@trustify-da/trustify-da-javascript-client 0.3.0-ea.6549d2a → 0.3.0-ea.68905d3

package/dist/src/updaters/toml_updater.js

@@ -0,0 +1,276 @@
+import { parse as parseToml } from 'smol-toml';
+/**
+ * One entry in {@link updateTomlVersions}' `applied` list: a version that was changed and where.
+ * `type` discriminates the edit site — `'ref'` for a `[libraries]` entry pointing at a shared
+ * `[versions]` alias via `version.ref` (then `versionRef` names that alias), `'inline'` for a
+ * version declared directly on the library. `alias` is the library's catalog key in both cases.
+ * @typedef {{
+ *   groupId: string,
+ *   artifactId: string,
+ *   newVersion: string,
+ *   oldVersion: string,
+ *   type: ('ref'|'inline'),
+ *   alias: string,
+ *   versionRef?: string
+ * }} TomlAppliedChange
+ */
+/**
+ * Stable edit-site key for a TOML (Gradle version catalog) change: same key => same commit/PR.
+ * Deps sharing one `[versions]` alias via `version.ref` share the ref key and are inseparable.
+ * @param {string} manifestPath
+ * @param {TomlAppliedChange} applied
+ * @returns {string}
+ */
+export function tomlChangeKey(manifestPath, applied) {
+    return applied.type === 'ref'
+        ? `toml:ref:${manifestPath}:${applied.versionRef}`
+        : `toml:inline:${manifestPath}:${applied.alias}`;
+}
+/**
+ * Updates dependency versions in a Gradle version catalog (libs.versions.toml) file.
+ *
+ * Supports two version declaration patterns:
+ * - Centralized: [versions] section defines version aliases, [libraries] references via version.ref
+ * - Inline: [libraries] entries include version = "x.y.z" directly
+ *
+ * Uses smol-toml parse() to locate keys, then performs position-based string replacement
+ * on the raw content to preserve formatting and comments.
+ *
+ * @param {string} tomlContent - raw TOML file content
+ * @param {import('../remediate.js').VersionChangeRequest[]} versionChanges
+ * @returns {{content: string, applied: TomlAppliedChange[], skipped: Array<{groupId: string, artifactId: string, newVersion: string, reason: string}>}}
+ */
+export function updateTomlVersions(tomlContent, versionChanges) {
+    const applied = [];
+    const skipped = [];
+    if (!versionChanges || versionChanges.length === 0) {
+        return { content: tomlContent, applied, skipped };
+    }
+    let parsed;
+    try {
+        parsed = parseToml(tomlContent);
+    }
+    catch (err) {
+        for (const change of versionChanges) {
+            skipped.push({
+                groupId: change.groupId,
+                artifactId: change.artifactId,
+                newVersion: change.newVersion,
+                reason: `Failed to parse TOML: ${err.message}`
+            });
+        }
+        return { content: tomlContent, applied, skipped };
+    }
+    const libraries = parsed.libraries || {};
+    const versions = parsed.versions || {};
+    const libraryIndex = buildLibraryIndex(libraries);
+    let updatedContent = tomlContent;
+    for (const change of versionChanges) {
+        const moduleKey = `${change.groupId}:${change.artifactId}`;
+        const alias = libraryIndex.get(moduleKey);
+        if (!alias) {
+            skipped.push({
+                groupId: change.groupId,
+                artifactId: change.artifactId,
+                newVersion: change.newVersion,
+                reason: `No library entry found for module ${moduleKey}`
+            });
+            continue;
+        }
+        const libEntry = libraries[alias];
+        const versionRef = getVersionRef(libEntry);
+        if (versionRef) {
+            const oldVersion = versions[versionRef];
+            if (oldVersion === undefined) {
+                skipped.push({
+                    groupId: change.groupId,
+                    artifactId: change.artifactId,
+                    newVersion: change.newVersion,
+                    reason: `Version ref "${versionRef}" not found in [versions] section`
+                });
+                continue;
+            }
+            if (oldVersion === change.newVersion) {
+                skipped.push({
+                    groupId: change.groupId,
+                    artifactId: change.artifactId,
