@cdxgen/cdxgen 13.2.0 → 13.4.0

package/lib/evinser/evinser.js

@@ -15,6 +15,11 @@ import {
   safeRmSync,
   safeWriteSync,
 } from "../core/fs.js";
+import { hasCppSources } from "../ecosystems/cppEvidence.js";
+import {
+  createIncludeAttributor,
+  parseCIncludeSlices,
+} from "../ecosystems/cppIncludeResolver.js";
 import {
   analyzeGolemProject,
   collectGolemEvidence,
@@ -40,14 +45,27 @@ import {
   isRusiRustLanguage,
 } from "../ecosystems/rusi.js";
 import {
+  analyzeScalaProject,
+  collectScalasemApiEndpoints,
+  collectScalasemEvidence,
+  collectScalasemServices,
+  isScalasemLanguage,
+} from "../ecosystems/scalasem.js";
+import {
+  atomCompileCommandsArgs,
   buildAtomCommandEnv,
   executeAtom,
   filterAtomSlicesByExcludePatterns,
+  readReachablesSlices,
+  readSlicesFile,
+  removeReachablesChunkFiles,
 } from "../inventory/atomUtils.js";
+import { isCycloneDxComponentTypeEnabled } from "../inventory/bomUtils.js";
 import {
   collectDosaiCryptoComponents,
   findCryptoAlgos,
 } from "../inventory/cbomutils.js";
+import { cmakeBuildDirCandidates } from "../inventory/cmakeBuildDirs.js";
 import { collectMvnDependencies } from "../inventory/deps.js";
 import { mergeServices } from "../inventory/depsUtils.js";
 import {
@@ -59,12 +77,16 @@ import {
   collectDosaiServicesFromMethods,
   createDosaiDataFlowSlice,
   createDosaiMethodsSlice,
+  dosaiRunWasStopped,
   isDosaiDotnetLanguage,
   normalizeDosaiServiceMap,
   persistDosaiSemanticsReport,
+  readDosaiDataFlowReport,
+  readDosaiMethodsReport,
 } from "../inventory/dosai.js";
 import { parseOccurrenceEvidenceLocation } from "../inventory/evidenceUtils.js";
 import { executeOsQuery } from "../managers/binary.js";
+import { MAX_JSON_TEXT_BYTES, readJsonFile } from "../parsers/largeJson.js";
 import { postProcess } from "../stages/postgen/postgen.js";
 import { createOrLoad } from "./db.js";
 import { findPurlLocations } from "./scalasem.js";
@@ -96,10 +118,175 @@ function appendComponentProperties(component, properties = []) {
   }
 }
 
+/**
+ * Merges one analyzer run's metadata properties into the BOM's metadata
+ * component. Analyzer metadata describes a single run, so when the input BOM
+ * already carries facts from an earlier run (cdxgen --profile research, then
+ * evinse), everything under the analyzer's own `cdx:<analyzer>:` prefix is
+ * replaced. Replacing by exact name would keep facts the new run no longer
+ * emits, such as a cdx:rusi:requestedBackend left from a fallback run.
+ *
+ * @param {Object} component Metadata component to update in place
+ * @param {Object[]} metadataProperties Properties from the analyzer run
+ */
+export function mergeAnalyzerMetadataProperties(
+  component,
+  metadataProperties = [],
+) {
+  if (!component || !metadataProperties.length) {
+    return;
+  }
+  if (component.properties?.length) {
+    const analyzerPrefixes = [
+      ...new Set(
+        metadataProperties
+          .map((p) => /^cdx:[^:]+:/.exec(p.name)?.[0])
+          .filter(Boolean),
+      ),
+    ];
+    component.properties = component.properties.filter(
+      (p) => !analyzerPrefixes.some((prefix) => p.name?.startsWith(prefix)),
+    );
+  }
+  appendComponentProperties(component, metadataProperties);
+}
+
 function filterAtomSliceData(sliceData, options = {}) {
   return filterAtomSlicesByExcludePatterns(sliceData, options.exclude);
 }
 
+/**
+ * The project type whose evidence a package URL type belongs to. Generic
+ * purls are left out because many collectors use that type; they count as C
+ * only when the tree holds C or C++ sources.
