@trustify-da/trustify-da-javascript-client 0.3.0-ea.ec6824b → 0.3.0-ea.efdc87d

package/dist/src/providers/oci_dockerfile.js

@@ -0,0 +1,177 @@
+import fs from 'node:fs';
+import { generateImageSBOM, parseImageRef } from '../oci_image/utils.js';
+import { getArgQuery, getFromQuery, getParser } from './containerfile_parser.js';
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'oci'; } };
+/** @typedef {import('../provider').Provider} */
+/** @typedef {import('../provider').Provided} Provided */
+/**
+ * @type {string} ecosystem identifier for OCI image packages
+ * @private
+ */
+const ecosystem = 'oci';
+/**
+ * Check if the given manifest name is a Dockerfile or Containerfile.
+ * Supports dot-suffixed variants such as Dockerfile.dev or Containerfile.prod.
+ * @param {string} manifestName the manifest file name to check
+ * @returns {boolean} true if the manifest is a Dockerfile or Containerfile
+ */
+function isSupported(manifestName) {
+    return /^(Dockerfile|Containerfile)(\..+)?$/.test(manifestName);
+}
+/**
+ * Dockerfiles have no lock file, so validation always passes.
+ * @returns {boolean} always true
+ */
+function validateLockFile() { return true; }
+/**
+ * Check whether a syntax node contains any expansion (variable substitution) children.
+ * @param {import('web-tree-sitter').SyntaxNode} node
+ * @returns {boolean}
+ * @private
+ */
+function containsExpansion(node) {
+    if (node.type === 'expansion') {
+        return true;
+    }
+    for (let i = 0; i < node.childCount; i++) {
+        if (containsExpansion(node.child(i))) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Strip surrounding single or double quotes from a string.
+ * @param {string} text
+ * @returns {string}
+ * @private
+ */
+function stripQuotes(text) {
+    if ((text.startsWith('"') && text.endsWith('"')) || (text.startsWith("'") && text.endsWith("'"))) {
+        return text.slice(1, -1);
+    }
+    return text;
+}
+/**
+ * Collect ARG key-value pairs from the Dockerfile AST.
+ * Only ARGs with a default value are collected (ARGs without defaults cannot be resolved statically).
+ * @param {import('web-tree-sitter').Tree} tree the parsed Dockerfile tree
+ * @param {import('web-tree-sitter').Query} argQuery the tree-sitter query for arg_instruction nodes
+ * @returns {Map<string, string>} map of ARG names to their default values
+ * @private
+ */
+function collectArgs(tree, argQuery) {
+    const args = new Map();
+    for (const match of argQuery.matches(tree.rootNode)) {
+        const name = match.captures.find(c => c.name === 'name')?.node.text;
+        const defaultValue = match.captures.find(c => c.name === 'default')?.node.text;
+        if (name && defaultValue) {
+            args.set(name, stripQuotes(defaultValue));
+        }
+    }
+    return args;
+}
+/**
+ * Resolve ARG substitutions in an image spec text using the collected ARG map.
+ * Replaces ${VAR} and $VAR patterns with their ARG default values.
+ * @param {string} text the image spec text potentially containing variable references
+ * @param {Map<string, string>} args map of ARG names to their default values
+ * @returns {string|null} the resolved text, or null if any variable could not be resolved
+ * @private
+ */
+function resolveArgs(text, args) {
+    let resolved = text;
+    let hasUnresolved = false;
+    resolved = resolved.replace(/\$\{([^}]+)\}|\$([A-Za-z_]\w*)/g, (_match, braced, plain) => {
+        const key = braced || plain;
+        if (args.has(key)) {
+            return args.get(key);
+        }
+        hasUnresolved = true;
+        return _match;
+    });
