@trustify-da/trustify-da-javascript-client 0.3.0-ea.7ed8d8c → 0.3.0-ea.7ee4047

package/dist/src/sbom.d.ts

@@ -2,9 +2,10 @@ export default class Sbom {
     sbomModel: CycloneDxSbom;
     /**
      * @param {PackageURL} root - add main/root component for sbom
+     * @param {string|Array} [licenses] - optional license(s) for the root component
      * @return Sbom
      */
-    addRoot(root: PackageURL): CycloneDxSbom;
+    addRoot(root: PackageURL, licenses?: string | any[]): CycloneDxSbom;
     /**
      * @return {{{"bom-ref": string, name, purl: string, type, version}}} root component of sbom.
      */
@@ -24,9 +25,25 @@ export default class Sbom {
     /**
      * @param {component} sourceRef current source Component ( Starting from root component by clients)
      * @param {PackageURL} targetRef current dependency to add to Dependencies list of component sourceRef
+     * @param {string} [scope] - Scope of the dependency
+     * @param {Array<{alg: string, content: string}>} [targetHashes] - Optional hashes for the target component
      * @return Sbom
      */
-    addDependency(sourceRef: component, targetRef: PackageURL, scope: any): CycloneDxSbom;
+    addDependency(sourceRef: component, targetRef: PackageURL, scope?: string, targetHashes?: Array<{
+        alg: string;
+        content: string;
+    }>): CycloneDxSbom;
+    /**
+     * Attach hashes to existing components by matching their PURL. Post-processing
+     * step used by ecosystem-specific providers (e.g. Maven) to enrich the SBOM
+     * with artifact hashes without leaking their concern into the shared parser.
+     * @param {Map<string, Array<{alg: string, content: string}>>} hashMap - PURL→hashes map
+     * @return {Sbom}
+     */
+    attachHashes(hashMap: Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>): Sbom;
     /**
      * @return String sbom json in a string format
      */
@@ -43,6 +60,8 @@ export default class Sbom {
         type: any;
         version: any;
         scope: any;
+        licenses?: any;
+        hashes?: any;
     };
     /** This method gets a component object, and a string name, and checks if the name is a substring of the component' purl.
      * @param {} component to search in its dependencies
@@ -51,6 +70,13 @@ export default class Sbom {
      * @return {boolean}
      */
     checkIfPackageInsideDependsOnList(component: any, name: string): boolean;
+    /**
+     * Checks if any entry in the dependsOn list of sourceRef starts with the given purl prefix.
+     * @param {PackageURL} sourceRef - The source component to check
+     * @param {string} purlPrefix - The purl prefix to match (e.g. "pkg:npm/minimist@")
+     * @return {boolean}
+     */
+    checkDependsOnByPurlPrefix(sourceRef: PackageURL, purlPrefix: string): boolean;
     /** Removes the root component from the sbom
      */
     removeRootComponent(): void;

package/dist/src/sbom.js

@@ -12,10 +12,11 @@ export default class Sbom {
     }
     /**
      * @param {PackageURL} root - add main/root component for sbom
+     * @param {string|Array} [licenses] - optional license(s) for the root component
      * @return Sbom
      */
-    addRoot(root) {
-        return this.sbomModel.addRoot(root);
+    addRoot(root, licenses) {
+        return this.sbomModel.addRoot(root, licenses);
     }
     /**
      * @return {{{"bom-ref": string, name, purl: string, type, version}}} root component of sbom.
@@ -42,10 +43,22 @@ export default class Sbom {
     /**
      * @param {component} sourceRef current source Component ( Starting from root component by clients)
      * @param {PackageURL} targetRef current dependency to add to Dependencies list of component sourceRef
+     * @param {string} [scope] - Scope of the dependency
+     * @param {Array<{alg: string, content: string}>} [targetHashes] - Optional hashes for the target component
      * @return Sbom
      */
-    addDependency(sourceRef, targetRef, scope) {
-        return this.sbomModel.addDependency(sourceRef, targetRef, scope);
+    addDependency(sourceRef, targetRef, scope, targetHashes) {
+        return this.sbomModel.addDependency(sourceRef, targetRef, scope, targetHashes);
+    }
+    /**
+     * Attach hashes to existing components by matching their PURL. Post-processing
+     * step used by ecosystem-specific providers (e.g. Maven) to enrich the SBOM
+     * with artifact hashes without leaking their concern into the shared parser.