+ */
+const EVIDENCE_LANGUAGE_BY_PURL_TYPE = {
+  cargo: "rust",
+  cocoapods: "swift",
+  composer: "php",
+  conan: "c",
+  gem: "ruby",
+  golang: "go",
+  maven: "java",
+  npm: "js",
+  nuget: "csharp",
+  pypi: "python",
+  swift: "swift",
+};
+
+/**
+ * The evidence language of a `cdxgen --evidence` run that names no project
+ * type.
+ *
+ * A directory with a Scala build takes the scalasem path. Otherwise the
+ * generated BOM decides: Java when it lists Maven packages, as before, and
+ * else the language most of its packages belong to. A BOM with no package in
+ * a language the evidence step analyses gives no language, so no analyzer
+ * runs over sources it cannot read.
+ *
+ * @param {string} dirPath Project directory
+ * @param {Object} [bomJson] The BOM generated for the directory
+ * @param {Object} [options] CLI options, for the exclude patterns
+ * @returns {string|undefined} Project type for the evidence phase
+ */
+export function defaultEvidenceLanguage(dirPath, bomJson, options = {}) {
+  const scalaBuildFiles = [
+    "build.sbt",
+    "build.sc",
+    "build.mill",
+    "project.scala",
+  ];
+  if (
+    scalaBuildFiles.some((file) => safeExistsSync(join(dirPath || ".", file)))
+  ) {
+    return "scala";
+  }
+  const counts = new Map();
+  let cppSources;
+  for (const component of bomJson?.components || []) {
+    const purl = `${component?.purl || ""}`;
+    if (!purl.startsWith("pkg:") || !purl.includes("/")) {
+      continue;
+    }
+    const purlType = purl.slice(4, purl.indexOf("/")).toLowerCase();
+    let language = EVIDENCE_LANGUAGE_BY_PURL_TYPE[purlType];
+    if (!language && purlType === "generic") {
+      cppSources ??= hasCppSources(dirPath || ".", options);
+      language = cppSources ? "c" : undefined;
+    }
+    if (language) {
+      counts.set(language, (counts.get(language) || 0) + 1);
+    }
+  }
+  if (counts.has("java")) {
+    return "java";
+  }
+  let chosen;
+  for (const [language, count] of counts) {
+    if (!chosen || count > counts.get(chosen)) {
+      chosen = language;
+    }
+  }
+  return chosen;
+}
+
+/**
+ * Build the options for the evinse phase (prepareDB, analyzeProject, and
+ * createEvinseFile) from the cdxgen CLI options.
+ *
+ * This object used to be assembled inline in bin/cdxgen.js, which dropped
+ * fields the analyzers read - most notably `exclude`, so every dosai and atom
+ * run triggered by `--evidence` ignored the user's `--exclude` patterns. Keep
+ * the wiring in one place so the forwarded fields stay testable.
+ *
+ * @param {Object} options CLI options
+ * @param {Object} args Parsed CLI arguments; `args._[0]` is the source directory
+ * @param {string} input Path of the BOM file the evinse phase enriches
+ * @returns {Object} Options for prepareDB, analyzeProject, and createEvinseFile
+ */
+export function buildEvinseOptions(options, args, input) {
+  const sourceDir = args._?.[0] || ".";
+  return {
+    _: args._,
+    input,
+    output: options.evinseOutput,
+    language: options.projectType,
+    skipMavenCollector: false,
+    force: false,
+    withReachables: options.deep,
+    usagesSlicesFile: options.usagesSlicesFile,
+    dataFlowSlicesFile: options.dataFlowSlicesFile,
+    reachablesSlicesFile: options.reachablesSlicesFile,
+    semanticsSlicesFile: options.semanticsSlicesFile,
+    openapiSpecFile: options.openapiSpecFile,
+    componentType: options.componentType,
+    includeCrypto:
+      options.includeCrypto &&
+      isCycloneDxComponentTypeEnabled("cryptographic-asset", options),
+    specVersion: options.specVersion,
+    profile: options.profile,
+    jsonPretty: options.jsonPretty,
+    exclude: options.exclude,
+    // Forwarded so a failed rusi/golem run can claim the --fail-on-error exit
+    // instead of degrading the reachability evidence in silence.
