@trustify-da/trustify-da-javascript-client 0.3.0-ea.c2f6c64 → 0.3.0-ea.c300d9f

package/dist/src/cyclone_dx_sbom.js

@@ -1,15 +1,23 @@
 import { EOL } from "os";
 import { PackageURL } from "packageurl-js";
+import { getPackageVersion } from "./package_version.js";
+/**
+ * This client's version, read once at module load, used to populate
+ * metadata.tools.components[].version in the generated SBOM.
+ * @type {string|undefined}
+ */
+const PACKAGE_VERSION = getPackageVersion();
 /**
  *
  * @param component {PackageURL}
  * @param type type of package - application or library
  * @param scope scope of the component - runtime or compile
  * @param licenses optional license string or array of licenses for the component
- * @return {{"bom-ref": string, name, purl: string, type, version, scope, licenses?}}
+ * @param hashes optional array of hash objects for the component, e.g. [{alg: "SHA-256", content: "..."}]
+ * @return {{"bom-ref": string, name, purl: string, type, version, scope, licenses?, hashes?}}
  * @private
  */
-function getComponent(component, type, scope, licenses) {
+function getComponent(component, type, scope, licenses, hashes) {
     let componentObject;
     if (component instanceof PackageURL) {
         if (component.namespace) {
@@ -40,12 +48,24 @@ function getComponent(component, type, scope, licenses) {
     // Add licenses if provided (CycloneDX format). Callers must provide valid SPDX identifiers.
     if (licenses) {
         const licenseArray = Array.isArray(licenses) ? licenses : [licenses];
-        componentObject.licenses = licenseArray.map(lic => {
+        const validLicenses = licenseArray
+            .map(lic => {
             if (typeof lic === 'string') {
                 return { license: { id: lic } };
             }
-            return lic;
-        });
+            if (typeof lic === 'object' && lic !== null && ('license' in lic || 'expression' in lic)) {
+                return lic;
+            }
+            return null;
+        })
+            .filter(Boolean);
+        if (validLicenses.length > 0) {
+            componentObject.licenses = validLicenses;
+        }
+    }
+    // Add hashes if provided (CycloneDX 1.4 format).
+    if (hashes && hashes.length > 0) {
+        componentObject.hashes = hashes;
     }
     return componentObject;
 }
@@ -86,16 +106,24 @@ export default class CycloneDxSbom {
      * Adds a dependency relationship between two components in the SBOM
      * @param {PackageURL} sourceRef - The source component (parent)
      * @param {PackageURL} targetRef - The target component (dependency)
+     * @param {string} [scope] - Scope of the dependency
+     * @param {Array<{alg: string, content: string}>} [targetHashes] - Optional hashes for the target component
      * @return {CycloneDxSbom} The updated SBOM
      */
-    addDependency(sourceRef, targetRef, scope) {
+    addDependency(sourceRef, targetRef, scope, targetHashes) {
         const sourcePurl = sourceRef.toString();
         const targetPurl = targetRef.toString();
         // Ensure both components exist in the components list
         [sourceRef, targetRef].forEach((ref, index) => {
             const purl = index === 0 ? sourcePurl : targetPurl;
-            if (this.getComponentIndex(purl) < 0) {
-                this.components.push(getComponent(ref, "library", scope));
+            const existingIndex = this.getComponentIndex(purl);
+            if (existingIndex < 0) {
+                const hashes = index === 1 ? targetHashes : undefined;
+                this.components.push(getComponent(ref, "library", scope, undefined, hashes));
+            }
+            else if (index === 1 && targetHashes && targetHashes.length > 0 && !this.components[existingIndex].hashes) {
+                // Update hashes if the component was first seen without them (e.g. as a source)
+                this.components[existingIndex].hashes = targetHashes;
             }
         });
         // Ensure source dependency exists
@@ -114,6 +142,30 @@ export default class CycloneDxSbom {
         }
         return this;
     }
+    /**
+     * Attach hashes to already-added components by matching their PURL. This is a
+     * post-processing step so ecosystem-specific hash sources (e.g. Maven reading
+     * the local .m2 cache) can enrich the SBOM without threading their concern
+     * through the shared dependency-tree parser. Components without a matching
+     * entry, or whose hashes are already set, are left untouched.
+     * @param {Map<string, Array<{alg: string, content: string}>>} hashMap - PURL→hashes map
+     * @return {CycloneDxSbom} the updated SBOM
+     */
+    attachHashes(hashMap) {
+        if (!hashMap || hashMap.size === 0) {
+            return this;
+        }
+        for (const component of this.components) {
+            if (component.hashes) {
+                continue;
+            }
+            const hashes = hashMap.get(component.purl);
+            if (hashes && hashes.length > 0) {
+                component.hashes = hashes;
+            }
+        }
+        return this;
+    }
     /** @param {{}} opts - various options, settings and configuration of application.
      * @return String CycloneDx Sbom json object in a string format
      */
@@ -123,11 +175,18 @@ export default class CycloneDxSbom {
         const rootPurl = this.rootComponent?.purl;
         this.sbomObject = {
             "bomFormat": "CycloneDX",
-            "specVersion": "1.4",
+            "specVersion": "1.6",
             "version": 1,
             "metadata": {
                 "timestamp": new Date(),
                 "component": this.rootComponent,
+                "tools": {
+                    "components": [{
+                            "type": "application",
+                            "name": "trustify-da-javascript-client",
+                            "version": PACKAGE_VERSION
+                        }]
+                },
                 "properties": new Array()
             },
             "components": this.components.filter(c => c.purl !== rootPurl),

