packtory 0.0.8 → 0.0.10

package/sbom/license-resolver.d.ts

@@ -0,0 +1,14 @@
+import type { FileManager } from '../file-manager/file-manager.ts';
+type LicenseResolverDependencies = {
+    readonly fileManager: FileManager;
+};
+type LicenseResolveOptions = {
+    readonly projectFolder: string;
+    readonly dependencyName: string;
+};
+export type LicenseResolver = {
+    resolveLicense: (options: LicenseResolveOptions) => Promise<string | undefined>;
+};
+export declare function createLicenseResolver(dependencies: LicenseResolverDependencies): LicenseResolver;
+export {};
+//# sourceMappingURL=license-resolver.d.ts.map

package/sbom/license-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-resolver.d.ts","sourceRoot":"","sources":["../../../../source/sbom/license-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAGnE,KAAK,2BAA2B,GAAG;IAC/B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACrC,CAAC;AAEF,KAAK,qBAAqB,GAAG;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,cAAc,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACnF,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,2BAA2B,GAAG,eAAe,CAqBhG"}

package/sbom/license-resolver.js

@@ -0,0 +1,3 @@
+import path from 'node:path';
+import { extractLicenseFromManifest } from "./extract-license.js";
+//# sourceMappingURL=license-resolver.js.map

package/sbom/license-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-resolver.js","sourceRoot":"","sources":["../../../../source/sbom/license-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW;AAE5B,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB"}

package/sbom/sbom-builder.js

@@ -0,0 +1,68 @@
+import * as cdx from '@cyclonedx/cyclonedx-library';
+import spdxParse from 'spdx-expression-parse';
+function isParseableSpdxExpression(value) {
+    try {
+        spdxParse(value);
+    }
+    catch {
+        return false;
+    }
+    return true;
+}
+function buildPurl(name, versionOrSpecifier) {
+    return `pkg:npm/${name}@${encodeURIComponent(versionOrSpecifier)}`;
+}
+const componentScopeByKind = {
+    peer: cdx.Enums.ComponentScope.Optional,
+    runtime: cdx.Enums.ComponentScope.Required
+};
+function scopeFor(kind) {
+    return componentScopeByKind[kind];
+}
+function attachLicense(component, license) {
+    if (license === undefined) {
+        return;
+    }
+    if (isParseableSpdxExpression(license)) {
+        component.licenses.add(new cdx.Models.LicenseExpression(license));
+        return;
+    }
+    component.licenses.add(new cdx.Models.NamedLicense(license));
+}
+function buildRootComponent(rootComponent) {
+    const purl = buildPurl(rootComponent.name, rootComponent.version);
+    return new cdx.Models.Component(cdx.Enums.ComponentType.Library, rootComponent.name, {
+        version: rootComponent.version,
+        bomRef: purl,
+        purl
+    });
+}
+function buildDependencyComponent(dependency) {
+    const purl = buildPurl(dependency.name, dependency.specifier);
+    const component = new cdx.Models.Component(cdx.Enums.ComponentType.Library, dependency.name, {
+        version: dependency.specifier,
+        bomRef: purl,
+        purl,
+        scope: scopeFor(dependency.kind)
+    });
+    attachLicense(component, dependency.license);
+    return component;
+}
+function buildToolComponent(toolVersion) {
+    return new cdx.Models.Component(cdx.Enums.ComponentType.Application, 'packtory', {
+        version: toolVersion
+    });
+}
+export function buildSbom(options) {
+    const bom = new cdx.Models.Bom();
+    bom.metadata.tools.components.add(buildToolComponent(options.toolVersion));
+    const rootComponent = buildRootComponent(options.rootComponent);
+    bom.metadata.component = rootComponent;
+    for (const dependency of options.dependencies) {
+        const component = buildDependencyComponent(dependency);
+        bom.components.add(component);
+        rootComponent.dependencies.add(component.bomRef);
+    }
+    return bom;
+}
+//# sourceMappingURL=sbom-builder.js.map

