@trustify-da/trustify-da-javascript-client 0.3.0-ea.e645720 → 0.3.0-ea.ec6824b

package/dist/src/providers/base_pyproject.d.ts

@@ -13,7 +13,7 @@ export default class Base_pyproject {
      * @param {Object} [opts={}]
      * @returns {boolean}
      */
-    validateLockFile(manifestDir: string, opts?: any): boolean;
+    validateLockFile(manifestDir: string, opts?: Object): boolean;
     /**
      * Walk up from manifestDir to find the directory containing the lock file.
      * Follows the same pattern as Base_javascript._findLockFileDir().
@@ -22,7 +22,7 @@ export default class Base_pyproject {
      * @returns {string|null}
      * @protected
      */
-    protected _findLockFileDir(manifestDir: string, opts?: any): string | null;
+    protected _findLockFileDir(manifestDir: string, opts?: Object): string | null;
     /**
      * Detect workspace root boundaries.
      * Currently only uv has native workspace support ([tool.uv.workspace] in pyproject.toml).
@@ -44,13 +44,13 @@ export default class Base_pyproject {
      * @param {Object} [opts={}]
      * @returns {Promise<Provided>}
      */
-    provideStack(manifest: string, opts?: any): Promise<Provided>;
+    provideStack(manifest: string, opts?: Object): Promise<Provided>;
     /**
      * @param {string} manifest - path to pyproject.toml
      * @param {Object} [opts={}]
      * @returns {Promise<Provided>}
      */
-    provideComponent(manifest: string, opts?: any): Promise<Provided>;
+    provideComponent(manifest: string, opts?: Object): Promise<Provided>;
     /**
      * @returns {string}
      * @protected
@@ -61,6 +61,11 @@ export default class Base_pyproject {
      * @protected
      */
     protected _cmdName(): string;
+    /**
+     * Returns the package manager name (e.g. pip, poetry, uv)
+     * @returns {string}
+     */
+    packageManagerName(): string;
     /**
      * Resolve dependencies using the tool-specific command and parser.
      *
@@ -72,7 +77,7 @@ export default class Base_pyproject {
      * @returns {Promise<DependencyData>}
      * @protected
      */
-    protected _getDependencyData(manifestDir: string, workspaceDir: string, parsed: object, opts: any): Promise<DependencyData>;
+    protected _getDependencyData(manifestDir: string, workspaceDir: string, parsed: object, opts: Object): Promise<DependencyData>;
     /**
      * Canonicalize a Python package name per PEP 503.
      * @param {string} name

package/dist/src/providers/base_pyproject.js

@@ -145,6 +145,13 @@ export default class Base_pyproject {
     _cmdName() {
         throw new TypeError('_cmdName must be implemented');
     }
+    /**
+     * Returns the package manager name (e.g. pip, poetry, uv)
+     * @returns {string}
+     */
+    packageManagerName() {
+        return this._cmdName();
+    }
     /**
      * Resolve dependencies using the tool-specific command and parser.
      *

package/dist/src/providers/golang_gomodules.d.ts

@@ -13,9 +13,10 @@ declare namespace _default {
     export { provideComponent };
     export { provideStack };
     export { readLicenseFromManifest };
+    export function packageManagerName(): string;
 }
 export default _default;
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 export type Package = {
     name: string;
     version: string;

package/dist/src/providers/golang_gomodules.js

@@ -6,7 +6,7 @@ import Sbom from '../sbom.js';
 import { getCustom, getCustomPath, invokeCommand } from "../tools.js";
 import { filterManifestPathsByDiscoveryIgnore, resolveWorkspaceDiscoveryIgnore } from '../workspace.js';
 import { getParser, getRequireQuery } from './gomod_parser.js';
-export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest };
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'go'; } };
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /** @typedef {{name: string, version: string}} Package */

package/dist/src/providers/java_gradle_groovy.d.ts

@@ -3,5 +3,5 @@ export default class Java_gradle_groovy extends Java_gradle {
     _parseAliasForLibsNotation(alias: any): any;
     _extractDepToBeIgnored(dep: any): any;
 }
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 import Java_gradle from './java_gradle.js';

package/dist/src/providers/java_gradle_kotlin.d.ts

@@ -7,5 +7,5 @@ export default class Java_gradle_kotlin extends Java_gradle {
     _parseAliasForLibsNotation(alias: any): any;
     _extractDepToBeIgnored(dep: any): string | null;
 }
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 import Java_gradle from './java_gradle.js';

