@trustify-da/trustify-da-javascript-client 0.3.0-ea.243eaef → 0.3.0-ea.24dd325

package/dist/src/remediate.d.ts

@@ -1,3 +1,14 @@
+/**
+ * Resolves a target path to the supported manifest files it contains: the single file
+ * if `targetPath` is a supported manifest, or every supported manifest discovered
+ * recursively if it's a directory. This is the single source of truth for what
+ * `runRemediation` will scan, so callers (e.g. the CLI) can reuse it to tell
+ * "no manifests here" apart from "manifests, but nothing to fix".
+ * @param {string} targetPath - path to a manifest file or directory
+ * @returns {string[]} absolute paths to supported manifests (empty for an empty directory)
+ * @throws if the path does not exist, or is a file of an unsupported manifest type
+ */
+export function findManifests(targetPath: string): string[];
 /**
  * Orchestrates the full remediation pipeline for a single manifest or directory:
  * discover manifests → scan via DA backend → extract remediations → apply or preview.
@@ -7,15 +18,103 @@
  * @param {boolean} [options.dryRun=false] - preview changes without modifying files (applies by default)
  * @param {string} [options.providers] - comma-separated provider list
  * @param {string} [options.sources] - comma-separated source list
- * @param {'dependency'|'bundle'} [options.groupBy='dependency'] - report grouping strategy
- * @returns {Promise<{exitCode: number, output: string}>}
+ * @param {string} [options.backendUrl] - Trustify DA backend URL
+ * @param {boolean} [options.perDependencyChanges=false] - when true, each remediation is populated with
+ *   a `changes` array describing the isolated, single-dependency edit (see {@link DependencyFix}). This lets
+ *   callers create one commit/PR per dependency without attributing diff hunks themselves.
+ * @returns {Promise<{exitCode: number, output: string, remediations: Remediation[], manifests: string[], appliedFiles: string[]}>}
+ *   exitCode is 2 for a dry-run that found remediations (nothing written), 0 otherwise. `remediations`
+ *   is the structured, per-manifest list of applicable updates — each entry carries the originating
+ *   manifest path(s) in `files` so callers can group and create per-dependency changes. `appliedFiles`
+ *   lists only the manifests actually written to disk (empty on a dry-run), so callers can report a
+ *   truthful "updated N files" count without conflating "had remediations" with "was written".
  */
 export function runRemediation(targetPath: string, options?: {
     dryRun?: boolean | undefined;
     providers?: string | undefined;
     sources?: string | undefined;
-    groupBy?: "bundle" | "dependency" | undefined;
+    backendUrl?: string | undefined;
+    perDependencyChanges?: boolean | undefined;
 }): Promise<{
     exitCode: number;
     output: string;
+    remediations: Remediation[];
+    manifests: string[];
+    appliedFiles: string[];
 }>;
+/**
+ * A single version change requested from an updater: bump `groupId:artifactId` to `newVersion`.
+ * The input side of every updater; each updater's output side (its `applied` entries) is its own
+ * type — see {@link AppliedChange}.
+ */
+export type VersionChangeRequest = {
+    groupId: string;
+    artifactId: string;
+    newVersion: string;
+};
+/**
+ * One entry from an updater's `applied` list, describing where and how a version was changed.
+ * Owned by the updater layer: the union of each updater's applied-entry shape. `changeKey`
+ * (per {@link ManifestType}) turns one of these into a stable edit-site identifier.
+ */
+export type AppliedChange = import("./updaters/maven_updater.js").MavenAppliedChange | import("./updaters/toml_updater.js").TomlAppliedChange;
+/**
+ * The result of running an updater over a manifest's raw content.
+ */
+export type UpdaterResult = {
+    content: string;
+    applied: AppliedChange[];
+    skipped: Array<{
+        groupId: string;
+        artifactId: string;
+        newVersion: string;
+        reason: string;
+    }>;
+};
+/**
+ * A supported manifest type and the operations that act on it.
+ * `changeKey` builds a stable edit-site key from a single `applied` entry, so callers can detect
+ * inseparable remediations (same key => same commit/PR).
+ */
+export type ManifestType = {
+    test: (basename: string) => boolean;
+    updater: (content: string, versionChanges: VersionChangeRequest[]) => UpdaterResult;
+    label: ("maven" | "toml");
+    changeKey: (manifestPath: string, applied: AppliedChange) => string;
+};
+/**
+ * An isolated, single-dependency edit to one manifest file.