+    failOnError: options.failOnError,
+    // The scala analyzer reads these: a command override, the test-source
+    // switch and the install policy that decides whether builds may run.
+    scalasemCommand: options.scalasemCommand,
+    scalasemIncludeTests: options.scalasemIncludeTests,
+    scalasem: options.scalasem,
+    installDeps: options.installDeps,
+    requiredOnly: options.requiredOnly,
+    // --deep publishes the namespaces the Scala classpath join reads.
+    scalasemNamespaces: options.deep,
+    // Absolute path of the deps slice createCsharpBom writes for --deep runs,
+    // so analyzeProject can reuse it instead of rerunning dosai methods.
+    depsSlicesFile: options.depsSlicesFile
+      ? resolve(sourceDir, options.depsSlicesFile)
+      : undefined,
+  };
+}
+
 /**
  * Function to create the db for the libraries referred in the sbom.
  *
@@ -153,7 +340,7 @@ export async function prepareDB(options) {
       await catalogMavenDeps(dirPath, purlsJars, Namespaces, options);
     }
     if (gradleFiles?.length) {
-      await catalogGradleDeps(dirPath, purlsJars, Namespaces);
+      await catalogGradleDeps(dirPath, purlsJars, Namespaces, options);
     }
   }
   for (const purl of Object.keys(purlsToSlice)) {
@@ -162,11 +349,42 @@ export async function prepareDB(options) {
   return { sequelize, Namespaces, Usages, DataFlows };
 }
 
+/**
+ * Read the jar namespace map cdxgen writes next to the BOM it generates
+ * (`<bom>.map`). The map for the BOM passed as `--input` is preferred; a
+ * `bom.json.map` in the project directory is the fallback.
+ *
+ * @param {string} dirPath Project directory scanned by evinse
+ * @param {Object} [options] CLI options, for `input`
+ * @returns {Object|undefined} The mapping, when a non-empty one exists.
+ */
+export function readNamespaceMap(dirPath, options = {}) {
+  const candidates = [
+    options?.input ? `${options.input}.map` : undefined,
+    join(dirPath, "bom.json.map"),
+  ];
+  for (const mapFile of candidates) {
+    if (!mapFile || !safeExistsSync(mapFile)) {
+      continue;
+    }
+    try {
+      const mapData = JSON.parse(fs.readFileSync(mapFile, "utf-8"));
+      if (mapData && Object.keys(mapData).length) {
+        return mapData;
+      }
+    } catch (_err) {
+      // An unreadable map is the same as no map.
+    }
+  }
+  return undefined;
+}
+
 /**
  * Collect Maven jar namespace mappings for the purls found in the SBOM.
  *
- * If a previously generated `bom.json.map` is present in `dirPath` it is reused;
- * otherwise the maven command is invoked to collect the jar dependencies. Each
+ * If cdxgen left a namespace map next to the BOM (see {@link readNamespaceMap})
+ * it is reused; otherwise the maven command is invoked to collect the jar
+ * dependencies. Each
  * resolved purl is recorded in the `purlsJars` map and persisted in the
  * `Namespaces` model.
