packtory 0.0.95 → 0.0.97

package/resource-resolver/resource-resolve-options.d.ts

@@ -13,5 +13,10 @@ export type ResourceResolveOptions = {
     readonly roots: Roots;
     readonly surface?: PackageSurface | undefined;
 };
+export type ResolvedRootsAndSurface = {
+    readonly roots: Roots;
+    readonly surface: PackageSurface;
+};
+export declare function resolveRootsAndSurface(options: ResourceResolveOptions): ResolvedRootsAndSurface;
 export {};
 //# sourceMappingURL=resource-resolve-options.d.ts.map

package/resource-resolver/resource-resolve-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-resolve-options.d.ts","sourceRoot":"","sources":["../../../../source/resource-resolver/resource-resolve-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE5F,KAAK,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;AAE5C,MAAM,MAAM,sBAAsB,GAAG;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC,yBAAyB,GAAG,MAAM,CAAC,EAAE,CAAC;IAC1E,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;CACjD,CAAC;AAEF,MAAM,CAAgC,EAGrC,CAAC"}
+{"version":3,"file":"resource-resolve-options.d.ts","sourceRoot":"","sources":["../../../../source/resource-resolver/resource-resolve-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE5F,KAAK,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;AAE5C,MAAM,MAAM,sBAAsB,GAAG;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC,yBAAyB,GAAG,MAAM,CAAC,EAAE,CAAC;IAC1E,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IAClC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;CACpC,CAAC;AAEF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,sBAAsB,GAAG,uBAAuB,CAY/F"}

package/resource-resolver/resource-resolve-options.js

@@ -1,2 +1,14 @@
-import "../package-surface/surface.js";
+import { implicitPackageSurface } from "../package-surface/surface.js";
+export function resolveRootsAndSurface(options) {
+    const rootEntries = Object.entries(options.roots);
+    const [firstRootEntry] = rootEntries;
+    if (firstRootEntry === undefined) {
+        throw new Error(`Package "${options.name}" must define at least one root`);
+    }
+    const [firstRootId] = firstRootEntry;
+    return {
+        roots: options.roots,
+        surface: options.surface ?? implicitPackageSurface(firstRootId)
+    };
+}
 //# sourceMappingURL=resource-resolve-options.js.map

package/resource-resolver/resource-resolve-options.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-resolve-options.js","sourceRoot":"","sources":["../../../../source/resource-resolver/resource-resolve-options.ts"],"names":[],"mappings":"AAGA,OAA4D,+BAA+B,CAAC"}
+{"version":3,"file":"resource-resolve-options.js","sourceRoot":"","sources":["../../../../source/resource-resolver/resource-resolve-options.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,sBAAsB,EAAuB,MAAM,+BAA+B,CAAC;AAoB5F,MAAM,UAAU,sBAAsB,CAAC,OAA+B;IAClE,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,CAAE,cAAc,CAAE,GAAG,WAAW,CAAC;IACvC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,YAAY,OAAO,CAAC,IAAI,iCAAiC,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,CAAE,WAAW,CAAE,GAAG,cAAc,CAAC;IACvC,OAAO;QACH,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,sBAAsB,CAAC,WAAW,CAAC;KAClE,CAAC;AACN,CAAC"}

package/resource-resolver/resource-resolver.d.ts

@@ -0,0 +1,15 @@
+import type { DependencyScanner } from '../dependency-scanner/scanner.ts';
+import type { FileManager } from '../file-manager/file-manager.ts';
+import type { ResolvedBundle } from './resolved-bundle.ts';
+import { type ResourceResolveOptions } from './resource-resolve-options.ts';
+export type ResourceResolverDependencies = {
+    readonly dependencyScanner: DependencyScanner;
+    readonly fileManager: FileManager;
+};
+export type ResourceResolver = {
+    resolve: (options: ResourceResolveOptions) => Promise<ResolvedBundle>;
+    resolveWithPromotedDeclarations: (options: ResourceResolveOptions, promotedDeclarationEntryFiles: readonly string[]) => Promise<ResolvedBundle>;
+    resolveWithPromotedDeclarationCompanions: (options: ResourceResolveOptions, substitutedInputFilePaths: ReadonlySet<string>) => Promise<ResolvedBundle>;
+};
+export declare function createResourceResolver(dependencies: ResourceResolverDependencies): ResourceResolver;
+//# sourceMappingURL=resource-resolver.d.ts.map

package/resource-resolver/resource-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-resolver.d.ts","sourceRoot":"","sources":["../../../../source/resource-resolver/resource-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAO1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAKnE,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAEpG,MAAM,MAAM,4BAA4B,GAAG;IACvC,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC3B,OAAO,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACtE,+BAA+B,EAAE,CAC7B,OAAO,EAAE,sBAAsB,EAC/B,6BAA6B,EAAE,SAAS,MAAM,EAAE,KAC/C,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7B,wCAAwC,EAAE,CACtC,OAAO,EAAE,sBAAsB,EAC/B,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAAC,KAC7C,OAAO,CAAC,cAAc,CAAC,CAAC;CAChC,CAAC;AAmIF,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,4BAA4B,GAAG,gBAAgB,CAmEnG"}