+ * - `after` is the *original* manifest content with only this dependency's fix applied, so a caller
+ *   can create an isolated commit by writing `after` to `path` on a branch cut from the base.
+ * - `changeKey` is a stable identifier for the underlying edit site. Two remediations that share a
+ *   `changeKey` are inseparable (e.g. two Maven deps whose versions resolve to the same `${property}`,
+ *   or two Gradle libraries sharing one `version.ref`) and MUST land in the same commit/PR — the
+ *   caller should union their CVEs/advisories.
+ */
+export type DependencyFix = {
+    path: string;
+    after: string;
+    changeKey: string;
+};
+/**
+ * A single applicable remediation, as produced by `extractRemediations` and enriched by
+ * `runRemediation` with the originating manifest path(s) and (optionally) per-dependency changes.
+ */
+export type Remediation = {
+    purl: string;
+    groupId: string;
+    artifactId: string;
+    currentVersion: string;
+    fixedInVersion: string;
+    fixedInPurl: string;
+    provider: string;
+    source: string;
+    advisories: Array<{
+        id: string;
+        url: string;
+    }>;
+    severity: string;
+    cves: string[];
+    files: string[];
+    changes?: DependencyFix[];
+};

package/dist/src/remediate.js

@@ -3,34 +3,122 @@ import path from 'node:path';
 import analysis from './analysis.js';
 import { availableProviders, match } from './provider.js';
 import { extractRemediations } from './remediation.js';
-import { generateReport } from './remediation_report.js';
-import { updateMavenVersions } from './updaters/maven_updater.js';
-import { updateTomlVersions } from './updaters/toml_updater.js';
+import { mavenChangeKey, updateMavenVersions } from './updaters/maven_updater.js';
+import { tomlChangeKey, updateTomlVersions } from './updaters/toml_updater.js';
 import { selectTrustifyDABackend } from './index.js';
 // Mirrors DEFAULT_WORKSPACE_DISCOVERY_IGNORE in workspace.js
 const SKIP_DIRS = new Set(['node_modules', '.git']);
+/**
+ * A single version change requested from an updater: bump `groupId:artifactId` to `newVersion`.
+ * The input side of every updater; each updater's output side (its `applied` entries) is its own
+ * type — see {@link AppliedChange}.
+ * @typedef {{groupId: string, artifactId: string, newVersion: string}} VersionChangeRequest
+ */
+/**
+ * One entry from an updater's `applied` list, describing where and how a version was changed.
+ * Owned by the updater layer: the union of each updater's applied-entry shape. `changeKey`
+ * (per {@link ManifestType}) turns one of these into a stable edit-site identifier.
+ * @typedef {import('./updaters/maven_updater.js').MavenAppliedChange
+ *   | import('./updaters/toml_updater.js').TomlAppliedChange} AppliedChange
+ */
+/**
+ * The result of running an updater over a manifest's raw content.
+ * @typedef {{content: string, applied: AppliedChange[], skipped: Array<{groupId: string, artifactId: string, newVersion: string, reason: string}>}} UpdaterResult
+ */
+/**
+ * A supported manifest type and the operations that act on it.
+ * `changeKey` builds a stable edit-site key from a single `applied` entry, so callers can detect
+ * inseparable remediations (same key => same commit/PR).
+ * @typedef {{
+ *   test: (basename: string) => boolean,
+ *   updater: (content: string, versionChanges: VersionChangeRequest[]) => UpdaterResult,
+ *   label: ('maven'|'toml'),
+ *   changeKey: (manifestPath: string, applied: AppliedChange) => string
+ * }} ManifestType
+ */
+/**
+ * An isolated, single-dependency edit to one manifest file.
+ * - `after` is the *original* manifest content with only this dependency's fix applied, so a caller
+ *   can create an isolated commit by writing `after` to `path` on a branch cut from the base.
+ * - `changeKey` is a stable identifier for the underlying edit site. Two remediations that share a
+ *   `changeKey` are inseparable (e.g. two Maven deps whose versions resolve to the same `${property}`,
+ *   or two Gradle libraries sharing one `version.ref`) and MUST land in the same commit/PR — the
+ *   caller should union their CVEs/advisories.
