line: string): number;
     /**
      * Create a PackageURL from any line in a Text Graph dependency tree for a manifest path.
      * @param {string} line - line to parse from a dependencies.txt file
@@ -51,7 +61,7 @@ export default class Base_Java {
      * @param {import('child_process').ExecFileOptionsWithStringEncoding} [opts={}]
      * @protected
      */
-    protected _invokeCommand(bin: any, args: any, opts?: import("child_process").ExecFileOptionsWithStringEncoding | undefined): string;
+    protected _invokeCommand(bin: any, args: any, opts?: import("child_process").ExecFileOptionsWithStringEncoding): string;
     /**
      *
      * @param {string} manifestPath
@@ -59,18 +69,8 @@ export default class Base_Java {
      * @returns string
      */
     selectToolBinary(manifestPath: string, opts: {}): string | null;
-    /**
-     *
-     * @param {string} startingManifest - the path of the manifest from which to start searching for the wrapper
-     * @param {string} repoRoot - the root of the repository at which point to stop searching for mvnw, derived via git if unset and then fallsback
-     * to the root of the drive the manifest is on (assumes absolute path is given)
-     * @returns {string|undefined}
-     */
-    traverseForWrapper(startingManifest: string, repoRoot?: string): string | undefined;
-    normalizePath(thePath: any): string;
-    #private;
 }
-export type Provided = import('../provider').Provided;
+export type Provided = any;
 export type Package = {
     name: string;
     version: string;

package/dist/src/providers/base_java.js

@@ -1,7 +1,6 @@
-import fs from 'node:fs';
 import path from 'node:path';
 import { PackageURL } from 'packageurl-js';
-import { getCustomPath, getGitRootDir, getWrapperPreference, invokeCommand } from "../tools.js";
+import { getCustomPath, getWrapperPreference, invokeCommand, traverseForWrapper } from "../tools.js";
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /** @typedef {{name: string, version: string}} Package */
@@ -26,6 +25,13 @@ export default class Base_Java {
         this.globalBinary = globalBinary;
         this.localWrapper = localWrapper;
     }
+    /**
+     * Returns the package manager name (e.g. mvn, gradle)
+     * @returns {string}
+     */
+    packageManagerName() {
+        return this.globalBinary;
+    }
     /**
      * Recursively populates the SBOM instance with the parsed graph
      * @param {string} src - Source dependency to start the calculations from
@@ -42,7 +48,7 @@ export default class Base_Java {
         }
         let index = 0;
         let target = lines[index];
-        let targetDepth = this.#getDepth(target);
+        let targetDepth = this._getDepth(target);
         while (targetDepth > srcDepth && index < lines.length) {
             if (targetDepth === srcDepth + 1) {
                 let from = this.parseDep(src);
@@ -55,22 +61,25 @@ export default class Base_Java {
                 }
             }
             else {
-                this.parseDependencyTree(lines[index - 1], this.#getDepth(lines[index - 1]), lines.slice(index), sbom);
+                this.parseDependencyTree(lines[index - 1], this._getDepth(lines[index - 1]), lines.slice(index), sbom);
             }
             target = lines[++index];
-            targetDepth = this.#getDepth(target);
+            targetDepth = this._getDepth(target);
         }
     }
     /**
      * Calculates how deep in the graph is the given line
      * @param {string} line - line to calculate the depth from
      * @returns {number} The calculated depth
-     * @private
+     * @protected
      */
-    #getDepth(line) {
-        if (line === undefined) {
+    _getDepth(line) {
+        if (!line || line.trim() === '') {
             return -1;
         }
+        if (line.match(/^\w/)) {
+            return 0;
+        }
         return ((line.indexOf('-') - 1) / 3) + 1;
     }
     /**
@@ -131,7 +140,7 @@ export default class Base_Java {
         const toolPath = getCustomPath(this.globalBinary, opts);
         const useWrapper = getWrapperPreference(this.globalBinary, opts);
         if (useWrapper) {
-            const wrapper = this.traverseForWrapper(manifestPath);
+            const wrapper = traverseForWrapper(manifestDir, this.localWrapper);
             if (wrapper !== undefined) {
                 try {
                     this._invokeCommand(wrapper, ['--version'], { cwd: manifestDir });
@@ -156,39 +165,4 @@ export default class Base_Java {
         }
         return toolPath;
     }
-    /**
-     *
-     * @param {string} startingManifest - the path of the manifest from which to start searching for the wrapper
-     * @param {string} repoRoot - the root of the repository at which point to stop searching for mvnw, derived via git if unset and then fallsback
-     * to the root of the drive the manifest is on (assumes absolute path is given)
-     * @returns {string|undefined}
-     */
-    traverseForWrapper(startingManifest, repoRoot = undefined) {
-        const normalizedManifest = this.normalizePath(startingManifest);
-        const currentDir = this.normalizePath(path.dirname(normalizedManifest));
-        repoRoot = repoRoot || getGitRootDir(currentDir) || path.parse(normalizedManifest).root;
-        const wrapperPath = path.join(currentDir, this.localWrapper);
-        try {
-            fs.accessSync(wrapperPath, fs.constants.X_OK);
-            return wrapperPath;
-        }
-        catch (error) {
-            if (error.code === 'ENOENT') {
-                const rootDir = path.parse(currentDir).root;
-                if (currentDir === repoRoot || currentDir === rootDir) {
-                    return undefined;
-                }
-                const parentDir = path.dirname(currentDir);
-                if (parentDir === currentDir || parentDir === rootDir) {
-                    return undefined;
-                }
-                return this.traverseForWrapper(path.join(parentDir, path.basename(normalizedManifest)), repoRoot);
-            }
-            throw new Error(`failure searching for ${this.localWrapper}`, { cause: error });
-        }
-    }
-    normalizePath(thePath) {
-        const normalized = path.resolve(thePath).normalize();
-        return process.platform === 'win32' ? normalized.toLowerCase() : normalized;
-    }
 }