  *
@@ -182,19 +400,7 @@ export async function catalogMavenDeps(
   Namespaces,
   options = {},
 ) {
-  let jarNSMapping;
-  if (safeExistsSync(join(dirPath, "bom.json.map"))) {
-    try {
-      const mapData = JSON.parse(
-        fs.readFileSync(join(dirPath, "bom.json.map"), "utf-8"),
-      );
-      if (mapData && Object.keys(mapData).length) {
-        jarNSMapping = mapData;
-      }
-    } catch (_err) {
-      // ignore
-    }
-  }
+  let jarNSMapping = readNamespaceMap(dirPath, options);
   if (!jarNSMapping) {
     console.log("About to collect jar dependencies for the path", dirPath);
     const mavenCmd = getMavenCommand(dirPath, dirPath);
@@ -238,18 +444,28 @@ export async function catalogMavenDeps(
  * @param {Object} Namespaces Sequelize-like Namespaces model used to persist pom and namespaces
  * @returns {Promise<void>}
  */
-export async function catalogGradleDeps(dirPath, purlsJars, Namespaces) {
-  console.log(
-    "About to collect jar dependencies from the gradle cache. This would take a while ...",
-  );
-  const gradleCmd = getGradleCommand(dirPath, dirPath);
-  // collect all jars including from the cache if data-flow mode is enabled
-  const jarNSMapping = await collectGradleDependencies(
-    gradleCmd,
-    dirPath,
-    false,
-    true,
-  );
+export async function catalogGradleDeps(
+  dirPath,
+  purlsJars,
+  Namespaces,
+  options = {},
+) {
+  // The map cdxgen wrote next to the BOM already holds the namespaces; the
+  // Gradle cache is walked only without it.
+  let jarNSMapping = readNamespaceMap(dirPath, options);
+  if (!jarNSMapping) {
+    console.log(
+      "About to collect jar dependencies from the gradle cache. This would take a while ...",
+    );
+    const gradleCmd = getGradleCommand(dirPath, dirPath);
+    // collect all jars including from the cache if data-flow mode is enabled
+    jarNSMapping = await collectGradleDependencies(
+      gradleCmd,
+      dirPath,
+      false,
+      true,
+    );
+  }
   if (jarNSMapping) {
     for (const purl of Object.keys(jarNSMapping)) {
       purlsJars[purl] = jarNSMapping[purl].jarFile;
@@ -429,7 +645,9 @@ export async function createSlice(
             resolve(slicesFile),
             options,
           );
-    if (!sliceResult) {
+    // A stopped run has already said why; it says nothing about whether the
+    // project is supported (issue 4438).
+    if (!sliceResult && !dosaiRunWasStopped(resolve(slicesFile))) {
       console.warn(
         `Unable to generate ${sliceType} slice using dosai. Check if this is a supported .NET project.`,
       );
@@ -444,6 +662,11 @@ export async function createSlice(
     `Creating ${sliceType} slice for ${resolve(filePath)}. Please wait ...`,
   );
   const atomFile = join(sliceOutputDir, `${language}-app.atom`);
+  if (sliceType === "reachables") {
+    // atom writes reachables in numbered chunks next to the slices file; one
+    // left by an earlier run must not be read back as part of this one.
+    removeReachablesChunkFiles(slicesFile);
+  }
   let args = [sliceType];
   // Support for crypto slices aka CBOM
   if (sliceType === "reachables" && options.includeCrypto) {
@@ -461,15 +684,9 @@ export async function createSlice(
         "Use an official cdxgen container image to improve the precision of endpoints detection (for SaaSBOM).",
       );
     }
-    if (["ruby", "scala"].includes(language)) {
+    if (language === "ruby") {
       args.push("--remove-atom");
     }
-    if (["scala"].includes(language)) {
-      semanticsSlicesFile = join(
-        sliceOutputDir,
-        basename(options.semanticsSlicesFile || "semantics.slices.json"),
-      );
-    }
   }
   args = args.concat([
     "-l",
@@ -488,6 +705,7 @@ export async function createSlice(
     args.push("--slice-depth");
     args.push(readEnvironmentVariable("ATOM_SLICE_DEPTH"));
   }
+  args.push(...atomCompileCommandsArgs(filePath, language, options));
   args.push(resolve(filePath));
   const atomExcludeEnv = buildAtomCommandEnv(options, language);
   // Execute atom
@@ -540,15 +758,6 @@ export async function createSlice(
       `openapi spec file "${join(filePath, openapiSpecFile)}" was not generated successfully. Check if atom-tools pypi package is installed and available in PATH.`,
     );
   }
-  if (
-    ["scala"].includes(language) &&
-    sliceType === "usages" &&
-    !safeExistsSync(semanticsSlicesFile)
-  ) {
-    console.log(
-      `Semantics slices file "${semanticsSlicesFile}" was not generated successfully. Try running atom cli in Java mode.`,
-    );
-  }
   return {
     tempDir: sliceOutputDir,
     tempDirOwned,
@@ -598,8 +807,9 @@ export function purlToLanguage(purl, filePath) {
  * Seed purl-location and import maps from SBOM component evidence.
