New key 'package-management' for metadata

Author: davidkopp

SPECIFICATION.md

@@ -69,7 +69,9 @@ The tool outputs structured JSON with packages aggregated by scope (project/syst
     "packages": [
       { "name": "numpy", "version": "1.3.3", "type": "pip" }
     ],
-    "pip": { "location": "/app/venv/lib/python3.12/site-packages", "hash": "sha256:..." }
+    "package-management": {
+      "pip": { "location": "/app/venv/lib/python3.12/site-packages", "hash": "sha256:..." }
+    }
   },
   "system": {
     "packages": [

dependency_resolver/core/orchestrator.py

@@ -104,13 +104,11 @@ def resolve_dependencies(
 
         # Build final result structure matching proposal
         if project_packages or project_metadata:
-            project_section: dict[str, Any] = {"packages": project_packages}
-            project_section.update(project_metadata)
+            project_section: dict[str, Any] = {"packages": project_packages, "package-management": project_metadata}
             result["project"] = project_section
 
         if system_packages or system_metadata:
-            system_section: dict[str, Any] = {"packages": system_packages}
-            system_section.update(system_metadata)
+            system_section: dict[str, Any] = {"packages": system_packages, "package-management": system_metadata}
             result["system"] = system_section
 
         return result

dependency_resolver/core/output_formatter.py

@@ -36,7 +36,7 @@ def create_excerpt(self, dependencies: dict[str, Any], max_deps_per_section: int
 
                 for key, value in section_data.items():
                     if key != "packages":
-                        # Copy metadata (location, hash for project managers)
+                        # Copy metadata (package-management and other metadata)
                         excerpt[section_name][key] = value
 
                 if "packages" in section_data:

docs/guides/quick-start.md

@@ -48,9 +48,11 @@ The tool outputs JSON with packages organized by scope:
         "type": "pip"
       }
     ],
-    "pip": {
-      "location": "/path/to/venv/lib/python3.12/site-packages",
-      "hash": "abc123..."
+    "package-management": {
+      "pip": {
+        "location": "/path/to/venv/lib/python3.12/site-packages",
+        "hash": "abc123..."
+      }
     }
   },
   "system": {

