@trustify-da/trustify-da-javascript-client 0.3.0-ea.030d439 → 0.3.0-ea.071e51e

package/dist/src/cli.js

@@ -4,6 +4,7 @@ import * as path from "path";
 import yargs from 'yargs';
 import { hideBin } from 'yargs/helpers';
 import { getProjectLicense, getLicenseDetails } from './license/index.js';
+import { runRemediation } from './remediate.js';
 import client, { selectTrustifyDABackend, generateSbom } from './index.js';
 // command for component analysis take manifest type and content
 const component = {
@@ -19,11 +20,25 @@ const component = {
             desc: 'Workspace root directory (for monorepos; lock file is expected here)',
             type: 'string',
             normalize: true,
+        },
+        providers: {
+            desc: 'Comma-separated list of vulnerability providers (env: TRUSTIFY_DA_PROVIDERS)',
+            type: 'string',
+        },
+        sources: {
+            desc: 'Comma-separated list of vulnerability sources (env: TRUSTIFY_DA_SOURCES)',
+            type: 'string',
         }
     }),
     handler: async (args) => {
         let manifestName = args['/path/to/manifest'];
         const opts = args.workspaceDir ? { TRUSTIFY_DA_WORKSPACE_DIR: args.workspaceDir } : {};
+        if (args.providers) {
+            opts.TRUSTIFY_DA_PROVIDERS = args.providers;
+        }
+        if (args.sources) {
+            opts.TRUSTIFY_DA_SOURCES = args.sources;
+        }
         let res = await client.componentAnalysis(manifestName, opts);
         console.log(JSON.stringify(res, null, 2));
     }
@@ -72,6 +87,14 @@ const image = {
             desc: 'For JSON report, get only the \'summary\'',
             type: 'boolean',
             conflicts: 'html'
+        },
+        providers: {
+            desc: 'Comma-separated list of vulnerability providers (env: TRUSTIFY_DA_PROVIDERS)',
+            type: 'string',
+        },
+        sources: {
+            desc: 'Comma-separated list of vulnerability sources (env: TRUSTIFY_DA_SOURCES)',
+            type: 'string',
         }
     }),
     handler: async (args) => {
@@ -81,7 +104,14 @@ const image = {
         }
         let html = args['html'];
         let summary = args['summary'];
-        let res = await client.imageAnalysis(imageRefs, html);
+        const opts = {};
+        if (args.providers) {
+            opts.TRUSTIFY_DA_PROVIDERS = args.providers;
+        }
+        if (args.sources) {
+            opts.TRUSTIFY_DA_SOURCES = args.sources;
+        }
+        let res = await client.imageAnalysis(imageRefs, html, opts);
         if (summary && !html) {
             let summaries = {};
             for (let [imageRef, report] of Object.entries(res)) {
@@ -132,6 +162,14 @@ const stack = {
             desc: 'Workspace root directory (for monorepos; lock file is expected here)',
             type: 'string',
             normalize: true,
+        },
+        providers: {
+            desc: 'Comma-separated list of vulnerability providers (env: TRUSTIFY_DA_PROVIDERS)',
+            type: 'string',
+        },
+        sources: {
+            desc: 'Comma-separated list of vulnerability sources (env: TRUSTIFY_DA_SOURCES)',
+            type: 'string',
         }
     }),
     handler: async (args) => {
@@ -139,6 +177,12 @@ const stack = {
         let html = args['html'];
         let summary = args['summary'];
         const opts = args.workspaceDir ? { TRUSTIFY_DA_WORKSPACE_DIR: args.workspaceDir } : {};
+        if (args.providers) {
+            opts.TRUSTIFY_DA_PROVIDERS = args.providers;
+        }
+        if (args.sources) {
+            opts.TRUSTIFY_DA_SOURCES = args.sources;
+        }
         let theProvidersSummary = new Map();
         let theProvidersObject = {};
         let res = await client.stackAnalysis(manifest, html, opts);
@@ -201,6 +245,14 @@ const stackBatch = {
             desc: 'Stop on first invalid package.json or SBOM error (env: TRUSTIFY_DA_CONTINUE_ON_ERROR=false)',
             type: 'boolean',
             default: false,
+        },
+        providers: {
+            desc: 'Comma-separated list of vulnerability providers (env: TRUSTIFY_DA_PROVIDERS)',
+            type: 'string',
+        },
+        sources: {
