@trustify-da/trustify-da-javascript-client 0.3.0-ea.608d6fa → 0.3.0-ea.62b88e5

package/dist/src/cli.js

@@ -1,9 +1,47 @@
 #!/usr/bin/env node
+import fs from 'node:fs';
 import * as path from "path";
 import yargs from 'yargs';
 import { hideBin } from 'yargs/helpers';
+import { resolveConfig } from './config.js';
 import { getProjectLicense, getLicenseDetails } from './license/index.js';
-import client, { selectTrustifyDABackend } from './index.js';
+import { runRemediation } from './remediate.js';
+import { generateReport } from './remediation_report.js';
+import client, { selectTrustifyDABackend, generateSbom } from './index.js';
+/**
+ * Builds a yargs middleware that loads `.trustify-da.yml` (discovered by walking
+ * up from the command's target path, or cwd when no path is available) and fills `--providers`, `--sources`, and
+ * `--group-by` with config file values when they were not supplied on the CLI or
+ * via environment variables. Precedence: CLI flag > env var > config file > default.
+ * @param {string} [pathKey] - positional argument holding the target path; defaults to the current working directory
+ * @param {{ groupBy?: boolean }} [options={}] - set `groupBy` when the command exposes `--group-by`
+ * @returns {(args: object) => object} yargs middleware
+ */
+function configMiddleware(pathKey, options = {}) {
+    return args => {
+        const startPath = pathKey === undefined ? process.cwd() : args[pathKey];
+        const envVars = options.groupBy
+            ? process.env
+            : Object.fromEntries(Object.entries(process.env).filter(([key]) => key !== 'TRUSTIFY_DA_GROUP_BY'));
+        const merged = resolveConfig(startPath, { backendUrl: args.backendUrl, providers: args.providers, sources: args.sources, groupBy: args['group-by'] }, envVars);
+        if (merged.backendUrlSource === 'file' && process.env.TRUSTIFY_DA_TOKEN) {
+            throw new Error('Refusing to send TRUSTIFY_DA_TOKEN to a backend selected by project configuration. Set --backend-url or TRUSTIFY_DA_BACKEND_URL to explicitly trust it.');
+        }
+        if (args.providers !== undefined || merged.providers.length) {
+            args.providers = merged.providers.join(',');
+        }
+        if (args.sources !== undefined || merged.sources.length) {
+            args.sources = merged.sources.join(',');
+        }
+        if (merged.backendUrl != null) {
+            args.backendUrl = merged.backendUrl;
+        }
+        if (options.groupBy) {
+            args['group-by'] = merged.groupBy;
+        }
+        return args;
+    };
+}
 // command for component analysis take manifest type and content
 const component = {
     command: 'component </path/to/manifest>',
@@ -12,10 +50,39 @@ const component = {
         desc: 'manifest path for analyzing',
         type: 'string',
         normalize: true,
-    }),
+    }).options({
+        workspaceDir: {
+            alias: 'w',
+            desc: 'Workspace root directory (for monorepos; lock file is expected here)',
+            type: 'string',
+            normalize: true,
+        },
+        backendUrl: {
+            desc: 'Trustify DA backend URL (env: TRUSTIFY_DA_BACKEND_URL)',
+            type: 'string',
+        },
+        providers: {
+            desc: 'Comma-separated list of vulnerability providers (env: TRUSTIFY_DA_PROVIDERS)',
+            type: 'string',
+        },
+        sources: {
+            desc: 'Comma-separated list of vulnerability sources (env: TRUSTIFY_DA_SOURCES)',
+            type: 'string',
+        }
+    }).middleware(configMiddleware('/path/to/manifest')),
     handler: async (args) => {
         let manifestName = args['/path/to/manifest'];
-        let res = await client.componentAnalysis(manifestName);
+        const opts = args.workspaceDir ? { TRUSTIFY_DA_WORKSPACE_DIR: args.workspaceDir } : {};
+        if (args.backendUrl !== undefined) {
+            opts.TRUSTIFY_DA_BACKEND_URL = args.backendUrl;
+        }
+        if (args.providers !== undefined) {
+            opts.TRUSTIFY_DA_PROVIDERS = args.providers;
+        }
+        if (args.sources !== undefined) {
+            opts.TRUSTIFY_DA_SOURCES = args.sources;
+        }
+        let res = await client.componentAnalysis(manifestName, opts);
         console.log(JSON.stringify(res, null, 2));
     }
 };
@@ -63,8 +130,20 @@ const image = {
             desc: 'For JSON report, get only the \'summary\'',
             type: 'boolean',
             conflicts: 'html'
+        },
+        backendUrl: {
