@trustify-da/trustify-da-javascript-client 0.3.0-ea.2ea1d77 → 0.3.0-ea.328523e

package/dist/src/analysis.d.ts

@@ -1,9 +1,12 @@
+/** Media type for CycloneDX JSON batch payloads (batch-analysis API). */
+export const CYCLONEDX_JSON_MEDIA_TYPE: "application/vnd.cyclonedx+json";
 declare namespace _default {
     export { requestComponent };
     export { requestStack };
     export { requestStackBatch };
     export { requestImages };
     export { validateToken };
+    export { appendAnalysisQueryParams };
 }
 export default _default;
 /**
@@ -12,41 +15,62 @@ export default _default;
  * @param {string} manifest - path for the manifest
  * @param {string} url - the backend url to send the request to
  * @param {import("index.js").Options} [opts={}] - optional various options to pass along the application
- * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>}
+ * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>}
  */
-declare function requestComponent(provider: import("./provider").Provider, manifest: string, url: string, opts?: import("index.js").Options): Promise<import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport>;
+declare function requestComponent(provider: any, manifest: string, url: string, opts?: any): Promise<import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts").AnalysisReport>;
 /**
- * Send a stack analysis request and get the report as 'text/html' or 'application/json'.
- * @param {import('./provider').Provider} provider - the provided data for constructing the request
- * @param {string} manifest - path for the manifest
- * @param {string} url - the backend url to send the request to
- * @param {boolean} [html=false] - true will return 'text/html', false will return 'application/json'
- * @param {import("index.js").Options} [opts={}] - optional various options to pass along the application
- * @returns {Promise<string|import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>}
+ * @overload
+ * @param {import('./provider').Provider} provider
+ * @param {string} manifest
+ * @param {string} url
+ * @param {true} [html]
+ * @param {import("index.js").Options} [opts={}]
+ * @returns {Promise<string>}
+ */
+declare function requestStack(provider: any, manifest: string, url: string, html?: true | undefined, opts?: any): Promise<string>;
+/**
+ * @overload
+ * @param {import('./provider').Provider} provider
+ * @param {string} manifest
+ * @param {string} url
+ * @param {false} [html]
+ * @param {import("index.js").Options} [opts={}]
+ * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>>}
  */
-declare function requestStack(provider: import("./provider").Provider, manifest: string, url: string, html?: boolean, opts?: import("index.js").Options): Promise<string | import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport>;
+declare function requestStack(provider: any, manifest: string, url: string, html?: false | undefined, opts?: any): Promise<import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts").AnalysisReport>;
 /**
- * Send a batch stack analysis request for multiple manifests (SBOMs keyed by purl).
- * @param {Object.<string, object>} sbomByPurl - Map of root purl to CycloneDX SBOM object
- * @param {string} url - the backend url
- * @param {boolean} [html=false] - true returns HTML, false returns JSON
+ * @overload
+ * @param {Object.<string, object>} sbomByPurl
+ * @param {string} url
+ * @param {true} [html=false]
  * @param {import("index.js").Options} [opts={}]
- * @returns {Promise<string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>>}
+ * @returns {Promise<string>}
  */
 declare function requestStackBatch(sbomByPurl: {
-    [x: string]: any;
-}, url: string, html?: boolean, opts?: import("index.js").Options): Promise<string | {
-    [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport;
+    [x: string]: object;
+}, url: string, html?: true | undefined, opts?: any): Promise<string>;
+/**
+ * @overload
+ * @param {Object.<string, object>} sbomByPurl
+ * @param {string} url
+ * @param {false} [html=false]
+ * @param {import("index.js").Options} [opts={}]
+ * @returns {Promise<Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>>}
+ */
+declare function requestStackBatch(sbomByPurl: {
+    [x: string]: object;
+}, url: string, html?: false | undefined, opts?: any): Promise<{
+    [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts").AnalysisReport;
 }>;
 /**
  *
  * @param {Array<string>} imageRefs
  * @param {string} url
  * @param {import("index.js").Options} [opts={}] - optional various options to pass along the application
- * @returns {Promise<string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>>}
+ * @returns {Promise<string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>>}
  */
-declare function requestImages(imageRefs: Array<string>, url: string, html?: boolean, opts?: import("index.js").Options): Promise<string | {
-    [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport;
+declare function requestImages(imageRefs: Array<string>, url: string, html?: boolean, opts?: any): Promise<string | {
+    [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts").AnalysisReport;
 }>;
 /**
  *
@@ -54,4 +78,10 @@ declare function requestImages(imageRefs: Array<string>, url: string, html?: boo
  * @param {import("index.js").Options} [opts={}] - optional various options to pass headers for t he validateToken Request
  * @return {Promise<number>} return the HTTP status Code of the response from the validate token request.
