trm-core 9.10.6 → 10.0.1

package/dist/commons/getPackagesNamespace.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPackagesNamespace = getPackagesNamespace;
+const getPackageNamespace_1 = require("./getPackageNamespace");
+/**
+ * Returns the namespace of a set of SAP packages: the root package namespace, or the only
+ * reserved (/NAMESPACE/) namespace used by a subpackage when the root uses Z or Y.
+ *
+ * Only one reserved namespace is supported: a TRM package carries a single namespace and repair
+ * license. Z and Y need no namespace object and can be mixed with it.
+ */
+function getPackagesNamespace(rootDevclass, devclasses) {
+    const reservedNamespaces = [...new Set([rootDevclass, ...devclasses].map(getPackageNamespace_1.getPackageNamespace).filter(ns => ns[0] === '/'))];
+    if (reservedNamespaces.length > 1) {
+        throw new Error(`SAP packages must use at most one namespace, found: ${reservedNamespaces.join(', ')}.`);
+    }
+    const rootNamespace = (0, getPackageNamespace_1.getPackageNamespace)(rootDevclass);
+    return rootNamespace[0] === '/' || reservedNamespaces.length === 0 ? rootNamespace : reservedNamespaces[0];
+}

package/dist/commons/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./normalize";
+export * from "./packageDataFromTdevc";
 export * from "./getFileSysSeparator";
 export * from "./fromAbapToDate";
 export * from "./PackageName";
@@ -8,6 +9,7 @@ export * from "./PackageHierarchy";
 export * from "./getPackageHierarchy";
 export * from "./getParentFromHierarchy";
 export * from "./getPackageNamespace";
+export * from "./getPackagesNamespace";
 export * from "./LogTableStruct";
 export * from "./getAxiosInstance";
 export * from "./getNodePackage";
@@ -15,3 +17,5 @@ export * from "./getCoreTrmDependencies";
 export * from "./checkCoreTrmDependencies";
 export * from "./jsonStringifyWithKeyOrder";
 export * from "./adjustTrmServerRestDevclass";
+export * from "./summarizeForLog";
+export * from "./resolveCoreVersion";

package/dist/commons/index.js

@@ -15,6 +15,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./normalize"), exports);
+__exportStar(require("./packageDataFromTdevc"), exports);
 __exportStar(require("./getFileSysSeparator"), exports);
 __exportStar(require("./fromAbapToDate"), exports);
 __exportStar(require("./PackageName"), exports);
@@ -24,6 +25,7 @@ __exportStar(require("./PackageHierarchy"), exports);
 __exportStar(require("./getPackageHierarchy"), exports);
 __exportStar(require("./getParentFromHierarchy"), exports);
 __exportStar(require("./getPackageNamespace"), exports);
+__exportStar(require("./getPackagesNamespace"), exports);
 __exportStar(require("./LogTableStruct"), exports);
 __exportStar(require("./getAxiosInstance"), exports);
 __exportStar(require("./getNodePackage"), exports);
@@ -31,3 +33,5 @@ __exportStar(require("./getCoreTrmDependencies"), exports);
 __exportStar(require("./checkCoreTrmDependencies"), exports);
 __exportStar(require("./jsonStringifyWithKeyOrder"), exports);
 __exportStar(require("./adjustTrmServerRestDevclass"), exports);
+__exportStar(require("./summarizeForLog"), exports);
+__exportStar(require("./resolveCoreVersion"), exports);

package/dist/commons/packageDataFromTdevc.d.ts

@@ -0,0 +1,12 @@
+import { SCOMPKDTLN, TDEVC } from "../client";
+type PackageCreationOverrides = Pick<SCOMPKDTLN, "devclass" | "ctext" | "as4user" | "dlvunit" | "pdevclass">;
+/**
+ * Convert the writable package attributes carried by a transported TDEVC row
+ * to the structure accepted by /ATRM/CREATE_PACKAGE.
+ *
+ * Target-owned routing and identity fields are supplied as overrides. Parentcl
+ * is intentionally omitted: the install workflow rebuilds the renamed package
+ * hierarchy only after every package exists.
+ */
+export declare function packageDataFromTdevc(source: TDEVC, overrides: PackageCreationOverrides): SCOMPKDTLN;
+export {};