+                    newVersion: change.newVersion,
+                    reason: `Version already at ${change.newVersion}`
+                });
+                continue;
+            }
+            updatedContent = replaceVersionInSection(updatedContent, versionRef, oldVersion, change.newVersion);
+            applied.push({
+                groupId: change.groupId,
+                artifactId: change.artifactId,
+                newVersion: change.newVersion,
+                oldVersion,
+                type: 'ref',
+                versionRef,
+                alias
+            });
+        }
+        else {
+            const inlineVersion = getInlineVersion(libEntry);
+            if (inlineVersion === undefined) {
+                skipped.push({
+                    groupId: change.groupId,
+                    artifactId: change.artifactId,
+                    newVersion: change.newVersion,
+                    reason: `No version.ref or inline version found for library "${alias}"`
+                });
+                continue;
+            }
+            if (inlineVersion === change.newVersion) {
+                skipped.push({
+                    groupId: change.groupId,
+                    artifactId: change.artifactId,
+                    newVersion: change.newVersion,
+                    reason: `Version already at ${change.newVersion}`
+                });
+                continue;
+            }
+            const beforeInline = updatedContent;
+            updatedContent = replaceInlineVersion(updatedContent, alias, inlineVersion, change.newVersion);
+            if (updatedContent !== beforeInline) {
+                applied.push({
+                    groupId: change.groupId,
+                    artifactId: change.artifactId,
+                    newVersion: change.newVersion,
+                    oldVersion: inlineVersion,
+                    type: 'inline',
+                    alias
+                });
+            }
+            else {
+                skipped.push({
+                    groupId: change.groupId,
+                    artifactId: change.artifactId,
+                    newVersion: change.newVersion,
+                    reason: `Inline version replacement did not match for library "${alias}"`
+                });
+            }
+        }
+    }
+    return { content: updatedContent, applied, skipped };
+}
+/**
+ * Builds a map from "groupId:artifactId" to the TOML library alias.
+ * @param {object} libraries - parsed [libraries] section
+ * @returns {Map<string, string>}
+ */
+function buildLibraryIndex(libraries) {
+    const index = new Map();
+    for (const [alias, entry] of Object.entries(libraries)) {
+        const module = getModule(entry);
+        if (module) {
+            index.set(module, alias);
+        }
+    }
+    return index;
+}
+/**
+ * Extracts the module identifier from a library entry.
+ * Handles both string shorthand ("group:artifact:version") and object notation
+ * ({ module = "group:artifact" } or { group = "...", name = "..." }).
+ * @param {string|object} entry
+ * @returns {string|undefined} "groupId:artifactId"
+ */
+function getModule(entry) {
+    if (typeof entry === 'string') {
+        const parts = entry.split(':');
+        if (parts.length >= 2) {
+            return `${parts[0]}:${parts[1]}`;
+        }
+        return undefined;
+    }
+    if (entry.module) {
+        const parts = entry.module.split(':');
+        if (parts.length >= 2) {
+            return `${parts[0]}:${parts[1]}`;
+        }
+        return entry.module;
+    }
+    if (entry.group && entry.name) {
+        return `${entry.group}:${entry.name}`;
+    }
+    return undefined;
+}
+/**
+ * Extracts the version.ref from a library entry, if present.
+ * @param {string|object} entry
+ * @returns {string|undefined}
+ */
+function getVersionRef(entry) {
+    if (typeof entry === 'object' && entry.version) {
+        if (typeof entry.version === 'object' && entry.version.ref) {
+            return entry.version.ref;
+        }
+    }
+    return undefined;
+}
+/**
+ * Extracts an inline version string from a library entry.
+ * Handles { version = "1.2.3" } and string shorthand "group:artifact:version".