+            desc: 'Trustify DA backend URL (env: TRUSTIFY_DA_BACKEND_URL)',
+            type: 'string',
+        },
+        providers: {
+            desc: 'Comma-separated list of vulnerability providers (env: TRUSTIFY_DA_PROVIDERS)',
+            type: 'string',
+        },
+        sources: {
+            desc: 'Comma-separated list of vulnerability sources (env: TRUSTIFY_DA_SOURCES)',
+            type: 'string',
         }
-    }),
+    }).middleware(configMiddleware()),
     handler: async (args) => {
         let imageRefs = args['image-refs'];
         if (!Array.isArray(imageRefs)) {
@@ -72,7 +151,17 @@ const image = {
         }
         let html = args['html'];
         let summary = args['summary'];
-        let res = await client.imageAnalysis(imageRefs, html);
+        const opts = {};
+        if (args.backendUrl !== undefined) {
+            opts.TRUSTIFY_DA_BACKEND_URL = args.backendUrl;
+        }
+        if (args.providers !== undefined) {
+            opts.TRUSTIFY_DA_PROVIDERS = args.providers;
+        }
+        if (args.sources !== undefined) {
+            opts.TRUSTIFY_DA_SOURCES = args.sources;
+        }
+        let res = await client.imageAnalysis(imageRefs, html, opts);
         if (summary && !html) {
             let summaries = {};
             for (let [imageRef, report] of Object.entries(res)) {
@@ -117,15 +206,43 @@ const stack = {
             desc: 'For JSON report, get only the \'summary\'',
             type: 'boolean',
             conflicts: 'html'
+        },
+        workspaceDir: {
+            alias: 'w',
+            desc: 'Workspace root directory (for monorepos; lock file is expected here)',
+            type: 'string',
+            normalize: true,
+        },
+        backendUrl: {
+            desc: 'Trustify DA backend URL (env: TRUSTIFY_DA_BACKEND_URL)',
+            type: 'string',
+        },
+        providers: {
+            desc: 'Comma-separated list of vulnerability providers (env: TRUSTIFY_DA_PROVIDERS)',
+            type: 'string',
+        },
+        sources: {
+            desc: 'Comma-separated list of vulnerability sources (env: TRUSTIFY_DA_SOURCES)',
+            type: 'string',
         }
-    }),
+    }).middleware(configMiddleware('/path/to/manifest')),
     handler: async (args) => {
         let manifest = args['/path/to/manifest'];
         let html = args['html'];
         let summary = args['summary'];
+        const opts = args.workspaceDir ? { TRUSTIFY_DA_WORKSPACE_DIR: args.workspaceDir } : {};
+        if (args.backendUrl !== undefined) {
+            opts.TRUSTIFY_DA_BACKEND_URL = args.backendUrl;
+        }
+        if (args.providers !== undefined) {
+            opts.TRUSTIFY_DA_PROVIDERS = args.providers;
+        }
+        if (args.sources !== undefined) {
+            opts.TRUSTIFY_DA_SOURCES = args.sources;
+        }
         let theProvidersSummary = new Map();
         let theProvidersObject = {};
-        let res = await client.stackAnalysis(manifest, html);
+        let res = await client.stackAnalysis(manifest, html, opts);
         if (summary) {
             for (let provider in res.providers) {
                 if (res.providers[provider].sources !== undefined) {
@@ -143,6 +260,129 @@ const stack = {
         console.log(html ? res : JSON.stringify(!html && summary ? theProvidersObject : res, null, 2));
     }
 };
+// command for batch stack analysis (workspace)
+const stackBatch = {
+    command: 'stack-batch </path/to/workspace-root> [--html|--summary] [--concurrency <n>] [--ignore <pattern>...] [--metadata] [--fail-fast]',
+    desc: 'produce stack report for all packages/crates in a workspace (Cargo or JS/TS)',
+    builder: yargs => yargs.positional('/path/to/workspace-root', {
+        desc: 'workspace root directory (containing Cargo.toml+Cargo.lock or package.json+lock file)',
+        type: 'string',
+        normalize: true,
+    }).options({
+        html: {
+            alias: 'r',
+            desc: 'Get the report as HTML instead of JSON',
+            type: 'boolean',
+            conflicts: 'summary'
+        },
+        summary: {
+            alias: 's',
+            desc: 'For JSON report, get only the \'summary\' per package',
+            type: 'boolean',
+            conflicts: 'html'
+        },
+        concurrency: {
+            alias: 'c',
+            desc: 'Max parallel SBOM generations (default: 10, env: TRUSTIFY_DA_BATCH_CONCURRENCY)',
+            type: 'number',
+        },
+        ignore: {
+            alias: 'i',
