@trustify-da/trustify-da-javascript-client 0.3.0-ea.243eaef → 0.3.0-ea.24dd325

package/dist/src/config.js

@@ -0,0 +1,260 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { load as yamlLoad } from 'js-yaml';
+/**
+ * @typedef {{
+ *   'group-by'?: 'dependency' | 'bundle',
+ *   exclude?: string[],
+ *   labels?: string[],
+ *   'branch-prefix'?: string,
+ *   [key: string]: unknown
+ * }} RemediationConfig
+ */
+/** @typedef {{ critical?: number, high?: number, 'license-conflicts'?: number, [key: string]: unknown }} FailOnConfig */
+/** @typedef {{ 'fail-on'?: FailOnConfig, [key: string]: unknown }} CheckConfig */
+/** @typedef {{ format?: string, targets?: string[], [key: string]: unknown }} SbomConfig */
+/**
+ * @typedef {{
+ *   'backend-url'?: string,
+ *   providers?: string[] | string,
+ *   sources?: string[] | string,
+ *   remediation?: RemediationConfig,
+ *   check?: CheckConfig,
+ *   sbom?: SbomConfig,
+ *   [key: string]: unknown
+ * }} FileConfig
+ */
+/**
+ * @typedef {{
+ *   backendUrl: string | null,
+ *   backendUrlSource: 'cli' | 'environment' | 'file' | 'default',
+ *   providers: string[],
+ *   sources: string[],
+ *   groupBy: string,
+ *   remediation: object,
+ *   check: object,
+ *   sbom: object
+ * }} ResolvedConfig
+ */
+/** Config file names discovered by walking up the directory tree, in precedence order. */
+export const CONFIG_FILENAMES = ['.trustify-da.yml', '.trustify-da.yaml'];
+function isMapping(value) {
+    if (value == null || typeof value !== 'object' || Array.isArray(value)) {
+        return false;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype == null;
+}
+function assertMapping(value, field, source) {
+    if (!isMapping(value)) {
+        throw new Error(`Invalid config file ${source}: ${field} must be a mapping`);
+    }
+}
+function assertString(value, field, source) {
+    if (typeof value !== 'string') {
+        throw new Error(`Invalid config file ${source}: ${field} must be a string`);
+    }
+}
+function assertStringArray(value, field, source) {
+    if (!Array.isArray(value) || value.some(item => typeof item !== 'string')) {
+        throw new Error(`Invalid config file ${source}: ${field} must be an array of strings`);
+    }
+}
+function assertStringOrArray(value, field, source) {
+    if (typeof value !== 'string') {
+        assertStringArray(value, field, source);
+    }
+}
+/**
+ * Validates all fields in the initial configuration schema. Unknown fields are preserved.
+ * @param {unknown} config
+ * @param {string} [source]
+ * @returns {FileConfig}
+ */
+function validateConfig(config, source = '<config>') {
+    assertMapping(config, 'root', source);
+    if (config['backend-url'] !== undefined) {
+        assertString(config['backend-url'], 'backend-url', source);
+    }
+    if (config.providers !== undefined) {
+        assertStringOrArray(config.providers, 'providers', source);
+    }
+    if (config.sources !== undefined) {
+        assertStringOrArray(config.sources, 'sources', source);
+    }
+    if (config.remediation !== undefined) {
+        assertMapping(config.remediation, 'remediation', source);
+        const remediation = config.remediation;
+        if (remediation['group-by'] !== undefined && !['dependency', 'bundle'].includes(remediation['group-by'])) {
+            throw new Error(`Invalid config file ${source}: remediation.group-by must be dependency or bundle`);
+        }
+        if (remediation.exclude !== undefined) {
+            assertStringArray(remediation.exclude, 'remediation.exclude', source);
+        }
+        if (remediation.labels !== undefined) {
+            assertStringArray(remediation.labels, 'remediation.labels', source);
+        }
+        if (remediation['branch-prefix'] !== undefined) {
+            assertString(remediation['branch-prefix'], 'remediation.branch-prefix', source);
+        }
+    }
+    if (config.check !== undefined) {
+        assertMapping(config.check, 'check', source);
+        if (config.check['fail-on'] !== undefined) {
+            assertMapping(config.check['fail-on'], 'check.fail-on', source);
+            for (const field of ['critical', 'high', 'license-conflicts']) {
+                const value = config.check['fail-on'][field];
+                if (value !== undefined && (typeof value !== 'number' || !Number.isFinite(value))) {
+                    throw new Error(`Invalid config file ${source}: check.fail-on.${field} must be a finite number`);
+                }
+            }
+        }
+    }
+    if (config.sbom !== undefined) {
+        assertMapping(config.sbom, 'sbom', source);
+        if (config.sbom.format !== undefined) {
+            assertString(config.sbom.format, 'sbom.format', source);
+        }
+        if (config.sbom.targets !== undefined) {
+            assertStringArray(config.sbom.targets, 'sbom.targets', source);
+        }
+    }
+    return config;
+}
+/**
+ * Walks up from `startPath` looking for a `.trustify-da.yml` (or `.yaml`) file,
+ * similar to how `.eslintrc` discovery works. If `startPath` points at a file,
+ * discovery begins in its containing directory. Within a directory, `.yml` takes
+ * precedence over `.yaml`.