  *
  * Walks the supplied components reading `internal:ImportedModules` (or
- * `internal:Namespaces` for php/ruby) and `evidence.occurrences` properties
- * to construct lookup maps used during slice analysis.
+ * `internal:Namespaces` for php/ruby, plus the `internal:ImportedSymbols` the
+ * C/C++ collector records) and `evidence.occurrences` properties to construct
+ * lookup maps used during slice analysis.
  *
  * @param {Object[]} components CycloneDX components from the input SBOM
  * @param {string} language Application language used to select the import property name
@@ -624,6 +834,18 @@ export function initFromSbom(components, language) {
         .forEach((v) => {
           purlImportsMap[comp.purl] = (v.value || "").split(",");
         });
+      // A C/C++ component records the symbols the project uses from it, which
+      // are what C usages are matched against. The list is pipe-separated:
+      // C++ symbols may contain commas.
+      if (["c", "cpp", "c++"].includes(language)) {
+        (comp.properties || [])
+          .filter((v) => v.name === "internal:ImportedSymbols")
+          .forEach((v) => {
+            purlImportsMap[comp.purl] = (
+              purlImportsMap[comp.purl] || []
+            ).concat((v.value || "").split("|").filter(Boolean));
+          });
+      }
     }
     if (comp.evidence.occurrences) {
       // Keep the `location#line` shape so a re-run over a cdxgen BOM does not
@@ -654,6 +876,273 @@ function usableSlicesFile(slicesFile) {
   return fileSizeInBytes > 1024;
 }
 
+/**
+ * Load a semantics slices file for reuse when it belongs to this project.
+ *
+ * `--semantics-slices-file` defaults to `semantics.slices.json` in the working
+ * directory, which is shared by every project scanned from there and also
+ * receives the reports of other analyzers (dosai, rusi, golem). A file is
+ * only reused when its shape matches the language. Swift slices must also
+ * describe the same project directory and must not predate the input SBOM:
+ * `cdxgen --evidence` writes a fresh SBOM before evinse runs, so an older
+ * slice was made from an earlier state of the sources and is regenerated.
+ * Scala reports are handled by the scalasem analyzer, which applies its own
+ * rules.
+ *
+ * @param {string} language Project language
+ * @param {string} slicesFile Candidate semantics slices file
+ * @param {string} bomFile Input SBOM
+ * @param {string} dirPath Project directory
+ * @returns {undefined|Object} Parsed slice when it can be reused
+ */
+export function loadReusableSemanticsSlice(
+  language,
+  slicesFile,
+  bomFile,
+  dirPath,
+) {
+  if (!usableSlicesFile(slicesFile)) {
+    return undefined;
+  }
+  let parsed;
+  try {
+    parsed = readJsonFile(slicesFile);
+  } catch (_e) {
+    return undefined;
+  }
+  if (!parsed || typeof parsed !== "object") {
+    return undefined;
+  }
+  if (!PROJECT_TYPE_ALIASES.swift.includes(language)) {
+    return undefined;
+  }
+  if (!(parsed.fileIndexes || parsed.buildSymbols || parsed.moduleInfos)) {
+    return undefined;
+  }
+  if (parsed.projectPath && resolve(parsed.projectPath) !== resolve(dirPath)) {
+    return undefined;
+  }
+  try {
+    if (fs.statSync(slicesFile).mtimeMs < fs.statSync(bomFile).mtimeMs) {
+      return undefined;
+    }
+  } catch (_e) {
+    // Without timestamps the shape and project checks decide
+  }
+  return parsed;
+}
+
+/**
+ * The Scala evidence path: scalasem only, never atom. The branch returns
+ * early for every entry point (evinse, --evidence, cbom, saasbom) and every
+ * Scala project type, so no usages, reachables, data-flow or atom-run
+ * scalasem happens here. Slices the user passes are still read: a version 1
+ * semantics slice keeps its usedTypes join, usages and reachables slices
+ * keep their own evidence, and an OpenAPI spec keeps its services.
