@trustify-da/trustify-da-javascript-client 0.3.0-ea.ff266a3 → 0.3.0-ea.ff694a0

package/dist/src/providers/golang_gomodules.js

@@ -1,10 +1,12 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { EOL } from "os";
 import { PackageURL } from 'packageurl-js';
+import { readLicenseFile } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
 import { getCustom, getCustomPath, invokeCommand } from "../tools.js";
-export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest };
+import { filterManifestPathsByDiscoveryIgnore, resolveWorkspaceDiscoveryIgnore } from '../workspace.js';
+import { getParser, getRequireQuery } from './gomod_parser.js';
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'go'; } };
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /** @typedef {{name: string, version: string}} Package */
@@ -16,46 +18,46 @@ export default { isSupported, validateLockFile, provideComponent, provideStack,
 const ecosystem = 'golang';
 const defaultMainModuleVersion = "v0.0.0";
 /**
- * @param {string} manifestName - the subject manifest name-type
- * @returns {boolean} - return true if `pom.xml` is the manifest name-type
+ * @param {string} manifestName the subject manifest name-type
+ * @returns {boolean} return true if `pom.xml` is the manifest name-type
 */
 function isSupported(manifestName) {
     return 'go.mod' === manifestName;
 }
 /**
  * Go modules have no standard license field in go.mod
- * @param {string} manifestPath - path to go.mod
+ * @param {string} manifestPath path to go.mod
  * @returns {string|null}
 */
 // eslint-disable-next-line no-unused-vars
-function readLicenseFromManifest(manifestPath) { return null; }
+function readLicenseFromManifest(manifestPath) { return readLicenseFile(manifestPath); }
 /**
- * @param {string} manifestDir - the directory where the manifest lies
+ * @param {string} manifestDir the directory where the manifest lies
  */
 function validateLockFile() { return true; }
 /**
  * Provide content and content type for maven-maven stack analysis.
- * @param {string} manifest - the manifest path or name
- * @param {{}} [opts={}] - optional various options to pass along the application
- * @returns {Provided}
+ * @param {string} manifest the manifest path or name
+ * @param {{}} [opts={}] optional various options to pass along the application
+ * @returns {Promise<Provided>}
  */
-function provideStack(manifest, opts = {}) {
+async function provideStack(manifest, opts = {}) {
     return {
         ecosystem,
-        content: getSBOM(manifest, opts, true),
+        content: await getSBOM(manifest, opts, true),
         contentType: 'application/vnd.cyclonedx+json'
     };
 }
 /**
  * Provide content and content type for maven-maven component analysis.
- * @param {string} manifest - path to go.mod for component report
- * @param {{}} [opts={}] - optional various options to pass along the application
- * @returns {Provided}
+ * @param {string} manifest path to go.mod for component report
+ * @param {{}} [opts={}] optional various options to pass along the application
+ * @returns {Promise<Provided>}
  */
-function provideComponent(manifest, opts = {}) {
+async function provideComponent(manifest, opts = {}) {
     return {
         ecosystem,
-        content: getSBOM(manifest, opts, false),
+        content: await getSBOM(manifest, opts, false),
         contentType: 'application/vnd.cyclonedx+json'
     };
 }
@@ -76,50 +78,52 @@ function getChildVertexFromEdge(edge) {
     return edge.split(" ")[1];
 }
 /**
- *
- * @param line one row from go.mod file
- * @return {boolean} whether line from go.mod should be considered as ignored or not
+ * Check whether a require_spec has a valid exhortignore marker.
+ * For direct dependencies: `//exhortignore` or `// exhortignore`
+ * For indirect dependencies: `// indirect; exhortignore` (semicolon-separated)
+ * @param {import('web-tree-sitter').SyntaxNode} specNode
+ * @return {boolean}
  */
-function ignoredLine(line) {
-    let result = false;
-    if (line.match(".*exhortignore.*")) {
-        if (line.match(".+//\\s*exhortignore") || line.match(".+//\\sindirect (//)?\\s*exhortignore")) {