package/resource-resolver/resource-resolver.js

@@ -1,6 +1,129 @@
-import "../common/declaration-companion-paths.js";
-import "./content.js";
-import "./bundle-resource-lookup.js";
-import "./dependency-resolution-walker.js";
-import "./resource-resolve-options.js";
+import { mergeExternalDependencyReference } from "../dependency-scanner/external-dependencies.js";
+import { declarationCompanionCandidates } from "../common/declaration-companion-paths.js";
+import { combineAllBundleFiles } from "./content.js";
+import { buildResolvedRoots } from "./bundle-resource-lookup.js";
+import { resolveDependenciesForAllRoots } from "./dependency-resolution-walker.js";
+import { resolveRootsAndSurface } from "./resource-resolve-options.js";
+const packageJsonIndentationSpaces = 4;
+function serializeVirtualManifest(mainPackageJson) {
+    return `${JSON.stringify(mainPackageJson, null, packageJsonIndentationSpaces)}\n`;
+}
+function hasDeclarationRoots(options) {
+    const normalized = resolveRootsAndSurface(options);
+    return Object.values(normalized.roots).some(function (root) {
+        return root.declarationFile !== undefined;
+    });
+}
+async function findReadableDeclarationCompanion(fileManager, inputFilePath) {
+    for (const candidate of declarationCompanionCandidates(inputFilePath)) {
+        const readability = await fileManager.checkReadability(candidate);
+        if (readability.isReadable) {
+            return candidate;
+        }
+    }
+    return undefined;
+}
+async function findReadableDeclarationCompanions(fileManager, substitutedInputFilePaths) {
+    const companions = [];
+    for (const inputFilePath of substitutedInputFilePaths) {
+        const companion = await findReadableDeclarationCompanion(fileManager, inputFilePath);
+        if (companion !== undefined) {
+            companions.push(companion);
+        }
+    }
+    return companions;
+}
+async function resolveFileDescription(fileManager, bundleFile, mainPackageJson) {
+    if (bundleFile.isGeneratedManifest) {
+        return {
+            content: serializeVirtualManifest(mainPackageJson),
+            isExecutable: false,
+            inputFilePath: bundleFile.inputFilePath,
+            targetFilePath: bundleFile.targetFilePath
+        };
+    }
+    return await fileManager.getTransferableFileDescriptionFromPath(bundleFile.inputFilePath, bundleFile.targetFilePath);
+}
+function targetPathByInputPath(resources) {
+    return new Map(resources.map(function (resource) {
+        return [resource.fileDescription.inputFilePath, resource.fileDescription.targetFilePath];
+    }));
+}
+function targetFilePathFor(targetByInputPath, inputFilePath) {
+    return targetByInputPath.get(inputFilePath) ?? inputFilePath;
+}
+function dependencySpecifierReferences(dependency) {
+    if (dependency.references !== undefined) {
+        return dependency.references.map(function (reference) {
+            return {
+                name: dependency.name,
+                targetFilePath: reference.targetFilePath,
+                sourceSpecifier: reference.sourceSpecifier,
+                emittedSpecifier: reference.emittedSpecifier
+            };
+        });
+    }
+    return dependency.referencedFrom.map(function (targetFilePath) {
+        return {
+            name: dependency.name,
+            targetFilePath,
+            sourceSpecifier: dependency.name,
+            emittedSpecifier: dependency.name
+        };
+    });
+}
+function externalDependenciesWithTargetPaths(dependencies, targetByInputPath) {
+    const dependenciesByName = new Map();
+    for (const dependency of dependencies.values()) {
+        for (const reference of dependencySpecifierReferences(dependency)) {
+            const existing = dependenciesByName.get(reference.name);
+            dependenciesByName.set(reference.name, mergeExternalDependencyReference({
+                name: reference.name,
+                sourceSpecifier: reference.sourceSpecifier,
+                emittedSpecifier: reference.emittedSpecifier
+            }, targetFilePathFor(targetByInputPath, reference.targetFilePath), existing));
+        }
+    }
+    return dependenciesByName;
+}
+export function createResourceResolver(dependencies) {
+    const { dependencyScanner, fileManager } = dependencies;
+    async function resolveWithPromotedDeclarations(options, promotedDeclarationEntryFiles) {
+        const normalized = resolveRootsAndSurface(options);
+        const resolvedDependencies = await resolveDependenciesForAllRoots({ dependencyScanner, fileManager }, options, promotedDeclarationEntryFiles);
+        const bundleFiles = combineAllBundleFiles(options.sourcesFolder, resolvedDependencies.localFiles, options.additionalFiles);
+        const contents = await Promise.all(bundleFiles.map(async function (bundleFile) {
+            const fileDescription = await resolveFileDescription(fileManager, bundleFile, options.mainPackageJson);
+            return {
+                fileDescription,
+                directDependencies: bundleFile.directDependencies,
+                moduleReferences: bundleFile.moduleReferences,
+                project: bundleFile.project,
+                isExplicitlyIncluded: bundleFile.isExplicitlyIncluded,
+                ...bundleFile.isGeneratedManifest ? { isGeneratedManifest: true } : {}
+            };
+        }));
+        const targetByInputPath = targetPathByInputPath(contents);
+        return {
+            contents,
+            name: options.name,
+            exportPackageJson: options.exportPackageJson,
+            surface: normalized.surface,
+            externalDependencies: externalDependenciesWithTargetPaths(resolvedDependencies.externalDependencies, targetByInputPath),
+            roots: buildResolvedRoots(normalized, contents)
+        };
+    }
+    return {
+        async resolve(options) {
+            return await resolveWithPromotedDeclarations(options, []);
+        },
+        resolveWithPromotedDeclarations,
+        async resolveWithPromotedDeclarationCompanions(options, substitutedInputFilePaths) {
+            const promotedDeclarationEntryFiles = hasDeclarationRoots(options)
+                ? await findReadableDeclarationCompanions(fileManager, substitutedInputFilePaths)
+                : [];
+            return await resolveWithPromotedDeclarations(options, promotedDeclarationEntryFiles);
+        }
+    };
+}
 //# sourceMappingURL=resource-resolver.js.map