+ *
+ * @param {string} language Project language, normalized to `scala`.
+ * @param {string} dirPath Project directory.
+ * @param {Object} options Command line options.
+ * @param {Object} bomJson Parsed input SBOM.
+ * @param {Object[]} components Components of the input SBOM.
+ * @param {Object} purlLocationMap Occurrences seeded from the input SBOM.
+ * @param {Object} purlImportsMap Imports seeded from the input SBOM.
+ * @param {Object} dbObjMap The evinse database objects.
+ * @returns {Promise<Object>} Slice artefacts for `createEvinseFile`.
+ */
+async function analyzeScalaEvidenceProject(
+  language,
+  dirPath,
+  options,
+  bomJson,
+  components,
+  purlLocationMap,
+  purlImportsMap,
+  dbObjMap,
+) {
+  let servicesMap = {};
+  const dataFlowFrames = {};
+  let componentPropertiesMap = {};
+  let metadataProperties = [];
+  let cryptoComponents = [];
+  const cryptoGeneratePurls = {};
+  const mergeLocations = (locationMap) => {
+    for (const [purl, locations] of Object.entries(locationMap || {})) {
+      purlLocationMap[purl] ??= new Set();
+      for (const location of locations) {
+        purlLocationMap[purl].add(location);
+      }
+    }
+  };
+  const mergeFrames = (framesMap) => {
+    for (const [purl, stacks] of Object.entries(framesMap || {})) {
+      dataFlowFrames[purl] = [...(dataFlowFrames[purl] || []), ...stacks];
+    }
+  };
+  const mergeProvides = (providesMap) => {
+    for (const [purl, refs] of Object.entries(providesMap || {})) {
+      cryptoGeneratePurls[purl] ??= new Set();
+      for (const ref of refs || []) {
+        cryptoGeneratePurls[purl].add(ref);
+      }
+    }
+  };
+  const analysis = analyzeScalaProject(dirPath, options);
+  if (analysis?.report) {
+    const evidence = await collectScalasemEvidence(
+      analysis.report,
+      [bomJson.metadata?.component, ...components].filter(Boolean),
+      { ...options, scalaNamespaceMap: readNamespaceMap(dirPath, options) },
+    );
+    mergeLocations(evidence.purlLocationMap);
+    mergeFrames(evidence.dataFlowFrames);
+    mergeProvides(evidence.cryptoGeneratePurls);
+    componentPropertiesMap = evidence.componentPropertiesMap;
+    cryptoComponents = evidence.cryptoComponents;
+    metadataProperties = evidence.metadataProperties;
+    servicesMap = collectScalasemServices(analysis.report, servicesMap);
+    servicesMap = collectScalasemApiEndpoints(analysis.report, servicesMap);
+  }
+  if (analysis?.metadataProperties?.length) {
+    for (const property of analysis.metadataProperties) {
+      if (
+        !metadataProperties.some(
+          (known) =>
+            known.name === property.name && known.value === property.value,
+        )
+      ) {
+        metadataProperties.push(property);
+      }
+    }
+  }
+  // A version 1 semantics slice still goes through the usedTypes join, merged
+  // with the report evidence rather than replacing it.
+  if (analysis?.v1Slice) {
+    mergeLocations(
+      findPurlLocations(components, analysis.v1Slice).purlLocationMap,
+    );
+  }
+  // Usages and reachables slices the user made, with atom or otherwise, are
+  // read as they are for any other language; none is ever generated here.