package/dist/commons/packageDataFromTdevc.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.packageDataFromTdevc = packageDataFromTdevc;
+/**
+ * Convert the writable package attributes carried by a transported TDEVC row
+ * to the structure accepted by /ATRM/CREATE_PACKAGE.
+ *
+ * Target-owned routing and identity fields are supplied as overrides. Parentcl
+ * is intentionally omitted: the install workflow rebuilds the renamed package
+ * hierarchy only after every package exists.
+ */
+function packageDataFromTdevc(source, overrides) {
+    const result = Object.assign({}, overrides);
+    const copy = (target, value) => {
+        if (value !== undefined) {
+            result[target] = value;
+        }
+    };
+    copy("korrflag", source.korrflag);
+    copy("perminher", source.perminher);
+    copy("packkind", source.packageKind);
+    copy("restricted", source.restricted);
+    copy("mainpack", source.mainpack);
+    return result;
+}

package/dist/commons/resolveCoreVersion.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Returns the version of trm-core in use.
+ *
+ * Clients may resolve trm-core from a different location (e.g. their global node modules), so a version
+ * they supply takes precedence over the package.json found by this package.
+ *
+ * @param coreVersion version supplied by the client
+ * @returns the version, or `undefined` when it can't be determined
+ */
+export declare function resolveCoreVersion(coreVersion?: string): string | undefined;

package/dist/commons/resolveCoreVersion.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveCoreVersion = resolveCoreVersion;
+const getNodePackage_1 = require("./getNodePackage");
+/**
+ * Returns the version of trm-core in use.
+ *
+ * Clients may resolve trm-core from a different location (e.g. their global node modules), so a version
+ * they supply takes precedence over the package.json found by this package.
+ *
+ * @param coreVersion version supplied by the client
+ * @returns the version, or `undefined` when it can't be determined
+ */
+function resolveCoreVersion(coreVersion) {
+    if (coreVersion) {
+        return coreVersion;
+    }
+    try {
+        return (0, getNodePackage_1.getNodePackage)().version;
+    }
+    catch (_a) {
+        return undefined;
+    }
+}

package/dist/commons/summarizeForLog.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Formats a request URL for diagnostic logging.
+ *
+ * Relative URLs are resolved against the base URL. Absolute URLs outside the base URL (such as
+ * signed download links) only keep their origin, since their path and query may grant access.
+ *
+ * @param baseURL Base URL of the client, if any.
+ * @param url Request URL.
+ * @returns A log-safe URL.
+ */
+export declare function summarizeUrlForLog(baseURL: string | undefined, url: string | undefined): string;
+/**
+ * Creates a bounded, serialization-safe value for diagnostic logging.
+ *
+ * Sensitive fields are redacted, binary values are replaced with byte counts, non-plain class
+ * instances are represented by their type, circular references are marked, and large/deep values
+ * are truncated. The input value is never mutated.
+ *
+ * @param value Value to summarize.
+ * @returns A log-safe structure containing only primitives, arrays, and plain objects.
+ */
+export declare function summarizeForLog(value: any): any;

