@smartspectra/node-sdk 3.2.0-rc.6 → 3.2.0-rc.8

package/README.md

@@ -149,16 +149,6 @@ generated from the SDK's bundled TypeScript declarations so it tracks the
 published package. For which metrics to request and how to read the decoded
 payloads, see the [metrics guide](docs/metrics.md).
 
-<!-- The two members below are not yet emitted by docs-site/scripts/generate-api.ts
-     (it doesn't capture fields on the ambient `declare class`); documented here
-     until that generator gap is fixed, then they move to the API reference. -->
-Two instance members aren't yet in the generated reference:
-
-| Member | Type | Notes |
-| --- | --- | --- |
-| `sdk.processingStatus` | `ProcessingStatusValue` | Current processing status (read-only). |
-| `SmartSpectraSDK.version` | `string` | Static; the SDK package version. |
-
 ## Electron integration
 
 Runnable sample at [electron-quickstart](https://github.com/Presage-Security/SmartSpectra/tree/main/nodejs/samples/electron-quickstart).

package/js/main/index.js

@@ -62,6 +62,7 @@ function ensurePreconfigured() {
     // Pre-create the tree with restrictive permissions; Electron's
     // app.getPath('cache') root isn't always present on first launch.
     try {
+        // nosemgrep: detect-non-literal-fs-filename - safe: SDK cache dir derived from the app/OS cache path (app.getPath('cache') + app name), not untrusted input.
         fs.mkdirSync(sdkDirectory, { recursive: true, mode: 0o700 });
     } catch (err) {
         throw new Error(

package/js/resolve-native.js

@@ -60,6 +60,7 @@ function resolveNativeLibrary() {
 
     const override = process.env.SMARTSPECTRA_CAPI_PATH;
     if (override) {
+        // nosemgrep: detect-non-literal-fs-filename - safe: path is the consumer-set SMARTSPECTRA_CAPI_PATH override, same trust boundary as the process; no attacker input.
         if (!fs.existsSync(override)) {
             throw new Error(
                 `@smartspectra/node-sdk: SMARTSPECTRA_CAPI_PATH=${override} ` +
@@ -96,6 +97,7 @@ function resolveNativeLibrary() {
     }
 
     const libPath = path.join(pkgRoot, libName);
+    // nosemgrep: detect-non-literal-fs-filename - safe: path is derived from require.resolve of the installed platform package plus a fixed library basename; same trust boundary as the process, no attacker input.
     if (!fs.existsSync(libPath)) {
         throw new Error(
             `@smartspectra/node-sdk: "${platformPkg}" is installed but ${libName} is missing from it ` +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartspectra/node-sdk",
-  "version": "3.2.0-rc.6",
+  "version": "3.2.0-rc.8",
   "description": "Node.js (Electron) FFI binding for SmartSpectra vitals measurement",
   "author": "Presage Technologies, Inc.",
   "license": "SEE LICENSE IN LICENSE",
@@ -65,10 +65,10 @@
   "dependencies": {
     "koffi": "^2.10.0",
     "protobufjs": "^7.5.0",
-    "@smartspectra/node-sdk-linux-x64": "3.2.0-rc.6",
-    "@smartspectra/node-sdk-linux-arm64": "3.2.0-rc.6",
-    "@smartspectra/node-sdk-darwin-arm64": "3.2.0-rc.6",
-    "@smartspectra/node-sdk-win32-x64": "3.2.0-rc.6"
+    "@smartspectra/node-sdk-linux-x64": "3.2.0-rc.8",
+    "@smartspectra/node-sdk-linux-arm64": "3.2.0-rc.8",
+    "@smartspectra/node-sdk-darwin-arm64": "3.2.0-rc.8",
+    "@smartspectra/node-sdk-win32-x64": "3.2.0-rc.8"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",