package/sbom/sbom-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom-builder.js","sourceRoot":"","sources":["../../../../source/sbom/sbom-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,8BAA8B,CAAC;AACpD,OAAO,SAAS,MAAM,uBAAuB,CAAC;AAsB9C,SAAS,yBAAyB,CAAC,KAAa;IAC5C,IAAI,CAAC;QACD,SAAS,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,kBAA0B;IACvD,OAAO,WAAW,IAAI,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,oBAAoB,GAAmE;IACzF,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ;IACvC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ;CAC7C,CAAC;AAEF,SAAS,QAAQ,CAAC,IAAwB;IACtC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,aAAa,CAAC,SAA+B,EAAE,OAA2B;IAC/E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO;IACX,CAAC;IACD,IAAI,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;QAClE,OAAO;IACX,CAAC;IACD,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,kBAAkB,CAAC,aAAgC;IACxD,MAAM,IAAI,GAAG,SAAS,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IAClE,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,EAAE;QACjF,OAAO,EAAE,aAAa,CAAC,OAAO;QAC9B,MAAM,EAAE,IAAI;QACZ,IAAI;KACP,CAAC,CAAC;AACP,CAAC;AAED,SAAS,wBAAwB,CAAC,UAA0B;IACxD,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE;QACzF,OAAO,EAAE,UAAU,CAAC,SAAS;QAC7B,MAAM,EAAE,IAAI;QACZ,IAAI;QACJ,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;KACnC,CAAC,CAAC;IACH,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,SAAS,kBAAkB,CAAC,WAAmB;IAC3C,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,EAAE,UAAU,EAAE;QAC7E,OAAO,EAAE,WAAW;KACvB,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAA2B;IACjD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IACjC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAE3E,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAChE,GAAG,CAAC,QAAQ,CAAC,SAAS,GAAG,aAAa,CAAC;IAEvC,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QACvD,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,GAAG,CAAC;AACf,CAAC"}

package/sbom/sbom-file.d.ts

@@ -0,0 +1,19 @@
+import type { PublishSettings } from '../config/publish-settings.ts';
+import type { FileDescription } from '../file-manager/file-description.ts';
+import type { VersionedBundleWithManifest } from '../version-manager/versioned-bundle.ts';
+import type { LicenseResolver } from './license-resolver.ts';
+import type { SbomSerializer } from './sbom-serializer.ts';
+type ToolVersionProvider = () => Promise<string>;
+type SbomFileBuilderDependencies = {
+    readonly licenseResolver: LicenseResolver;
+    readonly sbomSerializer: SbomSerializer;
+    readonly toolVersionProvider: ToolVersionProvider;
+    readonly projectFolder: string;
+};
+type SbomSibling = Pick<VersionedBundleWithManifest, 'name' | 'packageJson'>;
+export type SbomFileBuilder = {
+    generate: (bundle: VersionedBundleWithManifest, siblings: readonly SbomSibling[], publishSettings: PublishSettings) => Promise<readonly FileDescription[] | undefined>;
+};
+export declare function createSbomFileBuilder(dependencies: SbomFileBuilderDependencies): SbomFileBuilder;
+export {};
+//# sourceMappingURL=sbom-file.d.ts.map

package/sbom/sbom-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom-file.d.ts","sourceRoot":"","sources":["../../../../source/sbom/sbom-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AAE1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D,KAAK,mBAAmB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAEjD,KAAK,2BAA2B,GAAG;IAC/B,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAClD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF,KAAK,WAAW,GAAG,IAAI,CAAC,2BAA2B,EAAE,MAAM,GAAG,aAAa,CAAC,CAAC;AAE7E,MAAM,MAAM,eAAe,GAAG;IAC1B,QAAQ,EAAE,CACN,MAAM,EAAE,2BAA2B,EACnC,QAAQ,EAAE,SAAS,WAAW,EAAE,EAChC,eAAe,EAAE,eAAe,KAC/B,OAAO,CAAC,SAAS,eAAe,EAAE,GAAG,SAAS,CAAC,CAAC;CACxD,CAAC;AAuBF,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,2BAA2B,GAAG,eAAe,CAqDhG"}

