@cdxgen/cdxgen 13.2.0 → 13.3.0

package/lib/ecosystems/rusi.js

@@ -350,6 +350,29 @@ function cryptoMaterialComponent(material) {
   return component;
 }
 
+/**
+ * Returns the backend rusi actually used. `options.backend` is only the
+ * requested backend: when the compiler backend cannot run (missing
+ * components, wrapper build failure), rusi still echoes "compiler" but falls
+ * back to the stable source analysis. Compiler evidence was collected only
+ * when rusi emits its compiler-source-evidence diagnostic; a backend-error
+ * alone is not conclusive because native interop scanning reports failures
+ * under that kind too.
+ *
+ * @param {Object} rusiReport Parsed rusi report
+ * @returns {string|undefined} Effective backend name
+ */
+export function effectiveRusiBackend(rusiReport = {}) {
+  const requested = rusiReport.options?.backend;
+  if (requested !== "compiler") {
+    return requested;
+  }
+  const collected = (rusiReport.diagnostics || []).some(
+    (d) => d?.kind === "compiler-source-evidence",
+  );
+  return collected ? requested : "stable";
+}
+
 function addMetadataProperties(properties, rusiReport = {}) {
   appendUniqueProperty(
     properties,
@@ -374,7 +397,15 @@ function addMetadataProperties(properties, rusiReport = {}) {
   appendUniqueProperty(properties, "cdx:rusi:host", rusiReport.runtime?.host);
 
   const options = rusiReport.options || {};
-  appendUniqueProperty(properties, "cdx:rusi:backend", options.backend);
+  const backend = effectiveRusiBackend(rusiReport);
+  appendUniqueProperty(properties, "cdx:rusi:backend", backend);
+  if (options.backend && options.backend !== backend) {
+    appendUniqueProperty(
+      properties,
+      "cdx:rusi:requestedBackend",
+      options.backend,
+    );
+  }
   appendUniqueProperty(
     properties,
     "cdx:rusi:analysisScope",