  */
-declare function validateToken(url: any, opts?: import("index.js").Options): Promise<number>;
+declare function validateToken(url: any, opts?: any): Promise<number>;
+/**
+ * Append common analysis query parameters (recommend, providers, sources) to a URL.
+ * @param {URL} url - the URL object to append query parameters to
+ * @param {import("index.js").Options} [opts={}] - options containing parameter overrides
+ */
+declare function appendAnalysisQueryParams(url: URL, opts?: any): void;

package/dist/src/analysis.js

@@ -4,7 +4,27 @@ import { EOL } from "os";
 import { runLicenseCheck } from "./license/index.js";
 import { generateImageSBOM, parseImageRef } from "./oci_image/utils.js";
 import { addProxyAgent, getCustom, getTokenHeaders, TRUSTIFY_DA_OPERATION_TYPE_HEADER, TRUSTIFY_DA_PACKAGE_MANAGER_HEADER } from "./tools.js";
-export default { requestComponent, requestStack, requestStackBatch, requestImages, validateToken };
+/** Media type for CycloneDX JSON batch payloads (batch-analysis API). */
+export const CYCLONEDX_JSON_MEDIA_TYPE = 'application/vnd.cyclonedx+json';
+export default { requestComponent, requestStack, requestStackBatch, requestImages, validateToken, appendAnalysisQueryParams };
+/**
+ * @overload
+ * @param {import('./provider').Provider} provider
+ * @param {string} manifest
+ * @param {string} url
+ * @param {true} [html]
+ * @param {import("index.js").Options} [opts={}]
+ * @returns {Promise<string>}
+ */
+/**
+ * @overload
+ * @param {import('./provider').Provider} provider
+ * @param {string} manifest
+ * @param {string} url
+ * @param {false} [html]
+ * @param {import("index.js").Options} [opts={}]
+ * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>>}
+ */
 /**
  * Send a stack analysis request and get the report as 'text/html' or 'application/json'.
  * @param {import('./provider').Provider} provider - the provided data for constructing the request
@@ -12,12 +32,15 @@ export default { requestComponent, requestStack, requestStackBatch, requestImage
  * @param {string} url - the backend url to send the request to
  * @param {boolean} [html=false] - true will return 'text/html', false will return 'application/json'
  * @param {import("index.js").Options} [opts={}] - optional various options to pass along the application
- * @returns {Promise<string|import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>}
+ * @returns {Promise<string|import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>}
  */
 async function requestStack(provider, manifest, url, html = false, opts = {}) {
     opts["source-manifest"] = Buffer.from(fs.readFileSync(manifest).toString()).toString('base64');
     opts["manifest-type"] = path.parse(manifest).base;
     let provided = await provider.provideStack(manifest, opts); // throws error if content providing failed
+    if (provided.batch) {
+        return requestStackBatch(JSON.parse(provided.content), url, html, opts);
+    }
     opts["source-manifest"] = "";
     opts[TRUSTIFY_DA_OPERATION_TYPE_HEADER.toUpperCase().replaceAll("-", "_")] = "stack-analysis";
     let startTime = new Date();
@@ -36,9 +59,7 @@ async function requestStack(provider, manifest, url, html = false, opts = {}) {
         body: provided.content
     }, opts);
     const finalUrl = new URL(`${url}/api/v5/analysis`);
