circle-ir 4.17.0 → 4.18.1

package/dist/analysis/sbom.js

@@ -20,6 +20,7 @@
  * runtime dependencies circle-ir permits are `web-tree-sitter` and `yaml`,
  * and a manifest dependency list needs nothing heavier.
  */
+import { parse as parseYaml } from 'yaml';
 // ---------------------------------------------------------------------------
 // purl helpers
 // ---------------------------------------------------------------------------
@@ -185,6 +186,332 @@ export function parseNpmLockDependencies(packageLock) {
         return true;
     });
 }
+/**
+ * Scope every node by reachability from the project roots: reached from a
+ * production root → `required`; else from an optional root → `optional`;
+ * else from a dev root → `dev`. A node no root reaches keeps the lockfile's
+ * own flag (pnpm v5/v6 `dev` / `optional`), else `required`.
+ * `direct` is set when any root names the node; `undefined` when `hasRoots`
+ * is false (the input did not carry the project's declarations).
+ */
+function scopeLockNodes(nodes, roots, hasRoots) {
+    const reach = (starts) => {
+        const seen = new Set();
+        const stack = starts.filter((k) => nodes.has(k));
+        while (stack.length > 0) {
+            const k = stack.pop();
+            if (seen.has(k))
+                continue;
+            seen.add(k);
+            for (const next of nodes.get(k)?.deps ?? [])
+                if (nodes.has(next) && !seen.has(next))
+                    stack.push(next);
+        }
+        return seen;
+    };
+    const prod = reach(roots.required);
+    const opt = reach(roots.optional);
+    const dev = reach(roots.dev);
+    const direct = new Set([...roots.required, ...roots.optional, ...roots.dev]);
+    const out = [];
+    const seen = new Set();
+    for (const [key, n] of [...nodes.entries()].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))) {
+        let scope;
+        if (prod.has(key))
+            scope = 'required';
+        else if (opt.has(key))
+            scope = 'optional';
+        else if (dev.has(key))
+            scope = 'dev';
+        else
+            scope = n.flagDev ? 'dev' : n.flagOptional ? 'optional' : 'required';
+        const id = `${n.name}|${n.version}|${scope}`;
+        if (seen.has(id))
+            continue;
+        seen.add(id);
+        const d = dep('npm', n.name, n.version, scope);
+        if (hasRoots)
+            d.direct = direct.has(key);
+        out.push(d);
+    }
+    return out;
+}
+/** Split `name@version` (name may be `@scope/name`). */
+function splitAt(spec) {
+    const at = spec.lastIndexOf('@');
+    if (at <= 0)
+        return null;
+    return { name: spec.slice(0, at), rest: spec.slice(at + 1) };
+}
+/** Drop pnpm's peer suffix: `1.2.3(react@18.2.0)` → `1.2.3`; v5 `1.2.3_react@18` → `1.2.3`. */
+function stripPnpmPeers(v) {
+    const paren = v.indexOf('(');
+    let out = paren >= 0 ? v.slice(0, paren) : v;
+    const us = out.indexOf('_');
+    if (us > 0)
+        out = out.slice(0, us);
+    return out;
+}
+/** Local or workspace references are the project's own code, not npm packages. */
+const PNPM_LOCAL = /^(link:|file:|workspace:|portal:)/;
+/**
+ * Turn a pnpm package key into `{ name, version }`:
+ *   - v9: `name@1.2.3` / `name@1.2.3(peer@x)`
+ *   - v6: `/name@1.2.3(peer@x)`
+ *   - v5: `/name/1.2.3_peer@x` / `/@scope/name/1.2.3`
+ */
+function parsePnpmKey(rawKey) {
+    let key = rawKey.startsWith('/') ? rawKey.slice(1) : rawKey;
+    // v5 slash form first: its peer suffix (`_react@18`) contains an `@`.
