@trustify-da/trustify-da-javascript-client 0.3.0-ea.6549d2a → 0.3.0-ea.7144952

package/dist/src/license/project_license.d.ts

@@ -10,12 +10,6 @@ export function getProjectLicense(manifestPath: string): {
     fromFile: string | null;
     mismatch: boolean;
 };
-/**
- * Find LICENSE file path in the same directory as the manifest.
- * @param {string} manifestPath
- * @returns {string|null} - path to LICENSE file or null if not found
- */
-export function findLicenseFilePath(manifestPath: string): string | null;
 /**
  * Call backend /licenses/identify endpoint to identify license from file.
  * @param {string} licenseFilePath - path to LICENSE file
@@ -23,3 +17,4 @@ export function findLicenseFilePath(manifestPath: string): string | null;
  * @returns {Promise<string|null>} - SPDX identifier or null
  */
 export function identifyLicense(licenseFilePath: string, opts?: {}): Promise<string | null>;
+export { findLicenseFilePath, readLicenseFile } from "./license_utils.js";

package/dist/src/license/project_license.js

@@ -7,7 +7,7 @@ import path from 'node:path';
 import { selectTrustifyDABackend } from '../index.js';
 import { matchForLicense, availableProviders } from '../provider.js';
 import { addProxyAgent, getTokenHeaders } from '../tools.js';
-const LICENSE_FILES = ['LICENSE', 'LICENSE.md', 'LICENSE.txt'];
+import { normalizeSpdx, readLicenseFile } from './license_utils.js';
 /**
  * Resolve project license from manifest and from LICENSE / LICENSE.md in manifest dir or git root.
  * Uses local pattern matching for LICENSE file identification (synchronous).
@@ -19,7 +19,7 @@ export function getProjectLicense(manifestPath) {
     const resolved = path.resolve(manifestPath);
     const provider = matchForLicense(resolved, availableProviders);
     const fromManifest = provider.readLicenseFromManifest(resolved);
-    const fromFile = readLicenseFromFile(resolved);
+    const fromFile = readLicenseFile(resolved);
     const mismatch = Boolean(fromManifest && fromFile && normalizeSpdx(fromManifest) !== normalizeSpdx(fromFile));
     return {
         fromManifest: fromManifest || null,
@@ -27,26 +27,7 @@ export function getProjectLicense(manifestPath) {
         mismatch
     };
 }
-/**
- * Find LICENSE file path in the same directory as the manifest.
- * @param {string} manifestPath
- * @returns {string|null} - path to LICENSE file or null if not found
- */
-export function findLicenseFilePath(manifestPath) {
-    const manifestDir = path.dirname(path.resolve(manifestPath));
-    for (const name of LICENSE_FILES) {
-        const filePath = path.join(manifestDir, name);
-        try {
-            if (fs.statSync(filePath).isFile()) {
-                return filePath;
-            }
-        }
-        catch {
-            // skip
-        }
-    }
-    return null;
-}
+export { findLicenseFilePath, readLicenseFile } from './license_utils.js';
 /**
  * Call backend /licenses/identify endpoint to identify license from file.
  * @param {string} licenseFilePath - path to LICENSE file
@@ -57,7 +38,7 @@ export async function identifyLicense(licenseFilePath, opts = {}) {
     try {
         const fileContent = fs.readFileSync(licenseFilePath);
         const backendUrl = selectTrustifyDABackend(opts);
-        const url = new URL(`${backendUrl}/licenses/identify`);
+        const url = new URL(`${backendUrl}/api/v5/licenses/identify`);
         const tokenHeaders = getTokenHeaders(opts);
         const fetchOptions = addProxyAgent({
             method: 'POST',
@@ -79,61 +60,3 @@ export async function identifyLicense(licenseFilePath, opts = {}) {
         return null; // Fallback to local detection on error
     }
 }
-/**
- * Find and read LICENSE or LICENSE.md; use local pattern matching for identification.
- * @param {string} manifestPath
- * @returns {string|null}
- */
-function readLicenseFromFile(manifestPath) {
-    const licenseFilePath = findLicenseFilePath(manifestPath);
-    if (!licenseFilePath) {
-        return null;
-    }
-    try {
-        const content = fs.readFileSync(licenseFilePath, 'utf-8');
-        return detectSpdxFromText(content) || content.split('\n')[0]?.trim() || null;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Very simple SPDX detection from common license text (first ~500 chars).
- * @param {string} text
- * @returns {string|null}
- */
-function detectSpdxFromText(text) {
-    const head = text.slice(0, 500);
-    if (/Apache License,?\s*Version 2\.0/i.test(head)) {
-        return 'Apache-2.0';
-    }
-    if (/MIT License/i.test(head) && /Permission is hereby granted/i.test(head)) {
-        return 'MIT';
-    }
-    if (/GNU GENERAL PUBLIC LICENSE\s+Version 2/i.test(head)) {
-        return 'GPL-2.0-only';
-    }
-    if (/GNU GENERAL PUBLIC LICENSE\s+Version 3/i.test(head)) {
-        return 'GPL-3.0-only';
-    }
-    if (/BSD 2-Clause/i.test(head)) {
-        return 'BSD-2-Clause';
-    }
-    if (/BSD 3-Clause/i.test(head)) {
-        return 'BSD-3-Clause';
-    }
-    return null;
-}
-/**
- * Normalize for comparison (lowercase, strip common suffixes).
- * @param {string} spdxOrName
- * @returns {string}
- */
-function normalizeSpdx(spdxOrName) {
-    const s = String(spdxOrName).trim().toLowerCase();
-    // e.g. "MIT" vs "MIT License"
-    if (s.endsWith(' license')) {
-        return s.slice(0, -8);
-    }
-    return s;
-}

