@trustify-da/trustify-da-javascript-client 0.3.0-ea.de12f6a → 0.3.0-ea.de62188

package/dist/src/providers/python_uv.js

@@ -0,0 +1,269 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import fg from 'fast-glob';
+import { parse as parseToml } from 'smol-toml';
+import { environmentVariableIsPopulated, getCustomPath, invokeCommand } from '../tools.js';
+import { filterManifestPathsByDiscoveryIgnore, resolveWorkspaceDiscoveryIgnore, toManifestGlobPatterns } from '../workspace.js';
+import Base_pyproject from './base_pyproject.js';
+import { evaluateMarker } from './marker_evaluator.js';
+import { getParser, getPinnedVersionQuery } from './requirements_parser.js';
+export default class Python_uv extends Base_pyproject {
+    /** @returns {string} */
+    _lockFileName() {
+        return 'uv.lock';
+    }
+    /** @returns {string} */
+    _cmdName() {
+        return 'uv';
+    }
+    /**
+     * @param {string} manifestDir - directory containing the target pyproject.toml
+     * @param {string} workspaceDir - workspace root (for resolving editable install paths)
+     * @param {object} parsed - parsed pyproject.toml
+     * @param {Object} opts
+     * @returns {Promise<{directDeps: string[], graph: Map<string, import('./base_pyproject.js').GraphEntry>}>}
+     */
+    async _getDependencyData(manifestDir, workspaceDir, parsed, opts) {
+        let projectName = this._getProjectName(parsed);
+        let uvOutput = this._getUvExportOutput(manifestDir, opts);
+        let { directDeps, graph } = await this._parseUvExport(uvOutput, projectName, workspaceDir);
+        await this._attachHashesFromLockFile(path.join(workspaceDir, 'uv.lock'), graph);
+        return { directDeps, graph };
+    }
+    /**
+     * Parse uv.lock and attach SHA-256 hashes to graph entries.
+     * @param {string} lockFilePath - path to uv.lock
+     * @param {Map<string, import('./base_pyproject.js').GraphEntry>} graph
+     */
+    async _attachHashesFromLockFile(lockFilePath, graph) {
+        let lockContent;
+        try {
+            lockContent = await fs.promises.readFile(lockFilePath, 'utf-8');
+        }
+        catch {
+            return;
+        }
+        let parsed;
+        try {
+            parsed = parseToml(lockContent);
+        }
+        catch {
+            return;
+        }
+        let packages = parsed.package;
+        if (!Array.isArray(packages)) {
+            return;
+        }
+        for (let pkg of packages) {
+            if (!pkg.name) {
+                continue;
+            }
+            let hashStr = pkg.sdist?.hash || pkg.wheels?.[0]?.hash;
+            if (!hashStr || !hashStr.startsWith('sha256:')) {
+                continue;
+            }
+            let key = this._canonicalize(pkg.name);
+            let entry = graph.get(key);
+            if (!entry || entry.hashes) {
+                continue;
+            }
+            entry.hashes = [{ alg: "SHA-256", content: hashStr.slice(7) }];
+        }
+    }
+    /**
+     * Get the uv export output, either from env var or by running the command.
+     * @param {string} manifestDir
+     * @param {Object} opts
+     * @returns {string}
+     */
+    _getUvExportOutput(manifestDir, opts) {
+        if (environmentVariableIsPopulated('TRUSTIFY_DA_UV_EXPORT')) {
+            return Buffer.from(process.env['TRUSTIFY_DA_UV_EXPORT'], 'base64').toString('ascii');
+        }
+        let uvBin = getCustomPath('uv', opts);
+        return invokeCommand(uvBin, ['export', '--format', 'requirements.txt', '--frozen', '--no-hashes', '--no-dev', '--no-emit-project'], { cwd: manifestDir }).toString();
+    }
+    /**
+     * Parse uv export output into a dependency graph using tree-sitter-requirements
+     * for package/version extraction and string parsing for "# via" comments.
+     *
+     * @param {string} output
+     * @param {string} projectName - canonical project name to identify direct deps
