@trustify-da/trustify-da-javascript-client 0.3.0-ea.02983f2 → 0.3.0-ea.0c4e031

package/dist/src/sbom.js

@@ -12,10 +12,11 @@ export default class Sbom {
     }
     /**
      * @param {PackageURL} root - add main/root component for sbom
+     * @param {string|Array} [licenses] - optional license(s) for the root component
      * @return Sbom
      */
-    addRoot(root) {
-        return this.sbomModel.addRoot(root);
+    addRoot(root, licenses) {
+        return this.sbomModel.addRoot(root, licenses);
     }
     /**
      * @return {{{"bom-ref": string, name, purl: string, type, version}}} root component of sbom.
@@ -42,10 +43,12 @@ export default class Sbom {
     /**
      * @param {component} sourceRef current source Component ( Starting from root component by clients)
      * @param {PackageURL} targetRef current dependency to add to Dependencies list of component sourceRef
+     * @param {string} [scope] - Scope of the dependency
+     * @param {Array<{alg: string, content: string}>} [targetHashes] - Optional hashes for the target component
      * @return Sbom
      */
-    addDependency(sourceRef, targetRef, scope) {
-        return this.sbomModel.addDependency(sourceRef, targetRef, scope);
+    addDependency(sourceRef, targetRef, scope, targetHashes) {
+        return this.sbomModel.addDependency(sourceRef, targetRef, scope, targetHashes);
     }
     /**
      * @return String sbom json in a string format
@@ -76,6 +79,15 @@ export default class Sbom {
     checkIfPackageInsideDependsOnList(component, name) {
         return this.sbomModel.checkIfPackageInsideDependsOnList(component, name);
     }
+    /**
+     * Checks if any entry in the dependsOn list of sourceRef starts with the given purl prefix.
+     * @param {PackageURL} sourceRef - The source component to check
+     * @param {string} purlPrefix - The purl prefix to match (e.g. "pkg:npm/minimist@")
+     * @return {boolean}
+     */
+    checkDependsOnByPurlPrefix(sourceRef, purlPrefix) {
+        return this.sbomModel.checkDependsOnByPurlPrefix(sourceRef, purlPrefix);
+    }
     /** Removes the root component from the sbom
      */
     removeRootComponent() {

package/dist/src/tools.d.ts

@@ -1,12 +1,10 @@
-/// <reference types="node" />
-/// <reference types="packageurl-js/src/package-url" />
 /**
  *
  * @param {string} key to log its value from environment variables and from opts, if it exists
  * @param {{}} [opts={}] different options of application, if key in it, log it.
  * @param {string }defValue default value of key in case there is no option and environment variable values for key
  */
-export function logValueFromObjects(key: string, opts?: {} | undefined, defValue: string): void;
+export function logValueFromObjects(key: string, opts?: {}, defValue: string): void;
 /**
  * Utility function will return the value for key from the environment variables,
  * if not present will return the value for key from the opts objects only if it's a string,
@@ -17,7 +15,7 @@ export function logValueFromObjects(key: string, opts?: {} | undefined, defValue
  * @returns {string|null} the value of the key found in the environment, options object, or the
  * 		default supplied
  */
-export function getCustom(key: string, def?: string | null | undefined, opts?: {} | undefined): string | null;
+export function getCustom(key: string, def?: string | null, opts?: {}): string | null;
 /**
  * Utility function for looking up custom variable for a binary path.
  * Will look in the environment variables (1) or in opts (2) for a key with TRUSTIFY_DA_x_PATH, x is an
@@ -28,7 +26,7 @@ export function getCustom(key: string, def?: string | null | undefined, opts?: {
  * @returns {string|null} the value of the key found in the environment, options object, or the
  * 		original name supplied
  */
-export function getCustomPath(name: any, opts?: {} | undefined): string | null;
+export function getCustomPath(name: any, opts?: {}): string | null;
 /**
  * Utility function for determining whether wrappers for build tools such as gradlew/mvnw should be
  * preferred over invoking the binary directly.
@@ -63,12 +61,56 @@ export function toPurlFromString(strPurl: any): PackageURL | null;
  * @param {string} cwd - directory for which to find the root of the git repository.
  */
 export function getGitRootDir(cwd: string): string | undefined;
+/**
+ * Normalize a filesystem path, lowercasing on Windows for case-insensitive comparison.
