@trustify-da/trustify-da-javascript-client 0.3.0-ea.f2d5d72 → 0.3.0-ea.fa16f06

package/dist/src/providers/python_uv.js

@@ -1,5 +1,11 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import fg from 'fast-glob';
+import { parse as parseToml } from 'smol-toml';
 import { environmentVariableIsPopulated, getCustomPath, invokeCommand } from '../tools.js';
+import { filterManifestPathsByDiscoveryIgnore, resolveWorkspaceDiscoveryIgnore, toManifestGlobPatterns } from '../workspace.js';
 import Base_pyproject from './base_pyproject.js';
+import { evaluateMarker } from './marker_evaluator.js';
 import { getParser, getPinnedVersionQuery } from './requirements_parser.js';
 export default class Python_uv extends Base_pyproject {
     /** @returns {string} */
@@ -11,15 +17,58 @@ export default class Python_uv extends Base_pyproject {
         return 'uv';
     }
     /**
-     * @param {string} manifestDir
+     * @param {string} manifestDir - directory containing the target pyproject.toml
+     * @param {string} workspaceDir - workspace root (for resolving editable install paths)
      * @param {object} parsed - parsed pyproject.toml
      * @param {Object} opts
-     * @returns {Promise<{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}>}
+     * @returns {Promise<{directDeps: string[], graph: Map<string, import('./base_pyproject.js').GraphEntry>}>}
      */
-    async _getDependencyData(manifestDir, parsed, opts) {
+    async _getDependencyData(manifestDir, workspaceDir, parsed, opts) {
         let projectName = this._getProjectName(parsed);
         let uvOutput = this._getUvExportOutput(manifestDir, opts);
-        return this._parseUvExport(uvOutput, projectName);
+        let { directDeps, graph } = await this._parseUvExport(uvOutput, projectName, workspaceDir);
+        await this._attachHashesFromLockFile(path.join(workspaceDir, 'uv.lock'), graph);
+        return { directDeps, graph };
+    }
+    /**
+     * Parse uv.lock and attach SHA-256 hashes to graph entries.
+     * @param {string} lockFilePath - path to uv.lock
+     * @param {Map<string, import('./base_pyproject.js').GraphEntry>} graph
+     */
+    async _attachHashesFromLockFile(lockFilePath, graph) {
+        let lockContent;
+        try {
+            lockContent = await fs.promises.readFile(lockFilePath, 'utf-8');
+        }
+        catch {
+            return;
+        }
+        let parsed;
+        try {
+            parsed = parseToml(lockContent);
+        }
+        catch {
+            return;
+        }
+        let packages = parsed.package;
+        if (!Array.isArray(packages)) {
+            return;
+        }
+        for (let pkg of packages) {
+            if (!pkg.name) {
+                continue;
+            }
+            let hashStr = pkg.sdist?.hash || pkg.wheels?.[0]?.hash;
+            if (!hashStr || !hashStr.startsWith('sha256:')) {
+                continue;
+            }
+            let key = this._canonicalize(pkg.name);
+            let entry = graph.get(key);
+            if (!entry || entry.hashes) {
+                continue;
+            }
+            entry.hashes = [{ alg: "SHA-256", content: hashStr.slice(7) }];
+        }
     }
     /**
      * Get the uv export output, either from env var or by running the command.
