@trustify-da/trustify-da-javascript-client 0.3.0-ea.243eaef → 0.3.0-ea.24dd325

package/dist/src/tools.d.ts

@@ -6,24 +6,22 @@
  */
 export function logValueFromObjects(key: string, opts?: {}, defValue: string): void;
 /**
- * Utility function will return the value for key from the environment variables,
- * if not present will return the value for key from the opts objects only if it's a string,
- * if not present, or not string will return the default value supplied which default to null.
+ * Utility function returns the value for key from opts, then environment variables,
+ * then the supplied default. Values from opts are used only if they are strings.
  * @param {string} key the key to look for in the environment variables and the opts object
  * @param {string|null} [def=null] the value to return if nothing else found
- * @param {{}} [opts={}] the options object to look for the key in if not found in environment
- * @returns {string|null} the value of the key found in the environment, options object, or the
+ * @param {{}} [opts={}] the options object to check before the environment
+ * @returns {string|null} the value of the key found in the options object, environment, or the
  * 		default supplied
  */
 export function getCustom(key: string, def?: string | null, opts?: {}): string | null;
 /**
  * Utility function for looking up custom variable for a binary path.
- * Will look in the environment variables (1) or in opts (2) for a key with TRUSTIFY_DA_x_PATH, x is an
- * uppercase version of passed name to look for. The name will also be returned if nothing else was
- * found.
+ * Looks in opts, then environment variables, for a key with TRUSTIFY_DA_x_PATH, where x is an
+ * uppercase version of the supplied name. The name is returned if neither contains the key.
  * @param name the binary name to look for, will be returned as value in nothing else found
- * @param {{}} [opts={}] the options object to look for the key in if not found in environment
- * @returns {string|null} the value of the key found in the environment, options object, or the
+ * @param {{}} [opts={}] the options object to check before the environment
+ * @returns {string|null} the value of the key found in the options object, environment, or the
  * 		original name supplied
  */
 export function getCustomPath(name: any, opts?: {}): string | null;
@@ -31,7 +29,7 @@ export function getCustomPath(name: any, opts?: {}): string | null;
  * Utility function for determining whether wrappers for build tools such as gradlew/mvnw should be
  * preferred over invoking the binary directly.
  * @param {string} name - binary for which to search for its wrapper
- * @param {{}} opts - the options object to look for the key in if not found in environment
+ * @param {{}} opts - the options object to check before the environment
  * @returns {boolean} whether to prefer the wrapper if exists or not
  */
 export function getWrapperPreference(name: string, opts?: {}): boolean;

