@cdxgen/cdxgen 13.1.0 → 13.2.0

package/lib/inventory/astWorker.js

@@ -9,6 +9,12 @@
 import { parentPort } from "node:worker_threads";
 
 import { parseFileASTTreeCollected } from "./analyzer.js";
+import { getSvelteTemplateParser } from "./svelteUtils.js";
+
+// The parse runs synchronously on the worker thread, so the optional Svelte
+// template parser is resolved eagerly here (a silent no-op when the optional
+// package is absent; the built-in script mask covers all scope evidence).
+getSvelteTemplateParser();
 
 parentPort.on("message", (task) => {
   try {

package/lib/inventory/auditCategories.js

@@ -23,6 +23,12 @@ export const GOLEM_AUDIT_CATEGORIES = Object.freeze([
   "golem-compliance",
 ]);
 
+/** Frozen list of Cargo (Rust) audit categories. */
+export const CARGO_AUDIT_CATEGORIES = Object.freeze([
+  "cargo-security",
+  "cargo-compliance",
+]);
+
 /**
  * Frozen list of audit categories that never activate on their own. These
  * rule packs serve a specific feature (`--introspect` for build-fidelity) and
@@ -52,10 +58,12 @@ export const BOM_AUDIT_CATEGORY_ALIASES = Object.freeze({
   "ai-bom": [...AI_BOM_AUDIT_CATEGORIES, "ai-agent", "mcp-server"],
   "ai-provenance": ["ai-provenance", "ai-oversight"],
   "ai-oversight": ["ai-oversight"],
+  cargo: [...CARGO_AUDIT_CATEGORIES],
   cbom: [...CBOM_AUDIT_CATEGORIES],
   "crypto-bom": [...CBOM_AUDIT_CATEGORIES],
   golem: [...GOLEM_AUDIT_CATEGORIES],
   hbom: [...HBOM_AUDIT_CATEGORIES],
+  rust: [...CARGO_AUDIT_CATEGORIES],
   host: [...HBOM_AUDIT_CATEGORIES, ...HOST_TOPOLOGY_AUDIT_CATEGORIES],
 });
 

package/lib/inventory/cbomutils.js

@@ -345,6 +345,36 @@ function normalizeDosaiCryptoNames(cryptoObject) {
       names.add("sha-512");
     }
   }
+  // dosai reports the post-quantum families under their generic names and no
+  // generic OID exists for any of them, so the parameter set has to come from
+  // the call-site context (dosai's Code field carries the source line, e.g.
+  // "MLDsa.GenerateKey(MLDsaAlgorithm.MLDsa65)"). Without a parameter set the
+  // asset stays unmapped and is skipped rather than emitted with a wrong OID.
+  if (/^ML-?DSA$/i.test(cleanName)) {
+    const parameterSet = context.match(/(?:MLDsa|ML-DSA-)(44|65|87)\b/i);
+    if (parameterSet) {
+      names.add(`ml-dsa-${parameterSet[1]}`);
+    }
+  }
+  if (/^ML-?KEM$/i.test(cleanName)) {
+    const parameterSet = context.match(/(?:MLKem|ML-KEM-)(512|768|1024)\b/i);
+    if (parameterSet) {
+      names.add(`ml-kem-${parameterSet[1]}`);
+    }
+  }
+  if (/^SLH-?DSA$/i.test(cleanName)) {
+    // .NET spells it SlhDsaSha2_128s; NIST SLH-DSA-SHA2-128s. The hash family
+    // is required: SHA2 and SHAKE have distinct OIDs, so a context naming only
+    // the size, such as SLH-DSA-192f, resolves to no single parameter set.
+    const parameterSet = context.match(
+      /(?:SlhDsa|SLH-DSA-)(SHA2|SHAKE)[-_]?(128|192|256)(s|f)\b/i,
+    );
+    if (parameterSet) {
+      names.add(
+        `slh-dsa-${parameterSet[1].toLowerCase()}-${parameterSet[2]}${parameterSet[3].toLowerCase()}`,
+      );
+    }
+  }
   return Array.from(names);
 }
 

package/lib/inventory/cdxrs.js

@@ -25,8 +25,13 @@ import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
 import { safeExistsSync } from "../core/fs.js";
 import { getDefaultPluginRuntime, resolvePluginBinary } from "./plugins.js";
 
