@trustify-da/trustify-da-javascript-client 0.3.0-ea.a9624b2 → 0.3.0-ea.aaf5191

package/dist/src/remediation_report.js

@@ -0,0 +1,159 @@
+/**
+ * Report generator that transforms remediation extractor output into structured
+ * markdown for PR bodies, CLI dry-run output, and JSON.
+ */
+import { SEVERITY_ORDER } from './remediation.js';
+/**
+ * Generates a formatted report from an array of remediation entries.
+ *
+ * @param {Array<{purl: string, groupId: string, artifactId: string, currentVersion: string,
+ *   fixedInVersion: string, fixedInPurl: string, provider: string, source: string,
+ *   advisories: Array<{id: string, url: string}>, severity: string, cves: string[]}>} remediations
+ * @param {object} [options]
+ * @param {'dependency'|'bundle'} [options.groupBy='dependency'] - grouping strategy
+ * @param {'markdown'|'json'} [options.format='markdown'] - output format
+ * @param {boolean} [options.dryRun=false] - when true, produces tabular summary
+ * @returns {string}
+ */
+export function generateReport(remediations, options = {}) {
+    const { groupBy = 'dependency', format = 'markdown', dryRun = false } = options;
+    if (!remediations || remediations.length === 0) {
+        return format === 'json' ? '[]' : 'No remediations found.';
+    }
+    if (format === 'json') {
+        return JSON.stringify(remediations, null, '\t');
+    }
+    if (dryRun) {
+        return generateDryRunReport(remediations);
+    }
+    if (groupBy === 'bundle') {
+        return generateBundledReport(remediations);
+    }
+    return generatePerDependencyReport(remediations);
+}
+/**
+ * Generates a per-dependency markdown report with one section per remediation entry.
+ * @param {Array<object>} remediations
+ * @returns {string}
+ */
+function generatePerDependencyReport(remediations) {
+    const sections = remediations.map(rem => {
+        const depName = rem.groupId
+            ? `${rem.groupId}:${rem.artifactId}`
+            : rem.artifactId;
+        const lines = [
+            `## Security Update: ${depName} ${rem.currentVersion} → ${rem.fixedInVersion}`,
+            '',
+            `**Provider:** ${rem.provider} | **Source:** ${rem.source}`,
+            '',
+        ];
+        if (rem.cves && rem.cves.length > 0) {
+            lines.push('### Vulnerabilities resolved');
+            lines.push('');
+            lines.push('| CVE | Severity | Advisory |');
+            lines.push('| --- | --- | --- |');
+            const advisoryLinks = formatAdvisoryLinks(rem.advisories);
+            for (const cve of rem.cves) {
+                lines.push(`| ${cve} | ${rem.severity} | ${advisoryLinks} |`);
+            }
+        }
+        return lines.join('\n');
+    });
+    return sections.join('\n\n');
+}
+/**
+ * Generates a bundled markdown report grouping all remediations by severity.
+ * @param {Array<object>} remediations
+ * @returns {string}
+ */
+function generateBundledReport(remediations) {
+    const lines = ['# Security Update Summary', ''];
+    const bySeverity = groupBySeverity(remediations);
+    for (const severity of [...SEVERITY_ORDER].reverse()) {
+        const group = bySeverity.get(severity);
+        if (!group || group.length === 0) {
+            continue;
+        }
+        lines.push(`## ${severity}`);
+        lines.push('');
+        lines.push('| Dependency | Current | Fixed | Provider | CVEs | Advisory |');
+        lines.push('| --- | --- | --- | --- | --- | --- |');
+        for (const rem of group) {
+            const depName = rem.groupId
+                ? `${rem.groupId}:${rem.artifactId}`
+                : rem.artifactId;
+            const cves = (rem.cves || []).join(', ');
+            const advisoryLinks = formatAdvisoryLinks(rem.advisories);
+            lines.push(`| ${depName} | ${rem.currentVersion} | ${rem.fixedInVersion}`
+                + ` | ${rem.provider} | ${cves} | ${advisoryLinks} |`);
+        }
+        lines.push('');
+    }
+    return lines.join('\n').trimEnd();
+}
+/**
+ * Generates a tabular dry-run summary of proposed changes.
+ * @param {Array<object>} remediations
+ * @returns {string}
+ */
+function generateDryRunReport(remediations) {
+    const lines = [
+        'Proposed dependency updates:',
+        '',
+        '| Dependency | Current | Fixed | Severity | Provider |',
+        '| --- | --- | --- | --- | --- |',
+    ];
+    for (const rem of remediations) {
+        const depName = rem.groupId
+            ? `${rem.groupId}:${rem.artifactId}`
+            : rem.artifactId;
+        lines.push(`| ${depName} | ${rem.currentVersion} | ${rem.fixedInVersion}`
+            + ` | ${rem.severity} | ${rem.provider} |`);
+    }
+    return lines.join('\n');
+}
+/**
+ * Groups remediations by their severity.
+ * @param {Array<object>} remediations
+ * @returns {Map<string, Array<object>>}
+ */
+function groupBySeverity(remediations) {
+    const map = new Map();
+    for (const severity of SEVERITY_ORDER) {
+        map.set(severity, []);
+    }
+    for (const rem of remediations) {
+        const sev = rem.severity || 'UNKNOWN';
+        if (!map.has(sev)) {
+            map.set(sev, []);
+        }
+        map.get(sev).push(rem);
+    }
+    return map;
+}
+/**
+ * Formats advisory entries into markdown links or plain text.
+ * @param {Array<{id: string, url: string}>} advisories
+ * @returns {string}
+ */
+function formatAdvisoryLinks(advisories) {
+    if (!advisories || advisories.length === 0) {
+        return '-';
+    }
+    return advisories
+        .map(adv => adv.url ? `[${adv.id}](${adv.url})` : adv.id)
+        .join(', ');
+}
+/**
+ * Generates a deterministic deduplication key for a remediation entry.
+ * Suitable for checking existing PR titles or branch names.
+ *
+ * @param {object} remediation - a single remediation entry
+ * @returns {string} stable key in the form `groupId:artifactId:newVersion`
+ */
+export function generateDeduplicationKey(remediation) {
+    const group = remediation.groupId || '';
+    const artifact = remediation.artifactId || '';
+    const version = remediation.fixedInVersion || '';
+    return `${group}:${artifact}:${version}`;
+}