+     * @param {string} workspaceDir - workspace root (for resolving editable install paths)
+     * @returns {Promise<{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}>}
+     */
+    async _parseUvExport(output, projectName, workspaceDir) {
+        let [parser, pinnedVersionQuery] = await Promise.all([
+            getParser(), getPinnedVersionQuery()
+        ]);
+        let tree = parser.parse(output);
+        let root = tree.rootNode;
+        let canonProjectName = this._canonicalize(projectName);
+        let packages = new Map(); // canonical name -> {name, version, parents: Set}
+        let currentPkg = null;
+        let collectingVia = false;
+        for (let child of root.children) {
+            if (child.type === 'global_opt') {
+                let optNode = child.children.find(c => c.type === 'option');
+                let pathNode = child.children.find(c => c.type === 'path');
+                if (optNode?.text === '-e' && pathNode && workspaceDir) {
+                    let memberDir = path.resolve(workspaceDir, pathNode.text);
+                    let memberManifest = path.join(memberDir, 'pyproject.toml');
+                    if (fs.existsSync(memberManifest)) {
+                        let memberParsed = parseToml(fs.readFileSync(memberManifest, 'utf-8'));
+                        let name = memberParsed.project?.name || memberParsed.tool?.poetry?.name;
+                        let version = memberParsed.project?.version || memberParsed.tool?.poetry?.version;
+                        if (name && version) {
+                            let key = this._canonicalize(name);
+                            if (key === canonProjectName) {
+                                continue;
+                            }
+                            currentPkg = { name, version, parents: new Set() };
+                            packages.set(key, currentPkg);
+                            collectingVia = false;
+                            continue;
+                        }
+                    }
+                }
+                currentPkg = null;
+                collectingVia = false;
+                continue;
+            }
+            if (child.type === 'requirement') {
+                let nameNode = child.children.find(c => c.type === 'package');
+                if (!nameNode) {
+                    continue;
+                }
+                // Skip packages with non-matching PEP 508 markers, e.g. "pywin32==311 ; sys_platform == 'win32'"
+                let markerNode = child.children.find(c => c.type === 'marker_spec');
+                if (markerNode) {
+                    let markerText = markerNode.text.replace(/^\s*;\s*/, '');
+                    if (!evaluateMarker(markerText)) {
+                        currentPkg = null;
+                        collectingVia = false;
+                        continue;
+                    }
+                }
+                let name = nameNode.text;
+                let version = null;
+                let versionMatches = pinnedVersionQuery.matches(child);
+                if (versionMatches.length > 0) {
+                    version = versionMatches[0].captures.find(c => c.name === 'version').node.text;
+                }
+                if (!version) {
+                    throw new Error(`uv export: package '${name}' has no pinned version`);
+                }
+                let key = this._canonicalize(name);
+                currentPkg = { name, version, parents: new Set() };
+                packages.set(key, currentPkg);
+                collectingVia = false;
+                continue;
+            }
+            if (child.type === 'comment' && currentPkg) {
+                let text = child.text.trim();
+                let viaSingle = text.match(/^# via ([A-Za-z0-9][A-Za-z0-9._-]*)$/);
+                if (viaSingle) {
+                    currentPkg.parents.add(this._canonicalize(viaSingle[1]));