package/dist/src/index.d.ts

@@ -1,8 +1,6 @@
 /**
- * This function is used to determine the Trustify DA backend URL.
- * The TRUSTIFY_DA_BACKEND_URL is evaluated in the following order and selected when it finds it first:
- * 1. Environment Variable
- * 2. (key,value) from opts object
+ * Selects the Trustify DA backend URL from opts.TRUSTIFY_DA_BACKEND_URL, then environment
+ * variable TRUSTIFY_DA_BACKEND_URL. Options take precedence over environment variables.
  * If TRUSTIFY_DA_BACKEND_URL is not set, the function will throw an error.
  * @param {{TRUSTIFY_DA_DEBUG?: string | undefined; TRUSTIFY_DA_BACKEND_URL?: string | undefined}} [opts={}]
  * @return {string} - The selected Trustify DA backend URL
@@ -24,6 +22,7 @@ export function selectTrustifyDABackend(opts?: {
 export function generateSbom(manifestPath: string, opts?: Options): Promise<object>;
 export { parseImageRef } from "./oci_image/utils.js";
 export { ImageRef } from "./oci_image/images.js";
+export { extractRemediations } from "./remediation.js";
 declare namespace _default {
     export { componentAnalysis };
     export { stackAnalysis };
@@ -53,7 +52,9 @@ export type Options = {
     TRUSTIFY_DA_PYTHON_PATH?: string | undefined;
     TRUSTIFY_DA_PYTHON_VIRTUAL_ENV?: string | undefined;
     TRUSTIFY_DA_PYTHON3_PATH?: string | undefined;
-    TRUSTIFY_DA_RECOMMENDATIONS_ENABLED?: string | undefined;
+    TRUSTIFY_DA_PROVIDERS?: string | undefined;
+    TRUSTIFY_DA_RECOMMEND?: string | undefined;
+    TRUSTIFY_DA_SOURCES?: string | undefined;
     TRUSTIFY_DA_SKOPEO_CONFIG_PATH?: string | undefined;
     TRUSTIFY_DA_SKOPEO_PATH?: string | undefined;
     TRUSTIFY_DA_SYFT_CONFIG_PATH?: string | undefined;
@@ -61,6 +62,7 @@ export type Options = {
     TRUSTIFY_DA_YARN_PATH?: string | undefined;
     TRUSTIFY_DA_WORKSPACE_DIR?: string | undefined;
     TRUSTIFY_DA_LICENSE_CHECK?: string | undefined;
+    licenseCheck?: boolean | undefined;
     MATCH_MANIFEST_VERSIONS?: string | undefined;
     TRUSTIFY_DA_SOURCE?: string | undefined;
     TRUSTIFY_DA_TOKEN?: string | undefined;
@@ -80,7 +82,7 @@ export type Options = {
 };
 export type BatchAnalysisMetadata = {
     workspaceRoot: string;
-    ecosystem: "javascript" | "cargo" | "unknown";
+    ecosystem: "javascript" | "cargo" | "pyproject" | "unknown";
     total: number;
     successful: number;
     failed: number;
@@ -106,7 +108,7 @@ export type SbomResult = {
  * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>}
  * @throws {Error} if no matching provider, failed to get create content, or backend request failed
  */
-declare function componentAnalysis(manifest: string, opts?: Options): Promise<import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport>;
+declare function componentAnalysis(manifest: string, opts?: Options): Promise<any>;
 /**
  * @overload
  * @param {string} manifest
@@ -124,7 +126,7 @@ declare function stackAnalysis(manifest: string, html: true, opts?: Options | un
  * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>}
  * @throws {Error}
  */
-declare function stackAnalysis(manifest: string, html: false, opts?: Options | undefined): Promise<import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport>;
+declare function stackAnalysis(manifest: string, html: false, opts?: Options | undefined): Promise<any>;
 /**
  * Get stack analysis report for a manifest file.