package/dist/src/providers/java_maven.d.ts

@@ -51,8 +51,8 @@ export default class Java_maven extends Base_java {
     createSbomFileFromTextFormat(textGraphList: string, ignoredDeps: [string], opts: any, manifestPath: string): string;
     #private;
 }
-export type Java_maven = import("../provider").Provider;
-export type Provided = import("../provider").Provided;
+export type Java_maven = any;
+export type Provided = any;
 export type Package = {
     name: string;
     version: string;

package/dist/src/providers/java_maven.js

@@ -181,6 +181,7 @@ export default class Java_maven extends Base_java {
         /** @type [Dependency] */
         let dependencies = this.#getDependencies(tmpEffectivePom)
             .filter(d => !this.#dependencyIn(d, ignored));
+        dependencies = this.#resolveVersionRanges(dependencies, manifestPath, opts);
         let sbom = new Sbom();
         let rootDependency = this.#getRootFromPom(tmpEffectivePom, manifestPath);
         let purlRoot = this.toPurl(rootDependency.groupId, rootDependency.artifactId, rootDependency.version);
@@ -289,6 +290,77 @@ export default class Java_maven extends Base_java {
     #dependencyIn(dep, deps) {
         return deps.filter(d => dep.artifactId === d.artifactId && dep.groupId === d.groupId && dep.scope === d.scope).length > 0;
     }
+    /**
+     * Returns true if the given version string is a Maven version range
+     * (starts with '[' or '(').
+     * @param {string} version
+     * @returns {boolean}
+     * @private
+     */
+    #isVersionRange(version) {
+        return typeof version === 'string' && (version.startsWith('[') || version.startsWith('('));
+    }
+    /**
+     * Resolves Maven version ranges in the given dependency list by running
+     * maven-dependency-plugin:tree and reading the concrete versions it selects.
+     * If no dependency uses a version range, returns the list unchanged.
+     * @param {Dependency[]} dependencies
+     * @param {string} manifestPath
+     * @param {object} opts
+     * @returns {Dependency[]}
+     * @private
+     */
+    #resolveVersionRanges(dependencies, manifestPath, opts = {}) {
+        // short-circuit if no dependency has a version range
+        if (!dependencies.some(dep => this.#isVersionRange(dep.version))) {
+            return dependencies;
+        }
+        const mvn = this.selectToolBinary(manifestPath, opts);
+        const mvnArgs = JSON.parse(getCustom('TRUSTIFY_DA_MVN_ARGS', '[]', opts));
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'trustify_da_range_'));
+        const tmpDepTree = path.join(tmpDir, 'mvn_deptree_ranges.txt');
+        try {
+            this._invokeCommand(mvn, [
+                '-q',
+                'org.apache.maven.plugins:maven-dependency-plugin:3.6.0:tree',
+                '-Dscope=compile',
+                '-DoutputType=text',
+                `-DoutputFile=${tmpDepTree}`,
+                ...mvnArgs
+            ], { cwd: path.dirname(manifestPath) });
+            const content = fs.readFileSync(tmpDepTree);
+            const lines = content.toString().split(EOL).filter(l => l.trim() !== '');
+            // Build a map of groupId:artifactId -> resolved version from depth-1 entries
+            /** @type {Map<string, string>} */
+            const resolvedVersions = new Map();
+            for (const line of lines) {
+                if (this._getDepth(line) === 1) {
+                    const purl = this.parseDep(line);
+                    resolvedVersions.set(`${purl.namespace}:${purl.name}`, purl.version);
+                }
+            }
+            // Replace version ranges with resolved concrete versions
+            return dependencies.map(dep => {
+                if (this.#isVersionRange(dep.version)) {
+                    const key = `${dep.groupId}:${dep.artifactId}`;
+                    const resolved = resolvedVersions.get(key);
+                    if (resolved) {
+                        return { ...dep, version: resolved };
+                    }
+                }
+                return dep;
+            });
+        }
+        catch (error) {
+            if (process.env["TRUSTIFY_DA_DEBUG"] === "true") {
+                console.error("Failed to resolve Maven version ranges: " + error.message);
+            }
+            return dependencies;
+        }
+        finally {
+            fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
+    }
 }
 const DEFAULT_MAVEN_DISCOVERY_IGNORE = [
     '**/target/**',