+            desc: 'Extra glob patterns excluded from workspace discovery (merged with defaults). Repeat flag per pattern. Env: TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE (comma-separated)',
+            type: 'string',
+            array: true,
+        },
+        metadata: {
+            alias: 'm',
+            desc: 'Return { analysis, metadata } with per-manifest errors (env: TRUSTIFY_DA_BATCH_METADATA=true)',
+            type: 'boolean',
+            default: false,
+        },
+        failFast: {
+            desc: 'Stop on first invalid package.json or SBOM error (env: TRUSTIFY_DA_CONTINUE_ON_ERROR=false)',
+            type: 'boolean',
+            default: false,
+        },
+        backendUrl: {
+            desc: 'Trustify DA backend URL (env: TRUSTIFY_DA_BACKEND_URL)',
+            type: 'string',
+        },
+        providers: {
+            desc: 'Comma-separated list of vulnerability providers (env: TRUSTIFY_DA_PROVIDERS)',
+            type: 'string',
+        },
+        sources: {
+            desc: 'Comma-separated list of vulnerability sources (env: TRUSTIFY_DA_SOURCES)',
+            type: 'string',
+        }
+    }).middleware(configMiddleware('/path/to/workspace-root')),
+    handler: async (args) => {
+        const workspaceRoot = args['/path/to/workspace-root'];
+        const html = args['html'];
+        const summary = args['summary'];
+        const opts = {};
+        if (args.backendUrl !== undefined) {
+            opts.TRUSTIFY_DA_BACKEND_URL = args.backendUrl;
+        }
+        if (args.concurrency != null) {
+            opts.batchConcurrency = args.concurrency;
+        }
+        const extraIgnores = Array.isArray(args.ignore) ? args.ignore.filter(p => p != null && String(p).trim()) : [];
+        if (extraIgnores.length > 0) {
+            opts.workspaceDiscoveryIgnore = extraIgnores;
+        }
+        if (args.metadata) {
+            opts.batchMetadata = true;
+        }
+        if (args.failFast) {
+            opts.continueOnError = false;
+        }
+        if (args.providers !== undefined) {
+            opts.TRUSTIFY_DA_PROVIDERS = args.providers;
+        }
+        if (args.sources !== undefined) {
+            opts.TRUSTIFY_DA_SOURCES = args.sources;
+        }
+        let res = await client.stackAnalysisBatch(workspaceRoot, html, opts);
+        const batchAnalysis = res && typeof res === 'object' && res != null && 'analysis' in res ? res.analysis : res;
+        if (summary && !html && typeof batchAnalysis === 'object') {
+            const summaries = {};
+            for (const [purl, report] of Object.entries(batchAnalysis)) {
+                if (report?.providers) {
+                    for (const provider of Object.keys(report.providers)) {
+                        const sources = report.providers[provider]?.sources;
+                        if (sources) {
+                            for (const [source, data] of Object.entries(sources)) {
+                                if (data?.summary) {
+                                    if (!summaries[purl]) {
+                                        summaries[purl] = {};
+                                    }
+                                    if (!summaries[purl][provider]) {
+                                        summaries[purl][provider] = {};
+                                    }
+                                    summaries[purl][provider][source] = data.summary;
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            if (res && typeof res === 'object' && res != null && 'metadata' in res) {
+                res = { analysis: summaries, metadata: res.metadata };
+            }
+            else {
+                res = summaries;
+            }
+        }
+        if (html) {
+            const htmlContent = res && typeof res === 'object' && 'analysis' in res ? res.analysis : res;
+            console.log(htmlContent);
+        }
+        else {
+            console.log(JSON.stringify(res, null, 2));
+        }
+    }
+};
 // command for license checking
 const license = {
     command: 'license </path/to/manifest>',
@@ -208,14 +448,123 @@ const license = {
         console.log(JSON.stringify(output, null, 2));
     }
 };
+const sbom = {
+    command: 'sbom </path/to/manifest> [--output]',
+    desc: 'generate a CycloneDX SBOM from a manifest file',
+    builder: yargs => yargs.positional('/path/to/manifest', {
+        desc: 'manifest path for SBOM generation',
+        type: 'string',
+        normalize: true,
+    }).options({