+            desc: 'Comma-separated list of vulnerability sources (env: TRUSTIFY_DA_SOURCES)',
+            type: 'string',
         }
     }),
     handler: async (args) => {
@@ -221,6 +273,12 @@ const stackBatch = {
         if (args.failFast) {
             opts.continueOnError = false;
         }
+        if (args.providers) {
+            opts.TRUSTIFY_DA_PROVIDERS = args.providers;
+        }
+        if (args.sources) {
+            opts.TRUSTIFY_DA_SOURCES = args.sources;
+        }
         let res = await client.stackAnalysisBatch(workspaceRoot, html, opts);
         const batchAnalysis = res && typeof res === 'object' && res != null && 'analysis' in res ? res.analysis : res;
         if (summary && !html && typeof batchAnalysis === 'object') {
@@ -373,9 +431,54 @@ const sbom = {
         }
     }
 };
+const remediate = {
+    command: 'remediate <path>',
+    desc: 'Scan and apply vulnerability remediations to manifest files',
+    builder: yargs => yargs.positional('path', {
+        desc: 'Path to manifest file or directory',
+        type: 'string',
+        normalize: true,
+    }).options({
+        'dry-run': {
+            alias: 'd',
+            type: 'boolean',
+            desc: 'Preview changes without modifying files',
+        },
+        providers: {
+            desc: 'Comma-separated list of vulnerability providers (env: TRUSTIFY_DA_PROVIDERS)',
+            type: 'string',
+        },
+        sources: {
+            desc: 'Comma-separated list of vulnerability sources (env: TRUSTIFY_DA_SOURCES)',
+            type: 'string',
+        },
+        'group-by': {
+            type: 'string',
+            choices: ['dependency', 'bundle'],
+            default: 'dependency',
+            desc: 'Report grouping strategy',
+        },
+    }),
+    handler: async (args) => {
+        try {
+            const result = await runRemediation(args.path, {
+                dryRun: args['dry-run'],
+                providers: args.providers,
+                sources: args.sources,
+                groupBy: args['group-by'],
+            });
+            console.log(result.output);
+            process.exit(result.exitCode);
+        }
+        catch (err) {
+            console.error(err.message);
+            process.exit(1);
+        }
+    }
+};
 // parse and invoke the command
 yargs(hideBin(process.argv))
-    .usage(`Usage: ${process.argv[0].includes("node") ? path.parse(process.argv[1]).base : path.parse(process.argv[0]).base} {component|stack|stack-batch|image|validate-token|license|sbom}`)
+    .usage(`Usage: ${process.argv[0].includes("node") ? path.parse(process.argv[1]).base : path.parse(process.argv[0]).base} {component|stack|stack-batch|image|validate-token|license|sbom|remediate}`)
     .command(stack)
     .command(stackBatch)
     .command(component)
@@ -383,6 +486,7 @@ yargs(hideBin(process.argv))
     .command(validateToken)
     .command(license)
     .command(sbom)
+    .command(remediate)
     .scriptName('')
     .version(false)
     .demandCommand(1)

package/dist/src/cyclone_dx_sbom.d.ts

@@ -18,9 +18,27 @@ export default class CycloneDxSbom {
      * Adds a dependency relationship between two components in the SBOM
      * @param {PackageURL} sourceRef - The source component (parent)
      * @param {PackageURL} targetRef - The target component (dependency)
+     * @param {string} [scope] - Scope of the dependency
+     * @param {Array<{alg: string, content: string}>} [targetHashes] - Optional hashes for the target component
      * @return {CycloneDxSbom} The updated SBOM
      */
-    addDependency(sourceRef: PackageURL, targetRef: PackageURL, scope: any): CycloneDxSbom;
+    addDependency(sourceRef: PackageURL, targetRef: PackageURL, scope?: string, targetHashes?: Array<{
+        alg: string;
+        content: string;
+    }>): CycloneDxSbom;
+    /**
+     * Attach hashes to already-added components by matching their PURL. This is a
+     * post-processing step so ecosystem-specific hash sources (e.g. Maven reading
+     * the local .m2 cache) can enrich the SBOM without threading their concern
+     * through the shared dependency-tree parser. Components without a matching
+     * entry, or whose hashes are already set, are left untouched.