-    if (opts['TRUSTIFY_DA_RECOMMENDATIONS_ENABLED'] === 'false') {
-        finalUrl.searchParams.append('recommend', 'false');
-    }
+    appendAnalysisQueryParams(finalUrl, opts);
     let resp = await fetch(finalUrl, fetchOptions);
     let result;
     if (resp.status === 200) {
@@ -72,11 +93,14 @@ async function requestStack(provider, manifest, url, html = false, opts = {}) {
  * @param {string} manifest - path for the manifest
  * @param {string} url - the backend url to send the request to
  * @param {import("index.js").Options} [opts={}] - optional various options to pass along the application
- * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>}
+ * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>}
  */
 async function requestComponent(provider, manifest, url, opts = {}) {
     opts["source-manifest"] = Buffer.from(fs.readFileSync(manifest).toString()).toString('base64');
     let provided = await provider.provideComponent(manifest, opts); // throws error if content providing failed
+    if (provided.batch) {
+        return requestStackBatch(JSON.parse(provided.content), url, false, opts);
+    }
     opts["source-manifest"] = "";
     opts[TRUSTIFY_DA_OPERATION_TYPE_HEADER.toUpperCase().replaceAll("-", "_")] = "component-analysis";
     if (process.env["TRUSTIFY_DA_DEBUG"] === "true") {
@@ -93,9 +117,7 @@ async function requestComponent(provider, manifest, url, opts = {}) {
         body: provided.content
     }, opts);
     const finalUrl = new URL(`${url}/api/v5/analysis`);
-    if (opts['TRUSTIFY_DA_RECOMMENDATIONS_ENABLED'] === 'false') {
-        finalUrl.searchParams.append('recommend', 'false');
-    }
+    appendAnalysisQueryParams(finalUrl, opts);
     let resp = await fetch(finalUrl, fetchOptions);
     let result;
     if (resp.status === 200) {
@@ -109,7 +131,9 @@ async function requestComponent(provider, manifest, url, opts = {}) {
             console.log(JSON.stringify(result, null, 4));
             console.log("Ending time of sending component analysis request to Trustify DA backend server= " + new Date());
         }
-        const licenseCheckEnabled = getCustom('TRUSTIFY_DA_LICENSE_CHECK', 'true', opts) !== 'false' && opts.licenseCheck !== false;
+        const licenseCheckEnabled = typeof opts.licenseCheck === 'boolean'
+            ? opts.licenseCheck
+            : getCustom('TRUSTIFY_DA_LICENSE_CHECK', 'true', opts) !== 'false';
         if (licenseCheckEnabled) {
             try {
                 result.licenseSummary = await runLicenseCheck(provided.content, manifest, url, opts, result);
@@ -124,24 +148,38 @@ async function requestComponent(provider, manifest, url, opts = {}) {
     }
     return Promise.resolve(result);
 }
+/**
+ * @overload
+ * @param {Object.<string, object>} sbomByPurl
+ * @param {string} url
+ * @param {true} [html=false]
+ * @param {import("index.js").Options} [opts={}]
+ * @returns {Promise<string>}
+ */
+/**
+ * @overload
+ * @param {Object.<string, object>} sbomByPurl
+ * @param {string} url
+ * @param {false} [html=false]
+ * @param {import("index.js").Options} [opts={}]
+ * @returns {Promise<Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>>}
+ */
 /**
  * Send a batch stack analysis request for multiple manifests (SBOMs keyed by purl).