package/sbom/sbom-file.js

@@ -0,0 +1,3 @@
+import { extractLicenseFromManifest } from "./extract-license.js";
+import { buildSbom } from "./sbom-builder.js";
+//# sourceMappingURL=sbom-file.js.map

package/sbom/sbom-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom-file.js","sourceRoot":"","sources":["../../../../source/sbom/sbom-file.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB;AAGjE,OAAO,EAAE,SAAS,EAAgD,MAAM,mBAAmB"}

package/sbom/sbom-serializer.d.ts

@@ -0,0 +1,6 @@
+import * as cdx from '@cyclonedx/cyclonedx-library';
+export type SbomSerializer = {
+    serialize: (bom: cdx.Models.Bom) => string;
+};
+export declare function createSbomSerializer(): SbomSerializer;
+//# sourceMappingURL=sbom-serializer.d.ts.map

package/sbom/sbom-serializer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom-serializer.d.ts","sourceRoot":"","sources":["../../../../source/sbom/sbom-serializer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,8BAA8B,CAAC;AAEpD,MAAM,MAAM,cAAc,GAAG;IACzB,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC;CAC9C,CAAC;AAEF,wBAAgB,oBAAoB,IAAI,cAAc,CASrD"}

package/sbom/sbom-serializer.js

@@ -0,0 +1,2 @@
+import * as cdx from '@cyclonedx/cyclonedx-library';
+//# sourceMappingURL=sbom-serializer.js.map

package/sbom/sbom-serializer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom-serializer.js","sourceRoot":"","sources":["../../../../source/sbom/sbom-serializer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,8BAA8B"}

package/sbom/tool-version.js

@@ -0,0 +1,44 @@
+import { isPlainObject } from 'remeda';
+const candidatePackageNames = ['@packtory/cli', 'packtory'];
+const nodeModulesSegment = 'node_modules';
+const pathSeparators = /[/\\]/u;
+function isInsideNodeModules(filePath) {
+    return filePath.split(pathSeparators).includes(nodeModulesSegment);
+}
+function buildUnresolvableMessage() {
+    const intro = 'Cannot determine packtory tool version: neither "@packtory/cli" nor "packtory" is resolvable.';
+    return `${intro} Install packtory via npm so it lives under node_modules/.`;
+}
+function buildOutsideNodeModulesMessage(packageJsonPath) {
+    const intro = `Refusing to read packtory tool version from "${packageJsonPath}":`;
+    const reason = 'the resolved package.json is not inside a node_modules folder.';
+    return `${intro} ${reason} Install packtory via npm to make its real version available.`;
+}
+function findInstalledPackagePath(resolvePackagePath) {
+    for (const candidatePackageName of candidatePackageNames) {
+        const resolved = resolvePackagePath(`${candidatePackageName}/package.json`);
+        if (resolved !== undefined) {
+            return resolved;
+        }
+    }
+    return undefined;
+}
+export function createPacktoryToolVersionResolver(dependencies) {
+    const { fileManager, resolvePackagePath } = dependencies;
+    return async function resolvePacktoryToolVersion() {
+        const packageJsonPath = findInstalledPackagePath(resolvePackagePath);
+        if (packageJsonPath === undefined) {
+            throw new Error(buildUnresolvableMessage());
+        }
+        if (!isInsideNodeModules(packageJsonPath)) {
+            throw new Error(buildOutsideNodeModulesMessage(packageJsonPath));
+        }
+        const content = await fileManager.readFile(packageJsonPath);
+        const parsed = JSON.parse(content);
+        if (!isPlainObject(parsed) || typeof parsed.version !== 'string') {
+            throw new Error(`Resolved packtory package.json at "${packageJsonPath}" is missing a version field`);
+        }
+        return parsed.version;
+    };
+}
+//# sourceMappingURL=tool-version.js.map