+                    collectingVia = false;
+                    continue;
+                }
+                if (text === '# via') {
+                    collectingVia = true;
+                    continue;
+                }
+                if (collectingVia) {
+                    let parentMatch = text.match(/^#\s+([A-Za-z0-9][A-Za-z0-9._-]*)$/);
+                    if (parentMatch) {
+                        currentPkg.parents.add(this._canonicalize(parentMatch[1]));
+                        continue;
+                    }
+                    collectingVia = false;
+                }
+            }
+        }
+        // Build forward dependency map and extract direct deps in one pass
+        let graph = new Map();
+        let directDeps = [];
+        for (let [key, pkg] of packages) {
+            graph.set(key, { name: pkg.name, version: pkg.version, children: [] });
+        }
+        for (let [childKey, pkg] of packages) {
+            for (let parentKey of pkg.parents) {
+                if (parentKey === canonProjectName) {
+                    directDeps.push(childKey);
+                    continue;
+                }
+                let parentEntry = graph.get(parentKey);
+                if (parentEntry) {
+                    parentEntry.children.push(childKey);
+                }
+            }
+        }
+        return { directDeps, graph };
+    }
+}
+const DEFAULT_UV_DISCOVERY_IGNORE = [
+    '**/__pycache__/**',
+    '**/.venv/**',
+];
+/**
+ * Discover all pyproject.toml manifest paths in a uv workspace.
+ * Parses `[tool.uv.workspace]` from root pyproject.toml and glob-expands member patterns.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain pyproject.toml and uv.lock)
+ * @param {{ workspaceDiscoveryIgnore?: string[], TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string, [key: string]: unknown }} [opts={}]
+ * @returns {Promise<string[]>} Paths to pyproject.toml files (absolute)
+ */
+export async function discoverUvWorkspaceMembers(workspaceRoot, opts = {}) {
+    const root = path.resolve(workspaceRoot);
+    const rootPyproject = path.join(root, 'pyproject.toml');
+    const uvLock = path.join(root, 'uv.lock');
+    if (!fs.existsSync(rootPyproject) || !fs.existsSync(uvLock)) {
+        return [];
+    }
+    let parsed;
+    try {
+        parsed = parseToml(fs.readFileSync(rootPyproject, 'utf-8'));
+    }
+    catch {
+        return [];
+    }
+    const workspaceConfig = parsed?.tool?.uv?.workspace;
+    if (!workspaceConfig) {
+        return [];
+    }
+    const memberPatterns = workspaceConfig.members;
+    if (!Array.isArray(memberPatterns) || memberPatterns.length === 0) {
+        return [];
+    }
+    const excludePatterns = Array.isArray(workspaceConfig.exclude) ? workspaceConfig.exclude : [];
+    const excludeGlobs = excludePatterns
+        .filter(p => typeof p === 'string' && p.trim())
+        .map(p => `${p.trim()}/pyproject.toml`);
+    const ignorePatterns = [...resolveWorkspaceDiscoveryIgnore(opts), ...DEFAULT_UV_DISCOVERY_IGNORE];
+    const globOpts = {
+        cwd: root,
+        absolute: true,
+        onlyFiles: true,
+        ignore: [...ignorePatterns, ...excludeGlobs],
+        followSymbolicLinks: false,
+    };
+    const patterns = toManifestGlobPatterns(memberPatterns.filter(p => typeof p === 'string'), 'pyproject.toml');
+    const manifestPaths = await fg(patterns, globOpts);
+    if (!manifestPaths.includes(rootPyproject) && hasProjectMetadata(parsed)) {
+        manifestPaths.unshift(rootPyproject);
+    }
+    return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+}
+/**
+ * @param {import('smol-toml').TomlTable} parsedPyProject
+ * @returns {boolean}
+ */
+function hasProjectMetadata(parsedPyProject) {
+    try {
+        return typeof parsedPyProject?.project?.name === 'string' && parsedPyProject.project.name.trim() !== '';
+    }
+    catch {
+        return false;
+    }
+}

