@trustify-da/trustify-da-javascript-client 0.3.0-ea.c2f6c64 → 0.3.0-ea.c300d9f

package/dist/src/sbom.d.ts

@@ -25,9 +25,25 @@ export default class Sbom {
     /**
      * @param {component} sourceRef current source Component ( Starting from root component by clients)
      * @param {PackageURL} targetRef current dependency to add to Dependencies list of component sourceRef
+     * @param {string} [scope] - Scope of the dependency
+     * @param {Array<{alg: string, content: string}>} [targetHashes] - Optional hashes for the target component
      * @return Sbom
      */
-    addDependency(sourceRef: component, targetRef: PackageURL, scope: any): CycloneDxSbom;
+    addDependency(sourceRef: component, targetRef: PackageURL, scope?: string, targetHashes?: Array<{
+        alg: string;
+        content: string;
+    }>): CycloneDxSbom;
+    /**
+     * Attach hashes to existing components by matching their PURL. Post-processing
+     * step used by ecosystem-specific providers (e.g. Maven) to enrich the SBOM
+     * with artifact hashes without leaking their concern into the shared parser.
+     * @param {Map<string, Array<{alg: string, content: string}>>} hashMap - PURL→hashes map
+     * @return {Sbom}
+     */
+    attachHashes(hashMap: Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>): Sbom;
     /**
      * @return String sbom json in a string format
      */
@@ -45,6 +61,7 @@ export default class Sbom {
         version: any;
         scope: any;
         licenses?: any;
+        hashes?: any;
     };
     /** This method gets a component object, and a string name, and checks if the name is a substring of the component' purl.
      * @param {} component to search in its dependencies

package/dist/src/sbom.js

@@ -43,10 +43,22 @@ export default class Sbom {
     /**
      * @param {component} sourceRef current source Component ( Starting from root component by clients)
      * @param {PackageURL} targetRef current dependency to add to Dependencies list of component sourceRef
+     * @param {string} [scope] - Scope of the dependency
+     * @param {Array<{alg: string, content: string}>} [targetHashes] - Optional hashes for the target component
      * @return Sbom
      */
-    addDependency(sourceRef, targetRef, scope) {
-        return this.sbomModel.addDependency(sourceRef, targetRef, scope);
+    addDependency(sourceRef, targetRef, scope, targetHashes) {
+        return this.sbomModel.addDependency(sourceRef, targetRef, scope, targetHashes);
+    }
+    /**
+     * Attach hashes to existing components by matching their PURL. Post-processing
+     * step used by ecosystem-specific providers (e.g. Maven) to enrich the SBOM
+     * with artifact hashes without leaking their concern into the shared parser.
+     * @param {Map<string, Array<{alg: string, content: string}>>} hashMap - PURL→hashes map
+     * @return {Sbom}
+     */
+    attachHashes(hashMap) {
+        return this.sbomModel.attachHashes(hashMap);
     }
     /**
      * @return String sbom json in a string format