package/dist/commons/summarizeForLog.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.summarizeUrlForLog = summarizeUrlForLog;
+exports.summarizeForLog = summarizeForLog;
+const MAX_LOG_DEPTH = 4;
+const MAX_LOG_ARRAY_ITEMS = 20;
+const MAX_LOG_OBJECT_KEYS = 30;
+const MAX_LOG_STRING_LENGTH = 500;
+function isSensitiveKey(key) {
+    const normalized = key.replace(/[^a-z]/gi, "").toLowerCase();
+    return [
+        "auth",
+        "authentication",
+        "authorization",
+        "cookie",
+        "cookies",
+        "credential",
+        "credentials",
+        "password",
+        "passwd",
+        "apikey",
+        "privatekey",
+        "downloadlink",
+        "replicense"
+    ].includes(normalized) || normalized.endsWith("secret") || normalized.endsWith("token");
+}
+/**
+ * Formats a request URL for diagnostic logging.
+ *
+ * Relative URLs are resolved against the base URL. Absolute URLs outside the base URL (such as
+ * signed download links) only keep their origin, since their path and query may grant access.
+ *
+ * @param baseURL Base URL of the client, if any.
+ * @param url Request URL.
+ * @returns A log-safe URL.
+ */
+function summarizeUrlForLog(baseURL, url) {
+    const sUrl = url || "";
+    if (!/^[a-z][a-z\d+\-.]*:\/\//i.test(sUrl)) {
+        return `${baseURL || ""}${sUrl}`;
+    }
+    if (baseURL && sUrl.startsWith(baseURL)) {
+        return sUrl;
+    }
+    try {
+        return `${new URL(sUrl).origin}/[REDACTED]`;
+    }
+    catch (_a) {
+        return "[REDACTED]";
+    }
+}
+/**
+ * Creates a bounded, serialization-safe value for diagnostic logging.
+ *
+ * Sensitive fields are redacted, binary values are replaced with byte counts, non-plain class
+ * instances are represented by their type, circular references are marked, and large/deep values
+ * are truncated. The input value is never mutated.
+ *
+ * @param value Value to summarize.
+ * @returns A log-safe structure containing only primitives, arrays, and plain objects.
+ */
+function summarizeForLog(value) {
+    return summarizeValue(value, 0, new WeakSet());
+}
+function summarizeValue(value, depth, seen) {
+    var _a, _b;
+    if (value === null || value === undefined || typeof value === "number" || typeof value === "boolean") {
+        return value;
+    }
+    if (typeof value === "string") {
+        return value.length <= MAX_LOG_STRING_LENGTH
+            ? value
+            : `${value.slice(0, MAX_LOG_STRING_LENGTH)}… (${value.length} characters)`;
+    }
+    if (typeof value === "bigint") {
+        return value.toString();
+    }
+    if (typeof value === "symbol" || typeof value === "function") {
+        return `[${typeof value}]`;
+    }
+    if (Buffer.isBuffer(value)) {
+        return `<Buffer ${value.length} bytes>`;
+    }
+    if (ArrayBuffer.isView(value)) {
+        return `<${((_a = value.constructor) === null || _a === void 0 ? void 0 : _a.name) || "TypedArray"} ${value.byteLength} bytes>`;
+    }
+    if (value instanceof ArrayBuffer) {
+        return `<ArrayBuffer ${value.byteLength} bytes>`;
+    }
+    if (seen.has(value)) {
+        return "[Circular]";
+    }
+    const typeName = ((_b = value.constructor) === null || _b === void 0 ? void 0 : _b.name) || "Object";
+    if (depth >= MAX_LOG_DEPTH) {
+        return `[${typeName}]`;
+    }
+    seen.add(value);
+    if (Array.isArray(value)) {
+        const summary = value.slice(0, MAX_LOG_ARRAY_ITEMS).map(item => summarizeValue(item, depth + 1, seen));
+        if (value.length > MAX_LOG_ARRAY_ITEMS) {
+            summary.push(`… ${value.length - MAX_LOG_ARRAY_ITEMS} more items`);
+        }
+        return summary;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+        return `[${typeName}]`;
+    }
+    const entries = Object.entries(value);
+    const summary = {};
+    entries.slice(0, MAX_LOG_OBJECT_KEYS).forEach(([key, entryValue]) => {
+        summary[key] = isSensitiveKey(key)
+            ? "[REDACTED]"
+            : summarizeValue(entryValue, depth + 1, seen);
+    });
+    if (entries.length > MAX_LOG_OBJECT_KEYS) {
+        summary["…"] = `${entries.length - MAX_LOG_OBJECT_KEYS} more keys`;
+    }
+    return summary;
+}

package/dist/connection/OpenRFCConnect.d.ts

@@ -0,0 +1,13 @@
+import { RFCConnect } from "trm-commons";
+import { ISystemConnector } from "../systemConnector";
+/**
+ * Connection to an SAP system through RFC (open-rfc).
+ *
+ * Same connection data as {@link RFCConnect}, but the system connector
+ * uses open-rfc instead of node-rfc.
+ */
+export declare class OpenRFCConnect extends RFCConnect {
+    name: string;
+    description: string;
+    getSystemConnector(): ISystemConnector;
+}

package/dist/connection/OpenRFCConnect.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OpenRFCConnect = void 0;
+const trm_commons_1 = require("trm-commons");
+const systemConnector_1 = require("../systemConnector");
+/**
+ * Connection to an SAP system through RFC (open-rfc).
+ *
+ * Same connection data as {@link RFCConnect}, but the system connector
+ * uses open-rfc instead of node-rfc.
+ */
+class OpenRFCConnect extends trm_commons_1.RFCConnect {
+    constructor() {
+        super(...arguments);
+        this.name = 'OPENRFC';
+        this.description = 'RFC (Uses open-rfc)';
+    }
+    getSystemConnector() {
+        const data = this.getData();
+        return new systemConnector_1.OpenRFCSystemConnector(data, data);
+    }
+}
+exports.OpenRFCConnect = OpenRFCConnect;