+     * @param {Map<string, Array<{alg: string, content: string}>>} hashMap - PURL→hashes map
+     * @return {Sbom}
+     */
+    attachHashes(hashMap) {
+        return this.sbomModel.attachHashes(hashMap);
     }
     /**
      * @return String sbom json in a string format
@@ -76,6 +89,15 @@ export default class Sbom {
     checkIfPackageInsideDependsOnList(component, name) {
         return this.sbomModel.checkIfPackageInsideDependsOnList(component, name);
     }
+    /**
+     * Checks if any entry in the dependsOn list of sourceRef starts with the given purl prefix.
+     * @param {PackageURL} sourceRef - The source component to check
+     * @param {string} purlPrefix - The purl prefix to match (e.g. "pkg:npm/minimist@")
+     * @return {boolean}
+     */
+    checkDependsOnByPurlPrefix(sourceRef, purlPrefix) {
+        return this.sbomModel.checkDependsOnByPurlPrefix(sourceRef, purlPrefix);
+    }
     /** Removes the root component from the sbom
      */
     removeRootComponent() {

package/dist/src/tools.d.ts

@@ -6,24 +6,22 @@
  */
 export function logValueFromObjects(key: string, opts?: {}, defValue: string): void;
 /**
- * Utility function will return the value for key from the environment variables,
- * if not present will return the value for key from the opts objects only if it's a string,
- * if not present, or not string will return the default value supplied which default to null.
+ * Utility function returns the value for key from opts, then environment variables,
+ * then the supplied default. Values from opts are used only if they are strings.
  * @param {string} key the key to look for in the environment variables and the opts object
  * @param {string|null} [def=null] the value to return if nothing else found
- * @param {{}} [opts={}] the options object to look for the key in if not found in environment
- * @returns {string|null} the value of the key found in the environment, options object, or the
+ * @param {{}} [opts={}] the options object to check before the environment
+ * @returns {string|null} the value of the key found in the options object, environment, or the
  * 		default supplied
  */
 export function getCustom(key: string, def?: string | null, opts?: {}): string | null;
 /**
  * Utility function for looking up custom variable for a binary path.
- * Will look in the environment variables (1) or in opts (2) for a key with TRUSTIFY_DA_x_PATH, x is an
- * uppercase version of passed name to look for. The name will also be returned if nothing else was
- * found.
+ * Looks in opts, then environment variables, for a key with TRUSTIFY_DA_x_PATH, where x is an
+ * uppercase version of the supplied name. The name is returned if neither contains the key.
  * @param name the binary name to look for, will be returned as value in nothing else found
- * @param {{}} [opts={}] the options object to look for the key in if not found in environment
- * @returns {string|null} the value of the key found in the environment, options object, or the
+ * @param {{}} [opts={}] the options object to check before the environment
+ * @returns {string|null} the value of the key found in the options object, environment, or the
  * 		original name supplied
  */
 export function getCustomPath(name: any, opts?: {}): string | null;
@@ -31,7 +29,7 @@ export function getCustomPath(name: any, opts?: {}): string | null;
  * Utility function for determining whether wrappers for build tools such as gradlew/mvnw should be
  * preferred over invoking the binary directly.
  * @param {string} name - binary for which to search for its wrapper
- * @param {{}} opts - the options object to look for the key in if not found in environment
+ * @param {{}} opts - the options object to check before the environment
  * @returns {boolean} whether to prefer the wrapper if exists or not
  */
 export function getWrapperPreference(name: string, opts?: {}): boolean;
@@ -61,6 +59,32 @@ export function toPurlFromString(strPurl: any): PackageURL | null;
  * @param {string} cwd - directory for which to find the root of the git repository.