@@ -32,7 +81,7 @@ export default class Python_uv extends Base_pyproject {
             return Buffer.from(process.env['TRUSTIFY_DA_UV_EXPORT'], 'base64').toString('ascii');
         }
         let uvBin = getCustomPath('uv', opts);
-        return invokeCommand(uvBin, ['export', '--format', 'requirements.txt', '--frozen', '--no-hashes'], { cwd: manifestDir }).toString();
+        return invokeCommand(uvBin, ['export', '--format', 'requirements.txt', '--frozen', '--no-hashes', '--no-dev', '--no-emit-project'], { cwd: manifestDir }).toString();
     }
     /**
      * Parse uv export output into a dependency graph using tree-sitter-requirements
@@ -40,9 +89,10 @@ export default class Python_uv extends Base_pyproject {
      *
      * @param {string} output
      * @param {string} projectName - canonical project name to identify direct deps
+     * @param {string} workspaceDir - workspace root (for resolving editable install paths)
      * @returns {Promise<{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}>}
      */
-    async _parseUvExport(output, projectName) {
+    async _parseUvExport(output, projectName, workspaceDir) {
         let [parser, pinnedVersionQuery] = await Promise.all([
             getParser(), getPinnedVersionQuery()
         ]);
@@ -53,11 +103,47 @@ export default class Python_uv extends Base_pyproject {
         let currentPkg = null;
         let collectingVia = false;
         for (let child of root.children) {
+            if (child.type === 'global_opt') {
+                let optNode = child.children.find(c => c.type === 'option');
+                let pathNode = child.children.find(c => c.type === 'path');
+                if (optNode?.text === '-e' && pathNode && workspaceDir) {
+                    let memberDir = path.resolve(workspaceDir, pathNode.text);
+                    let memberManifest = path.join(memberDir, 'pyproject.toml');
+                    if (fs.existsSync(memberManifest)) {
+                        let memberParsed = parseToml(fs.readFileSync(memberManifest, 'utf-8'));
+                        let name = memberParsed.project?.name || memberParsed.tool?.poetry?.name;
+                        let version = memberParsed.project?.version || memberParsed.tool?.poetry?.version;
+                        if (name && version) {
+                            let key = this._canonicalize(name);
+                            if (key === canonProjectName) {
+                                continue;
+                            }
+                            currentPkg = { name, version, parents: new Set() };
+                            packages.set(key, currentPkg);
+                            collectingVia = false;
+                            continue;
+                        }
+                    }
+                }
+                currentPkg = null;
+                collectingVia = false;
+                continue;
+            }
             if (child.type === 'requirement') {
                 let nameNode = child.children.find(c => c.type === 'package');
                 if (!nameNode) {
                     continue;
                 }
+                // Skip packages with non-matching PEP 508 markers, e.g. "pywin32==311 ; sys_platform == 'win32'"
+                let markerNode = child.children.find(c => c.type === 'marker_spec');
+                if (markerNode) {
+                    let markerText = markerNode.text.replace(/^\s*;\s*/, '');
+                    if (!evaluateMarker(markerText)) {
+                        currentPkg = null;
+                        collectingVia = false;
+                        continue;
+                    }
+                }
                 let name = nameNode.text;
                 let version = null;
                 let versionMatches = pinnedVersionQuery.matches(child);
@@ -116,3 +202,68 @@ export default class Python_uv extends Base_pyproject {
         return { directDeps, graph };
     }
 }
+const DEFAULT_UV_DISCOVERY_IGNORE = [
+    '**/__pycache__/**',
+    '**/.venv/**',
+];
+/**
+ * Discover all pyproject.toml manifest paths in a uv workspace.
+ * Parses `[tool.uv.workspace]` from root pyproject.toml and glob-expands member patterns.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain pyproject.toml and uv.lock)
+ * @param {{ workspaceDiscoveryIgnore?: string[], TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string, [key: string]: unknown }} [opts={}]
+ * @returns {Promise<string[]>} Paths to pyproject.toml files (absolute)
+ */
+export async function discoverUvWorkspaceMembers(workspaceRoot, opts = {}) {
+    const root = path.resolve(workspaceRoot);
+    const rootPyproject = path.join(root, 'pyproject.toml');
+    const uvLock = path.join(root, 'uv.lock');
+    if (!fs.existsSync(rootPyproject) || !fs.existsSync(uvLock)) {
+        return [];
+    }
+    let parsed;