  * @param {Object.<string, object>} sbomByPurl - Map of root purl to CycloneDX SBOM object
  * @param {string} url - the backend url
  * @param {boolean} [html=false] - true returns HTML, false returns JSON
  * @param {import("index.js").Options} [opts={}]
- * @returns {Promise<string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>>}
+ * @returns {Promise<string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>>}
  */
 async function requestStackBatch(sbomByPurl, url, html = false, opts = {}) {
     const finalUrl = new URL(`${url}/api/v5/batch-analysis`);
-    if (opts['TRUSTIFY_DA_RECOMMENDATIONS_ENABLED'] === 'false') {
-        finalUrl.searchParams.append('recommend', 'false');
-    }
+    appendAnalysisQueryParams(finalUrl, opts);
     const fetchOptions = addProxyAgent({
         method: 'POST',
         headers: {
             'Accept': html ? 'text/html' : 'application/json',
-            'Content-Type': 'application/json',
+            'Content-Type': CYCLONEDX_JSON_MEDIA_TYPE,
             ...getTokenHeaders(opts)
         },
         body: JSON.stringify(sbomByPurl)
@@ -175,7 +213,7 @@ async function requestStackBatch(sbomByPurl, url, html = false, opts = {}) {
  * @param {Array<string>} imageRefs
  * @param {string} url
  * @param {import("index.js").Options} [opts={}] - optional various options to pass along the application
- * @returns {Promise<string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>>}
+ * @returns {Promise<string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport>>}
  */
 async function requestImages(imageRefs, url, html = false, opts = {}) {
     const imageSboms = {};
@@ -184,18 +222,17 @@ async function requestImages(imageRefs, url, html = false, opts = {}) {
         imageSboms[parsedImageRef.getPackageURL().toString()] = generateImageSBOM(parsedImageRef, opts);
     }
     const finalUrl = new URL(`${url}/api/v5/batch-analysis`);
-    if (opts['TRUSTIFY_DA_RECOMMENDATIONS_ENABLED'] === 'false') {
-        finalUrl.searchParams.append('recommend', 'false');
-    }
-    const resp = await fetch(finalUrl, {
+    appendAnalysisQueryParams(finalUrl, opts);
+    const fetchOptions = addProxyAgent({
         method: 'POST',
         headers: {
             'Accept': html ? 'text/html' : 'application/json',
-            'Content-Type': 'application/vnd.cyclonedx+json',
+            'Content-Type': CYCLONEDX_JSON_MEDIA_TYPE,
             ...getTokenHeaders(opts)
         },
         body: JSON.stringify(imageSboms),
-    });
+    }, opts);
+    const resp = await fetch(finalUrl, fetchOptions);
     if (resp.status === 200) {
         let result;
         if (!html) {
@@ -219,6 +256,24 @@ async function requestImages(imageRefs, url, html = false, opts = {}) {
         throw new Error(`Got error response from Trustify DA backend - http return code : ${resp.status}, ex-request-id: ${resp.headers.get("ex-request-id")}  error message =>  ${await resp.text()}`);
     }
 }
+/**
+ * Append common analysis query parameters (recommend, providers, sources) to a URL.
+ * @param {URL} url - the URL object to append query parameters to
+ * @param {import("index.js").Options} [opts={}] - options containing parameter overrides
+ */
+function appendAnalysisQueryParams(url, opts = {}) {
+    if (getCustom('TRUSTIFY_DA_RECOMMEND', 'true', opts) === 'false') {
+        url.searchParams.append('recommend', 'false');
+    }
+    const providers = getCustom('TRUSTIFY_DA_PROVIDERS', null, opts);
+    if (providers) {
+        url.searchParams.append('providers', providers);
+    }
+    const sources = getCustom('TRUSTIFY_DA_SOURCES', null, opts);
+    if (sources) {
+        url.searchParams.append('sources', sources);
+    }
+}
 /**
  *
  * @param url the backend url to send the request to

package/dist/src/cli.js

@@ -1,9 +1,47 @@
 #!/usr/bin/env node
+import fs from 'node:fs';
 import * as path from "path";
 import yargs from 'yargs';
 import { hideBin } from 'yargs/helpers';
+import { resolveConfig } from './config.js';
 import { getProjectLicense, getLicenseDetails } from './license/index.js';
-import client, { selectTrustifyDABackend } from './index.js';
+import { runRemediation } from './remediate.js';
+import { generateReport } from './remediation_report.js';
+import client, { selectTrustifyDABackend, generateSbom } from './index.js';
+/**
+ * Builds a yargs middleware that loads `.trustify-da.yml` (discovered by walking
+ * up from the command's target path, or cwd when no path is available) and fills `--providers`, `--sources`, and
+ * `--group-by` with config file values when they were not supplied on the CLI or
+ * via environment variables. Precedence: CLI flag > env var > config file > default.