+        output: {
+            alias: 'o',
+            desc: 'Write SBOM JSON to a file instead of stdout',
+            type: 'string',
+            normalize: true,
+        },
+        workspaceDir: {
+            alias: 'w',
+            desc: 'Workspace root directory (for monorepos; lock file is expected here)',
+            type: 'string',
+            normalize: true,
+        }
+    }),
+    handler: async (args) => {
+        let manifest = args['/path/to/manifest'];
+        const opts = args.workspaceDir ? { TRUSTIFY_DA_WORKSPACE_DIR: args.workspaceDir } : {};
+        let result;
+        try {
+            result = await generateSbom(manifest, opts);
+        }
+        catch (err) {
+            console.error(JSON.stringify({ error: `Failed to generate SBOM: ${err.message}` }, null, 2));
+            process.exit(1);
+        }
+        const json = JSON.stringify(result, null, 2);
+        if (args.output) {
+            try {
+                fs.writeFileSync(args.output, json);
+            }
+            catch (err) {
+                console.error(JSON.stringify({ error: `Failed to write output file: ${err.message}` }, null, 2));
+                process.exit(1);
+            }
+        }
+        else {
+            console.log(json);
+        }
+    }
+};
+const remediate = {
+    command: 'remediate <path>',
+    desc: 'Scan and apply vulnerability remediations to manifest files',
+    builder: yargs => yargs.positional('path', {
+        desc: 'Path to manifest file or directory',
+        type: 'string',
+        normalize: true,
+    }).options({
+        'dry-run': {
+            alias: 'd',
+            type: 'boolean',
+            desc: 'Preview changes without modifying files',
+        },
+        providers: {
+            desc: 'Comma-separated list of vulnerability providers (env: TRUSTIFY_DA_PROVIDERS)',
+            type: 'string',
+        },
+        sources: {
+            desc: 'Comma-separated list of vulnerability sources (env: TRUSTIFY_DA_SOURCES)',
+            type: 'string',
+        },
+        'group-by': {
+            type: 'string',
+            choices: ['dependency', 'bundle'],
+            desc: 'Report grouping strategy (default: dependency)',
+        },
+        backendUrl: {
+            desc: 'Trustify DA backend URL (env: TRUSTIFY_DA_BACKEND_URL)',
+            type: 'string',
+        },
+    }).middleware(configMiddleware('path', { groupBy: true })),
+    handler: async (args) => {
+        try {
+            const result = await runRemediation(args.path, {
+                dryRun: args['dry-run'],
+                providers: args.providers,
+                sources: args.sources,
+                backendUrl: args.backendUrl,
+            });
+            if (result.remediations.length === 0 && result.manifests.length === 0) {
+                console.log('No supported manifest files found.');
+                process.exit(result.exitCode);
+            }
+            if (!args['dry-run'] && result.appliedFiles.length > 0) {
+                console.log(`Updated ${result.appliedFiles.length} file(s):`);
+                for (const file of result.appliedFiles) {
+                    console.log(`  ${file}`);
+                }
+                console.log('');
+            }
+            console.log(generateReport(result.remediations, { groupBy: args['group-by'], dryRun: args['dry-run'] }));
+            process.exit(result.exitCode);
+        }
+        catch (err) {
+            console.error(err.message);
+            process.exit(1);
+        }
+    }
+};
 // parse and invoke the command
 yargs(hideBin(process.argv))
-    .usage(`Usage: ${process.argv[0].includes("node") ? path.parse(process.argv[1]).base : path.parse(process.argv[0]).base} {component|stack|image|validate-token|license}`)
+    .usage(`Usage: ${process.argv[0].includes("node") ? path.parse(process.argv[1]).base : path.parse(process.argv[0]).base} {component|stack|stack-batch|image|validate-token|license|sbom|remediate}`)
     .command(stack)
+    .command(stackBatch)
     .command(component)
     .command(image)
     .command(validateToken)
     .command(license)
+    .command(sbom)
+    .command(remediate)
     .scriptName('')
     .version(false)
     .demandCommand(1)

package/dist/src/config.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Discovers and parses `.trustify-da.yml` by walking up from `startPath`.
+ * A missing config file is not an error — an empty object is returned so callers
+ * can fall back to defaults.