+    try {
+        parsed = parseToml(fs.readFileSync(rootPyproject, 'utf-8'));
+    }
+    catch {
+        return [];
+    }
+    const workspaceConfig = parsed?.tool?.uv?.workspace;
+    if (!workspaceConfig) {
+        return [];
+    }
+    const memberPatterns = workspaceConfig.members;
+    if (!Array.isArray(memberPatterns) || memberPatterns.length === 0) {
+        return [];
+    }
+    const excludePatterns = Array.isArray(workspaceConfig.exclude) ? workspaceConfig.exclude : [];
+    const excludeGlobs = excludePatterns
+        .filter(p => typeof p === 'string' && p.trim())
+        .map(p => `${p.trim()}/pyproject.toml`);
+    const ignorePatterns = [...resolveWorkspaceDiscoveryIgnore(opts), ...DEFAULT_UV_DISCOVERY_IGNORE];
+    const globOpts = {
+        cwd: root,
+        absolute: true,
+        onlyFiles: true,
+        ignore: [...ignorePatterns, ...excludeGlobs],
+        followSymbolicLinks: false,
+    };
+    const patterns = toManifestGlobPatterns(memberPatterns.filter(p => typeof p === 'string'), 'pyproject.toml');
+    const manifestPaths = await fg(patterns, globOpts);
+    if (!manifestPaths.includes(rootPyproject) && hasProjectMetadata(parsed)) {
+        manifestPaths.unshift(rootPyproject);
+    }
+    return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
+}
+/**
+ * @param {import('smol-toml').TomlTable} parsedPyProject
+ * @returns {boolean}
+ */
+function hasProjectMetadata(parsedPyProject) {
+    try {
+        return typeof parsedPyProject?.project?.name === 'string' && parsedPyProject.project.name.trim() !== '';
+    }
+    catch {
+        return false;
+    }
+}

package/dist/src/providers/rust_cargo.d.ts

@@ -4,9 +4,10 @@ declare namespace _default {
     export { provideComponent };
     export { provideStack };
     export { readLicenseFromManifest };
+    export function packageManagerName(): string;
 }
 export default _default;
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 /**
  * @param {string} manifestName - the subject manifest name-type
  * @returns {boolean} - return true if `Cargo.toml` is the manifest name-type
@@ -46,7 +47,10 @@ declare function provideStack(manifest: string, opts?: {}): Provided;
  * Read project license from Cargo.toml, with fallback to LICENSE file.
  * Supports the `license` field under `[package]` (single crate / workspace
  * with root) and under `[workspace.package]` (virtual workspaces).
+ * When a member crate uses `license = { workspace = true }`, the actual
+ * license is resolved from the workspace root Cargo.toml.
  * @param {string} manifestPath - path to Cargo.toml
+ * @param {object} [metadata] - cargo metadata output (needed for workspace license resolution)
  * @returns {string|null} SPDX identifier or null
  */
-declare function readLicenseFromManifest(manifestPath: string): string | null;
+declare function readLicenseFromManifest(manifestPath: string, metadata?: object): string | null;

package/dist/src/providers/rust_cargo.js

@@ -5,7 +5,7 @@ import { parse as parseToml } from 'smol-toml';
 import { getLicense } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
 import { getCustom, getCustomPath, invokeCommand } from '../tools.js';
-export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest };
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'cargo'; } };
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /**
@@ -71,15 +71,22 @@ function isSupported(manifestName) {
  * Read project license from Cargo.toml, with fallback to LICENSE file.
  * Supports the `license` field under `[package]` (single crate / workspace
  * with root) and under `[workspace.package]` (virtual workspaces).
+ * When a member crate uses `license = { workspace = true }`, the actual
+ * license is resolved from the workspace root Cargo.toml.
  * @param {string} manifestPath - path to Cargo.toml
+ * @param {object} [metadata] - cargo metadata output (needed for workspace license resolution)
  * @returns {string|null} SPDX identifier or null
  */
-function readLicenseFromManifest(manifestPath) {
+function readLicenseFromManifest(manifestPath, metadata) {
     let fromManifest = null;
     try {
         let content = fs.readFileSync(manifestPath, 'utf-8');
         let parsed = parseToml(content);
-        fromManifest = parsed.package?.license
+        let packageLicense = parsed.package?.license;
+        if (typeof packageLicense === 'object' && packageLicense?.workspace === true) {
+            packageLicense = resolveWorkspaceLicense(parsed, metadata);
+        }
+        fromManifest = packageLicense
             || parsed.workspace?.package?.license
             || null;
     }
@@ -88,6 +95,26 @@ function readLicenseFromManifest(manifestPath) {
     }
     return getLicense(fromManifest, manifestPath);
 }
+/**
+ * Resolve a workspace-inherited license from the workspace root Cargo.toml.