+    return hasUnresolved ? null : resolved;
+}
+/**
+ * Parse all FROM instructions from a Dockerfile using tree-sitter to extract base image references.
+ * In multi-stage builds, every FROM line is returned so each image can be analyzed independently.
+ * ARG substitutions are resolved using declared default values. FROM lines with unresolvable
+ * variables (ARGs without defaults) are silently skipped.
+ * @param {string} manifestContent the content of the Dockerfile
+ * @returns {Promise<string[]>} array of image references from all resolvable FROM instructions
+ * @throws {Error} when no FROM instruction is found or when no FROM lines can be resolved
+ */
+export async function parseAllFromImages(manifestContent) {
+    const [parser, fromQuery, argQuery] = await Promise.all([getParser(), getFromQuery(), getArgQuery()]);
+    const tree = parser.parse(manifestContent);
+    const matches = fromQuery.matches(tree.rootNode);
+    if (matches.length === 0) {
+        throw new Error('No FROM line found in Dockerfile');
+    }
+    const args = collectArgs(tree, argQuery);
+    const images = [];
+    for (const match of matches) {
+        const imageSpec = match.captures.find(c => c.name === 'image').node;
+        if (containsExpansion(imageSpec)) {
+            const resolved = resolveArgs(imageSpec.text, args);
+            if (resolved != null) {
+                images.push(resolved);
+            }
+            continue;
+        }
+        images.push(imageSpec.text);
+    }
+    if (images.length === 0) {
+        throw new Error('Dockerfile uses ARG substitution in all FROM lines — cannot resolve variable references');
+    }
+    return images;
+}
+/**
+ * Generate image SBOMs for all FROM instructions in a Dockerfile manifest using syft.
+ * Returns a batch result with a purl-to-SBOM map suitable for the batch-analysis endpoint.
+ * @param {string} manifest path to the Dockerfile
+ * @param {{}} [opts={}] optional various options to pass along the application
+ * @returns {Promise<{ecosystem: string, content: string, contentType: string, batch: boolean}>}
+ * @private
+ */
+async function getImageSBOM(manifest, opts = {}) {
+    const manifestContent = fs.readFileSync(manifest, 'utf-8');
+    const images = await parseAllFromImages(manifestContent);
+    const sbomByPurl = {};
+    for (const image of images) {
+        const imageRef = parseImageRef(image, opts);
+        const purl = imageRef.getPackageURL().toString();
+        if (purl in sbomByPurl)
+            continue;
+        sbomByPurl[purl] = generateImageSBOM(imageRef, opts);
+    }
+    return {
+        ecosystem,
+        content: JSON.stringify(sbomByPurl),
+        contentType: 'application/vnd.cyclonedx+json',
+        batch: true
+    };
+}
+/**
+ * Provide content and content type for Dockerfile component analysis.
+ * @param {string} manifest path to the Dockerfile
+ * @param {{}} [opts={}] optional various options to pass along the application
+ * @returns {Promise<Provided>}
+ */
+async function provideComponent(manifest, opts = {}) {
+    return getImageSBOM(manifest, opts);
+}
+/**
+ * Provide content and content type for Dockerfile stack analysis.
+ * @param {string} manifest path to the Dockerfile
+ * @param {{}} [opts={}] optional various options to pass along the application
+ * @returns {Promise<Provided>}
+ */
+async function provideStack(manifest, opts = {}) {
+    return getImageSBOM(manifest, opts);
+}
+/**
+ * Dockerfiles contain no license information.
+ * @returns {null} always null
+ */
+function readLicenseFromManifest() { return null; }