package/dist/src/tools.d.ts

@@ -6,24 +6,22 @@
  */
 export function logValueFromObjects(key: string, opts?: {}, defValue: string): void;
 /**
- * Utility function will return the value for key from the environment variables,
- * if not present will return the value for key from the opts objects only if it's a string,
- * if not present, or not string will return the default value supplied which default to null.
+ * Utility function returns the value for key from opts, then environment variables,
+ * then the supplied default. Values from opts are used only if they are strings.
  * @param {string} key the key to look for in the environment variables and the opts object
  * @param {string|null} [def=null] the value to return if nothing else found
- * @param {{}} [opts={}] the options object to look for the key in if not found in environment
- * @returns {string|null} the value of the key found in the environment, options object, or the
+ * @param {{}} [opts={}] the options object to check before the environment
+ * @returns {string|null} the value of the key found in the options object, environment, or the
  * 		default supplied
  */
 export function getCustom(key: string, def?: string | null, opts?: {}): string | null;
 /**
  * Utility function for looking up custom variable for a binary path.
- * Will look in the environment variables (1) or in opts (2) for a key with TRUSTIFY_DA_x_PATH, x is an
- * uppercase version of passed name to look for. The name will also be returned if nothing else was
- * found.
+ * Looks in opts, then environment variables, for a key with TRUSTIFY_DA_x_PATH, where x is an
+ * uppercase version of the supplied name. The name is returned if neither contains the key.
  * @param name the binary name to look for, will be returned as value in nothing else found
- * @param {{}} [opts={}] the options object to look for the key in if not found in environment
- * @returns {string|null} the value of the key found in the environment, options object, or the
+ * @param {{}} [opts={}] the options object to check before the environment
+ * @returns {string|null} the value of the key found in the options object, environment, or the
  * 		original name supplied
  */
 export function getCustomPath(name: any, opts?: {}): string | null;
@@ -31,7 +29,7 @@ export function getCustomPath(name: any, opts?: {}): string | null;
  * Utility function for determining whether wrappers for build tools such as gradlew/mvnw should be
  * preferred over invoking the binary directly.
  * @param {string} name - binary for which to search for its wrapper
- * @param {{}} opts - the options object to look for the key in if not found in environment
+ * @param {{}} opts - the options object to check before the environment
  * @returns {boolean} whether to prefer the wrapper if exists or not
  */
 export function getWrapperPreference(name: string, opts?: {}): boolean;
@@ -61,6 +59,32 @@ export function toPurlFromString(strPurl: any): PackageURL | null;
  * @param {string} cwd - directory for which to find the root of the git repository.
  */
 export function getGitRootDir(cwd: string): string | undefined;
+/**
+ * Normalize a filesystem path, lowercasing on Windows for case-insensitive comparison.
+ *
+ * @param {string} thePath
+ * @returns {string}
+ */
+export function normalizePath(thePath: string): string;
+/**
+ * Walk up from `startDir` to `repoRoot` looking for an executable wrapper script.
+ *
+ * @param {string} startDir - Absolute directory to start from
+ * @param {string} wrapperName - Wrapper filename (e.g. `mvnw`, `gradlew`)
+ * @param {string} [repoRoot] - Stop boundary (defaults to git root or filesystem root)
+ * @returns {string | undefined}
+ */
+export function traverseForWrapper(startDir: string, wrapperName: string, repoRoot?: string): string | undefined;
+/**
+ * Resolve a build-tool binary, preferring a wrapper when configured.
+ *
+ * @param {string} globalBinary - Global binary name (e.g. `mvn`, `gradle`)
+ * @param {string} localWrapper - Wrapper filename (e.g. `mvnw`, `gradlew.bat`)
+ * @param {string} startDir - Directory from which to start the wrapper search
+ * @param {import('./index.js').Options} [opts={}]
+ * @returns {string} Path to the resolved binary
+ */
+export function resolveBinary(globalBinary: string, localWrapper: string, startDir: string, opts?: import("./index.js").Options): string;
 /** this method invokes command string in a process in a synchronous way.
  * @param {string} bin - the command to be invoked
  * @param {Array<string>} args - the args to pass to the binary
@@ -74,13 +98,13 @@ export function invokeCommand(bin: string, args: Array<string>, opts?: import("c
  * @param {import("index.js").Options} opts - The trustify DA options that may contain proxy configuration
  * @returns {RequestInit} The fetch options with proxy agent if applicable
  */
-export function addProxyAgent(options: RequestInit, opts: import("index.js").Options): RequestInit;
+export function addProxyAgent(options: RequestInit, opts: any): RequestInit;
 /**
  * Utility function for fetching vendor tokens
  * @param {import("index.js").Options} [opts={}] - optional various options to pass along the application
  * @returns {{}}
  */
-export function getTokenHeaders(opts?: import("index.js").Options): {};
+export function getTokenHeaders(opts?: any): {};
 export const RegexNotToBeLogged: RegExp;
 export const TRUSTIFY_DA_TOKEN_HEADER: "trust-da-token";
 export const TRUSTIFY_DA_TELEMETRY_ID_HEADER: "telemetry-anonymous-id";