+ *
+ * @param {string} thePath
+ * @returns {string}
+ */
+export function normalizePath(thePath: string): string;
+/**
+ * Walk up from `startDir` to `repoRoot` looking for an executable wrapper script.
+ *
+ * @param {string} startDir - Absolute directory to start from
+ * @param {string} wrapperName - Wrapper filename (e.g. `mvnw`, `gradlew`)
+ * @param {string} [repoRoot] - Stop boundary (defaults to git root or filesystem root)
+ * @returns {string | undefined}
+ */
+export function traverseForWrapper(startDir: string, wrapperName: string, repoRoot?: string): string | undefined;
+/**
+ * Resolve a build-tool binary, preferring a wrapper when configured.
+ *
+ * @param {string} globalBinary - Global binary name (e.g. `mvn`, `gradle`)
+ * @param {string} localWrapper - Wrapper filename (e.g. `mvnw`, `gradlew.bat`)
+ * @param {string} startDir - Directory from which to start the wrapper search
+ * @param {import('./index.js').Options} [opts={}]
+ * @returns {string} Path to the resolved binary
+ */
+export function resolveBinary(globalBinary: string, localWrapper: string, startDir: string, opts?: import("./index.js").Options): string;
 /** this method invokes command string in a process in a synchronous way.
  * @param {string} bin - the command to be invoked
  * @param {Array<string>} args - the args to pass to the binary
  * @param {import('child_process').ExecFileOptionsWithStringEncoding} [opts={}]
  * @returns {string}
  */
-export function invokeCommand(bin: string, args: Array<string>, opts?: import("child_process").ExecFileOptionsWithStringEncoding | undefined): string;
+export function invokeCommand(bin: string, args: Array<string>, opts?: import("child_process").ExecFileOptionsWithStringEncoding): string;
+/**
+ * Adds proxy agent configuration to fetch options if a proxy URL is specified
+ * @param {RequestInit} options - The base fetch options
+ * @param {import("index.js").Options} opts - The trustify DA options that may contain proxy configuration
+ * @returns {RequestInit} The fetch options with proxy agent if applicable
+ */
+export function addProxyAgent(options: RequestInit, opts: any): RequestInit;
+/**
+ * Utility function for fetching vendor tokens
+ * @param {import("index.js").Options} [opts={}] - optional various options to pass along the application
+ * @returns {{}}
+ */
+export function getTokenHeaders(opts?: any): {};
 export const RegexNotToBeLogged: RegExp;
+export const TRUSTIFY_DA_TOKEN_HEADER: "trust-da-token";
+export const TRUSTIFY_DA_TELEMETRY_ID_HEADER: "telemetry-anonymous-id";
+export const TRUSTIFY_DA_SOURCE_HEADER: "trust-da-source";
+export const TRUSTIFY_DA_OPERATION_TYPE_HEADER: "trust-da-operation-type";
+export const TRUSTIFY_DA_PACKAGE_MANAGER_HEADER: "trust-da-pkg-manager";
 import { PackageURL } from "packageurl-js";

package/dist/src/tools.js

@@ -1,7 +1,10 @@
 import { execFileSync } from "child_process";
+import fs from 'node:fs';
+import path from 'node:path';
 import { EOL } from "os";
+import { HttpsProxyAgent } from "https-proxy-agent";
 import { PackageURL } from "packageurl-js";
-export const RegexNotToBeLogged = /TRUSTIFY_DA_.*_TOKEN|ex-.*-token/;
+export const RegexNotToBeLogged = /TRUSTIFY_DA_(.*_)?TOKEN|ex-.*-token|trust-.*-token/;
 /**
  *
  * @param {string} key to log its value from environment variables and from opts, if it exists
@@ -127,6 +130,62 @@ export function getGitRootDir(cwd) {
         return undefined;
     }
 }
+/**
+ * Normalize a filesystem path, lowercasing on Windows for case-insensitive comparison.
+ *
+ * @param {string} thePath
+ * @returns {string}
+ */
+export function normalizePath(thePath) {
+    const normalized = path.resolve(thePath).normalize();
+    return process.platform === 'win32' ? normalized.toLowerCase() : normalized;
+}
+/**
+ * Walk up from `startDir` to `repoRoot` looking for an executable wrapper script.