+ * @param {string} startPath - manifest file or directory to start the search from
+ * @returns {string | null} absolute path to the config file, or null if none found
+ */
+function findConfigFile(startPath) {
+    let dir = path.resolve(startPath || '.');
+    try {
+        if (fs.statSync(dir).isFile()) {
+            dir = path.dirname(dir);
+        }
+    }
+    catch {
+        // startPath may not exist yet — walk up from its resolved location anyway
+    }
+    // Walk up until the filesystem root (where dirname(dir) === dir)
+    for (;;) {
+        for (const name of CONFIG_FILENAMES) {
+            const candidate = path.join(dir, name);
+            try {
+                if (fs.statSync(candidate).isFile()) {
+                    return candidate;
+                }
+            }
+            catch {
+                // Ignore inaccessible or disappearing candidates and continue discovery.
+            }
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir) {
+            return null;
+        }
+        dir = parent;
+    }
+}
+/**
+ * Discovers and parses `.trustify-da.yml` by walking up from `startPath`.
+ * A missing config file is not an error — an empty object is returned so callers
+ * can fall back to defaults.
+ * @param {string} [startPath] - manifest file or directory to start the search from
+ * @returns {FileConfig} the parsed config object, or `{}` when no file is found
+ * @throws {Error} when the config file exists but contains malformed YAML
+ */
+export function loadConfig(startPath) {
+    const configPath = findConfigFile(startPath);
+    if (!configPath) {
+        return {};
+    }
+    const content = fs.readFileSync(configPath, 'utf-8');
+    let doc;
+    try {
+        doc = yamlLoad(content);
+    }
+    catch (err) {
+        throw new Error(`Failed to parse config file ${configPath}: ${err.message}`);
+    }
+    return doc == null ? {} : validateConfig(doc, configPath);
+}
+/**
+ * Normalizes a providers/sources value to an array of trimmed strings. Accepts
+ * either a YAML array (`[redhat, osv]`) or a comma-separated string (`redhat,osv`).
+ * @param {string[] | string | undefined | null} value
+ * @returns {string[]}
+ */
+function toArray(value) {
+    if (Array.isArray(value)) {
+        return value.filter(v => typeof v === 'string' && v.trim()).map(v => v.trim());
+    }
+    if (typeof value === 'string') {
+        return value.split(',').map(v => v.trim()).filter(Boolean);
+    }
+    return [];
+}
+/**
+ * Returns the first argument that is neither undefined nor null.
+ * @param {...unknown} values
+ * @returns {unknown}
+ */
+function first(...values) {
+    return values.find(v => v != null);
+}
+/**
+ * Merges config sources with precedence: CLI flag > environment variable
+ * (`TRUSTIFY_DA_*`) > config file > hardcoded default. Providers and sources are
+ * normalized to arrays regardless of whether the source used a YAML array or a
+ * comma-separated string.
+ * @param {FileConfig} [fileConfig={}] - values parsed from `.trustify-da.yml`
+ * @param {{ providers?: string, sources?: string, groupBy?: string, backendUrl?: string }} [cliFlags={}]
+ * @param {{ [key: string]: string | undefined }} [envVars={}] - typically `process.env`
+ * @returns {ResolvedConfig} the resolved, typed config object
+ */
+export function mergeConfig(fileConfig = {}, cliFlags = {}, envVars = {}) {
+    const file = validateConfig(fileConfig || {});
+    const cli = cliFlags || {};
+    const env = envVars || {};
+    let backendUrl = null;
+    let backendUrlSource = 'default';
+    if (cli.backendUrl != null) {
+        backendUrl = cli.backendUrl;
+        backendUrlSource = 'cli';
+    }
+    else if (env.TRUSTIFY_DA_BACKEND_URL != null) {
+        backendUrl = env.TRUSTIFY_DA_BACKEND_URL;
+        backendUrlSource = 'environment';
+    }
+    else if (file['backend-url'] != null) {
+        backendUrl = file['backend-url'];
+        backendUrlSource = 'file';
+    }
+    const groupBy = first(cli.groupBy, env.TRUSTIFY_DA_GROUP_BY, file.remediation?.['group-by']) ?? 'dependency';
+    if (!['dependency', 'bundle'].includes(groupBy)) {
+        throw new Error(`Invalid group-by value "${groupBy}". Expected dependency or bundle.`);
+    }
+    return {
+        backendUrl,
+        backendUrlSource,
+        providers: toArray(first(cli.providers, env.TRUSTIFY_DA_PROVIDERS, file.providers)),
+        sources: toArray(first(cli.sources, env.TRUSTIFY_DA_SOURCES, file.sources)),
+        groupBy,
+        remediation: file.remediation ?? {},
+        check: file.check ?? {},
+        sbom: file.sbom ?? {},
+    };
+}
+/**
+ * Loads and merges the project configuration for a target path.
+ * @param {string} [startPath] - manifest file or directory to start discovery from
+ * @param {{ providers?: string, sources?: string, groupBy?: string, backendUrl?: string }} [cliFlags={}] - explicit options
+ * @param {{ [key: string]: string | undefined }} [envVars={}] - typically `process.env`
+ * @returns {ResolvedConfig} the resolved, typed config object
+ */
+export function resolveConfig(startPath, cliFlags = {}, envVars = {}) {
+    return mergeConfig(loadConfig(startPath), cliFlags, envVars);
+}