package/dist/src/provider.d.ts

@@ -13,12 +13,15 @@ export function matchForLicense(manifestPath: string, providers: [Provider]): Pr
  * Each provider MUST export 'provideStack' taking manifest path returning a {@link Provided}.
  * @param {string} manifest - the name-type or path of the manifest
  * @param {[Provider]} providers - list of providers to iterate over
+ * @param {{TRUSTIFY_DA_WORKSPACE_DIR?: string}} [opts={}] - optional; TRUSTIFY_DA_WORKSPACE_DIR overrides lock file location for workspaces
  * @returns {Provider}
  * @throws {Error} when the manifest is not supported and no provider was matched
  */
-export function match(manifest: string, providers: [Provider]): Provider;
+export function match(manifest: string, providers: [Provider], opts?: {
+    TRUSTIFY_DA_WORKSPACE_DIR?: string;
+}): Provider;
 /** @typedef {{ecosystem: string, contentType: string, content: string}} Provided */
-/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string): string | null}} Provider */
+/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string, Object): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string): string | null}} Provider */
 /**
  * MUST include all providers here.
  * @type {[Provider]}
@@ -31,7 +34,7 @@ export type Provided = {
 };
 export type Provider = {
     isSupported: (arg0: string) => boolean;
-    validateLockFile: (arg0: string) => void;
+    validateLockFile: (arg0: string, arg1: any) => void;
     provideComponent: (arg0: string, arg1: {}) => Provided | Promise<Provided>;
     provideStack: (arg0: string, arg1: {}) => Provided | Promise<Provided>;
     readLicenseFromManifest: (arg0: string) => string | null;