+ *
+ * @param {string} startDir - Absolute directory to start from
+ * @param {string} wrapperName - Wrapper filename (e.g. `mvnw`, `gradlew`)
+ * @param {string} [repoRoot] - Stop boundary (defaults to git root or filesystem root)
+ * @returns {string | undefined}
+ */
+export function traverseForWrapper(startDir, wrapperName, repoRoot = undefined) {
+    const currentDir = normalizePath(startDir);
+    repoRoot = repoRoot || getGitRootDir(currentDir) || path.parse(currentDir).root;
+    const wrapperPath = path.join(currentDir, wrapperName);
+    try {
+        fs.accessSync(wrapperPath, fs.constants.X_OK);
+        return wrapperPath;
+    }
+    catch {
+        const rootDir = path.parse(currentDir).root;
+        if (currentDir === repoRoot || currentDir === rootDir) {
+            return undefined;
+        }
+        const parentDir = path.dirname(currentDir);
+        if (parentDir === currentDir || parentDir === rootDir) {
+            return undefined;
+        }
+        return traverseForWrapper(parentDir, wrapperName, repoRoot);
+    }
+}
+/**
+ * Resolve a build-tool binary, preferring a wrapper when configured.
+ *
+ * @param {string} globalBinary - Global binary name (e.g. `mvn`, `gradle`)
+ * @param {string} localWrapper - Wrapper filename (e.g. `mvnw`, `gradlew.bat`)
+ * @param {string} startDir - Directory from which to start the wrapper search
+ * @param {import('./index.js').Options} [opts={}]
+ * @returns {string} Path to the resolved binary
+ */
+export function resolveBinary(globalBinary, localWrapper, startDir, opts = {}) {
+    if (getWrapperPreference(globalBinary, opts)) {
+        const wrapper = traverseForWrapper(startDir, localWrapper);
+        if (wrapper !== undefined) {
+            return wrapper;
+        }
+    }
+    return getCustomPath(globalBinary, opts);
+}
 /** this method invokes command string in a process in a synchronous way.
  * @param {string} bin - the command to be invoked
  * @param {Array<string>} args - the args to pass to the binary
@@ -157,3 +216,57 @@ export function invokeCommand(bin, args, opts = {}) {
     };
     return execFileSync(bin, args, { ...{ stdio: 'pipe', encoding: 'utf-8' }, ...opts });
 }
+export const TRUSTIFY_DA_TOKEN_HEADER = "trust-da-token";
+export const TRUSTIFY_DA_TELEMETRY_ID_HEADER = "telemetry-anonymous-id";
+export const TRUSTIFY_DA_SOURCE_HEADER = "trust-da-source";
+export const TRUSTIFY_DA_OPERATION_TYPE_HEADER = "trust-da-operation-type";
+export const TRUSTIFY_DA_PACKAGE_MANAGER_HEADER = "trust-da-pkg-manager";
+/**
+ * Adds proxy agent configuration to fetch options if a proxy URL is specified
+ * @param {RequestInit} options - The base fetch options
+ * @param {import("index.js").Options} opts - The trustify DA options that may contain proxy configuration
+ * @returns {RequestInit} The fetch options with proxy agent if applicable
+ */
+export function addProxyAgent(options, opts) {
+    const proxyUrl = getCustom('TRUSTIFY_DA_PROXY_URL', null, opts);
+    if (proxyUrl) {
+        options.agent = new HttpsProxyAgent(proxyUrl);
+    }
+    return options;
+}
+/**
+ * Utility function for fetching vendor tokens
+ * @param {import("index.js").Options} [opts={}] - optional various options to pass along the application
+ * @returns {{}}
+ */
+export function getTokenHeaders(opts = {}) {
+    let headers = {};
+    setCustomHeader(TRUSTIFY_DA_TOKEN_HEADER, headers, 'TRUSTIFY_DA_TOKEN', opts);
+    setCustomHeader(TRUSTIFY_DA_SOURCE_HEADER, headers, 'TRUSTIFY_DA_SOURCE', opts);
+    setCustomHeader(TRUSTIFY_DA_OPERATION_TYPE_HEADER, headers, TRUSTIFY_DA_OPERATION_TYPE_HEADER.toUpperCase().replaceAll("-", "_"), opts);
+    setCustomHeader(TRUSTIFY_DA_PACKAGE_MANAGER_HEADER, headers, TRUSTIFY_DA_PACKAGE_MANAGER_HEADER.toUpperCase().replaceAll("-", "_"), opts);
+    setCustomHeader(TRUSTIFY_DA_TELEMETRY_ID_HEADER, headers, 'TRUSTIFY_DA_TELEMETRY_ID', opts);
+    if (getCustom("TRUSTIFY_DA_DEBUG", null, opts) === "true") {
+        console.log("Headers Values to be sent to Trustify DA backend:" + EOL);
+        for (const headerKey in headers) {
+            if (!headerKey.match(RegexNotToBeLogged)) {
+                console.log(`${headerKey}: ${headers[headerKey]}`);
+            }
+        }
+    }
+    return headers;
+}
+/**
+ *
+ * @param {string} headerName - the header name to populate in request
+ * @param headers
+ * @param {string} optsKey - key in the options object to use the value for
+ * @param {import("index.js").Options} [opts={}] - options input object to fetch header values from
+ * @private
+ */
+function setCustomHeader(headerName, headers, optsKey, opts) {
+    let customHeaderValue = getCustom(optsKey, null, opts);
+    if (customHeaderValue) {
+        headers[headerName] = customHeaderValue;
+    }
+}

package/dist/src/updaters/maven_updater.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Updates dependency versions in a Maven pom.xml while preserving file formatting.
