@trustify-da/trustify-da-javascript-client 0.3.0-ea.e645720 → 0.3.0-ea.ec6824b

package/dist/src/providers/python_poetry.js

@@ -32,6 +32,17 @@ export default class Python_poetry extends Base_pyproject {
     _cmdName() {
         return 'poetry';
     }
+    _verifyPoetryAccessible(poetryBin) {
+        try {
+            invokeCommand(poetryBin, ['--version']);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT') {
+                throw new Error(`poetry is not accessible at "${poetryBin}"`, { cause: error });
+            }
+            throw new Error('failed to check for poetry binary', { cause: error });
+        }
+    }
     /**
      * @param {string} manifestDir
      * @param {string} _workspaceDir - unused (poetry has no workspace support)
@@ -41,9 +52,15 @@ export default class Python_poetry extends Base_pyproject {
      */
     // eslint-disable-next-line no-unused-vars
     async _getDependencyData(manifestDir, _workspaceDir, parsed, opts) {
+        let poetryBin = getCustomPath('poetry', opts);
+        let envBypass = environmentVariableIsPopulated('TRUSTIFY_DA_POETRY_SHOW_TREE')
+            && environmentVariableIsPopulated('TRUSTIFY_DA_POETRY_SHOW_ALL');
+        if (!envBypass) {
+            this._verifyPoetryAccessible(poetryBin);
+        }
         let hasDevGroup = !!(parsed.tool?.poetry?.group?.dev || parsed.tool?.poetry?.['dev-dependencies']);
-        let treeOutput = this._getPoetryShowTreeOutput(manifestDir, hasDevGroup, opts);
-        let showAllOutput = this._getPoetryShowAllOutput(manifestDir, opts);
+        let treeOutput = this._getPoetryShowTreeOutput(manifestDir, hasDevGroup, poetryBin);
+        let showAllOutput = this._getPoetryShowAllOutput(manifestDir, poetryBin);
         let versionMap = this._parsePoetryShowAll(showAllOutput);
         let lockDir = this._findLockFileDir(manifestDir, opts);
         let markerData = this._extractMarkerData(lockDir, parsed);
@@ -53,14 +70,13 @@ export default class Python_poetry extends Base_pyproject {
      * Get poetry show --tree output.
      * @param {string} manifestDir
      * @param {boolean} hasDevGroup
-     * @param {Object} opts
+     * @param {string} poetryBin
      * @returns {string}
      */
-    _getPoetryShowTreeOutput(manifestDir, hasDevGroup, opts) {
+    _getPoetryShowTreeOutput(manifestDir, hasDevGroup, poetryBin) {
         if (environmentVariableIsPopulated('TRUSTIFY_DA_POETRY_SHOW_TREE')) {
             return Buffer.from(process.env['TRUSTIFY_DA_POETRY_SHOW_TREE'], 'base64').toString('utf-8');
         }
-        let poetryBin = getCustomPath('poetry', opts);
         let args = ['show', '--tree', '--no-ansi'];
         if (hasDevGroup) {
             args.push('--without', 'dev');
@@ -70,14 +86,13 @@ export default class Python_poetry extends Base_pyproject {
     /**
      * Get poetry show --all output (flat list with resolved versions).
      * @param {string} manifestDir
-     * @param {Object} opts
+     * @param {string} poetryBin
      * @returns {string}
      */
-    _getPoetryShowAllOutput(manifestDir, opts) {
+    _getPoetryShowAllOutput(manifestDir, poetryBin) {
         if (environmentVariableIsPopulated('TRUSTIFY_DA_POETRY_SHOW_ALL')) {
             return Buffer.from(process.env['TRUSTIFY_DA_POETRY_SHOW_ALL'], 'base64').toString('utf-8');
         }
-        let poetryBin = getCustomPath('poetry', opts);
         return invokeCommand(poetryBin, ['show', '--no-ansi', '--all'], { cwd: manifestDir }).toString();
     }
     /**
@@ -111,11 +126,12 @@ export default class Python_poetry extends Base_pyproject {
      *   → transitiveMarkers['click']['colorama'] = "sys_platform == 'win32'"
      * @param {string|null} lockDir
      * @param {object} parsed - parsed pyproject.toml
-     * @returns {{directMarkers: Map<string, string>, transitiveMarkers: Map<string, Map<string, string>>}}
