feat: expose package manager name in componentAnalysis result (guacsec#518)

* feat: expose package manager name in componentAnalysis result

Attach the matched provider's command name (e.g. pip, uv, poetry) as
`packageManager` on the component analysis result so IDE consumers can
display provider-specific instructions without re-implementing detection.

Jira: TC-4336

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* refactor: add packageManagerName as public API for all providers

Keep _cmdName as the internal/protected method for binary resolution
and add packageManagerName() as the proper public method on every
provider. This ensures result.packageManager is always set for all
providers, not just when _cmdName happens to exist.

Jira: TC-4336

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: a-oren

src/index.js

@@ -210,7 +210,9 @@ async function componentAnalysis(manifest, opts = {}) {
 	fs.accessSync(manifest, fs.constants.R_OK)
 	opts["manifest-type"] = path.basename(manifest)
 	let provider = match(manifest, availableProviders, opts) // throws error if no matching provider
-	return await analysis.requestComponent(provider, manifest, theUrl, opts) // throws error request sending failed
+	const result = await analysis.requestComponent(provider, manifest, theUrl, opts) // throws error request sending failed
+	result.packageManager = provider.packageManagerName()
+	return result
 }
 
 /**

src/provider.js

@@ -15,7 +15,7 @@ import Python_uv from './providers/python_uv.js'
 import rustCargoProvider from './providers/rust_cargo.js'
 
 /** @typedef {{ecosystem: string, contentType: string, content: string}} Provided */
-/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string, Object): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string): string | null}} Provider */
+/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string, Object): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string): string | null, packageManagerName: function(): string}} Provider */
 
 /**
  * MUST include all providers here.

src/providers/base_java.js

@@ -35,6 +35,14 @@ export default class Base_Java {
 		this.localWrapper = localWrapper
 	}
 
+	/**
+	 * Returns the package manager name (e.g. mvn, gradle)
+	 * @returns {string}
+	 */
+	packageManagerName() {
+		return this.globalBinary
+	}
+
 	/**
 	 * Recursively populates the SBOM instance with the parsed graph
 	 * @param {string} src - Source dependency to start the calculations from

src/providers/base_javascript.js

@@ -82,6 +82,14 @@ export default class Base_javascript {
 		throw new TypeError("_cmdName must be implemented");
 	}
 
+	/**
+   * Returns the package manager name (e.g. npm, yarn, pnpm, bun)
+   * @returns {string} The package manager name
+   */
+	packageManagerName() {
+		return this._cmdName();
+	}
+
 	/**
    * Returns the command arguments for listing dependencies
    * @returns {Array<string>} The command arguments

src/providers/base_pyproject.js

@@ -168,6 +168,14 @@ export default class Base_pyproject {
 		throw new TypeError('_cmdName must be implemented')
 	}
 
+	/**
+	 * Returns the package manager name (e.g. pip, poetry, uv)
+	 * @returns {string}
+	 */
+	packageManagerName() {
+		return this._cmdName()
+	}
+
 	/**
 	 * Resolve dependencies using the tool-specific command and parser.
 	 *

src/providers/golang_gomodules.js

@@ -10,7 +10,7 @@ import { filterManifestPathsByDiscoveryIgnore, resolveWorkspaceDiscoveryIgnore }
 
 import { getParser, getRequireQuery } from './gomod_parser.js'
 
-export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest }
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'go' } }
 
 /** @typedef {import('../provider').Provider} */
 

src/providers/python_pip.js

@@ -14,7 +14,7 @@ import {
 import Python_controller from './python_controller.js'
 import { getParser, getIgnoreQuery, getPinnedVersionQuery } from './requirements_parser.js'
 
-export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest }
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'pip' } }
 
 /** @typedef {{name: string, version: string, dependencies: DependencyEntry[], hashes?: Array<{alg: string, content: string}>}} DependencyEntry */
 

src/providers/rust_cargo.js

@@ -8,7 +8,7 @@ import { getLicense } from '../license/license_utils.js'
 import Sbom from '../sbom.js'
 import { getCustom, getCustomPath, invokeCommand } from '../tools.js'
 
-export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest }
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'cargo' } }
 
 /** @typedef {import('../provider').Provider} */