+ *
+ * Uses `fast-xml-parser` to understand the XML structure (dependencies and properties),
+ * then performs position-based string splice to replace version strings without altering
+ * any other formatting, comments, whitespace, or indentation.
+ *
+ * Supports `${property}` indirection: when a dependency's `<version>` is a property
+ * reference, the updater resolves the property chain (including recursive references)
+ * and updates the terminal property value in `<properties>` instead.
+ *
+ * @param {string} pomContent - the raw pom.xml file content
+ * @param {Array<{groupId: string, artifactId: string, newVersion: string}>} versionChanges -
+ *   list of version changes to apply
+ * @returns {{content: string, applied: Array, skipped: Array}} the updated content and
+ *   lists of applied and skipped changes
+ */
+export function updateMavenVersions(pomContent: string, versionChanges: Array<{
+    groupId: string;
+    artifactId: string;
+    newVersion: string;
+}>): {
+    content: string;
+    applied: any[];
+    skipped: any[];
+};

package/dist/src/updaters/maven_updater.js

@@ -0,0 +1,322 @@
+import { XMLParser } from 'fast-xml-parser';
+/**
+ * Extracts the trimmed text content of a simple XML element from a string block.
+ * @param {string} block - the XML text to search within
+ * @param {string} tagName - the element name whose content to extract
+ * @returns {string|null} the trimmed text content, or null if not found
+ */
+function extractTagContent(block, tagName) {
+    const openTag = `<${tagName}>`;
+    const closeTag = `</${tagName}>`;
+    const start = block.indexOf(openTag);
+    if (start === -1) {
+        return null;
+    }
+    const contentStart = start + openTag.length;
+    const end = block.indexOf(closeTag, contentStart);
+    if (end === -1) {
+        return null;
+    }
+    return block.substring(contentStart, end).trim();
+}
+/**
+ * Finds the character positions of an XML element's text content within the raw file.
+ * Returns the start (inclusive) and end (exclusive) offsets of the text between the
+ * opening and closing tags.
+ * @param {string} content - full raw XML content
+ * @param {number} searchStart - start offset to search from
+ * @param {number} searchEnd - end offset to search within
+ * @param {string} tagName - the element name whose content position to locate
+ * @returns {{start: number, end: number}|null} character offsets, or null if not found
+ */
+function findTagContentPosition(content, searchStart, searchEnd, tagName) {
+    const openTag = `<${tagName}>`;
+    const closeTag = `</${tagName}>`;
+    const tagStart = content.indexOf(openTag, searchStart);
+    if (tagStart === -1 || tagStart >= searchEnd) {
+        return null;
+    }
+    const contentStart = tagStart + openTag.length;
+    const tagEnd = content.indexOf(closeTag, contentStart);
+    if (tagEnd === -1 || tagEnd > searchEnd) {
+        return null;
+    }
+    return { start: contentStart, end: tagEnd };
+}
+/**
+ * Checks whether the character immediately following a tag prefix indicates
+ * that the prefix is the complete tag name (e.g. `<dependency>` vs `<dependencyManagement>`).
+ * @param {string} char - the character after the tag prefix
+ * @returns {boolean} true if the character terminates the tag name
+ */
+function isTagBoundary(char) {
+    return char === '>' || char === ' ' || char === '\t'
+        || char === '\n' || char === '\r' || char === '/';
+}
+/**
+ * Finds the text content position of a `<version>` element within the first
+ * `<dependency>` block matching the given groupId and artifactId.