+    const v5 = key.match(/^(@[^/@]+\/[^/@]+|[^/@]+)\/(\d[^/]*)$/);
+    if (v5)
+        return { name: v5[1], version: stripPnpmPeers(v5[2]) };
+    const paren = key.indexOf('(');
+    if (paren >= 0)
+        key = key.slice(0, paren);
+    const at = splitAt(key);
+    if (at && /^\d/.test(at.rest))
+        return { name: at.name, version: stripPnpmPeers(at.rest) };
+    return null;
+}
+/**
+ * Resolve a dependency reference inside a pnpm lockfile to a node key
+ * (`name@version`). A reference is a version (`1.2.3`, `1.2.3(peer)`), a
+ * path key (`/other@1.0.0`, v5 `/other/1.0.0`) or an alias (`other@1.0.0`).
+ * Returns `null` for local/workspace links.
+ */
+function pnpmRef(depName, ref) {
+    if (typeof ref !== 'string')
+        return null;
+    if (PNPM_LOCAL.test(ref))
+        return null;
+    if (/^\d/.test(ref))
+        return `${depName}@${stripPnpmPeers(ref)}`;
+    const parsed = parsePnpmKey(ref);
+    return parsed ? `${parsed.name}@${parsed.version}` : null;
+}
+/** The version of an importer entry: v6/v9 `{ specifier, version }`, v5 a plain string. */
+function importerVersion(entry) {
+    if (entry && typeof entry === 'object' && 'version' in entry) {
+        return entry.version;
+    }
+    return entry;
+}
+function asRecord(v) {
+    return v && typeof v === 'object' && !Array.isArray(v) ? v : undefined;
+}
+/**
+ * Parse a `pnpm-lock.yaml` (lockfile formats 5.x, 6.0 and 9.0) into exact
+ * resolved npm dependencies, direct and transitive.
+ *
+ * - **Roots:** every importer (`importers['.']`, `importers['packages/x']`, …),
+ *   or, in single-project v5/v6 files, the top-level `dependencies` /
+ *   `devDependencies` / `optionalDependencies`. Workspace and local links
+ *   (`link:`, `file:`, `workspace:`) are the project's own packages and are
+ *   not listed.
+ * - **Scope:** by reachability from the roots (prod → `required`, optional
+ *   roots → `optional`, dev-only → `dev`); a package no root reaches keeps
+ *   pnpm v5/v6's own `dev` / `optional` flag.
+ * - **direct:** `true` for a package an importer declares, else `false`.
+ *
+ * Peer-dependency variants of one version (`a@1.0.0(react@17)`,
+ * `a@1.0.0(react@18)`) collapse into one entry. Malformed YAML yields `[]`.
+ */
+export function parsePnpmLockDependencies(pnpmLock) {
+    if (!pnpmLock)
+        return [];
+    let root;
+    try {
+        root = asRecord(parseYaml(pnpmLock, { uniqueKeys: false }));
+    }
+    catch {
+        return [];
+    }
+    if (!root)
+        return [];
+    const nodes = new Map();
+    const addNode = (rawKey, info) => {
+        const id = parsePnpmKey(rawKey);
+        if (!id)
+            return;
+        const key = `${id.name}@${id.version}`;
+        const node = nodes.get(key) ?? { name: id.name, version: id.version, deps: [] };
+        if (info) {
+            for (const section of ['dependencies', 'optionalDependencies']) {
+                for (const [n, ref] of Object.entries(asRecord(info[section]) ?? {})) {
+                    const k = pnpmRef(n, ref);
+                    if (k && !node.deps.includes(k))
+                        node.deps.push(k);
+                }
+            }
+            if (info.dev === true)
+                node.flagDev = true;
+            if (info.optional === true)
+                node.flagOptional = true;
+        }
+        nodes.set(key, node);
+    };
+    for (const [k, v] of Object.entries(asRecord(root.packages) ?? {}))
+        addNode(k, asRecord(v));
+    // v9 keeps the graph in `snapshots`, identities in `packages`.