+ * @typedef {{ path: string, after: string, changeKey: string }} DependencyFix
+ */
+/**
+ * A single applicable remediation, as produced by `extractRemediations` and enriched by
+ * `runRemediation` with the originating manifest path(s) and (optionally) per-dependency changes.
+ * @typedef {{
+ *   purl: string,
+ *   groupId: string,
+ *   artifactId: string,
+ *   currentVersion: string,
+ *   fixedInVersion: string,
+ *   fixedInPurl: string,
+ *   provider: string,
+ *   source: string,
+ *   advisories: Array<{id: string, url: string}>,
+ *   severity: string,
+ *   cves: string[],
+ *   files: string[],
+ *   changes?: DependencyFix[]
+ * }} Remediation
+ */
+/** @type {ManifestType[]} */
 const MANIFEST_TYPES = [
     {
         test: (basename) => basename === 'pom.xml',
         updater: updateMavenVersions,
         label: 'maven',
+        changeKey: mavenChangeKey
     },
     {
         test: (basename) => basename.endsWith('.versions.toml') || basename === 'libs.versions.toml',
         updater: updateTomlVersions,
         label: 'toml',
+        changeKey: tomlChangeKey
     },
 ];
 /**
- * Discovers supported manifest files recursively within a directory.
- * @param {string} dirPath - absolute path to the directory
- * @returns {string[]} array of absolute paths to supported manifest files
+ * Returns the manifest type descriptor for a given filename, or null if unsupported.
+ * @param {string} basename - the file name to check
+ * @returns {ManifestType|null}
+ */
+function getManifestType(basename) {
+    return MANIFEST_TYPES.find(t => t.test(basename)) || null;
+}
+/**
+ * Resolves a target path to the supported manifest files it contains: the single file
+ * if `targetPath` is a supported manifest, or every supported manifest discovered
+ * recursively if it's a directory. This is the single source of truth for what
+ * `runRemediation` will scan, so callers (e.g. the CLI) can reuse it to tell
+ * "no manifests here" apart from "manifests, but nothing to fix".
+ * @param {string} targetPath - path to a manifest file or directory
+ * @returns {string[]} absolute paths to supported manifests (empty for an empty directory)
+ * @throws if the path does not exist, or is a file of an unsupported manifest type
  */
-function discoverManifests(dirPath) {
+export function findManifests(targetPath) {
+    const resolvedPath = path.resolve(targetPath);
+    let stat;
+    try {
+        stat = fs.statSync(resolvedPath);
+    }
+    catch {
+        throw new Error(`Path not found: ${resolvedPath}`);
+    }
+    // A single file must itself be a supported manifest.
+    if (!stat.isDirectory()) {
+        const basename = path.basename(resolvedPath);
+        if (!getManifestType(basename)) {
+            throw new Error(`Unsupported manifest type: ${basename}`);
+        }
+        return [resolvedPath];
+    }
+    // A directory yields every supported manifest found recursively beneath it.
     const manifests = [];
     function walk(dir) {
-        const entries = fs.readdirSync(dir, { withFileTypes: true });
-        for (const entry of entries) {
+        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
             if (SKIP_DIRS.has(entry.name)) {
                 continue;
             }
@@ -43,17 +131,9 @@ function discoverManifests(dirPath) {
             }
         }
     }
-    walk(dirPath);
+    walk(resolvedPath);
     return manifests;
 }
-/**
- * Returns the manifest type descriptor for a given filename, or null if unsupported.
- * @param {string} basename - the file name to check
- * @returns {{test: function, updater: function, label: string}|null}
- */
-function getManifestType(basename) {
-    return MANIFEST_TYPES.find(t => t.test(basename)) || null;
-}
 /**
  * Orchestrates the full remediation pipeline for a single manifest or directory:
  * discover manifests → scan via DA backend → extract remediations → apply or preview.
@@ -63,38 +143,31 @@ function getManifestType(basename) {
  * @param {boolean} [options.dryRun=false] - preview changes without modifying files (applies by default)
  * @param {string} [options.providers] - comma-separated provider list
  * @param {string} [options.sources] - comma-separated source list
- * @param {'dependency'|'bundle'} [options.groupBy='dependency'] - report grouping strategy
- * @returns {Promise<{exitCode: number, output: string}>}
+ * @param {string} [options.backendUrl] - Trustify DA backend URL
+ * @param {boolean} [options.perDependencyChanges=false] - when true, each remediation is populated with
+ *   a `changes` array describing the isolated, single-dependency edit (see {@link DependencyFix}). This lets
+ *   callers create one commit/PR per dependency without attributing diff hunks themselves.