package/dist/connection/index.d.ts

@@ -0,0 +1 @@
+export * from "./OpenRFCConnect";

package/dist/connection/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./OpenRFCConnect"), exports);

package/dist/dependencies/PackageDependencies.d.ts

@@ -28,7 +28,9 @@ export declare class PackageDependencies {
     readonly trmPackageDependencies: TrmPackageDependency[];
     readonly abapPackageDependencies: AbapPackageDependency[];
     private devclasses;
+    private ancestors;
     constructor(devclass: DEVCLASS);
     setDependencies(packageDependencies: ZTRM_OBJECT_DEPENDENCIES[]): Promise<PackageDependencies>;
+    private getAncestors;
     private getDevclasses;
 }

package/dist/dependencies/PackageDependencies.js

@@ -68,8 +68,10 @@ class PackageDependencies {
             i = 0;
             logProgress = trm_commons_1.Logger.progressbar('Building dependency tree [{bar}] {percentage}% ({value}/{total})', '>');
             logProgress.start(this.allDependencies.length, 0);
+            //Logger.loading(`Building dependency tree...`, !log);
             for (const o of this.allDependencies) {
                 for (const trmPackage of o.trmPackages) {
+                    // only if the abap package of the trm package is not the same as the one analyzed
                     if (trmPackage.trmPackage.getDevclass() !== this.devclass) {
                         var depIndex = this.trmPackageDependencies.findIndex(k => k.trmPackage.compareName(trmPackage.trmPackage.packageName) && k.trmPackage.compareRegistry(trmPackage.trmPackage.registry));
                         if (depIndex < 0) {
@@ -86,9 +88,17 @@ class PackageDependencies {
                         }
                     }
                 }
+                // The root package's definition points to its superpackages: they're not shipped, and
+                // install places the root wherever the user chooses.
+                const isRootDefinition = o.object === 'DEVC' && o.objName === this.devclass;
                 for (const sapPackage of o.sapPackages) {
+                    if (isRootDefinition && (yield this.getAncestors()).includes(sapPackage.package)) {
+                        continue;
+                    }
                     for (const dep of sapPackage.dependencies) {
+                        // only if the abap package is not a subpackage of the one analyzed
                         if (!(yield this.getDevclasses()).includes(sapPackage.package)) {
+                            // get the root, in trm we assume subpackages are part of the same package (supposing the user will generate on after a mising dependency)
                             const root = yield systemConnector_1.SystemConnector.getRootDevclass(sapPackage.package);
                             var packageIndex = this.abapPackageDependencies.findIndex(k => k.abapPackage.devclass === root);
                             if (packageIndex < 0) {
@@ -129,6 +139,20 @@ class PackageDependencies {
             return this;
         });
     }
+    getAncestors() {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            if (!this.ancestors) {
+                this.ancestors = [];
+                let parent = (_a = (yield systemConnector_1.SystemConnector.getDevclass(this.devclass))) === null || _a === void 0 ? void 0 : _a.parentcl;
+                while (parent && !this.ancestors.includes(parent)) {
+                    this.ancestors.push(parent);
+                    parent = (_b = (yield systemConnector_1.SystemConnector.getDevclass(parent))) === null || _b === void 0 ? void 0 : _b.parentcl;
+                }
+            }
+            return this.ancestors;
+        });
+    }
     getDevclasses() {
         return __awaiter(this, void 0, void 0, function* () {
             if (!this.devclasses) {

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export * from "./actions";
 export * from "./client";
 export * from "./commons";
+export * from "./connection";
 export * from "./manifest";
 export * from "./registry";
 export * from "./dependencies";

package/dist/index.js

@@ -17,6 +17,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./actions"), exports);
 __exportStar(require("./client"), exports);
 __exportStar(require("./commons"), exports);
+__exportStar(require("./connection"), exports);
 __exportStar(require("./manifest"), exports);
 __exportStar(require("./registry"), exports);
 __exportStar(require("./dependencies"), exports);