package/dist/src/providers/rust_cargo.d.ts

@@ -4,9 +4,10 @@ declare namespace _default {
     export { provideComponent };
     export { provideStack };
     export { readLicenseFromManifest };
+    export function packageManagerName(): string;
 }
 export default _default;
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 /**
  * @param {string} manifestName - the subject manifest name-type
  * @returns {boolean} - return true if `Cargo.toml` is the manifest name-type
@@ -46,7 +47,10 @@ declare function provideStack(manifest: string, opts?: {}): Provided;
  * Read project license from Cargo.toml, with fallback to LICENSE file.
  * Supports the `license` field under `[package]` (single crate / workspace
  * with root) and under `[workspace.package]` (virtual workspaces).
+ * When a member crate uses `license = { workspace = true }`, the actual
+ * license is resolved from the workspace root Cargo.toml.
  * @param {string} manifestPath - path to Cargo.toml
+ * @param {object} [metadata] - cargo metadata output (needed for workspace license resolution)
  * @returns {string|null} SPDX identifier or null
  */
-declare function readLicenseFromManifest(manifestPath: string): string | null;
+declare function readLicenseFromManifest(manifestPath: string, metadata?: object): string | null;

package/dist/src/providers/rust_cargo.js

@@ -5,7 +5,7 @@ import { parse as parseToml } from 'smol-toml';
 import { getLicense } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
 import { getCustom, getCustomPath, invokeCommand } from '../tools.js';
-export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest };
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'cargo'; } };
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /**
@@ -71,15 +71,22 @@ function isSupported(manifestName) {
  * Read project license from Cargo.toml, with fallback to LICENSE file.
  * Supports the `license` field under `[package]` (single crate / workspace
  * with root) and under `[workspace.package]` (virtual workspaces).
+ * When a member crate uses `license = { workspace = true }`, the actual
+ * license is resolved from the workspace root Cargo.toml.
  * @param {string} manifestPath - path to Cargo.toml
+ * @param {object} [metadata] - cargo metadata output (needed for workspace license resolution)
  * @returns {string|null} SPDX identifier or null
  */
-function readLicenseFromManifest(manifestPath) {
+function readLicenseFromManifest(manifestPath, metadata) {
     let fromManifest = null;
     try {
         let content = fs.readFileSync(manifestPath, 'utf-8');
         let parsed = parseToml(content);
-        fromManifest = parsed.package?.license
+        let packageLicense = parsed.package?.license;
+        if (typeof packageLicense === 'object' && packageLicense?.workspace === true) {
+            packageLicense = resolveWorkspaceLicense(parsed, metadata);
+        }
+        fromManifest = packageLicense
             || parsed.workspace?.package?.license
             || null;
     }
@@ -88,6 +95,26 @@ function readLicenseFromManifest(manifestPath) {
     }
     return getLicense(fromManifest, manifestPath);
 }
+/**
+ * Resolve a workspace-inherited license from the workspace root Cargo.toml.
+ * @param {object} parsed - the parsed member crate Cargo.toml
+ * @param {object} [metadata] - cargo metadata output with workspace_root
+ * @returns {string|null} resolved license string or null
+ */
+function resolveWorkspaceLicense(parsed, metadata) {
+    if (metadata?.workspace_root) {
+        let cargoTomlPath = path.join(metadata.workspace_root, 'Cargo.toml');
+        try {
+            let content = fs.readFileSync(cargoTomlPath, 'utf-8');
+            let workspaceParsed = parseToml(content);
+            return workspaceParsed.workspace?.package?.license || null;
+        }
+        catch (_) {
+            // fall through
+        }
+    }
+    return parsed.workspace?.package?.license || null;
+}
 /**
  * Validates that Cargo.lock exists in the manifest directory or in a parent
  * workspace root directory.  In Cargo workspaces the lock file always lives at
@@ -173,7 +200,7 @@ function getSBOM(manifest, opts = {}, includeTransitive) {
     let metadata = executeCargoMetadata(cargoBin, manifestDir);
     let ignoredDeps = getIgnoredDeps(manifest, metadata);
     let crateType = detectCrateType(metadata);
-    let license = readLicenseFromManifest(manifest);
+    let license = readLicenseFromManifest(manifest, metadata);
     let sbom;
     if (crateType === CrateType.WORKSPACE_VIRTUAL) {
         sbom = handleVirtualWorkspace(manifest, metadata, ignoredDeps, includeTransitive, opts, license);

package/dist/src/sbom.d.ts

@@ -25,9 +25,14 @@ export default class Sbom {
     /**
      * @param {component} sourceRef current source Component ( Starting from root component by clients)
      * @param {PackageURL} targetRef current dependency to add to Dependencies list of component sourceRef
+     * @param {string} [scope] - Scope of the dependency
+     * @param {Array<{alg: string, content: string}>} [targetHashes] - Optional hashes for the target component
      * @return Sbom
      */
-    addDependency(sourceRef: component, targetRef: PackageURL, scope: any): CycloneDxSbom;
+    addDependency(sourceRef: component, targetRef: PackageURL, scope?: string, targetHashes?: Array<{
+        alg: string;
+        content: string;
+    }>): CycloneDxSbom;
     /**
      * @return String sbom json in a string format
      */
@@ -45,6 +50,7 @@ export default class Sbom {
         version: any;
         scope: any;
         licenses?: any;
+        hashes?: any;
     };
     /** This method gets a component object, and a string name, and checks if the name is a substring of the component' purl.
      * @param {} component to search in its dependencies
@@ -53,6 +59,13 @@ export default class Sbom {
      * @return {boolean}
      */
     checkIfPackageInsideDependsOnList(component: any, name: string): boolean;
+    /**
+     * Checks if any entry in the dependsOn list of sourceRef starts with the given purl prefix.
+     * @param {PackageURL} sourceRef - The source component to check
+     * @param {string} purlPrefix - The purl prefix to match (e.g. "pkg:npm/minimist@")
+     * @return {boolean}
+     */
+    checkDependsOnByPurlPrefix(sourceRef: PackageURL, purlPrefix: string): boolean;
     /** Removes the root component from the sbom
      */
     removeRootComponent(): void;