docs/technical/adding-new-detectors.md

@@ -336,14 +336,14 @@ def has_system_scope(self, executor: EnvironmentExecutor, working_dir: Optional[
 def get_dependencies(self, executor: EnvironmentExecutor, working_dir: Optional[str] = None) -> tuple[list[dict[str, Any]], dict[str, Any]]:
     if working_dir and self._has_project_files(executor, working_dir):
         # Extract project dependencies
-        packages = []  # List of package dictionaries
+        packages = []
         location = self._resolve_absolute_path(executor, working_dir)
-        metadata = {"location": location}  # Project scope metadata
+        metadata = {"location": location}
         return packages, metadata
     else:
         # Extract system dependencies
-        packages = []  # List of package dictionaries
-        metadata = {}  # Empty for system scope
+        packages = []
+        metadata = {}
         return packages, metadata
 ```
 

docs/usage/output-format.md

@@ -11,8 +11,10 @@ The dependency-resolver outputs a unified JSON structure that aggregates all pac
   "source": { ... },
   "project": {
     "packages": [...],
-    "pip": { ... },
-    "npm": { ... }
+    "package-management": {
+      "pip": { ... },
+      "npm": { ... }
+    }
   },
   "system": {
     "packages": [...]
@@ -63,13 +65,15 @@ Project-specific packages from all package managers are aggregated in a single a
         "type": "npm"
       }
     ],
-    "pip": {
-      "location": "/path/to/venv/lib/python3.12/site-packages",
-      "hash": "def456..."
-    },
-    "npm": {
-      "location": "/app/node_modules",
-      "hash": "abc123..."
+    "package-management": {
+      "pip": {
+        "location": "/path/to/venv/lib/python3.12/site-packages",
+        "hash": "def456..."
+      },
+      "npm": {
+        "location": "/app/node_modules",
+        "hash": "abc123..."
+      }
     }
   }
 }
@@ -142,9 +146,11 @@ For project-scoped package managers, a location hash is provided in the metadata
 {
   "project": {
     "packages": [...],
-    "pip": {
-      "location": "/path/to/venv/lib/python3.12/site-packages",
-      "hash": "sha256:location-based-hash"
+    "package-management": {
+      "pip": {
+        "location": "/path/to/venv/lib/python3.12/site-packages",
+        "hash": "sha256:location-based-hash"
+      }
     }
   }
 }
@@ -197,13 +203,15 @@ Here's a complete example showing the new unified structure:
         "type": "npm"
       }
     ],
-    "pip": {
-      "location": "/app/venv/lib/python3.12/site-packages",
-      "hash": "sha256:xyz789..."
-    },
-    "npm": {
-      "location": "/app/node_modules",
-      "hash": "sha256:npm456..."
+    "package-management": {
+      "pip": {
+        "location": "/app/venv/lib/python3.12/site-packages",
+        "hash": "sha256:xyz789..."
+      },
+      "npm": {
+        "location": "/app/node_modules",
+        "hash": "sha256:npm456..."
+      }
     }
   },
   "system": {
@@ -250,8 +258,9 @@ if "project" in deps:
         print(f"  {name}: {version} ({pkg_type}) {'✓' if has_hash else ''}")
 
     # Show metadata for each package manager
-    for key, value in project.items():
-        if key != "packages" and isinstance(value, dict):
+    package_management = project.get("package-management", {})
+    for key, value in package_management.items():
+        if isinstance(value, dict):
             location = value.get("location", "N/A")
             has_hash = "hash" in value
             print(f"  {key.upper()} location: {location} {'✓' if has_hash else ''}")

tests/detectors/maven/test_maven_docker_detection.py

@@ -218,8 +218,10 @@ def _validate_maven_dependencies(self, result: Dict[str, Any]) -> None:
         assert len(maven_packages) > 0, "Should have found Maven packages"
 
         # Should have location metadata
-        assert "maven" in project_result, "Project scope should contain Maven metadata"
-        maven_metadata = project_result["maven"]
+        assert "package-management" in project_result, "Project scope should contain package-management metadata"
+        package_management = project_result["package-management"]
+        assert "maven" in package_management, "package-management should contain Maven metadata"
+        maven_metadata = package_management["maven"]
         assert "location" in maven_metadata
         assert maven_metadata["location"] == "/tmp/test-maven-project"
 
@@ -260,8 +262,10 @@ def _validate_maven_dependencies_pom_only(self, result: Dict[str, Any]) -> None:
         assert len(maven_packages) > 0, "Should have found Maven packages"
 
         # Should have location metadata
-        assert "maven" in project_result, "Project scope should contain Maven metadata"
-        maven_metadata = project_result["maven"]
+        assert "package-management" in project_result, "Project scope should contain package-management metadata"
+        package_management = project_result["package-management"]
+        assert "maven" in package_management, "package-management should contain Maven metadata"
+        maven_metadata = package_management["maven"]
         assert "location" in maven_metadata
         assert maven_metadata["location"] == "/tmp/test-maven-project"
 

tests/detectors/npm/test_npm_docker_detection.py

@@ -80,8 +80,10 @@ def _validate_npm_dependencies(self, result: Dict[str, Any]) -> None:
         self.validate_dependency_structure(npm_packages, sample_count=3)
 
         # Should have location metadata
-        assert "npm" in project_result, "Project scope should contain npm metadata"
-        npm_metadata = project_result["npm"]
+        assert "package-management" in project_result, "Project scope should contain package-management metadata"
+        package_management = project_result["package-management"]
+        assert "npm" in package_management, "package-management should contain npm metadata"
+        npm_metadata = package_management["npm"]
         assert "location" in npm_metadata, "npm metadata should have location field for project scope"
         location = npm_metadata["location"]
         assert isinstance(location, str), "Location should be a string"