+     * @returns {{directMarkers: Map<string, string>, transitiveMarkers: Map<string, Map<string, string>>, hashMap: Map<string, Array<{alg: string, content: string}>>}}
      */
     _extractMarkerData(lockDir, parsed) {
         let directMarkers = new Map();
         let transitiveMarkers = new Map();
+        let hashMap = new Map();
         // Extract markers from PEP 621 dependency strings: "name[extras]>=ver ; marker"
         let deps = parsed.project?.dependencies || [];
         for (let dep of deps) {
@@ -142,18 +158,40 @@ export default class Python_poetry extends Base_pyproject {
                             transitiveMarkers.get(pkgKey).set(this._canonicalize(depName), markers);
                         }
                     }
+                    let sha256Hex = this._extractSha256FromFiles(pkg.files);
+                    if (sha256Hex) {
+                        hashMap.set(pkgKey, [{ alg: "SHA-256", content: sha256Hex }]);
+                    }
                 }
             }
         }
-        return { directMarkers, transitiveMarkers };
+        return { directMarkers, transitiveMarkers, hashMap };
+    }
+    /**
+     * Extract a SHA-256 hex digest from poetry.lock files array.
+     * Prefers the sdist (.tar.gz) hash; falls back to the first wheel hash.
+     * @param {Array<{file: string, hash: string}>} [files]
+     * @returns {string|null}
+     */
+    _extractSha256FromFiles(files) {
+        if (!Array.isArray(files) || files.length === 0) {
+            return null;
+        }
+        let sdist = files.find(f => f.file.endsWith('.tar.gz'));
+        let entry = sdist || files[0];
+        let hash = entry.hash;
+        if (hash && hash.startsWith('sha256:')) {
+            return hash.slice(7);
+        }
+        return null;
     }
     /**
      * Parse poetry show --tree output into a dependency graph structure.
      *
      * @param {string} treeOutput
      * @param {Map<string, string>} versionMap - canonical name -> resolved version
-     * @param {{directMarkers: Map<string, string>, transitiveMarkers: Map<string, Map<string, string>>}} markerData
-     * @returns {{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}}
+     * @param {{directMarkers: Map<string, string>, transitiveMarkers: Map<string, Map<string, string>>, hashMap: Map<string, Array<{alg: string, content: string}>>}} markerData
+     * @returns {{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[], hashes?: Array<{alg: string, content: string}>}>}}
      */
     _parsePoetryTree(treeOutput, versionMap, markerData) {
         let lines = treeOutput.split(/\r?\n/);
@@ -179,7 +217,12 @@ export default class Python_poetry extends Base_pyproject {
                 }
                 directDeps.push(key);
                 if (!graph.has(key)) {
-                    graph.set(key, { name, version, children: [] });
+                    let entry = { name, version, children: [] };
+                    let hashes = markerData.hashMap.get(key);
+                    if (hashes) {
+                        entry.hashes = hashes;
+                    }
+                    graph.set(key, entry);
                 }
                 currentDirectDep = key;
                 stack = [{ key, depth: -1 }];
@@ -223,7 +266,12 @@ export default class Python_poetry extends Base_pyproject {
                 throw new Error(`poetry: package '${depName}' has no resolved version`);
             }
             if (!graph.has(depKey)) {
-                graph.set(depKey, { name: depName, version, children: [] });
+                let entry = { name: depName, version, children: [] };
+                let hashes = markerData.hashMap.get(depKey);
+                if (hashes) {
+                    entry.hashes = hashes;
+                }
+                graph.set(depKey, entry);
             }
             if (parentKey) {
                 let parentEntry = graph.get(parentKey);

