@trustify-da/trustify-da-javascript-client 0.3.0-ea.b6d9c3f → 0.3.0-ea.b77d624

package/dist/src/remediate.js

@@ -0,0 +1,149 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import analysis from './analysis.js';
+import { availableProviders, match } from './provider.js';
+import { extractRemediations } from './remediation.js';
+import { generateReport } from './remediation_report.js';
+import { updateMavenVersions } from './updaters/maven_updater.js';
+import { updateTomlVersions } from './updaters/toml_updater.js';
+import { selectTrustifyDABackend } from './index.js';
+// Mirrors DEFAULT_WORKSPACE_DISCOVERY_IGNORE in workspace.js
+const SKIP_DIRS = new Set(['node_modules', '.git']);
+const MANIFEST_TYPES = [
+    {
+        test: (basename) => basename === 'pom.xml',
+        updater: updateMavenVersions,
+        label: 'maven',
+    },
+    {
+        test: (basename) => basename.endsWith('.versions.toml') || basename === 'libs.versions.toml',
+        updater: updateTomlVersions,
+        label: 'toml',
+    },
+];
+/**
+ * Discovers supported manifest files recursively within a directory.
+ * @param {string} dirPath - absolute path to the directory
+ * @returns {string[]} array of absolute paths to supported manifest files
+ */
+function discoverManifests(dirPath) {
+    const manifests = [];
+    function walk(dir) {
+        const entries = fs.readdirSync(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            if (SKIP_DIRS.has(entry.name)) {
+                continue;
+            }
+            const fullPath = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                walk(fullPath);
+            }
+            else if (getManifestType(entry.name)) {
+                manifests.push(fullPath);
+            }
+        }
+    }
+    walk(dirPath);
+    return manifests;
+}
+/**
+ * Returns the manifest type descriptor for a given filename, or null if unsupported.
+ * @param {string} basename - the file name to check
+ * @returns {{test: function, updater: function, label: string}|null}
+ */
+function getManifestType(basename) {
+    return MANIFEST_TYPES.find(t => t.test(basename)) || null;
+}
+/**
+ * Orchestrates the full remediation pipeline for a single manifest or directory:
+ * discover manifests → scan via DA backend → extract remediations → apply or preview.
+ *
+ * @param {string} targetPath - path to a manifest file or directory
+ * @param {object} [options]
+ * @param {boolean} [options.dryRun=false] - preview changes without modifying files (applies by default)
+ * @param {string} [options.providers] - comma-separated provider list
+ * @param {string} [options.sources] - comma-separated source list
+ * @param {'dependency'|'bundle'} [options.groupBy='dependency'] - report grouping strategy
+ * @returns {Promise<{exitCode: number, output: string}>}
+ */
+export async function runRemediation(targetPath, options = {}) {
+    const { dryRun = false, providers, sources, groupBy = 'dependency' } = options;
+    const resolvedPath = path.resolve(targetPath);
+    let manifestPaths;
+    let stat;
+    try {
+        stat = fs.statSync(resolvedPath);
+    }
+    catch {
+        throw new Error(`Path not found: ${resolvedPath}`);
+    }
+    if (stat.isDirectory()) {
+        manifestPaths = discoverManifests(resolvedPath);
+        if (manifestPaths.length === 0) {
+            return { exitCode: 0, output: 'No supported manifest files found.' };
+        }
+    }
+    else {
+        const basename = path.basename(resolvedPath);
+        if (!getManifestType(basename)) {
+            throw new Error(`Unsupported manifest type: ${basename}`);
+        }
+        manifestPaths = [resolvedPath];
+    }
+    const opts = {};
+    if (providers) {
+        opts.TRUSTIFY_DA_PROVIDERS = providers;
+    }
+    if (sources) {
+        opts.TRUSTIFY_DA_SOURCES = sources;
+    }
+    const url = selectTrustifyDABackend(opts);
+    const allRemediations = [];
+    const appliedFiles = [];
+    for (const manifestPath of manifestPaths) {
+        const basename = path.basename(manifestPath);
+        const manifestType = getManifestType(basename);
+        if (!manifestType) {
+            continue;
+        }
+        let provider;