  * @overload
@@ -135,24 +137,79 @@ declare function stackAnalysis(manifest: string, html: false, opts?: Options | u
  * @throws {Error} if manifest inaccessible, no matching provider, failed to get create content,
  * 		or backend request failed
  */
-declare function stackAnalysis(manifest: string, html?: boolean | undefined, opts?: Options | undefined): Promise<string | import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport>;
+declare function stackAnalysis(manifest: string, html?: boolean | undefined, opts?: Options | undefined): Promise<string | any>;
+/**
+ * @overload
+ * @param {string} workspaceRoot
+ * @param {true} html
+ * @param {Options & { batchMetadata: true }} opts
+ * @returns {Promise<{ analysis: string, metadata: BatchAnalysisMetadata }>}
+ * @throws {Error}
+ */
+declare function stackAnalysisBatch(workspaceRoot: string, html: true, opts: Options & {
+    batchMetadata: true;
+}): Promise<{
+    analysis: string;
+    metadata: BatchAnalysisMetadata;
+}>;
+/**
+ * @overload
+ * @param {string} workspaceRoot
+ * @param {true} html
+ * @param {Options & { batchMetadata?: false }} [opts={}]
+ * @returns {Promise<string>}
+ * @throws {Error}
+ */
+declare function stackAnalysisBatch(workspaceRoot: string, html: true, opts?: (Options & {
+    batchMetadata?: false;
+}) | undefined): Promise<string>;
+/**
+ * @overload
+ * @param {string} workspaceRoot
+ * @param {false} html
+ * @param {Options & { batchMetadata: true }} opts
+ * @returns {Promise<{ analysis: Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>, metadata: BatchAnalysisMetadata }>}
+ * @throws {Error}
+ */
+declare function stackAnalysisBatch(workspaceRoot: string, html: false, opts: Options & {
+    batchMetadata: true;
+}): Promise<{
+    analysis: {
+        [x: string]: any;
+    };
+    metadata: BatchAnalysisMetadata;
+}>;
+/**
+ * @overload
+ * @param {string} workspaceRoot
+ * @param {false} html
+ * @param {Options & { batchMetadata?: false }} [opts={}]
+ * @returns {Promise<Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>>}
+ * @throws {Error}
+ */
+declare function stackAnalysisBatch(workspaceRoot: string, html: false, opts?: (Options & {
+    batchMetadata?: false;
+}) | undefined): Promise<{
+    [x: string]: any;
+}>;
 /**
  * Get stack analysis for all workspace packages/crates (batch).
  * Detects ecosystem from workspace root: Cargo (Cargo.toml + Cargo.lock) or JS/TS (package.json + lock file).
  * SBOMs are generated in parallel (see `batchConcurrency`) unless `continueOnError: false` (fail-fast sequential).
  * With `opts.batchMetadata` / `TRUSTIFY_DA_BATCH_METADATA`, returns `{ analysis, metadata }` including validation and SBOM errors.
  *
+ * @overload
  * @param {string} workspaceRoot - Path to workspace root (containing lock file and workspace config)
  * @param {boolean} [html=false] - true returns HTML, false returns JSON report
  * @param {Options} [opts={}] - `batchConcurrency`, discovery ignores, `continueOnError` (default true), `batchMetadata` (default false)
  * @returns {Promise<string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>|{ analysis: string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>, metadata: BatchAnalysisMetadata }>}