-            let trimmedRow = line.trim();
-            if (!trimmedRow.startsWith("module ") && !trimmedRow.startsWith("go ") && !trimmedRow.startsWith("require (") && !trimmedRow.startsWith("require(")
-                && !trimmedRow.startsWith("exclude ") && !trimmedRow.startsWith("replace ") && !trimmedRow.startsWith("retract ") && !trimmedRow.startsWith("use ")
-                && !trimmedRow.includes("=>")) {
-                if (trimmedRow.startsWith("require ") || trimmedRow.match("^[a-z.0-9/-]+\\s{1,2}[vV][0-9]\\.[0-9](\\.[0-9]){0,2}.*")) {
-                    result = true;
-                }
-            }
+function hasExhortIgnore(specNode) {
+    // Ideally this would be the following tree-sitter query instead, but for some
+    // reason it throws an error here but not in the playground.
+    // (require_spec) ((module_path) @path (version) (comment) @comment (#match? @comment "^//.*exhortignore"))
+    // QueryError: Bad pattern structure at offset 53: '(comment) @comment (#match? @comment "^//.*exhortignore")) @spec'...
+    let comments = specNode.children.filter(c => c.type === 'comment');
+    for (let comment of comments) {
+        let text = comment.text;
+        if (/^\/\/\s*indirect;\s*exhortignore/.test(text)) {
+            return true;
+        }
+        if (/^\/\/\s*exhortignore/.test(text)) {
+            return true;
         }
     }
-    return result;
-}
-/**
- * extract package name from go.mod line that contains exhortignore comment.
- * @param line a row contains exhortignore as part of a comment
- * @return {string} the full package name + group/namespace + version
- * @private
- */
-function extractPackageName(line) {
-    let trimmedRow = line.trim();
-    let firstRemarkNotationOccurrence = trimmedRow.indexOf("//");
-    return trimmedRow.substring(0, firstRemarkNotationOccurrence).trim();
+    return false;
 }
 /**
  *
- * @param {string } manifest - path to manifest
- * @return {[PackageURL]} list of ignored dependencies d
+ * @param {string} manifestContent go.mod file contents
+ * @param {import('web-tree-sitter').Parser} parser
+ * @param {import('web-tree-sitter').Query} requireQuery
+ * @return {PackageURL[]} list of ignored dependencies
  */
-function getIgnoredDeps(manifest) {
-    let goMod = fs.readFileSync(manifest).toString().trim();
-    let lines = goMod.split(getLineSeparatorGolang());
-    return lines.filter(line => ignoredLine(line)).map(line => extractPackageName(line)).map(dep => toPurl(dep, /[ ]{1,3}/));
+function getIgnoredDeps(manifestContent, parser, requireQuery) {
+    let tree = parser.parse(manifestContent);
+    return requireQuery.matches(tree.rootNode)
+        .filter(match => {
+        let specNode = match.captures.find(c => c.name === 'spec').node;
+        return hasExhortIgnore(specNode);
+    })
+        .map(match => {
+        let name = match.captures.find(c => c.name === 'name').node.text;
+        let version = match.captures.find(c => c.name === 'version').node.text;
+        return toPurl(`${name} ${version}`, /[ ]{1,3}/);
+    });
 }
 /**
  *
- * @param {[PackageURL]}allIgnoredDeps - list of purls of all dependencies that should be ignored
+ * @param {PackageURL[]} allIgnoredDeps list of purls of all dependencies that should be ignored
  * @param {PackageURL} purl object to be checked if needed to be ignored
  * @return {boolean}
  */
@@ -138,59 +142,29 @@ function enforceRemovingIgnoredDepsInCaseOfAutomaticVersionUpdate(ignoredDeps, s
 }
 /**
  *
- * @param {[string]} lines - array of lines of go.mod manifest
- * @param {string} goMod - content of go.mod manifest
- * @return {[string]} all dependencies from go.mod file as array
+ * @param {string} manifestContent go.mod file contents
+ * @param {import('web-tree-sitter').Parser} parser
+ * @param {import('web-tree-sitter').Query} requireQuery
+ * @return {string[]} all dependencies from go.mod file as "name version" strings
  */
-function collectAllDepsFromManifest(lines, goMod) {
-    let result;
-    // collect all deps that starts with require keyword