+    for (const [k, v] of Object.entries(asRecord(root.snapshots) ?? {}))
+        addNode(k, asRecord(v));
+    const roots = { required: [], optional: [], dev: [] };
+    const importers = asRecord(root.importers);
+    const projects = importers
+        ? Object.values(importers).map(asRecord).filter((x) => Boolean(x))
+        : [root];
+    for (const project of projects) {
+        for (const [section, bucket] of [
+            ['dependencies', roots.required],
+            ['optionalDependencies', roots.optional],
+            ['devDependencies', roots.dev],
+        ]) {
+            for (const [n, entry] of Object.entries(asRecord(project[section]) ?? {})) {
+                const k = pnpmRef(n, importerVersion(entry));
+                if (k)
+                    bucket.push(k);
+            }
+        }
+    }
+    return scopeLockNodes(nodes, roots, true);
+}
+/**
+ * The project directories a `pnpm-lock.yaml` covers, relative to the
+ * lockfile (`.` for the root). A workspace lockfile resolves every listed
+ * package, so it supersedes each of their `package.json` files (DT4).
+ * Single-project lockfiles return `['.']`; malformed YAML returns `[]`.
+ */
+export function pnpmLockImporters(pnpmLock) {
+    if (!pnpmLock)
+        return [];
+    let root;
+    try {
+        root = asRecord(parseYaml(pnpmLock, { uniqueKeys: false }));
+    }
+    catch {
+        return [];
+    }
+    if (!root)
+        return [];
+    const importers = asRecord(root.importers);
+    return importers ? Object.keys(importers).sort() : ['.'];
+}
+/** Unquote a yarn v1 token: `"@babel/core@^7.0.0"` → `@babel/core@^7.0.0`. */
+function yarnUnquote(s) {
+    const t = s.trim();
+    return t.length >= 2 && t.startsWith('"') && t.endsWith('"') ? t.slice(1, -1) : t;
+}
+/**
+ * Parse a Yarn classic (v1) `yarn.lock` into exact resolved npm
+ * dependencies. Yarn v1 records no dev or direct marker, so:
+ *
+ * - with only the lockfile, every package is `required` and `direct` is
+ *   absent (unknown);
+ * - with the project's `package.json` as the second argument, scope and
+ *   `direct` come from reachability, as for pnpm.
+ *
+ * Yarn Berry (v2+, a YAML file with `__metadata`) is not handled and yields
+ * `[]`. Malformed entries are skipped.
+ */
+export function parseYarnLockDependencies(yarnLock, packageJson) {
+    if (!yarnLock)
+        return [];
+    if (/^__metadata:/m.test(yarnLock))
+        return [];
+    const nodes = new Map();
+    const specToKey = new Map();
+    const pendingDeps = [];
+    let specs = [];
+    let version;
+    let deps = [];
+    let inDeps = false;
+    const flush = () => {
+        if (specs.length > 0 && version) {
+            const first = splitAt(specs[0]);
+            if (first) {
+                const key = `${first.name}@${version}`;
+                if (!nodes.has(key))
+                    nodes.set(key, { name: first.name, version, deps: [] });
+                for (const s of specs)
+                    specToKey.set(s, key);
+                pendingDeps.push([key, deps]);
+            }
+        }
+        specs = [];
+        version = undefined;
+        deps = [];
+        inDeps = false;
+    };
+    for (const rawLine of yarnLock.split(/\r?\n/)) {
+        if (!rawLine.trim() || rawLine.trimStart().startsWith('#'))
+            continue;
+        const indent = rawLine.length - rawLine.trimStart().length;
+        const line = rawLine.trim();
+        if (indent === 0) {
+            flush();
+            if (!line.endsWith(':'))
+                continue;
+            specs = line.slice(0, -1).split(',').map(yarnUnquote).filter(Boolean);
+            continue;
+        }
+        if (indent <= 2) {
+            inDeps = false;
+            const m = line.match(/^(\S+)\s+(.+)$/);
+            if (line === 'dependencies:' || line === 'optionalDependencies:') {
+                inDeps = true;
+            }
+            else if (m && yarnUnquote(m[1]) === 'version') {
+                version = yarnUnquote(m[2]);
+            }
+            continue;
+        }
+        if (inDeps) {