package/dist/src/sbom.d.ts

@@ -33,6 +33,17 @@ export default class Sbom {
         alg: string;
         content: string;
     }>): CycloneDxSbom;
+    /**
+     * Attach hashes to existing components by matching their PURL. Post-processing
+     * step used by ecosystem-specific providers (e.g. Maven) to enrich the SBOM
+     * with artifact hashes without leaking their concern into the shared parser.
+     * @param {Map<string, Array<{alg: string, content: string}>>} hashMap - PURL→hashes map
+     * @return {Sbom}
+     */
+    attachHashes(hashMap: Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>): Sbom;
     /**
      * @return String sbom json in a string format
      */

package/dist/src/sbom.js

@@ -50,6 +50,16 @@ export default class Sbom {
     addDependency(sourceRef, targetRef, scope, targetHashes) {
         return this.sbomModel.addDependency(sourceRef, targetRef, scope, targetHashes);
     }
+    /**
+     * Attach hashes to existing components by matching their PURL. Post-processing
+     * step used by ecosystem-specific providers (e.g. Maven) to enrich the SBOM
+     * with artifact hashes without leaking their concern into the shared parser.
+     * @param {Map<string, Array<{alg: string, content: string}>>} hashMap - PURL→hashes map
+     * @return {Sbom}
+     */
+    attachHashes(hashMap) {
+        return this.sbomModel.attachHashes(hashMap);
+    }
     /**
      * @return String sbom json in a string format
      */