-    result = lines.filter((line) => line.trim().startsWith("require") && !line.includes("(")).map((dep) => dep.substring("require".length).trim());
-    // collect all deps that are inside `require` blocks
-    let currentSegmentOfGoMod = goMod;
-    let requirePositionObject = decideRequireBlockIndex(currentSegmentOfGoMod);
-    while (requirePositionObject.index > -1) {
-        let depsInsideRequirementsBlock = currentSegmentOfGoMod.substring(requirePositionObject.index + requirePositionObject.startingOffeset).trim();
-        let endOfBlockIndex = depsInsideRequirementsBlock.indexOf(")");
-        let currentIndex = 0;
-        while (currentIndex < endOfBlockIndex) {
-            let endOfLinePosition = depsInsideRequirementsBlock.indexOf(EOL, currentIndex);
-            let dependency = depsInsideRequirementsBlock.substring(currentIndex, endOfLinePosition);
-            result.push(dependency.trim());
-            currentIndex = endOfLinePosition + 1;
-        }
-        currentSegmentOfGoMod = currentSegmentOfGoMod.substring(endOfBlockIndex + 1).trim();
-        requirePositionObject = decideRequireBlockIndex(currentSegmentOfGoMod);
-    }
-    function decideRequireBlockIndex(goMod) {
-        let object = {};
-        let index = goMod.indexOf("require(");
-        object.startingOffeset = "require(".length;
-        if (index === -1) {
-            index = goMod.indexOf("require (");
-            object.startingOffeset = "require (".length;
-            if (index === -1) {
-                index = goMod.indexOf("require  (");
-                object.startingOffeset = "require  (".length;
-            }
-        }
-        object.index = index;
-        return object;
-    }
-    return result;
+function collectAllDepsFromManifest(manifestContent, parser, requireQuery) {
+    let tree = parser.parse(manifestContent);
+    return requireQuery.matches(tree.rootNode).map(match => {
+        let name = match.captures.find(c => c.name === 'name').node.text;
+        let version = match.captures.find(c => c.name === 'version').node.text;
+        return `${name} ${version}`;
+    });
 }
 /**
  *
  * @param {string} rootElementName the rootElementName element of go mod graph, to compare only direct deps from go mod graph against go.mod manifest
- * @param{[string]} goModGraphOutputRows the goModGraphOutputRows from go mod graph' output
- * @param {string }manifest path to go.mod manifest on file system
+ * @param {string[]} goModGraphOutputRows the goModGraphOutputRows from go mod graph' output
+ * @param {string} manifestContent go.mod file contents
  * @private
  */
-function performManifestVersionsCheck(rootElementName, goModGraphOutputRows, manifest) {
-    let goMod = fs.readFileSync(manifest).toString().trim();
-    let lines = goMod.split(getLineSeparatorGolang());
+function performManifestVersionsCheck(rootElementName, goModGraphOutputRows, manifestContent, parser, requireQuery) {
     let comparisonLines = goModGraphOutputRows.filter((line) => line.startsWith(rootElementName)).map((line) => getChildVertexFromEdge(line));
-    let manifestDeps = collectAllDepsFromManifest(lines, goMod);
+    let manifestDeps = collectAllDepsFromManifest(manifestContent, parser, requireQuery);
     try {
         comparisonLines.forEach((dependency) => {
             let parts = dependency.split("@");
@@ -202,7 +176,7 @@ function performManifestVersionsCheck(rootElementName, goModGraphOutputRows, man
                 let currentVersion = components[1];
                 if (currentDepName === depName) {
                     if (currentVersion !== version) {
-                        throw new Error(`versions mismatch for dependency name ${depName}, manifest version=${currentVersion}, installed Version=${version}, if you want to allow version mismatch for analysis between installed and requested packages, set environment variable/setting - MATCH_MANIFEST_VERSIONS=false`);