+ * @param {string} [startPath] - manifest file or directory to start the search from
+ * @returns {FileConfig} the parsed config object, or `{}` when no file is found
+ * @throws {Error} when the config file exists but contains malformed YAML
+ */
+export function loadConfig(startPath?: string): FileConfig;
+/**
+ * Merges config sources with precedence: CLI flag > environment variable
+ * (`TRUSTIFY_DA_*`) > config file > hardcoded default. Providers and sources are
+ * normalized to arrays regardless of whether the source used a YAML array or a
+ * comma-separated string.
+ * @param {FileConfig} [fileConfig={}] - values parsed from `.trustify-da.yml`
+ * @param {{ providers?: string, sources?: string, groupBy?: string, backendUrl?: string }} [cliFlags={}]
+ * @param {{ [key: string]: string | undefined }} [envVars={}] - typically `process.env`
+ * @returns {ResolvedConfig} the resolved, typed config object
+ */
+export function mergeConfig(fileConfig?: FileConfig, cliFlags?: {
+    providers?: string;
+    sources?: string;
+    groupBy?: string;
+    backendUrl?: string;
+}, envVars?: {
+    [key: string]: string | undefined;
+}): ResolvedConfig;
+/**
+ * Loads and merges the project configuration for a target path.
+ * @param {string} [startPath] - manifest file or directory to start discovery from
+ * @param {{ providers?: string, sources?: string, groupBy?: string, backendUrl?: string }} [cliFlags={}] - explicit options
+ * @param {{ [key: string]: string | undefined }} [envVars={}] - typically `process.env`
+ * @returns {ResolvedConfig} the resolved, typed config object
+ */
+export function resolveConfig(startPath?: string, cliFlags?: {
+    providers?: string;
+    sources?: string;
+    groupBy?: string;
+    backendUrl?: string;
+}, envVars?: {
+    [key: string]: string | undefined;
+}): ResolvedConfig;
+/**
+ * @typedef {{
+ *   'group-by'?: 'dependency' | 'bundle',
+ *   exclude?: string[],
+ *   labels?: string[],
+ *   'branch-prefix'?: string,
+ *   [key: string]: unknown
+ * }} RemediationConfig
+ */
+/** @typedef {{ critical?: number, high?: number, 'license-conflicts'?: number, [key: string]: unknown }} FailOnConfig */
+/** @typedef {{ 'fail-on'?: FailOnConfig, [key: string]: unknown }} CheckConfig */
+/** @typedef {{ format?: string, targets?: string[], [key: string]: unknown }} SbomConfig */
+/**
+ * @typedef {{
+ *   'backend-url'?: string,
+ *   providers?: string[] | string,
+ *   sources?: string[] | string,
+ *   remediation?: RemediationConfig,
+ *   check?: CheckConfig,
+ *   sbom?: SbomConfig,
+ *   [key: string]: unknown
+ * }} FileConfig
+ */
+/**
+ * @typedef {{
+ *   backendUrl: string | null,
+ *   backendUrlSource: 'cli' | 'environment' | 'file' | 'default',
+ *   providers: string[],
+ *   sources: string[],
+ *   groupBy: string,
+ *   remediation: object,
+ *   check: object,
+ *   sbom: object
+ * }} ResolvedConfig
+ */
+/** Config file names discovered by walking up the directory tree, in precedence order. */
+export const CONFIG_FILENAMES: string[];
+export type RemediationConfig = {
+    "group-by"?: "dependency" | "bundle";
+    exclude?: string[];
+    labels?: string[];
+    "branch-prefix"?: string;
+    [key: string]: unknown;
+};
+export type FailOnConfig = {
+    critical?: number;
+    high?: number;
+    "license-conflicts"?: number;
+    [key: string]: unknown;
+};
+export type CheckConfig = {
+    "fail-on"?: FailOnConfig;
+    [key: string]: unknown;
+};
+export type SbomConfig = {
+    format?: string;
+    targets?: string[];
+    [key: string]: unknown;
+};
+export type FileConfig = {
+    "backend-url"?: string;
+    providers?: string[] | string;
+    sources?: string[] | string;
+    remediation?: RemediationConfig;
+    check?: CheckConfig;
+    sbom?: SbomConfig;
+    [key: string]: unknown;
+};
+export type ResolvedConfig = {
+    backendUrl: string | null;
+    backendUrlSource: "cli" | "environment" | "file" | "default";
+    providers: string[];
+    sources: string[];
+    groupBy: string;
+    remediation: object;
+    check: object;
+    sbom: object;
+};