package/dist/lockfile/Lockfile.d.ts

@@ -8,16 +8,38 @@ export interface Lock {
 export interface LockfileContent {
     lockfileVersion: number;
     source: string;
+    /** Name of the locked (root) package. */
     name?: string;
+    /** Version of the locked (root) package. */
     version?: string;
+    /** Registry endpoint of the locked (root) package; not recorded for a package installed from a local file. */
+    registry?: string;
+    /** Integrity of the locked (root) release; not recorded when the source system has none. */
+    integrity?: string;
     packages?: Lock[];
 }
+/** Release of the locked (root) package recorded in a lockfile. */
+export interface RootLock {
+    name: string;
+    version: string;
+    registry?: string;
+    integrity?: string;
+}
 export declare class Lockfile {
     lockfile: LockfileContent;
     private constructor();
     static generate(root: TrmPackage, packages?: TrmPackage[]): Promise<Lockfile>;
     static fromJson(json: any): Lockfile;
     toJson(): string;
-    getLock(trmPackage: TrmPackage, versionRange: string): Lock;
+    /**
+     * Returns the locked (root) release, or `undefined` when the lockfile doesn't record it.
+     */
+    getRootLock(): RootLock | undefined;
+    /**
+     * Returns the lock of `trmPackage`, or `undefined` when the lockfile has no entry for it
+     * (a lockfile generated without the package installed on the source system).
+     * @throws When the locked version does not satisfy `versionRange`.
+     */
+    getLock(trmPackage: TrmPackage, versionRange: string): Lock | undefined;
     static testReleaseByLock(lock: Lock): Promise<boolean>;
 }

package/dist/lockfile/Lockfile.js

@@ -34,6 +34,16 @@ class Lockfile {
             var dependencies = rootManifest.dependencies || [];
             lock.name = rootManifest.name;
             lock.version = rootManifest.version;
+            if (root.registry.getRegistryType() !== registry_1.RegistryType.LOCAL) {
+                lock.registry = root.registry.endpoint;
+            }
+            const rootIntegrity = yield systemConnector_1.SystemConnector.getPackageIntegrity(root);
+            if (rootIntegrity) {
+                lock.integrity = rootIntegrity;
+            }
+            else {
+                trm_commons_1.Logger.warning(`Integrity of package "${rootManifest.name}" is missing in system ${systemConnector_1.SystemConnector.getDest()}: clean installs won't verify its release. Reinstall it to restore its package data.`, { important: true });
+            }
             for (const dep of dependencies) {
                 if (dep.registry === registry_1.LOCAL_RESERVED_KEYWORD) {
                     throw new Error(`Cannot generate lockfile: dependency with local package "${dep.name}"`);
@@ -48,6 +58,9 @@ class Lockfile {
                         if (depPackage) {
                             const depManifest = depPackage.manifest.get();
                             const depIntegrity = yield systemConnector_1.SystemConnector.getPackageIntegrity(depPackage);
+                            if (!depIntegrity) {
+                                throw new Error(`Cannot generate lockfile: integrity of dependency "${dep.name}", registry "${depRegistry.endpoint}" is missing in system ${systemConnector_1.SystemConnector.getDest()}. Reinstall it to restore its package data.`);
+                            }
                             lock.packages.push({
                                 name: dep.name,
                                 version: depManifest.version,
@@ -57,7 +70,7 @@ class Lockfile {
                             dependencies = dependencies.concat(depManifest.dependencies || []);
                         }
                         else {
-                            trm_commons_1.Logger.warning(`Dependency "${dep.name}", registry "${depRegistry.endpoint}" not found in system ${systemConnector_1.SystemConnector.getDest()}`);
+                            trm_commons_1.Logger.warning(`Dependency "${dep.name}", registry "${depRegistry.endpoint}" not found in system ${systemConnector_1.SystemConnector.getDest()}`, { important: true });
                         }
                     }
                 }
@@ -76,31 +89,54 @@ class Lockfile {
             "lockfileVersion",
             "source",
             "name",
-            "version"
+            "version",
+            "registry",
+            "integrity"
         ];
         return (0, commons_1.jsonStringifyWithKeyOrder)(this.lockfile, KEYS_ORDER, 2);
     }
+    /**
+     * Returns the locked (root) release, or `undefined` when the lockfile doesn't record it.
+     */
+    getRootLock() {
+        const { name, version, registry, integrity } = this.lockfile;
+        if (!name || !version) {
+            return undefined;
+        }
+        return { name, version, registry: registry || undefined, integrity: integrity || undefined };
+    }
+    /**
+     * Returns the lock of `trmPackage`, or `undefined` when the lockfile has no entry for it
+     * (a lockfile generated without the package installed on the source system).
+     * @throws When the locked version does not satisfy `versionRange`.
+     */
     getLock(trmPackage, versionRange) {
         var _a;
         const lock = (_a = this.lockfile.packages) === null || _a === void 0 ? void 0 : _a.find(o => trmPackage.compareName(o.name) && trmPackage.compareRegistry(registry_1.RegistryProvider.getRegistry(o.registry)));
-        if (!lock || !(0, semver_1.satisfies)(lock.version, versionRange)) {
-            throw new Error(`Lock for package "${trmPackage.packageName}", registry "${trmPackage.registry.endpoint}" not found`);
+        if (!lock) {
+            return undefined;
+        }
+        if (!(0, semver_1.satisfies)(lock.version, versionRange, { includePrerelease: true })) {
+            throw new Error(`Lock for package "${trmPackage.packageName}", registry "${trmPackage.registry.endpoint}" pins v${lock.version}, which does not satisfy ${versionRange}.`);
         }
         return lock;
     }
     static testReleaseByLock(lock) {
         return __awaiter(this, void 0, void 0, function* () {
+            if (!lock.integrity) {
+                throw new Error(`Lock for package "${lock.name}", registry "${lock.registry}" has no integrity: regenerate the lockfile.`);
+            }
             const registry = registry_1.RegistryProvider.getRegistry(lock.registry);
             const ping = yield registry.ping();
             const release = yield registry.getPackage(lock.name, lock.version);
             const artifact = yield registry.downloadArtifact(lock.name, lock.version);
             const checksum = (0, crypto_1.createHash)("sha512").update(artifact.binary).digest("base64");
             if (release.checksum !== lock.integrity || checksum !== lock.integrity) {
-                trm_commons_1.Logger.error(`SECURITY ISSUE! Release "${lock.name}", registry "${lock.registry}", integrity in lockfile does NOT match!`);
-                trm_commons_1.Logger.error(`SECURITY ISSUE! Registry SHA is ${release.checksum}`);
-                trm_commons_1.Logger.error(`SECURITY ISSUE! Artifact SHA is ${checksum}`);
-                trm_commons_1.Logger.error(`SECURITY ISSUE! Lockfile SHA is ${lock.integrity}`);
-                trm_commons_1.Logger.error(`SECURITY ISSUE! Please, report the issue to ${ping && ping.alert_email ? ping.alert_email : 'registry moderation team'}`);
+                trm_commons_1.Logger.error(`SECURITY ISSUE! Release "${lock.name}", registry "${lock.registry}", integrity in lockfile does NOT match!`, { important: true });
+                trm_commons_1.Logger.error(`SECURITY ISSUE! Registry SHA is ${release.checksum}`, { important: true });
+                trm_commons_1.Logger.error(`SECURITY ISSUE! Artifact SHA is ${checksum}`, { important: true });
+                trm_commons_1.Logger.error(`SECURITY ISSUE! Lockfile SHA is ${lock.integrity}`, { important: true });
+                trm_commons_1.Logger.error(`SECURITY ISSUE! Please, report the issue to ${ping && ping.alert_email ? ping.alert_email : 'registry moderation team'}`, { important: true });
                 return false;
             }
             return true;