+        try {
+            provider = match(manifestPath, availableProviders, opts);
+        }
+        catch {
+            continue;
+        }
+        const analysisReport = await analysis.requestStack(provider, manifestPath, url, false, opts);
+        const remediations = extractRemediations(analysisReport, {
+            providerPriority: providers ? providers.split(',').map(p => p.trim()).filter(Boolean) : undefined,
+        });
+        if (remediations.length === 0) {
+            continue;
+        }
+        allRemediations.push(...remediations);
+        if (!dryRun) {
+            const content = fs.readFileSync(manifestPath, 'utf-8');
+            const versionChanges = remediations.map(r => ({
+                groupId: r.groupId,
+                artifactId: r.artifactId,
+                newVersion: r.fixedInVersion,
+            }));
+            const result = manifestType.updater(content, versionChanges);
+            if (result.applied.length > 0) {
+                fs.writeFileSync(manifestPath, result.content, 'utf-8');
+                appliedFiles.push(manifestPath);
+            }
+        }
+    }
+    if (allRemediations.length === 0) {
+        return { exitCode: 0, output: 'No remediations found.' };
+    }
+    const report = generateReport(allRemediations, { groupBy });
+    if (dryRun) {
+        return { exitCode: 2, output: report };
+    }
+    const summary = appliedFiles.length > 0
+        ? `Updated ${appliedFiles.length} file(s):\n${appliedFiles.map(f => `  ${f}`).join('\n')}\n\n${report}`
+        : report;
+    return { exitCode: 0, output: summary };
+}

package/dist/src/remediation.d.ts

@@ -2,19 +2,22 @@
  * Extracts actionable remediation instructions from a DA AnalysisReport response.
  *
  * Walks the provider/source/dependency/issue tree, collects fixedIn and trustedContent
- * remediation data, applies provider priority resolution, and for the same dependency
- * affected by multiple CVEs selects the highest fixedIn version from the highest-priority
- * provider. Dependencies with no remediation data are skipped.
+ * remediation data, applies provider priority resolution, and uses the configured
+ * version selection strategy to resolve conflicts. Dependencies with no remediation
+ * data are skipped.
  *
  * @param {object} analysisReport - raw DA AnalysisReport JSON response
  * @param {object} [options] - extraction options
  * @param {string[]} [options.providerPriority] - provider names in descending priority order.
  *   The first entry has the highest priority. Providers not listed share the lowest priority.
  *   When omitted or empty, all providers are treated equally and the highest fix version wins.
+ * @param {object} [options.versionStrategy] - version selection strategy with selectVersion
+ *   and resolveConflict methods. Defaults to closestCoverageStrategy.
  * @returns {Array<{purl: string, groupId: string, artifactId: string, currentVersion: string, fixedInVersion: string, fixedInPurl: string, provider: string, source: string, advisories: Array<{id: string, url: string}>, severity: string, cves: string[]}>}
  */
 export function extractRemediations(analysisReport: object, options?: {
     providerPriority?: string[] | undefined;
+    versionStrategy?: object | undefined;
 }): Array<{
     purl: string;
     groupId: string;
@@ -31,3 +34,24 @@ export function extractRemediations(analysisReport: object, options?: {
     severity: string;
     cves: string[];
 }>;
+/**
+ * Version selection strategy that prefers the closest compatible version
+ * within the same major version stream. Falls back to the lowest cross-major
+ * version when no same-major option exists.
+ * @type {{selectVersion: function(string[], string): string, resolveConflict: function(object, object): string}}
+ */
+export const closestCoverageStrategy: {
+    selectVersion: (arg0: string[], arg1: string) => string;
+    resolveConflict: (arg0: object, arg1: object) => string;
+};
+/**
+ * Version selection strategy that always picks the highest version regardless
+ * of major version distance. Guarantees maximum CVE coverage but may produce
+ * large version jumps. This is the original behavior before pluggable strategies.