+ * @param {string} [pathKey] - positional argument holding the target path; defaults to the current working directory
+ * @param {{ groupBy?: boolean }} [options={}] - set `groupBy` when the command exposes `--group-by`
+ * @returns {(args: object) => object} yargs middleware
+ */
+function configMiddleware(pathKey, options = {}) {
+    return args => {
+        const startPath = pathKey === undefined ? process.cwd() : args[pathKey];
+        const envVars = options.groupBy
+            ? process.env
+            : Object.fromEntries(Object.entries(process.env).filter(([key]) => key !== 'TRUSTIFY_DA_GROUP_BY'));
+        const merged = resolveConfig(startPath, { backendUrl: args.backendUrl, providers: args.providers, sources: args.sources, groupBy: args['group-by'] }, envVars);
+        if (merged.backendUrlSource === 'file' && process.env.TRUSTIFY_DA_TOKEN) {
+            throw new Error('Refusing to send TRUSTIFY_DA_TOKEN to a backend selected by project configuration. Set --backend-url or TRUSTIFY_DA_BACKEND_URL to explicitly trust it.');
+        }
+        if (args.providers !== undefined || merged.providers.length) {
+            args.providers = merged.providers.join(',');
+        }
+        if (args.sources !== undefined || merged.sources.length) {
+            args.sources = merged.sources.join(',');
+        }
+        if (merged.backendUrl != null) {
+            args.backendUrl = merged.backendUrl;
+        }
+        if (options.groupBy) {
+            args['group-by'] = merged.groupBy;
+        }
+        return args;
+    };
+}
 // command for component analysis take manifest type and content
 const component = {
     command: 'component </path/to/manifest>',
@@ -18,11 +56,32 @@ const component = {
             desc: 'Workspace root directory (for monorepos; lock file is expected here)',
             type: 'string',
             normalize: true,
+        },
+        backendUrl: {
+            desc: 'Trustify DA backend URL (env: TRUSTIFY_DA_BACKEND_URL)',
+            type: 'string',
+        },
+        providers: {
+            desc: 'Comma-separated list of vulnerability providers (env: TRUSTIFY_DA_PROVIDERS)',
+            type: 'string',
+        },
+        sources: {
+            desc: 'Comma-separated list of vulnerability sources (env: TRUSTIFY_DA_SOURCES)',
+            type: 'string',
         }
-    }),
+    }).middleware(configMiddleware('/path/to/manifest')),
     handler: async (args) => {
         let manifestName = args['/path/to/manifest'];
         const opts = args.workspaceDir ? { TRUSTIFY_DA_WORKSPACE_DIR: args.workspaceDir } : {};
+        if (args.backendUrl !== undefined) {
+            opts.TRUSTIFY_DA_BACKEND_URL = args.backendUrl;
+        }
+        if (args.providers !== undefined) {
+            opts.TRUSTIFY_DA_PROVIDERS = args.providers;
+        }
+        if (args.sources !== undefined) {
+            opts.TRUSTIFY_DA_SOURCES = args.sources;
+        }
         let res = await client.componentAnalysis(manifestName, opts);
         console.log(JSON.stringify(res, null, 2));
     }
@@ -71,8 +130,20 @@ const image = {
             desc: 'For JSON report, get only the \'summary\'',
             type: 'boolean',
             conflicts: 'html'
+        },
+        backendUrl: {
+            desc: 'Trustify DA backend URL (env: TRUSTIFY_DA_BACKEND_URL)',
+            type: 'string',
+        },
+        providers: {
+            desc: 'Comma-separated list of vulnerability providers (env: TRUSTIFY_DA_PROVIDERS)',
+            type: 'string',
+        },
+        sources: {
+            desc: 'Comma-separated list of vulnerability sources (env: TRUSTIFY_DA_SOURCES)',
+            type: 'string',
         }
-    }),
+    }).middleware(configMiddleware()),
     handler: async (args) => {
         let imageRefs = args['image-refs'];
         if (!Array.isArray(imageRefs)) {
@@ -80,7 +151,17 @@ const image = {
         }
         let html = args['html'];
         let summary = args['summary'];
-        let res = await client.imageAnalysis(imageRefs, html);
+        const opts = {};
+        if (args.backendUrl !== undefined) {
+            opts.TRUSTIFY_DA_BACKEND_URL = args.backendUrl;
+        }