-/** Major version this bridge expects from the cdxrs binary. */
-const CDXRS_VERSION_MAJOR = "3";
+/**
+ * Major version this bridge expects from the cdxrs binary. cdxgen-plugins-bin
+ * versions every tool in lockstep, so this moves with
+ * `@cdxgen/cdxgen-plugins-bin` in package.json even when cdxrs itself carries
+ * no breaking change (4.0.0 is 3.2.0 renumbered by the release).
+ */
+const CDXRS_VERSION_MAJOR = "4";
 
 /** Default timeout for a cdxrs invocation. */
 const DEFAULT_TIMEOUT_MS = 30_000;

package/lib/inventory/communityAiConfigParser.js

@@ -1,8 +1,9 @@
 import { readFileSync } from "node:fs";
-import { basename, dirname, extname } from "node:path";
+import { basename, dirname, extname, join } from "node:path";
 
 import { parse as loadYaml } from "yaml";
 
+import { safeExistsSync } from "../core/fs.js";
 import { sanitizeBomPropertyValue } from "../core/propertySanitizer.js";
 import { parseJsonLike } from "./jsonLike.js";
 import {
@@ -28,6 +29,18 @@ const COMMUNITY_AI_PATTERNS = [
   "**/.claude/skills/*/SKILL.md",
   ".agents/skills/*/SKILL.md",
   "**/.agents/skills/*/SKILL.md",
+  ".codex/skills/*/SKILL.md",
+  "**/.codex/skills/*/SKILL.md",
+  "skills/*/SKILL.md",
+  "**/skills/*/SKILL.md",
+  ".claude-plugin/plugin.json",
+  "**/.claude-plugin/plugin.json",
+  ".claude-plugin/marketplace.json",
+  "**/.claude-plugin/marketplace.json",
+  ".claude/agents/*.md",
+  "**/.claude/agents/*.md",
+  ".claude/commands/**/*.md",
+  "**/.claude/commands/**/*.md",
   ".cursor/rules/*.{md,mdc}",
   "**/.cursor/rules/*.{md,mdc}",
   ".windsurf/rules/**/*.md",
@@ -145,9 +158,24 @@ function frameworkForFile(filePath, raw = "") {
   if (lowerPath.includes("/.claude/skills/")) {
     return "claude-compatible";
   }
+  if (lowerPath.includes("/.claude-plugin/")) {
+    return "claude-plugin";
+  }
+  if (lowerPath.includes("/.claude/agents/")) {
+    return "claude-subagent";
+  }
+  if (lowerPath.includes("/.claude/commands/")) {
+    return "claude-command";
+  }
+  if (lowerPath.includes("/.codex/skills/")) {
+    return "codex";
+  }
   if (lowerPath.includes("/.agents/skills/")) {
     return "agent-compatible";
   }
+  if (/(?:^|\/)skills\/[^/]+\/skill\.md$/u.test(lowerPath)) {
+    return "agent-skills";
+  }
   return "community-ai";
 }
 