+     * @param {Map<string, Array<{alg: string, content: string}>>} hashMap - PURL→hashes map
+     * @return {CycloneDxSbom} the updated SBOM
+     */
+    attachHashes(hashMap: Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>): CycloneDxSbom;
     /** @param {{}} opts - various options, settings and configuration of application.
      * @return String CycloneDx Sbom json object in a string format
      */
@@ -50,6 +68,7 @@ export default class CycloneDxSbom {
         version: any;
         scope: any;
         licenses?: any;
+        hashes?: any;
     };
     /**
      * This method gets an array of dependencies to be ignored, and remove all of them from CycloneDx Sbom

package/dist/src/cyclone_dx_sbom.js

@@ -1,15 +1,23 @@
 import { EOL } from "os";
 import { PackageURL } from "packageurl-js";
+import { getPackageVersion } from "./package_version.js";
+/**
+ * This client's version, read once at module load, used to populate
+ * metadata.tools.components[].version in the generated SBOM.
+ * @type {string|undefined}
+ */
+const PACKAGE_VERSION = getPackageVersion();
 /**
  *
  * @param component {PackageURL}
  * @param type type of package - application or library
  * @param scope scope of the component - runtime or compile
  * @param licenses optional license string or array of licenses for the component
- * @return {{"bom-ref": string, name, purl: string, type, version, scope, licenses?}}
+ * @param hashes optional array of hash objects for the component, e.g. [{alg: "SHA-256", content: "..."}]
+ * @return {{"bom-ref": string, name, purl: string, type, version, scope, licenses?, hashes?}}
  * @private
  */
-function getComponent(component, type, scope, licenses) {
+function getComponent(component, type, scope, licenses, hashes) {
     let componentObject;
     if (component instanceof PackageURL) {
         if (component.namespace) {
@@ -40,12 +48,24 @@ function getComponent(component, type, scope, licenses) {
     // Add licenses if provided (CycloneDX format). Callers must provide valid SPDX identifiers.
     if (licenses) {
         const licenseArray = Array.isArray(licenses) ? licenses : [licenses];
-        componentObject.licenses = licenseArray.map(lic => {
+        const validLicenses = licenseArray
+            .map(lic => {
             if (typeof lic === 'string') {
                 return { license: { id: lic } };
             }
-            return lic;
-        });
+            if (typeof lic === 'object' && lic !== null && ('license' in lic || 'expression' in lic)) {
+                return lic;
+            }
+            return null;
+        })
+            .filter(Boolean);
+        if (validLicenses.length > 0) {
+            componentObject.licenses = validLicenses;
+        }
+    }
+    // Add hashes if provided (CycloneDX 1.4 format).