package/dist/src/index.d.ts

@@ -1,8 +1,6 @@
 /**
- * This function is used to determine the Trustify DA backend URL.
- * The TRUSTIFY_DA_BACKEND_URL is evaluated in the following order and selected when it finds it first:
- * 1. Environment Variable
- * 2. (key,value) from opts object
+ * Selects the Trustify DA backend URL from opts.TRUSTIFY_DA_BACKEND_URL, then environment
+ * variable TRUSTIFY_DA_BACKEND_URL. Options take precedence over environment variables.
  * If TRUSTIFY_DA_BACKEND_URL is not set, the function will throw an error.
  * @param {{TRUSTIFY_DA_DEBUG?: string | undefined; TRUSTIFY_DA_BACKEND_URL?: string | undefined}} [opts={}]
  * @return {string} - The selected Trustify DA backend URL
@@ -64,6 +62,7 @@ export type Options = {
     TRUSTIFY_DA_YARN_PATH?: string | undefined;
     TRUSTIFY_DA_WORKSPACE_DIR?: string | undefined;
     TRUSTIFY_DA_LICENSE_CHECK?: string | undefined;
+    licenseCheck?: boolean | undefined;
     MATCH_MANIFEST_VERSIONS?: string | undefined;
     TRUSTIFY_DA_SOURCE?: string | undefined;
     TRUSTIFY_DA_TOKEN?: string | undefined;
@@ -106,10 +105,10 @@ export type SbomResult = {
  * Get component analysis report for a manifest content.
  * @param {string} manifest - path to the manifest
  * @param {Options} [opts={}] - optional various options to pass along the application
- * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>}
+ * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>}
  * @throws {Error} if no matching provider, failed to get create content, or backend request failed
  */
-declare function componentAnalysis(manifest: string, opts?: Options): Promise<any>;
+declare function componentAnalysis(manifest: string, opts?: Options): Promise<import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts").AnalysisReport>;
 /**
  * @overload
  * @param {string} manifest
@@ -124,21 +123,21 @@ declare function stackAnalysis(manifest: string, html: true, opts?: Options | un
  * @param {string} manifest
  * @param {false} html
  * @param {Options} [opts={}]
- * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>}
+ * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>}
  * @throws {Error}
  */
-declare function stackAnalysis(manifest: string, html: false, opts?: Options | undefined): Promise<any>;
+declare function stackAnalysis(manifest: string, html: false, opts?: Options | undefined): Promise<import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts").AnalysisReport>;
 /**
  * Get stack analysis report for a manifest file.
  * @overload
  * @param {string} manifest - path for the manifest
  * @param {boolean} [html=false] - true will return a html string, false will return AnalysisReport object.
  * @param {Options} [opts={}] - optional various options to pass along the application
- * @returns {Promise<string|import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>}
+ * @returns {Promise<string|import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>}
  * @throws {Error} if manifest inaccessible, no matching provider, failed to get create content,
  * 		or backend request failed
  */
-declare function stackAnalysis(manifest: string, html?: boolean | undefined, opts?: Options | undefined): Promise<string | any>;
+declare function stackAnalysis(manifest: string, html?: boolean | undefined, opts?: Options | undefined): Promise<string | import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts").AnalysisReport>;
 /**
  * @overload
  * @param {string} workspaceRoot
@@ -169,14 +168,14 @@ declare function stackAnalysisBatch(workspaceRoot: string, html: true, opts?: (O
  * @param {string} workspaceRoot
  * @param {false} html
  * @param {Options & { batchMetadata: true }} opts
- * @returns {Promise<{ analysis: Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>, metadata: BatchAnalysisMetadata }>}
+ * @returns {Promise<{ analysis: Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>, metadata: BatchAnalysisMetadata }>}
  * @throws {Error}
  */
 declare function stackAnalysisBatch(workspaceRoot: string, html: false, opts: Options & {
     batchMetadata: true;
 }): Promise<{
     analysis: {
-        [x: string]: any;
+        [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts").AnalysisReport;
     };
     metadata: BatchAnalysisMetadata;
 }>;
@@ -185,13 +184,13 @@ declare function stackAnalysisBatch(workspaceRoot: string, html: false, opts: Op
  * @param {string} workspaceRoot
  * @param {false} html