@@ -250,6 +278,173 @@ function parseSkillFile(filePath, raw) {
       metadata.metadata,
     );
   }
+  // Record whether the frontmatter satisfies the open Agent Skills constraints
+  // (name: 1-64 lowercase-alnum-hyphen; description: 1-1024 chars) as a single
+  // reviewer-friendly boolean rather than copying the raw values twice.
+  const specValid =
+    typeof metadata?.name === "string" &&
+    /^[a-z0-9-]{1,64}$/u.test(metadata.name) &&
+    typeof metadata?.description === "string" &&
+    metadata.description.length >= 1 &&
+    metadata.description.length <= 1024;
+  addUniqueProperty(
+    component.properties,
+    "cdx:skill:specValid",
+    specValid ? "true" : "false",
+  );
+  const skillDir = dirname(filePath);
+  for (const [subdir, property] of [
+    ["scripts", "cdx:skill:hasScripts"],
+    ["references", "cdx:skill:hasReferences"],
+    ["assets", "cdx:skill:hasAssets"],
+  ]) {
+    if (safeExistsSync(join(skillDir, subdir))) {
+      addUniqueProperty(component.properties, property, "true");
+    }
+  }
+  maybeAddFileSignals(component.properties, filePath, raw);
+  return [component];
+}
+
+/**
+ * Parse a Claude Code plugin manifest (`.claude-plugin/plugin.json`) into a
+ * single application component describing the plugin.
+ *
+ * @param {string} filePath Manifest path
+ * @param {string} raw File contents
+ * @returns {Object[]} Component list (one plugin component or empty)
+ */
+function parsePluginManifest(filePath, raw) {
+  let manifest;
+  try {
+    manifest = parseJsonLike(raw);
+  } catch {
+    return [];
+  }
+  if (!manifest?.name) {
+    return [];
+  }
+  const component = createComponent(
+    filePath,
+    "claude-plugin",
+    "agent-plugin",
+    manifest.name,
+  );
+  if (manifest.version) {
+    component.version = String(manifest.version);
+  }
+  addUniqueProperty(
+    component.properties,
+    "cdx:plugin:description",
+    manifest.description,
+  );
+  addUniqueProperty(
+    component.properties,
+    "cdx:plugin:author",
+    typeof manifest.author === "string"
+      ? manifest.author
+      : manifest.author?.name,
+  );
+  for (const [key, property] of [
+    ["commands", "cdx:plugin:commandCount"],
+    ["agents", "cdx:plugin:agentCount"],
+    ["skills", "cdx:plugin:skillCount"],
+    ["hooks", "cdx:plugin:hookCount"],
+    ["mcpServers", "cdx:plugin:mcpServerCount"],
+  ]) {
+    const value = manifest[key];
+    if (Array.isArray(value)) {
+      addUniqueProperty(component.properties, property, String(value.length));
+    } else if (value && typeof value === "object") {
+      addUniqueProperty(
+        component.properties,
+        property,
+        String(Object.keys(value).length),
+      );
+    }
+  }
+  maybeAddFileSignals(component.properties, filePath, raw);
+  return [component];
+}
+
+/**
+ * Parse a Claude Code plugin marketplace file
+ * (`.claude-plugin/marketplace.json`) into one component per listed plugin.
+ *
+ * @param {string} filePath Marketplace path
+ * @param {string} raw File contents
+ * @returns {Object[]} Component list
+ */
+function parsePluginMarketplace(filePath, raw) {
+  let marketplace;
+  try {
+    marketplace = parseJsonLike(raw);
+  } catch {
+    return [];
+  }
+  const plugins = Array.isArray(marketplace?.plugins)
+    ? marketplace.plugins
+    : [];
+  const components = [];
+  for (const plugin of plugins) {
+    const name = plugin?.name || plugin?.source;
+    if (!name) {
+      continue;
+    }
+    const component = createComponent(
+      filePath,
+      "claude-plugin",
+      "agent-plugin-listing",
+      String(name),
+    );
+    addUniqueProperty(
+      component.properties,
+      "cdx:plugin:description",
+      plugin.description,
+    );
+    addUniqueProperty(
+      component.properties,
+      "cdx:plugin:source",
+      typeof plugin.source === "string" ? plugin.source : undefined,
+    );
+    components.push(component);
+  }
+  return components;
+}
+
+/**
+ * Parse a Claude Code subagent definition (`.claude/agents/*.md`) into an
+ * agent-definition component using its markdown frontmatter.
+ *
+ * @param {string} filePath Subagent markdown path
+ * @param {string} raw File contents
+ * @returns {Object[]} Component list
+ */
+function parseClaudeSubagent(filePath, raw) {
+  const { metadata } = parseFrontmatter(raw);
+  const name = metadata?.name || basename(filePath, extname(filePath));
+  const component = createComponent(
+    filePath,
+    "claude-subagent",
+    "agent-definition",
+    name,
+  );
+  addUniqueProperty(component.properties, "cdx:agent:role", "claude-subagent");
+  addUniqueProperty(
+    component.properties,
+    "cdx:agent:description",
+    metadata?.description,
+  );
+  addUniqueProperty(component.properties, "cdx:agent:model", metadata?.model);
+  if (Array.isArray(metadata?.tools)) {
+    addUniqueProperty(
+      component.properties,
+      "cdx:agent:tools",
+      metadata.tools.join(","),
+    );
+  } else if (typeof metadata?.tools === "string") {
+    addUniqueProperty(component.properties, "cdx:agent:tools", metadata.tools);
+  }
   maybeAddFileSignals(component.properties, filePath, raw);
   return [component];
 }
@@ -708,10 +903,28 @@ export const communityAiConfigParser = {
         components.push(...parseAgentMarkdown(filePath, raw));
         continue;
       }
+      if (lowerPath.endsWith("/.claude-plugin/plugin.json")) {
+        components.push(...parsePluginManifest(filePath, raw));
+        continue;
+      }
+      if (lowerPath.endsWith("/.claude-plugin/marketplace.json")) {
+        components.push(...parsePluginMarketplace(filePath, raw));
+        continue;
+      }
+      if (lowerPath.includes("/.claude/agents/")) {
+        components.push(...parseClaudeSubagent(filePath, raw));
+        continue;
+      }
+      if (lowerPath.includes("/.claude/commands/")) {
+        components.push(...parseInstructionMarkdown(filePath, raw));
+        continue;
+      }
       if (
         lowerPath.includes("/.opencode/skills/") ||
         lowerPath.includes("/.claude/skills/") ||
-        lowerPath.includes("/.agents/skills/")
+        lowerPath.includes("/.agents/skills/") ||
+        lowerPath.includes("/.codex/skills/") ||
+        lowerPath.endsWith("/skill.md")
       ) {
         components.push(...parseSkillFile(filePath, raw));
         continue;