+    if (hashes && hashes.length > 0) {
+        componentObject.hashes = hashes;
     }
     return componentObject;
 }
@@ -86,16 +106,24 @@ export default class CycloneDxSbom {
      * Adds a dependency relationship between two components in the SBOM
      * @param {PackageURL} sourceRef - The source component (parent)
      * @param {PackageURL} targetRef - The target component (dependency)
+     * @param {string} [scope] - Scope of the dependency
+     * @param {Array<{alg: string, content: string}>} [targetHashes] - Optional hashes for the target component
      * @return {CycloneDxSbom} The updated SBOM
      */
-    addDependency(sourceRef, targetRef, scope) {
+    addDependency(sourceRef, targetRef, scope, targetHashes) {
         const sourcePurl = sourceRef.toString();
         const targetPurl = targetRef.toString();
         // Ensure both components exist in the components list
         [sourceRef, targetRef].forEach((ref, index) => {
             const purl = index === 0 ? sourcePurl : targetPurl;
-            if (this.getComponentIndex(purl) < 0) {
-                this.components.push(getComponent(ref, "library", scope));
+            const existingIndex = this.getComponentIndex(purl);
+            if (existingIndex < 0) {
+                const hashes = index === 1 ? targetHashes : undefined;
+                this.components.push(getComponent(ref, "library", scope, undefined, hashes));
+            }
+            else if (index === 1 && targetHashes && targetHashes.length > 0 && !this.components[existingIndex].hashes) {
+                // Update hashes if the component was first seen without them (e.g. as a source)
+                this.components[existingIndex].hashes = targetHashes;
             }
         });
         // Ensure source dependency exists
@@ -114,6 +142,30 @@ export default class CycloneDxSbom {
         }
         return this;
     }
+    /**
+     * Attach hashes to already-added components by matching their PURL. This is a
+     * post-processing step so ecosystem-specific hash sources (e.g. Maven reading
+     * the local .m2 cache) can enrich the SBOM without threading their concern
+     * through the shared dependency-tree parser. Components without a matching
+     * entry, or whose hashes are already set, are left untouched.
+     * @param {Map<string, Array<{alg: string, content: string}>>} hashMap - PURL→hashes map
+     * @return {CycloneDxSbom} the updated SBOM
+     */
+    attachHashes(hashMap) {
+        if (!hashMap || hashMap.size === 0) {
+            return this;
+        }
+        for (const component of this.components) {
+            if (component.hashes) {
+                continue;
+            }
+            const hashes = hashMap.get(component.purl);
+            if (hashes && hashes.length > 0) {
+                component.hashes = hashes;
+            }
+        }
+        return this;
+    }
     /** @param {{}} opts - various options, settings and configuration of application.
      * @return String CycloneDx Sbom json object in a string format
      */
@@ -123,11 +175,18 @@ export default class CycloneDxSbom {
         const rootPurl = this.rootComponent?.purl;
         this.sbomObject = {
             "bomFormat": "CycloneDX",
-            "specVersion": "1.4",
+            "specVersion": "1.6",
             "version": 1,
             "metadata": {
                 "timestamp": new Date(),
                 "component": this.rootComponent,
+                "tools": {
+                    "components": [{
+                            "type": "application",
+                            "name": "trustify-da-javascript-client",
+                            "version": PACKAGE_VERSION
+                        }]
+                },
                 "properties": new Array()
             },
             "components": this.components.filter(c => c.purl !== rootPurl),

package/dist/src/index.d.ts

@@ -24,6 +24,7 @@ export function selectTrustifyDABackend(opts?: {
 export function generateSbom(manifestPath: string, opts?: Options): Promise<object>;
 export { parseImageRef } from "./oci_image/utils.js";
 export { ImageRef } from "./oci_image/images.js";
+export { extractRemediations } from "./remediation.js";
 declare namespace _default {
     export { componentAnalysis };
     export { stackAnalysis };
@@ -53,7 +54,9 @@ export type Options = {