package/dist/src/tools.js

@@ -27,20 +27,19 @@ export function logValueFromObjects(key, opts, defValue) {
     console.log(`default value for ${key} = ${defValue} ${EOL}`);
 }
 /**
- * Utility function will return the value for key from the environment variables,
- * if not present will return the value for key from the opts objects only if it's a string,
- * if not present, or not string will return the default value supplied which default to null.
+ * Utility function returns the value for key from opts, then environment variables,
+ * then the supplied default. Values from opts are used only if they are strings.
  * @param {string} key the key to look for in the environment variables and the opts object
  * @param {string|null} [def=null] the value to return if nothing else found
- * @param {{}} [opts={}] the options object to look for the key in if not found in environment
- * @returns {string|null} the value of the key found in the environment, options object, or the
+ * @param {{}} [opts={}] the options object to check before the environment
+ * @returns {string|null} the value of the key found in the options object, environment, or the
  * 		default supplied
  */
 export function getCustom(key, def = null, opts = {}) {
     if (process.env["TRUSTIFY_DA_DEBUG"] === "true" && !key.match(RegexNotToBeLogged)) {
         logValueFromObjects(key, opts, def);
     }
-    return key in process.env ? process.env[key] : key in opts && typeof opts[key] === 'string' ? opts[key] : def;
+    return key in opts && typeof opts[key] === 'string' ? opts[key] : key in process.env ? process.env[key] : def;
 }
 /**
  * Validates that an executable path does not use directory traversal or relative segments.
@@ -66,12 +65,11 @@ function validateExecutablePath(binPath) {
 }
 /**
  * Utility function for looking up custom variable for a binary path.
- * Will look in the environment variables (1) or in opts (2) for a key with TRUSTIFY_DA_x_PATH, x is an
- * uppercase version of passed name to look for. The name will also be returned if nothing else was
- * found.
+ * Looks in opts, then environment variables, for a key with TRUSTIFY_DA_x_PATH, where x is an
+ * uppercase version of the supplied name. The name is returned if neither contains the key.
  * @param name the binary name to look for, will be returned as value in nothing else found
- * @param {{}} [opts={}] the options object to look for the key in if not found in environment
- * @returns {string|null} the value of the key found in the environment, options object, or the
+ * @param {{}} [opts={}] the options object to check before the environment
+ * @returns {string|null} the value of the key found in the options object, environment, or the
  * 		original name supplied
  */
 export function getCustomPath(name, opts = {}) {
@@ -82,7 +80,7 @@ export function getCustomPath(name, opts = {}) {
  * Utility function for determining whether wrappers for build tools such as gradlew/mvnw should be
  * preferred over invoking the binary directly.
  * @param {string} name - binary for which to search for its wrapper
- * @param {{}} opts - the options object to look for the key in if not found in environment
+ * @param {{}} opts - the options object to check before the environment
  * @returns {boolean} whether to prefer the wrapper if exists or not
  */
 export function getWrapperPreference(name, opts = {}) {

package/dist/src/updaters/maven_updater.d.ts

@@ -1,3 +1,23 @@
+/**
+ * One entry in {@link updateMavenVersions}' `applied` list: a version that was changed and
+ * where. `type` discriminates the edit site — `'direct'` for a dependency's own `<version>`,
+ * `'property'` for a `${property}` reference (then `property` names the resolved property).
+ * @typedef {{
+ *   groupId: string,
+ *   artifactId: string,
+ *   newVersion: string,
+ *   type: ('direct'|'property'),
+ *   property?: string
+ * }} MavenAppliedChange
+ */
+/**
+ * Stable edit-site key for a Maven change: same key => same commit/PR. Deps whose versions
+ * resolve to one `${property}` share the property key and are therefore inseparable.
+ * @param {string} manifestPath
+ * @param {MavenAppliedChange} applied
+ * @returns {string}
+ */
+export function mavenChangeKey(manifestPath: string, applied: MavenAppliedChange): string;
 /**
  * Updates dependency versions in a Maven pom.xml while preserving file formatting.
  *
@@ -10,17 +30,29 @@
  * and updates the terminal property value in `<properties>` instead.
  *
  * @param {string} pomContent - the raw pom.xml file content
- * @param {Array<{groupId: string, artifactId: string, newVersion: string}>} versionChanges -
- *   list of version changes to apply
- * @returns {{content: string, applied: Array, skipped: Array}} the updated content and
+ * @param {import('../remediate.js').VersionChangeRequest[]} versionChanges - list of version changes to apply
+ * @returns {{content: string, applied: MavenAppliedChange[], skipped: Array<{groupId: string, artifactId: string, newVersion: string, reason: string}>}} the updated content and
  *   lists of applied and skipped changes
  */
-export function updateMavenVersions(pomContent: string, versionChanges: Array<{
+export function updateMavenVersions(pomContent: string, versionChanges: import("../remediate.js").VersionChangeRequest[]): {
+    content: string;
+    applied: MavenAppliedChange[];
+    skipped: Array<{
+        groupId: string;
+        artifactId: string;
+        newVersion: string;
+        reason: string;
+    }>;
+};
+/**
+ * One entry in {@link updateMavenVersions}' `applied` list: a version that was changed and
+ * where. `type` discriminates the edit site — `'direct'` for a dependency's own `<version>`,
+ * `'property'` for a `${property}` reference (then `property` names the resolved property).
+ */
+export type MavenAppliedChange = {
     groupId: string;
     artifactId: string;
     newVersion: string;
-}>): {
-    content: string;
-    applied: any[];
-    skipped: any[];
+    type: ("direct" | "property");
+    property?: string;
 };