+ * @param {string|object} entry
+ * @returns {string|undefined}
+ */
+function getInlineVersion(entry) {
+    if (typeof entry === 'string') {
+        const parts = entry.split(':');
+        if (parts.length >= 3) {
+            return parts[2];
+        }
+        return undefined;
+    }
+    if (typeof entry === 'object' && entry.version) {
+        if (typeof entry.version === 'string') {
+            return entry.version;
+        }
+    }
+    return undefined;
+}
+/**
+ * Replaces a version value using position-based string replacement.
+ * Targets lines matching: key = "oldVersion"
+ * @param {string} content - raw TOML content
+ * @param {string} key - version alias key
+ * @param {string} oldVersion - current version string
+ * @param {string} newVersion - replacement version string
+ * @returns {string} updated content
+ */
+function replaceVersionInSection(content, key, oldVersion, newVersion) {
+    const escapedKey = escapeRegExp(key);
+    const escapedOld = escapeRegExp(oldVersion);
+    const pattern = new RegExp(`^(\\s*${escapedKey}\\s*=\\s*")${escapedOld}("\\s*)$`, 'm');
+    return content.replace(pattern, (_, p1, p2) => `${p1}${newVersion}${p2}`);
+}
+/**
+ * Replaces an inline version in a library entry.
+ * Targets patterns like: version = "oldVersion" or version ="oldVersion"
+ * on the line containing the library alias.
+ * @param {string} content - raw TOML content
+ * @param {string} alias - library alias
+ * @param {string} oldVersion - current version string
+ * @param {string} newVersion - replacement version string
+ * @returns {string} updated content
+ */
+function replaceInlineVersion(content, alias, oldVersion, newVersion) {
+    const escapedAlias = escapeRegExp(alias);
+    const escapedOld = escapeRegExp(oldVersion);
+    const pattern = new RegExp(`^(\\s*${escapedAlias}\\s*=\\s*\\{[^}]*version\\s*=\\s*")${escapedOld}("[^}]*\\}\\s*)$`, 'm');
+    const result = content.replace(pattern, (_, p1, p2) => `${p1}${newVersion}${p2}`);
+    if (result !== content) {
+        return result;
+    }
+    const stringPattern = new RegExp(`^(\\s*${escapedAlias}\\s*=\\s*"[^:]+:[^:]+:)${escapedOld}("\\s*)$`, 'm');
+    return content.replace(stringPattern, (_, p1, p2) => `${p1}${newVersion}${p2}`);
+}
+/**
+ * Escapes special regex characters in a string.
+ * @param {string} str
+ * @returns {string}
+ */
+function escapeRegExp(str) {
+    return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}

package/dist/src/workspace.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Resolve ignore globs for workspace discovery: defaults + `TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE` + `opts.workspaceDiscoveryIgnore`.
+ * Patterns are fast-glob / micromatch style, relative to the workspace root (forward slashes).
+ *
+ * @param {{ workspaceDiscoveryIgnore?: string[], TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string, [key: string]: unknown }} [opts={}]
+ * @returns {string[]}
+ */
+export function resolveWorkspaceDiscoveryIgnore(opts?: {
+    workspaceDiscoveryIgnore?: string[];
+    TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string;
+    [key: string]: unknown;
+}): string[];
+/**
+ * Drop manifest paths whose location matches an ignore pattern (e.g. root unshift, Cargo paths).
+ *
+ * @param {string[]} manifestPaths
+ * @param {string} root
+ * @param {string[]} ignorePatterns
+ * @returns {string[]}
+ */
+export function filterManifestPathsByDiscoveryIgnore(manifestPaths: string[], root: string, ignorePatterns: string[]): string[];
+/**
+ * @typedef {{ valid: true, name: string, version: string } | { valid: false, error: string }} ValidatePackageJsonResult
+ */
+/**
+ * Validate a package.json has non-empty `name` and `version` (required for stable SBOM root identity in batch).
+ *
+ * @param {string} packageJsonPath - Absolute or relative path to package.json
+ * @returns {ValidatePackageJsonResult}
+ */
+export function validatePackageJson(packageJsonPath: string): ValidatePackageJsonResult;
+/**
+ * Discover all package.json paths in a JS/TS workspace.