+ * @returns {Promise<{exitCode: number, output: string, remediations: Remediation[], manifests: string[], appliedFiles: string[]}>}
+ *   exitCode is 2 for a dry-run that found remediations (nothing written), 0 otherwise. `remediations`
+ *   is the structured, per-manifest list of applicable updates — each entry carries the originating
+ *   manifest path(s) in `files` so callers can group and create per-dependency changes. `appliedFiles`
+ *   lists only the manifests actually written to disk (empty on a dry-run), so callers can report a
+ *   truthful "updated N files" count without conflating "had remediations" with "was written".
  */
 export async function runRemediation(targetPath, options = {}) {
-    const { dryRun = false, providers, sources, groupBy = 'dependency' } = options;
-    const resolvedPath = path.resolve(targetPath);
-    let manifestPaths;
-    let stat;
-    try {
-        stat = fs.statSync(resolvedPath);
-    }
-    catch {
-        throw new Error(`Path not found: ${resolvedPath}`);
-    }
-    if (stat.isDirectory()) {
-        manifestPaths = discoverManifests(resolvedPath);
-        if (manifestPaths.length === 0) {
-            return { exitCode: 0, output: 'No supported manifest files found.' };
-        }
-    }
-    else {
-        const basename = path.basename(resolvedPath);
-        if (!getManifestType(basename)) {
-            throw new Error(`Unsupported manifest type: ${basename}`);
-        }
-        manifestPaths = [resolvedPath];
+    const { dryRun = false, providers, sources, perDependencyChanges = false, backendUrl } = options;
+    const manifestPaths = findManifests(targetPath);
+    if (manifestPaths.length === 0) {
+        return { exitCode: 0, remediations: [], manifests: manifestPaths, appliedFiles: [] };
     }
     const opts = {};
-    if (providers) {
+    if (backendUrl !== undefined) {
+        opts.TRUSTIFY_DA_BACKEND_URL = backendUrl;
+    }
+    if (providers !== undefined) {
         opts.TRUSTIFY_DA_PROVIDERS = providers;
     }
-    if (sources) {
+    if (sources !== undefined) {
         opts.TRUSTIFY_DA_SOURCES = sources;
     }
     const url = selectTrustifyDABackend(opts);
@@ -120,15 +193,52 @@ export async function runRemediation(targetPath, options = {}) {
         if (remediations.length === 0) {
             continue;
         }
-        allRemediations.push(...remediations);
+        // Tag each remediation with the manifest it came from so callers can group
+        // changes per dependency across a multi-manifest workspace.
+        for (const remediation of remediations) {
+            remediation.files = [manifestPath];
+        }
+        // Read the pristine manifest once. Both the atomic apply and the per-dependency
+        // change computation must diff against the *original* content.
+        const needsContent = perDependencyChanges || !dryRun;
+        const originalContent = needsContent ? fs.readFileSync(manifestPath, 'utf-8') : null;
+        if (perDependencyChanges) {
+            // With per-dependency changes every returned remediation must carry an isolated
+            // edit. A dependency the updater cannot locate in this manifest — e.g. a vulnerable
+            // *transitive* dependency surfaced by analysis but not declared here — yields no
+            // applied change, so it is dropped rather than returned with an absent `changes`
+            // array (which would crash callers that iterate `remediation.changes` to build PRs).
+            const applicable = [];
+            for (const remediation of remediations) {
+                const isolated = manifestType.updater(originalContent, [{
+                        groupId: remediation.groupId,
+                        artifactId: remediation.artifactId,
+                        newVersion: remediation.fixedInVersion,
+                    }]);
+                if (isolated.applied.length === 0) {
+                    continue;
+                }
+                remediation.changes = [{
+                        path: manifestPath,
+                        after: isolated.content,
+                        changeKey: manifestType.changeKey(manifestPath, isolated.applied[0])
+                    }];
+                applicable.push(remediation);
+            }
+            allRemediations.push(...applicable);
+        }
+        else {
+            allRemediations.push(...remediations);
+        }
         if (!dryRun) {
-            const content = fs.readFileSync(manifestPath, 'utf-8');
-            const versionChanges = remediations.map(r => ({
+            // Disk receives the union of every dependency's fix. When
+            // perDependencyChanges is also set, each remediation's `changes[].after`
+            // deliberately stays isolated (single-dep) for branch-per-dep workflows.