package/dist/src/providers/processors/yarn_berry_processor.d.ts

@@ -34,8 +34,12 @@ export default class Yarn_berry_processor extends Yarn_processor {
    * Adds dependencies to the SBOM
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The dependency tree object
+   * @param {function(PackageURL): (Array<{alg: string, content: string}>|undefined)} [hashesForPurl] - Resolves lock-file hashes for a purl
    */
-    addDependenciesToSbom(sbom: Sbom, depTree: Object): void;
+    addDependenciesToSbom(sbom: Sbom, depTree: Object, hashesForPurl?: (arg0: PackageURL) => (Array<{
+        alg: string;
+        content: string;
+    }> | undefined)): void;
     #private;
 }
 import Yarn_processor from "./yarn_processor.js";

package/dist/src/providers/processors/yarn_berry_processor.js

@@ -78,8 +78,9 @@ export default class Yarn_berry_processor extends Yarn_processor {
    * Adds dependencies to the SBOM
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The dependency tree object
+   * @param {function(PackageURL): (Array<{alg: string, content: string}>|undefined)} [hashesForPurl] - Resolves lock-file hashes for a purl
    */
-    addDependenciesToSbom(sbom, depTree) {
+    addDependenciesToSbom(sbom, depTree, hashesForPurl = () => undefined) {
         if (!depTree) {
             return;
         }
@@ -137,7 +138,7 @@ export default class Yarn_berry_processor extends Yarn_processor {
                 }
                 const to = this.#purlFromLocator(d.locator);
                 if (to) {
-                    sbom.addDependency(from, to);
+                    sbom.addDependency(from, to, undefined, hashesForPurl(to));
                 }
             });
         });

package/dist/src/providers/processors/yarn_classic_processor.d.ts

@@ -30,8 +30,12 @@ export default class Yarn_classic_processor extends Yarn_processor {
    * Adds dependencies to the SBOM
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The dependency tree object
+   * @param {function(PackageURL): (Array<{alg: string, content: string}>|undefined)} [hashesForPurl] - Resolves lock-file hashes for a purl
    */
-    addDependenciesToSbom(sbom: Sbom, depTree: Object): void;
+    addDependenciesToSbom(sbom: Sbom, depTree: Object, hashesForPurl?: (arg0: PackageURL) => (Array<{
+        alg: string;
+        content: string;
+    }> | undefined)): void;
     #private;
 }
 import Yarn_processor from "./yarn_processor.js";

package/dist/src/providers/processors/yarn_classic_processor.js

@@ -50,8 +50,9 @@ export default class Yarn_classic_processor extends Yarn_processor {
    * Adds dependencies to the SBOM
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The dependency tree object
+   * @param {function(PackageURL): (Array<{alg: string, content: string}>|undefined)} [hashesForPurl] - Resolves lock-file hashes for a purl
    */
-    addDependenciesToSbom(sbom, depTree) {
+    addDependenciesToSbom(sbom, depTree, hashesForPurl = () => undefined) {
         if (!depTree?.data?.trees) {
             return;
         }
@@ -60,12 +61,12 @@ export default class Yarn_classic_processor extends Yarn_processor {
         depTree.data.trees.forEach(n => {
             const dep = new NodeMetaData(n);
             if (this._manifest.dependencies.includes(dep.name)) {
-                sbom.addDependency(rootPurl, dep.purl);
+                sbom.addDependency(rootPurl, dep.purl, undefined, hashesForPurl(dep.purl));
             }
             purls.set(dep.name, dep.purl);
         });
         depTree.data.trees.forEach(n => {
-            this.#addChildrenToSbom(sbom, n, purls);
+            this.#addChildrenToSbom(sbom, n, purls, hashesForPurl);
         });
     }
     /**
@@ -73,9 +74,10 @@ export default class Yarn_classic_processor extends Yarn_processor {
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} node - The current dependency node
    * @param {Map<string, PackageURL>} purls - Map of dependency names to their PackageURL objects
+   * @param {function(PackageURL): (Array<{alg: string, content: string}>|undefined)} hashesForPurl - Resolves lock-file hashes for a purl
    * @private
    */
-    #addChildrenToSbom(sbom, node, purls) {
+    #addChildrenToSbom(sbom, node, purls, hashesForPurl) {
         const dep = new NodeMetaData(node);
         const children = node.children ? node.children : [];
         children.forEach(c => {
@@ -83,9 +85,9 @@ export default class Yarn_classic_processor extends Yarn_processor {
             const from = dep.shadow ? purls.get(dep.name) : dep.purl;
             const to = child.shadow ? purls.get(child.name) : child.purl;
             if (from && to) {
-                sbom.addDependency(from, to);
+                sbom.addDependency(from, to, undefined, hashesForPurl(to));
             }
-            this.#addChildrenToSbom(sbom, c, purls);
+            this.#addChildrenToSbom(sbom, c, purls, hashesForPurl);
         });
     }
 }