+ * @type {{selectVersion: function(string[], string): string, resolveConflict: function(object, object): string}}
+ */
+export const highestStrategy: {
+    selectVersion: (arg0: string[], arg1: string) => string;
+    resolveConflict: (arg0: object, arg1: object) => string;
+};
+export const SEVERITY_ORDER: string[];

package/dist/src/remediation.js

@@ -1,17 +1,85 @@
 import { PackageURL } from 'packageurl-js';
+/**
+ * Extracts the major version segment from a version string.
+ * @param {string} version
+ * @returns {string} the first dot-separated segment
+ */
+function getMajorVersion(version) {
+    return version.split('.')[0] || '';
+}
+/**
+ * Version selection strategy that prefers the closest compatible version
+ * within the same major version stream. Falls back to the lowest cross-major
+ * version when no same-major option exists.
+ * @type {{selectVersion: function(string[], string): string, resolveConflict: function(object, object): string}}
+ */
+export const closestCoverageStrategy = {
+    selectVersion(fixedInVersions, currentVersion) {
+        const currentMajor = getMajorVersion(currentVersion);
+        const sameMajor = fixedInVersions.filter(v => getMajorVersion(v) === currentMajor);
+        if (sameMajor.length > 0) {
+            return sameMajor.sort((a, b) => compareVersions(b, a))[0];
+        }
+        return fixedInVersions.sort((a, b) => compareVersions(a, b))[0];
+    },
+    resolveConflict(existing, candidate) {
+        if (existing._fromTrustedContent && !candidate._fromTrustedContent) {
+            return 'existing';
+        }
+        if (!existing._fromTrustedContent && candidate._fromTrustedContent) {
+            return 'candidate';
+        }
+        const currentMajor = getMajorVersion(existing.currentVersion);
+        const existingSameMajor = getMajorVersion(existing.fixedInVersion) === currentMajor;
+        const candidateSameMajor = getMajorVersion(candidate.fixedInVersion) === currentMajor;
+        if (existingSameMajor && !candidateSameMajor) {
+            return 'existing';
+        }
+        if (!existingSameMajor && candidateSameMajor) {
+            return 'candidate';
+        }
+        return compareVersions(candidate.fixedInVersion, existing.fixedInVersion) > 0
+            ? 'candidate'
+            : 'existing';
+    },
+};
+/**
+ * Version selection strategy that always picks the highest version regardless
+ * of major version distance. Guarantees maximum CVE coverage but may produce
+ * large version jumps. This is the original behavior before pluggable strategies.
+ * @type {{selectVersion: function(string[], string): string, resolveConflict: function(object, object): string}}
+ */
+export const highestStrategy = {
+    selectVersion(fixedInVersions) {
+        return fixedInVersions.sort((a, b) => compareVersions(b, a))[0];
+    },
+    resolveConflict(existing, candidate) {
+        if (existing._fromTrustedContent && !candidate._fromTrustedContent) {
+            return 'existing';
+        }
+        if (!existing._fromTrustedContent && candidate._fromTrustedContent) {
+            return 'candidate';
+        }
+        return compareVersions(candidate.fixedInVersion, existing.fixedInVersion) > 0
+            ? 'candidate'
+            : 'existing';
+    },
+};
 /**
  * Extracts actionable remediation instructions from a DA AnalysisReport response.
  *
  * Walks the provider/source/dependency/issue tree, collects fixedIn and trustedContent
- * remediation data, applies provider priority resolution, and for the same dependency
- * affected by multiple CVEs selects the highest fixedIn version from the highest-priority
- * provider. Dependencies with no remediation data are skipped.
+ * remediation data, applies provider priority resolution, and uses the configured
+ * version selection strategy to resolve conflicts. Dependencies with no remediation
+ * data are skipped.
  *
  * @param {object} analysisReport - raw DA AnalysisReport JSON response
  * @param {object} [options] - extraction options
  * @param {string[]} [options.providerPriority] - provider names in descending priority order.
  *   The first entry has the highest priority. Providers not listed share the lowest priority.
  *   When omitted or empty, all providers are treated equally and the highest fix version wins.