+ * Searches through all `<dependency>` elements in the file, covering both
+ * `<dependencies>` and `<dependencyManagement>` sections.
+ * @param {string} content - full raw pom.xml content
+ * @param {string} groupId - the dependency's groupId to match
+ * @param {string} artifactId - the dependency's artifactId to match
+ * @returns {{start: number, end: number}|null} version content offsets, or null
+ */
+function findDependencyVersionPosition(content, groupId, artifactId) {
+    let searchStart = 0;
+    const TAG_PREFIX = '<dependency';
+    const CLOSE_TAG = '</dependency>';
+    while (searchStart < content.length) {
+        const start = content.indexOf(TAG_PREFIX, searchStart);
+        if (start === -1) {
+            break;
+        }
+        // Verify this is exactly <dependency> and not <dependencyManagement> etc.
+        const charAfterTag = content.charAt(start + TAG_PREFIX.length);
+        if (!isTagBoundary(charAfterTag)) {
+            searchStart = start + 1;
+            continue;
+        }
+        // Find closing </dependency>
+        const end = content.indexOf(CLOSE_TAG, start + TAG_PREFIX.length);
+        if (end === -1) {
+            break;
+        }
+        const blockEnd = end + CLOSE_TAG.length;
+        const block = content.substring(start, blockEnd);
+        const gid = extractTagContent(block, 'groupId');
+        const aid = extractTagContent(block, 'artifactId');
+        if (gid === groupId && aid === artifactId) {
+            const pos = findTagContentPosition(content, start, blockEnd, 'version');
+            if (pos) {
+                return pos;
+            }
+            // Matching dependency but no <version> element; continue searching
+            // (the version may be in <dependencyManagement>)
+        }
+        searchStart = blockEnd;
+    }
+    return null;
+}
+/**
+ * Finds the text content position of a property element inside a `<properties>` block.
+ * Searches through all `<properties>` blocks in the file.
+ * @param {string} content - full raw pom.xml content
+ * @param {string} propName - the property element name to locate
+ * @returns {{start: number, end: number}|null} property value offsets, or null
+ */
+function findPropertyPosition(content, propName) {
+    let searchStart = 0;
+    const TAG_PREFIX = '<properties';
+    const CLOSE_TAG = '</properties>';
+    while (searchStart < content.length) {
+        const propsStart = content.indexOf(TAG_PREFIX, searchStart);
+        if (propsStart === -1) {
+            break;
+        }
+        // Verify this is exactly <properties> and not some other tag
+        const charAfter = content.charAt(propsStart + TAG_PREFIX.length);
+        if (!isTagBoundary(charAfter)) {
+            searchStart = propsStart + 1;
+            continue;
+        }
+        const propsCloseStart = content.indexOf(CLOSE_TAG, propsStart);
+        if (propsCloseStart === -1) {
+            break;
+        }
+        const propsBlockEnd = propsCloseStart + CLOSE_TAG.length;
+        const result = findTagContentPosition(content, propsStart, propsBlockEnd, propName);
+        if (result) {
+            return result;
+        }
+        searchStart = propsBlockEnd;
+    }
+    return null;
+}
+/**
+ * Resolves a Maven property chain, following `${propName}` references through
+ * the properties map until a concrete (non-reference) value is reached.
+ * Detects circular references via a visited set.
+ * @param {string} propName - the initial property name to resolve
+ * @param {Object} properties - properties map from the parsed XML
+ * @param {Set<string>} [visited] - visited property names (for cycle detection)
+ * @returns {{terminalPropName: string, resolvedValue: string}|{error: string}}
+ */
+function resolvePropertyChain(propName, properties, visited = new Set()) {
+    if (visited.has(propName)) {
+        const chain = [...visited, propName].join(' -> ');
+        return { error: `Circular property reference detected: ${chain}` };
+    }
+    visited.add(propName);
+    const value = properties[propName];
+    if (value == null) {
+        return { error: `Property '${propName}' not found in <properties>` };
+    }
+    const valueStr = String(value);
+    const propMatch = valueStr.match(/^\$\{(.+)\}$/);
+    if (propMatch) {
+        return resolvePropertyChain(propMatch[1], properties, visited);
+    }
+    return { terminalPropName: propName, resolvedValue: valueStr };
+}
+/**
+ * Updates dependency versions in a Maven pom.xml while preserving file formatting.