package/resource-resolver/resource-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-resolver.js","sourceRoot":"","sources":["../../../../source/resource-resolver/resource-resolver.ts"],"names":[],"mappings":"AAEA,OAA+C,0CAA0C,CAAC;AAC1F,OAAsC,cAAc,CAAC;AACrD,OAAmC,6BAA6B,CAAC;AACjE,OAA+C,mCAAmC,CAAC;AAEnF,OAAoE,+BAA+B,CAAC"}
+{"version":3,"file":"resource-resolver.js","sourceRoot":"","sources":["../../../../source/resource-resolver/resource-resolver.ts"],"names":[],"mappings":"AACA,OAAO,EACH,gCAAgC,EAInC,MAAM,gDAAgD,CAAC;AAExD,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AAEnF,OAAO,EAAE,sBAAsB,EAA+B,MAAM,+BAA+B,CAAC;AAmBpG,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAQvC,SAAS,wBAAwB,CAAC,eAA0D;IACxF,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,EAAE,4BAA4B,CAAC,IAAI,CAAC;AACtF,CAAC;AAED,SAAS,mBAAmB,CAAC,OAA+B;IACxD,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI;QACtD,OAAO,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC;IAC9C,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC3C,WAAkD,EAClD,aAAqB;IAErB,KAAK,MAAM,SAAS,IAAI,8BAA8B,CAAC,aAAa,CAAC,EAAE,CAAC;QACpE,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAClE,IAAI,WAAW,CAAC,UAAU,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC5C,WAAkD,EAClD,yBAA8C;IAE9C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,aAAa,IAAI,yBAAyB,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACrF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC1B,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,sBAAsB,CACjC,WAAwB,EACxB,UAAsC,EACtC,eAA0D;IAE1D,IAAI,UAAU,CAAC,mBAAmB,EAAE,CAAC;QACjC,OAAO;YACH,OAAO,EAAE,wBAAwB,CAAC,eAAe,CAAC;YAClD,YAAY,EAAE,KAAK;YACnB,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,cAAc,EAAE,UAAU,CAAC,cAAc;SAC5C,CAAC;IACN,CAAC;IAED,OAAO,MAAM,WAAW,CAAC,sCAAsC,CAC3D,UAAU,CAAC,aAAa,EACxB,UAAU,CAAC,cAAc,CAC5B,CAAC;AACN,CAAC;AAED,SAAS,qBAAqB,CAAC,SAAqC;IAChE,OAAO,IAAI,GAAG,CACV,SAAS,CAAC,GAAG,CAAC,UAAU,QAAQ;QAC5B,OAAO,CAAE,QAAQ,CAAC,eAAe,CAAC,aAAa,EAAE,QAAQ,CAAC,eAAe,CAAC,cAAc,CAAE,CAAC;IAC/F,CAAC,CAAC,CACL,CAAC;AACN,CAAC;AAED,SAAS,iBAAiB,CACtB,iBAA8C,EAC9C,aAAqB;IAErB,OAAO,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC;AACjE,CAAC;AAED,SAAS,6BAA6B,CAClC,UAA8B;IAE9B,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,SAAS;YAChD,OAAO;gBACH,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,cAAc,EAAE,SAAS,CAAC,cAAc;gBACxC,eAAe,EAAE,SAAS,CAAC,eAAe;gBAC1C,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;aAC/C,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC;IACD,OAAO,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,cAAc;QACzD,OAAO;YACH,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,cAAc;YACd,eAAe,EAAE,UAAU,CAAC,IAAI;YAChC,gBAAgB,EAAE,UAAU,CAAC,IAAI;SACpC,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,mCAAmC,CACxC,YAAkC,EAClC,iBAA8C;IAE9C,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA8B,CAAC;IACjE,KAAK,MAAM,UAAU,IAAI,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7C,KAAK,MAAM,SAAS,IAAI,6BAA6B,CAAC,UAAU,CAAC,EAAE,CAAC;YAChE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACxD,kBAAkB,CAAC,GAAG,CAClB,SAAS,CAAC,IAAI,EACd,gCAAgC,CAC5B;gBACI,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,eAAe,EAAE,SAAS,CAAC,eAAe;gBAC1C,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;aAC/C,EACD,iBAAiB,CAAC,iBAAiB,EAAE,SAAS,CAAC,cAAc,CAAC,EAC9D,QAAQ,CACX,CACJ,CAAC;QACN,CAAC;IACL,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,YAA0C;IAC7E,MAAM,EAAE,iBAAiB,EAAE,WAAW,EAAE,GAAG,YAAY,CAAC;IAExD,KAAK,UAAU,+BAA+B,CAC1C,OAA+B,EAC/B,6BAAgD;QAEhD,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,oBAAoB,GAAG,MAAM,8BAA8B,CAC7D,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAClC,OAAO,EACP,6BAA6B,CAChC,CAAC;QAEF,MAAM,WAAW,GAAG,qBAAqB,CACrC,OAAO,CAAC,aAAa,EACrB,oBAAoB,CAAC,UAAU,EAC/B,OAAO,CAAC,eAAe,CAC1B,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,WAAW,CAAC,GAAG,CAAC,KAAK,WAAW,UAAU;YACtC,MAAM,eAAe,GAAG,MAAM,sBAAsB,CAChD,WAAW,EACX,UAAU,EACV,OAAO,CAAC,eAAe,CAC1B,CAAC;YAEF,OAAO;gBACH,eAAe;gBACf,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;gBACjD,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;gBAC7C,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,oBAAoB,EAAE,UAAU,CAAC,oBAAoB;gBACrD,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;aACzE,CAAC;QACN,CAAC,CAAC,CACL,CAAC;QAEF,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAC1D,OAAO;YACH,QAAQ;YACR,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,oBAAoB,EAAE,mCAAmC,CACrD,oBAAoB,CAAC,oBAAoB,EACzC,iBAAiB,CACpB;YACD,KAAK,EAAE,kBAAkB,CAAC,UAAU,EAAE,QAAQ,CAAC;SAClD,CAAC;IACN,CAAC;IAED,OAAO;QACH,KAAK,CAAC,OAAO,CAAC,OAAO;YACjB,OAAO,MAAM,+BAA+B,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,+BAA+B;QAE/B,KAAK,CAAC,wCAAwC,CAAC,OAAO,EAAE,yBAAyB;YAC7E,MAAM,6BAA6B,GAAG,mBAAmB,CAAC,OAAO,CAAC;gBAC9D,CAAC,CAAC,MAAM,iCAAiC,CAAC,WAAW,EAAE,yBAAyB,CAAC;gBACjF,CAAC,CAAC,EAAE,CAAC;YACT,OAAO,MAAM,+BAA+B,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;QACzF,CAAC;KACJ,CAAC;AACN,CAAC"}