package/dist/src/providers/python_controller.js

@@ -178,8 +178,11 @@ export default class Python_controller {
             startingTime = new Date();
             console.log("Starting time to get requirements.txt dependency tree = " + startingTime);
         }
+        let installBestEfforts = getCustom("TRUSTIFY_DA_PYTHON_INSTALL_BEST_EFFORTS", "false", this.options);
+        if (installBestEfforts === "true" && this.realEnvironment) {
+            throw new Error("Conflicting settings, TRUSTIFY_DA_PYTHON_INSTALL_BEST_EFFORTS=true requires TRUSTIFY_DA_PYTHON_VIRTUAL_ENV=true");
+        }
         if (!this.realEnvironment) {
-            let installBestEfforts = getCustom("TRUSTIFY_DA_PYTHON_INSTALL_BEST_EFFORTS", "false", this.options);
             if (installBestEfforts === "false") {
                 try {
                     invokeCommand(this.pathToPipBin, ['install', '-r', this.pathToRequirements]);

package/dist/src/providers/requirements_parser.js

@@ -16,7 +16,7 @@ export async function getRequirementQuery() {
 }
 export async function getIgnoreQuery() {
     const language = await init();
-    return new Query(language, '((requirement (package) @name) @req . (comment) @comment (#match? @comment "^#[\\t ]*exhortignore"))');
+    return new Query(language, '((requirement (package) @name) @req . (comment) @comment (#match? @comment "^#[\\t ]*(exhortignore|trustify-da-ignore)(?![\\w-])"))');
 }
 export async function getPinnedVersionQuery() {
     const language = await init();