+            const result = manifestType.updater(originalContent, remediations.map(r => ({
                 groupId: r.groupId,
                 artifactId: r.artifactId,
                 newVersion: r.fixedInVersion,
-            }));
-            const result = manifestType.updater(content, versionChanges);
+            })));
             if (result.applied.length > 0) {
                 fs.writeFileSync(manifestPath, result.content, 'utf-8');
                 appliedFiles.push(manifestPath);
@@ -136,14 +246,8 @@ export async function runRemediation(targetPath, options = {}) {
         }
     }
     if (allRemediations.length === 0) {
-        return { exitCode: 0, output: 'No remediations found.' };
-    }
-    const report = generateReport(allRemediations, { groupBy });
-    if (dryRun) {
-        return { exitCode: 2, output: report };
+        return { exitCode: 0, remediations: [], manifests: manifestPaths, appliedFiles };
     }
-    const summary = appliedFiles.length > 0
-        ? `Updated ${appliedFiles.length} file(s):\n${appliedFiles.map(f => `  ${f}`).join('\n')}\n\n${report}`
-        : report;
-    return { exitCode: 0, output: summary };
+    // Dry-run signals "changes available but not written" via exit code 2.
+    return { exitCode: dryRun ? 2 : 0, remediations: allRemediations, manifests: manifestPaths, appliedFiles };
 }

package/dist/src/remediation.d.ts

@@ -6,18 +6,18 @@
  * version selection strategy to resolve conflicts. Dependencies with no remediation
  * data are skipped.
  *
- * @param {object} analysisReport - raw DA AnalysisReport JSON response
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport} analysisReport - raw DA AnalysisReport JSON response
  * @param {object} [options] - extraction options
  * @param {string[]} [options.providerPriority] - provider names in descending priority order.
  *   The first entry has the highest priority. Providers not listed share the lowest priority.
  *   When omitted or empty, all providers are treated equally and the highest fix version wins.
- * @param {object} [options.versionStrategy] - version selection strategy with selectVersion
+ * @param {VersionStrategy} [options.versionStrategy] - version selection strategy with selectVersion
  *   and resolveConflict methods. Defaults to closestCoverageStrategy.
  * @returns {Array<{purl: string, groupId: string, artifactId: string, currentVersion: string, fixedInVersion: string, fixedInPurl: string, provider: string, source: string, advisories: Array<{id: string, url: string}>, severity: string, cves: string[]}>}
  */
-export function extractRemediations(analysisReport: object, options?: {
+export function extractRemediations(analysisReport: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts").AnalysisReport, options?: {
     providerPriority?: string[] | undefined;
-    versionStrategy?: object | undefined;
+    versionStrategy?: VersionStrategy | undefined;
 }): Array<{
     purl: string;
     groupId: string;
@@ -34,24 +34,25 @@ export function extractRemediations(analysisReport: object, options?: {
     severity: string;
     cves: string[];
 }>;
+/**
+ * @typedef {{selectVersion: (fixedInVersions: string[], currentVersion: string) => string, resolveConflict: (existing: ConflictCandidate, candidate: ConflictCandidate) => 'existing'|'candidate'}} VersionStrategy
+ */
 /**
  * Version selection strategy that prefers the closest compatible version
  * within the same major version stream. Falls back to the lowest cross-major
  * version when no same-major option exists.
- * @type {{selectVersion: function(string[], string): string, resolveConflict: function(object, object): string}}
+ * @type {VersionStrategy}
  */
-export const closestCoverageStrategy: {
-    selectVersion: (arg0: string[], arg1: string) => string;
-    resolveConflict: (arg0: object, arg1: object) => string;
-};
+export const closestCoverageStrategy: VersionStrategy;
 /**
  * Version selection strategy that always picks the highest version regardless
  * of major version distance. Guarantees maximum CVE coverage but may produce
  * large version jumps. This is the original behavior before pluggable strategies.