package/dist/src/provider.js

@@ -7,8 +7,9 @@ import Javascript_npm from './providers/javascript_npm.js';
 import Javascript_pnpm from './providers/javascript_pnpm.js';
 import Javascript_yarn from './providers/javascript_yarn.js';
 import pythonPipProvider from './providers/python_pip.js';
+import rustCargoProvider from './providers/rust_cargo.js';
 /** @typedef {{ecosystem: string, contentType: string, content: string}} Provided */
-/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string): string | null}} Provider */
+/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string, Object): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string): string | null}} Provider */
 /**
  * MUST include all providers here.
  * @type {[Provider]}
@@ -17,11 +18,12 @@ export const availableProviders = [
     new Java_maven(),
     new Java_gradle_groovy(),
     new Java_gradle_kotlin(),
-    new Javascript_npm(),
     new Javascript_pnpm(),
     new Javascript_yarn(),
+    new Javascript_npm(),
     golangGomodulesProvider,
-    pythonPipProvider
+    pythonPipProvider,
+    rustCargoProvider
 ];
 /**
  * Match a provider by manifest type only (no lock file check). Used for license reading.
@@ -45,16 +47,17 @@ export function matchForLicense(manifestPath, providers) {
  * Each provider MUST export 'provideStack' taking manifest path returning a {@link Provided}.
  * @param {string} manifest - the name-type or path of the manifest
  * @param {[Provider]} providers - list of providers to iterate over
+ * @param {{TRUSTIFY_DA_WORKSPACE_DIR?: string}} [opts={}] - optional; TRUSTIFY_DA_WORKSPACE_DIR overrides lock file location for workspaces
  * @returns {Provider}
  * @throws {Error} when the manifest is not supported and no provider was matched
  */
-export function match(manifest, providers) {
+export function match(manifest, providers, opts = {}) {
     const manifestPath = path.parse(manifest);
     const supported = providers.filter(prov => prov.isSupported(manifestPath.base));
     if (supported.length === 0) {
         throw new Error(`${manifestPath.base} is not supported`);
     }
-    const provider = supported.find(prov => prov.validateLockFile(manifestPath.dir));
+    const provider = supported.find(prov => prov.validateLockFile(manifestPath.dir, opts));
     if (!provider) {
         throw new Error(`${manifestPath.base} requires a lock file. Use your preferred package manager to generate the lock file.`);
     }

package/dist/src/providers/base_javascript.d.ts

@@ -67,11 +67,16 @@ export default class Base_javascript {
    */
     isSupported(manifestName: string): boolean;
     /**
-   * Checks if a required lock file exists in the same path as the manifest
+   * Checks if a required lock file exists in the manifest directory or at the workspace root.
+   * When TRUSTIFY_DA_WORKSPACE_DIR is provided (via env var or opts),
+   * checks only that directory for the lock file.
    * @param {string} manifestDir - The base directory where the manifest is located
+   * @param {{TRUSTIFY_DA_WORKSPACE_DIR?: string}} [opts={}] - optional workspace root
    * @returns {boolean} True if the lock file exists
    */
-    validateLockFile(manifestDir: string): boolean;
+    validateLockFile(manifestDir: string, opts?: {
+        TRUSTIFY_DA_WORKSPACE_DIR?: string;
+    }): boolean;
     /**
    * Provides content and content type for stack analysis
    * @param {string} manifestPath - The manifest path or name
@@ -95,10 +100,11 @@ export default class Base_javascript {
     /**
    * Builds the dependency tree for the project
    * @param {boolean} includeTransitive - Whether to include transitive dependencies
+   * @param {Object} [opts={}] - Configuration options; when `TRUSTIFY_DA_WORKSPACE_DIR` is set, commands run from workspace root
    * @returns {Object} The dependency tree
    * @protected
    */
-    protected _buildDependencyTree(includeTransitive: boolean): any;
+    protected _buildDependencyTree(includeTransitive: boolean, opts?: any): any;
     /**
    * Recursively builds the Sbom from the JSON that npm listing returns
    * @param {Sbom} sbom - The SBOM object to add dependencies to