package/dist/src/providers/rust_cargo.js

@@ -116,30 +116,25 @@ function resolveWorkspaceLicense(parsed, metadata) {
     return parsed.workspace?.package?.license || null;
 }
 /**
- * Validates that Cargo.lock exists in the manifest directory or in a parent
- * workspace root directory.  In Cargo workspaces the lock file always lives at
- * the workspace root, so when a member crate's Cargo.toml is provided we walk
- * up the directory tree looking for Cargo.lock (stopping when we find a
- * Cargo.toml that contains a [workspace] section, or when we reach the
- * filesystem root).
- * When TRUSTIFY_DA_WORKSPACE_DIR is provided (via env var or opts),
- * checks only that directory for Cargo.lock — no walk-up.
+ * Finds the directory containing Cargo.lock, honoring TRUSTIFY_DA_WORKSPACE_DIR.
+ * Walks up from manifestDir looking for Cargo.lock, stopping at workspace root or filesystem root.
  * @param {string} manifestDir - the directory where the manifest lies
  * @param {{TRUSTIFY_DA_WORKSPACE_DIR?: string}} [opts={}] - optional workspace root
- * @returns {boolean} true if Cargo.lock is found
+ * @returns {string|null} the directory path containing Cargo.lock, or null if not found
+ * @private
  */
-function validateLockFile(manifestDir, opts = {}) {
+function _findCargoLockDir(manifestDir, opts = {}) {
     const workspaceDir = getCustom('TRUSTIFY_DA_WORKSPACE_DIR', null, opts);
     if (workspaceDir) {
         const dir = path.resolve(workspaceDir);
-        return fs.existsSync(path.join(dir, 'Cargo.lock'));
+        return fs.existsSync(path.join(dir, 'Cargo.lock')) ? dir : null;
     }
     let dir = path.resolve(manifestDir);
     let parent = dir;
     do {
         dir = parent;
         if (fs.existsSync(path.join(dir, 'Cargo.lock'))) {
-            return true;
+            return dir;
         }
         // If this directory has a Cargo.toml with [workspace], the lock file
         // should have been here — stop searching.
@@ -148,7 +143,7 @@ function validateLockFile(manifestDir, opts = {}) {
             try {
                 let content = fs.readFileSync(cargoToml, 'utf-8');
                 if (/\[workspace\]/.test(content)) {
-                    return false;
+                    return null;
                 }
             }
             catch (_) {
@@ -157,7 +152,23 @@ function validateLockFile(manifestDir, opts = {}) {
         }
         parent = path.dirname(dir);
     } while (parent !== dir);
-    return false;
+    return null;
+}
+/**
+ * Validates that Cargo.lock exists in the manifest directory or in a parent
+ * workspace root directory.  In Cargo workspaces the lock file always lives at
+ * the workspace root, so when a member crate's Cargo.toml is provided we walk
+ * up the directory tree looking for Cargo.lock (stopping when we find a
+ * Cargo.toml that contains a [workspace] section, or when we reach the
+ * filesystem root).
+ * When TRUSTIFY_DA_WORKSPACE_DIR is provided (via env var or opts),
+ * checks only that directory for Cargo.lock — no walk-up.
+ * @param {string} manifestDir - the directory where the manifest lies
+ * @param {{TRUSTIFY_DA_WORKSPACE_DIR?: string}} [opts={}] - optional workspace root
+ * @returns {boolean} true if Cargo.lock is found
+ */
+function validateLockFile(manifestDir, opts = {}) {
+    return _findCargoLockDir(manifestDir, opts) !== null;
 }
 /**
  * Provide content and content type for Cargo stack analysis.
@@ -201,12 +212,13 @@ function getSBOM(manifest, opts = {}, includeTransitive) {
     let ignoredDeps = getIgnoredDeps(manifest, metadata);
     let crateType = detectCrateType(metadata);
     let license = readLicenseFromManifest(manifest, metadata);