+ * Reads pnpm-workspace.yaml or package.json workspaces.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root
+ * @param {{ workspaceDiscoveryIgnore?: string[], TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string, [key: string]: unknown }} [opts={}] - optional `workspaceDiscoveryIgnore` globs (merged with defaults and env)
+ * @returns {Promise<string[]>} Paths to package.json files (absolute)
+ */
+export function discoverWorkspacePackages(workspaceRoot: string, opts?: {
+    workspaceDiscoveryIgnore?: string[];
+    TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string;
+    [key: string]: unknown;
+}): Promise<string[]>;
+/**
+ * Convert workspace glob patterns to manifest-file glob patterns,
+ * correctly handling negation prefixes.
+ *
+ * @param {string[]} patterns - Workspace glob patterns (may include negations)
+ * @param {string} manifestFileName - e.g. 'package.json' or 'Cargo.toml'
+ * @returns {string[]}
+ */
+export function toManifestGlobPatterns(patterns: string[], manifestFileName: string): string[];
+/**
+ * Discover all Cargo.toml manifest paths in a Cargo workspace.
+ * Uses `cargo metadata` to get workspace members.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain Cargo.toml and Cargo.lock)
+ * @param {import('./index.js').Options} [opts={}]
+ * @returns {Promise<string[]>} Paths to Cargo.toml files (absolute)
+ */
+export function discoverWorkspaceCrates(workspaceRoot: string, opts?: import("./index.js").Options): Promise<string[]>;
+export type ValidatePackageJsonResult = {
+    valid: true;
+    name: string;
+    version: string;
+} | {
+    valid: false;
+    error: string;
+};

package/dist/src/workspace.js

@@ -0,0 +1,256 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import fg from 'fast-glob';
+import { load as yamlLoad } from 'js-yaml';
+import micromatch from 'micromatch';
+import { getCustom, getCustomPath, invokeCommand } from './tools.js';
+/** Default paths skipped during JS workspace discovery (merged with user patterns). */
+const DEFAULT_WORKSPACE_DISCOVERY_IGNORE = [
+    '**/node_modules/**',
+    '**/.git/**',
+];
+/**
+ * Resolve ignore globs for workspace discovery: defaults + `TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE` + `opts.workspaceDiscoveryIgnore`.
+ * Patterns are fast-glob / micromatch style, relative to the workspace root (forward slashes).
+ *
+ * @param {{ workspaceDiscoveryIgnore?: string[], TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string, [key: string]: unknown }} [opts={}]
+ * @returns {string[]}
+ */
+export function resolveWorkspaceDiscoveryIgnore(opts = {}) {
+    const merged = [...DEFAULT_WORKSPACE_DISCOVERY_IGNORE];
+    const fromEnv = getCustom('TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE', null, opts);
+    if (fromEnv && String(fromEnv).trim()) {
+        merged.push(...String(fromEnv).split(',').map(s => s.trim()).filter(Boolean));
+    }
+    const extra = opts.workspaceDiscoveryIgnore;
+    if (Array.isArray(extra)) {
+        for (const p of extra) {
+            if (typeof p === 'string' && p.trim()) {
+                merged.push(p.trim());
+            }
+        }
+    }
+    return [...new Set(merged)];
+}
+/**
+ * @param {string} root - Workspace root (absolute)
+ * @param {string[]} ignorePatterns
+ */
+function buildWorkspaceDiscoveryGlobOptions(root, ignorePatterns) {
+    return {
+        cwd: root,
+        absolute: true,
+        onlyFiles: true,
+        ignore: ignorePatterns,
+        followSymbolicLinks: false,
+    };
+}
+/**
+ * @param {string} filePath - Absolute path
+ * @param {string} root - Workspace root (absolute)
+ * @returns {string} Relative path with forward slashes
+ */
+function relativePathForGlobMatch(filePath, root) {
+    const rel = path.relative(root, filePath);
+    return rel.split(path.sep).join('/');
+}
+/**
+ * Drop manifest paths whose location matches an ignore pattern (e.g. root unshift, Cargo paths).