package/lib/inventory/dosai.js

@@ -26,6 +26,15 @@ const DOTNET_LANGUAGES = new Set([
   "cs",
   "dotnet",
   "dotnet-framework",
+  // Versioned CLI types (`-t dotnet11`): the project-type aliases map them to
+  // csharp for dispatch, but gates such as shouldCollectDosaiCrypto inspect the
+  // raw options.projectType, so the versioned spellings must resolve here too.
+  "dotnet6",
+  "dotnet7",
+  "dotnet8",
+  "dotnet9",
+  "dotnet10",
+  "dotnet11",
   "f#",
   "fsharp",
   "fs",
@@ -429,6 +438,74 @@ export function resolveComponentPurl(purl, purlAliasMap) {
   return resolveDosaiComponentPurl(purl, purlAliasMap);
 }
 
+/**
+ * Copy one dosai PackageReachability fact onto a component as properties.
+ *
+ * The occurrence/location consumers of PackageReachability read SourceLocations, EdgeIds,
+ * and NodeIds only, so dosai's Confidence, EvidenceKinds, ReachabilityKind, and
+ * ConfidenceReasons never reached the BOM: an unbuilt tree (Low confidence, unresolved
+ * evidence) was indistinguishable from a package that really is only imported. These
+ * properties carry that distinction to BOM consumers. They use the consumer-facing
+ * `cdx:dosai:reachability:*` namespace - not `internal:`, which is cdxgen's private
+ * bookkeeping namespace stripped or ignored by downstream tooling.
+ *
+ * @param {Object} component BOM component object (mutated; properties created on demand)
+ * @param {Object} reachability dosai PackageReachability entry
+ */
+export function addDosaiReachabilityProperties(component, reachability) {
+  if (!component || !reachability) {
+    return;
+  }
+  component.properties = component.properties || [];
+  const values = {
+    "cdx:dosai:reachability:kind": reachability.ReachabilityKind,
+    "cdx:dosai:reachability:confidence": reachability.Confidence,
+    "cdx:dosai:reachability:evidence": (reachability.EvidenceKinds || []).join(
+      ", ",
+    ),
+    "cdx:dosai:reachability:reasons": (
+      reachability.ConfidenceReasons || []
+    ).join(" | "),
+  };
+  for (const [name, value] of Object.entries(values)) {
+    if (!value) {
+      continue;
+    }
+    // First fact wins so a repeated enrichment pass cannot stack duplicate properties.
+    if (component.properties.some((p) => p.name === name)) {
+      continue;
+    }
+    component.properties.push({ name, value });
+  }
+}
+
+/**
+ * Attach dosai PackageReachability confidence facts to matching BOM components.
+ *
+ * @param {Object} methodsSlice Parsed dosai methods slice JSON
+ * @param {Object[]} [components] BOM components used to resolve purl aliases and mutate
+ * @returns {number} Number of distinct components enriched
+ */
+export function applyDosaiReachabilityEvidence(methodsSlice, components = []) {
+  const purlAliasMap = buildPurlAliasMap(components);
+  const componentsByPurl = new Map(
+    components
+      .filter((component) => component?.purl)
+      .map((component) => [component.purl, component]),
+  );
+  const enriched = new Set();
+  for (const reachability of methodsSlice?.PackageReachability || []) {
+    const purl = resolveComponentPurl(reachability.Purl, purlAliasMap);
+    const component = purl && componentsByPurl.get(purl);
+    if (!component) {
+      continue;
+    }
+    addDosaiReachabilityProperties(component, reachability);
+    enriched.add(component);
+  }
+  return enriched.size;
+}
+
 /**
  * Map a dosai methods slice to per-purl occurrence evidence.
  *