+            const m = line.match(/^(\S+)\s+(.+)$/);
+            if (m)
+                deps.push(`${yarnUnquote(m[1])}@${yarnUnquote(m[2])}`);
+        }
+    }
+    flush();
+    for (const [key, ds] of pendingDeps) {
+        const node = nodes.get(key);
+        if (!node)
+            continue;
+        for (const s of ds) {
+            const k = specToKey.get(s);
+            if (k && !node.deps.includes(k))
+                node.deps.push(k);
+        }
+    }
+    const roots = { required: [], optional: [], dev: [] };
+    let hasRoots = false;
+    if (packageJson) {
+        try {
+            const pkg = asRecord(JSON.parse(packageJson));
+            if (pkg) {
+                hasRoots = true;
+                for (const [section, bucket] of [
+                    ['dependencies', roots.required],
+                    ['peerDependencies', roots.required],
+                    ['optionalDependencies', roots.optional],
+                    ['devDependencies', roots.dev],
+                ]) {
+                    for (const [n, range] of Object.entries(asRecord(pkg[section]) ?? {})) {
+                        if (typeof range !== 'string')
+                            continue;
+                        const k = specToKey.get(`${n}@${range}`);
+                        if (k)
+                            bucket.push(k);
+                    }
+                }
+            }
+        }
+        catch {
+            hasRoots = false;
+        }
+    }
+    return scopeLockNodes(nodes, roots, hasRoots);
+}
 /**
  * Parse a TOML `[[package]]` array (the shared shape of `Cargo.lock` and
  * `poetry.lock`): a sequence of blocks each carrying `name = "..."` and
@@ -404,6 +731,125 @@ export function parseMavenDependencies(pomXml) {
     }
     return out;
 }
+/**
+ * Parse a Gradle dependency lockfile — the resolved, exact versions of every
+ * direct and transitive dependency, per configuration. Two layouts:
+ *
+ *   - **`gradle.lockfile`** (Gradle 6.4+, one file per project):
+ *     `group:artifact:version=conf1,conf2,…`; the `empty=…` line lists
+ *     configurations that resolved nothing and is skipped.
+ *   - **`gradle/dependency-locks/<configuration>.lockfile`** (older, one file
+ *     per configuration): bare `group:artifact:version` lines. The
+ *     configuration is the file name, which the caller may pass as
+ *     `configuration`; without it the entries count as `required`.
+ *
+ * A dependency is `dev` only when every configuration that resolved it is a
+ * test configuration (`test…`, or `…Test…` such as `integrationTestRuntimeClasspath`);
+ * any other configuration makes it `required`. Comment lines (`#`) are skipped.
+ */
+export function parseGradleLockfile(lockfile, configuration) {
+    if (!lockfile)
+        return [];
+    const out = [];
+    const seen = new Set();
+    for (const raw of lockfile.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const eq = line.indexOf('=');
+        const coordPart = eq >= 0 ? line.slice(0, eq).trim() : line;
+        if (coordPart === 'empty')
+            continue;
+        const coord = coordPart.split(':');
+        if (coord.length !== 3 || coord.some((c) => !c))
+            continue;
+        const configs = eq >= 0
+            ? line.slice(eq + 1).split(',').map((c) => c.trim()).filter(Boolean)
+            : configuration
+                ? [configuration]
+                : [];
+        const scope = configs.length > 0 && configs.every(isGradleTestConfiguration) ? 'dev' : 'required';
+        const name = `${coord[0]}:${coord[1]}`;
+        const key = `${name}|${coord[2]}|${scope}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push(dep('maven', name, coord[2], scope));
+    }
+    return out;
+}
+function isGradleTestConfiguration(config) {
+    return /^test[A-Z]?/.test(config) || /Test[A-Z]/.test(config);
+}
+/** Maven scopes as printed by `dependency:list` / `dependency:tree`. */
+const MAVEN_SCOPES = 'compile|provided|runtime|test|system|import';
+/**
+ * Coordinate as Maven prints it in resolved output:
+ * `groupId:artifactId:type[:classifier]:version:scope`.