package/dist/src/tools.js

@@ -1,4 +1,6 @@
 import { execFileSync } from "child_process";
+import fs from 'node:fs';
+import path from 'node:path';
 import { EOL } from "os";
 import { HttpsProxyAgent } from "https-proxy-agent";
 import { PackageURL } from "packageurl-js";
@@ -25,39 +27,60 @@ export function logValueFromObjects(key, opts, defValue) {
     console.log(`default value for ${key} = ${defValue} ${EOL}`);
 }
 /**
- * Utility function will return the value for key from the environment variables,
- * if not present will return the value for key from the opts objects only if it's a string,
- * if not present, or not string will return the default value supplied which default to null.
+ * Utility function returns the value for key from opts, then environment variables,
+ * then the supplied default. Values from opts are used only if they are strings.
  * @param {string} key the key to look for in the environment variables and the opts object
  * @param {string|null} [def=null] the value to return if nothing else found
- * @param {{}} [opts={}] the options object to look for the key in if not found in environment
- * @returns {string|null} the value of the key found in the environment, options object, or the
+ * @param {{}} [opts={}] the options object to check before the environment
+ * @returns {string|null} the value of the key found in the options object, environment, or the
  * 		default supplied
  */
 export function getCustom(key, def = null, opts = {}) {
     if (process.env["TRUSTIFY_DA_DEBUG"] === "true" && !key.match(RegexNotToBeLogged)) {
         logValueFromObjects(key, opts, def);
     }
-    return key in process.env ? process.env[key] : key in opts && typeof opts[key] === 'string' ? opts[key] : def;
+    return key in opts && typeof opts[key] === 'string' ? opts[key] : key in process.env ? process.env[key] : def;
+}
+/**
+ * Validates that an executable path does not use directory traversal or relative segments.
+ * @param {string} binPath - The executable path to validate.
+ * @returns {string} The validated path.
+ * @throws {Error} If the path contains '..' segments or is a relative path with separators.
+ */
+function validateExecutablePath(binPath) {
+    if (typeof binPath !== 'string' || binPath.length === 0) {
+        throw new Error('Executable path rejected: expected a non-empty string');
+    }
+    if (binPath.startsWith('./') || binPath.startsWith('.\\')) {
+        throw new Error(`Executable path rejected: relative paths starting with './' are not allowed: ${binPath}`);
+    }
+    const segments = binPath.split(/[/\\]/);
+    if (segments.includes('..')) {
+        throw new Error(`Executable path rejected: path contains directory traversal segment (..): ${binPath}`);
+    }
+    if ((binPath.includes('/') || binPath.includes('\\')) && !path.isAbsolute(binPath)) {
+        throw new Error(`Executable path rejected: relative paths are not allowed, use an absolute path or a bare command name: ${binPath}`);
+    }
+    return binPath;
 }
 /**
  * Utility function for looking up custom variable for a binary path.
- * Will look in the environment variables (1) or in opts (2) for a key with TRUSTIFY_DA_x_PATH, x is an
- * uppercase version of passed name to look for. The name will also be returned if nothing else was
- * found.
+ * Looks in opts, then environment variables, for a key with TRUSTIFY_DA_x_PATH, where x is an
+ * uppercase version of the supplied name. The name is returned if neither contains the key.
  * @param name the binary name to look for, will be returned as value in nothing else found
- * @param {{}} [opts={}] the options object to look for the key in if not found in environment
- * @returns {string|null} the value of the key found in the environment, options object, or the
+ * @param {{}} [opts={}] the options object to check before the environment
+ * @returns {string|null} the value of the key found in the options object, environment, or the
  * 		original name supplied
  */
 export function getCustomPath(name, opts = {}) {
-    return getCustom(`TRUSTIFY_DA_${name.toUpperCase()}_PATH`, name, opts);
+    const resolvedPath = getCustom(`TRUSTIFY_DA_${name.toUpperCase()}_PATH`, name, opts);
+    return validateExecutablePath(resolvedPath);
 }
 /**
  * Utility function for determining whether wrappers for build tools such as gradlew/mvnw should be
  * preferred over invoking the binary directly.
  * @param {string} name - binary for which to search for its wrapper
- * @param {{}} opts - the options object to look for the key in if not found in environment
+ * @param {{}} opts - the options object to check before the environment
  * @returns {boolean} whether to prefer the wrapper if exists or not
  */
 export function getWrapperPreference(name, opts = {}) {
@@ -128,6 +151,62 @@ export function getGitRootDir(cwd) {
         return undefined;
     }
 }
+/**
+ * Normalize a filesystem path, lowercasing on Windows for case-insensitive comparison.
+ *
+ * @param {string} thePath
+ * @returns {string}
+ */
+export function normalizePath(thePath) {
+    const normalized = path.resolve(thePath).normalize();
+    return process.platform === 'win32' ? normalized.toLowerCase() : normalized;
+}
+/**
+ * Walk up from `startDir` to `repoRoot` looking for an executable wrapper script.
+ *
+ * @param {string} startDir - Absolute directory to start from
+ * @param {string} wrapperName - Wrapper filename (e.g. `mvnw`, `gradlew`)
+ * @param {string} [repoRoot] - Stop boundary (defaults to git root or filesystem root)
+ * @returns {string | undefined}
+ */
+export function traverseForWrapper(startDir, wrapperName, repoRoot = undefined) {
+    const currentDir = normalizePath(startDir);
+    repoRoot = repoRoot || getGitRootDir(currentDir) || path.parse(currentDir).root;
+    const wrapperPath = path.join(currentDir, wrapperName);
+    try {
+        fs.accessSync(wrapperPath, fs.constants.X_OK);
+        return wrapperPath;
+    }
+    catch {
+        const rootDir = path.parse(currentDir).root;
+        if (currentDir === repoRoot || currentDir === rootDir) {
+            return undefined;
+        }
+        const parentDir = path.dirname(currentDir);
+        if (parentDir === currentDir || parentDir === rootDir) {
+            return undefined;
+        }
+        return traverseForWrapper(parentDir, wrapperName, repoRoot);
+    }
+}
+/**
+ * Resolve a build-tool binary, preferring a wrapper when configured.
+ *
+ * @param {string} globalBinary - Global binary name (e.g. `mvn`, `gradle`)
+ * @param {string} localWrapper - Wrapper filename (e.g. `mvnw`, `gradlew.bat`)
+ * @param {string} startDir - Directory from which to start the wrapper search
+ * @param {import('./index.js').Options} [opts={}]
+ * @returns {string} Path to the resolved binary
+ */
+export function resolveBinary(globalBinary, localWrapper, startDir, opts = {}) {
+    if (getWrapperPreference(globalBinary, opts)) {
+        const wrapper = traverseForWrapper(startDir, localWrapper);
+        if (wrapper !== undefined) {
+            return wrapper;
+        }
+    }
+    return getCustomPath(globalBinary, opts);
+}
 /** this method invokes command string in a process in a synchronous way.
  * @param {string} bin - the command to be invoked
  * @param {Array<string>} args - the args to pass to the binary

