@trustify-da/trustify-da-javascript-client 0.3.0-ea.61444d4 → 0.3.0-ea.62b88e5

package/dist/src/updaters/maven_updater.d.ts

@@ -1,3 +1,23 @@
+/**
+ * One entry in {@link updateMavenVersions}' `applied` list: a version that was changed and
+ * where. `type` discriminates the edit site — `'direct'` for a dependency's own `<version>`,
+ * `'property'` for a `${property}` reference (then `property` names the resolved property).
+ * @typedef {{
+ *   groupId: string,
+ *   artifactId: string,
+ *   newVersion: string,
+ *   type: ('direct'|'property'),
+ *   property?: string
+ * }} MavenAppliedChange
+ */
+/**
+ * Stable edit-site key for a Maven change: same key => same commit/PR. Deps whose versions
+ * resolve to one `${property}` share the property key and are therefore inseparable.
+ * @param {string} manifestPath
+ * @param {MavenAppliedChange} applied
+ * @returns {string}
+ */
+export function mavenChangeKey(manifestPath: string, applied: MavenAppliedChange): string;
 /**
  * Updates dependency versions in a Maven pom.xml while preserving file formatting.
  *
@@ -10,17 +30,29 @@
  * and updates the terminal property value in `<properties>` instead.
  *
  * @param {string} pomContent - the raw pom.xml file content
- * @param {Array<{groupId: string, artifactId: string, newVersion: string}>} versionChanges -
- *   list of version changes to apply
- * @returns {{content: string, applied: Array, skipped: Array}} the updated content and
+ * @param {import('../remediate.js').VersionChangeRequest[]} versionChanges - list of version changes to apply
+ * @returns {{content: string, applied: MavenAppliedChange[], skipped: Array<{groupId: string, artifactId: string, newVersion: string, reason: string}>}} the updated content and
  *   lists of applied and skipped changes
  */
-export function updateMavenVersions(pomContent: string, versionChanges: Array<{
+export function updateMavenVersions(pomContent: string, versionChanges: import("../remediate.js").VersionChangeRequest[]): {
+    content: string;
+    applied: MavenAppliedChange[];
+    skipped: Array<{
+        groupId: string;
+        artifactId: string;
+        newVersion: string;
+        reason: string;
+    }>;
+};
+/**
+ * One entry in {@link updateMavenVersions}' `applied` list: a version that was changed and
+ * where. `type` discriminates the edit site — `'direct'` for a dependency's own `<version>`,
+ * `'property'` for a `${property}` reference (then `property` names the resolved property).
+ */
+export type MavenAppliedChange = {
     groupId: string;
     artifactId: string;
     newVersion: string;
-}>): {
-    content: string;
-    applied: any[];
-    skipped: any[];
+    type: ("direct" | "property");
+    property?: string;
 };

package/dist/src/updaters/maven_updater.js

@@ -160,6 +160,30 @@ function resolvePropertyChain(propName, properties, visited = new Set()) {
     }
     return { terminalPropName: propName, resolvedValue: valueStr };
 }
+/**
+ * One entry in {@link updateMavenVersions}' `applied` list: a version that was changed and
+ * where. `type` discriminates the edit site — `'direct'` for a dependency's own `<version>`,
+ * `'property'` for a `${property}` reference (then `property` names the resolved property).
+ * @typedef {{
+ *   groupId: string,
+ *   artifactId: string,
+ *   newVersion: string,
+ *   type: ('direct'|'property'),
+ *   property?: string
+ * }} MavenAppliedChange
+ */
+/**
+ * Stable edit-site key for a Maven change: same key => same commit/PR. Deps whose versions
+ * resolve to one `${property}` share the property key and are therefore inseparable.
+ * @param {string} manifestPath
+ * @param {MavenAppliedChange} applied
+ * @returns {string}
+ */
+export function mavenChangeKey(manifestPath, applied) {
+    return applied.type === 'property'
+        ? `mvn:prop:${manifestPath}:${applied.property}`
+        : `mvn:direct:${manifestPath}:${applied.groupId}:${applied.artifactId}`;
+}
 /**
  * Updates dependency versions in a Maven pom.xml while preserving file formatting.
  *
@@ -172,9 +196,8 @@ function resolvePropertyChain(propName, properties, visited = new Set()) {
  * and updates the terminal property value in `<properties>` instead.
  *
  * @param {string} pomContent - the raw pom.xml file content
- * @param {Array<{groupId: string, artifactId: string, newVersion: string}>} versionChanges -
- *   list of version changes to apply
- * @returns {{content: string, applied: Array, skipped: Array}} the updated content and
+ * @param {import('../remediate.js').VersionChangeRequest[]} versionChanges - list of version changes to apply
+ * @returns {{content: string, applied: MavenAppliedChange[], skipped: Array<{groupId: string, artifactId: string, newVersion: string, reason: string}>}} the updated content and
  *   lists of applied and skipped changes
  */
 export function updateMavenVersions(pomContent, versionChanges) {