package/dist/src/providers/python_uv.d.ts

@@ -13,27 +13,18 @@ export function discoverUvWorkspaceMembers(workspaceRoot: string, opts?: {
 }): Promise<string[]>;
 export default class Python_uv extends Base_pyproject {
     /**
-     * @param {string} manifestDir - directory containing the target pyproject.toml
-     * @param {string} workspaceDir - workspace root (for resolving editable install paths)
-     * @param {object} parsed - parsed pyproject.toml
-     * @param {Object} opts
-     * @returns {Promise<{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}>}
+     * Parse uv.lock and attach SHA-256 hashes to graph entries.
+     * @param {string} lockFilePath - path to uv.lock
+     * @param {Map<string, import('./base_pyproject.js').GraphEntry>} graph
      */
-    _getDependencyData(manifestDir: string, workspaceDir: string, parsed: object, opts: any): Promise<{
-        directDeps: string[];
-        graph: Map<string, {
-            name: string;
-            version: string;
-            children: string[];
-        }>;
-    }>;
+    _attachHashesFromLockFile(lockFilePath: string, graph: Map<string, import("./base_pyproject.js").GraphEntry>): Promise<void>;
     /**
      * Get the uv export output, either from env var or by running the command.
      * @param {string} manifestDir
      * @param {Object} opts
      * @returns {string}
      */
-    _getUvExportOutput(manifestDir: string, opts: any): string;
+    _getUvExportOutput(manifestDir: string, opts: Object): string;
     /**
      * Parse uv export output into a dependency graph using tree-sitter-requirements
      * for package/version extraction and string parsing for "# via" comments.

package/dist/src/providers/python_uv.js

@@ -21,12 +21,54 @@ export default class Python_uv extends Base_pyproject {
      * @param {string} workspaceDir - workspace root (for resolving editable install paths)
      * @param {object} parsed - parsed pyproject.toml
      * @param {Object} opts
-     * @returns {Promise<{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}>}
+     * @returns {Promise<{directDeps: string[], graph: Map<string, import('./base_pyproject.js').GraphEntry>}>}
      */
     async _getDependencyData(manifestDir, workspaceDir, parsed, opts) {
         let projectName = this._getProjectName(parsed);
         let uvOutput = this._getUvExportOutput(manifestDir, opts);
-        return this._parseUvExport(uvOutput, projectName, workspaceDir);
+        let { directDeps, graph } = await this._parseUvExport(uvOutput, projectName, workspaceDir);
+        await this._attachHashesFromLockFile(path.join(workspaceDir, 'uv.lock'), graph);
+        return { directDeps, graph };
+    }
+    /**
+     * Parse uv.lock and attach SHA-256 hashes to graph entries.
+     * @param {string} lockFilePath - path to uv.lock
+     * @param {Map<string, import('./base_pyproject.js').GraphEntry>} graph
+     */
+    async _attachHashesFromLockFile(lockFilePath, graph) {
+        let lockContent;
+        try {
+            lockContent = await fs.promises.readFile(lockFilePath, 'utf-8');
+        }
+        catch {
+            return;
+        }
+        let parsed;
+        try {
+            parsed = parseToml(lockContent);
+        }
+        catch {
+            return;
+        }
+        let packages = parsed.package;
+        if (!Array.isArray(packages)) {
+            return;
+        }
+        for (let pkg of packages) {
+            if (!pkg.name) {
+                continue;
+            }
+            let hashStr = pkg.sdist?.hash || pkg.wheels?.[0]?.hash;
+            if (!hashStr || !hashStr.startsWith('sha256:')) {
+                continue;
+            }
+            let key = this._canonicalize(pkg.name);
+            let entry = graph.get(key);
+            if (!entry || entry.hashes) {
+                continue;
+            }
+            entry.hashes = [{ alg: "SHA-256", content: hashStr.slice(7) }];
+        }
     }
     /**
      * Get the uv export output, either from env var or by running the command.

package/dist/src/providers/rust_cargo.d.ts

@@ -4,9 +4,10 @@ declare namespace _default {
     export { provideComponent };
     export { provideStack };
     export { readLicenseFromManifest };
+    export function packageManagerName(): string;
 }
 export default _default;
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 /**
  * @param {string} manifestName - the subject manifest name-type
  * @returns {boolean} - return true if `Cargo.toml` is the manifest name-type
@@ -46,7 +47,10 @@ declare function provideStack(manifest: string, opts?: {}): Provided;
  * Read project license from Cargo.toml, with fallback to LICENSE file.
  * Supports the `license` field under `[package]` (single crate / workspace
  * with root) and under `[workspace.package]` (virtual workspaces).
+ * When a member crate uses `license = { workspace = true }`, the actual
+ * license is resolved from the workspace root Cargo.toml.
  * @param {string} manifestPath - path to Cargo.toml
+ * @param {object} [metadata] - cargo metadata output (needed for workspace license resolution)
  * @returns {string|null} SPDX identifier or null
  */
-declare function readLicenseFromManifest(manifestPath: string): string | null;
+declare function readLicenseFromManifest(manifestPath: string, metadata?: object): string | null;