+    let hashMap = parseCargoLockHashes(manifestDir, opts);
     let sbom;
     if (crateType === CrateType.WORKSPACE_VIRTUAL) {
-        sbom = handleVirtualWorkspace(manifest, metadata, ignoredDeps, includeTransitive, opts, license);
+        sbom = handleVirtualWorkspace(manifest, metadata, ignoredDeps, includeTransitive, opts, license, hashMap);
     }
     else {
-        sbom = handleSingleCrate(metadata, ignoredDeps, includeTransitive, opts, license);
+        sbom = handleSingleCrate(metadata, ignoredDeps, includeTransitive, opts, license, hashMap);
     }
     return sbom;
 }
@@ -244,6 +256,34 @@ function executeCargoMetadata(cargoBin, manifestDir) {
         throw new Error('failed to execute cargo metadata', { cause: error });
     }
 }
+/**
+ * Parses Cargo.lock to extract SHA-256 checksums for each package.
+ * @param {string} manifestDir - directory containing Cargo.toml (Cargo.lock is searched upward)
+ * @param {{TRUSTIFY_DA_WORKSPACE_DIR?: string}} [opts={}] - optional workspace root
+ * @returns {Map<string, Array<{alg: string, content: string}>>} map of "name@version" to CycloneDX hashes
+ * @private
+ */
+function parseCargoLockHashes(manifestDir, opts = {}) {
+    let hashMap = new Map();
+    let lockDir = _findCargoLockDir(manifestDir, opts);
+    if (!lockDir) {
+        return hashMap;
+    }
+    let lockPath = path.join(lockDir, 'Cargo.lock');
+    try {
+        let content = fs.readFileSync(lockPath, 'utf-8');
+        let parsed = parseToml(content);
+        for (let pkg of (parsed.package || [])) {
+            if (pkg.name && pkg.version && pkg.checksum) {
+                hashMap.set(`${pkg.name}@${pkg.version}`, [{ alg: 'SHA-256', content: pkg.checksum }]);
+            }
+        }
+    }
+    catch (error) {
+        console.warn(`Failed to parse Cargo.lock at ${lockPath} for hashes: ${error.message}. SBOM will be generated without hashes.`);
+    }
+    return hashMap;
+}
 /**
  * Detects the type of Cargo project from metadata.
  * @param {object} metadata - parsed cargo metadata
@@ -275,7 +315,7 @@ function detectCrateType(metadata) {
  * @returns {string} SBOM json string
  * @private
  */
-function handleSingleCrate(metadata, ignoredDeps, includeTransitive, opts, license) {
+function handleSingleCrate(metadata, ignoredDeps, includeTransitive, opts, license, hashMap) {
     let rootPackageId = metadata.resolve.root;
     let rootPackage = findPackageById(metadata, rootPackageId);
     let rootPurl = toPurl(rootPackage.name, rootPackage.version);
@@ -286,10 +326,10 @@ function handleSingleCrate(metadata, ignoredDeps, includeTransitive, opts, licen
         return sbom.getAsJsonString(opts);
     }
     if (includeTransitive) {
-        addTransitiveDeps(sbom, metadata, rootPackageId, ignoredDeps, new Set(), rootPurl);
+        addTransitiveDeps(sbom, metadata, rootPackageId, ignoredDeps, new Set(), hashMap, rootPurl);
     }
     else {
-        addDirectDeps(sbom, metadata, rootPackageId, rootPurl, ignoredDeps);
+        addDirectDeps(sbom, metadata, rootPackageId, rootPurl, ignoredDeps, hashMap);
     }
     return sbom.getAsJsonString(opts);
 }
@@ -315,7 +355,7 @@ function handleSingleCrate(metadata, ignoredDeps, includeTransitive, opts, licen
  * @returns {string} SBOM json string
  * @private
  */
-function handleVirtualWorkspace(manifest, metadata, ignoredDeps, includeTransitive, opts, license) {
+function handleVirtualWorkspace(manifest, metadata, ignoredDeps, includeTransitive, opts, license, hashMap) {
     let workspaceRoot = metadata.workspace_root;
     let rootName = path.basename(workspaceRoot);
     let workspaceVersion = getWorkspaceVersion(metadata);
@@ -323,7 +363,6 @@ function handleVirtualWorkspace(manifest, metadata, ignoredDeps, includeTransiti