+ *
+ * Uses `fast-xml-parser` to understand the XML structure (dependencies and properties),
+ * then performs position-based string splice to replace version strings without altering
+ * any other formatting, comments, whitespace, or indentation.
+ *
+ * Supports `${property}` indirection: when a dependency's `<version>` is a property
+ * reference, the updater resolves the property chain (including recursive references)
+ * and updates the terminal property value in `<properties>` instead.
+ *
+ * @param {string} pomContent - the raw pom.xml file content
+ * @param {Array<{groupId: string, artifactId: string, newVersion: string}>} versionChanges -
+ *   list of version changes to apply
+ * @returns {{content: string, applied: Array, skipped: Array}} the updated content and
+ *   lists of applied and skipped changes
+ */
+export function updateMavenVersions(pomContent, versionChanges) {
+    if (!versionChanges || versionChanges.length === 0) {
+        return { content: pomContent, applied: [], skipped: [] };
+    }
+    const parser = new XMLParser({
+        parseTagValue: false,
+        commentPropName: '#comment',
+    });
+    let parsed;
+    try {
+        parsed = parser.parse(pomContent);
+    }
+    catch (e) {
+        return {
+            content: pomContent,
+            applied: [],
+            skipped: versionChanges.map(vc => ({
+                groupId: vc.groupId,
+                artifactId: vc.artifactId,
+                newVersion: vc.newVersion,
+                reason: `Failed to parse pom.xml: ${e.message}`,
+            })),
+        };
+    }
+    const project = parsed?.project;
+    if (!project) {
+        return {
+            content: pomContent,
+            applied: [],
+            skipped: versionChanges.map(vc => ({
+                groupId: vc.groupId,
+                artifactId: vc.artifactId,
+                newVersion: vc.newVersion,
+                reason: 'No <project> element found in pom.xml',
+            })),
+        };
+    }
+    const properties = project.properties || {};
+    const applied = [];
+    const skipped = [];
+    /** @type {Map<number, {start: number, end: number, newValue: string}>} */
+    const replacementsByPosition = new Map();
+    for (const change of versionChanges) {
+        const versionPos = findDependencyVersionPosition(pomContent, change.groupId, change.artifactId);
+        if (!versionPos) {
+            skipped.push({
+                groupId: change.groupId,
+                artifactId: change.artifactId,
+                newVersion: change.newVersion,
+                reason: 'Dependency not found in pom.xml or has no <version> element',
+            });
+            continue;
+        }
+        const currentVersion = pomContent.substring(versionPos.start, versionPos.end);
+        const propMatch = currentVersion.match(/^\$\{(.+)\}$/);
+        if (propMatch) {
+            const resolved = resolvePropertyChain(propMatch[1], properties);
+            if (resolved.error) {
+                skipped.push({
+                    groupId: change.groupId,
+                    artifactId: change.artifactId,
+                    newVersion: change.newVersion,
+                    reason: resolved.error,
+                });
+                continue;
+            }
+            const propPos = findPropertyPosition(pomContent, resolved.terminalPropName);
+            if (!propPos) {
+                skipped.push({
+                    groupId: change.groupId,
+                    artifactId: change.artifactId,
+                    newVersion: change.newVersion,
+                    reason: `Could not locate property '${resolved.terminalPropName}' in pom.xml`,
+                });
+                continue;
+            }
+            // Deduplicate: multiple deps may share the same property
+            const existing = replacementsByPosition.get(propPos.start);
+            if (existing) {
+                if (existing.newValue !== change.newVersion) {
+                    skipped.push({
+                        groupId: change.groupId,
+                        artifactId: change.artifactId,
+                        newVersion: change.newVersion,
+                        reason: `Property '${resolved.terminalPropName}' already targeted `
+                            + `with a different version '${existing.newValue}'`,
+                    });
+                    continue;
+                }
+                // Same replacement already queued; record as applied without duplicating
+            }
+            else {
+                replacementsByPosition.set(propPos.start, {
+                    start: propPos.start,
+                    end: propPos.end,
+                    newValue: change.newVersion,
+                });
+            }
+            applied.push({
+                groupId: change.groupId,
+                artifactId: change.artifactId,