  * @throws {Error} if workspace root invalid, no manifests found, no packages pass validation, no SBOMs produced, or backend request failed. When `opts.batchMetadata` is set, `error.batchMetadata` may be set on thrown errors.
  */
-declare function stackAnalysisBatch(workspaceRoot: string, html?: boolean, opts?: Options): Promise<string | {
-    [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport;
+declare function stackAnalysisBatch(workspaceRoot: string, html?: boolean | undefined, opts?: Options | undefined): Promise<string | {
+    [x: string]: any;
 } | {
     analysis: string | {
-        [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport;
+        [x: string]: any;
     };
     metadata: BatchAnalysisMetadata;
 }>;
@@ -174,7 +231,7 @@ declare function imageAnalysis(imageRefs: Array<string>, html: true, opts?: Opti
  * @throws {Error}
  */
 declare function imageAnalysis(imageRefs: Array<string>, html: false, opts?: Options | undefined): Promise<{
-    [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport;
+    [x: string]: any;
 }>;
 /**
  * Get image analysis report for a set of OCI image references.
@@ -187,7 +244,7 @@ declare function imageAnalysis(imageRefs: Array<string>, html: false, opts?: Opt
  * 		or backend request failed
  */
 declare function imageAnalysis(imageRefs: Array<string>, html?: boolean | undefined, opts?: Options | undefined): Promise<string | {
-    [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport;
+    [x: string]: any;
 }>;
 /**
  * Validates the Exhort token.
@@ -196,6 +253,10 @@ declare function imageAnalysis(imageRefs: Array<string>, html?: boolean | undefi
  * @throws {Error} if the backend request failed.
  */
 declare function validateToken(opts?: Options): Promise<object>;
+import { discoverMavenModules } from './providers/java_maven.js';
+import { discoverGradleSubprojects } from './providers/java_gradle.js';
+import { discoverGoWorkspaceModules } from './providers/golang_gomodules.js';
+import { discoverUvWorkspaceMembers } from './providers/python_uv.js';
 import { discoverWorkspacePackages } from './workspace.js';
 import { discoverWorkspaceCrates } from './workspace.js';
 import { validatePackageJson } from './workspace.js';
@@ -203,5 +264,8 @@ import { resolveWorkspaceDiscoveryIgnore } from './workspace.js';
 import { filterManifestPathsByDiscoveryIgnore } from './workspace.js';
 import { resolveContinueOnError } from './batch_opts.js';
 import { resolveBatchMetadata } from './batch_opts.js';
-export { discoverWorkspacePackages, discoverWorkspaceCrates, validatePackageJson, resolveWorkspaceDiscoveryIgnore, filterManifestPathsByDiscoveryIgnore, resolveContinueOnError, resolveBatchMetadata };
+export { discoverMavenModules, discoverGradleSubprojects, discoverGoWorkspaceModules, discoverUvWorkspaceMembers, discoverWorkspacePackages, discoverWorkspaceCrates, validatePackageJson, resolveWorkspaceDiscoveryIgnore, filterManifestPathsByDiscoveryIgnore, resolveContinueOnError, resolveBatchMetadata };
 export { getProjectLicense, findLicenseFilePath, identifyLicense, getLicenseDetails, licensesFromReport, normalizeLicensesResponse, runLicenseCheck, getCompatibility } from "./license/index.js";
+export { generateReport, generateDeduplicationKey } from "./remediation_report.js";
+export { loadConfig, mergeConfig, resolveConfig, CONFIG_FILENAMES } from "./config.js";
+export { runRemediation, findManifests } from "./remediate.js";

