fix(sbom): resolve Bun dependency edges from the lockfile graph

[sonukapoor]

Note: this is an in-house item already being handled by the maintainer - not open for contribution. Filed for tracking only.

Follow-up to #1079, which fixed SBOM dependency-graph completeness for npm only. Sibling of #1107 (pnpm).

Problem

Bun still derives SBOM dependency edges by prefix-matching PackageRef.paths, capped at MAX_PATHS_PER_PACKAGE = 5 (src/parsers/bun-lock.ts:6). Packages reachable by more routes lose edges, and one whose surviving routes all traverse excluded packages ends up with no parent at all. Dependency relationships are an NTIA minimum element, so this weakens the SBOM for the compliance use case.

What the parser already has

src/parsers/bun-lock.ts builds childDepsByPackageName and packageNameToVersion (lines 116-117) before capping, so the raw material exists.

The wrinkle to check first, and the reason this is not a copy of #1107

childDepsByPackageName is keyed by package name, not name@version. If a Bun lockfile can contain the same package at two versions, that map collapses them and the derived edges would be wrong rather than merely incomplete, which is worse than the current state.

Establish this before writing any code. Read the Bun lockfile format and check examples/bun-workspace and examples/bun-lock for a duplicated name at different versions. If the map does collapse versions, the fix is to re-key it during parse rather than to work around it downstream.

Important: do not record edges during the path traversal

The BFS at bun-lock.ts:48-64 caps as it walks, so recording edges inside it inherits the same incompleteness. Use a separate edge-only pass, as the npm implementation does.

Scope

• Expose a child-to-parents edge map keyed by name@version.
• Extend resolveDependencyEdges (src/output/sbom-dependency-edges.ts) for bun-lock, keeping the empty-list fallback for ecosystems not yet covered.
• Handle workspace members (linked, no version) and parents filtered out of the scanned set by anchoring to the root rather than orphaning. Never emit a reference to a package absent from the document.
• Update website/docs/spdx.md, which currently lists Bun among the affected ecosystems.

Keep MAX_PATHS_PER_PACKAGE at 5.

Verification

examples/bun-workspace and examples/bun-simple. Confirm packages with no parent edge drop to the root project alone, and zero dangling references.

Estimated half a day, assuming the name-keying question resolves cleanly. Do #1107 first: the shared interface will already exist.