package/dist/src/providers/rust_cargo.js

@@ -5,7 +5,7 @@ import { parse as parseToml } from 'smol-toml';
 import { getLicense } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
 import { getCustom, getCustomPath, invokeCommand } from '../tools.js';
-export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest };
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'cargo'; } };
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /**
@@ -71,15 +71,22 @@ function isSupported(manifestName) {
  * Read project license from Cargo.toml, with fallback to LICENSE file.
  * Supports the `license` field under `[package]` (single crate / workspace
  * with root) and under `[workspace.package]` (virtual workspaces).
+ * When a member crate uses `license = { workspace = true }`, the actual
+ * license is resolved from the workspace root Cargo.toml.
  * @param {string} manifestPath - path to Cargo.toml
+ * @param {object} [metadata] - cargo metadata output (needed for workspace license resolution)
  * @returns {string|null} SPDX identifier or null
  */
-function readLicenseFromManifest(manifestPath) {
+function readLicenseFromManifest(manifestPath, metadata) {
     let fromManifest = null;
     try {
         let content = fs.readFileSync(manifestPath, 'utf-8');
         let parsed = parseToml(content);
-        fromManifest = parsed.package?.license
+        let packageLicense = parsed.package?.license;
+        if (typeof packageLicense === 'object' && packageLicense?.workspace === true) {
+            packageLicense = resolveWorkspaceLicense(parsed, metadata);
+        }
+        fromManifest = packageLicense
             || parsed.workspace?.package?.license
             || null;
     }
@@ -88,6 +95,26 @@ function readLicenseFromManifest(manifestPath) {
     }
     return getLicense(fromManifest, manifestPath);
 }
+/**
+ * Resolve a workspace-inherited license from the workspace root Cargo.toml.
+ * @param {object} parsed - the parsed member crate Cargo.toml
+ * @param {object} [metadata] - cargo metadata output with workspace_root
+ * @returns {string|null} resolved license string or null
+ */
+function resolveWorkspaceLicense(parsed, metadata) {
+    if (metadata?.workspace_root) {
+        let cargoTomlPath = path.join(metadata.workspace_root, 'Cargo.toml');
+        try {
+            let content = fs.readFileSync(cargoTomlPath, 'utf-8');
+            let workspaceParsed = parseToml(content);
+            return workspaceParsed.workspace?.package?.license || null;
+        }
+        catch (_) {
+            // fall through
+        }
+    }
+    return parsed.workspace?.package?.license || null;
+}
 /**
  * Validates that Cargo.lock exists in the manifest directory or in a parent
  * workspace root directory.  In Cargo workspaces the lock file always lives at
@@ -173,7 +200,7 @@ function getSBOM(manifest, opts = {}, includeTransitive) {
     let metadata = executeCargoMetadata(cargoBin, manifestDir);
     let ignoredDeps = getIgnoredDeps(manifest, metadata);
     let crateType = detectCrateType(metadata);
-    let license = readLicenseFromManifest(manifest);
+    let license = readLicenseFromManifest(manifest, metadata);
     let sbom;
     if (crateType === CrateType.WORKSPACE_VIRTUAL) {
         sbom = handleVirtualWorkspace(manifest, metadata, ignoredDeps, includeTransitive, opts, license);

package/dist/src/tools.d.ts

@@ -100,13 +100,13 @@ export function invokeCommand(bin: string, args: Array<string>, opts?: import("c
  * @param {import("index.js").Options} opts - The trustify DA options that may contain proxy configuration
  * @returns {RequestInit} The fetch options with proxy agent if applicable
  */
-export function addProxyAgent(options: RequestInit, opts: import("index.js").Options): RequestInit;
+export function addProxyAgent(options: RequestInit, opts: any): RequestInit;
 /**
  * Utility function for fetching vendor tokens
  * @param {import("index.js").Options} [opts={}] - optional various options to pass along the application
  * @returns {{}}
  */
-export function getTokenHeaders(opts?: import("index.js").Options): {};
+export function getTokenHeaders(opts?: any): {};
 export const RegexNotToBeLogged: RegExp;
 export const TRUSTIFY_DA_TOKEN_HEADER: "trust-da-token";
 export const TRUSTIFY_DA_TELEMETRY_ID_HEADER: "telemetry-anonymous-id";