package/dist/src/sbom.js

@@ -43,10 +43,12 @@ export default class Sbom {
     /**
      * @param {component} sourceRef current source Component ( Starting from root component by clients)
      * @param {PackageURL} targetRef current dependency to add to Dependencies list of component sourceRef
+     * @param {string} [scope] - Scope of the dependency
+     * @param {Array<{alg: string, content: string}>} [targetHashes] - Optional hashes for the target component
      * @return Sbom
      */
-    addDependency(sourceRef, targetRef, scope) {
-        return this.sbomModel.addDependency(sourceRef, targetRef, scope);
+    addDependency(sourceRef, targetRef, scope, targetHashes) {
+        return this.sbomModel.addDependency(sourceRef, targetRef, scope, targetHashes);
     }
     /**
      * @return String sbom json in a string format
@@ -77,6 +79,15 @@ export default class Sbom {
     checkIfPackageInsideDependsOnList(component, name) {
         return this.sbomModel.checkIfPackageInsideDependsOnList(component, name);
     }
+    /**
+     * Checks if any entry in the dependsOn list of sourceRef starts with the given purl prefix.
+     * @param {PackageURL} sourceRef - The source component to check
+     * @param {string} purlPrefix - The purl prefix to match (e.g. "pkg:npm/minimist@")
+     * @return {boolean}
+     */
+    checkDependsOnByPurlPrefix(sourceRef, purlPrefix) {
+        return this.sbomModel.checkDependsOnByPurlPrefix(sourceRef, purlPrefix);
+    }
     /** Removes the root component from the sbom
      */
     removeRootComponent() {

package/dist/src/tools.d.ts

@@ -61,6 +61,32 @@ export function toPurlFromString(strPurl: any): PackageURL | null;
  * @param {string} cwd - directory for which to find the root of the git repository.
  */
 export function getGitRootDir(cwd: string): string | undefined;
+/**
+ * Normalize a filesystem path, lowercasing on Windows for case-insensitive comparison.
+ *
+ * @param {string} thePath
+ * @returns {string}
+ */
+export function normalizePath(thePath: string): string;
+/**
+ * Walk up from `startDir` to `repoRoot` looking for an executable wrapper script.
+ *
+ * @param {string} startDir - Absolute directory to start from
+ * @param {string} wrapperName - Wrapper filename (e.g. `mvnw`, `gradlew`)
+ * @param {string} [repoRoot] - Stop boundary (defaults to git root or filesystem root)
+ * @returns {string | undefined}
+ */
+export function traverseForWrapper(startDir: string, wrapperName: string, repoRoot?: string): string | undefined;
+/**
+ * Resolve a build-tool binary, preferring a wrapper when configured.
+ *
+ * @param {string} globalBinary - Global binary name (e.g. `mvn`, `gradle`)
+ * @param {string} localWrapper - Wrapper filename (e.g. `mvnw`, `gradlew.bat`)
+ * @param {string} startDir - Directory from which to start the wrapper search
+ * @param {import('./index.js').Options} [opts={}]
+ * @returns {string} Path to the resolved binary
+ */
+export function resolveBinary(globalBinary: string, localWrapper: string, startDir: string, opts?: import("./index.js").Options): string;
 /** this method invokes command string in a process in a synchronous way.
  * @param {string} bin - the command to be invoked
  * @param {Array<string>} args - the args to pass to the binary
@@ -74,13 +100,13 @@ export function invokeCommand(bin: string, args: Array<string>, opts?: import("c
  * @param {import("index.js").Options} opts - The trustify DA options that may contain proxy configuration
  * @returns {RequestInit} The fetch options with proxy agent if applicable
  */
-export function addProxyAgent(options: RequestInit, opts: import("index.js").Options): RequestInit;
+export function addProxyAgent(options: RequestInit, opts: any): RequestInit;
 /**
  * Utility function for fetching vendor tokens
  * @param {import("index.js").Options} [opts={}] - optional various options to pass along the application
  * @returns {{}}
  */
-export function getTokenHeaders(opts?: import("index.js").Options): {};
+export function getTokenHeaders(opts?: any): {};
 export const RegexNotToBeLogged: RegExp;
 export const TRUSTIFY_DA_TOKEN_HEADER: "trust-da-token";
 export const TRUSTIFY_DA_TELEMETRY_ID_HEADER: "telemetry-anonymous-id";