+  let usagesSlicesFile;
+  let reachablesSlicesFile;
+  if (
+    (options.withReachables || options.includeCrypto) &&
+    usableSlicesFile(options.reachablesSlicesFile)
+  ) {
+    reachablesSlicesFile = options.reachablesSlicesFile;
+    const reachables = collectReachableFrames(
+      language,
+      filterAtomSliceData(readReachablesSlices(reachablesSlicesFile), options),
+    );
+    mergeFrames(reachables.dataFlowFrames);
+    mergeProvides(reachables.cryptoGeneratePurls);
+    const knownRefs = new Set(
+      cryptoComponents.map((asset) => asset["bom-ref"]),
+    );
+    cryptoComponents = cryptoComponents.concat(
+      (reachables.cryptoComponents || []).filter(
+        (asset) => !knownRefs.has(asset["bom-ref"]),
+      ),
+    );
+  }
+  let userDefinedTypesMap = {};
+  if (usableSlicesFile(options.usagesSlicesFile)) {
+    usagesSlicesFile = options.usagesSlicesFile;
+    const usageSlice = filterAtomSliceData(
+      readSlicesFile(usagesSlicesFile, "usages"),
+      options,
+    );
+    if (usageSlice && Object.keys(usageSlice).length) {
+      const retMap = await parseObjectSlices(
+        language,
+        usageSlice,
+        dbObjMap,
+        servicesMap,
+        purlLocationMap,
+        purlImportsMap,
+      );
+      servicesMap = retMap.servicesMap || servicesMap;
+      userDefinedTypesMap = retMap.userDefinedTypesMap || {};
+    }
+  }
+  // An OpenAPI spec the user has (atom-tools' conversion of this report, or
+  // the project's own) adds its routes to the report's: a route both name is
+  // one service.
+  const openapiSpecFile = options.openapiSpecFile
+    ? resolve(dirPath, options.openapiSpecFile)
+    : undefined;
+  if (openapiSpecFile && safeExistsSync(openapiSpecFile)) {
+    const openapiServices = {};
+    detectServicesFromOpenAPI(language, openapiSpecFile, openapiServices);
+    mergeServiceDefinitions(servicesMap, openapiServices);
+  }
+  // A BOM without a project component still needs somewhere for the run's
+  // metadata properties to live; a nameless entry would explain nothing.
+  let workspaceComponent;
+  if (!bomJson.metadata?.component) {
+    workspaceComponent = {
+      type: "application",
+      name: basename(resolve(dirPath)),
+    };
+  }
+  return {
+    purlLocationMap,
+    servicesMap,
+    dataFlowFrames,
+    componentPropertiesMap,
+    metadataProperties,
+    cryptoComponents,
+    cryptoGeneratePurls,
+    usagesSlicesFile,
+    reachablesSlicesFile,
+    semanticsSlicesFile: analysis?.reportFile,
+    userDefinedTypesMap,
+    workspaceComponent,
+  };
+}
+
+/**
+ * Merge service definitions into a services map: endpoints join, and a
+ * property another source already carries is not added again, whatever the
+ * case of an HTTP method.
+ *
+ * @param {Object} target Services map that receives the definitions.
+ * @param {Object} source Services map to merge in.
+ * @returns {Object} The target map.