package/dist/src/updaters/maven_updater.js

@@ -160,6 +160,30 @@ function resolvePropertyChain(propName, properties, visited = new Set()) {
     }
     return { terminalPropName: propName, resolvedValue: valueStr };
 }
+/**
+ * One entry in {@link updateMavenVersions}' `applied` list: a version that was changed and
+ * where. `type` discriminates the edit site — `'direct'` for a dependency's own `<version>`,
+ * `'property'` for a `${property}` reference (then `property` names the resolved property).
+ * @typedef {{
+ *   groupId: string,
+ *   artifactId: string,
+ *   newVersion: string,
+ *   type: ('direct'|'property'),
+ *   property?: string
+ * }} MavenAppliedChange
+ */
+/**
+ * Stable edit-site key for a Maven change: same key => same commit/PR. Deps whose versions
+ * resolve to one `${property}` share the property key and are therefore inseparable.
+ * @param {string} manifestPath
+ * @param {MavenAppliedChange} applied
+ * @returns {string}
+ */
+export function mavenChangeKey(manifestPath, applied) {
+    return applied.type === 'property'
+        ? `mvn:prop:${manifestPath}:${applied.property}`
+        : `mvn:direct:${manifestPath}:${applied.groupId}:${applied.artifactId}`;
+}
 /**
  * Updates dependency versions in a Maven pom.xml while preserving file formatting.
  *
@@ -172,9 +196,8 @@ function resolvePropertyChain(propName, properties, visited = new Set()) {
  * and updates the terminal property value in `<properties>` instead.
  *
  * @param {string} pomContent - the raw pom.xml file content
- * @param {Array<{groupId: string, artifactId: string, newVersion: string}>} versionChanges -
- *   list of version changes to apply
- * @returns {{content: string, applied: Array, skipped: Array}} the updated content and
+ * @param {import('../remediate.js').VersionChangeRequest[]} versionChanges - list of version changes to apply
+ * @returns {{content: string, applied: MavenAppliedChange[], skipped: Array<{groupId: string, artifactId: string, newVersion: string, reason: string}>}} the updated content and
  *   lists of applied and skipped changes
  */
 export function updateMavenVersions(pomContent, versionChanges) {