- * @type {{selectVersion: function(string[], string): string, resolveConflict: function(object, object): string}}
+ * @type {VersionStrategy}
  */
-export const highestStrategy: {
-    selectVersion: (arg0: string[], arg1: string) => string;
-    resolveConflict: (arg0: object, arg1: object) => string;
-};
+export const highestStrategy: VersionStrategy;
 export const SEVERITY_ORDER: string[];
+export type VersionStrategy = {
+    selectVersion: (fixedInVersions: string[], currentVersion: string) => string;
+    resolveConflict: (existing: ConflictCandidate, candidate: ConflictCandidate) => "existing" | "candidate";
+};

package/dist/src/remediation.js

@@ -7,11 +7,14 @@ import { PackageURL } from 'packageurl-js';
 function getMajorVersion(version) {
     return version.split('.')[0] || '';
 }
+/**
+ * @typedef {{selectVersion: (fixedInVersions: string[], currentVersion: string) => string, resolveConflict: (existing: ConflictCandidate, candidate: ConflictCandidate) => 'existing'|'candidate'}} VersionStrategy
+ */
 /**
  * Version selection strategy that prefers the closest compatible version
  * within the same major version stream. Falls back to the lowest cross-major
  * version when no same-major option exists.
- * @type {{selectVersion: function(string[], string): string, resolveConflict: function(object, object): string}}
+ * @type {VersionStrategy}
  */
 export const closestCoverageStrategy = {
     selectVersion(fixedInVersions, currentVersion) {
@@ -47,7 +50,7 @@ export const closestCoverageStrategy = {
  * Version selection strategy that always picks the highest version regardless
  * of major version distance. Guarantees maximum CVE coverage but may produce
  * large version jumps. This is the original behavior before pluggable strategies.
- * @type {{selectVersion: function(string[], string): string, resolveConflict: function(object, object): string}}
+ * @type {VersionStrategy}
  */
 export const highestStrategy = {
     selectVersion(fixedInVersions) {
@@ -73,12 +76,12 @@ export const highestStrategy = {
  * version selection strategy to resolve conflicts. Dependencies with no remediation
  * data are skipped.
  *
- * @param {object} analysisReport - raw DA AnalysisReport JSON response
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport} analysisReport - raw DA AnalysisReport JSON response
  * @param {object} [options] - extraction options
  * @param {string[]} [options.providerPriority] - provider names in descending priority order.
  *   The first entry has the highest priority. Providers not listed share the lowest priority.
  *   When omitted or empty, all providers are treated equally and the highest fix version wins.
- * @param {object} [options.versionStrategy] - version selection strategy with selectVersion
+ * @param {VersionStrategy} [options.versionStrategy] - version selection strategy with selectVersion
  *   and resolveConflict methods. Defaults to closestCoverageStrategy.
  * @returns {Array<{purl: string, groupId: string, artifactId: string, currentVersion: string, fixedInVersion: string, fixedInPurl: string, provider: string, source: string, advisories: Array<{id: string, url: string}>, severity: string, cves: string[]}>}
  */
@@ -88,6 +91,7 @@ export function extractRemediations(analysisReport, options = {}) {
     }
     const priorityMap = buildPriorityMap(options.providerPriority);
     const strategy = options.versionStrategy || closestCoverageStrategy;
+    /** @type {Map<string, Remediation & { _fromTrustedContent?: boolean}>} */
     const remediationsByDep = new Map();
     const rankByDep = new Map();
     for (const [providerName, providerReport] of Object.entries(analysisReport.providers)) {
@@ -120,12 +124,12 @@ function buildPriorityMap(providerPriority) {
 }
 /**
  * Extracts remediations from the sources/dependencies/issues tree of a provider report.
- * @param {object} providerReport
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/ProviderReport.js').ProviderReport} providerReport
  * @param {string} providerName
  * @param {number} providerRank - numeric priority rank for this provider
- * @param {Map<string, object>} remediationsByDep - accumulator keyed by dependency PURL
+ * @param {Map<string, Remediation & { _fromTrustedContent?: boolean }>} remediationsByDep - accumulator keyed by dependency PURL
  * @param {Map<string, number>} rankByDep - tracks current winning rank per dependency
- * @param {object} strategy - version selection strategy
+ * @param {VersionStrategy} strategy - version selection strategy
  */
 function extractFromSources(providerReport, providerName, providerRank, remediationsByDep, rankByDep, strategy) {
     if (!providerReport.sources) {
@@ -147,14 +151,14 @@ function extractFromSources(providerReport, providerName, providerRank, remediat
 }
 /**
  * Processes a single issue's remediation data and merges it into the accumulator.