package/sbom/tool-version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-version.js","sourceRoot":"","sources":["../../../../source/sbom/tool-version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAGvC,MAAM,qBAAqB,GAAG,CAAC,eAAe,EAAE,UAAU,CAAU,CAAC;AACrE,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAC1C,MAAM,cAAc,GAAG,QAAQ,CAAC;AAOhC,SAAS,mBAAmB,CAAC,QAAgB;IACzC,OAAO,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,wBAAwB;IAC7B,MAAM,KAAK,GAAG,+FAA+F,CAAC;IAC9G,OAAO,GAAG,KAAK,4DAA4D,CAAC;AAChF,CAAC;AAED,SAAS,8BAA8B,CAAC,eAAuB;IAC3D,MAAM,KAAK,GAAG,gDAAgD,eAAe,IAAI,CAAC;IAClF,MAAM,MAAM,GAAG,gEAAgE,CAAC;IAChF,OAAO,GAAG,KAAK,IAAI,MAAM,+DAA+D,CAAC;AAC7F,CAAC;AAED,SAAS,wBAAwB,CAC7B,kBAAyE;IAEzE,KAAK,MAAM,oBAAoB,IAAI,qBAAqB,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,oBAAoB,eAAe,CAAC,CAAC;QAC5E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,QAAQ,CAAC;QACpB,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC7C,YAA6C;IAE7C,MAAM,EAAE,WAAW,EAAE,kBAAkB,EAAE,GAAG,YAAY,CAAC;IAEzD,OAAO,KAAK,UAAU,0BAA0B;QAC5C,MAAM,eAAe,GAAG,wBAAwB,CAAC,kBAAkB,CAAC,CAAC;QACrE,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,eAAe,CAAC,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,sCAAsC,eAAe,8BAA8B,CAAC,CAAC;QACzG,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC;IAC1B,CAAC,CAAC;AACN,CAAC"}