package/dist/src/updaters/toml_updater.d.ts

@@ -1,3 +1,26 @@
+/**
+ * One entry in {@link updateTomlVersions}' `applied` list: a version that was changed and where.
+ * `type` discriminates the edit site — `'ref'` for a `[libraries]` entry pointing at a shared
+ * `[versions]` alias via `version.ref` (then `versionRef` names that alias), `'inline'` for a
+ * version declared directly on the library. `alias` is the library's catalog key in both cases.
+ * @typedef {{
+ *   groupId: string,
+ *   artifactId: string,
+ *   newVersion: string,
+ *   oldVersion: string,
+ *   type: ('ref'|'inline'),
+ *   alias: string,
+ *   versionRef?: string
+ * }} TomlAppliedChange
+ */
+/**
+ * Stable edit-site key for a TOML (Gradle version catalog) change: same key => same commit/PR.
+ * Deps sharing one `[versions]` alias via `version.ref` share the ref key and are inseparable.
+ * @param {string} manifestPath
+ * @param {TomlAppliedChange} applied
+ * @returns {string}
+ */
+export function tomlChangeKey(manifestPath: string, applied: TomlAppliedChange): string;
 /**
  * Updates dependency versions in a Gradle version catalog (libs.versions.toml) file.
  *
@@ -9,21 +32,12 @@
  * on the raw content to preserve formatting and comments.
  *
  * @param {string} tomlContent - raw TOML file content
- * @param {Array<{groupId: string, artifactId: string, newVersion: string}>} versionChanges
- * @returns {{content: string, applied: Array<{groupId: string, artifactId: string, newVersion: string, oldVersion: string}>, skipped: Array<{groupId: string, artifactId: string, newVersion: string, reason: string}>}}
+ * @param {import('../remediate.js').VersionChangeRequest[]} versionChanges
+ * @returns {{content: string, applied: TomlAppliedChange[], skipped: Array<{groupId: string, artifactId: string, newVersion: string, reason: string}>}}
  */
-export function updateTomlVersions(tomlContent: string, versionChanges: Array<{
-    groupId: string;
-    artifactId: string;
-    newVersion: string;
-}>): {
+export function updateTomlVersions(tomlContent: string, versionChanges: import("../remediate.js").VersionChangeRequest[]): {
     content: string;
-    applied: Array<{
-        groupId: string;
-        artifactId: string;
-        newVersion: string;
-        oldVersion: string;
-    }>;
+    applied: TomlAppliedChange[];
     skipped: Array<{
         groupId: string;
         artifactId: string;
@@ -31,3 +45,18 @@ export function updateTomlVersions(tomlContent: string, versionChanges: Array<{
         reason: string;
     }>;
 };
+/**
+ * One entry in {@link updateTomlVersions}' `applied` list: a version that was changed and where.
+ * `type` discriminates the edit site — `'ref'` for a `[libraries]` entry pointing at a shared
+ * `[versions]` alias via `version.ref` (then `versionRef` names that alias), `'inline'` for a
+ * version declared directly on the library. `alias` is the library's catalog key in both cases.
+ */
+export type TomlAppliedChange = {
+    groupId: string;
+    artifactId: string;
+    newVersion: string;
+    oldVersion: string;
+    type: ("ref" | "inline");
+    alias: string;
+    versionRef?: string;
+};

package/dist/src/updaters/toml_updater.js

@@ -1,4 +1,31 @@
 import { parse as parseToml } from 'smol-toml';
+/**
+ * One entry in {@link updateTomlVersions}' `applied` list: a version that was changed and where.
+ * `type` discriminates the edit site — `'ref'` for a `[libraries]` entry pointing at a shared
+ * `[versions]` alias via `version.ref` (then `versionRef` names that alias), `'inline'` for a
+ * version declared directly on the library. `alias` is the library's catalog key in both cases.
+ * @typedef {{
+ *   groupId: string,
+ *   artifactId: string,
+ *   newVersion: string,
+ *   oldVersion: string,
+ *   type: ('ref'|'inline'),
+ *   alias: string,
+ *   versionRef?: string
+ * }} TomlAppliedChange
+ */
+/**
+ * Stable edit-site key for a TOML (Gradle version catalog) change: same key => same commit/PR.
+ * Deps sharing one `[versions]` alias via `version.ref` share the ref key and are inseparable.
+ * @param {string} manifestPath
+ * @param {TomlAppliedChange} applied
+ * @returns {string}
+ */
+export function tomlChangeKey(manifestPath, applied) {
+    return applied.type === 'ref'
+        ? `toml:ref:${manifestPath}:${applied.versionRef}`
+        : `toml:inline:${manifestPath}:${applied.alias}`;
+}
 /**
  * Updates dependency versions in a Gradle version catalog (libs.versions.toml) file.
  *
@@ -10,8 +37,8 @@ import { parse as parseToml } from 'smol-toml';
  * on the raw content to preserve formatting and comments.
  *
  * @param {string} tomlContent - raw TOML file content
- * @param {Array<{groupId: string, artifactId: string, newVersion: string}>} versionChanges
- * @returns {{content: string, applied: Array<{groupId: string, artifactId: string, newVersion: string, oldVersion: string}>, skipped: Array<{groupId: string, artifactId: string, newVersion: string, reason: string}>}}
+ * @param {import('../remediate.js').VersionChangeRequest[]} versionChanges
+ * @returns {{content: string, applied: TomlAppliedChange[], skipped: Array<{groupId: string, artifactId: string, newVersion: string, reason: string}>}}
  */
 export function updateTomlVersions(tomlContent, versionChanges) {
     const applied = [];
@@ -77,7 +104,10 @@ export function updateTomlVersions(tomlContent, versionChanges) {
                 groupId: change.groupId,
                 artifactId: change.artifactId,
                 newVersion: change.newVersion,
-                oldVersion
+                oldVersion,
+                type: 'ref',
+                versionRef,
+                alias
             });
         }
         else {
@@ -107,7 +137,9 @@ export function updateTomlVersions(tomlContent, versionChanges) {
                     groupId: change.groupId,
                     artifactId: change.artifactId,
                     newVersion: change.newVersion,
-                    oldVersion: inlineVersion
+                    oldVersion: inlineVersion,
+                    type: 'inline',
+                    alias
                 });
             }
             else {