     let sbom = new Sbom();
     sbom.addRoot(rootPurl, license);
     if (includeTransitive) {
-        // Stack analysis: walk all members and their full dependency trees
         let workspaceMembers = metadata.workspace_members || [];
         for (let memberId of workspaceMembers) {
             let memberPackage = findPackageById(metadata, memberId);
@@ -334,11 +373,10 @@ function handleVirtualWorkspace(manifest, metadata, ignoredDeps, includeTransiti
                 ? toPathDepPurl(memberPackage.name, memberPackage.version)
                 : toPurl(memberPackage.name, memberPackage.version);
             sbom.addDependency(rootPurl, memberPurl);
-            addTransitiveDeps(sbom, metadata, memberId, ignoredDeps, new Set(), memberPurl);
+            addTransitiveDeps(sbom, metadata, memberId, ignoredDeps, new Set(), hashMap, memberPurl);
         }
     }
     else {
-        // Component analysis: only [workspace.dependencies] from root Cargo.toml
         let workspaceDeps = getWorkspaceDepsFromManifest(manifest);
         for (let depName of workspaceDeps) {
             if (isDepIgnored(depName, ignoredDeps)) {
@@ -355,7 +393,8 @@ function handleVirtualWorkspace(manifest, metadata, ignoredDeps, includeTransiti
             let depPurl = pkg.source == null
                 ? toPathDepPurl(pkg.name, pkg.version)
                 : toPurl(pkg.name, pkg.version);
-            sbom.addDependency(rootPurl, depPurl);
+            let hashes = hashMap.get(`${pkg.name}@${pkg.version}`);
+            sbom.addDependency(rootPurl, depPurl, undefined, hashes);
         }
     }
     return sbom.getAsJsonString(opts);
@@ -374,7 +413,7 @@ function handleVirtualWorkspace(manifest, metadata, ignoredDeps, includeTransiti
  *   so callers can ensure it matches the purl already added to the SBOM
  * @private
  */
-function addTransitiveDeps(sbom, metadata, packageId, ignoredDeps, visited, startingPurl) {
+function addTransitiveDeps(sbom, metadata, packageId, ignoredDeps, visited, hashMap, startingPurl) {
     if (visited.has(packageId)) {
         return;
     }
@@ -402,8 +441,9 @@ function addTransitiveDeps(sbom, metadata, packageId, ignoredDeps, visited, star
         let depPurl = depPackage.source == null
             ? toPathDepPurl(depPackage.name, depPackage.version)
             : toPurl(depPackage.name, depPackage.version);
-        sbom.addDependency(sourcePurl, depPurl);
-        addTransitiveDeps(sbom, metadata, depId, ignoredDeps, visited);
+        let hashes = hashMap.get(`${depPackage.name}@${depPackage.version}`);
+        sbom.addDependency(sourcePurl, depPurl, undefined, hashes);
+        addTransitiveDeps(sbom, metadata, depId, ignoredDeps, visited, hashMap);
     }
 }
 /**
@@ -416,7 +456,7 @@ function addTransitiveDeps(sbom, metadata, packageId, ignoredDeps, visited, star
  * @param {Set<string>} ignoredDeps - set of ignored dependency names
  * @private
  */
-function addDirectDeps(sbom, metadata, packageId, parentPurl, ignoredDeps) {
+function addDirectDeps(sbom, metadata, packageId, parentPurl, ignoredDeps, hashMap) {
     let resolveNode = findResolveNode(metadata, packageId);
     if (!resolveNode) {
         return;
@@ -433,7 +473,8 @@ function addDirectDeps(sbom, metadata, packageId, parentPurl, ignoredDeps) {
         let depPurl = depPackage.source == null
             ? toPathDepPurl(depPackage.name, depPackage.version)
             : toPurl(depPackage.name, depPackage.version);
-        sbom.addDependency(parentPurl, depPurl);
+        let hashes = hashMap.get(`${depPackage.name}@${depPackage.version}`);
+        sbom.addDependency(parentPurl, depPurl, undefined, hashes);
     }
 }
 /**