package/dist/src/updaters/toml_updater.d.ts

@@ -1,3 +1,26 @@
+/**
+ * One entry in {@link updateTomlVersions}' `applied` list: a version that was changed and where.
+ * `type` discriminates the edit site — `'ref'` for a `[libraries]` entry pointing at a shared
+ * `[versions]` alias via `version.ref` (then `versionRef` names that alias), `'inline'` for a
+ * version declared directly on the library. `alias` is the library's catalog key in both cases.
+ * @typedef {{
+ *   groupId: string,
+ *   artifactId: string,
+ *   newVersion: string,
+ *   oldVersion: string,
+ *   type: ('ref'|'inline'),
+ *   alias: string,
+ *   versionRef?: string
+ * }} TomlAppliedChange
+ */
+/**
+ * Stable edit-site key for a TOML (Gradle version catalog) change: same key => same commit/PR.
+ * Deps sharing one `[versions]` alias via `version.ref` share the ref key and are inseparable.
+ * @param {string} manifestPath
+ * @param {TomlAppliedChange} applied
+ * @returns {string}
+ */
+export function tomlChangeKey(manifestPath: string, applied: TomlAppliedChange): string;
 /**
  * Updates dependency versions in a Gradle version catalog (libs.versions.toml) file.
  *
@@ -9,21 +32,12 @@
  * on the raw content to preserve formatting and comments.
  *
  * @param {string} tomlContent - raw TOML file content
- * @param {Array<{groupId: string, artifactId: string, newVersion: string}>} versionChanges
- * @returns {{content: string, applied: Array<{groupId: string, artifactId: string, newVersion: string, oldVersion: string}>, skipped: Array<{groupId: string, artifactId: string, newVersion: string, reason: string}>}}
+ * @param {import('../remediate.js').VersionChangeRequest[]} versionChanges
+ * @returns {{content: string, applied: TomlAppliedChange[], skipped: Array<{groupId: string, artifactId: string, newVersion: string, reason: string}>}}
  */
-export function updateTomlVersions(tomlContent: string, versionChanges: Array<{
-    groupId: string;
-    artifactId: string;
-    newVersion: string;
-}>): {
+export function updateTomlVersions(tomlContent: string, versionChanges: import("../remediate.js").VersionChangeRequest[]): {
     content: string;
-    applied: Array<{
-        groupId: string;
-        artifactId: string;
-        newVersion: string;
-        oldVersion: string;
-    }>;
+    applied: TomlAppliedChange[];
     skipped: Array<{
         groupId: string;
         artifactId: string;
@@ -31,3 +45,18 @@ export function updateTomlVersions(tomlContent: string, versionChanges: Array<{
         reason: string;
     }>;
 };
+/**
+ * One entry in {@link updateTomlVersions}' `applied` list: a version that was changed and where.
+ * `type` discriminates the edit site — `'ref'` for a `[libraries]` entry pointing at a shared
+ * `[versions]` alias via `version.ref` (then `versionRef` names that alias), `'inline'` for a
+ * version declared directly on the library. `alias` is the library's catalog key in both cases.
+ */
+export type TomlAppliedChange = {
+    groupId: string;
+    artifactId: string;
+    newVersion: string;
+    oldVersion: string;
+    type: ("ref" | "inline");
+    alias: string;
+    versionRef?: string;
+};

package/dist/src/updaters/toml_updater.js

@@ -1,4 +1,31 @@
 import { parse as parseToml } from 'smol-toml';
+/**
+ * One entry in {@link updateTomlVersions}' `applied` list: a version that was changed and where.
+ * `type` discriminates the edit site — `'ref'` for a `[libraries]` entry pointing at a shared
+ * `[versions]` alias via `version.ref` (then `versionRef` names that alias), `'inline'` for a
+ * version declared directly on the library. `alias` is the library's catalog key in both cases.
+ * @typedef {{
+ *   groupId: string,
+ *   artifactId: string,
+ *   newVersion: string,
+ *   oldVersion: string,
+ *   type: ('ref'|'inline'),
+ *   alias: string,
+ *   versionRef?: string
+ * }} TomlAppliedChange
+ */
+/**
+ * Stable edit-site key for a TOML (Gradle version catalog) change: same key => same commit/PR.
+ * Deps sharing one `[versions]` alias via `version.ref` share the ref key and are inseparable.
+ * @param {string} manifestPath
+ * @param {TomlAppliedChange} applied
+ * @returns {string}
+ */
+export function tomlChangeKey(manifestPath, applied) {
+    return applied.type === 'ref'
+        ? `toml:ref:${manifestPath}:${applied.versionRef}`
+        : `toml:inline:${manifestPath}:${applied.alias}`;
+}
 /**
  * Updates dependency versions in a Gradle version catalog (libs.versions.toml) file.
  *
@@ -10,8 +37,8 @@ import { parse as parseToml } from 'smol-toml';
  * on the raw content to preserve formatting and comments.
  *
  * @param {string} tomlContent - raw TOML file content
- * @param {Array<{groupId: string, artifactId: string, newVersion: string}>} versionChanges
- * @returns {{content: string, applied: Array<{groupId: string, artifactId: string, newVersion: string, oldVersion: string}>, skipped: Array<{groupId: string, artifactId: string, newVersion: string, reason: string}>}}
+ * @param {import('../remediate.js').VersionChangeRequest[]} versionChanges
+ * @returns {{content: string, applied: TomlAppliedChange[], skipped: Array<{groupId: string, artifactId: string, newVersion: string, reason: string}>}}
  */
 export function updateTomlVersions(tomlContent, versionChanges) {
     const applied = [];
@@ -77,7 +104,10 @@ export function updateTomlVersions(tomlContent, versionChanges) {
                 groupId: change.groupId,
                 artifactId: change.artifactId,
                 newVersion: change.newVersion,
-                oldVersion
+                oldVersion,
+                type: 'ref',
+                versionRef,
+                alias
             });
         }
         else {
@@ -107,7 +137,9 @@ export function updateTomlVersions(tomlContent, versionChanges) {
                     groupId: change.groupId,
                     artifactId: change.artifactId,
                     newVersion: change.newVersion,
-                    oldVersion: inlineVersion
+                    oldVersion: inlineVersion,
+                    type: 'inline',
+                    alias
                 });
             }
             else {