     TRUSTIFY_DA_PYTHON_PATH?: string | undefined;
     TRUSTIFY_DA_PYTHON_VIRTUAL_ENV?: string | undefined;
     TRUSTIFY_DA_PYTHON3_PATH?: string | undefined;
-    TRUSTIFY_DA_RECOMMENDATIONS_ENABLED?: string | undefined;
+    TRUSTIFY_DA_PROVIDERS?: string | undefined;
+    TRUSTIFY_DA_RECOMMEND?: string | undefined;
+    TRUSTIFY_DA_SOURCES?: string | undefined;
     TRUSTIFY_DA_SKOPEO_CONFIG_PATH?: string | undefined;
     TRUSTIFY_DA_SKOPEO_PATH?: string | undefined;
     TRUSTIFY_DA_SYFT_CONFIG_PATH?: string | undefined;
@@ -80,7 +83,7 @@ export type Options = {
 };
 export type BatchAnalysisMetadata = {
     workspaceRoot: string;
-    ecosystem: "javascript" | "cargo" | "unknown";
+    ecosystem: "javascript" | "cargo" | "pyproject" | "unknown";
     total: number;
     successful: number;
     failed: number;
@@ -106,7 +109,7 @@ export type SbomResult = {
  * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>}
  * @throws {Error} if no matching provider, failed to get create content, or backend request failed
  */
-declare function componentAnalysis(manifest: string, opts?: Options): Promise<import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport>;
+declare function componentAnalysis(manifest: string, opts?: Options): Promise<any>;
 /**
  * @overload
  * @param {string} manifest
@@ -124,7 +127,7 @@ declare function stackAnalysis(manifest: string, html: true, opts?: Options | un
  * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>}
  * @throws {Error}
  */
-declare function stackAnalysis(manifest: string, html: false, opts?: Options | undefined): Promise<import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport>;
+declare function stackAnalysis(manifest: string, html: false, opts?: Options | undefined): Promise<any>;
 /**
  * Get stack analysis report for a manifest file.
  * @overload
@@ -135,24 +138,79 @@ declare function stackAnalysis(manifest: string, html: false, opts?: Options | u
  * @throws {Error} if manifest inaccessible, no matching provider, failed to get create content,
  * 		or backend request failed
  */
-declare function stackAnalysis(manifest: string, html?: boolean | undefined, opts?: Options | undefined): Promise<string | import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport>;
+declare function stackAnalysis(manifest: string, html?: boolean | undefined, opts?: Options | undefined): Promise<string | any>;
+/**
+ * @overload
+ * @param {string} workspaceRoot
+ * @param {true} html
+ * @param {Options & { batchMetadata: true }} opts
+ * @returns {Promise<{ analysis: string, metadata: BatchAnalysisMetadata }>}
+ * @throws {Error}
+ */
+declare function stackAnalysisBatch(workspaceRoot: string, html: true, opts: Options & {
+    batchMetadata: true;
+}): Promise<{
+    analysis: string;
+    metadata: BatchAnalysisMetadata;
+}>;
+/**
+ * @overload
+ * @param {string} workspaceRoot
+ * @param {true} html
+ * @param {Options & { batchMetadata?: false }} [opts={}]
+ * @returns {Promise<string>}
+ * @throws {Error}
+ */
+declare function stackAnalysisBatch(workspaceRoot: string, html: true, opts?: (Options & {
+    batchMetadata?: false;
+}) | undefined): Promise<string>;
+/**
+ * @overload
+ * @param {string} workspaceRoot
+ * @param {false} html
+ * @param {Options & { batchMetadata: true }} opts
+ * @returns {Promise<{ analysis: Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>, metadata: BatchAnalysisMetadata }>}
+ * @throws {Error}
+ */
+declare function stackAnalysisBatch(workspaceRoot: string, html: false, opts: Options & {
+    batchMetadata: true;
+}): Promise<{
+    analysis: {
+        [x: string]: any;
+    };
+    metadata: BatchAnalysisMetadata;
+}>;
+/**
+ * @overload
+ * @param {string} workspaceRoot
+ * @param {false} html
+ * @param {Options & { batchMetadata?: false }} [opts={}]
+ * @returns {Promise<Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>>}
+ * @throws {Error}
+ */
+declare function stackAnalysisBatch(workspaceRoot: string, html: false, opts?: (Options & {
+    batchMetadata?: false;
+}) | undefined): Promise<{
+    [x: string]: any;
+}>;
 /**
  * Get stack analysis for all workspace packages/crates (batch).
  * Detects ecosystem from workspace root: Cargo (Cargo.toml + Cargo.lock) or JS/TS (package.json + lock file).
  * SBOMs are generated in parallel (see `batchConcurrency`) unless `continueOnError: false` (fail-fast sequential).