package/sbom/extract-license.js

@@ -1,2 +1,12 @@
-import 'remeda';
+import { isPlainObject } from 'remeda';
+export function extractLicenseFromManifest(packageJson) {
+    if (!isPlainObject(packageJson)) {
+        return undefined;
+    }
+    const { license } = packageJson;
+    if (typeof license === 'string' && license.length > 0) {
+        return license;
+    }
+    return undefined;
+}
 //# sourceMappingURL=extract-license.js.map

package/sbom/extract-license.js.map

@@ -1 +1 @@
-{"version":3,"file":"extract-license.js","sourceRoot":"","sources":["../../../../source/sbom/extract-license.ts"],"names":[],"mappings":"AAAA,OAA8B,QAAQ,CAAC"}
+{"version":3,"file":"extract-license.js","sourceRoot":"","sources":["../../../../source/sbom/extract-license.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEvC,MAAM,UAAU,0BAA0B,CAAC,WAAoB;IAC3D,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;IAChC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,OAAO,OAAO,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC"}

package/sbom/license-resolver.d.ts

@@ -0,0 +1,14 @@
+import type { FileManager } from '../file-manager/file-manager.ts';
+type LicenseResolverDependencies = {
+    readonly fileManager: FileManager;
+};
+type LicenseResolveOptions = {
+    readonly projectFolder: string;
+    readonly dependencyName: string;
+};
+export type LicenseResolver = {
+    resolveLicense: (options: LicenseResolveOptions) => Promise<string | undefined>;
+};
+export declare function createLicenseResolver(dependencies: LicenseResolverDependencies): LicenseResolver;
+export {};
+//# sourceMappingURL=license-resolver.d.ts.map

package/sbom/license-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-resolver.d.ts","sourceRoot":"","sources":["../../../../source/sbom/license-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAGnE,KAAK,2BAA2B,GAAG;IAC/B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACrC,CAAC;AAEF,KAAK,qBAAqB,GAAG;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,cAAc,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACnF,CAAC;AAMF,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,2BAA2B,GAAG,eAAe,CAoBhG"}

package/sbom/license-resolver.js

@@ -1,3 +1,24 @@
-import "../common/package-layout.js";
-import "./extract-license.js";
+import { installedDependenciesFolderName, installedDependencyManifestPathIn } from "../common/package-layout.js";
+import { extractLicenseFromManifest } from "./extract-license.js";
+function parseJsonString(content) {
+    return JSON.parse(content);
+}
+export function createLicenseResolver(dependencies) {
+    const { fileManager } = dependencies;
+    function buildMissingDependencyMessage(dependencyName) {
+        const intro = `Dependency "${dependencyName}" is declared in the published manifest`;
+        return `${intro} but is not installed in ${installedDependenciesFolderName}`;
+    }
+    return {
+        async resolveLicense({ projectFolder, dependencyName }) {
+            const packageJsonPath = installedDependencyManifestPathIn(projectFolder, dependencyName);
+            const readability = await fileManager.checkReadability(packageJsonPath);
+            if (!readability.isReadable) {
+                throw new Error(buildMissingDependencyMessage(dependencyName));
+            }
+            const parsed = parseJsonString(await fileManager.readFile(packageJsonPath));
+            return extractLicenseFromManifest(parsed);
+        }
+    };
+}
 //# sourceMappingURL=license-resolver.js.map

package/sbom/license-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"license-resolver.js","sourceRoot":"","sources":["../../../../source/sbom/license-resolver.ts"],"names":[],"mappings":"AAAA,OAAmF,6BAA6B,CAAC;AAEjH,OAA2C,sBAAsB,CAAC"}
+{"version":3,"file":"license-resolver.js","sourceRoot":"","sources":["../../../../source/sbom/license-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC;AAEjH,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAelE,SAAS,eAAe,CAAC,OAAe;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,YAAyC;IAC3E,MAAM,EAAE,WAAW,EAAE,GAAG,YAAY,CAAC;IAErC,SAAS,6BAA6B,CAAC,cAAsB;QACzD,MAAM,KAAK,GAAG,eAAe,cAAc,yCAAyC,CAAC;QACrF,OAAO,GAAG,KAAK,4BAA4B,+BAA+B,EAAE,CAAC;IACjF,CAAC;IAED,OAAO;QACH,KAAK,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,cAAc,EAAE;YAClD,MAAM,eAAe,GAAG,iCAAiC,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YACzF,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;YACxE,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,cAAc,CAAC,CAAC,CAAC;YACnE,CAAC;YAED,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;YAC5E,OAAO,0BAA0B,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC;KACJ,CAAC;AACN,CAAC"}