package/dist/src/updaters/maven_updater.d.ts

@@ -0,0 +1,58 @@
+/**
+ * One entry in {@link updateMavenVersions}' `applied` list: a version that was changed and
+ * where. `type` discriminates the edit site — `'direct'` for a dependency's own `<version>`,
+ * `'property'` for a `${property}` reference (then `property` names the resolved property).
+ * @typedef {{
+ *   groupId: string,
+ *   artifactId: string,
+ *   newVersion: string,
+ *   type: ('direct'|'property'),
+ *   property?: string
+ * }} MavenAppliedChange
+ */
+/**
+ * Stable edit-site key for a Maven change: same key => same commit/PR. Deps whose versions
+ * resolve to one `${property}` share the property key and are therefore inseparable.
+ * @param {string} manifestPath
+ * @param {MavenAppliedChange} applied
+ * @returns {string}
+ */
+export function mavenChangeKey(manifestPath: string, applied: MavenAppliedChange): string;
+/**
+ * Updates dependency versions in a Maven pom.xml while preserving file formatting.
+ *
+ * Uses `fast-xml-parser` to understand the XML structure (dependencies and properties),
+ * then performs position-based string splice to replace version strings without altering
+ * any other formatting, comments, whitespace, or indentation.
+ *
+ * Supports `${property}` indirection: when a dependency's `<version>` is a property
+ * reference, the updater resolves the property chain (including recursive references)
+ * and updates the terminal property value in `<properties>` instead.
+ *
+ * @param {string} pomContent - the raw pom.xml file content
+ * @param {import('../remediate.js').VersionChangeRequest[]} versionChanges - list of version changes to apply
+ * @returns {{content: string, applied: MavenAppliedChange[], skipped: Array<{groupId: string, artifactId: string, newVersion: string, reason: string}>}} the updated content and
+ *   lists of applied and skipped changes
+ */
+export function updateMavenVersions(pomContent: string, versionChanges: import("../remediate.js").VersionChangeRequest[]): {
+    content: string;
+    applied: MavenAppliedChange[];
+    skipped: Array<{
+        groupId: string;
+        artifactId: string;
+        newVersion: string;
+        reason: string;
+    }>;
+};
+/**
+ * One entry in {@link updateMavenVersions}' `applied` list: a version that was changed and
+ * where. `type` discriminates the edit site — `'direct'` for a dependency's own `<version>`,
+ * `'property'` for a `${property}` reference (then `property` names the resolved property).
+ */
+export type MavenAppliedChange = {
+    groupId: string;
+    artifactId: string;
+    newVersion: string;
+    type: ("direct" | "property");
+    property?: string;
+};