package/dist/src/tools.js

@@ -42,6 +42,28 @@ export function getCustom(key, def = null, opts = {}) {
     }
     return key in process.env ? process.env[key] : key in opts && typeof opts[key] === 'string' ? opts[key] : def;
 }
+/**
+ * Validates that an executable path does not use directory traversal or relative segments.
+ * @param {string} binPath - The executable path to validate.
+ * @returns {string} The validated path.
+ * @throws {Error} If the path contains '..' segments or is a relative path with separators.
+ */
+function validateExecutablePath(binPath) {
+    if (typeof binPath !== 'string' || binPath.length === 0) {
+        throw new Error('Executable path rejected: expected a non-empty string');
+    }
+    if (binPath.startsWith('./') || binPath.startsWith('.\\')) {
+        throw new Error(`Executable path rejected: relative paths starting with './' are not allowed: ${binPath}`);
+    }
+    const segments = binPath.split(/[/\\]/);
+    if (segments.includes('..')) {
+        throw new Error(`Executable path rejected: path contains directory traversal segment (..): ${binPath}`);
+    }
+    if ((binPath.includes('/') || binPath.includes('\\')) && !path.isAbsolute(binPath)) {
+        throw new Error(`Executable path rejected: relative paths are not allowed, use an absolute path or a bare command name: ${binPath}`);
+    }
+    return binPath;
+}
 /**
  * Utility function for looking up custom variable for a binary path.
  * Will look in the environment variables (1) or in opts (2) for a key with TRUSTIFY_DA_x_PATH, x is an
@@ -53,7 +75,8 @@ export function getCustom(key, def = null, opts = {}) {
  * 		original name supplied
  */
 export function getCustomPath(name, opts = {}) {
-    return getCustom(`TRUSTIFY_DA_${name.toUpperCase()}_PATH`, name, opts);
+    const resolvedPath = getCustom(`TRUSTIFY_DA_${name.toUpperCase()}_PATH`, name, opts);
+    return validateExecutablePath(resolvedPath);
 }
 /**
  * Utility function for determining whether wrappers for build tools such as gradlew/mvnw should be

package/dist/src/updaters/toml_updater.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Updates dependency versions in a Gradle version catalog (libs.versions.toml) file.
+ *
+ * Supports two version declaration patterns:
+ * - Centralized: [versions] section defines version aliases, [libraries] references via version.ref
+ * - Inline: [libraries] entries include version = "x.y.z" directly
+ *
+ * Uses smol-toml parse() to locate keys, then performs position-based string replacement
+ * on the raw content to preserve formatting and comments.
+ *
+ * @param {string} tomlContent - raw TOML file content
+ * @param {Array<{groupId: string, artifactId: string, newVersion: string}>} versionChanges
+ * @returns {{content: string, applied: Array<{groupId: string, artifactId: string, newVersion: string, oldVersion: string}>, skipped: Array<{groupId: string, artifactId: string, newVersion: string, reason: string}>}}
+ */
+export function updateTomlVersions(tomlContent: string, versionChanges: Array<{
+    groupId: string;
+    artifactId: string;
+    newVersion: string;
+}>): {
+    content: string;
+    applied: Array<{
+        groupId: string;
+        artifactId: string;
+        newVersion: string;
+        oldVersion: string;
+    }>;
+    skipped: Array<{
+        groupId: string;
+        artifactId: string;
+        newVersion: string;
+        reason: string;
+    }>;
+};

