refactor: keep everything scoped inside the package and create purls file in dist instead

To minimize changes we'd need to make for this, instead we could add creating and appending purls file creation to the prepublishing step.

Author: gagik

packages/node-runtime-worker-thread/package.json

@@ -29,9 +29,11 @@
     "webpack-build": "npm run compile && webpack --mode production",
     "webpack-build-dev": "npm run compile && webpack --mode development",
     "compile": "tsc -p tsconfig.json",
-    "prepublish": "npm run webpack-build",
+    "prepublish": "npm run webpack-build && npm run create-purls-file",
     "prettier": "prettier",
-    "reformat": "npm run prettier -- --write . && npm run eslint --fix"
+    "reformat": "npm run prettier -- --write . && npm run eslint --fix",
+    "create-purls-file": "npm run write-node-js-dep && node ../../scripts/create-purls.js .sbom/dependencies.json .sbom/node-js-dep.json > dist/purls.txt",
+    "write-node-js-dep": "mkdir -p .sbom && node ../../scripts/write-nodejs-dep > .sbom/node-js-dep.json"
   },
   "devDependencies": {
     "@mongodb-js/eslint-config-mongosh": "^1.0.0",

packages/node-runtime-worker-thread/webpack.config.js

@@ -2,16 +2,22 @@
 const { merge } = require('webpack-merge');
 const path = require('path');
 
+const { WebpackDependenciesPlugin } = require('@mongodb-js/sbom-tools');
 const baseWebpackConfig = require('../../config/webpack.base.config');
 
+const webpackDependenciesPlugin = new WebpackDependenciesPlugin({
+  outputFilename: path.resolve(__dirname, '.sbom', 'dependencies.json'),
+  includeExternalProductionDependencies: true,
+});
+
 /** @type import('webpack').Configuration */
 const config = {
   output: {
     path: path.resolve(__dirname, 'dist'),
     filename: '[name].js',
     libraryTarget: 'umd',
   },
-
+  plugins: [webpackDependenciesPlugin],
   externals: {
     'mongodb-client-encryption': 'commonjs2 mongodb-client-encryption',
     kerberos: 'commonjs2 kerberos',