- * @param {object} issue - issue object containing remediation and CVE data
- * @param {object} dep - dependency object containing the ref PURL
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/Issue.js').Issue} issue - issue object containing remediation and CVE data
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/DependencyReport.js').DependencyReport} dep - dependency object containing the ref PURL
  * @param {string} providerName
  * @param {string} sourceName
  * @param {number} providerRank
- * @param {Map<string, object>} remediationsByDep
+ * @param {Map<string, Remediation & { _fromTrustedContent?: boolean }>} remediationsByDep
  * @param {Map<string, number>} rankByDep
- * @param {object} strategy - version selection strategy
+ * @param {VersionStrategy} strategy - version selection strategy
  */
 function processIssueRemediation(issue, dep, providerName, sourceName, providerRank, remediationsByDep, rankByDep, strategy) {
     const depPurl = dep.ref;
@@ -185,7 +189,7 @@ function processIssueRemediation(issue, dep, providerName, sourceName, providerR
     if (!fixedInVersion) {
         return;
     }
-    const cveId = issue.id || issue.cve;
+    const cveId = issue.id;
     const severity = issue.severity || 'UNKNOWN';
     const advisories = extractAdvisories(issue);
     const existing = remediationsByDep.get(depPurl);
@@ -236,10 +240,10 @@ function processIssueRemediation(issue, dep, providerName, sourceName, providerR
 /**
  * Extracts remediations from the recommendations section of a provider report.
  * Merges CVEs and advisories into existing entries when present.
- * @param {object} providerReport
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/ProviderReport.js').ProviderReport} providerReport
  * @param {string} providerName
  * @param {number} providerRank
- * @param {Map<string, object>} remediationsByDep
+ * @param {Map<string, Remediation & { _fromTrustedContent?: boolean }>} remediationsByDep
  * @param {Map<string, number>} rankByDep
  */
 function extractFromRecommendations(providerReport, providerName, providerRank, remediationsByDep, rankByDep) {
@@ -308,9 +312,9 @@ function extractFromRecommendations(providerReport, providerName, providerRank,
  * Gets the fixedIn PURL from an issue's remediation, preferring trustedContent.
  * When fixedIn is an array of version strings (not PURLs), uses the strategy's
  * selectVersion to pick the best candidate and constructs a PURL from the dependency ref.
- * @param {object} issue
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/Issue.js').Issue} issue
  * @param {string} depPurl - the dependency PURL, used to construct fixedIn PURLs from version strings
- * @param {object} strategy - version selection strategy
+ * @param {VersionStrategy} strategy - version selection strategy
  * @param {string} currentVersion - the dependency's current version
  * @returns {string|undefined}
  */
@@ -318,17 +322,11 @@ function getFixedInPurl(issue, depPurl, strategy, currentVersion) {
     if (!issue.remediation) {
         return undefined;
     }
-    if (issue.remediation.trustedContent && issue.remediation.trustedContent.ref) {
+    if (issue.remediation.trustedContent?.ref) {
         return issue.remediation.trustedContent.ref;
     }
     const fixedIn = issue.remediation.fixedIn;
-    if (!fixedIn) {
-        return undefined;
-    }
-    if (typeof fixedIn === 'string') {
-        return fixedIn;
-    }
-    if (Array.isArray(fixedIn) && fixedIn.length > 0) {
+    if (fixedIn?.length > 0) {
         const version = fixedIn.length > 1
             ? strategy.selectVersion(fixedIn, currentVersion)
             : fixedIn[0];
@@ -350,25 +348,16 @@ function getFixedInPurl(issue, depPurl, strategy, currentVersion) {
 }
 /**
  * Extracts advisory objects from an issue.
- * @param {object} issue
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/Issue.js').Issue} issue
  * @returns {Array<{id: string, url: string}>}
  */
 function extractAdvisories(issue) {
     const advisories = [];
-    if (issue.remediation && issue.remediation.trustedContent) {
-        const tc = issue.remediation.trustedContent;
-        if (tc.advisory) {
-            advisories.push({
-                id: tc.advisory.id || tc.advisory,
-                url: tc.advisory.url || '',
-            });
-        }
-    }
-    if (issue.advisories) {
-        for (const adv of issue.advisories) {
+    for (const advisory of issue.remediation?.advisories ?? []) {
+        if (advisory.advisory?.id) {
             advisories.push({
-                id: adv.id || adv,
-                url: adv.url || '',
+                id: advisory.advisory.id,
+                url: advisory.advisory.url || '',
             });
         }
     }