package/dist/src/workspace.d.ts

@@ -1,5 +1,6 @@
 /**
- * Resolve ignore globs for workspace discovery: defaults + `TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE` + `opts.workspaceDiscoveryIgnore`.
+ * Resolve ignore globs for workspace discovery. Unlike scalar options, ignore patterns are additive:
+ * defaults + `opts.TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE`/environment + `opts.workspaceDiscoveryIgnore`.
  * Patterns are fast-glob / micromatch style, relative to the workspace root (forward slashes).
  *
  * @param {{ workspaceDiscoveryIgnore?: string[], TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string, [key: string]: unknown }} [opts={}]

package/dist/src/workspace.js

@@ -10,7 +10,8 @@ const DEFAULT_WORKSPACE_DISCOVERY_IGNORE = [
     '**/.git/**',
 ];
 /**
- * Resolve ignore globs for workspace discovery: defaults + `TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE` + `opts.workspaceDiscoveryIgnore`.
+ * Resolve ignore globs for workspace discovery. Unlike scalar options, ignore patterns are additive:
+ * defaults + `opts.TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE`/environment + `opts.workspaceDiscoveryIgnore`.
  * Patterns are fast-glob / micromatch style, relative to the workspace root (forward slashes).
  *
  * @param {{ workspaceDiscoveryIgnore?: string[], TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string, [key: string]: unknown }} [opts={}]

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@trustify-da/trustify-da-javascript-client",
-	"version": "0.3.0-ea.61444d4",
+	"version": "0.3.0-ea.62b88e5",
 	"description": "Code-Ready Dependency Analytics JavaScript API.",
 	"license": "Apache-2.0",
 	"homepage": "https://github.com/guacsec/trustify-da-javascript-client#README.md",
@@ -25,7 +25,9 @@
 		"provenance": true
 	},
 	"type": "module",
-	"bin": "dist/src/cli.js",
+	"bin": {
+		"trustify-da": "dist/src/cli.js"
+	},
 	"main": "dist/src/index.js",
 	"module": "dist/src/index.js",
 	"types": "dist/src/index.d.ts",
@@ -47,8 +49,7 @@
 		"postcompile": "cp node_modules/tree-sitter-requirements/tree-sitter-requirements.wasm dist/src/providers/tree-sitter-requirements.wasm && cp node_modules/tree-sitter-gomod/tree-sitter-gomod.wasm dist/src/providers/tree-sitter-gomod.wasm && cp node_modules/tree-sitter-containerfile/tree-sitter-containerfile.wasm dist/src/providers/tree-sitter-containerfile.wasm"
 	},
 	"dependencies": {
-		"@babel/core": "^7.23.2",
-		"@cyclonedx/cyclonedx-library": "^10.0.0",
+		"@yarnpkg/parsers": "^3.1.0",
 		"eslint-import-resolver-typescript": "^4.4.4",
 		"fast-glob": "^3.3.3",
 		"fast-xml-parser": "^5.3.4",
@@ -68,12 +69,12 @@
 		"yargs": "^18.0.0"
 	},
 	"devDependencies": {
-		"@babel/core": "^7.23.2",
+		"@cyclonedx/cyclonedx-library": "^10.2.0",
 		"@eslint/js": "^10.0.0",
 		"@trustify-da/trustify-da-api-model": "^2.0.12",
 		"@types/node": "^25.9.1",
 		"@types/which": "^3.0.4",
-		"babel-plugin-rewire": "^1.2.0",
+		"ajv": "^8.20.0",
 		"c8": "^11.0.0",
 		"chai": "^6.2.2",
 		"eslint": "^10.4.1",