package/sbom.cdx.json

@@ -0,0 +1,390 @@
+{
+    "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
+    "bomFormat": "CycloneDX",
+    "specVersion": "1.6",
+    "version": 1,
+    "metadata": {
+        "tools": {
+            "components": [
+                {
+                    "type": "application",
+                    "name": "packtory",
+                    "version": "0.0.9"
+                }
+            ]
+        },
+        "component": {
+            "type": "library",
+            "name": "packtory",
+            "version": "0.0.10",
+            "bom-ref": "pkg:npm/packtory@0.0.10",
+            "purl": "pkg:npm/packtory@0.0.10"
+        }
+    },
+    "components": [
+        {
+            "type": "library",
+            "name": "@cyclonedx/cyclonedx-library",
+            "version": "10.0.0",
+            "bom-ref": "pkg:npm/@cyclonedx/cyclonedx-library@10.0.0",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "Apache-2.0"
+                }
+            ],
+            "purl": "pkg:npm/@cyclonedx/cyclonedx-library@10.0.0"
+        },
+        {
+            "type": "library",
+            "name": "@jridgewell/gen-mapping",
+            "version": "0.3.13",
+            "bom-ref": "pkg:npm/@jridgewell/gen-mapping@0.3.13",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "MIT"
+                }
+            ],
+            "purl": "pkg:npm/@jridgewell/gen-mapping@0.3.13"
+        },
+        {
+            "type": "library",
+            "name": "@jridgewell/trace-mapping",
+            "version": "0.3.31",
+            "bom-ref": "pkg:npm/@jridgewell/trace-mapping@0.3.31",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "MIT"
+                }
+            ],
+            "purl": "pkg:npm/@jridgewell/trace-mapping@0.3.31"
+        },
+        {
+            "type": "library",
+            "name": "@schema-hub/zod-error-formatter",
+            "version": "0.0.11",
+            "bom-ref": "pkg:npm/@schema-hub/zod-error-formatter@0.0.11",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "MIT"
+                }
+            ],
+            "purl": "pkg:npm/@schema-hub/zod-error-formatter@0.0.11"
+        },
+        {
+            "type": "library",
+            "name": "@ts-morph/common",
+            "version": "0.29.0",
+            "bom-ref": "pkg:npm/@ts-morph/common@0.29.0",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "MIT"
+                }
+            ],
+            "purl": "pkg:npm/@ts-morph/common@0.29.0"
+        },
+        {
+            "type": "library",
+            "name": "@types/libnpmpublish",
+            "version": "9.0.1",
+            "bom-ref": "pkg:npm/@types/libnpmpublish@9.0.1",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "MIT"
+                }
+            ],
+            "purl": "pkg:npm/@types/libnpmpublish@9.0.1"
+        },
+        {
+            "type": "library",
+            "name": "@types/npm-registry-fetch",
+            "version": "8.0.9",
+            "bom-ref": "pkg:npm/@types/npm-registry-fetch@8.0.9",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "MIT"
+                }
+            ],
+            "purl": "pkg:npm/@types/npm-registry-fetch@8.0.9"
+        },
+        {
+            "type": "library",
+            "name": "common-tags",
+            "version": "1.8.2",
+            "bom-ref": "pkg:npm/common-tags@1.8.2",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "MIT"
+                }
+            ],
+            "purl": "pkg:npm/common-tags@1.8.2"
+        },
+        {
+            "type": "library",
+            "name": "hosted-git-info",
+            "version": "10.1.0",
+            "bom-ref": "pkg:npm/hosted-git-info@10.1.0",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "ISC"
+                }
+            ],
+            "purl": "pkg:npm/hosted-git-info@10.1.0"
+        },
+        {
+            "type": "library",
+            "name": "libnpmpublish",
+            "version": "11.1.3",
+            "bom-ref": "pkg:npm/libnpmpublish@11.1.3",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "ISC"
+                }
+            ],
+            "purl": "pkg:npm/libnpmpublish@11.1.3"
+        },
+        {
+            "type": "library",
+            "name": "npm-package-arg",
+            "version": "14.0.0",
+            "bom-ref": "pkg:npm/npm-package-arg@14.0.0",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "ISC"
+                }
+            ],
+            "purl": "pkg:npm/npm-package-arg@14.0.0"
+        },
+        {
+            "type": "library",
+            "name": "npm-registry-fetch",
+            "version": "19.1.1",
+            "bom-ref": "pkg:npm/npm-registry-fetch@19.1.1",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "ISC"
+                }
+            ],
+            "purl": "pkg:npm/npm-registry-fetch@19.1.1"
+        },
+        {
+            "type": "library",
+            "name": "remeda",
+            "version": "2.34.1",
+            "bom-ref": "pkg:npm/remeda@2.34.1",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "MIT"
+                }
+            ],
+            "purl": "pkg:npm/remeda@2.34.1"
+        },
+        {
+            "type": "library",
+            "name": "semver",
+            "version": "7.8.0",