+ * @param {object} parsed - the parsed member crate Cargo.toml
+ * @param {object} [metadata] - cargo metadata output with workspace_root
+ * @returns {string|null} resolved license string or null
+ */
+function resolveWorkspaceLicense(parsed, metadata) {
+    if (metadata?.workspace_root) {
+        let cargoTomlPath = path.join(metadata.workspace_root, 'Cargo.toml');
+        try {
+            let content = fs.readFileSync(cargoTomlPath, 'utf-8');
+            let workspaceParsed = parseToml(content);
+            return workspaceParsed.workspace?.package?.license || null;
+        }
+        catch (_) {
+            // fall through
+        }
+    }
+    return parsed.workspace?.package?.license || null;
+}
 /**
  * Validates that Cargo.lock exists in the manifest directory or in a parent
  * workspace root directory.  In Cargo workspaces the lock file always lives at
@@ -173,13 +200,14 @@ function getSBOM(manifest, opts = {}, includeTransitive) {
     let metadata = executeCargoMetadata(cargoBin, manifestDir);
     let ignoredDeps = getIgnoredDeps(manifest, metadata);
     let crateType = detectCrateType(metadata);
-    let license = readLicenseFromManifest(manifest);
+    let license = readLicenseFromManifest(manifest, metadata);
+    let hashMap = parseCargoLockHashes(manifestDir);
     let sbom;
     if (crateType === CrateType.WORKSPACE_VIRTUAL) {
-        sbom = handleVirtualWorkspace(manifest, metadata, ignoredDeps, includeTransitive, opts, license);
+        sbom = handleVirtualWorkspace(manifest, metadata, ignoredDeps, includeTransitive, opts, license, hashMap);
     }
     else {
-        sbom = handleSingleCrate(metadata, ignoredDeps, includeTransitive, opts, license);
+        sbom = handleSingleCrate(metadata, ignoredDeps, includeTransitive, opts, license, hashMap);
     }
     return sbom;
 }
@@ -217,6 +245,63 @@ function executeCargoMetadata(cargoBin, manifestDir) {
         throw new Error('failed to execute cargo metadata', { cause: error });
     }
 }
+/**
+ * Parses Cargo.lock to extract SHA-256 checksums for each package.
+ * @param {string} manifestDir - directory containing Cargo.toml (Cargo.lock is searched upward)
+ * @returns {Map<string, Array<{alg: string, content: string}>>} map of "name@version" to CycloneDX hashes
+ * @private
+ */
+function parseCargoLockHashes(manifestDir) {
+    let hashMap = new Map();
+    let lockPath = findCargoLock(manifestDir);
+    if (!lockPath) {
+        return hashMap;
+    }
+    try {
+        let content = fs.readFileSync(lockPath, 'utf-8');
+        let parsed = parseToml(content);
+        for (let pkg of (parsed.package || [])) {
+            if (pkg.name && pkg.version && pkg.checksum) {
+                hashMap.set(`${pkg.name}@${pkg.version}`, [{ alg: 'SHA-256', content: pkg.checksum }]);
+            }
+        }
+    }
+    catch (error) {
+        console.warn('Failed to parse Cargo.lock for hashes, SBOM will be generated without hashes');
+    }
+    return hashMap;
+}
+/**
+ * Searches upward from the manifest directory to find the nearest Cargo.lock.
+ * @param {string} manifestDir - starting directory
+ * @returns {string|null} absolute path to Cargo.lock or null if not found
+ * @private
+ */
+function findCargoLock(manifestDir) {
+    let dir = path.resolve(manifestDir);
+    let parent = dir;
+    do {
+        dir = parent;
+        let lockFile = path.join(dir, 'Cargo.lock');
+        if (fs.existsSync(lockFile)) {
+            return lockFile;
+        }
+        let cargoToml = path.join(dir, 'Cargo.toml');
+        if (fs.existsSync(cargoToml)) {
+            try {
+                let content = fs.readFileSync(cargoToml, 'utf-8');
+                if (/\[workspace\]/.test(content)) {
+                    return null;
+                }
+            }
+            catch (_) {
+                // ignore read errors, keep searching
+            }
+        }
+        parent = path.dirname(dir);
+    } while (parent !== dir);
+    return null;
+}
 /**
  * Detects the type of Cargo project from metadata.