  */
 export function getGitRootDir(cwd: string): string | undefined;
+/**
+ * Normalize a filesystem path, lowercasing on Windows for case-insensitive comparison.
+ *
+ * @param {string} thePath
+ * @returns {string}
+ */
+export function normalizePath(thePath: string): string;
+/**
+ * Walk up from `startDir` to `repoRoot` looking for an executable wrapper script.
+ *
+ * @param {string} startDir - Absolute directory to start from
+ * @param {string} wrapperName - Wrapper filename (e.g. `mvnw`, `gradlew`)
+ * @param {string} [repoRoot] - Stop boundary (defaults to git root or filesystem root)
+ * @returns {string | undefined}
+ */
+export function traverseForWrapper(startDir: string, wrapperName: string, repoRoot?: string): string | undefined;
+/**
+ * Resolve a build-tool binary, preferring a wrapper when configured.
+ *
+ * @param {string} globalBinary - Global binary name (e.g. `mvn`, `gradle`)
+ * @param {string} localWrapper - Wrapper filename (e.g. `mvnw`, `gradlew.bat`)
+ * @param {string} startDir - Directory from which to start the wrapper search
+ * @param {import('./index.js').Options} [opts={}]
+ * @returns {string} Path to the resolved binary
+ */
+export function resolveBinary(globalBinary: string, localWrapper: string, startDir: string, opts?: import("./index.js").Options): string;
 /** this method invokes command string in a process in a synchronous way.
  * @param {string} bin - the command to be invoked
  * @param {Array<string>} args - the args to pass to the binary
@@ -68,5 +92,23 @@ export function getGitRootDir(cwd: string): string | undefined;
  * @returns {string}
  */
 export function invokeCommand(bin: string, args: Array<string>, opts?: import("child_process").ExecFileOptionsWithStringEncoding): string;
+/**
+ * Adds proxy agent configuration to fetch options if a proxy URL is specified
+ * @param {RequestInit} options - The base fetch options
+ * @param {import("index.js").Options} opts - The trustify DA options that may contain proxy configuration
+ * @returns {RequestInit} The fetch options with proxy agent if applicable
+ */
+export function addProxyAgent(options: RequestInit, opts: any): RequestInit;
+/**
+ * Utility function for fetching vendor tokens
+ * @param {import("index.js").Options} [opts={}] - optional various options to pass along the application
+ * @returns {{}}
+ */
+export function getTokenHeaders(opts?: any): {};
 export const RegexNotToBeLogged: RegExp;
+export const TRUSTIFY_DA_TOKEN_HEADER: "trust-da-token";
+export const TRUSTIFY_DA_TELEMETRY_ID_HEADER: "telemetry-anonymous-id";
+export const TRUSTIFY_DA_SOURCE_HEADER: "trust-da-source";
+export const TRUSTIFY_DA_OPERATION_TYPE_HEADER: "trust-da-operation-type";
+export const TRUSTIFY_DA_PACKAGE_MANAGER_HEADER: "trust-da-pkg-manager";
 import { PackageURL } from "packageurl-js";

package/dist/src/tools.js

@@ -1,5 +1,8 @@
 import { execFileSync } from "child_process";
+import fs from 'node:fs';
+import path from 'node:path';
 import { EOL } from "os";
+import { HttpsProxyAgent } from "https-proxy-agent";
 import { PackageURL } from "packageurl-js";
 export const RegexNotToBeLogged = /TRUSTIFY_DA_(.*_)?TOKEN|ex-.*-token|trust-.*-token/;
 /**
@@ -24,39 +27,60 @@ export function logValueFromObjects(key, opts, defValue) {
     console.log(`default value for ${key} = ${defValue} ${EOL}`);
 }
 /**
- * Utility function will return the value for key from the environment variables,
- * if not present will return the value for key from the opts objects only if it's a string,
- * if not present, or not string will return the default value supplied which default to null.
+ * Utility function returns the value for key from opts, then environment variables,
+ * then the supplied default. Values from opts are used only if they are strings.