package/dist/src/index.js

@@ -1,19 +1,26 @@
+import fs from 'node:fs';
 import path from "node:path";
 import { EOL } from "os";
 import pLimit from 'p-limit';
-import { availableProviders, match } from './provider.js';
 import analysis from './analysis.js';
-import fs from 'node:fs';
-import { getCustom } from "./tools.js";
 import { resolveBatchMetadata, resolveContinueOnError } from './batch_opts.js';
+import { getPackageVersion } from './package_version.js';
+import { availableProviders, match } from './provider.js';
+import { discoverGoWorkspaceModules } from './providers/golang_gomodules.js';
+import { discoverGradleSubprojects } from './providers/java_gradle.js';
+import { discoverMavenModules } from './providers/java_maven.js';
+import { discoverUvWorkspaceMembers } from './providers/python_uv.js';
+import { getCustom } from "./tools.js";
 import { discoverWorkspaceCrates, discoverWorkspacePackages, filterManifestPathsByDiscoveryIgnore, resolveWorkspaceDiscoveryIgnore, validatePackageJson, } from './workspace.js';
-import.meta.dirname;
-import * as url from 'url';
 export { parseImageRef } from "./oci_image/utils.js";
 export { ImageRef } from "./oci_image/images.js";
 export { getProjectLicense, findLicenseFilePath, identifyLicense, getLicenseDetails, licensesFromReport, normalizeLicensesResponse, runLicenseCheck, getCompatibility } from "./license/index.js";
+export { extractRemediations } from "./remediation.js";
+export { generateReport, generateDeduplicationKey } from './remediation_report.js';
+export { loadConfig, mergeConfig, resolveConfig, CONFIG_FILENAMES } from './config.js';
+export { runRemediation, findManifests } from './remediate.js';
 export default { componentAnalysis, stackAnalysis, stackAnalysisBatch, imageAnalysis, validateToken, generateSbom };
-export { discoverWorkspacePackages, discoverWorkspaceCrates, validatePackageJson, resolveWorkspaceDiscoveryIgnore, filterManifestPathsByDiscoveryIgnore, resolveContinueOnError, resolveBatchMetadata, };
+export { discoverMavenModules, discoverGradleSubprojects, discoverGoWorkspaceModules, discoverUvWorkspaceMembers, discoverWorkspacePackages, discoverWorkspaceCrates, validatePackageJson, resolveWorkspaceDiscoveryIgnore, filterManifestPathsByDiscoveryIgnore, resolveContinueOnError, resolveBatchMetadata, };
 /**
  * @typedef {{
  * TRUSTIFY_DA_CARGO_PATH?: string | undefined,
@@ -35,7 +42,9 @@ export { discoverWorkspacePackages, discoverWorkspaceCrates, validatePackageJson
  * TRUSTIFY_DA_PYTHON_PATH?: string | undefined,
  * TRUSTIFY_DA_PYTHON_VIRTUAL_ENV?: string | undefined,
  * TRUSTIFY_DA_PYTHON3_PATH?: string | undefined,
- * TRUSTIFY_DA_RECOMMENDATIONS_ENABLED?: string | undefined,
+ * TRUSTIFY_DA_PROVIDERS?: string | undefined,
+ * TRUSTIFY_DA_RECOMMEND?: string | undefined,
+ * TRUSTIFY_DA_SOURCES?: string | undefined,
  * TRUSTIFY_DA_SKOPEO_CONFIG_PATH?: string | undefined,
  * TRUSTIFY_DA_SKOPEO_PATH?: string | undefined,
  * TRUSTIFY_DA_SYFT_CONFIG_PATH?: string | undefined,
@@ -43,6 +52,7 @@ export { discoverWorkspacePackages, discoverWorkspaceCrates, validatePackageJson
  * TRUSTIFY_DA_YARN_PATH?: string | undefined,
  * TRUSTIFY_DA_WORKSPACE_DIR?: string | undefined,
  * TRUSTIFY_DA_LICENSE_CHECK?: string | undefined,
+ * licenseCheck?: boolean | undefined,
  * MATCH_MANIFEST_VERSIONS?: string | undefined,
  * TRUSTIFY_DA_SOURCE?: string | undefined,
  * TRUSTIFY_DA_TOKEN?: string | undefined,
@@ -64,7 +74,7 @@ export { discoverWorkspacePackages, discoverWorkspaceCrates, validatePackageJson
 /**
  * @typedef {{
  *   workspaceRoot: string,
- *   ecosystem: 'javascript' | 'cargo' | 'unknown',
+ *   ecosystem: 'javascript' | 'cargo' | 'pyproject' | 'unknown',
  *   total: number,
  *   successful: number,
  *   failed: number,