+ */
+const MAVEN_RESOLVED_COORD = new RegExp(`^([\\w.-]+):([\\w.-]+):([\\w.-]+)(?::([\\w.-]+))?:([^:\\s()]+):(${MAVEN_SCOPES})\\b(.*)$`);
+/**
+ * Parse the text output of `mvn dependency:list` or `mvn dependency:tree`
+ * (console or `-DoutputFile`): the dependency set Maven actually resolved,
+ * direct and transitive, after mediation. A `pom.xml` alone cannot give this —
+ * versions come from parents, BOMs and nearest-wins mediation — so the caller
+ * runs Maven (in a build sandbox) and hands the text here; the engine never
+ * runs a build.
+ *
+ * Accepts `[INFO]` prefixes, tree drawing (`+-`, `|`, `\-`), the module
+ * suffix newer plugins print (`-- module x`), and the root project line of a
+ * tree (skipped: it has no scope). Verbose-tree entries that Maven did **not**
+ * resolve (`omitted for conflict with …`) are skipped; `omitted for duplicate`
+ * entries collapse into the one kept. `test` / `provided` → `dev`, a trailing
+ * `(optional)` → `optional`, everything else → `required`. From a tree, each
+ * entry also carries `direct` and `via` (its path from a direct dependency).
+ */
+export function parseMavenResolvedDependencies(output) {
+    if (!output)
+        return [];
+    const out = [];
+    const seen = new Set();
+    const lines = output.split(/\r?\n/).map((raw) => raw.replace(/^\s*\[(?:INFO|WARNING|DEBUG)\]\s?/, ''));
+    // A tree carries the graph: depth from indentation (3 columns per level),
+    // the path from the stack of ancestors. A list does not.
+    const isTree = lines.some((l) => /^[\s|]*[+\\]- /.test(l));
+    const ancestors = [];
+    for (const raw of lines) {
+        const depth = isTree ? Math.round(raw.search(/[A-Za-z0-9(]/) / 3) : -1;
+        if (/omitted for conflict/.test(raw))
+            continue;
+        // Strip tree drawing and the verbose-tree parenthesis around an entry.
+        const line = raw.replace(/^[\s|+\\`-]*/, '').replace(/^\(/, '').trim();
+        const m = MAVEN_RESOLVED_COORD.exec(line);
+        if (!m) {
+            // A root (project) line of a tree starts a new graph.
+            if (isTree && depth === 0 && /^[\w.-]+:[\w.-]+:/.test(line))
+                ancestors.length = 0;
+            continue;
+        }
+        const [, gid, aid, , , version, mvnScope, rest] = m;
+        const name = `${gid}:${aid}`;
+        let via;
+        if (isTree && depth >= 1) {
+            ancestors.length = depth - 1;
+            via = ancestors.slice();
+            ancestors.push(name);
+        }
+        const optional = /\(optional\)/.test(rest);
+        const scope = mvnScope === 'test' || mvnScope === 'provided' ? 'dev' : optional ? 'optional' : 'required';
+        const key = `${name}|${version}|${scope}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        const d = dep('maven', name, version, scope);
+        if (via) {
+            d.direct = via.length === 0;
+            d.via = via;
+        }
+        out.push(d);
+    }
+    return out;
+}
 /**
  * Parse a Cargo `Cargo.toml`. `[dependencies]` → required,
  * `[dev-dependencies]` → dev, `[build-dependencies]` → optional. Handles both
@@ -503,15 +949,29 @@ export function collectDependencies(ctx) {
     if (!ctx)
         return [];
     const all = [];
-    if (ctx.js?.packageJson)
+    // npm resolved sets (exact + transitive) supersede `package.json` (DT4):
+    // pnpm > package-lock > yarn when more than one is supplied.