package/dist/src/providers/javascript_bun.d.ts

@@ -0,0 +1,10 @@
+export default class Javascript_bun extends Base_javascript {
+    _listCmdArgs(): void;
+    _buildDependencyTree(includeTransitive: any, opts?: {}): {
+        name: any;
+        version: any;
+        dependencies: {};
+    };
+    #private;
+}
+import Base_javascript from './base_javascript.js';

package/dist/src/providers/javascript_bun.js

@@ -0,0 +1,100 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { parse } from 'jsonc-parser';
+import Base_javascript from './base_javascript.js';
+export default class Javascript_bun extends Base_javascript {
+    _lockFileName() {
+        return "bun.lock";
+    }
+    _cmdName() {
+        return "bun";
+    }
+    _listCmdArgs() {
+        throw new Error("not supported by Bun");
+    }
+    _updateLockFileCmdArgs() {
+        return ['install', '--lockfile-only'];
+    }
+    _buildDependencyTree(includeTransitive, opts = {}) {
+        this._version();
+        const manifestDir = path.dirname(this._getManifest().manifestPath);
+        const lockDir = this._findLockFileDir(manifestDir, opts) || manifestDir;
+        this._createLockFile(lockDir);
+        const lockContent = fs.readFileSync(path.join(lockDir, 'bun.lock'), 'utf-8');
+        const lockData = parse(lockContent);
+        const packages = lockData.packages || {};
+        const memberName = this._getManifest().name;
+        const workspaceEntry = this.#findWorkspaceEntry(lockData, lockDir, manifestDir, memberName);
+        const directDeps = workspaceEntry?.dependencies || {};
+        const tree = { name: memberName, version: this._getManifest().version, dependencies: {} };
+        const visited = new Set();
+        for (const depName of Object.keys(directDeps)) {
+            const resolved = this.#resolvePackage(depName, '', packages);
+            if (resolved) {
+                tree.dependencies[depName] = this.#buildNode(depName, resolved, packages, includeTransitive, visited);
+            }
+        }
+        return tree;
+    }
+    #findWorkspaceEntry(lockData, lockDir, manifestDir, memberName) {
+        const workspaces = lockData.workspaces || {};
+        const relPath = path.relative(lockDir, path.resolve(manifestDir));
+        if (!relPath || relPath === '.') {
+            return workspaces[''] || {};
+        }
+        const normalised = relPath.split(path.sep).join('/');
+        if (workspaces[normalised]) {
+            return workspaces[normalised];
+        }
+        for (const [wsPath, entry] of Object.entries(workspaces)) {
+            if (entry.name === memberName && wsPath !== '') {
+                return entry;
+            }
+        }
+        return workspaces[''] || {};
+    }
+    #resolvePackage(depName, parentKey, packages) {
+        if (parentKey) {
+            const scopedKey = `${parentKey}/${depName}`;
+            if (packages[scopedKey]) {
+                return packages[scopedKey];
+            }
+        }
+        return packages[depName] || null;
+    }
+    #buildNode(depName, resolved, packages, includeTransitive, visited) {
+        const resolvedId = Array.isArray(resolved) ? resolved[0] : resolved;
+        const version = this.#extractVersion(resolvedId);
+        const node = { version };
+        if (!includeTransitive) {
+            return node;
+        }
+        const metadata = Array.isArray(resolved) ? (resolved[2] || {}) : {};
+        const subDeps = metadata.dependencies || {};
+        if (Object.keys(subDeps).length > 0) {
+            const visitKey = `${depName}@${version}`;
+            if (visited.has(visitKey)) {
+                return node;
+            }
+            visited.add(visitKey);
+            node.dependencies = {};
+            for (const subName of Object.keys(subDeps)) {
+                const subResolved = this.#resolvePackage(subName, depName, packages);
+                if (subResolved) {
+                    node.dependencies[subName] = this.#buildNode(subName, subResolved, packages, true, visited);
+                }
+            }
+        }
+        return node;
+    }
+    #extractVersion(resolvedId) {
+        if (typeof resolvedId !== 'string') {
+            return '0.0.0';
+        }
+        const atIdx = resolvedId.lastIndexOf('@');
+        if (atIdx > 0) {
+            return resolvedId.substring(atIdx + 1);
+        }
+        return '0.0.0';
+    }
+}