+            "bom-ref": "pkg:npm/semver@7.8.0",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "ISC"
+                }
+            ],
+            "purl": "pkg:npm/semver@7.8.0"
+        },
+        {
+            "type": "library",
+            "name": "spdx-expression-parse",
+            "version": "4.0.0",
+            "bom-ref": "pkg:npm/spdx-expression-parse@4.0.0",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "MIT"
+                }
+            ],
+            "purl": "pkg:npm/spdx-expression-parse@4.0.0"
+        },
+        {
+            "type": "library",
+            "name": "tar-stream",
+            "version": "3.1.8",
+            "bom-ref": "pkg:npm/tar-stream@3.1.8",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "MIT"
+                }
+            ],
+            "purl": "pkg:npm/tar-stream@3.1.8"
+        },
+        {
+            "type": "library",
+            "name": "true-myth",
+            "version": "9.3.1",
+            "bom-ref": "pkg:npm/true-myth@9.3.1",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "MIT"
+                }
+            ],
+            "purl": "pkg:npm/true-myth@9.3.1"
+        },
+        {
+            "type": "library",
+            "name": "ts-morph",
+            "version": "27.0.2",
+            "bom-ref": "pkg:npm/ts-morph@27.0.2",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "MIT"
+                }
+            ],
+            "purl": "pkg:npm/ts-morph@27.0.2"
+        },
+        {
+            "type": "library",
+            "name": "type-fest",
+            "version": "5.6.0",
+            "bom-ref": "pkg:npm/type-fest@5.6.0",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "(MIT OR CC0-1.0)"
+                }
+            ],
+            "purl": "pkg:npm/type-fest@5.6.0"
+        },
+        {
+            "type": "library",
+            "name": "unix-permissions",
+            "version": "6.0.1",
+            "bom-ref": "pkg:npm/unix-permissions@6.0.1",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "Apache-2.0"
+                }
+            ],
+            "purl": "pkg:npm/unix-permissions@6.0.1"
+        },
+        {
+            "type": "library",
+            "name": "zod",
+            "version": "4.4.3",
+            "bom-ref": "pkg:npm/zod@4.4.3",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "MIT"
+                }
+            ],
+            "purl": "pkg:npm/zod@4.4.3"
+        }
+    ],
+    "dependencies": [
+        {
+            "ref": "pkg:npm/@cyclonedx/cyclonedx-library@10.0.0"
+        },
+        {
+            "ref": "pkg:npm/@jridgewell/gen-mapping@0.3.13"
+        },
+        {
+            "ref": "pkg:npm/@jridgewell/trace-mapping@0.3.31"
+        },
+        {
+            "ref": "pkg:npm/@schema-hub/zod-error-formatter@0.0.11"
+        },
+        {
+            "ref": "pkg:npm/@ts-morph/common@0.29.0"
+        },
+        {
+            "ref": "pkg:npm/@types/libnpmpublish@9.0.1"
+        },
+        {
+            "ref": "pkg:npm/@types/npm-registry-fetch@8.0.9"
+        },
+        {
+            "ref": "pkg:npm/common-tags@1.8.2"
+        },
+        {
+            "ref": "pkg:npm/hosted-git-info@10.1.0"
+        },
+        {
+            "ref": "pkg:npm/libnpmpublish@11.1.3"
+        },
+        {
+            "ref": "pkg:npm/npm-package-arg@14.0.0"
+        },
+        {
+            "ref": "pkg:npm/npm-registry-fetch@19.1.1"
+        },
+        {
+            "ref": "pkg:npm/packtory@0.0.10",
+            "dependsOn": [
+                "pkg:npm/@cyclonedx/cyclonedx-library@10.0.0",
+                "pkg:npm/@jridgewell/gen-mapping@0.3.13",
+                "pkg:npm/@jridgewell/trace-mapping@0.3.31",
+                "pkg:npm/@schema-hub/zod-error-formatter@0.0.11",
+                "pkg:npm/@ts-morph/common@0.29.0",
+                "pkg:npm/@types/libnpmpublish@9.0.1",
+                "pkg:npm/@types/npm-registry-fetch@8.0.9",
+                "pkg:npm/common-tags@1.8.2",
+                "pkg:npm/hosted-git-info@10.1.0",
+                "pkg:npm/libnpmpublish@11.1.3",
+                "pkg:npm/npm-package-arg@14.0.0",
+                "pkg:npm/npm-registry-fetch@19.1.1",
+                "pkg:npm/remeda@2.34.1",
+                "pkg:npm/semver@7.8.0",
+                "pkg:npm/spdx-expression-parse@4.0.0",
+                "pkg:npm/tar-stream@3.1.8",
+                "pkg:npm/true-myth@9.3.1",
+                "pkg:npm/ts-morph@27.0.2",
+                "pkg:npm/type-fest@5.6.0",
+                "pkg:npm/unix-permissions@6.0.1",
+                "pkg:npm/zod@4.4.3"
+            ]
+        },
+        {
+            "ref": "pkg:npm/remeda@2.34.1"
+        },
+        {
+            "ref": "pkg:npm/semver@7.8.0"
+        },
+        {
+            "ref": "pkg:npm/spdx-expression-parse@4.0.0"
+        },
+        {
+            "ref": "pkg:npm/tar-stream@3.1.8"
+        },
+        {
+            "ref": "pkg:npm/true-myth@9.3.1"
+        },
+        {
+            "ref": "pkg:npm/ts-morph@27.0.2"
+        },
+        {
+            "ref": "pkg:npm/type-fest@5.6.0"
+        },
+        {
+            "ref": "pkg:npm/unix-permissions@6.0.1"
+        },
+        {
+            "ref": "pkg:npm/zod@4.4.3"
+        }
+    ]
+}

