Loading SOVA...
Loading SOVA...
SOVA writes a single sova-manifest.json file. This document describes every field in the output.
interface SovaManifest {
version: string; // Schema version (e.g. "1.0")
generatedAt: string; // ISO 8601 timestamp
tool: { name: string; version: string };
project: { name: string; version: string; path: string };
scan: ScanSummary;
applications: Record<string, string[]>;
dependencyGraph: Record<string, string[]>;
files: FileEntry[];
fileResults: FileResult[];
securitySignals: ManifestSecuritySignals;
}versionstringThe schema version of the manifest. Current value: "1.0".
generatedAtstringISO 8601 UTC timestamp of when the scan completed (e.g. "2026-04-09T14:23:01.456Z").
toolobjectname@securenexus/sovaversionprojectobjectnamepackage.json name field, or directory name if not found)versionpath. if --strip-paths was used)scanScanSummarylanguagesDetectedtotalFilestotalDependencieshasLockFilesapplicationsRecord<string, string[]>Dependencies grouped by language in "package_:_version" format. This matches the PackageFetchRequest.applications format used by SecureNexus backend.
{
"javascript": ["express_:_4.18.2", "lodash_:_4.17.21"],
"python": ["requests_:_2.31.0", "boto3_:_1.28.0"]
}dependencyGraphRecord<string, string[]>Adjacency list built from lock files. Keys and values use the same "package_:_version" format. Each key maps to its direct children. Empty ({}) when no lock files were found.
{
"express_:_4.18.2": ["accepts_:_1.3.8", "body-parser_:_1.20.2"],
"accepts_:_1.3.8": ["mime-types_:_2.1.35", "negotiator_:_0.6.3"]
}filesFileEntry[]Lightweight per-file summary entries:
interface FileEntry {
path: string; // Relative path within project
language: string; // e.g. "javascript"
packageManager: string; // e.g. "npm"
fileType: 'manifest' | 'lockfile';
dependencyCount: number;
}fileResultsFileResult[]Detailed parse results including the full dependency list per file:
interface FileResult {
file: string;
language: string;
packageManager: string;
fileType: 'manifest' | 'lockfile';
dependencies: string[]; // "package_:_version" list
additionalDependencies: Record<string, string[]>; // graph from lock file
}securitySignalsManifestSecuritySignalstotalSignalscriticalhighmediumlowsignalsEach SecuritySignal:
interface SecuritySignal {
file: string; // Relative file path
language: string; // Language ecosystem
category: string; // e.g. "install-script"
type: string; // Short identifier, e.g. "npm-preinstall-script"
description: string; // Human-readable description
severity: string; // "critical" | "high" | "medium" | "low" | "info"
content?: string; // File snippet (max 500 chars), if --include-signal-content
}{
"version": "1.0",
"generatedAt": "2026-04-09T14:23:01.456Z",
"tool": { "name": "@securenexus/sova", "version": "1.0.0" },
"project": { "name": "my-app", "version": "2.1.0", "path": "/home/user/my-app" },
"scan": {
"languagesDetected": ["javascript", "python"],
"totalFiles": 3,
"totalDependencies": 261,
"hasLockFiles": true
},
"applications": {
"javascript": ["express_:_4.18.2", "lodash_:_4.17.21"],
"python": ["requests_:_2.31.0"]
},
"dependencyGraph": {
"express_:_4.18.2": ["accepts_:_1.3.8"]
},
"files": [
{
"path": "package.json",
"language": "javascript",
"packageManager": "npm",
"fileType": "manifest",
"dependencyCount": 12
},
{
"path": "package-lock.json",
"language": "javascript",
"packageManager": "npm",
"fileType": "lockfile",
"dependencyCount": 249
}
],
"fileResults": [],
"securitySignals": {
"totalSignals": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"signals": []
}
}