+ *
+ * @param {string[]} manifestPaths
+ * @param {string} root
+ * @param {string[]} ignorePatterns
+ * @returns {string[]}
+ */
+export function filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns) {
+    if (!ignorePatterns.length) {
+        return manifestPaths;
+    }
+    const resolvedRoot = path.resolve(root);
+    return manifestPaths.filter(absPath => {
+        const rel = relativePathForGlobMatch(absPath, resolvedRoot);
+        if (rel === '') {
+            return true;
+        }
+        return !ignorePatterns.some(pattern => micromatch.isMatch(rel, pattern, { dot: true }));
+    });
+}
+/**
+ * @typedef {{ valid: true, name: string, version: string } | { valid: false, error: string }} ValidatePackageJsonResult
+ */
+/**
+ * Validate a package.json has non-empty `name` and `version` (required for stable SBOM root identity in batch).
+ *
+ * @param {string} packageJsonPath - Absolute or relative path to package.json
+ * @returns {ValidatePackageJsonResult}
+ */
+export function validatePackageJson(packageJsonPath) {
+    let content;
+    try {
+        const raw = fs.readFileSync(packageJsonPath, 'utf-8');
+        content = JSON.parse(raw);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { valid: false, error: `Invalid package.json: ${msg}` };
+    }
+    if (!content || typeof content !== 'object') {
+        return { valid: false, error: 'package.json must be a JSON object' };
+    }
+    const name = content.name;
+    const version = content.version;
+    if (typeof name !== 'string' || !name.trim()) {
+        return { valid: false, error: 'Missing or invalid name' };
+    }
+    if (typeof version !== 'string' || !version.trim()) {
+        return { valid: false, error: 'Missing or invalid version' };
+    }
+    return { valid: true, name: name.trim(), version: version.trim() };
+}
+/**
+ * Discover all package.json paths in a JS/TS workspace.
+ * Reads pnpm-workspace.yaml or package.json workspaces.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root
+ * @param {{ workspaceDiscoveryIgnore?: string[], TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string, [key: string]: unknown }} [opts={}] - optional `workspaceDiscoveryIgnore` globs (merged with defaults and env)
+ * @returns {Promise<string[]>} Paths to package.json files (absolute)
+ */
+export async function discoverWorkspacePackages(workspaceRoot, opts = {}) {
+    const root = path.resolve(workspaceRoot);
+    const ignorePatterns = resolveWorkspaceDiscoveryIgnore(opts);
+    const globOpts = buildWorkspaceDiscoveryGlobOptions(root, ignorePatterns);
+    const pnpmWorkspace = path.join(root, 'pnpm-workspace.yaml');
+    const packageJson = path.join(root, 'package.json');
+    if (fs.existsSync(pnpmWorkspace)) {
+        return discoverFromPnpmWorkspace(root, pnpmWorkspace, globOpts, ignorePatterns);
+    }
+    if (fs.existsSync(packageJson)) {
+        return discoverFromPackageJsonWorkspaces(root, packageJson, globOpts, ignorePatterns);
+    }
+    return [];
+}
+/**
+ * @param {string} root
+ * @param {string} pnpmWorkspacePath
+ * @param {object} globOpts - fast-glob options (cwd, ignore, followSymbolicLinks, …)
+ * @param {string[]} ignorePatterns - for post-filter
+ * @returns {Promise<string[]>}
+ */
+async function discoverFromPnpmWorkspace(root, pnpmWorkspacePath, globOpts, ignorePatterns) {
+    const content = fs.readFileSync(pnpmWorkspacePath, 'utf-8');
+    const packages = parsePnpmPackages(content);
+    if (packages.length === 0) {
+        return [];
+    }
+    const patterns = toManifestGlobPatterns(packages, 'package.json');
+    const manifestPaths = await fg(patterns, globOpts);
+    return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+}
+/**
+ * Parse the `packages` array from pnpm-workspace.yaml content.