package/sbom/sbom-builder.js

@@ -1,3 +1,58 @@
-import '@cyclonedx/cyclonedx-library';
-import 'spdx-expression-parse';
+import * as cdx from '@cyclonedx/cyclonedx-library';
+import spdxParse from 'spdx-expression-parse';
+function isParseableSpdxExpression(value) {
+    try {
+        spdxParse(value);
+    }
+    catch {
+        return false;
+    }
+    return true;
+}
+function buildPurl(name, versionOrSpecifier) {
+    return `pkg:npm/${name}@${encodeURIComponent(versionOrSpecifier)}`;
+}
+function buildRootComponent(rootComponent) {
+    const purl = buildPurl(rootComponent.name, rootComponent.version);
+    return new cdx.Models.Component(cdx.Enums.ComponentType.Library, rootComponent.name, {
+        version: rootComponent.version,
+        bomRef: purl,
+        purl
+    });
+}
+function buildDependencyComponent(dependency) {
+    const purl = buildPurl(dependency.name, dependency.specifier);
+    const component = new cdx.Models.Component(cdx.Enums.ComponentType.Library, dependency.name, {
+        version: dependency.specifier,
+        bomRef: purl,
+        purl,
+        scope: dependency.scope
+    });
+    if (dependency.license === undefined) {
+        return component;
+    }
+    if (isParseableSpdxExpression(dependency.license)) {
+        component.licenses.add(new cdx.Models.LicenseExpression(dependency.license));
+        return component;
+    }
+    component.licenses.add(new cdx.Models.NamedLicense(dependency.license));
+    return component;
+}
+function buildToolComponent(toolVersion) {
+    return new cdx.Models.Component(cdx.Enums.ComponentType.Application, 'packtory', {
+        version: toolVersion
+    });
+}
+export function buildSbom(options) {
+    const bom = new cdx.Models.Bom();
+    bom.metadata.tools.components.add(buildToolComponent(options.toolVersion));
+    const rootComponent = buildRootComponent(options.rootComponent);
+    bom.metadata.component = rootComponent;
+    for (const dependency of options.dependencies) {
+        const component = buildDependencyComponent(dependency);
+        bom.components.add(component);
+        rootComponent.dependencies.add(component.bomRef);
+    }
+    return bom;
+}
 //# sourceMappingURL=sbom-builder.js.map

package/sbom/sbom-builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"sbom-builder.js","sourceRoot":"","sources":["../../../../source/sbom/sbom-builder.ts"],"names":[],"mappings":"AAAA,OAAqB,8BAA8B,CAAC;AACpD,OAAsB,uBAAuB,CAAC"}
+{"version":3,"file":"sbom-builder.js","sourceRoot":"","sources":["../../../../source/sbom/sbom-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,8BAA8B,CAAC;AACpD,OAAO,SAAS,MAAM,uBAAuB,CAAC;AAoB9C,SAAS,yBAAyB,CAAC,KAAa;IAC5C,IAAI,CAAC;QACD,SAAS,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,kBAA0B;IACvD,OAAO,WAAW,IAAI,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,kBAAkB,CAAC,aAAgC;IACxD,MAAM,IAAI,GAAG,SAAS,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IAClE,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,EAAE;QACjF,OAAO,EAAE,aAAa,CAAC,OAAO;QAC9B,MAAM,EAAE,IAAI;QACZ,IAAI;KACP,CAAC,CAAC;AACP,CAAC;AAED,SAAS,wBAAwB,CAAC,UAA0B;IACxD,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE;QACzF,OAAO,EAAE,UAAU,CAAC,SAAS;QAC7B,MAAM,EAAE,IAAI;QACZ,IAAI;QACJ,KAAK,EAAE,UAAU,CAAC,KAAK;KAC1B,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,yBAAyB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7E,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,SAAS,kBAAkB,CAAC,WAAmB;IAC3C,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,EAAE,UAAU,EAAE;QAC7E,OAAO,EAAE,WAAW;KACvB,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAA2B;IACjD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IACjC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAE3E,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAChE,GAAG,CAAC,QAAQ,CAAC,SAAS,GAAG,aAAa,CAAC;IAEvC,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QACvD,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,GAAG,CAAC;AACf,CAAC"}

package/sbom/sbom-canonicalizer.js

@@ -1,4 +1,46 @@
-import 'remeda';
-import "../common/package-layout.js";
-import "../common/stable-json.js";
+import { isArray, isPlainObject } from 'remeda';
+import { bundleRelativePath, sbomArtifactFilePath } from "../common/package-layout.js";
+import { serializeStableJson } from "../common/stable-json.js";
+const packtoryToolName = 'packtory';
+function pluckObjectField(value, key) {
+    if (!isPlainObject(value)) {
+        return undefined;
+    }
+    return value[key];
+}
+function resolveToolComponents(parsed) {
+    const metadata = pluckObjectField(parsed, 'metadata');
+    const tools = pluckObjectField(metadata, 'tools');
+    const components = pluckObjectField(tools, 'components');
+    return isArray(components) ? components : undefined;
+}
+function stripPacktoryVersion(parsed) {
+    const components = resolveToolComponents(parsed);
+    if (components === undefined) {
+        return;
+    }
+    for (const entry of components) {
+        if (isPlainObject(entry) && entry.name === packtoryToolName) {
+            delete entry.version;
+        }
+    }
+}
+function canonicalizeSbomContent(content) {
+    try {
+        const parsed = JSON.parse(content);
+        stripPacktoryVersion(parsed);
+        return serializeStableJson(parsed);
+    }
+    catch {
+        return content;
+    }
+}
+export function canonicalizeSbomInFileSet(files) {
+    return files.map(function (file) {
+        if (bundleRelativePath(file.filePath) !== sbomArtifactFilePath) {
+            return file;
+        }
+        return { ...file, content: canonicalizeSbomContent(file.content) };
+    });
+}
 //# sourceMappingURL=sbom-canonicalizer.js.map