package/dist/src/providers/javascript_npm.d.ts

@@ -1,5 +1,10 @@
 export default class Javascript_npm extends Base_javascript {
     _listCmdArgs(includeTransitive: any): string[];
-    _buildDependencyTree(includeTransitive: any, opts?: {}): any;
+    _buildDependencyTree(includeTransitive: any, opts?: {}): Object | {
+        name: any;
+        version: any;
+        dependencies: any;
+        optionalDependencies: any;
+    };
 }
 import Base_javascript from './base_javascript.js';

package/dist/src/providers/processors/yarn_berry_processor.d.ts

@@ -29,13 +29,13 @@ export default class Yarn_berry_processor extends Yarn_processor {
    * @param {Object} depTree - The dependency tree object
    * @returns {Map<string, PackageURL>} Map of dependency names to their PackageURL objects
    */
-    getRootDependencies(depTree: any): Map<string, PackageURL>;
+    getRootDependencies(depTree: Object): Map<string, PackageURL>;
     /**
    * Adds dependencies to the SBOM
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The dependency tree object
    */
-    addDependenciesToSbom(sbom: Sbom, depTree: any): void;
+    addDependenciesToSbom(sbom: Sbom, depTree: Object): void;
     #private;
 }
 import Yarn_processor from "./yarn_processor.js";

package/dist/src/providers/processors/yarn_classic_processor.d.ts

@@ -25,13 +25,13 @@ export default class Yarn_classic_processor extends Yarn_processor {
    * @param {Object} depTree - The dependency tree object
    * @returns {Map<string, PackageURL>} Map of dependency names to their PackageURL objects
    */
-    getRootDependencies(depTree: any): Map<string, PackageURL>;
+    getRootDependencies(depTree: Object): Map<string, PackageURL>;
     /**
    * Adds dependencies to the SBOM
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The dependency tree object
    */
-    addDependenciesToSbom(sbom: Sbom, depTree: any): void;
+    addDependenciesToSbom(sbom: Sbom, depTree: Object): void;
     #private;
 }
 import Yarn_processor from "./yarn_processor.js";