  * @param {Options & { batchMetadata?: false }} [opts={}]
- * @returns {Promise<Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>>}
+ * @returns {Promise<Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>>}
  * @throws {Error}
  */
 declare function stackAnalysisBatch(workspaceRoot: string, html: false, opts?: (Options & {
     batchMetadata?: false;
 }) | undefined): Promise<{
-    [x: string]: any;
+    [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts").AnalysisReport;
 }>;
 /**
  * Get stack analysis for all workspace packages/crates (batch).
@@ -203,14 +202,14 @@ declare function stackAnalysisBatch(workspaceRoot: string, html: false, opts?: (
  * @param {string} workspaceRoot - Path to workspace root (containing lock file and workspace config)
  * @param {boolean} [html=false] - true returns HTML, false returns JSON report
  * @param {Options} [opts={}] - `batchConcurrency`, discovery ignores, `continueOnError` (default true), `batchMetadata` (default false)
- * @returns {Promise<string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>|{ analysis: string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>, metadata: BatchAnalysisMetadata }>}
+ * @returns {Promise<string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>|{ analysis: string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>, metadata: BatchAnalysisMetadata }>}
  * @throws {Error} if workspace root invalid, no manifests found, no packages pass validation, no SBOMs produced, or backend request failed. When `opts.batchMetadata` is set, `error.batchMetadata` may be set on thrown errors.
  */
 declare function stackAnalysisBatch(workspaceRoot: string, html?: boolean | undefined, opts?: Options | undefined): Promise<string | {
-    [x: string]: any;
+    [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts").AnalysisReport;
 } | {
     analysis: string | {
-        [x: string]: any;
+        [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts").AnalysisReport;
     };
     metadata: BatchAnalysisMetadata;
 }>;
@@ -228,11 +227,11 @@ declare function imageAnalysis(imageRefs: Array<string>, html: true, opts?: Opti
  * @param {Array<string>} imageRefs
  * @param {false} html
  * @param {Options} [opts={}]
- * @returns {Promise<Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>>}
+ * @returns {Promise<Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>>}
  * @throws {Error}
  */
 declare function imageAnalysis(imageRefs: Array<string>, html: false, opts?: Options | undefined): Promise<{
-    [x: string]: any;
+    [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts").AnalysisReport;
 }>;
 /**
  * Get image analysis report for a set of OCI image references.
@@ -240,12 +239,12 @@ declare function imageAnalysis(imageRefs: Array<string>, html: false, opts?: Opt
  * @param {Array<string>} imageRefs - OCI image references
  * @param {boolean} [html=false] - true will return a html string, false will return AnalysisReport
  * @param {Options} [opts={}] - optional various options to pass along the application
- * @returns {Promise<string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>>}
+ * @returns {Promise<string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>>}
  * @throws {Error} if manifest inaccessible, no matching provider, failed to get create content,
  * 		or backend request failed
  */
 declare function imageAnalysis(imageRefs: Array<string>, html?: boolean | undefined, opts?: Options | undefined): Promise<string | {
-    [x: string]: any;
+    [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts").AnalysisReport;
 }>;
 /**
  * Validates the Exhort token.
@@ -268,3 +267,5 @@ import { resolveBatchMetadata } from './batch_opts.js';
 export { discoverMavenModules, discoverGradleSubprojects, discoverGoWorkspaceModules, discoverUvWorkspaceMembers, discoverWorkspacePackages, discoverWorkspaceCrates, validatePackageJson, resolveWorkspaceDiscoveryIgnore, filterManifestPathsByDiscoveryIgnore, resolveContinueOnError, resolveBatchMetadata };
 export { getProjectLicense, findLicenseFilePath, identifyLicense, getLicenseDetails, licensesFromReport, normalizeLicensesResponse, runLicenseCheck, getCompatibility } from "./license/index.js";
 export { generateReport, generateDeduplicationKey } from "./remediation_report.js";
+export { loadConfig, mergeConfig, resolveConfig, CONFIG_FILENAMES } from "./config.js";
+export { runRemediation, findManifests } from "./remediate.js";