package/dist/src/tools.js

@@ -1,4 +1,6 @@
 import { execFileSync } from "child_process";
+import fs from 'node:fs';
+import path from 'node:path';
 import { EOL } from "os";
 import { HttpsProxyAgent } from "https-proxy-agent";
 import { PackageURL } from "packageurl-js";
@@ -128,6 +130,62 @@ export function getGitRootDir(cwd) {
         return undefined;
     }
 }
+/**
+ * Normalize a filesystem path, lowercasing on Windows for case-insensitive comparison.
+ *
+ * @param {string} thePath
+ * @returns {string}
+ */
+export function normalizePath(thePath) {
+    const normalized = path.resolve(thePath).normalize();
+    return process.platform === 'win32' ? normalized.toLowerCase() : normalized;
+}
+/**
+ * Walk up from `startDir` to `repoRoot` looking for an executable wrapper script.
+ *
+ * @param {string} startDir - Absolute directory to start from
+ * @param {string} wrapperName - Wrapper filename (e.g. `mvnw`, `gradlew`)
+ * @param {string} [repoRoot] - Stop boundary (defaults to git root or filesystem root)
+ * @returns {string | undefined}
+ */
+export function traverseForWrapper(startDir, wrapperName, repoRoot = undefined) {
+    const currentDir = normalizePath(startDir);
+    repoRoot = repoRoot || getGitRootDir(currentDir) || path.parse(currentDir).root;
+    const wrapperPath = path.join(currentDir, wrapperName);
+    try {
+        fs.accessSync(wrapperPath, fs.constants.X_OK);
+        return wrapperPath;
+    }
+    catch {
+        const rootDir = path.parse(currentDir).root;
+        if (currentDir === repoRoot || currentDir === rootDir) {
+            return undefined;
+        }
+        const parentDir = path.dirname(currentDir);
+        if (parentDir === currentDir || parentDir === rootDir) {
+            return undefined;
+        }
+        return traverseForWrapper(parentDir, wrapperName, repoRoot);
+    }
+}
+/**
+ * Resolve a build-tool binary, preferring a wrapper when configured.
+ *
+ * @param {string} globalBinary - Global binary name (e.g. `mvn`, `gradle`)
+ * @param {string} localWrapper - Wrapper filename (e.g. `mvnw`, `gradlew.bat`)
+ * @param {string} startDir - Directory from which to start the wrapper search
+ * @param {import('./index.js').Options} [opts={}]
+ * @returns {string} Path to the resolved binary
+ */
+export function resolveBinary(globalBinary, localWrapper, startDir, opts = {}) {
+    if (getWrapperPreference(globalBinary, opts)) {
+        const wrapper = traverseForWrapper(startDir, localWrapper);
+        if (wrapper !== undefined) {
+            return wrapper;
+        }
+    }
+    return getCustomPath(globalBinary, opts);
+}
 /** this method invokes command string in a process in a synchronous way.
  * @param {string} bin - the command to be invoked
  * @param {Array<string>} args - the args to pass to the binary

package/dist/src/updaters/maven_updater.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Updates dependency versions in a Maven pom.xml while preserving file formatting.
+ *
+ * Uses `fast-xml-parser` to understand the XML structure (dependencies and properties),
+ * then performs position-based string splice to replace version strings without altering
+ * any other formatting, comments, whitespace, or indentation.
+ *
+ * Supports `${property}` indirection: when a dependency's `<version>` is a property
+ * reference, the updater resolves the property chain (including recursive references)
+ * and updates the terminal property value in `<properties>` instead.
+ *
+ * @param {string} pomContent - the raw pom.xml file content
+ * @param {Array<{groupId: string, artifactId: string, newVersion: string}>} versionChanges -
+ *   list of version changes to apply
+ * @returns {{content: string, applied: Array, skipped: Array}} the updated content and
+ *   lists of applied and skipped changes
+ */
+export function updateMavenVersions(pomContent: string, versionChanges: Array<{
+    groupId: string;
+    artifactId: string;
+    newVersion: string;
+}>): {
+    content: string;
+    applied: any[];
+    skipped: any[];
+};