  * @param {object} metadata - parsed cargo metadata
@@ -248,7 +333,7 @@ function detectCrateType(metadata) {
  * @returns {string} SBOM json string
  * @private
  */
-function handleSingleCrate(metadata, ignoredDeps, includeTransitive, opts, license) {
+function handleSingleCrate(metadata, ignoredDeps, includeTransitive, opts, license, hashMap) {
     let rootPackageId = metadata.resolve.root;
     let rootPackage = findPackageById(metadata, rootPackageId);
     let rootPurl = toPurl(rootPackage.name, rootPackage.version);
@@ -259,10 +344,10 @@ function handleSingleCrate(metadata, ignoredDeps, includeTransitive, opts, licen
         return sbom.getAsJsonString(opts);
     }
     if (includeTransitive) {
-        addTransitiveDeps(sbom, metadata, rootPackageId, ignoredDeps, new Set(), rootPurl);
+        addTransitiveDeps(sbom, metadata, rootPackageId, ignoredDeps, new Set(), hashMap, rootPurl);
     }
     else {
-        addDirectDeps(sbom, metadata, rootPackageId, rootPurl, ignoredDeps);
+        addDirectDeps(sbom, metadata, rootPackageId, rootPurl, ignoredDeps, hashMap);
     }
     return sbom.getAsJsonString(opts);
 }
@@ -288,7 +373,7 @@ function handleSingleCrate(metadata, ignoredDeps, includeTransitive, opts, licen
  * @returns {string} SBOM json string
  * @private
  */
-function handleVirtualWorkspace(manifest, metadata, ignoredDeps, includeTransitive, opts, license) {
+function handleVirtualWorkspace(manifest, metadata, ignoredDeps, includeTransitive, opts, license, hashMap) {
     let workspaceRoot = metadata.workspace_root;
     let rootName = path.basename(workspaceRoot);
     let workspaceVersion = getWorkspaceVersion(metadata);
@@ -296,7 +381,6 @@ function handleVirtualWorkspace(manifest, metadata, ignoredDeps, includeTransiti
     let sbom = new Sbom();
     sbom.addRoot(rootPurl, license);
     if (includeTransitive) {
-        // Stack analysis: walk all members and their full dependency trees
         let workspaceMembers = metadata.workspace_members || [];
         for (let memberId of workspaceMembers) {
             let memberPackage = findPackageById(metadata, memberId);
@@ -307,11 +391,10 @@ function handleVirtualWorkspace(manifest, metadata, ignoredDeps, includeTransiti
                 ? toPathDepPurl(memberPackage.name, memberPackage.version)
                 : toPurl(memberPackage.name, memberPackage.version);
             sbom.addDependency(rootPurl, memberPurl);
-            addTransitiveDeps(sbom, metadata, memberId, ignoredDeps, new Set(), memberPurl);
+            addTransitiveDeps(sbom, metadata, memberId, ignoredDeps, new Set(), hashMap, memberPurl);
         }
     }
     else {
-        // Component analysis: only [workspace.dependencies] from root Cargo.toml
         let workspaceDeps = getWorkspaceDepsFromManifest(manifest);
         for (let depName of workspaceDeps) {
             if (isDepIgnored(depName, ignoredDeps)) {
@@ -328,7 +411,8 @@ function handleVirtualWorkspace(manifest, metadata, ignoredDeps, includeTransiti
             let depPurl = pkg.source == null
                 ? toPathDepPurl(pkg.name, pkg.version)
                 : toPurl(pkg.name, pkg.version);
-            sbom.addDependency(rootPurl, depPurl);
+            let hashes = hashMap.get(`${pkg.name}@${pkg.version}`);
+            sbom.addDependency(rootPurl, depPurl, undefined, hashes);
         }
     }
     return sbom.getAsJsonString(opts);
@@ -347,7 +431,7 @@ function handleVirtualWorkspace(manifest, metadata, ignoredDeps, includeTransiti
  *   so callers can ensure it matches the purl already added to the SBOM
  * @private
  */
-function addTransitiveDeps(sbom, metadata, packageId, ignoredDeps, visited, startingPurl) {
+function addTransitiveDeps(sbom, metadata, packageId, ignoredDeps, visited, hashMap, startingPurl) {