+                        throw new Error(`version mismatch for dependency "${depName}", manifest version=${currentVersion}, installed version=${version}, if you want to allow version mismatch for analysis between installed and requested packages, set environment variable/setting MATCH_MANIFEST_VERSIONS=false`);
                     }
                 }
             });
@@ -218,10 +192,10 @@ function performManifestVersionsCheck(rootElementName, goModGraphOutputRows, man
  * @param {string} manifest - path for go.mod
  * @param {{}} [opts={}] - optional various options to pass along the application
  * @param {boolean} includeTransitive - whether the sbom should contain transitive dependencies of the main module or not.
- * @returns {string} the SBOM json content
+ * @returns {Promise<string>} the SBOM json content
  * @private
  */
-function getSBOM(manifest, opts = {}, includeTransitive) {
+async function getSBOM(manifest, opts = {}, includeTransitive) {
     // get custom goBin path
     let goBin = getCustomPath('go', opts);
     // verify goBin is accessible
@@ -247,14 +221,25 @@ function getSBOM(manifest, opts = {}, includeTransitive) {
     catch (error) {
         throw new Error('failed to determine root module name', { cause: error });
     }
-    let ignoredDeps = getIgnoredDeps(manifest);
+    let manifestContent = fs.readFileSync(manifest).toString();
+    let [parser, requireQuery] = await Promise.all([getParser(), getRequireQuery()]);
+    let ignoredDeps = getIgnoredDeps(manifestContent, parser, requireQuery);
     let allIgnoredDeps = ignoredDeps.map((dep) => dep.toString());
     let sbom = new Sbom();
     let rows = goGraphOutput.split(getLineSeparatorGolang()).filter(line => !line.includes(' go@'));
-    let root = getParentVertexFromEdge(goModEditOutput['Module']['Path']);
+    let root = goModEditOutput['Module']['Path'];
+    // Build set of direct dependency paths from go mod edit -json
+    let directDepPaths = new Set();
+    if (goModEditOutput['Require']) {
+        goModEditOutput['Require'].forEach(req => {
+            if (!req['Indirect']) {
+                directDepPaths.add(req['Path']);
+            }
+        });
+    }
     let matchManifestVersions = getCustom("MATCH_MANIFEST_VERSIONS", "false", opts);
     if (matchManifestVersions === "true") {
-        performManifestVersionsCheck(root, rows, manifest);
+        performManifestVersionsCheck(root, rows, manifestContent, parser, requireQuery);
     }
     const mainModule = toPurl(root, "@");
     const license = readLicenseFromManifest(manifest);
@@ -272,7 +257,11 @@ function getSBOM(manifest, opts = {}, includeTransitive) {
                 currentParent = getParentVertexFromEdge(row);
                 source = toPurl(currentParent, "@");
             }
-            let target = toPurl(getChildVertexFromEdge(row), "@");
+            let child = getChildVertexFromEdge(row);
+            let target = toPurl(child, "@");
+            if (getParentVertexFromEdge(row) === root && !directDepPaths.has(getPackageName(child))) {
+                return;
+            }
             sbom.addDependency(source, target);
         });
         // at the end, filter out all ignored dependencies including versions.
@@ -282,10 +271,12 @@ function getSBOM(manifest, opts = {}, includeTransitive) {
     else {
         let directDependencies = rows.filter(row => row.startsWith(root));
         directDependencies.forEach(pair => {
-            let dependency = getChildVertexFromEdge(pair);
-            let depPurl = toPurl(dependency, "@");
-            if (dependencyNotIgnored(ignoredDeps, depPurl)) {
-                sbom.addDependency(mainModule, depPurl);
+            let child = getChildVertexFromEdge(pair);
+            let target = toPurl(child, "@");
+            if (dependencyNotIgnored(ignoredDeps, target)) {
+                if (directDepPaths.has(getPackageName(child))) {
+                    sbom.addDependency(mainModule, target);
+                }
             }
         });
         enforceRemovingIgnoredDepsInCaseOfAutomaticVersionUpdate(ignoredDeps, sbom);
@@ -295,7 +286,7 @@ function getSBOM(manifest, opts = {}, includeTransitive) {
 /**
  * Utility function for creating Purl String
 