+ * @param {object} [options.versionStrategy] - version selection strategy with selectVersion
+ *   and resolveConflict methods. Defaults to closestCoverageStrategy.
  * @returns {Array<{purl: string, groupId: string, artifactId: string, currentVersion: string, fixedInVersion: string, fixedInPurl: string, provider: string, source: string, advisories: Array<{id: string, url: string}>, severity: string, cves: string[]}>}
  */
 export function extractRemediations(analysisReport, options = {}) {
@@ -19,14 +87,19 @@ export function extractRemediations(analysisReport, options = {}) {
         return [];
     }
     const priorityMap = buildPriorityMap(options.providerPriority);
+    const strategy = options.versionStrategy || closestCoverageStrategy;
     const remediationsByDep = new Map();
     const rankByDep = new Map();
     for (const [providerName, providerReport] of Object.entries(analysisReport.providers)) {
         const providerRank = priorityMap.get(providerName) ?? 0;
-        extractFromSources(providerReport, providerName, providerRank, remediationsByDep, rankByDep);
+        extractFromSources(providerReport, providerName, providerRank, remediationsByDep, rankByDep, strategy);
         extractFromRecommendations(providerReport, providerName, providerRank, remediationsByDep, rankByDep);
     }
     return Array.from(remediationsByDep.values())
+        .map((entry) => {
+        delete entry._fromTrustedContent;
+        return entry;
+    })
         .sort((a, b) => a.purl.localeCompare(b.purl));
 }
 /**
@@ -52,8 +125,9 @@ function buildPriorityMap(providerPriority) {
  * @param {number} providerRank - numeric priority rank for this provider
  * @param {Map<string, object>} remediationsByDep - accumulator keyed by dependency PURL
  * @param {Map<string, number>} rankByDep - tracks current winning rank per dependency
+ * @param {object} strategy - version selection strategy
  */
-function extractFromSources(providerReport, providerName, providerRank, remediationsByDep, rankByDep) {
+function extractFromSources(providerReport, providerName, providerRank, remediationsByDep, rankByDep, strategy) {
     if (!providerReport.sources) {
         return;
     }
@@ -66,7 +140,7 @@ function extractFromSources(providerReport, providerName, providerRank, remediat
                 continue;
             }
             for (const issue of dep.issues) {
-                processIssueRemediation(issue, dep, providerName, sourceName, providerRank, remediationsByDep, rankByDep);
+                processIssueRemediation(issue, dep, providerName, sourceName, providerRank, remediationsByDep, rankByDep, strategy);
             }
         }
     }
@@ -80,20 +154,28 @@ function extractFromSources(providerReport, providerName, providerRank, remediat
  * @param {number} providerRank
  * @param {Map<string, object>} remediationsByDep
  * @param {Map<string, number>} rankByDep
+ * @param {object} strategy - version selection strategy
  */
-function processIssueRemediation(issue, dep, providerName, sourceName, providerRank, remediationsByDep, rankByDep) {
-    const fixedInPurl = getFixedInPurl(issue);
-    if (!fixedInPurl) {
-        return;
-    }
+function processIssueRemediation(issue, dep, providerName, sourceName, providerRank, remediationsByDep, rankByDep, strategy) {
     const depPurl = dep.ref;
     if (!depPurl) {
         return;
     }
     let parsedDep;
-    let parsedFix;
     try {
         parsedDep = PackageURL.fromString(depPurl);
+    }
+    catch {
+        return;
+    }
+    const currentVersion = parsedDep.version || '';
+    const fixedInPurl = getFixedInPurl(issue, depPurl, strategy, currentVersion);
+    if (!fixedInPurl) {
+        return;
+    }
+    const isTrustedContent = !!(issue.remediation && issue.remediation.trustedContent && issue.remediation.trustedContent.ref);
+    let parsedFix;
+    try {
         parsedFix = PackageURL.fromString(fixedInPurl);
     }
     catch {
@@ -112,7 +194,7 @@ function processIssueRemediation(issue, dep, providerName, sourceName, providerR
             purl: depPurl,
             groupId: parsedDep.namespace || '',
             artifactId: parsedDep.name,
-            currentVersion: parsedDep.version || '',