package/dist/src/providers/base_javascript.js

@@ -1,8 +1,9 @@
 import fs from 'node:fs';
 import os from "node:os";
 import path from 'node:path';
+import { getLicense } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
-import { getCustom, getCustomPath, invokeCommand, toPurl, toPurlFromString } from "../tools.js";
+import { getCustom, getCustomPath, invokeCommand, toPurl, toPurlFromString } from '../tools.js';
 import Manifest from './manifest.js';
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
@@ -96,12 +97,17 @@ export default class Base_javascript {
         return 'package.json' === manifestName;
     }
     /**
-   * Checks if a required lock file exists in the same path as the manifest
+   * Checks if a required lock file exists in the manifest directory or at the workspace root.
+   * When TRUSTIFY_DA_WORKSPACE_DIR is provided (via env var or opts),
+   * checks only that directory for the lock file.
    * @param {string} manifestDir - The base directory where the manifest is located
+   * @param {{TRUSTIFY_DA_WORKSPACE_DIR?: string}} [opts={}] - optional workspace root
    * @returns {boolean} True if the lock file exists
    */
-    validateLockFile(manifestDir) {
-        const lock = path.join(manifestDir, this._lockFileName());
+    validateLockFile(manifestDir, opts = {}) {
+        const workspaceDir = getCustom('TRUSTIFY_DA_WORKSPACE_DIR', null, opts);
+        const dirToCheck = workspaceDir ? path.resolve(workspaceDir) : manifestDir;
+        const lock = path.join(dirToCheck, this._lockFileName());
         return fs.existsSync(lock);
     }
     /**
@@ -138,33 +144,37 @@ export default class Base_javascript {
      * @returns {string|null}
      */
     readLicenseFromManifest(manifestPath) {
+        let manifestLicense;
         try {
             const content = JSON.parse(fs.readFileSync(manifestPath, 'utf-8'));
             if (typeof content.license === 'string') {
-                return content.license.trim() || null;
+                manifestLicense = content.license.trim() || null;
             }
-            if (Array.isArray(content.licenses) && content.licenses.length > 0) {
+            else if (Array.isArray(content.licenses) && content.licenses.length > 0) {
                 const first = content.licenses[0];
                 const name = first.type || first.name;
-                return typeof name === 'string' ? name.trim() : null;
+                manifestLicense = (typeof name === 'string' ? name.trim() : null);
             }
-            return null;
         }
         catch {
-            return null;
+            manifestLicense = null;
         }
+        return getLicense(manifestLicense, manifestPath);
     }
     /**
    * Builds the dependency tree for the project
    * @param {boolean} includeTransitive - Whether to include transitive dependencies
+   * @param {Object} [opts={}] - Configuration options; when `TRUSTIFY_DA_WORKSPACE_DIR` is set, commands run from workspace root
    * @returns {Object} The dependency tree
    * @protected
    */
-    _buildDependencyTree(includeTransitive) {
+    _buildDependencyTree(includeTransitive, opts = {}) {
         this._version();
-        let manifestDir = path.dirname(this.#manifest.manifestPath);
-        this.#createLockFile(manifestDir);
-        let output = this.#executeListCmd(includeTransitive, manifestDir);
+        const manifestDir = path.dirname(this.#manifest.manifestPath);
+        const workspaceDir = getCustom('TRUSTIFY_DA_WORKSPACE_DIR', null, opts);
+        const cmdDir = workspaceDir ? path.resolve(workspaceDir) : manifestDir;
+        this.#createLockFile(cmdDir);
+        let output = this.#executeListCmd(includeTransitive, cmdDir);
         output = this._parseDepTreeOutput(output);
         return JSON.parse(output);
     }
@@ -175,7 +185,7 @@ export default class Base_javascript {
    * @private
    */
     #getSBOM(opts = {}) {
-        const depsObject = this._buildDependencyTree(true);
+        const depsObject = this._buildDependencyTree(true, opts);
         let mainComponent = toPurl(purlType, this.#manifest.name, this.#manifest.version);
         const license = this.readLicenseFromManifest(this.#manifest.manifestPath);
         let sbom = new Sbom();
@@ -227,7 +237,7 @@ export default class Base_javascript {
    * @private
    */
     #getDirectDependencySbom(opts = {}) {
-        const depTree = this._buildDependencyTree(false);
+        const depTree = this._buildDependencyTree(false, opts);
         let mainComponent = toPurl(purlType, this.#manifest.name, this.#manifest.version);
         const license = this.readLicenseFromManifest(this.#manifest.manifestPath);
         let sbom = new Sbom();