package/lib/inventory/envcontext.js

@@ -101,15 +101,18 @@ function hardenedGitEnv() {
  * @type {Object<string, string>}
  */
 export const SDKMAN_JAVA_TOOL_ALIASES = {
-  java8: readEnvironmentVariable("JAVA8_TOOL") || "8.0.452-amzn", // Temurin no longer offers java8 :(
-  java11: readEnvironmentVariable("JAVA11_TOOL") || "11.0.31-tem",
-  java17: readEnvironmentVariable("JAVA17_TOOL") || "17.0.19-tem",
-  java21: readEnvironmentVariable("JAVA21_TOOL") || "21.0.11-tem",
+  // Identifiers must be downloadable from the sdkman broker: the `sdk list`
+  // output advertises Temurin respin ids such as 21.0.12+1.1-tem, but the
+  // broker cannot serve ids containing '+', so the plain ids are pinned.
+  java8: readEnvironmentVariable("JAVA8_TOOL") || "8.0.504-zulu", // Temurin no longer offers java8 :(
+  java11: readEnvironmentVariable("JAVA11_TOOL") || "11.0.32-tem",
+  java17: readEnvironmentVariable("JAVA17_TOOL") || "17.0.20-tem",
+  java21: readEnvironmentVariable("JAVA21_TOOL") || "21.0.12-tem",
   java22: readEnvironmentVariable("JAVA22_TOOL") || "22.0.2-tem",
   java23: readEnvironmentVariable("JAVA23_TOOL") || "23.0.2-tem",
   java24: readEnvironmentVariable("JAVA24_TOOL") || "24.0.2-tem",
-  java25: readEnvironmentVariable("JAVA25_TOOL") || "25.0.3-tem",
-  java26: readEnvironmentVariable("JAVA26_TOOL") || "26.0.1-tem",
+  java25: readEnvironmentVariable("JAVA25_TOOL") || "25.0.4-tem",
+  java26: readEnvironmentVariable("JAVA26_TOOL") || "26.0.2-tem",
 };
 
 /**

package/lib/inventory/evidenceUtils.js

@@ -6,6 +6,7 @@ import { build } from "@cdxgen/cdx-purl";
 
 import { safeExistsSync } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
+import { addDosaiReachabilityProperties } from "./dosai.js";
 import {
   addDosaiSetValue,
   buildDosaiPurlAliasMap,
@@ -256,6 +257,7 @@ export function addEvidenceForDotnet(pkgList, slicesFile) {
   const purlLocationMap = {};
   const purlModulesMap = {};
   const purlMethodsMap = {};
+  const purlReachabilityMap = {};
   const purlAliasMap = buildDosaiPurlAliasMap(pkgList);
   for (const apkg of pkgList) {
     if (apkg.properties && Array.isArray(apkg.properties)) {
@@ -340,6 +342,9 @@ export function addEvidenceForDotnet(pkgList, slicesFile) {
         if (!modPurl) {
           continue;
         }
+        // Confidence/evidence facts for this purl, applied to the component below so an
+        // unbuilt tree stays distinguishable from an only-imported package.
+        purlReachabilityMap[modPurl] ??= reachability;
         let hasExplicitSourceLocations = false;
         for (const sourceLocation of reachability.SourceLocations || []) {
           const location = dosaiSourceLocation(sourceLocation);
@@ -456,6 +461,14 @@ export function addEvidenceForDotnet(pkgList, slicesFile) {
       "I didn't find any occurrence evidence or detailed imported modules, even though there is good dependency slice data from dosai. This is surprising.",
     );
   }
+  // Reachability confidence facts (kind, confidence, evidence, reasons) as properties.
+  // Applied outside the location guard: a Low-confidence unbuilt tree must stay
+  // distinguishable from an only-imported package even when no locations were found.
+  for (const apkg of pkgList) {
+    if (purlReachabilityMap[apkg.purl]) {
+      addDosaiReachabilityProperties(apkg, purlReachabilityMap[apkg.purl]);
+    }
+  }
   return pkgList;
 }
 