+            currentVersion,
             fixedInVersion,
             fixedInPurl,
             provider: providerName,
@@ -120,6 +202,7 @@ function processIssueRemediation(issue, dep, providerName, sourceName, providerR
             advisories,
             severity: severity.toUpperCase(),
             cves: cveId ? [cveId] : [],
+            _fromTrustedContent: isTrustedContent,
         });
         rankByDep.set(depPurl, providerRank);
         return;
@@ -135,14 +218,17 @@ function processIssueRemediation(issue, dep, providerName, sourceName, providerR
         existing.provider = providerName;
         existing.source = sourceName;
         existing.severity = higherSeverity(existing.severity, severity);
+        existing._fromTrustedContent = isTrustedContent;
         rankByDep.set(depPurl, providerRank);
     }
     else if (providerRank === existingRank) {
-        if (compareVersions(fixedInVersion, existing.fixedInVersion) > 0) {
+        const winner = strategy.resolveConflict({ fixedInVersion: existing.fixedInVersion, _fromTrustedContent: existing._fromTrustedContent, currentVersion }, { fixedInVersion, _fromTrustedContent: isTrustedContent, currentVersion });
+        if (winner === 'candidate') {
             existing.fixedInVersion = fixedInVersion;
             existing.fixedInPurl = fixedInPurl;
             existing.provider = providerName;
             existing.source = sourceName;
+            existing._fromTrustedContent = isTrustedContent;
         }
         existing.severity = higherSeverity(existing.severity, severity);
     }
@@ -220,18 +306,45 @@ function extractFromRecommendations(providerReport, providerName, providerRank,
 }
 /**
  * Gets the fixedIn PURL from an issue's remediation, preferring trustedContent.
+ * When fixedIn is an array of version strings (not PURLs), uses the strategy's
+ * selectVersion to pick the best candidate and constructs a PURL from the dependency ref.
  * @param {object} issue
+ * @param {string} depPurl - the dependency PURL, used to construct fixedIn PURLs from version strings
+ * @param {object} strategy - version selection strategy
+ * @param {string} currentVersion - the dependency's current version
  * @returns {string|undefined}
  */
-function getFixedInPurl(issue) {
+function getFixedInPurl(issue, depPurl, strategy, currentVersion) {
     if (!issue.remediation) {
         return undefined;
     }
     if (issue.remediation.trustedContent && issue.remediation.trustedContent.ref) {
         return issue.remediation.trustedContent.ref;
     }
-    if (issue.remediation.fixedIn) {
-        return issue.remediation.fixedIn;
+    const fixedIn = issue.remediation.fixedIn;
+    if (!fixedIn) {
+        return undefined;
+    }
+    if (typeof fixedIn === 'string') {
+        return fixedIn;
+    }
+    if (Array.isArray(fixedIn) && fixedIn.length > 0) {
+        const version = fixedIn.length > 1
+            ? strategy.selectVersion(fixedIn, currentVersion)
+            : fixedIn[0];
+        if (typeof version === 'string' && version.startsWith('pkg:')) {
+            return version;
+        }
+        if (typeof version === 'string' && depPurl) {
+            try {
+                const parsed = PackageURL.fromString(depPurl);
+                parsed.version = version;
+                return parsed.toString();
+            }
+            catch {
+                return undefined;
+            }
+        }
     }
     return undefined;
 }
@@ -294,18 +407,20 @@ function compareVersions(a, b) {
         const numB = Number(segB);
         if (Number.isFinite(numA) && Number.isFinite(numB)) {
             const diff = numA - numB;
-            if (diff !== 0)
+            if (diff !== 0) {
                 return diff;
+            }
         }
         else {
             const cmp = segA.localeCompare(segB);
-            if (cmp !== 0)
+            if (cmp !== 0) {
                 return cmp;
+            }
         }
     }
     return 0;
 }
-const SEVERITY_ORDER = ['UNKNOWN', 'LOW', 'MEDIUM', 'HIGH', 'CRITICAL'];
+export const SEVERITY_ORDER = ['UNKNOWN', 'LOW', 'MEDIUM', 'HIGH', 'CRITICAL'];
 /**
  * Returns the higher of two severity strings, normalized to uppercase.