package/dist/src/providers/base_javascript.d.ts

@@ -1,5 +1,6 @@
-/** @typedef {import('../provider.js').Provider} Provider */
-/** @typedef {import('../provider.js').Provided} Provided */
+export type purlType = any;
+/** @typedef {import('../provider').Provider} */
+/** @typedef {import('../provider').Provided} Provided */
 /**
  * The ecosystem identifier for JavaScript/npm packages
  * @type {string}
@@ -18,7 +19,7 @@ export default class Base_javascript {
    * @param {Object} opts - Configuration options for the provider
    * @protected
    */
-    protected _setUp(manifestPath: string, opts: any): void;
+    protected _setUp(manifestPath: string, opts: Object): void;
     /**
      * Gets the current manifest object
      * @returns {Manifest} The manifest object
@@ -46,6 +47,11 @@ export default class Base_javascript {
    */
     protected _cmdName(): string;
     /**
+   * Returns the package manager name (e.g. npm, yarn, pnpm, bun)
+   * @returns {string} The package manager name
+   */
+    packageManagerName(): string;
+    /**
    * Returns the command arguments for listing dependencies
    * @returns {Array<string>} The command arguments
    * @abstract
@@ -66,46 +72,68 @@ export default class Base_javascript {
    */
     isSupported(manifestName: string): boolean;
     /**
-   * Checks if a required lock file exists in the same path as the manifest
+   * Walks up the directory tree from manifestDir looking for the lock file.
+   * Stops when the lock file is found, when a package.json with a "workspaces"
+   * field is encountered without a lock file (workspace root boundary), or
+   * when the filesystem root is reached.
+   *
+   * When TRUSTIFY_DA_WORKSPACE_DIR is set, checks only that directory (no walk-up).
+   *
+   * @param {string} manifestDir - The directory to start searching from
+   * @param {Object} [opts={}] - optional; may contain TRUSTIFY_DA_WORKSPACE_DIR
+   * @returns {string|null} The directory containing the lock file, or null
+   * @protected
+   */
+    protected _isWorkspaceRoot(dir: any): string | null;
+    _findLockFileDir(manifestDir: any, opts?: {}): string | null;
+    /**
    * @param {string} manifestDir - The base directory where the manifest is located
+   * @param {Object} [opts={}] - optional; may contain TRUSTIFY_DA_WORKSPACE_DIR
    * @returns {boolean} True if the lock file exists
    */
-    validateLockFile(manifestDir: string): boolean;
+    validateLockFile(manifestDir: string, opts?: Object): boolean;
     /**
    * Provides content and content type for stack analysis
    * @param {string} manifestPath - The manifest path or name
    * @param {Object} [opts={}] - Optional configuration options
    * @returns {Provided} The provided data for stack analysis
    */
-    provideStack(manifestPath: string, opts?: any): Provided;
+    provideStack(manifestPath: string, opts?: Object): Provided;
     /**
    * Provides content and content type for component analysis
    * @param {string} manifestPath - Path to package.json for component report
    * @param {Object} [opts={}] - Optional configuration options
    * @returns {Provided} The provided data for component analysis
    */
-    provideComponent(manifestPath: string, opts?: any): Provided;
+    provideComponent(manifestPath: string, opts?: Object): Provided;
+    /**
+     * Read license from manifest (package.json). Reused by npm, pnpm, yarn.
+     * @param {string} manifestPath - path to package.json
+     * @returns {string|null}
+     */
+    readLicenseFromManifest(manifestPath: string): string | null;
     /**
    * Builds the dependency tree for the project
    * @param {boolean} includeTransitive - Whether to include transitive dependencies
+   * @param {Object} [opts={}] - Configuration options; when `TRUSTIFY_DA_WORKSPACE_DIR` is set, commands run from workspace root
    * @returns {Object} The dependency tree
    * @protected
    */
-    protected _buildDependencyTree(includeTransitive: boolean): any;
+    protected _buildDependencyTree(includeTransitive: boolean, opts?: Object): Object;
     /**
    * Recursively builds the Sbom from the JSON that npm listing returns
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The current dependency tree
    * @protected
    */
-    protected _addDependenciesToSbom(sbom: Sbom, depTree: any): void;
+    protected _addDependenciesToSbom(sbom: Sbom, depTree: Object): void;
     /**
    * Extracts root dependencies from the dependency tree
    * @param {Object} depTree - The dependency tree object
    * @returns {Map<string, PackageURL>} Map of dependency names to their PackageURL objects
    * @protected
    */
-    protected _getRootDependencies(depTree: any): Map<string, PackageURL>;
+    protected _getRootDependencies(depTree: Object): Map<string, PackageURL>;
     /**
    * Gets the version of the package manager
    * @returns {string} The version string of the package manager
@@ -113,6 +141,12 @@ export default class Base_javascript {
    */
     protected _version(): string;
     /**
+   * Creates or updates the lock file for the package manager
+   * @param {string} manifestDir - Directory containing the manifest file
+   * @protected
+   */
+    protected _createLockFile(manifestDir: string): void;
+    /**
    * Parses the dependency tree output
    * @param {string} output - The output to parse
    * @returns {string} The parsed output
@@ -121,7 +155,6 @@ export default class Base_javascript {
     protected _parseDepTreeOutput(output: string): string;
     #private;
 }
-export type Provider = import('../provider.js').Provider;
-export type Provided = import('../provider.js').Provided;
+export type Provided = any;
 import Manifest from './manifest.js';
 import Sbom from '../sbom.js';