  * With `opts.batchMetadata` / `TRUSTIFY_DA_BATCH_METADATA`, returns `{ analysis, metadata }` including validation and SBOM errors.
  *
+ * @overload
  * @param {string} workspaceRoot - Path to workspace root (containing lock file and workspace config)
  * @param {boolean} [html=false] - true returns HTML, false returns JSON report
  * @param {Options} [opts={}] - `batchConcurrency`, discovery ignores, `continueOnError` (default true), `batchMetadata` (default false)
  * @returns {Promise<string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>|{ analysis: string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>, metadata: BatchAnalysisMetadata }>}
  * @throws {Error} if workspace root invalid, no manifests found, no packages pass validation, no SBOMs produced, or backend request failed. When `opts.batchMetadata` is set, `error.batchMetadata` may be set on thrown errors.
  */
-declare function stackAnalysisBatch(workspaceRoot: string, html?: boolean, opts?: Options): Promise<string | {
-    [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport;
+declare function stackAnalysisBatch(workspaceRoot: string, html?: boolean | undefined, opts?: Options | undefined): Promise<string | {
+    [x: string]: any;
 } | {
     analysis: string | {
-        [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport;
+        [x: string]: any;
     };
     metadata: BatchAnalysisMetadata;
 }>;
@@ -174,7 +232,7 @@ declare function imageAnalysis(imageRefs: Array<string>, html: true, opts?: Opti
  * @throws {Error}
  */
 declare function imageAnalysis(imageRefs: Array<string>, html: false, opts?: Options | undefined): Promise<{
-    [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport;
+    [x: string]: any;
 }>;
 /**
  * Get image analysis report for a set of OCI image references.
@@ -187,7 +245,7 @@ declare function imageAnalysis(imageRefs: Array<string>, html: false, opts?: Opt
  * 		or backend request failed
  */
 declare function imageAnalysis(imageRefs: Array<string>, html?: boolean | undefined, opts?: Options | undefined): Promise<string | {
-    [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport;
+    [x: string]: any;
 }>;
 /**
  * Validates the Exhort token.
@@ -196,6 +254,10 @@ declare function imageAnalysis(imageRefs: Array<string>, html?: boolean | undefi
  * @throws {Error} if the backend request failed.
  */
 declare function validateToken(opts?: Options): Promise<object>;
+import { discoverMavenModules } from './providers/java_maven.js';
+import { discoverGradleSubprojects } from './providers/java_gradle.js';
+import { discoverGoWorkspaceModules } from './providers/golang_gomodules.js';
+import { discoverUvWorkspaceMembers } from './providers/python_uv.js';
 import { discoverWorkspacePackages } from './workspace.js';
 import { discoverWorkspaceCrates } from './workspace.js';
 import { validatePackageJson } from './workspace.js';
@@ -203,5 +265,6 @@ import { resolveWorkspaceDiscoveryIgnore } from './workspace.js';
 import { filterManifestPathsByDiscoveryIgnore } from './workspace.js';
 import { resolveContinueOnError } from './batch_opts.js';
 import { resolveBatchMetadata } from './batch_opts.js';
-export { discoverWorkspacePackages, discoverWorkspaceCrates, validatePackageJson, resolveWorkspaceDiscoveryIgnore, filterManifestPathsByDiscoveryIgnore, resolveContinueOnError, resolveBatchMetadata };
+export { discoverMavenModules, discoverGradleSubprojects, discoverGoWorkspaceModules, discoverUvWorkspaceMembers, discoverWorkspacePackages, discoverWorkspaceCrates, validatePackageJson, resolveWorkspaceDiscoveryIgnore, filterManifestPathsByDiscoveryIgnore, resolveContinueOnError, resolveBatchMetadata };
 export { getProjectLicense, findLicenseFilePath, identifyLicense, getLicenseDetails, licensesFromReport, normalizeLicensesResponse, runLicenseCheck, getCompatibility } from "./license/index.js";
+export { generateReport, generateDeduplicationKey } from "./remediation_report.js";