+ * @param {string} content - Raw YAML content
+ * @returns {string[]}
+ */
+function parsePnpmPackages(content) {
+    let doc;
+    try {
+        doc = yamlLoad(content);
+    }
+    catch {
+        return [];
+    }
+    if (!doc || typeof doc !== 'object' || !Array.isArray(doc.packages)) {
+        return [];
+    }
+    return doc.packages.filter(p => typeof p === 'string' && p.trim()).map(p => p.trim());
+}
+/**
+ * Convert workspace glob patterns to manifest-file glob patterns,
+ * correctly handling negation prefixes.
+ *
+ * @param {string[]} patterns - Workspace glob patterns (may include negations)
+ * @param {string} manifestFileName - e.g. 'package.json' or 'Cargo.toml'
+ * @returns {string[]}
+ */
+export function toManifestGlobPatterns(patterns, manifestFileName) {
+    return patterns.map(p => {
+        if (p.startsWith('!')) {
+            return `!${p.slice(1)}/${manifestFileName}`;
+        }
+        return `${p}/${manifestFileName}`;
+    });
+}
+/**
+ * @param {string} root
+ * @param {string} packageJsonPath
+ * @param {object} globOpts
+ * @param {string[]} ignorePatterns
+ * @returns {Promise<string[]>}
+ */
+async function discoverFromPackageJsonWorkspaces(root, packageJsonPath, globOpts, ignorePatterns) {
+    let pkg;
+    try {
+        pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
+    }
+    catch {
+        return [];
+    }
+    const workspaces = pkg.workspaces;
+    if (!workspaces) {
+        return [];
+    }
+    const raw = Array.isArray(workspaces) ? workspaces : workspaces.packages || [];
+    const patterns = toManifestGlobPatterns(raw.filter(p => typeof p === 'string'), 'package.json');
+    if (patterns.length === 0) {
+        return [];
+    }
+    const manifestPaths = await fg(patterns, globOpts);
+    const rootPkg = path.join(root, 'package.json');
+    if (fs.existsSync(rootPkg) && !manifestPaths.includes(rootPkg)) {
+        manifestPaths.unshift(rootPkg);
+    }
+    return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+}
+/**
+ * Discover all Cargo.toml manifest paths in a Cargo workspace.
+ * Uses `cargo metadata` to get workspace members.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain Cargo.toml and Cargo.lock)
+ * @param {import('./index.js').Options} [opts={}]
+ * @returns {Promise<string[]>} Paths to Cargo.toml files (absolute)
+ */
+export async function discoverWorkspaceCrates(workspaceRoot, opts = {}) {
+    const root = path.resolve(workspaceRoot);
+    const cargoToml = path.join(root, 'Cargo.toml');
+    const cargoLock = path.join(root, 'Cargo.lock');
+    if (!fs.existsSync(cargoToml) || !fs.existsSync(cargoLock)) {
+        return [];
+    }
+    const cargoBin = getCustomPath('cargo', opts);
+    let output;
+    try {
+        output = invokeCommand(cargoBin, ['metadata', '--format-version', '1', '--no-deps'], { cwd: root });
+    }
+    catch {
+        return [];
+    }
+    let metadata;
+    try {
+        metadata = JSON.parse(output.toString().trim());
+    }
+    catch {
+        return [];
+    }
+    const memberIds = new Set(metadata.workspace_members || []);
+    const manifestPaths = [];
+    for (const pkg of metadata.packages || []) {
+        if (memberIds.has(pkg.id) && pkg.manifest_path) {
+            const manifestPath = path.resolve(pkg.manifest_path);
+            if (fs.existsSync(manifestPath)) {
+                manifestPaths.push(manifestPath);
+            }
+        }
+    }
+    const ignorePatterns = resolveWorkspaceDiscoveryIgnore(opts);
+    return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+}