+                newVersion: change.newVersion,
+                type: 'property',
+                property: resolved.terminalPropName,
+            });
+        }
+        else {
+            const existing = replacementsByPosition.get(versionPos.start);
+            if (existing) {
+                if (existing.newValue !== change.newVersion) {
+                    skipped.push({
+                        groupId: change.groupId,
+                        artifactId: change.artifactId,
+                        newVersion: change.newVersion,
+                        reason: `Version already targeted with a different version '${existing.newValue}'`,
+                    });
+                    continue;
+                }
+            }
+            else {
+                replacementsByPosition.set(versionPos.start, {
+                    start: versionPos.start,
+                    end: versionPos.end,
+                    newValue: change.newVersion,
+                });
+            }
+            applied.push({
+                groupId: change.groupId,
+                artifactId: change.artifactId,
+                newVersion: change.newVersion,
+                type: 'direct',
+            });
+        }
+    }
+    // Sort replacements by position descending to preserve offsets during splice
+    const sortedReplacements = [...replacementsByPosition.values()]
+        .sort((a, b) => b.start - a.start);
+    let result = pomContent;
+    for (const r of sortedReplacements) {
+        result = result.substring(0, r.start) + r.newValue + result.substring(r.end);
+    }
+    return { content: result, applied, skipped };
+}

package/dist/src/workspace.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Resolve ignore globs for workspace discovery: defaults + `TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE` + `opts.workspaceDiscoveryIgnore`.
+ * Patterns are fast-glob / micromatch style, relative to the workspace root (forward slashes).
+ *
+ * @param {{ workspaceDiscoveryIgnore?: string[], TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string, [key: string]: unknown }} [opts={}]
+ * @returns {string[]}
+ */
+export function resolveWorkspaceDiscoveryIgnore(opts?: {
+    workspaceDiscoveryIgnore?: string[];
+    TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string;
+    [key: string]: unknown;
+}): string[];
+/**
+ * Drop manifest paths whose location matches an ignore pattern (e.g. root unshift, Cargo paths).
+ *
+ * @param {string[]} manifestPaths
+ * @param {string} root
+ * @param {string[]} ignorePatterns
+ * @returns {string[]}
+ */
+export function filterManifestPathsByDiscoveryIgnore(manifestPaths: string[], root: string, ignorePatterns: string[]): string[];
+/**
+ * @typedef {{ valid: true, name: string, version: string } | { valid: false, error: string }} ValidatePackageJsonResult
+ */
+/**
+ * Validate a package.json has non-empty `name` and `version` (required for stable SBOM root identity in batch).
+ *
+ * @param {string} packageJsonPath - Absolute or relative path to package.json
+ * @returns {ValidatePackageJsonResult}
+ */
+export function validatePackageJson(packageJsonPath: string): ValidatePackageJsonResult;
+/**
+ * Discover all package.json paths in a JS/TS workspace.
+ * Reads pnpm-workspace.yaml or package.json workspaces.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root
+ * @param {{ workspaceDiscoveryIgnore?: string[], TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string, [key: string]: unknown }} [opts={}] - optional `workspaceDiscoveryIgnore` globs (merged with defaults and env)
+ * @returns {Promise<string[]>} Paths to package.json files (absolute)
+ */
+export function discoverWorkspacePackages(workspaceRoot: string, opts?: {
+    workspaceDiscoveryIgnore?: string[];
+    TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string;
+    [key: string]: unknown;
+}): Promise<string[]>;
+/**
+ * Convert workspace glob patterns to manifest-file glob patterns,
+ * correctly handling negation prefixes.
+ *
+ * @param {string[]} patterns - Workspace glob patterns (may include negations)
+ * @param {string} manifestFileName - e.g. 'package.json' or 'Cargo.toml'
+ * @returns {string[]}
+ */
+export function toManifestGlobPatterns(patterns: string[], manifestFileName: string): string[];
+/**
+ * Discover all Cargo.toml manifest paths in a Cargo workspace.
+ * Uses `cargo metadata` to get workspace members.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain Cargo.toml and Cargo.lock)
+ * @param {import('./index.js').Options} [opts={}]
+ * @returns {Promise<string[]>} Paths to Cargo.toml files (absolute)
+ */
+export function discoverWorkspaceCrates(workspaceRoot: string, opts?: import("./index.js").Options): Promise<string[]>;
+export type ValidatePackageJsonResult = {
+    valid: true;
+    name: string;
+    version: string;
+} | {
+    valid: false;
+    error: string;
+};