@@ -87,29 +97,11 @@ function logOptionsAndEnvironmentsVariables(alongsideText, valueToBePrinted) {
  * @private
  */
 function readAndPrintVersionFromPackageJson() {
-    let dirName;
-    // new ESM way in nodeJS ( since node version 22 ) to bring module directory.
-    dirName = import.meta.dirname;
-    // old ESM way in nodeJS ( before node versions 22.00 to bring module directory)
-    if (!dirName) {
-        dirName = url.fileURLToPath(new URL('.', import.meta.url));
-    }
-    try {
-        if (__dirname) {
-            dirName = __dirname;
-        }
-    }
-    catch (e) {
-        console.log("__dirname is not defined, continue with fileUrlPath");
-    }
-    let packageJson = JSON.parse(fs.readFileSync(path.join(dirName, "..", "package.json")).toString());
-    logOptionsAndEnvironmentsVariables("trustify-da-javascript-client analysis started, version: ", packageJson.version);
+    logOptionsAndEnvironmentsVariables("trustify-da-javascript-client analysis started, version: ", getPackageVersion());
 }
 /**
- * This function is used to determine the Trustify DA backend URL.
- * The TRUSTIFY_DA_BACKEND_URL is evaluated in the following order and selected when it finds it first:
- * 1. Environment Variable
- * 2. (key,value) from opts object
+ * Selects the Trustify DA backend URL from opts.TRUSTIFY_DA_BACKEND_URL, then environment
+ * variable TRUSTIFY_DA_BACKEND_URL. Options take precedence over environment variables.
  * If TRUSTIFY_DA_BACKEND_URL is not set, the function will throw an error.
  * @param {{TRUSTIFY_DA_DEBUG?: string | undefined; TRUSTIFY_DA_BACKEND_URL?: string | undefined}} [opts={}]
  * @return {string} - The selected Trustify DA backend URL
@@ -171,7 +163,9 @@ async function componentAnalysis(manifest, opts = {}) {
     fs.accessSync(manifest, fs.constants.R_OK);
     opts["manifest-type"] = path.basename(manifest);
     let provider = match(manifest, availableProviders, opts); // throws error if no matching provider
-    return await analysis.requestComponent(provider, manifest, theUrl, opts); // throws error request sending failed
+    const result = await analysis.requestComponent(provider, manifest, theUrl, opts); // throws error request sending failed
+    result.packageManager = provider.packageManagerName();
+    return result;
 }
 /**
  * @overload
@@ -204,7 +198,8 @@ async function imageAnalysis(imageRefs, html = false, opts = {}) {
     return await analysis.requestImages(imageRefs, theUrl, html, opts);
 }
 /**
- * Max concurrent SBOM generations for batch workspace analysis. Env/opts override default 10.
+ * Max concurrent SBOM generations for batch workspace analysis. Options override environment;
+ * environment overrides the default of 10.
  * @param {Options} opts
  * @returns {number}
  * @private
@@ -279,17 +274,45 @@ async function generateOneSbom(manifestPath, workspaceOpts) {
  *
  * @param {string} root - Resolved workspace root
  * @param {Options} opts
- * @returns {Promise<{ ecosystem: 'javascript' | 'cargo' | 'unknown', manifestPaths: string[] }>}
+ * @returns {Promise<{ ecosystem: 'javascript' | 'cargo' | 'maven' | 'gradle' | 'gomodules' | 'pyproject' | 'unknown', manifestPaths: string[] }>}
  * @private
  */
 async function detectWorkspaceManifests(root, opts) {
     const cargoToml = path.join(root, 'Cargo.toml');
     const cargoLock = path.join(root, 'Cargo.lock');
     const packageJson = path.join(root, 'package.json');
+    const pomXml = path.join(root, 'pom.xml');
     if (fs.existsSync(cargoToml) && fs.existsSync(cargoLock)) {
         return { ecosystem: 'cargo', manifestPaths: await discoverWorkspaceCrates(root, opts) };
     }
-    const hasJsLock = fs.existsSync(path.join(root, 'pnpm-lock.yaml'))
+    if (fs.existsSync(pomXml)) {
+        const manifestPaths = await discoverMavenModules(root, opts);