package/dist/manifest/Manifest.d.ts

@@ -1,22 +1,26 @@
 import { TrmManifest } from "./TrmManifest";
-import { Transport } from "../transport";
 import { TrmPackage } from "../trmPackage";
 import { TrmManifestAuthor } from "./TrmManifestAuthor";
 export declare class Manifest {
     private _manifest;
     private _filePath?;
     constructor(_manifest: TrmManifest, _filePath?: string);
-    get(keepRuntimeValues?: boolean): TrmManifest;
+    get(): TrmManifest;
     getKey(keepVersion?: boolean): string;
     setDistFolder(dist: string): Manifest;
     setSrcFolder(src: string): Manifest;
-    setLinkedTransport(transport: Transport): Manifest;
-    getLinkedTransport(): Transport | null;
     setRegistryEndpoint(endpoint: string): void;
     getJSON(ignoredKeys?: string[]): string;
     getAbapXml(): string;
     getPackage(): TrmPackage;
-    static normalize(manifest: TrmManifest, keepRuntimeValues: boolean): TrmManifest;
+    /**
+     * Checks whether a dependency version is an acceptable semantic-version range.
+     *
+     * Stricter than `semver.validRange`: an empty or blank range (which semver reads as `*`)
+     * is rejected, so every dependency must declare an explicit range.
+     */
+    static isValidDependencyRange(range: unknown): boolean;
+    static normalize(manifest: TrmManifest): TrmManifest;
     static fromAbapXml(sXml: string): Manifest;
     static _parseAbapXmlSapEntriesArray(input: any): any[];
     static fromJson(sJson: string): Manifest;