+    if (ctx.js?.pnpmLock)
+        all.push(...parsePnpmLockDependencies(ctx.js.pnpmLock));
+    else if (ctx.js?.packageLock)
+        all.push(...parseNpmLockDependencies(ctx.js.packageLock));
+    else if (ctx.js?.yarnLock)
+        all.push(...parseYarnLockDependencies(ctx.js.yarnLock, ctx.js.packageJson));
+    else if (ctx.js?.packageJson)
         all.push(...parseNpmDependencies(ctx.js.packageJson));
     if (ctx.python?.requirementsTxt)
         all.push(...parsePypiDependencies(ctx.python.requirementsTxt));
     if (ctx.python?.pyprojectToml)
         all.push(...parsePyprojectDependencies(ctx.python.pyprojectToml));
-    if (ctx.java?.pomXml)
+    // Resolved Java dependency sets (exact + transitive) supersede the declared
+    // manifest they came from, as a lockfile does for npm, Cargo and Poetry.
+    if (ctx.java?.mavenResolved)
+        all.push(...parseMavenResolvedDependencies(ctx.java.mavenResolved));
+    else if (ctx.java?.pomXml)
         all.push(...parseMavenDependencies(ctx.java.pomXml));
-    if (ctx.java?.buildGradle)
+    if (ctx.java?.gradleLockfile)
+        all.push(...parseGradleLockfile(ctx.java.gradleLockfile));
+    else if (ctx.java?.buildGradle)
         all.push(...parseGradleDependencies(ctx.java.buildGradle));
     if (ctx.rust?.cargoToml)
         all.push(...parseCargoDependencies(ctx.rust.cargoToml));
@@ -526,6 +986,57 @@ export function collectDependencies(ctx) {
     }
     return deduped;
 }
+/**
+ * The licence a package's own `package.json` declares, as one expression:
+ * `license` (string, or the legacy `{ type }` object), else the legacy
+ * `licenses: [{ type }]` array joined with ` OR `. `undefined` when the text
+ * does not parse or declares none.
+ */
+export function licenseFromPackageJson(packageJson) {
+    let pkg;
+    try {
+        pkg = JSON.parse(packageJson);
+    }
+    catch {
+        return undefined;
+    }
+    if (!pkg || typeof pkg !== 'object')
+        return undefined;
+    const rec = pkg;
+    const one = (v) => {
+        if (typeof v === 'string' && v.trim())
+            return v.trim();
+        if (v && typeof v === 'object') {
+            const t = v.type;
+            if (typeof t === 'string' && t.trim())
+                return t.trim();
+        }
+        return undefined;
+    };
+    const direct = one(rec.license);
+    if (direct)
+        return direct;
+    if (Array.isArray(rec.licenses)) {
+        const all = rec.licenses.map(one).filter((x) => !!x);
+        if (all.length === 1)
+            return all[0];
+        if (all.length > 1)
+            return `(${all.join(' OR ')})`;
+    }
+    return undefined;
+}
+/**
+ * Fill in `license` from an offline map for dependencies that have none.
+ * Returns new objects; an existing `license` is never overwritten.
+ */
+export function applyLicenses(deps, map) {
+    return deps.map((d) => {
+        if (d.license)
+            return d;
+        const lic = map[`${d.name}@${d.version}`] ?? map[d.name];
+        return lic ? { ...d, license: lic } : d;
+    });
+}
 // ---------------------------------------------------------------------------
 // emitters
 // ---------------------------------------------------------------------------