package/dist/src/index.js

@@ -17,6 +17,8 @@ export { ImageRef } from "./oci_image/images.js";
 export { getProjectLicense, findLicenseFilePath, identifyLicense, getLicenseDetails, licensesFromReport, normalizeLicensesResponse, runLicenseCheck, getCompatibility } from "./license/index.js";
 export { extractRemediations } from "./remediation.js";
 export { generateReport, generateDeduplicationKey } from './remediation_report.js';
+export { loadConfig, mergeConfig, resolveConfig, CONFIG_FILENAMES } from './config.js';
+export { runRemediation, findManifests } from './remediate.js';
 export default { componentAnalysis, stackAnalysis, stackAnalysisBatch, imageAnalysis, validateToken, generateSbom };
 export { discoverMavenModules, discoverGradleSubprojects, discoverGoWorkspaceModules, discoverUvWorkspaceMembers, discoverWorkspacePackages, discoverWorkspaceCrates, validatePackageJson, resolveWorkspaceDiscoveryIgnore, filterManifestPathsByDiscoveryIgnore, resolveContinueOnError, resolveBatchMetadata, };
 /**
@@ -50,6 +52,7 @@ export { discoverMavenModules, discoverGradleSubprojects, discoverGoWorkspaceMod
  * TRUSTIFY_DA_YARN_PATH?: string | undefined,
  * TRUSTIFY_DA_WORKSPACE_DIR?: string | undefined,
  * TRUSTIFY_DA_LICENSE_CHECK?: string | undefined,
+ * licenseCheck?: boolean | undefined,
  * MATCH_MANIFEST_VERSIONS?: string | undefined,
  * TRUSTIFY_DA_SOURCE?: string | undefined,
  * TRUSTIFY_DA_TOKEN?: string | undefined,
@@ -97,10 +100,8 @@ function readAndPrintVersionFromPackageJson() {
     logOptionsAndEnvironmentsVariables("trustify-da-javascript-client analysis started, version: ", getPackageVersion());
 }
 /**
- * This function is used to determine the Trustify DA backend URL.
- * The TRUSTIFY_DA_BACKEND_URL is evaluated in the following order and selected when it finds it first:
- * 1. Environment Variable
- * 2. (key,value) from opts object
+ * Selects the Trustify DA backend URL from opts.TRUSTIFY_DA_BACKEND_URL, then environment
+ * variable TRUSTIFY_DA_BACKEND_URL. Options take precedence over environment variables.
  * If TRUSTIFY_DA_BACKEND_URL is not set, the function will throw an error.
  * @param {{TRUSTIFY_DA_DEBUG?: string | undefined; TRUSTIFY_DA_BACKEND_URL?: string | undefined}} [opts={}]
  * @return {string} - The selected Trustify DA backend URL
@@ -131,7 +132,7 @@ export function selectTrustifyDABackend(opts = {}) {
  * @param {string} manifest
  * @param {false} html
  * @param {Options} [opts={}]
- * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>}
+ * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>}
  * @throws {Error}
  */
 /**
@@ -140,7 +141,7 @@ export function selectTrustifyDABackend(opts = {}) {
  * @param {string} manifest - path for the manifest
  * @param {boolean} [html=false] - true will return a html string, false will return AnalysisReport object.
  * @param {Options} [opts={}] - optional various options to pass along the application
- * @returns {Promise<string|import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>}
+ * @returns {Promise<string|import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>}
  * @throws {Error} if manifest inaccessible, no matching provider, failed to get create content,
  * 		or backend request failed
  */
@@ -154,7 +155,7 @@ async function stackAnalysis(manifest, html = false, opts = {}) {
  * Get component analysis report for a manifest content.
  * @param {string} manifest - path to the manifest
  * @param {Options} [opts={}] - optional various options to pass along the application
- * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>}
+ * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>}
  * @throws {Error} if no matching provider, failed to get create content, or backend request failed
  */
 async function componentAnalysis(manifest, opts = {}) {
@@ -179,7 +180,7 @@ async function componentAnalysis(manifest, opts = {}) {
  * @param {Array<string>} imageRefs
  * @param {false} html
  * @param {Options} [opts={}]
- * @returns {Promise<Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>>}
+ * @returns {Promise<Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>>}
  * @throws {Error}
  */
 /**
@@ -188,7 +189,7 @@ async function componentAnalysis(manifest, opts = {}) {
  * @param {Array<string>} imageRefs - OCI image references
  * @param {boolean} [html=false] - true will return a html string, false will return AnalysisReport
  * @param {Options} [opts={}] - optional various options to pass along the application
- * @returns {Promise<string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>>}
+ * @returns {Promise<string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>>}
  * @throws {Error} if manifest inaccessible, no matching provider, failed to get create content,
  * 		or backend request failed
  */
@@ -197,7 +198,8 @@ async function imageAnalysis(imageRefs, html = false, opts = {}) {
     return await analysis.requestImages(imageRefs, theUrl, html, opts);
 }
 /**
- * Max concurrent SBOM generations for batch workspace analysis. Env/opts override default 10.
+ * Max concurrent SBOM generations for batch workspace analysis. Options override environment;
+ * environment overrides the default of 10.
  * @param {Options} opts
  * @returns {number}
  * @private
@@ -440,7 +442,7 @@ function batchError(message, wantMetadata, metadata) {
  * @param {string} workspaceRoot
  * @param {false} html
  * @param {Options & { batchMetadata: true }} opts
- * @returns {Promise<{ analysis: Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>, metadata: BatchAnalysisMetadata }>}
+ * @returns {Promise<{ analysis: Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>, metadata: BatchAnalysisMetadata }>}
  * @throws {Error}
  */
 /**
@@ -448,7 +450,7 @@ function batchError(message, wantMetadata, metadata) {
  * @param {string} workspaceRoot
  * @param {false} html
  * @param {Options & { batchMetadata?: false }} [opts={}]
- * @returns {Promise<Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>>}
+ * @returns {Promise<Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>>}
  * @throws {Error}
  */
 /**
@@ -461,7 +463,7 @@ function batchError(message, wantMetadata, metadata) {
  * @param {string} workspaceRoot - Path to workspace root (containing lock file and workspace config)
  * @param {boolean} [html=false] - true returns HTML, false returns JSON report
  * @param {Options} [opts={}] - `batchConcurrency`, discovery ignores, `continueOnError` (default true), `batchMetadata` (default false)
- * @returns {Promise<string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>|{ analysis: string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>, metadata: BatchAnalysisMetadata }>}
+ * @returns {Promise<string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>|{ analysis: string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>, metadata: BatchAnalysisMetadata }>}
  * @throws {Error} if workspace root invalid, no manifests found, no packages pass validation, no SBOMs produced, or backend request failed. When `opts.batchMetadata` is set, `error.batchMetadata` may be set on thrown errors.
  */
 async function stackAnalysisBatch(workspaceRoot, html = false, opts = {}) {