  * @param {string} a

package/dist/src/remediation_report.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Generates a formatted report from an array of remediation entries.
+ *
+ * @param {Array<{purl: string, groupId: string, artifactId: string, currentVersion: string,
+ *   fixedInVersion: string, fixedInPurl: string, provider: string, source: string,
+ *   advisories: Array<{id: string, url: string}>, severity: string, cves: string[]}>} remediations
+ * @param {object} [options]
+ * @param {'dependency'|'bundle'} [options.groupBy='dependency'] - grouping strategy
+ * @param {'markdown'|'json'} [options.format='markdown'] - output format
+ * @param {boolean} [options.dryRun=false] - when true, produces tabular summary
+ * @returns {string}
+ */
+export function generateReport(remediations: Array<{
+    purl: string;
+    groupId: string;
+    artifactId: string;
+    currentVersion: string;
+    fixedInVersion: string;
+    fixedInPurl: string;
+    provider: string;
+    source: string;
+    advisories: Array<{
+        id: string;
+        url: string;
+    }>;
+    severity: string;
+    cves: string[];
+}>, options?: {
+    groupBy?: "bundle" | "dependency" | undefined;
+    format?: "markdown" | "json" | undefined;
+    dryRun?: boolean | undefined;
+}): string;
+/**
+ * Generates a deterministic deduplication key for a remediation entry.
+ * Suitable for checking existing PR titles or branch names.
+ *
+ * @param {object} remediation - a single remediation entry
+ * @returns {string} stable key in the form `groupId:artifactId:newVersion`
+ */
+export function generateDeduplicationKey(remediation: object): string;

package/dist/src/remediation_report.js

@@ -0,0 +1,159 @@
+/**
+ * Report generator that transforms remediation extractor output into structured
+ * markdown for PR bodies, CLI dry-run output, and JSON.
+ */
+import { SEVERITY_ORDER } from './remediation.js';
+/**
+ * Generates a formatted report from an array of remediation entries.
+ *
+ * @param {Array<{purl: string, groupId: string, artifactId: string, currentVersion: string,
+ *   fixedInVersion: string, fixedInPurl: string, provider: string, source: string,
+ *   advisories: Array<{id: string, url: string}>, severity: string, cves: string[]}>} remediations
+ * @param {object} [options]
+ * @param {'dependency'|'bundle'} [options.groupBy='dependency'] - grouping strategy
+ * @param {'markdown'|'json'} [options.format='markdown'] - output format
+ * @param {boolean} [options.dryRun=false] - when true, produces tabular summary
+ * @returns {string}
+ */
+export function generateReport(remediations, options = {}) {
+    const { groupBy = 'dependency', format = 'markdown', dryRun = false } = options;
+    if (!remediations || remediations.length === 0) {
+        return format === 'json' ? '[]' : 'No remediations found.';
+    }
+    if (format === 'json') {
+        return JSON.stringify(remediations, null, '\t');
+    }
+    if (dryRun) {
+        return generateDryRunReport(remediations);
+    }
+    if (groupBy === 'bundle') {
+        return generateBundledReport(remediations);
+    }
+    return generatePerDependencyReport(remediations);
+}
+/**
+ * Generates a per-dependency markdown report with one section per remediation entry.
+ * @param {Array<object>} remediations
+ * @returns {string}
+ */
+function generatePerDependencyReport(remediations) {
+    const sections = remediations.map(rem => {
+        const depName = rem.groupId
+            ? `${rem.groupId}:${rem.artifactId}`
+            : rem.artifactId;
+        const lines = [
+            `## Security Update: ${depName} ${rem.currentVersion} → ${rem.fixedInVersion}`,
+            '',
+            `**Provider:** ${rem.provider} | **Source:** ${rem.source}`,
+            '',
+        ];
+        if (rem.cves && rem.cves.length > 0) {
+            lines.push('### Vulnerabilities resolved');
+            lines.push('');
+            lines.push('| CVE | Severity | Advisory |');
+            lines.push('| --- | --- | --- |');
+            const advisoryLinks = formatAdvisoryLinks(rem.advisories);
+            for (const cve of rem.cves) {
+                lines.push(`| ${cve} | ${rem.severity} | ${advisoryLinks} |`);
+            }
+        }
+        return lines.join('\n');
+    });
+    return sections.join('\n\n');
+}
+/**
+ * Generates a bundled markdown report grouping all remediations by severity.