package/dist/src/providers/golang_gomodules.js

@@ -2,6 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { EOL } from "os";
 import { PackageURL } from 'packageurl-js';
+import { readLicenseFile } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
 import { getCustom, getCustomPath, invokeCommand } from "../tools.js";
 export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest };
@@ -28,7 +29,7 @@ function isSupported(manifestName) {
  * @returns {string|null}
 */
 // eslint-disable-next-line no-unused-vars
-function readLicenseFromManifest(manifestPath) { return null; }
+function readLicenseFromManifest(manifestPath) { return readLicenseFile(manifestPath); }
 /**
  * @param {string} manifestDir - the directory where the manifest lies
  */

package/dist/src/providers/java_gradle.js

@@ -2,6 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { EOL } from 'os';
 import TOML from 'fast-toml';
+import { readLicenseFile } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
 import Base_java, { ecosystem_gradle } from "./base_java.js";
 /** @typedef {import('../provider.js').Provider} */
@@ -55,7 +56,7 @@ export default class Java_gradle extends Base_java {
      * @returns {null}
      */
     // eslint-disable-next-line no-unused-vars
-    readLicenseFromManifest(manifestPath) { return null; }
+    readLicenseFromManifest(manifestPath) { return readLicenseFile(manifestPath); }
     /**
      * Provide content and content type for stack analysis.
      * @param {string} manifest - the manifest path or name

package/dist/src/providers/java_maven.d.ts

@@ -28,7 +28,7 @@ export default class Java_maven extends Base_java {
      */
     provideComponent(manifest: string, opts?: {}): Provided;
     /**
-     * Read license from pom.xml manifest
+     * Read license from pom.xml manifest, with fallback to LICENSE file
      * @param {string} manifestPath - path to pom.xml
      * @returns {string|null}
      */

package/dist/src/providers/java_maven.js

@@ -3,6 +3,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { EOL } from 'os';
 import { XMLParser } from 'fast-xml-parser';
+import { getLicense } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
 import { getCustom } from '../tools.js';
 import Base_java, { ecosystem_maven } from "./base_java.js";
@@ -52,28 +53,28 @@ export default class Java_maven extends Base_java {
         };
     }
     /**
-     * Read license from pom.xml manifest
+     * Read license from pom.xml manifest, with fallback to LICENSE file
      * @param {string} manifestPath - path to pom.xml
      * @returns {string|null}
      */
     readLicenseFromManifest(manifestPath) {
+        let fromPom = null;
         try {
             const xml = fs.readFileSync(manifestPath, 'utf-8');
             const parser = new XMLParser({ ignoreAttributes: false });
             const obj = parser.parse(xml);
             const project = obj?.project;
-            if (!project?.licenses?.license) {
-                return null;
+            if (project?.licenses?.license) {
+                const license = Array.isArray(project.licenses.license)
+                    ? project.licenses.license[0]
+                    : project.licenses.license;
+                fromPom = (license?.name && license.name.trim()) || null;
             }
-            const license = Array.isArray(project.licenses.license)
-                ? project.licenses.license[0]
-                : project.licenses.license;
-            const name = (license?.name && license.name.trim()) || null;
-            return name || null;
         }
         catch {
-            return null;
+            // leave fromPom as null
         }
+        return getLicense(fromPom, manifestPath);
     }
     /**
      * Create a Dot Graph dependency tree for a manifest path.

package/dist/src/providers/javascript_pnpm.d.ts

@@ -1,5 +1,5 @@
 export default class Javascript_pnpm extends Base_javascript {
     _listCmdArgs(includeTransitive: any): string[];
-    _buildDependencyTree(includeTransitive: any, manifest: any): any;
+    _buildDependencyTree(includeTransitive: any, opts?: {}): any;
 }
 import Base_javascript from './base_javascript.js';

package/dist/src/providers/javascript_pnpm.js

@@ -12,8 +12,8 @@ export default class Javascript_pnpm extends Base_javascript {
     _updateLockFileCmdArgs() {
         return ['install', '--frozen-lockfile'];
     }
-    _buildDependencyTree(includeTransitive, manifest) {
-        const tree = super._buildDependencyTree(includeTransitive, manifest);
+    _buildDependencyTree(includeTransitive, opts = {}) {
+        const tree = super._buildDependencyTree(includeTransitive, opts);
         if (Array.isArray(tree) && tree.length > 0) {
             return tree[0];
         }