  * @param {string} key the key to look for in the environment variables and the opts object
  * @param {string|null} [def=null] the value to return if nothing else found
- * @param {{}} [opts={}] the options object to look for the key in if not found in environment
- * @returns {string|null} the value of the key found in the environment, options object, or the
+ * @param {{}} [opts={}] the options object to check before the environment
+ * @returns {string|null} the value of the key found in the options object, environment, or the
  * 		default supplied
  */
 export function getCustom(key, def = null, opts = {}) {
     if (process.env["TRUSTIFY_DA_DEBUG"] === "true" && !key.match(RegexNotToBeLogged)) {
         logValueFromObjects(key, opts, def);
     }
-    return key in process.env ? process.env[key] : key in opts && typeof opts[key] === 'string' ? opts[key] : def;
+    return key in opts && typeof opts[key] === 'string' ? opts[key] : key in process.env ? process.env[key] : def;
+}
+/**
+ * Validates that an executable path does not use directory traversal or relative segments.
+ * @param {string} binPath - The executable path to validate.
+ * @returns {string} The validated path.
+ * @throws {Error} If the path contains '..' segments or is a relative path with separators.
+ */
+function validateExecutablePath(binPath) {
+    if (typeof binPath !== 'string' || binPath.length === 0) {
+        throw new Error('Executable path rejected: expected a non-empty string');
+    }
+    if (binPath.startsWith('./') || binPath.startsWith('.\\')) {
+        throw new Error(`Executable path rejected: relative paths starting with './' are not allowed: ${binPath}`);
+    }
+    const segments = binPath.split(/[/\\]/);
+    if (segments.includes('..')) {
+        throw new Error(`Executable path rejected: path contains directory traversal segment (..): ${binPath}`);
+    }
+    if ((binPath.includes('/') || binPath.includes('\\')) && !path.isAbsolute(binPath)) {
+        throw new Error(`Executable path rejected: relative paths are not allowed, use an absolute path or a bare command name: ${binPath}`);
+    }
+    return binPath;
 }
 /**
  * Utility function for looking up custom variable for a binary path.
- * Will look in the environment variables (1) or in opts (2) for a key with TRUSTIFY_DA_x_PATH, x is an
- * uppercase version of passed name to look for. The name will also be returned if nothing else was
- * found.
+ * Looks in opts, then environment variables, for a key with TRUSTIFY_DA_x_PATH, where x is an
+ * uppercase version of the supplied name. The name is returned if neither contains the key.
  * @param name the binary name to look for, will be returned as value in nothing else found
- * @param {{}} [opts={}] the options object to look for the key in if not found in environment
- * @returns {string|null} the value of the key found in the environment, options object, or the
+ * @param {{}} [opts={}] the options object to check before the environment
+ * @returns {string|null} the value of the key found in the options object, environment, or the
  * 		original name supplied
  */
 export function getCustomPath(name, opts = {}) {
-    return getCustom(`TRUSTIFY_DA_${name.toUpperCase()}_PATH`, name, opts);
+    const resolvedPath = getCustom(`TRUSTIFY_DA_${name.toUpperCase()}_PATH`, name, opts);
+    return validateExecutablePath(resolvedPath);
 }
 /**
  * Utility function for determining whether wrappers for build tools such as gradlew/mvnw should be
  * preferred over invoking the binary directly.
  * @param {string} name - binary for which to search for its wrapper
- * @param {{}} opts - the options object to look for the key in if not found in environment
+ * @param {{}} opts - the options object to check before the environment
  * @returns {boolean} whether to prefer the wrapper if exists or not
  */
 export function getWrapperPreference(name, opts = {}) {
@@ -127,6 +151,62 @@ export function getGitRootDir(cwd) {
         return undefined;
     }
 }
+/**
+ * Normalize a filesystem path, lowercasing on Windows for case-insensitive comparison.
+ *
+ * @param {string} thePath
+ * @returns {string}
+ */
+export function normalizePath(thePath) {
+    const normalized = path.resolve(thePath).normalize();
+    return process.platform === 'win32' ? normalized.toLowerCase() : normalized;
+}
+/**
+ * Walk up from `startDir` to `repoRoot` looking for an executable wrapper script.