package/dist/src/updaters/toml_updater.js

@@ -0,0 +1,244 @@
+import { parse as parseToml } from 'smol-toml';
+/**
+ * Updates dependency versions in a Gradle version catalog (libs.versions.toml) file.
+ *
+ * Supports two version declaration patterns:
+ * - Centralized: [versions] section defines version aliases, [libraries] references via version.ref
+ * - Inline: [libraries] entries include version = "x.y.z" directly
+ *
+ * Uses smol-toml parse() to locate keys, then performs position-based string replacement
+ * on the raw content to preserve formatting and comments.
+ *
+ * @param {string} tomlContent - raw TOML file content
+ * @param {Array<{groupId: string, artifactId: string, newVersion: string}>} versionChanges
+ * @returns {{content: string, applied: Array<{groupId: string, artifactId: string, newVersion: string, oldVersion: string}>, skipped: Array<{groupId: string, artifactId: string, newVersion: string, reason: string}>}}
+ */
+export function updateTomlVersions(tomlContent, versionChanges) {
+    const applied = [];
+    const skipped = [];
+    if (!versionChanges || versionChanges.length === 0) {
+        return { content: tomlContent, applied, skipped };
+    }
+    let parsed;
+    try {
+        parsed = parseToml(tomlContent);
+    }
+    catch (err) {
+        for (const change of versionChanges) {
+            skipped.push({
+                groupId: change.groupId,
+                artifactId: change.artifactId,
+                newVersion: change.newVersion,
+                reason: `Failed to parse TOML: ${err.message}`
+            });
+        }
+        return { content: tomlContent, applied, skipped };
+    }
+    const libraries = parsed.libraries || {};
+    const versions = parsed.versions || {};
+    const libraryIndex = buildLibraryIndex(libraries);
+    let updatedContent = tomlContent;
+    for (const change of versionChanges) {
+        const moduleKey = `${change.groupId}:${change.artifactId}`;
+        const alias = libraryIndex.get(moduleKey);
+        if (!alias) {
+            skipped.push({
+                groupId: change.groupId,
+                artifactId: change.artifactId,
+                newVersion: change.newVersion,
+                reason: `No library entry found for module ${moduleKey}`
+            });
+            continue;
+        }
+        const libEntry = libraries[alias];
+        const versionRef = getVersionRef(libEntry);
+        if (versionRef) {
+            const oldVersion = versions[versionRef];
+            if (oldVersion === undefined) {
+                skipped.push({
+                    groupId: change.groupId,
+                    artifactId: change.artifactId,
+                    newVersion: change.newVersion,
+                    reason: `Version ref "${versionRef}" not found in [versions] section`
+                });
+                continue;
+            }
+            if (oldVersion === change.newVersion) {
+                skipped.push({
+                    groupId: change.groupId,
+                    artifactId: change.artifactId,
+                    newVersion: change.newVersion,
+                    reason: `Version already at ${change.newVersion}`
+                });
+                continue;
+            }
+            updatedContent = replaceVersionInSection(updatedContent, versionRef, oldVersion, change.newVersion);
+            applied.push({
+                groupId: change.groupId,
+                artifactId: change.artifactId,
+                newVersion: change.newVersion,
+                oldVersion
+            });
+        }
+        else {
+            const inlineVersion = getInlineVersion(libEntry);
+            if (inlineVersion === undefined) {
+                skipped.push({
+                    groupId: change.groupId,
+                    artifactId: change.artifactId,
+                    newVersion: change.newVersion,
+                    reason: `No version.ref or inline version found for library "${alias}"`
+                });
+                continue;
+            }
+            if (inlineVersion === change.newVersion) {
+                skipped.push({
+                    groupId: change.groupId,
+                    artifactId: change.artifactId,
+                    newVersion: change.newVersion,
+                    reason: `Version already at ${change.newVersion}`
+                });
+                continue;
+            }
+            const beforeInline = updatedContent;
+            updatedContent = replaceInlineVersion(updatedContent, alias, inlineVersion, change.newVersion);
+            if (updatedContent !== beforeInline) {
+                applied.push({
+                    groupId: change.groupId,
+                    artifactId: change.artifactId,
+                    newVersion: change.newVersion,
+                    oldVersion: inlineVersion
+                });
+            }
+            else {
+                skipped.push({
+                    groupId: change.groupId,
+                    artifactId: change.artifactId,
+                    newVersion: change.newVersion,
+                    reason: `Inline version replacement did not match for library "${alias}"`
+                });
+            }
+        }
+    }
+    return { content: updatedContent, applied, skipped };
+}
+/**
+ * Builds a map from "groupId:artifactId" to the TOML library alias.