package/dist/src/providers/python_pip.js

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import { PackageURL } from 'packageurl-js';
+import { readLicenseFile } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
 import { environmentVariableIsPopulated, getCustom, getCustomPath, invokeCommand } from "../tools.js";
 import Python_controller from './python_controller.js';
@@ -24,7 +25,7 @@ function isSupported(manifestName) {
  * @returns {string|null}
  */
 // eslint-disable-next-line no-unused-vars
-function readLicenseFromManifest(manifestPath) { return null; }
+function readLicenseFromManifest(manifestPath) { return readLicenseFile(manifestPath); }
 /**
  * @param {string} manifestDir - the directory where the manifest lies
  */

package/dist/src/providers/requirements_parser.js

@@ -1,9 +1,10 @@
-import { createRequire } from 'node:module';
+import { readFile } from 'node:fs/promises';
 import { Language, Parser, Query } from 'web-tree-sitter';
-const require = createRequire(import.meta.url);
+const wasmUrl = new URL('./tree-sitter-requirements.wasm', import.meta.url);
 async function init() {
     await Parser.init();
-    return await Language.load(require.resolve('tree-sitter-requirements/tree-sitter-requirements.wasm'));
+    const wasmBytes = new Uint8Array(await readFile(wasmUrl));
+    return await Language.load(wasmBytes);
 }
 export async function getParser() {
     const language = await init();

package/dist/src/providers/rust_cargo.d.ts

@@ -0,0 +1,52 @@
+declare namespace _default {
+    export { isSupported };
+    export { validateLockFile };
+    export { provideComponent };
+    export { provideStack };
+    export { readLicenseFromManifest };
+}
+export default _default;
+export type Provided = import("../provider").Provided;
+/**
+ * @param {string} manifestName - the subject manifest name-type
+ * @returns {boolean} - return true if `Cargo.toml` is the manifest name-type
+ */
+declare function isSupported(manifestName: string): boolean;
+/**
+ * Validates that Cargo.lock exists in the manifest directory or in a parent
+ * workspace root directory.  In Cargo workspaces the lock file always lives at
+ * the workspace root, so when a member crate's Cargo.toml is provided we walk
+ * up the directory tree looking for Cargo.lock (stopping when we find a
+ * Cargo.toml that contains a [workspace] section, or when we reach the
+ * filesystem root).
+ * When TRUSTIFY_DA_WORKSPACE_DIR is provided (via env var or opts),
+ * checks only that directory for Cargo.lock — no walk-up.
+ * @param {string} manifestDir - the directory where the manifest lies
+ * @param {{TRUSTIFY_DA_WORKSPACE_DIR?: string}} [opts={}] - optional workspace root
+ * @returns {boolean} true if Cargo.lock is found
+ */
+declare function validateLockFile(manifestDir: string, opts?: {
+    TRUSTIFY_DA_WORKSPACE_DIR?: string;
+}): boolean;
+/**
+ * Provide content and content type for Cargo component analysis.
+ * @param {string} manifest - path to Cargo.toml for component report
+ * @param {{}} [opts={}] - optional various options to pass along the application
+ * @returns {Provided}
+ */
+declare function provideComponent(manifest: string, opts?: {}): Provided;
+/**
+ * Provide content and content type for Cargo stack analysis.
+ * @param {string} manifest - the manifest path
+ * @param {{}} [opts={}] - optional various options to pass along the application
+ * @returns {Provided}
+ */
+declare function provideStack(manifest: string, opts?: {}): Provided;
+/**
+ * Read project license from Cargo.toml, with fallback to LICENSE file.
+ * Supports the `license` field under `[package]` (single crate / workspace
+ * with root) and under `[workspace.package]` (virtual workspaces).
+ * @param {string} manifestPath - path to Cargo.toml
+ * @returns {string|null} SPDX identifier or null
+ */
+declare function readLicenseFromManifest(manifestPath: string): string | null;