+ *
+ * @param {string} startDir - Absolute directory to start from
+ * @param {string} wrapperName - Wrapper filename (e.g. `mvnw`, `gradlew`)
+ * @param {string} [repoRoot] - Stop boundary (defaults to git root or filesystem root)
+ * @returns {string | undefined}
+ */
+export function traverseForWrapper(startDir, wrapperName, repoRoot = undefined) {
+    const currentDir = normalizePath(startDir);
+    repoRoot = repoRoot || getGitRootDir(currentDir) || path.parse(currentDir).root;
+    const wrapperPath = path.join(currentDir, wrapperName);
+    try {
+        fs.accessSync(wrapperPath, fs.constants.X_OK);
+        return wrapperPath;
+    }
+    catch {
+        const rootDir = path.parse(currentDir).root;
+        if (currentDir === repoRoot || currentDir === rootDir) {
+            return undefined;
+        }
+        const parentDir = path.dirname(currentDir);
+        if (parentDir === currentDir || parentDir === rootDir) {
+            return undefined;
+        }
+        return traverseForWrapper(parentDir, wrapperName, repoRoot);
+    }
+}
+/**
+ * Resolve a build-tool binary, preferring a wrapper when configured.
+ *
+ * @param {string} globalBinary - Global binary name (e.g. `mvn`, `gradle`)
+ * @param {string} localWrapper - Wrapper filename (e.g. `mvnw`, `gradlew.bat`)
+ * @param {string} startDir - Directory from which to start the wrapper search
+ * @param {import('./index.js').Options} [opts={}]
+ * @returns {string} Path to the resolved binary
+ */
+export function resolveBinary(globalBinary, localWrapper, startDir, opts = {}) {
+    if (getWrapperPreference(globalBinary, opts)) {
+        const wrapper = traverseForWrapper(startDir, localWrapper);
+        if (wrapper !== undefined) {
+            return wrapper;
+        }
+    }
+    return getCustomPath(globalBinary, opts);
+}
 /** this method invokes command string in a process in a synchronous way.
  * @param {string} bin - the command to be invoked
  * @param {Array<string>} args - the args to pass to the binary
@@ -157,3 +237,57 @@ export function invokeCommand(bin, args, opts = {}) {
     };
     return execFileSync(bin, args, { ...{ stdio: 'pipe', encoding: 'utf-8' }, ...opts });
 }
+export const TRUSTIFY_DA_TOKEN_HEADER = "trust-da-token";
+export const TRUSTIFY_DA_TELEMETRY_ID_HEADER = "telemetry-anonymous-id";
+export const TRUSTIFY_DA_SOURCE_HEADER = "trust-da-source";
+export const TRUSTIFY_DA_OPERATION_TYPE_HEADER = "trust-da-operation-type";
+export const TRUSTIFY_DA_PACKAGE_MANAGER_HEADER = "trust-da-pkg-manager";
+/**
+ * Adds proxy agent configuration to fetch options if a proxy URL is specified
+ * @param {RequestInit} options - The base fetch options
+ * @param {import("index.js").Options} opts - The trustify DA options that may contain proxy configuration
+ * @returns {RequestInit} The fetch options with proxy agent if applicable
+ */
+export function addProxyAgent(options, opts) {
+    const proxyUrl = getCustom('TRUSTIFY_DA_PROXY_URL', null, opts);
+    if (proxyUrl) {
+        options.agent = new HttpsProxyAgent(proxyUrl);
+    }
+    return options;
+}
+/**
+ * Utility function for fetching vendor tokens
+ * @param {import("index.js").Options} [opts={}] - optional various options to pass along the application
+ * @returns {{}}
+ */
+export function getTokenHeaders(opts = {}) {
+    let headers = {};
+    setCustomHeader(TRUSTIFY_DA_TOKEN_HEADER, headers, 'TRUSTIFY_DA_TOKEN', opts);
+    setCustomHeader(TRUSTIFY_DA_SOURCE_HEADER, headers, 'TRUSTIFY_DA_SOURCE', opts);
+    setCustomHeader(TRUSTIFY_DA_OPERATION_TYPE_HEADER, headers, TRUSTIFY_DA_OPERATION_TYPE_HEADER.toUpperCase().replaceAll("-", "_"), opts);
+    setCustomHeader(TRUSTIFY_DA_PACKAGE_MANAGER_HEADER, headers, TRUSTIFY_DA_PACKAGE_MANAGER_HEADER.toUpperCase().replaceAll("-", "_"), opts);