package/dist/src/providers/python_controller.js

@@ -19,6 +19,53 @@ function getPipShowOutput(depNames) {
         throw new Error('fail invoking \'pip show\' to fetch metadata for all installed packages in environment', { cause: error });
     }
 }
+/**
+ * Get pip inspect output from env var override or by invoking pip inspect.
+ * Returns null if pip inspect is unavailable (pip < 22.2) or if freeze/show
+ * env vars are set without an inspect override (to avoid inconsistent data).
+ * @return {string|null} pip inspect JSON output, or null on failure
+ */
+function getPipInspectOutput() {
+    if (environmentVariableIsPopulated("TRUSTIFY_DA_PIP_INSPECT")) {
+        return new Buffer.from(process.env["TRUSTIFY_DA_PIP_INSPECT"], 'base64').toString('ascii');
+    }
+    if (environmentVariableIsPopulated("TRUSTIFY_DA_PIP_FREEZE") || environmentVariableIsPopulated("TRUSTIFY_DA_PIP_SHOW")) {
+        return null;
+    }
+    try {
+        return invokeCommand(this.pathToPipBin, ['inspect']).toString();
+    }
+    catch (error) {
+        console.warn('pip inspect is not available (requires pip 22.2+), SBOM will be generated without hashes');
+        return null;
+    }
+}
+/**
+ * Parse pip inspect JSON output and build a hash lookup map.
+ * @param {string|null} inspectOutput - raw pip inspect JSON string
+ * @return {Map<string, Array<{alg: string, content: string}>>} map of lowercase package name to hashes
+ */
+function parsePipInspectHashes(inspectOutput) {
+    if (!inspectOutput) {
+        return new Map();
+    }
+    try {
+        let inspectData = JSON.parse(inspectOutput);
+        let hashMap = new Map();
+        for (let pkg of (inspectData.installed || [])) {
+            let name = pkg.metadata?.name;
+            let sha256 = pkg.download_info?.archive_info?.hashes?.sha256;
+            if (name && sha256) {
+                hashMap.set(name.toLowerCase(), [{ alg: "SHA-256", content: sha256 }]);
+            }
+        }
+        return hashMap;
+    }
+    catch (error) {
+        console.warn('Failed to parse pip inspect output, SBOM will be generated without hashes');
+        return new Map();
+    }
+}
 /** @typedef {{name: string, version: string, dependencies: DependencyEntry[], hashes?: Array<{alg: string, content: string}>}} DependencyEntry */
 export default class Python_controller {
     pythonEnvDir;
@@ -225,6 +272,8 @@ export default class Python_controller {
                 CachedEnvironmentDeps[packageName.replace("_", "-")] = pipDepTreeEntryForCache;
             });
         }
+        const inspectOutput = getPipInspectOutput.call(this);
+        const hashMap = parsePipInspectHashes(inspectOutput);
         parsedRequirements.forEach(({ name: depName, version: manifestVersion, hasMarker }) => {
             if (hasMarker && CachedEnvironmentDeps[depName.toLowerCase()] === undefined) {
                 return;
@@ -247,7 +296,7 @@ export default class Python_controller {
             }
             let path = [];
             path.push(depName.toLowerCase());
-            bringAllDependencies(dependencies, depName, CachedEnvironmentDeps, includeTransitive, path, usePipDepTree);
+            bringAllDependencies(dependencies, depName, CachedEnvironmentDeps, includeTransitive, path, usePipDepTree, hashMap);
         });
         dependencies.sort((dep1, dep2) => {
             const DEP1 = dep1.name.toLowerCase();
@@ -327,8 +376,9 @@ function getDepsList(record) {
  * @param includeTransitive
  * @param usePipDepTree
  * @param {[string]}path array representing the path of the current branch in dependency tree, starting with a root dependency - that is - a given dependency in requirements.txt
+ * @param {Map<string, Array<{alg: string, content: string}>>} hashMap - map of lowercase package name to hashes
  */
-function bringAllDependencies(dependencies, dependencyName, cachedEnvironmentDeps, includeTransitive, path, usePipDepTree) {
+function bringAllDependencies(dependencies, dependencyName, cachedEnvironmentDeps, includeTransitive, path, usePipDepTree, hashMap) {
     if (dependencyName?.trim() === "") {
         return;
     }
@@ -350,7 +400,11 @@ function bringAllDependencies(dependencies, dependencyName, cachedEnvironmentDep
         directDeps = record.dependencies;
     }
     let targetDeps = [];
+    let hashes = hashMap?.get(depName.toLowerCase());
     let entry = { "name": depName, "version": version, "dependencies": [] };
+    if (hashes) {
+        entry.hashes = hashes;
+    }
     dependencies.push(entry);
     directDeps.forEach((dep) => {
         let depArray = [];
@@ -360,7 +414,7 @@ function bringAllDependencies(dependencies, dependencyName, cachedEnvironmentDep
             depArray.push(dep.toLowerCase());
             if (includeTransitive) {
                 // send to recurrsion the array of all deps in path + the current dependency name which is not on the path.
-                bringAllDependencies(targetDeps, dep, cachedEnvironmentDeps, includeTransitive, path.concat(depArray), usePipDepTree);
+                bringAllDependencies(targetDeps, dep, cachedEnvironmentDeps, includeTransitive, path.concat(depArray), usePipDepTree, hashMap);
             }
         }
         // sort ra

package/dist/src/providers/python_pip.d.ts

@@ -4,6 +4,7 @@ declare namespace _default {
     export { provideComponent };
     export { provideStack };
     export { readLicenseFromManifest };
+    export function packageManagerName(): string;
 }
 export default _default;
 export type DependencyEntry = {

package/dist/src/providers/python_pip.js

@@ -5,7 +5,7 @@ import Sbom from '../sbom.js';
 import { environmentVariableIsPopulated, getCustom, getCustomPath, invokeCommand } from "../tools.js";
 import Python_controller from './python_controller.js';
 import { getParser, getIgnoreQuery, getPinnedVersionQuery } from './requirements_parser.js';
-export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest };
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'pip'; } };
 /** @typedef {{name: string, version: string, dependencies: DependencyEntry[], hashes?: Array<{alg: string, content: string}>}} DependencyEntry */
 /**
  * @type {string} ecosystem for python-pip is 'pip'

package/dist/src/providers/python_pip_pyproject.js

@@ -76,7 +76,9 @@ export default class Python_pip_pyproject extends Base_pyproject {
             let name = pkg.metadata.name;
             let version = pkg.metadata.version;
             let key = this._canonicalize(name);
-            graph.set(key, { name, version, children: [] });
+            let sha256 = pkg.download_info?.archive_info?.hashes?.sha256;
+            let hashes = sha256 ? [{ alg: "SHA-256", content: sha256 }] : undefined;
+            graph.set(key, { name, version, children: [], hashes });
         }
         for (let pkg of nonRootPackages) {
             let key = this._canonicalize(pkg.metadata.name);