- * @param {string }dependency the name of the artifact, can include a namespace(group) or not - namespace/artifactName.
+ * @param {string} dependency the name of the artifact, can include a namespace(group) or not - namespace/artifactName.
  * @param {RegExp} delimiter delimiter between name of dependency and version
  * @private
  * @returns {PackageURL|null} PackageUrl Object ready to be used in SBOM
@@ -320,12 +311,12 @@ function toPurl(dependency, delimiter) {
     }
     return pkg;
 }
-/** This function gets rows from go mod graph , and go.mod graph, and selecting for all
+/** This function gets rows from go mod graph, and go.mod graph, and selecting for all
  * packages the has more than one minor the final versions as selected by golang MVS algorithm.
- * @param {[string]}rows all the rows from go modules dependency tree
+ * @param {string[]} rows all the rows from go modules dependency tree
  * @param {string} manifestPath the path of the go.mod file
  * @param {string} path to go binary
- * @return {[string]} rows that contains final versions.
+ * @return {string[]} rows that contains final versions.
  */
 function getFinalPackagesVersionsForModule(rows, manifestPath, goBin) {
     let manifestDir = path.dirname(manifestPath);
@@ -338,13 +329,7 @@ function getFinalPackagesVersionsForModule(rows, manifestPath, goBin) {
     catch (error) {
         throw new Error('failed to list all modules', { cause: error });
     }
-    let finalVersionModules = new Map();
-    finalVersionsForAllModules.split(getLineSeparatorGolang()).filter(string => string.trim() !== "")
-        .filter(string => string.trim().split(" ").length === 2)
-        .forEach((dependency) => {
-        let dep = dependency.split(" ");
-        finalVersionModules[dep[0]] = dep[1];
-    });
+    let finalVersionModules = parseModuleVersions(finalVersionsForAllModules);
     let finalVersionModulesArray = new Array();
     rows.filter(string => string.trim() !== "").forEach(module => {
         let child = getChildVertexFromEdge(module);
@@ -380,7 +365,7 @@ function getFinalPackagesVersionsForModule(rows, manifestPath, goBin) {
 /**
  *
  * @param {string} fullPackage - full package with its name and version
- * @return -{string} package name only
+ * @return {string} package name only
  * @private
  */
 function getPackageName(fullPackage) {
@@ -398,14 +383,76 @@ function isSpecialGoModule(moduleName) {
 /**
  *
  * @param {string} fullPackage - full package with its name and version
- * @return -{string} package version only
+ * @return {string|undefined} package version only
  * @private
  */
 function getVersionOfPackage(fullPackage) {
     let parts = fullPackage.split("@");
     return parts.length > 1 ? parts[1] : undefined;
 }
+function parseModuleVersions(goListOutput) {
+    let modules = {};
+    goListOutput.split(getLineSeparatorGolang()).filter(string => string.trim() !== "")
+        .forEach((line) => {
+        let parts = line.trim().split(" ");
+        if (parts.length === 2) {
+            modules[parts[0]] = parts[1];
+        }
+        else if (parts.length >= 4 && parts[2] === "=>") {
+            modules[parts[0]] = parts[parts.length - 1];
+        }
+    });
+    return modules;
+}
 function getLineSeparatorGolang() {
     let reg = /\n|\r\n/;
     return reg;
 }
+/**
+ * Discover all go.mod manifest paths in a Go workspace.
+ * Uses `go work edit -json` to get workspace members.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain go.work)
+ * @param {import('../index.js').Options} [opts={}]
+ * @returns {Promise<string[]>} Paths to go.mod files (absolute)
+ */
+export async function discoverGoWorkspaceModules(workspaceRoot, opts = {}) {
+    const root = path.resolve(workspaceRoot);
+    const goWork = path.join(root, 'go.work');
+    if (!fs.existsSync(goWork)) {
+        return [];
+    }
+    const goBin = getCustomPath('go', opts);
+    let output;
+    try {
+        output = invokeCommand(goBin, ['work', 'edit', '-json', goWork], { cwd: root });
+    }
+    catch {
+        return [];
+    }
+    let workspace;
+    try {
+        workspace = JSON.parse(output.toString().trim());
+    }
+    catch {
+        return [];
+    }
+    const useEntries = workspace.Use || [];
+    if (useEntries.length === 0) {
+        return [];
+    }
+    const manifestPaths = [];
+    for (const entry of useEntries) {
+        const diskPath = entry.DiskPath;
+        if (!diskPath) {
+            continue;
+        }
+        const moduleDir = path.resolve(root, diskPath);
+        const goMod = path.join(moduleDir, 'go.mod');
+        if (fs.existsSync(goMod)) {
+            manifestPaths.push(goMod);
+        }
+    }
+    const ignorePatterns = resolveWorkspaceDiscoveryIgnore(opts);
+    return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+}