package/dist/src/workspace.d.ts

@@ -1,5 +1,6 @@
 /**
- * Resolve ignore globs for workspace discovery: defaults + `TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE` + `opts.workspaceDiscoveryIgnore`.
+ * Resolve ignore globs for workspace discovery. Unlike scalar options, ignore patterns are additive:
+ * defaults + `opts.TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE`/environment + `opts.workspaceDiscoveryIgnore`.
  * Patterns are fast-glob / micromatch style, relative to the workspace root (forward slashes).
  *
  * @param {{ workspaceDiscoveryIgnore?: string[], TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string, [key: string]: unknown }} [opts={}]

package/dist/src/workspace.js

@@ -10,7 +10,8 @@ const DEFAULT_WORKSPACE_DISCOVERY_IGNORE = [
     '**/.git/**',
 ];
 /**
- * Resolve ignore globs for workspace discovery: defaults + `TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE` + `opts.workspaceDiscoveryIgnore`.
+ * Resolve ignore globs for workspace discovery. Unlike scalar options, ignore patterns are additive:
+ * defaults + `opts.TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE`/environment + `opts.workspaceDiscoveryIgnore`.
  * Patterns are fast-glob / micromatch style, relative to the workspace root (forward slashes).
  *
  * @param {{ workspaceDiscoveryIgnore?: string[], TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string, [key: string]: unknown }} [opts={}]

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@trustify-da/trustify-da-javascript-client",
-	"version": "0.3.0-ea.243eaef",
+	"version": "0.3.0-ea.24dd325",
 	"description": "Code-Ready Dependency Analytics JavaScript API.",
 	"license": "Apache-2.0",
 	"homepage": "https://github.com/guacsec/trustify-da-javascript-client#README.md",
@@ -49,7 +49,6 @@
 		"postcompile": "cp node_modules/tree-sitter-requirements/tree-sitter-requirements.wasm dist/src/providers/tree-sitter-requirements.wasm && cp node_modules/tree-sitter-gomod/tree-sitter-gomod.wasm dist/src/providers/tree-sitter-gomod.wasm && cp node_modules/tree-sitter-containerfile/tree-sitter-containerfile.wasm dist/src/providers/tree-sitter-containerfile.wasm"
 	},
 	"dependencies": {
-		"@babel/core": "^7.23.2",
 		"@yarnpkg/parsers": "^3.1.0",
 		"eslint-import-resolver-typescript": "^4.4.4",
 		"fast-glob": "^3.3.3",
@@ -70,14 +69,12 @@
 		"yargs": "^18.0.0"
 	},
 	"devDependencies": {
-		"@babel/core": "^7.23.2",
 		"@cyclonedx/cyclonedx-library": "^10.2.0",
 		"@eslint/js": "^10.0.0",
 		"@trustify-da/trustify-da-api-model": "^2.0.12",
 		"@types/node": "^25.9.1",
 		"@types/which": "^3.0.4",
 		"ajv": "^8.20.0",
-		"babel-plugin-rewire": "^1.2.0",
 		"c8": "^11.0.0",
 		"chai": "^6.2.2",
 		"eslint": "^10.4.1",