package/dist/src/providers/python_poetry.d.ts

@@ -1,4 +1,5 @@
 export default class Python_poetry extends Base_pyproject {
+    _verifyPoetryAccessible(poetryBin: any): void;
     /**
      * @param {string} manifestDir
      * @param {string} _workspaceDir - unused (poetry has no workspace support)
@@ -6,7 +7,7 @@ export default class Python_poetry extends Base_pyproject {
      * @param {Object} opts
      * @returns {Promise<{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}>}
      */
-    _getDependencyData(manifestDir: string, _workspaceDir: string, parsed: object, opts: any): Promise<{
+    _getDependencyData(manifestDir: string, _workspaceDir: string, parsed: object, opts: Object): Promise<{
         directDeps: string[];
         graph: Map<string, {
             name: string;
@@ -18,17 +19,17 @@ export default class Python_poetry extends Base_pyproject {
      * Get poetry show --tree output.
      * @param {string} manifestDir
      * @param {boolean} hasDevGroup
-     * @param {Object} opts
+     * @param {string} poetryBin
      * @returns {string}
      */
-    _getPoetryShowTreeOutput(manifestDir: string, hasDevGroup: boolean, opts: any): string;
+    _getPoetryShowTreeOutput(manifestDir: string, hasDevGroup: boolean, poetryBin: string): string;
     /**
      * Get poetry show --all output (flat list with resolved versions).
      * @param {string} manifestDir
-     * @param {Object} opts
+     * @param {string} poetryBin
      * @returns {string}
      */
-    _getPoetryShowAllOutput(manifestDir: string, opts: any): string;
+    _getPoetryShowAllOutput(manifestDir: string, poetryBin: string): string;
     /**
      * Parse poetry show --all output into a version map.
      * Lines look like: "name         (!) 1.2.3  Description text..."
@@ -46,29 +47,51 @@ export default class Python_poetry extends Base_pyproject {
      *   → transitiveMarkers['click']['colorama'] = "sys_platform == 'win32'"
      * @param {string|null} lockDir
      * @param {object} parsed - parsed pyproject.toml
-     * @returns {{directMarkers: Map<string, string>, transitiveMarkers: Map<string, Map<string, string>>}}
+     * @returns {{directMarkers: Map<string, string>, transitiveMarkers: Map<string, Map<string, string>>, hashMap: Map<string, Array<{alg: string, content: string}>>}}
      */
     _extractMarkerData(lockDir: string | null, parsed: object): {
         directMarkers: Map<string, string>;
         transitiveMarkers: Map<string, Map<string, string>>;
+        hashMap: Map<string, Array<{
+            alg: string;
+            content: string;
+        }>>;
     };
+    /**
+     * Extract a SHA-256 hex digest from poetry.lock files array.
+     * Prefers the sdist (.tar.gz) hash; falls back to the first wheel hash.
+     * @param {Array<{file: string, hash: string}>} [files]
+     * @returns {string|null}
+     */
+    _extractSha256FromFiles(files?: Array<{
+        file: string;
+        hash: string;
+    }>): string | null;
     /**
      * Parse poetry show --tree output into a dependency graph structure.
      *
      * @param {string} treeOutput
      * @param {Map<string, string>} versionMap - canonical name -> resolved version
-     * @param {{directMarkers: Map<string, string>, transitiveMarkers: Map<string, Map<string, string>>}} markerData
-     * @returns {{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}}
+     * @param {{directMarkers: Map<string, string>, transitiveMarkers: Map<string, Map<string, string>>, hashMap: Map<string, Array<{alg: string, content: string}>>}} markerData
+     * @returns {{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[], hashes?: Array<{alg: string, content: string}>}>}}
      */
     _parsePoetryTree(treeOutput: string, versionMap: Map<string, string>, markerData: {
         directMarkers: Map<string, string>;
         transitiveMarkers: Map<string, Map<string, string>>;
+        hashMap: Map<string, Array<{
+            alg: string;
+            content: string;
+        }>>;
     }): {
         directDeps: string[];
         graph: Map<string, {
             name: string;
             version: string;
             children: string[];
+            hashes?: Array<{
+                alg: string;
+                content: string;
+            }>;
         }>;
     };
 }