     if (visited.has(packageId)) {
         return;
     }
@@ -375,8 +459,9 @@ function addTransitiveDeps(sbom, metadata, packageId, ignoredDeps, visited, star
         let depPurl = depPackage.source == null
             ? toPathDepPurl(depPackage.name, depPackage.version)
             : toPurl(depPackage.name, depPackage.version);
-        sbom.addDependency(sourcePurl, depPurl);
-        addTransitiveDeps(sbom, metadata, depId, ignoredDeps, visited);
+        let hashes = hashMap ? hashMap.get(`${depPackage.name}@${depPackage.version}`) : undefined;
+        sbom.addDependency(sourcePurl, depPurl, undefined, hashes);
+        addTransitiveDeps(sbom, metadata, depId, ignoredDeps, visited, hashMap);
     }
 }
 /**
@@ -389,7 +474,7 @@ function addTransitiveDeps(sbom, metadata, packageId, ignoredDeps, visited, star
  * @param {Set<string>} ignoredDeps - set of ignored dependency names
  * @private
  */
-function addDirectDeps(sbom, metadata, packageId, parentPurl, ignoredDeps) {
+function addDirectDeps(sbom, metadata, packageId, parentPurl, ignoredDeps, hashMap) {
     let resolveNode = findResolveNode(metadata, packageId);
     if (!resolveNode) {
         return;
@@ -406,7 +491,8 @@ function addDirectDeps(sbom, metadata, packageId, parentPurl, ignoredDeps) {
         let depPurl = depPackage.source == null
             ? toPathDepPurl(depPackage.name, depPackage.version)
             : toPurl(depPackage.name, depPackage.version);
-        sbom.addDependency(parentPurl, depPurl);
+        let hashes = hashMap ? hashMap.get(`${depPackage.name}@${depPackage.version}`) : undefined;
+        sbom.addDependency(parentPurl, depPurl, undefined, hashes);
     }
 }
 /**

package/dist/src/remediate.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Orchestrates the full remediation pipeline for a single manifest or directory:
+ * discover manifests → scan via DA backend → extract remediations → apply or preview.
+ *
+ * @param {string} targetPath - path to a manifest file or directory
+ * @param {object} [options]
+ * @param {boolean} [options.dryRun=false] - preview changes without modifying files (applies by default)
+ * @param {string} [options.providers] - comma-separated provider list
+ * @param {string} [options.sources] - comma-separated source list
+ * @param {'dependency'|'bundle'} [options.groupBy='dependency'] - report grouping strategy
+ * @returns {Promise<{exitCode: number, output: string}>}
+ */
+export function runRemediation(targetPath: string, options?: {
+    dryRun?: boolean | undefined;
+    providers?: string | undefined;
+    sources?: string | undefined;
+    groupBy?: "dependency" | "bundle" | undefined;
+}): Promise<{
+    exitCode: number;
+    output: string;
+}>;

package/dist/src/remediate.js

@@ -0,0 +1,149 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import analysis from './analysis.js';
+import { availableProviders, match } from './provider.js';
+import { extractRemediations } from './remediation.js';
+import { generateReport } from './remediation_report.js';
+import { updateMavenVersions } from './updaters/maven_updater.js';
+import { updateTomlVersions } from './updaters/toml_updater.js';
+import { selectTrustifyDABackend } from './index.js';
+// Mirrors DEFAULT_WORKSPACE_DISCOVERY_IGNORE in workspace.js
+const SKIP_DIRS = new Set(['node_modules', '.git']);
+const MANIFEST_TYPES = [
+    {
+        test: (basename) => basename === 'pom.xml',
+        updater: updateMavenVersions,
+        label: 'maven',
+    },
+    {
+        test: (basename) => basename.endsWith('.versions.toml') || basename === 'libs.versions.toml',
+        updater: updateTomlVersions,
+        label: 'toml',
+    },
+];
+/**
+ * Discovers supported manifest files recursively within a directory.