package/dist/src/license/index.d.ts

@@ -6,10 +6,10 @@
  * @param {string} manifestPath - path to manifest
  * @param {string} url - the backend url to send the request to
  * @param {import('../index.js').Options} [opts={}]
- * @param {import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport} [analysisResult] - analysis result that includes licenses array from backend
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport} [analysisResult] - analysis result that includes licenses array from backend
  * @returns {Promise<{ projectLicense: { manifest: Object|null, file: Object|null, mismatch: boolean }, incompatibleDependencies: Array<{ purl: string, licenses: string[], category?: string, reason: string }>, error?: string }>}
  */
-export function runLicenseCheck(sbomContent: string, manifestPath: string, url: string, opts?: import("../index.js").Options, analysisResult?: any): Promise<{
+export function runLicenseCheck(sbomContent: string, manifestPath: string, url: string, opts?: import("../index.js").Options, analysisResult?: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts").AnalysisReport): Promise<{
     projectLicense: {
         manifest: Object | null;
         file: Object | null;

package/dist/src/license/index.js

@@ -1,9 +1,9 @@
 /**
  * License resolution and dependency license compatibility for component analysis.
  */
-import { getProjectLicense, findLicenseFilePath, identifyLicense } from './project_license.js';
-import { licensesFromReport, getLicenseDetails } from './licenses_api.js';
 import { getCompatibility } from './license_utils.js';
+import { licensesFromReport, getLicenseDetails } from './licenses_api.js';
+import { getProjectLicense, findLicenseFilePath, identifyLicense } from './project_license.js';
 export { getProjectLicense, findLicenseFilePath, identifyLicense } from './project_license.js';
 export { licensesFromReport, normalizeLicensesResponse, getLicenseDetails } from './licenses_api.js';
 export { getCompatibility } from './license_utils.js';
@@ -15,7 +15,7 @@ export { getCompatibility } from './license_utils.js';
  * @param {string} manifestPath - path to manifest
  * @param {string} url - the backend url to send the request to
  * @param {import('../index.js').Options} [opts={}]
- * @param {import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport} [analysisResult] - analysis result that includes licenses array from backend
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport} [analysisResult] - analysis result that includes licenses array from backend
  * @returns {Promise<{ projectLicense: { manifest: Object|null, file: Object|null, mismatch: boolean }, incompatibleDependencies: Array<{ purl: string, licenses: string[], category?: string, reason: string }>, error?: string }>}
  */
 export async function runLicenseCheck(sbomContent, manifestPath, url, opts = {}, analysisResult = null) {
@@ -39,10 +39,12 @@ export async function runLicenseCheck(sbomContent, manifestPath, url, opts = {},
     // Fetch detailed license info from backend (avoid duplicate calls if same license)
     const licenseDetailsCache = new Map();
     async function getDetails(spdxId) {
-        if (!spdxId || !url)
+        if (!spdxId || !url) {
             return null;
-        if (licenseDetailsCache.has(spdxId))
+        }
+        if (licenseDetailsCache.has(spdxId)) {
             return licenseDetailsCache.get(spdxId);
+        }
         try {
             const details = await getLicenseDetails(spdxId, { ...opts, TRUSTIFY_DA_BACKEND_URL: url });
             licenseDetailsCache.set(spdxId, details);
@@ -81,8 +83,9 @@ export async function runLicenseCheck(sbomContent, manifestPath, url, opts = {},
     const incompatibleDependencies = [];
     for (const purl of purls) {
         const entry = licenseByPurl.get(purl);
-        if (!entry)
+        if (!entry) {
             continue;
+        }
         const status = getCompatibility(projectCategory, entry.category);
         if (status === 'incompatible') {
             const reason = entry.category?.toUpperCase() === 'UNKNOWN'