package/dist/src/providers/gomod_parser.d.ts

@@ -0,0 +1,4 @@
+export function getParser(): Promise<Parser>;
+export function getRequireQuery(): Promise<Query>;
+import { Parser } from 'web-tree-sitter';
+import { Query } from 'web-tree-sitter';

package/dist/src/providers/gomod_parser.js

@@ -0,0 +1,16 @@
+import { readFile } from 'node:fs/promises';
+import { Language, Parser, Query } from 'web-tree-sitter';
+const wasmUrl = new URL('./tree-sitter-gomod.wasm', import.meta.url);
+async function init() {
+    await Parser.init();
+    const wasmBytes = new Uint8Array(await readFile(wasmUrl));
+    return await Language.load(wasmBytes);
+}
+export async function getParser() {
+    const language = await init();
+    return new Parser().setLanguage(language);
+}
+export async function getRequireQuery() {
+    const language = await init();
+    return new Query(language, '(require_spec (module_path) @name (version) @version) @spec');
+}

package/dist/src/providers/java_gradle.d.ts

@@ -1,3 +1,22 @@
+/**
+ * Discover all build.gradle[.kts] manifest paths in a Gradle multi-project build.
+ * Uses a custom init script to get structured project listing.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain settings.gradle[.kts])
+ * @param {import('../index.js').Options} [opts={}]
+ * @returns {Promise<string[]>} Paths to build.gradle[.kts] files (absolute)
+ */
+export function discoverGradleSubprojects(workspaceRoot: string, opts?: import("../index.js").Options): Promise<string[]>;
+/**
+ * Parse the structured output from the Gradle init script.
+ *
+ * @param {string} raw - Raw stdout from gradle
+ * @returns {{ path: string, dir: string }[]}
+ */
+export function parseGradleInitScriptOutput(raw: string): {
+    path: string;
+    dir: string;
+}[];
 /**
  * This class provides common functionality for Groovy and Kotlin DSL files.
  */