+ * @param {object} libraries - parsed [libraries] section
+ * @returns {Map<string, string>}
+ */
+function buildLibraryIndex(libraries) {
+    const index = new Map();
+    for (const [alias, entry] of Object.entries(libraries)) {
+        const module = getModule(entry);
+        if (module) {
+            index.set(module, alias);
+        }
+    }
+    return index;
+}
+/**
+ * Extracts the module identifier from a library entry.
+ * Handles both string shorthand ("group:artifact:version") and object notation
+ * ({ module = "group:artifact" } or { group = "...", name = "..." }).
+ * @param {string|object} entry
+ * @returns {string|undefined} "groupId:artifactId"
+ */
+function getModule(entry) {
+    if (typeof entry === 'string') {
+        const parts = entry.split(':');
+        if (parts.length >= 2) {
+            return `${parts[0]}:${parts[1]}`;
+        }
+        return undefined;
+    }
+    if (entry.module) {
+        const parts = entry.module.split(':');
+        if (parts.length >= 2) {
+            return `${parts[0]}:${parts[1]}`;
+        }
+        return entry.module;
+    }
+    if (entry.group && entry.name) {
+        return `${entry.group}:${entry.name}`;
+    }
+    return undefined;
+}
+/**
+ * Extracts the version.ref from a library entry, if present.
+ * @param {string|object} entry
+ * @returns {string|undefined}
+ */
+function getVersionRef(entry) {
+    if (typeof entry === 'object' && entry.version) {
+        if (typeof entry.version === 'object' && entry.version.ref) {
+            return entry.version.ref;
+        }
+    }
+    return undefined;
+}
+/**
+ * Extracts an inline version string from a library entry.
+ * Handles { version = "1.2.3" } and string shorthand "group:artifact:version".
+ * @param {string|object} entry
+ * @returns {string|undefined}
+ */
+function getInlineVersion(entry) {
+    if (typeof entry === 'string') {
+        const parts = entry.split(':');
+        if (parts.length >= 3) {
+            return parts[2];
+        }
+        return undefined;
+    }
+    if (typeof entry === 'object' && entry.version) {
+        if (typeof entry.version === 'string') {
+            return entry.version;
+        }
+    }
+    return undefined;
+}
+/**
+ * Replaces a version value using position-based string replacement.
+ * Targets lines matching: key = "oldVersion"
+ * @param {string} content - raw TOML content
+ * @param {string} key - version alias key
+ * @param {string} oldVersion - current version string
+ * @param {string} newVersion - replacement version string
+ * @returns {string} updated content
+ */
+function replaceVersionInSection(content, key, oldVersion, newVersion) {
+    const escapedKey = escapeRegExp(key);
+    const escapedOld = escapeRegExp(oldVersion);
+    const pattern = new RegExp(`^(\\s*${escapedKey}\\s*=\\s*")${escapedOld}("\\s*)$`, 'm');
+    return content.replace(pattern, (_, p1, p2) => `${p1}${newVersion}${p2}`);
+}
+/**
+ * Replaces an inline version in a library entry.
+ * Targets patterns like: version = "oldVersion" or version ="oldVersion"
+ * on the line containing the library alias.
+ * @param {string} content - raw TOML content
+ * @param {string} alias - library alias
+ * @param {string} oldVersion - current version string
+ * @param {string} newVersion - replacement version string
+ * @returns {string} updated content
+ */
+function replaceInlineVersion(content, alias, oldVersion, newVersion) {
+    const escapedAlias = escapeRegExp(alias);
+    const escapedOld = escapeRegExp(oldVersion);
+    const pattern = new RegExp(`^(\\s*${escapedAlias}\\s*=\\s*\\{[^}]*version\\s*=\\s*")${escapedOld}("[^}]*\\}\\s*)$`, 'm');
+    const result = content.replace(pattern, (_, p1, p2) => `${p1}${newVersion}${p2}`);
+    if (result !== content) {
+        return result;
+    }
+    const stringPattern = new RegExp(`^(\\s*${escapedAlias}\\s*=\\s*"[^:]+:[^:]+:)${escapedOld}("\\s*)$`, 'm');
+    return content.replace(stringPattern, (_, p1, p2) => `${p1}${newVersion}${p2}`);
+}
+/**
+ * Escapes special regex characters in a string.
+ * @param {string} str
+ * @returns {string}
+ */
+function escapeRegExp(str) {
+    return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@trustify-da/trustify-da-javascript-client",
-	"version": "0.3.0-ea.a9624b2",
+	"version": "0.3.0-ea.aaf5191",
 	"description": "Code-Ready Dependency Analytics JavaScript API.",
 	"license": "Apache-2.0",
 	"homepage": "https://github.com/guacsec/trustify-da-javascript-client#README.md",
@@ -25,7 +25,9 @@
 		"provenance": true
 	},
 	"type": "module",
-	"bin": "dist/src/cli.js",
+	"bin": {
+		"trustify-da": "dist/src/cli.js"
+	},
 	"main": "dist/src/index.js",
 	"module": "dist/src/index.js",
 	"types": "dist/src/index.d.ts",
@@ -48,7 +50,7 @@
 	},
 	"dependencies": {
 		"@babel/core": "^7.23.2",
-		"@cyclonedx/cyclonedx-library": "^10.0.0",
+		"@yarnpkg/parsers": "^3.1.0",
 		"eslint-import-resolver-typescript": "^4.4.4",
 		"fast-glob": "^3.3.3",
 		"fast-xml-parser": "^5.3.4",
@@ -69,10 +71,12 @@
 	},
 	"devDependencies": {
 		"@babel/core": "^7.23.2",
+		"@cyclonedx/cyclonedx-library": "^10.2.0",
 		"@eslint/js": "^10.0.0",
 		"@trustify-da/trustify-da-api-model": "^2.0.12",
 		"@types/node": "^25.9.1",
 		"@types/which": "^3.0.4",
+		"ajv": "^8.20.0",
 		"babel-plugin-rewire": "^1.2.0",
 		"c8": "^11.0.0",
 		"chai": "^6.2.2",