+        if (manifestPaths.length > 0) {
+            return { ecosystem: 'maven', manifestPaths };
+        }
+    }
+    const hasGradleSettings = fs.existsSync(path.join(root, 'settings.gradle'))
+        || fs.existsSync(path.join(root, 'settings.gradle.kts'));
+    if (hasGradleSettings) {
+        const manifestPaths = await discoverGradleSubprojects(root, opts);
+        if (manifestPaths.length > 0) {
+            return { ecosystem: 'gradle', manifestPaths };
+        }
+    }
+    if (fs.existsSync(path.join(root, 'go.work'))) {
+        const manifestPaths = await discoverGoWorkspaceModules(root, opts);
+        if (manifestPaths.length > 0) {
+            return { ecosystem: 'gomodules', manifestPaths };
+        }
+    }
+    if (fs.existsSync(path.join(root, 'pyproject.toml')) && fs.existsSync(path.join(root, 'uv.lock'))) {
+        const manifestPaths = await discoverUvWorkspaceMembers(root, opts);
+        if (manifestPaths.length > 0) {
+            return { ecosystem: 'pyproject', manifestPaths };
+        }
+    }
+    const hasJsLock = fs.existsSync(path.join(root, 'bun.lock'))
+        || fs.existsSync(path.join(root, 'pnpm-lock.yaml'))
         || fs.existsSync(path.join(root, 'yarn.lock'))
         || fs.existsSync(path.join(root, 'package-lock.json'));
     if (fs.existsSync(packageJson) && hasJsLock) {
@@ -398,12 +421,45 @@ function batchError(message, wantMetadata, metadata) {
     }
     return err;
 }
+/**
+ * @overload
+ * @param {string} workspaceRoot
+ * @param {true} html
+ * @param {Options & { batchMetadata: true }} opts
+ * @returns {Promise<{ analysis: string, metadata: BatchAnalysisMetadata }>}
+ * @throws {Error}
+ */
+/**
+ * @overload
+ * @param {string} workspaceRoot
+ * @param {true} html
+ * @param {Options & { batchMetadata?: false }} [opts={}]
+ * @returns {Promise<string>}
+ * @throws {Error}
+ */
+/**
+ * @overload
+ * @param {string} workspaceRoot
+ * @param {false} html
+ * @param {Options & { batchMetadata: true }} opts
+ * @returns {Promise<{ analysis: Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>, metadata: BatchAnalysisMetadata }>}
+ * @throws {Error}
+ */
+/**
+ * @overload
+ * @param {string} workspaceRoot
+ * @param {false} html
+ * @param {Options & { batchMetadata?: false }} [opts={}]
+ * @returns {Promise<Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>>}
+ * @throws {Error}
+ */
 /**
  * Get stack analysis for all workspace packages/crates (batch).
  * Detects ecosystem from workspace root: Cargo (Cargo.toml + Cargo.lock) or JS/TS (package.json + lock file).
  * SBOMs are generated in parallel (see `batchConcurrency`) unless `continueOnError: false` (fail-fast sequential).
  * With `opts.batchMetadata` / `TRUSTIFY_DA_BATCH_METADATA`, returns `{ analysis, metadata }` including validation and SBOM errors.
  *
+ * @overload
  * @param {string} workspaceRoot - Path to workspace root (containing lock file and workspace config)
  * @param {boolean} [html=false] - true returns HTML, false returns JSON report
  * @param {Options} [opts={}] - `batchConcurrency`, discovery ignores, `continueOnError` (default true), `batchMetadata` (default false)
@@ -434,7 +490,7 @@ async function stackAnalysisBatch(workspaceRoot, html = false, opts = {}) {
         }
     }
     if (manifestPaths.length === 0) {
-        throw new Error(`No workspace manifests found at ${root}. Ensure Cargo.toml+Cargo.lock or package.json+lock file exist.`);
+        throw new Error(`No workspace manifests found at ${root}. Ensure a supported workspace root exists (Cargo.toml+Cargo.lock, pom.xml, build.gradle, go.work, pyproject.toml+uv.lock, or package.json+lock file).`);
     }
     const workspaceOpts = { ...opts, TRUSTIFY_DA_WORKSPACE_DIR: root };
     const concurrency = resolveBatchConcurrency(opts);