package/sbom/sbom-canonicalizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sbom-canonicalizer.js","sourceRoot":"","sources":["../../../../source/sbom/sbom-canonicalizer.ts"],"names":[],"mappings":"AAAA,OAAuC,QAAQ,CAAC;AAChD,OAAyD,6BAA6B,CAAC;AACvF,OAAoC,0BAA0B,CAAC"}
+{"version":3,"file":"sbom-canonicalizer.js","sourceRoot":"","sources":["../../../../source/sbom/sbom-canonicalizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAG/D,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAEpC,SAAS,gBAAgB,CAAC,KAAc,EAAE,GAAW;IACjD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAe;IAC1C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACzD,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAe;IACzC,MAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;IACX,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC1D,OAAO,KAAK,CAAC,OAAO,CAAC;QACzB,CAAC;IACL,CAAC;AACL,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAe;IAC5C,IAAI,CAAC;QACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7B,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,OAAO,CAAC;IACnB,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAiC;IACvE,OAAO,KAAK,CAAC,GAAG,CAAC,UAAU,IAAI;QAC3B,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,oBAAoB,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IACvE,CAAC,CAAC,CAAC;AACP,CAAC"}

package/sbom/sbom-file.d.ts

@@ -1,8 +1,18 @@
 import type { PublishSettings } from '../config/publish-settings.ts';
 import { type FileDescription } from '../file-manager/file-description.ts';
 import type { SbomPackage, SbomSiblingPackage } from '../published-package/published-package.ts';
+import type { LicenseResolver } from './license-resolver.ts';
+import type { SbomSerializer } from './sbom-serializer.ts';
+type ToolVersionProvider = () => Promise<string>;
+type SbomFileBuilderDependencies = {
+    readonly licenseResolver: LicenseResolver;
+    readonly sbomSerializer: SbomSerializer;
+    readonly toolVersionProvider: ToolVersionProvider;
+    readonly projectFolder: string;
+};
 export type SbomFileBuilder = {
     generate: (bundle: SbomPackage, siblings: readonly SbomSiblingPackage[], publishSettings: PublishSettings) => Promise<readonly FileDescription[] | undefined>;
 };
+export declare function createSbomFileBuilder(dependencies: SbomFileBuilderDependencies): SbomFileBuilder;
 export {};
 //# sourceMappingURL=sbom-file.d.ts.map

package/sbom/sbom-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sbom-file.d.ts","sourceRoot":"","sources":["../../../../source/sbom/sbom-file.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAClG,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;MAe3F,MAAM,eAAe,GAAG;IAC1B,QAAQ,EAAE,CACN,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,SAAS,kBAAkB,EAAE,EACvC,eAAe,EAAE,eAAe,KAC/B,OAAO,CAAC,SAAS,eAAe,EAAE,GAAG,SAAS,CAAC,CAAC;CACxD,CAAC;AAuBF"}
+{"version":3,"file":"sbom-file.d.ts","sourceRoot":"","sources":["../../../../source/sbom/sbom-file.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAClG,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAEjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,KAAK,mBAAmB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAEjD,KAAK,2BAA2B,GAAG;IAC/B,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAClD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,QAAQ,EAAE,CACN,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,SAAS,kBAAkB,EAAE,EACvC,eAAe,EAAE,eAAe,KAC/B,OAAO,CAAC,SAAS,eAAe,EAAE,GAAG,SAAS,CAAC,CAAC;CACxD,CAAC;AAuBF,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,2BAA2B,GAAG,eAAe,CA6ChG"}

package/sbom/sbom-file.js

@@ -1,6 +1,55 @@
-import '@cyclonedx/cyclonedx-library';
-import "../common/package-layout.js";
-import "../file-manager/file-description.js";
-import "./extract-license.js";
-import "./sbom-builder.js";
+import * as cdx from '@cyclonedx/cyclonedx-library';
+import { sbomArtifactFilePath } from "../common/package-layout.js";
+import { createFileDescription } from "../file-manager/file-description.js";
+import { extractLicenseFromManifest } from "./extract-license.js";
+import { buildSbom } from "./sbom-builder.js";
+function isSbomEnabled(publishSettings) {
+    return publishSettings.sbom?.enabled ?? true;
+}
+function listDependencyEntries(bundle) {
+    return [
+        ...Object.entries(bundle.dependencies).map(function ([name, specifier]) {
+            return { name, specifier, scope: cdx.Enums.ComponentScope.Required };
+        }),
+        ...Object.entries(bundle.peerDependencies).map(function ([name, specifier]) {
+            return { name, specifier, scope: cdx.Enums.ComponentScope.Optional };
+        })
+    ];
+}
+export function createSbomFileBuilder(dependencies) {
+    const { licenseResolver, sbomSerializer, toolVersionProvider, projectFolder } = dependencies;
+    async function resolveDependencyEntries(bundle, siblings) {
+        const siblingsByName = new Map(siblings.map(function (sibling) {
+            return [sibling.name, sibling];
+        }));
+        const entries = listDependencyEntries(bundle);
+        return Promise.all(entries.map(async function (entry) {
+            const sibling = siblingsByName.get(entry.name);
+            const license = sibling === undefined
+                ? await licenseResolver.resolveLicense({ projectFolder, dependencyName: entry.name })
+                : extractLicenseFromManifest(sibling.packageJson);
+            return { ...entry, license };
+        }));
+    }
+    async function buildFile(bundle, siblings) {
+        const [resolvedToolVersion, sbomDependencies] = await Promise.all([
+            toolVersionProvider(),
+            resolveDependencyEntries(bundle, siblings)
+        ]);
+        const bom = buildSbom({
+            toolVersion: resolvedToolVersion,
+            rootComponent: { name: bundle.packageJson.name, version: bundle.packageJson.version },
+            dependencies: sbomDependencies
+        });
+        return createFileDescription(sbomArtifactFilePath, sbomSerializer.serialize(bom));
+    }
+    return {
+        async generate(bundle, siblings, publishSettings) {
+            if (!isSbomEnabled(publishSettings)) {
+                return undefined;
+            }
+            return [await buildFile(bundle, siblings)];
+        }
+    };
+}
 //# sourceMappingURL=sbom-file.js.map

