Struct NpmAttestationClient 

pub struct NpmAttestationClient { /* private fields */ }

Implementations

impl NpmAttestationClient

pub fn new() -> Result<Self>

pub fn fetch_provenance( &self, name: &str, version: &str, ) -> Result<Option<NpmProvenance>>

Fetch provenance for a single package version. Returns None if the package has no SLSA provenance attestation.

pub fn enrich_npm_deps(&self, deps: &mut [DependencySignatureEvidence])

Enrich npm dependencies in-place with provenance data from the attestation API. Non-npm dependencies and dependencies that lack attestations are left unchanged.

Uses a bounded worker pool (CONCURRENCY threads) to handle large dependency trees efficiently. Progress is reported to stderr.