+ * @param {Array<object>} remediations
+ * @returns {string}
+ */
+function generateBundledReport(remediations) {
+    const lines = ['# Security Update Summary', ''];
+    const bySeverity = groupBySeverity(remediations);
+    for (const severity of [...SEVERITY_ORDER].reverse()) {
+        const group = bySeverity.get(severity);
+        if (!group || group.length === 0) {
+            continue;
+        }
+        lines.push(`## ${severity}`);
+        lines.push('');
+        lines.push('| Dependency | Current | Fixed | Provider | CVEs | Advisory |');
+        lines.push('| --- | --- | --- | --- | --- | --- |');
+        for (const rem of group) {
+            const depName = rem.groupId
+                ? `${rem.groupId}:${rem.artifactId}`
+                : rem.artifactId;
+            const cves = (rem.cves || []).join(', ');
+            const advisoryLinks = formatAdvisoryLinks(rem.advisories);
+            lines.push(`| ${depName} | ${rem.currentVersion} | ${rem.fixedInVersion}`
+                + ` | ${rem.provider} | ${cves} | ${advisoryLinks} |`);
+        }
+        lines.push('');
+    }
+    return lines.join('\n').trimEnd();
+}
+/**
+ * Generates a tabular dry-run summary of proposed changes.
+ * @param {Array<object>} remediations
+ * @returns {string}
+ */
+function generateDryRunReport(remediations) {
+    const lines = [
+        'Proposed dependency updates:',
+        '',
+        '| Dependency | Current | Fixed | Severity | Provider |',
+        '| --- | --- | --- | --- | --- |',
+    ];
+    for (const rem of remediations) {
+        const depName = rem.groupId
+            ? `${rem.groupId}:${rem.artifactId}`
+            : rem.artifactId;
+        lines.push(`| ${depName} | ${rem.currentVersion} | ${rem.fixedInVersion}`
+            + ` | ${rem.severity} | ${rem.provider} |`);
+    }
+    return lines.join('\n');
+}
+/**
+ * Groups remediations by their severity.
+ * @param {Array<object>} remediations
+ * @returns {Map<string, Array<object>>}
+ */
+function groupBySeverity(remediations) {
+    const map = new Map();
+    for (const severity of SEVERITY_ORDER) {
+        map.set(severity, []);
+    }
+    for (const rem of remediations) {
+        const sev = rem.severity || 'UNKNOWN';
+        if (!map.has(sev)) {
+            map.set(sev, []);
+        }
+        map.get(sev).push(rem);
+    }
+    return map;
+}
+/**
+ * Formats advisory entries into markdown links or plain text.
+ * @param {Array<{id: string, url: string}>} advisories
+ * @returns {string}
+ */
+function formatAdvisoryLinks(advisories) {
+    if (!advisories || advisories.length === 0) {
+        return '-';
+    }
+    return advisories
+        .map(adv => adv.url ? `[${adv.id}](${adv.url})` : adv.id)
+        .join(', ');
+}
+/**
+ * Generates a deterministic deduplication key for a remediation entry.
+ * Suitable for checking existing PR titles or branch names.
+ *
+ * @param {object} remediation - a single remediation entry
+ * @returns {string} stable key in the form `groupId:artifactId:newVersion`
+ */
+export function generateDeduplicationKey(remediation) {
+    const group = remediation.groupId || '';
+    const artifact = remediation.artifactId || '';
+    const version = remediation.fixedInVersion || '';
+    return `${group}:${artifact}:${version}`;
+}