package/sbom/sbom-file.js.map

@@ -1 +1 @@
-{"version":3,"file":"sbom-file.js","sourceRoot":"","sources":["../../../../source/sbom/sbom-file.ts"],"names":[],"mappings":"AAAA,OAAqB,8BAA8B,CAAC;AACpD,OAAqC,6BAA6B,CAAC;AAEnE,OAA4D,qCAAqC,CAAC;AAElG,OAA2C,sBAAsB,CAAC;AAGlE,OAA+C,mBAAmB,CAAC"}
+{"version":3,"file":"sbom-file.js","sourceRoot":"","sources":["../../../../source/sbom/sbom-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,8BAA8B,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,OAAO,EAAE,qBAAqB,EAAwB,MAAM,qCAAqC,CAAC;AAElG,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAGlE,OAAO,EAAE,SAAS,EAAuB,MAAM,mBAAmB,CAAC;AAyBnE,SAAS,aAAa,CAAC,eAAgC;IACnD,OAAO,eAAe,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAmB;IAC9C,OAAO;QACH,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAkB,UAAU,CAAE,IAAI,EAAE,SAAS,CAAE;YACrF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;QACzE,CAAC,CAAC;QACF,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAkB,UAAU,CAAE,IAAI,EAAE,SAAS,CAAE;YACzF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;QACzE,CAAC,CAAC;KACL,CAAC;AACN,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,YAAyC;IAC3E,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,aAAa,EAAE,GAAG,YAAY,CAAC;IAE7F,KAAK,UAAU,wBAAwB,CACnC,MAAmB,EACnB,QAAuC;QAEvC,MAAM,cAAc,GAAG,IAAI,GAAG,CAC1B,QAAQ,CAAC,GAAG,CAAC,UAAU,OAAO;YAC1B,OAAO,CAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAE,CAAC;QACrC,CAAC,CAAC,CACL,CAAC;QACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,OAAO,CAAC,GAAG,CACd,OAAO,CAAC,GAAG,CAAC,KAAK,WAAW,KAAK;YAC7B,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,OAAO,KAAK,SAAS;gBACjC,CAAC,CAAC,MAAM,eAAe,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,cAAc,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;gBACrF,CAAC,CAAC,0BAA0B,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACtD,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,CAAC;QACjC,CAAC,CAAC,CACL,CAAC;IACN,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,MAAmB,EAAE,QAAuC;QACjF,MAAM,CAAE,mBAAmB,EAAE,gBAAgB,CAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChE,mBAAmB,EAAE;YACrB,wBAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC;SAC7C,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC;YAClB,WAAW,EAAE,mBAAmB;YAChC,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE;YACrF,YAAY,EAAE,gBAAgB;SACjC,CAAC,CAAC;QACH,OAAO,qBAAqB,CAAC,oBAAoB,EAAE,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,OAAO;QACH,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,eAAe;YAC5C,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,CAAC;gBAClC,OAAO,SAAS,CAAC;YACrB,CAAC;YACD,OAAO,CAAE,MAAM,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAE,CAAC;QACjD,CAAC;KACJ,CAAC;AACN,CAAC"}

package/sbom/sbom-serializer.d.ts

@@ -0,0 +1,8 @@
+import * as cdx from '@cyclonedx/cyclonedx-library';
+type SerializableBom = Readonly<cdx.Models.Bom>;
+export type SbomSerializer = {
+    serialize: (bom: SerializableBom) => string;
+};
+export declare function createSbomSerializer(): SbomSerializer;
+export {};
+//# sourceMappingURL=sbom-serializer.d.ts.map

package/sbom/sbom-serializer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom-serializer.d.ts","sourceRoot":"","sources":["../../../../source/sbom/sbom-serializer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,8BAA8B,CAAC;AAEpD,KAAK,eAAe,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAEhD,MAAM,MAAM,cAAc,GAAG;IACzB,SAAS,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,MAAM,CAAC;CAC/C,CAAC;AAUF,wBAAgB,oBAAoB,IAAI,cAAc,CAOrD"}

package/sbom/sbom-serializer.js

@@ -1,2 +1,15 @@
-import '@cyclonedx/cyclonedx-library';
+import * as cdx from '@cyclonedx/cyclonedx-library';
+function createCycloneDxJsonSerializer() {
+    return new cdx.Serialize.JsonSerializer(new cdx.Serialize.JSON.Normalize.Factory(cdx.Spec.Spec1dot6));
+}
+function serializeBom(serializer, bom) {
+    return String(Reflect.apply(serializer.serialize, serializer, [bom, { sortLists: true, space: 4 }]));
+}
+export function createSbomSerializer() {
+    const serializer = createCycloneDxJsonSerializer();
+    const serialize = function (bom) {
+        return serializeBom(serializer, bom);
+    };
+    return { serialize };
+}
 //# sourceMappingURL=sbom-serializer.js.map