package/dist/src/providers/java_gradle.js

@@ -1,8 +1,13 @@
+import crypto from 'node:crypto';
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { EOL } from 'os';
-import TOML from 'fast-toml';
+import { parse as parseToml } from 'smol-toml';
+import { readLicenseFile } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
+import { invokeCommand } from '../tools.js';
+import { filterManifestPathsByDiscoveryIgnore, resolveWorkspaceDiscoveryIgnore } from '../workspace.js';
 import Base_java, { ecosystem_gradle } from "./base_java.js";
 /** @typedef {import('../provider.js').Provider} */
 /** @typedef {import('../provider.js').Provided} Provided */
@@ -55,7 +60,7 @@ export default class Java_gradle extends Base_java {
      * @returns {null}
      */
     // eslint-disable-next-line no-unused-vars
-    readLicenseFromManifest(manifestPath) { return null; }
+    readLicenseFromManifest(manifestPath) { return readLicenseFile(manifestPath); }
     /**
      * Provide content and content type for stack analysis.
      * @param {string} manifest - the manifest path or name
@@ -361,7 +366,7 @@ export default class Java_gradle extends Base_java {
         // Read and parse the TOML file
         let pathOfToml = path.join(path.dirname(manifestPath), "gradle", "libs.versions.toml");
         const tomlString = fs.readFileSync(pathOfToml).toString();
-        let tomlObject = TOML.parse(tomlString);
+        let tomlObject = parseToml(tomlString);
         let groupPlusArtifactObject = tomlObject.libraries[alias];
         let parts = groupPlusArtifactObject.module.split(":");
         let groupId = parts[0];
@@ -406,3 +411,113 @@ export default class Java_gradle extends Base_java {
         return undefined;
     }
 }
+const DEFAULT_GRADLE_DISCOVERY_IGNORE = [
+    '**/build/**',
+    '**/.gradle/**',
+];
+/** Gradle init script that emits structured project listing. */
+const GRADLE_INIT_SCRIPT = `allprojects {
+    task daListProjects {
+        doLast {
+            println "::DA_PROJECT::\${project.path}::\${project.projectDir}"
+        }
+    }
+}
+`;
+/**
+ * Discover all build.gradle[.kts] manifest paths in a Gradle multi-project build.
+ * Uses a custom init script to get structured project listing.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain settings.gradle[.kts])
+ * @param {import('../index.js').Options} [opts={}]
+ * @returns {Promise<string[]>} Paths to build.gradle[.kts] files (absolute)
+ */
+export async function discoverGradleSubprojects(workspaceRoot, opts = {}) {
+    const root = path.resolve(workspaceRoot);
+    const hasSettings = fs.existsSync(path.join(root, 'settings.gradle'))
+        || fs.existsSync(path.join(root, 'settings.gradle.kts'));
+    if (!hasSettings) {
+        return [];
+    }
+    const manifestPaths = [];
+    const rootBuildKts = path.join(root, 'build.gradle.kts');
+    const rootBuild = path.join(root, 'build.gradle');
+    const rootManifest = fs.existsSync(rootBuildKts) ? rootBuildKts : fs.existsSync(rootBuild) ? rootBuild : null;
+    if (rootManifest) {
+        manifestPaths.push(rootManifest);
+    }
+    let gradleBin;
+    try {
+        gradleBin = new Java_gradle().selectToolBinary(rootManifest || rootBuild, opts);
+    }
+    catch {
+        const ignorePatterns = [...resolveWorkspaceDiscoveryIgnore(opts), ...DEFAULT_GRADLE_DISCOVERY_IGNORE];
+        return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+    }
+    const initScriptPath = path.join(os.tmpdir(), `da-list-projects-${crypto.randomUUID()}.gradle`);
+    try {
+        fs.writeFileSync(initScriptPath, GRADLE_INIT_SCRIPT);
+        let output;
+        try {
+            output = invokeCommand(gradleBin, [
+                '-q', '--no-daemon',
+                '--init-script', initScriptPath,
+                'daListProjects',
+            ], { cwd: root });
+        }
+        catch {
+            const ignorePatterns = [...resolveWorkspaceDiscoveryIgnore(opts), ...DEFAULT_GRADLE_DISCOVERY_IGNORE];
+            return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+        }
+        const projects = parseGradleInitScriptOutput(output.toString());
+        for (const proj of projects) {
+            if (proj.path === ':') {
+                continue;
+            }
+            const projDir = path.resolve(proj.dir);
+            const buildKts = path.join(projDir, 'build.gradle.kts');
+            const buildGroovy = path.join(projDir, 'build.gradle');
+            if (fs.existsSync(buildKts)) {
+                manifestPaths.push(buildKts);
+            }
+            else if (fs.existsSync(buildGroovy)) {
+                manifestPaths.push(buildGroovy);
+            }
+        }
+    }
+    finally {
+        try {
+            fs.unlinkSync(initScriptPath);
+        }
+        catch { /* ignore */ }
+    }
+    const ignorePatterns = [...resolveWorkspaceDiscoveryIgnore(opts), ...DEFAULT_GRADLE_DISCOVERY_IGNORE];
+    return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+}
+/**
+ * Parse the structured output from the Gradle init script.
+ *
+ * @param {string} raw - Raw stdout from gradle
+ * @returns {{ path: string, dir: string }[]}
+ */
+export function parseGradleInitScriptOutput(raw) {
+    const projects = [];
+    for (const rawLine of raw.split('\n')) {
+        const line = rawLine.trimEnd();
+        if (!line.startsWith('::DA_PROJECT::')) {
+            continue;
+        }
+        const prefix = '::DA_PROJECT::';
+        const remainder = line.substring(prefix.length);
+        const lastSep = remainder.lastIndexOf('::');
+        if (lastSep < 0) {
+            continue;
+        }
+        const projPath = remainder.substring(0, lastSep);
+        const dir = remainder.substring(lastSep + 2);
+        if (projPath && dir) {
+            projects.push({ path: projPath, dir });
+        }
+    }
+    return projects;
+}

package/dist/src/providers/java_maven.d.ts

@@ -1,3 +1,11 @@
+/**
+ * Discover all pom.xml manifest paths in a Maven multi-module project.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain pom.xml)
+ * @param {object} [opts={}]
+ * @returns {Promise<string[]>} Paths to pom.xml files (absolute)
+ */
+export function discoverMavenModules(workspaceRoot: string, opts?: object): Promise<string[]>;
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /** @typedef {{name: string, version: string}} Package */
@@ -28,7 +36,7 @@ export default class Java_maven extends Base_java {
      */
     provideComponent(manifest: string, opts?: {}): Provided;
     /**
-     * Read license from pom.xml manifest
+     * Read license from pom.xml manifest, with fallback to LICENSE file
      * @param {string} manifestPath - path to pom.xml
      * @returns {string|null}
      */