+        if (args.providers !== undefined) {
+            opts.TRUSTIFY_DA_PROVIDERS = args.providers;
+        }
+        if (args.sources !== undefined) {
+            opts.TRUSTIFY_DA_SOURCES = args.sources;
+        }
+        let res = await client.imageAnalysis(imageRefs, html, opts);
         if (summary && !html) {
             let summaries = {};
             for (let [imageRef, report] of Object.entries(res)) {
@@ -131,13 +212,34 @@ const stack = {
             desc: 'Workspace root directory (for monorepos; lock file is expected here)',
             type: 'string',
             normalize: true,
+        },
+        backendUrl: {
+            desc: 'Trustify DA backend URL (env: TRUSTIFY_DA_BACKEND_URL)',
+            type: 'string',
+        },
+        providers: {
+            desc: 'Comma-separated list of vulnerability providers (env: TRUSTIFY_DA_PROVIDERS)',
+            type: 'string',
+        },
+        sources: {
+            desc: 'Comma-separated list of vulnerability sources (env: TRUSTIFY_DA_SOURCES)',
+            type: 'string',
         }
-    }),
+    }).middleware(configMiddleware('/path/to/manifest')),
     handler: async (args) => {
         let manifest = args['/path/to/manifest'];
         let html = args['html'];
         let summary = args['summary'];
         const opts = args.workspaceDir ? { TRUSTIFY_DA_WORKSPACE_DIR: args.workspaceDir } : {};
+        if (args.backendUrl !== undefined) {
+            opts.TRUSTIFY_DA_BACKEND_URL = args.backendUrl;
+        }
+        if (args.providers !== undefined) {
+            opts.TRUSTIFY_DA_PROVIDERS = args.providers;
+        }
+        if (args.sources !== undefined) {
+            opts.TRUSTIFY_DA_SOURCES = args.sources;
+        }
         let theProvidersSummary = new Map();
         let theProvidersObject = {};
         let res = await client.stackAnalysis(manifest, html, opts);
@@ -200,13 +302,28 @@ const stackBatch = {
             desc: 'Stop on first invalid package.json or SBOM error (env: TRUSTIFY_DA_CONTINUE_ON_ERROR=false)',
             type: 'boolean',
             default: false,
+        },
+        backendUrl: {
+            desc: 'Trustify DA backend URL (env: TRUSTIFY_DA_BACKEND_URL)',
+            type: 'string',
+        },
+        providers: {
+            desc: 'Comma-separated list of vulnerability providers (env: TRUSTIFY_DA_PROVIDERS)',
+            type: 'string',
+        },
+        sources: {
+            desc: 'Comma-separated list of vulnerability sources (env: TRUSTIFY_DA_SOURCES)',
+            type: 'string',
         }
-    }),
+    }).middleware(configMiddleware('/path/to/workspace-root')),
     handler: async (args) => {
         const workspaceRoot = args['/path/to/workspace-root'];
         const html = args['html'];
         const summary = args['summary'];
         const opts = {};
+        if (args.backendUrl !== undefined) {
+            opts.TRUSTIFY_DA_BACKEND_URL = args.backendUrl;
+        }
         if (args.concurrency != null) {
             opts.batchConcurrency = args.concurrency;
         }
@@ -220,6 +337,12 @@ const stackBatch = {
         if (args.failFast) {
             opts.continueOnError = false;
         }
+        if (args.providers !== undefined) {
+            opts.TRUSTIFY_DA_PROVIDERS = args.providers;
+        }
+        if (args.sources !== undefined) {
+            opts.TRUSTIFY_DA_SOURCES = args.sources;
+        }
         let res = await client.stackAnalysisBatch(workspaceRoot, html, opts);
         const batchAnalysis = res && typeof res === 'object' && res != null && 'analysis' in res ? res.analysis : res;
         if (summary && !html && typeof batchAnalysis === 'object') {
@@ -325,15 +448,123 @@ const license = {
         console.log(JSON.stringify(output, null, 2));
     }
 };
+const sbom = {
+    command: 'sbom </path/to/manifest> [--output]',
+    desc: 'generate a CycloneDX SBOM from a manifest file',
+    builder: yargs => yargs.positional('/path/to/manifest', {
+        desc: 'manifest path for SBOM generation',
+        type: 'string',
+        normalize: true,
+    }).options({
+        output: {
+            alias: 'o',
+            desc: 'Write SBOM JSON to a file instead of stdout',