package/dist/src/license/index.d.ts

@@ -9,10 +9,10 @@
  * @param {import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport} [analysisResult] - analysis result that includes licenses array from backend
  * @returns {Promise<{ projectLicense: { manifest: Object|null, file: Object|null, mismatch: boolean }, incompatibleDependencies: Array<{ purl: string, licenses: string[], category?: string, reason: string }>, error?: string }>}
  */
-export function runLicenseCheck(sbomContent: string, manifestPath: string, url: string, opts?: import("../index.js").Options, analysisResult?: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport): Promise<{
+export function runLicenseCheck(sbomContent: string, manifestPath: string, url: string, opts?: import("../index.js").Options, analysisResult?: any): Promise<{
     projectLicense: {
-        manifest: any | null;
-        file: any | null;
+        manifest: Object | null;
+        file: Object | null;
         mismatch: boolean;
     };
     incompatibleDependencies: Array<{

package/dist/src/license/index.js

@@ -85,11 +85,14 @@ export async function runLicenseCheck(sbomContent, manifestPath, url, opts = {},
             continue;
         const status = getCompatibility(projectCategory, entry.category);
         if (status === 'incompatible') {
+            const reason = entry.category?.toUpperCase() === 'UNKNOWN'
+                ? 'License not recognized as a standard SPDX identifier. Manual review recommended to verify compatibility.'
+                : 'Dependency license(s) are incompatible with the project license.';
             incompatibleDependencies.push({
                 purl,
                 licenses: entry.licenses,
                 category: entry.category,
-                reason: 'Dependency license(s) are incompatible with the project license.'
+                reason
             });
         }
     }

package/dist/src/license/license_utils.js

@@ -114,9 +114,12 @@ export function getCompatibility(projectCategory, dependencyCategory) {
     }
     const proj = projectCategory.toUpperCase();
     const dep = dependencyCategory.toUpperCase();
-    if (proj === 'UNKNOWN' || dep === 'UNKNOWN') {
+    if (proj === 'UNKNOWN') {
         return 'unknown';
     }
+    if (dep === 'UNKNOWN') {
+        return 'incompatible';
+    }
     const restrictiveness = {
         'PERMISSIVE': 1,
         'WEAK_COPYLEFT': 2,

package/dist/src/license/licenses_api.d.ts

@@ -6,7 +6,7 @@
  * @param {import('../index.js').Options} [opts={}] - options (proxy, token, TRUSTIFY_DA_BACKEND_URL, etc.)
  * @returns {Promise<Object|null>} License details or null if not found
  */
-export function getLicenseDetails(spdxId: string, opts?: import("../index.js").Options): Promise<any | null>;
+export function getLicenseDetails(spdxId: string, opts?: import("../index.js").Options): Promise<Object | null>;
 /**
  * Normalize the LicensesResponse shape (array of LicenseProviderResult) into a map of purl -> license info.
  * Each provider result has { status, summary, packages } where packages is { [purl]: { concluded, evidence } }.
@@ -28,7 +28,7 @@ export function normalizeLicensesResponse(data: unknown, purls?: string[]): Map<
  * @param {string[]} [purls] - optional list of purls to restrict to
  * @returns {Map<string, { licenses: string[], category?: string }>}
  */
-export function licensesFromReport(analysisReport: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport, purls?: string[]): Map<string, {
+export function licensesFromReport(analysisReport: any, purls?: string[]): Map<string, {
     licenses: string[];
     category?: string;
 }>;

package/dist/src/oci_image/images.d.ts

@@ -78,7 +78,7 @@ export class ImageRef {
      * @param {string} [platform]
      * @param {import("index.js").Options} [opts={}]
      */
-    constructor(image: string, platform?: string, opts?: import("index.js").Options);
+    constructor(image: string, platform?: string, opts?: any);
     /** @type {Image} */
     image: Image;
     /** @type {Platform} */

package/dist/src/oci_image/images.js

@@ -242,8 +242,22 @@ export class ImageRef {
     getPackageURL() {
         /** @type {Object.<string, string>} */
         const qualifiers = {};
-        const repositoryUrl = this.image.getNameWithoutTag();
+        let repositoryUrl = this.image.getNameWithoutTag();
         const simpleName = this.image.getSimpleName();
+        // Normalize Docker Hub image references so all forms produce the same PURL:
+        //   node         → docker.io/node
+        //   docker.io/library/node → docker.io/node
+        if (repositoryUrl != null) {
+            const lower = repositoryUrl.toLowerCase();
+            if (lower === simpleName.toLowerCase()) {
+                // Bare name (e.g. "node") — default to docker.io
+                repositoryUrl = `docker.io/${simpleName}`;
+            }
+            else if (lower.startsWith('docker.io/library/')) {
+                // Official image with library/ prefix — strip it
+                repositoryUrl = `docker.io/${lower.substring('docker.io/library/'.length)}`;
+            }
+        }
         if (repositoryUrl != null && repositoryUrl.toLowerCase() !== simpleName.toLowerCase()) {
             qualifiers[ImageRef.REPOSITORY_QUALIFIER] = repositoryUrl.toLowerCase();
         }