package/tar/extract-tar.js

@@ -1,17 +1,4 @@
 import { createGunzip } from 'node:zlib';
 import { Readable } from 'node:stream';
 import { extract } from 'tar-stream';
-export async function extractTarEntries(buffer) {
-    const extractStream = extract();
-    const stream = Readable.from(buffer).pipe(createGunzip()).pipe(extractStream);
-    const entries = [];
-    for await (const entry of stream) {
-        let result = '';
-        for await (const chunk of entry) {
-            result += chunk.toString();
-        }
-        entries.push({ header: entry.header, content: result });
-    }
-    return entries;
-}
 //# sourceMappingURL=extract-tar.js.map

package/tar/extract-tar.js.map

@@ -1 +1 @@
-{"version":3,"file":"extract-tar.js","sourceRoot":"","sources":["../../../../source/tar/extract-tar.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,OAAO,EAAmC,MAAM,YAAY,CAAC;AAOtE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc;IAClD,MAAM,aAAa,GAAG,OAAO,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAe,EAAE,CAAC;IAE/B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC/B,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/B,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO,OAAO,CAAC;AACnB,CAAC"}
+{"version":3,"file":"extract-tar.js","sourceRoot":"","sources":["../../../../source/tar/extract-tar.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa;AACtC,OAAO,EAAE,OAAO,EAAmC,MAAM,YAAY"}

package/tar/tarball-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tarball-builder.d.ts","sourceRoot":"","sources":["../../../../source/tar/tarball-builder.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAE3E,MAAM,MAAM,cAAc,GAAG;IACzB,KAAK,EAAE,CAAC,gBAAgB,EAAE,SAAS,eAAe,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5E,CAAC;AAcF,wBAAgB,oBAAoB,IAAI,cAAc,CAuCrD"}
+{"version":3,"file":"tarball-builder.d.ts","sourceRoot":"","sources":["../../../../source/tar/tarball-builder.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAE3E,MAAM,MAAM,cAAc,GAAG;IACzB,KAAK,EAAE,CAAC,gBAAgB,EAAE,SAAS,eAAe,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5E,CAAC;AAmBF,wBAAgB,oBAAoB,IAAI,cAAc,CAsCrD"}

package/tar/tarball-builder.js

@@ -2,9 +2,13 @@ import zlib from 'node:zlib';
 import tar, {} from 'tar-stream';
 const gzipHeaderOperationSystemTypeFieldIndex = 9;
 const gzipHeaderOperationSystemTypeUnknown = 255;
-function unsetOperatingSystemGzipHeaderField(data) {
-    // eslint-disable-next-line no-param-reassign -- copying the whole buffer would be really inefficient
-    data[gzipHeaderOperationSystemTypeFieldIndex] = gzipHeaderOperationSystemTypeUnknown;
+function normalizeGzipHeader(data) {
+    const normalizedData = Buffer.from(data);
+    normalizedData[gzipHeaderOperationSystemTypeFieldIndex] = gzipHeaderOperationSystemTypeUnknown;
+    return normalizedData;
+}
+function toBuffer(chunk) {
+    return Buffer.from(chunk);
 }
 const staticFileModificationTime = new Date(0);
 const executableFileMode = 493;
@@ -30,12 +34,11 @@ export function createTarballBuilder() {
             const tarballStream = pack.pipe(gzipStream);
             const chunks = [];
             for await (const chunk of tarballStream) {
-                // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- ok in this case
-                chunks.push(chunk);
+                // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- gzip stream yields buffers in this usage
+                chunks.push(toBuffer(chunk));
             }
             const tarData = Buffer.concat(chunks);
-            unsetOperatingSystemGzipHeaderField(tarData);
-            return tarData;
+            return normalizeGzipHeader(tarData);
         }
     };
 }