package/dist/src/license/licenses_api.d.ts

@@ -24,11 +24,11 @@ export function normalizeLicensesResponse(data: unknown, purls?: string[]): Map<
  * Build license map from an analysis report that already includes license data (result.licenses).
  * Use this when the dependency analysis response already contains the licenses array to avoid a second request.
  *
- * @param {import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport} analysisReport - full analysis JSON
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport} analysisReport - full analysis JSON
  * @param {string[]} [purls] - optional list of purls to restrict to
  * @returns {Map<string, { licenses: string[], category?: string }>}
  */
-export function licensesFromReport(analysisReport: any, purls?: string[]): Map<string, {
+export function licensesFromReport(analysisReport: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts").AnalysisReport, purls?: string[]): Map<string, {
     licenses: string[];
     category?: string;
 }>;

package/dist/src/license/licenses_api.js

@@ -86,7 +86,7 @@ export function normalizeLicensesResponse(data, purls = []) {
  * Build license map from an analysis report that already includes license data (result.licenses).
  * Use this when the dependency analysis response already contains the licenses array to avoid a second request.
  *
- * @param {import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport} analysisReport - full analysis JSON
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport} analysisReport - full analysis JSON
  * @param {string[]} [purls] - optional list of purls to restrict to
  * @returns {Map<string, { licenses: string[], category?: string }>}
  */

package/dist/src/providers/base_javascript.js

@@ -532,7 +532,7 @@ export default class Base_javascript {
                 }
             }
             // Try to find the command in the following order:
-            // 1. Custom path from environment/opts (via getCustomPath)
+            // 1. Custom path from opts/environment (via getCustomPath)
             // 2. Local node_modules/.bin
             // 3. Global installation
             let cmd = this.#cmd;

package/dist/src/providers/rust_cargo.js

@@ -280,7 +280,7 @@ function parseCargoLockHashes(manifestDir, opts = {}) {
         }
     }
     catch (error) {
-        console.warn('Failed to parse Cargo.lock for hashes, SBOM will be generated without hashes');
+        console.warn(`Failed to parse Cargo.lock at ${lockPath} for hashes: ${error.message}. SBOM will be generated without hashes.`);
     }
     return hashMap;
 }
@@ -441,7 +441,7 @@ function addTransitiveDeps(sbom, metadata, packageId, ignoredDeps, visited, hash
         let depPurl = depPackage.source == null
             ? toPathDepPurl(depPackage.name, depPackage.version)
             : toPurl(depPackage.name, depPackage.version);
-        let hashes = hashMap ? hashMap.get(`${depPackage.name}@${depPackage.version}`) : undefined;
+        let hashes = hashMap.get(`${depPackage.name}@${depPackage.version}`);
         sbom.addDependency(sourcePurl, depPurl, undefined, hashes);
         addTransitiveDeps(sbom, metadata, depId, ignoredDeps, visited, hashMap);
     }
@@ -473,7 +473,7 @@ function addDirectDeps(sbom, metadata, packageId, parentPurl, ignoredDeps, hashM
         let depPurl = depPackage.source == null
             ? toPathDepPurl(depPackage.name, depPackage.version)
             : toPurl(depPackage.name, depPackage.version);
-        let hashes = hashMap ? hashMap.get(`${depPackage.name}@${depPackage.version}`) : undefined;
+        let hashes = hashMap.get(`${depPackage.name}@${depPackage.version}`);
         sbom.addDependency(parentPurl, depPurl, undefined, hashes);
     }
 }