+    setCustomHeader(TRUSTIFY_DA_TELEMETRY_ID_HEADER, headers, 'TRUSTIFY_DA_TELEMETRY_ID', opts);
+    if (getCustom("TRUSTIFY_DA_DEBUG", null, opts) === "true") {
+        console.log("Headers Values to be sent to Trustify DA backend:" + EOL);
+        for (const headerKey in headers) {
+            if (!headerKey.match(RegexNotToBeLogged)) {
+                console.log(`${headerKey}: ${headers[headerKey]}`);
+            }
+        }
+    }
+    return headers;
+}
+/**
+ *
+ * @param {string} headerName - the header name to populate in request
+ * @param headers
+ * @param {string} optsKey - key in the options object to use the value for
+ * @param {import("index.js").Options} [opts={}] - options input object to fetch header values from
+ * @private
+ */
+function setCustomHeader(headerName, headers, optsKey, opts) {
+    let customHeaderValue = getCustom(optsKey, null, opts);
+    if (customHeaderValue) {
+        headers[headerName] = customHeaderValue;
+    }
+}

package/dist/src/updaters/maven_updater.d.ts

@@ -0,0 +1,58 @@
+/**
+ * One entry in {@link updateMavenVersions}' `applied` list: a version that was changed and
+ * where. `type` discriminates the edit site — `'direct'` for a dependency's own `<version>`,
+ * `'property'` for a `${property}` reference (then `property` names the resolved property).
+ * @typedef {{
+ *   groupId: string,
+ *   artifactId: string,
+ *   newVersion: string,
+ *   type: ('direct'|'property'),
+ *   property?: string
+ * }} MavenAppliedChange
+ */
+/**
+ * Stable edit-site key for a Maven change: same key => same commit/PR. Deps whose versions
+ * resolve to one `${property}` share the property key and are therefore inseparable.
+ * @param {string} manifestPath
+ * @param {MavenAppliedChange} applied
+ * @returns {string}
+ */
+export function mavenChangeKey(manifestPath: string, applied: MavenAppliedChange): string;
+/**
+ * Updates dependency versions in a Maven pom.xml while preserving file formatting.
+ *
+ * Uses `fast-xml-parser` to understand the XML structure (dependencies and properties),
+ * then performs position-based string splice to replace version strings without altering
+ * any other formatting, comments, whitespace, or indentation.
+ *
+ * Supports `${property}` indirection: when a dependency's `<version>` is a property
+ * reference, the updater resolves the property chain (including recursive references)
+ * and updates the terminal property value in `<properties>` instead.
+ *
+ * @param {string} pomContent - the raw pom.xml file content
+ * @param {import('../remediate.js').VersionChangeRequest[]} versionChanges - list of version changes to apply
+ * @returns {{content: string, applied: MavenAppliedChange[], skipped: Array<{groupId: string, artifactId: string, newVersion: string, reason: string}>}} the updated content and
+ *   lists of applied and skipped changes
+ */
+export function updateMavenVersions(pomContent: string, versionChanges: import("../remediate.js").VersionChangeRequest[]): {
+    content: string;
+    applied: MavenAppliedChange[];
+    skipped: Array<{
+        groupId: string;
+        artifactId: string;
+        newVersion: string;
+        reason: string;
+    }>;
+};
+/**
+ * One entry in {@link updateMavenVersions}' `applied` list: a version that was changed and
+ * where. `type` discriminates the edit site — `'direct'` for a dependency's own `<version>`,
+ * `'property'` for a `${property}` reference (then `property` names the resolved property).
+ */
+export type MavenAppliedChange = {
+    groupId: string;
+    artifactId: string;
+    newVersion: string;
+    type: ("direct" | "property");
+    property?: string;
+};