+            type: 'string',
+            normalize: true,
+        },
+        workspaceDir: {
+            alias: 'w',
+            desc: 'Workspace root directory (for monorepos; lock file is expected here)',
+            type: 'string',
+            normalize: true,
+        }
+    }),
+    handler: async (args) => {
+        let manifest = args['/path/to/manifest'];
+        const opts = args.workspaceDir ? { TRUSTIFY_DA_WORKSPACE_DIR: args.workspaceDir } : {};
+        let result;
+        try {
+            result = await generateSbom(manifest, opts);
+        }
+        catch (err) {
+            console.error(JSON.stringify({ error: `Failed to generate SBOM: ${err.message}` }, null, 2));
+            process.exit(1);
+        }
+        const json = JSON.stringify(result, null, 2);
+        if (args.output) {
+            try {
+                fs.writeFileSync(args.output, json);
+            }
+            catch (err) {
+                console.error(JSON.stringify({ error: `Failed to write output file: ${err.message}` }, null, 2));
+                process.exit(1);
+            }
+        }
+        else {
+            console.log(json);
+        }
+    }
+};
+const remediate = {
+    command: 'remediate <path>',
+    desc: 'Scan and apply vulnerability remediations to manifest files',
+    builder: yargs => yargs.positional('path', {
+        desc: 'Path to manifest file or directory',
+        type: 'string',
+        normalize: true,
+    }).options({
+        'dry-run': {
+            alias: 'd',
+            type: 'boolean',
+            desc: 'Preview changes without modifying files',
+        },
+        providers: {
+            desc: 'Comma-separated list of vulnerability providers (env: TRUSTIFY_DA_PROVIDERS)',
+            type: 'string',
+        },
+        sources: {
+            desc: 'Comma-separated list of vulnerability sources (env: TRUSTIFY_DA_SOURCES)',
+            type: 'string',
+        },
+        'group-by': {
+            type: 'string',
+            choices: ['dependency', 'bundle'],
+            desc: 'Report grouping strategy (default: dependency)',
+        },
+        backendUrl: {
+            desc: 'Trustify DA backend URL (env: TRUSTIFY_DA_BACKEND_URL)',
+            type: 'string',
+        },
+    }).middleware(configMiddleware('path', { groupBy: true })),
+    handler: async (args) => {
+        try {
+            const result = await runRemediation(args.path, {
+                dryRun: args['dry-run'],
+                providers: args.providers,
+                sources: args.sources,
+                backendUrl: args.backendUrl,
+            });
+            if (result.remediations.length === 0 && result.manifests.length === 0) {
+                console.log('No supported manifest files found.');
+                process.exit(result.exitCode);
+            }
+            if (!args['dry-run'] && result.appliedFiles.length > 0) {
+                console.log(`Updated ${result.appliedFiles.length} file(s):`);
+                for (const file of result.appliedFiles) {
+                    console.log(`  ${file}`);
+                }
+                console.log('');
+            }
+            console.log(generateReport(result.remediations, { groupBy: args['group-by'], dryRun: args['dry-run'] }));
+            process.exit(result.exitCode);
+        }
+        catch (err) {
+            console.error(err.message);
+            process.exit(1);
+        }
+    }
+};
 // parse and invoke the command
 yargs(hideBin(process.argv))
-    .usage(`Usage: ${process.argv[0].includes("node") ? path.parse(process.argv[1]).base : path.parse(process.argv[0]).base} {component|stack|stack-batch|image|validate-token|license}`)
+    .usage(`Usage: ${process.argv[0].includes("node") ? path.parse(process.argv[1]).base : path.parse(process.argv[0]).base} {component|stack|stack-batch|image|validate-token|license|sbom|remediate}`)
     .command(stack)
     .command(stackBatch)
     .command(component)
     .command(image)
     .command(validateToken)
     .command(license)
+    .command(sbom)
+    .command(remediate)
     .scriptName('')
     .version(false)
     .demandCommand(1)