+ * @param {string} dirPath - absolute path to the directory
+ * @returns {string[]} array of absolute paths to supported manifest files
+ */
+function discoverManifests(dirPath) {
+    const manifests = [];
+    function walk(dir) {
+        const entries = fs.readdirSync(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            if (SKIP_DIRS.has(entry.name)) {
+                continue;
+            }
+            const fullPath = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                walk(fullPath);
+            }
+            else if (getManifestType(entry.name)) {
+                manifests.push(fullPath);
+            }
+        }
+    }
+    walk(dirPath);
+    return manifests;
+}
+/**
+ * Returns the manifest type descriptor for a given filename, or null if unsupported.
+ * @param {string} basename - the file name to check
+ * @returns {{test: function, updater: function, label: string}|null}
+ */
+function getManifestType(basename) {
+    return MANIFEST_TYPES.find(t => t.test(basename)) || null;
+}
+/**
+ * Orchestrates the full remediation pipeline for a single manifest or directory:
+ * discover manifests → scan via DA backend → extract remediations → apply or preview.
+ *
+ * @param {string} targetPath - path to a manifest file or directory
+ * @param {object} [options]
+ * @param {boolean} [options.dryRun=false] - preview changes without modifying files (applies by default)
+ * @param {string} [options.providers] - comma-separated provider list
+ * @param {string} [options.sources] - comma-separated source list
+ * @param {'dependency'|'bundle'} [options.groupBy='dependency'] - report grouping strategy
+ * @returns {Promise<{exitCode: number, output: string}>}
+ */
+export async function runRemediation(targetPath, options = {}) {
+    const { dryRun = false, providers, sources, groupBy = 'dependency' } = options;
+    const resolvedPath = path.resolve(targetPath);
+    let manifestPaths;
+    let stat;
+    try {
+        stat = fs.statSync(resolvedPath);
+    }
+    catch {
+        throw new Error(`Path not found: ${resolvedPath}`);
+    }
+    if (stat.isDirectory()) {
+        manifestPaths = discoverManifests(resolvedPath);
+        if (manifestPaths.length === 0) {
+            return { exitCode: 0, output: 'No supported manifest files found.' };
+        }
+    }
+    else {
+        const basename = path.basename(resolvedPath);
+        if (!getManifestType(basename)) {
+            throw new Error(`Unsupported manifest type: ${basename}`);
+        }
+        manifestPaths = [resolvedPath];
+    }
+    const opts = {};
+    if (providers) {
+        opts.TRUSTIFY_DA_PROVIDERS = providers;
+    }
+    if (sources) {
+        opts.TRUSTIFY_DA_SOURCES = sources;
+    }
+    const url = selectTrustifyDABackend(opts);
+    const allRemediations = [];
+    const appliedFiles = [];
+    for (const manifestPath of manifestPaths) {
+        const basename = path.basename(manifestPath);
+        const manifestType = getManifestType(basename);
+        if (!manifestType) {
+            continue;
+        }
+        let provider;
+        try {
+            provider = match(manifestPath, availableProviders, opts);
+        }
+        catch {
+            continue;
+        }
+        const analysisReport = await analysis.requestStack(provider, manifestPath, url, false, opts);
+        const remediations = extractRemediations(analysisReport, {
+            providerPriority: providers ? providers.split(',').map(p => p.trim()).filter(Boolean) : undefined,
+        });
+        if (remediations.length === 0) {
+            continue;
+        }
+        allRemediations.push(...remediations);
+        if (!dryRun) {
+            const content = fs.readFileSync(manifestPath, 'utf-8');
+            const versionChanges = remediations.map(r => ({
+                groupId: r.groupId,
+                artifactId: r.artifactId,
+                newVersion: r.fixedInVersion,
+            }));
+            const result = manifestType.updater(content, versionChanges);
+            if (result.applied.length > 0) {
+                fs.writeFileSync(manifestPath, result.content, 'utf-8');
+                appliedFiles.push(manifestPath);
+            }
+        }
+    }
+    if (allRemediations.length === 0) {
+        return { exitCode: 0, output: 'No remediations found.' };
+    }
+    const report = generateReport(allRemediations, { groupBy });
+    if (dryRun) {
+        return { exitCode: 2, output: report };
+    }
+    const summary = appliedFiles.length > 0
+        ? `Updated ${appliedFiles.length} file(s):\n${appliedFiles.map(f => `  ${f}`).join('\n')}\n\n${report}`
+        : report;
+    return { exitCode: 0, output: summary };
+}