package/lib/inventory/fetchBatch.js

@@ -248,21 +248,58 @@ export async function prefetchJson(requests, options = {}) {
  * - a non-JSON `responseType`, since the envelope has nowhere to put HTML;
  * - request-specific `headers`, since cdxrs derives its own Authorization from
  *   `GITHUB_TOKEN` and would silently drop any other credential, turning an
- *   authenticated lookup into an anonymous one.
+ *   authenticated lookup into an anonymous one;
+ * - anything addressed to a host whose rate policy only one transport knows.
+ *   crates.io's crawler policy allows one request per second with no
+ *   parallelism, and package.elm-lang.org has a JS-only allowance because
+ *   rate.rs carries no row for it. Both transports keep separate gates, so a
+ *   batch split across the two would issue twice the agreed rate; the JS pool
+ *   owns these hosts so there is one gate to reason about.
  *
  * The pool applies the same global and per-host concurrency and rate policy, so
  * the batching win is unaffected; only the on-disk cache is skipped.
  *
- * @param {{responseType?: string, headers?: Object}} request
+ * @param {{url?: string, responseType?: string, headers?: Object}} request
  * @returns {boolean}
  */
 function cdxrsCanServe(request) {
   if (request.responseType && request.responseType !== "json") {
     return false;
   }
+  if (isSingleGateHost(extractHost(request.url))) {
+    return false;
+  }
   return !request.headers || !Object.keys(request.headers).length;
 }
 
+/**
+ * Whether a hostname belongs to crates.io, including its index and CDN hosts.
+ *
+ * @param {string|null} host Hostname, or null when the URL did not parse.
+ * @returns {boolean}
+ */
+export function isCratesHost(host) {
+  if (!host) {
+    return false;
+  }
+  const lower = host.toLowerCase();
+  return lower === "crates.io" || lower.endsWith(".crates.io");
+}
+
+/**
+ * Whether a host's rate policy lives in the JS table alone and therefore needs
+ * every request to pass through the one gate the JS pool holds.
+ *
+ * @param {string|null} host Hostname, or null when the URL did not parse.
+ * @returns {boolean}
+ */
+export function isSingleGateHost(host) {
+  if (!host) {
+    return false;
+  }
+  return isCratesHost(host) || host.toLowerCase() === "package.elm-lang.org";
+}
+
 /**
  * Run the batch through the `cdxrs fetch` subprocess and translate its
  * envelope into the shared result shape.
@@ -700,6 +737,41 @@ async function fetchOne(request, gauge) {
   }
 }
 
+/**
+ * Run a caller's own request under the same per-host gate the batch pool uses.
+ *
+ * Not every registry lookup goes through the pool: a caller that misses the
+ * prefetch, or runs with prefetching disabled, issues `cdxgenAgent.get`
+ * directly. Those requests reach the same host and count against the same
+ * published budget, so they have to queue behind the same limiter rather than
+ * a second one — crates.io's one-request-per-second policy is not honoured by
+ * two independent gates that each allow one per second.
+ *
+ * The per-host semaphore and limiter are module state, so this shares one gate
+ * per host for the life of the process.
+ *
+ * @template T
+ * @param {string} url The URL about to be requested.
+ * @param {() => Promise<T>} issue Issues the request and resolves its result.
+ * @returns {Promise<T>} Whatever `issue` resolves to.
+ */
+export async function withHostRateLimit(url, issue) {
+  const host = extractHost(url);
+  if (!host) {
+    return await issue();
+  }
+  const controls = getHostControls(host);
+  const releaseGlobal = await _globalSemaphore.acquire();
+  const releaseHost = await controls.sem.acquire();
+  try {
+    await controls.limiter.wait();
+    return await issue();
+  } finally {
+    releaseHost();
+    releaseGlobal();
+  }
+}
+
 /**
  * Dedupe key for an in-flight request: the URL, plus everything that changes
  * which response the caller gets back. That is the headers which change what