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@trustify-da/trustify-da-javascript-client",
-	"version": "0.3.0-ea.e645720",
+	"version": "0.3.0-ea.ec6824b",
 	"description": "Code-Ready Dependency Analytics JavaScript API.",
 	"license": "Apache-2.0",
 	"homepage": "https://github.com/guacsec/trustify-da-javascript-client#README.md",
@@ -35,8 +35,8 @@
 		"config/**/*"
 	],
 	"scripts": {
-		"lint": "eslint src test --ext js",
-		"lint:fix": "eslint src test --ext js --fix",
+		"lint": "eslint src test",
+		"lint:fix": "eslint src test --fix",
 		"test": "c8 npm run tests",
 		"tests": "mocha --config .mocharc.json",
 		"tests:rep": "mocha --reporter-option maxDiffSize=0 --reporter json > unit-tests-result.json",
@@ -48,16 +48,17 @@
 	},
 	"dependencies": {
 		"@babel/core": "^7.23.2",
-		"@cyclonedx/cyclonedx-library": "^6.13.0",
+		"@cyclonedx/cyclonedx-library": "^10.0.0",
 		"eslint-import-resolver-typescript": "^4.4.4",
 		"fast-glob": "^3.3.3",
 		"fast-xml-parser": "^5.3.4",
 		"help": "^3.0.2",
-		"https-proxy-agent": "^7.0.6",
+		"https-proxy-agent": "^9.0.0",
 		"js-yaml": "^4.1.1",
+		"jsonc-parser": "^3.3.1",
 		"micromatch": "^4.0.8",
 		"node-fetch": "^3.3.2",
-		"p-limit": "^4.0.0",
+		"p-limit": "^7.3.0",
 		"packageurl-js": "~1.0.2",
 		"smol-toml": "^1.6.0",
 		"tree-sitter-gomod": "github:strum355/tree-sitter-go-mod#56326f2ad478892ace58ff247a97d492a3cbcdda",
@@ -67,23 +68,24 @@
 	},
 	"devDependencies": {
 		"@babel/core": "^7.23.2",
-		"@trustify-da/trustify-da-api-model": "^2.0.7",
-		"@types/node": "^20.17.30",
+		"@trustify-da/trustify-da-api-model": "^2.0.8",
+		"@types/node": "^25.9.1",
 		"@types/which": "^3.0.4",
 		"babel-plugin-rewire": "^1.2.0",
 		"c8": "^11.0.0",
-		"chai": "^4.3.7",
-		"eslint": "^8.42.0",
+		"chai": "^6.2.2",
+		"@eslint/js": "^10.0.0",
+		"eslint": "^10.4.1",
 		"eslint-import-resolver-typescript": "^4.4.4",
-		"eslint-plugin-editorconfig": "^4.0.3",
-		"eslint-plugin-import": "^2.29.1",
+		"eslint-plugin-import-x": "^4.16.2",
+		"globals": "^17.6.0",
 		"esmock": "^2.6.2",
-		"mocha": "^10.2.0",
+		"mocha": "^11.7.6",
 		"msw": "^2.12.7",
-		"sinon": "^15.1.2",
-		"sinon-chai": "^3.7.0",
-		"typescript": "^5.1.3",
-		"which": "^5.0.0"
+		"sinon": "^22.0.0",
+		"sinon-chai": "^4.0.1",
+		"typescript": "^6.0.3",
+		"which": "^7.0.0"
 	},
 	"mocha": {
 		"check-leaks": false,
@@ -111,12 +113,10 @@
 		"reporter": [
 			"html",
 			"json",
+			"lcov",
 			"text"
 		]
 	},
-	"eslintIgnore": [
-		"index.js"
-	],
 	"resolutions": {
 		"@hapi/joi": "17.1.1"
 	}