package/dist/src/remediate.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Resolves a target path to the supported manifest files it contains: the single file
+ * if `targetPath` is a supported manifest, or every supported manifest discovered
+ * recursively if it's a directory. This is the single source of truth for what
+ * `runRemediation` will scan, so callers (e.g. the CLI) can reuse it to tell
+ * "no manifests here" apart from "manifests, but nothing to fix".
+ * @param {string} targetPath - path to a manifest file or directory
+ * @returns {string[]} absolute paths to supported manifests (empty for an empty directory)
+ * @throws if the path does not exist, or is a file of an unsupported manifest type
+ */
+export function findManifests(targetPath: string): string[];
+/**
+ * Orchestrates the full remediation pipeline for a single manifest or directory:
+ * discover manifests → scan via DA backend → extract remediations → apply or preview.
+ *
+ * @param {string} targetPath - path to a manifest file or directory
+ * @param {object} [options]
+ * @param {boolean} [options.dryRun=false] - preview changes without modifying files (applies by default)
+ * @param {string} [options.providers] - comma-separated provider list
+ * @param {string} [options.sources] - comma-separated source list
+ * @param {string} [options.backendUrl] - Trustify DA backend URL
+ * @param {boolean} [options.perDependencyChanges=false] - when true, each remediation is populated with
+ *   a `changes` array describing the isolated, single-dependency edit (see {@link DependencyFix}). This lets
+ *   callers create one commit/PR per dependency without attributing diff hunks themselves.
+ * @returns {Promise<{exitCode: number, output: string, remediations: Remediation[], manifests: string[], appliedFiles: string[]}>}
+ *   exitCode is 2 for a dry-run that found remediations (nothing written), 0 otherwise. `remediations`
+ *   is the structured, per-manifest list of applicable updates — each entry carries the originating
+ *   manifest path(s) in `files` so callers can group and create per-dependency changes. `appliedFiles`
+ *   lists only the manifests actually written to disk (empty on a dry-run), so callers can report a
+ *   truthful "updated N files" count without conflating "had remediations" with "was written".
+ */
+export function runRemediation(targetPath: string, options?: {
+    dryRun?: boolean | undefined;
+    providers?: string | undefined;
+    sources?: string | undefined;
+    backendUrl?: string | undefined;
+    perDependencyChanges?: boolean | undefined;
+}): Promise<{
+    exitCode: number;
+    output: string;
+    remediations: Remediation[];
+    manifests: string[];
+    appliedFiles: string[];
+}>;
+/**
+ * A single version change requested from an updater: bump `groupId:artifactId` to `newVersion`.
+ * The input side of every updater; each updater's output side (its `applied` entries) is its own
+ * type — see {@link AppliedChange}.
+ */
+export type VersionChangeRequest = {
+    groupId: string;
+    artifactId: string;
+    newVersion: string;
+};
+/**
+ * One entry from an updater's `applied` list, describing where and how a version was changed.
+ * Owned by the updater layer: the union of each updater's applied-entry shape. `changeKey`
+ * (per {@link ManifestType}) turns one of these into a stable edit-site identifier.
+ */
+export type AppliedChange = import("./updaters/maven_updater.js").MavenAppliedChange | import("./updaters/toml_updater.js").TomlAppliedChange;
+/**
+ * The result of running an updater over a manifest's raw content.
+ */
+export type UpdaterResult = {
+    content: string;
+    applied: AppliedChange[];
+    skipped: Array<{
+        groupId: string;
+        artifactId: string;
+        newVersion: string;
+        reason: string;
+    }>;
+};
+/**
+ * A supported manifest type and the operations that act on it.
+ * `changeKey` builds a stable edit-site key from a single `applied` entry, so callers can detect
+ * inseparable remediations (same key => same commit/PR).
+ */
+export type ManifestType = {
+    test: (basename: string) => boolean;
+    updater: (content: string, versionChanges: VersionChangeRequest[]) => UpdaterResult;
+    label: ("maven" | "toml");
+    changeKey: (manifestPath: string, applied: AppliedChange) => string;
+};
+/**
+ * An isolated, single-dependency edit to one manifest file.
+ * - `after` is the *original* manifest content with only this dependency's fix applied, so a caller
+ *   can create an isolated commit by writing `after` to `path` on a branch cut from the base.
+ * - `changeKey` is a stable identifier for the underlying edit site. Two remediations that share a
+ *   `changeKey` are inseparable (e.g. two Maven deps whose versions resolve to the same `${property}`,
+ *   or two Gradle libraries sharing one `version.ref`) and MUST land in the same commit/PR — the
+ *   caller should union their CVEs/advisories.
+ */
+export type DependencyFix = {
+    path: string;
+    after: string;
+    changeKey: string;
+};
+/**
+ * A single applicable remediation, as produced by `extractRemediations` and enriched by
+ * `runRemediation` with the originating manifest path(s) and (optionally) per-dependency changes.
+ */
+export type Remediation = {
+    purl: string;
+    groupId: string;
+    artifactId: string;
+    currentVersion: string;
+    fixedInVersion: string;
+    fixedInPurl: string;
+    provider: string;
+    source: string;
+    advisories: Array<{
+        id: string;
+        url: string;
+    }>;
+    severity: string;
+    cves: string[];
+    files: string[];
+    changes?: DependencyFix[];
+};