package/sbom/sbom-serializer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sbom-serializer.js","sourceRoot":"","sources":["../../../../source/sbom/sbom-serializer.ts"],"names":[],"mappings":"AAAA,OAAqB,8BAA8B,CAAC"}
+{"version":3,"file":"sbom-serializer.js","sourceRoot":"","sources":["../../../../source/sbom/sbom-serializer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,8BAA8B,CAAC;AAQpD,SAAS,6BAA6B;IAClC,OAAO,IAAI,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,SAAS,YAAY,CAAC,UAAwC,EAAE,GAAoB;IAChF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,EAAE,CAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAE,CAAC,CAAC,CAAC;AAC3G,CAAC;AAED,MAAM,UAAU,oBAAoB;IAChC,MAAM,UAAU,GAAG,6BAA6B,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,UAAU,GAAoB;QAC5C,OAAO,YAAY,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC;IAEF,OAAO,EAAE,SAAS,EAAE,CAAC;AACzB,CAAC"}

package/sbom/tool-version.js

@@ -1,2 +1,50 @@
-import 'remeda';
+import { isObjectType, isPlainObject } from 'remeda';
+const candidatePackageNames = ['@packtory/cli', 'packtory'];
+function buildUnresolvableMessage() {
+    const intro = 'Cannot determine packtory tool version: neither "@packtory/cli" nor "packtory" is resolvable.';
+    return `${intro} Install packtory via npm so it lives under node_modules/.`;
+}
+function isCandidatePackageName(value) {
+    return value === '@packtory/cli' || value === 'packtory';
+}
+function isImportResolutionError(error) {
+    if (!isObjectType(error) || !Object.hasOwn(error, 'code')) {
+        return false;
+    }
+    const code = Reflect.get(error, 'code');
+    return code === 'ERR_MODULE_NOT_FOUND' || code === 'ERR_PACKAGE_PATH_NOT_EXPORTED';
+}
+function unwrapJsonModule(importedModule) {
+    if (!isPlainObject(importedModule) || !Object.hasOwn(importedModule, 'default')) {
+        return importedModule;
+    }
+    return importedModule.default;
+}
+function parseToolPackageJson(specifier, importedModule) {
+    const parsed = unwrapJsonModule(importedModule);
+    if (!isPlainObject(parsed) || typeof parsed.version !== 'string') {
+        throw new Error(`Imported packtory package.json from "${specifier}" is missing a version field`);
+    }
+    if (!isCandidatePackageName(parsed.name)) {
+        throw new Error(`Imported packtory package.json from "${specifier}" has unexpected package name`);
+    }
+    return parsed.version;
+}
+export function createPacktoryToolVersionResolver(dependencies) {
+    const { importPackageJson } = dependencies;
+    return async function resolvePacktoryToolVersion() {
+        for (const candidatePackageName of candidatePackageNames) {
+            const specifier = `${candidatePackageName}/package.json`;
+            try {
+                return parseToolPackageJson(specifier, await importPackageJson(specifier));
+            }
+            catch (error) {
+                if (!isImportResolutionError(error)) {
+                    throw error;
+                }
+            }
+        }
+        throw new Error(buildUnresolvableMessage());
+    };
+}
 //# sourceMappingURL=tool-version.js.map

package/sbom/tool-version.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-version.js","sourceRoot":"","sources":["../../../../source/sbom/tool-version.ts"],"names":[],"mappings":"AAAA,OAA4C,QAAQ,CAAC"}
+{"version":3,"file":"tool-version.js","sourceRoot":"","sources":["../../../../source/sbom/tool-version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAErD,MAAM,qBAAqB,GAAG,CAAE,eAAe,EAAE,UAAU,CAAW,CAAC;AAQvE,SAAS,wBAAwB;IAC7B,MAAM,KAAK,GAAG,+FAA+F,CAAC;IAC9G,OAAO,GAAG,KAAK,4DAA4D,CAAC;AAChF,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,eAAe,IAAI,KAAK,KAAK,UAAU,CAAC;AAC7D,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC3C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,IAAI,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,IAAI,KAAK,sBAAsB,IAAI,IAAI,KAAK,+BAA+B,CAAC;AACvF,CAAC;AAED,SAAS,gBAAgB,CAAC,cAAuB;IAC7C,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,EAAE,CAAC;QAC9E,OAAO,cAAc,CAAC;IAC1B,CAAC;IAED,OAAO,cAAc,CAAC,OAAO,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,SAAiB,EAAE,cAAuB;IACpE,MAAM,MAAM,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAChD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,wCAAwC,SAAS,8BAA8B,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,wCAAwC,SAAS,+BAA+B,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC7C,YAA6C;IAE7C,MAAM,EAAE,iBAAiB,EAAE,GAAG,YAAY,CAAC;IAE3C,OAAO,KAAK,UAAU,0BAA0B;QAC5C,KAAK,MAAM,oBAAoB,IAAI,qBAAqB,EAAE,CAAC;YACvD,MAAM,SAAS,GAAG,GAAG,oBAAoB,eAAe,CAAC;YACzD,IAAI,CAAC;gBACD,OAAO,oBAAoB,CAAC,SAAS,EAAE,MAAM,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACtB,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAClC,MAAM,KAAK,CAAC;gBAChB,CAAC;YACL,CAAC;QACL,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC;AACN,CAAC"}