+ */
+export function mergeServiceDefinitions(target, source) {
+  const sameProperty = (left, right) =>
+    left.name === right.name &&
+    (left.name === "cdx:service:httpMethod"
+      ? String(left.value).toUpperCase() === String(right.value).toUpperCase()
+      : left.value === right.value);
+  for (const [name, definition] of Object.entries(source || {})) {
+    const existing = target[name];
+    if (!existing) {
+      target[name] = definition;
+      continue;
+    }
+    existing.endpoints ??= new Set();
+    for (const endpoint of definition.endpoints || []) {
+      existing.endpoints.add(endpoint);
+    }
+    existing.properties ??= [];
+    for (const property of definition.properties || []) {
+      if (!existing.properties.some((known) => sameProperty(known, property))) {
+        existing.properties.push(property);
+      }
+    }
+    if (definition.authenticated) {
+      existing.authenticated = true;
+    }
+    if (definition.xTrustBoundary) {
+      existing.xTrustBoundary = true;
+    }
+  }
+  return target;
+}
+
 /**
  * Function to analyze the project
  *
@@ -663,7 +1152,12 @@ function usableSlicesFile(slicesFile) {
 export async function analyzeProject(dbObjMap, options) {
   const dirPath = options._[0] || ".";
   const languages = options.language;
-  const language = Array.isArray(languages) ? languages[0] : languages;
+  let language = Array.isArray(languages) ? languages[0] : languages;
+  // cdxgen --evidence forwards the raw project type, so -t sbt, -t mill and
+  // -t scala3 must be normalized once to behave like -l scala everywhere.
+  if (PROJECT_TYPE_ALIASES.scala.includes(language)) {
+    language = "scala";
+  }
   let usageSlice;
   let dataFlowSlice;
   let reachablesSlice;
@@ -817,6 +1311,19 @@ export async function analyzeProject(dbObjMap, options) {
     };
   }
 
+  if (isScalasemLanguage(language)) {
+    return analyzeScalaEvidenceProject(
+      language,
+      dirPath,
+      options,
+      bomJson,
+      components,
+      purlLocationMap,
+      purlImportsMap,
+      dbObjMap,
+    );
+  }
+
   if (isDosaiDotnetLanguage(language)) {
     if (options.profile === "research") {
       options.withDataFlow = true;
@@ -826,23 +1333,38 @@ export async function analyzeProject(dbObjMap, options) {
       options.usagesSlicesFile &&
       usableSlicesFile(options.usagesSlicesFile)
     ) {
-      usageSlice = JSON.parse(
-        fs.readFileSync(options.usagesSlicesFile, "utf-8"),
-      );
+      usageSlice = readDosaiMethodsReport(options.usagesSlicesFile);
       usagesSlicesFile = options.usagesSlicesFile;
+    } else if (usableSlicesFile(options.depsSlicesFile)) {
+      // createCsharpBom already ran dosai methods on this tree for --deep runs
+      // and wrote the deps slice. For dosai, that output IS the usages slice,
+      // so reuse it instead of invoking dosai a second time.
+      if (DEBUG_MODE) {
+        console.log(
+          `Reusing the dosai deps slices file "${options.depsSlicesFile}" for the usages analysis.`,
+        );
+      }
+      usageSlice = readDosaiMethodsReport(options.depsSlicesFile);
+      usagesSlicesFile = options.depsSlicesFile;
     } else {
       retMap = await createSlice(language, dirPath, "usages", options);
       if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
-        usageSlice = JSON.parse(fs.readFileSync(retMap.slicesFile, "utf-8"));
+        usageSlice = readDosaiMethodsReport(retMap.slicesFile);
         usagesSlicesFile = retMap.slicesFile;
       }
     }
     if (usageSlice && Object.keys(usageSlice).length) {
-      const dosaiEvidence = collectDosaiPurlEvidence(usageSlice, components);
+      // dosai locations are relative to the analyzed directory; a package the
+      // BOM holds in several versions is matched by the project of the file.
+      const dosaiEvidence = collectDosaiPurlEvidence(usageSlice, components, {
+        srcPath: resolve(dirPath),
+      });
       // Confidence/evidence facts ride along as properties so an unbuilt tree (Low
       // confidence, unresolved evidence) stays distinguishable from an only-imported
       // package in the emitted BOM.
-      applyDosaiReachabilityEvidence(usageSlice, components);
+      applyDosaiReachabilityEvidence(usageSlice, components, {
+        srcPath: resolve(dirPath),
+      });
       for (const [purl, locations] of Object.entries(
         dosaiEvidence.purlLocationMap,
       )) {
@@ -867,20 +1389,18 @@ export async function analyzeProject(dbObjMap, options) {
         safeExistsSync(options.dataFlowSlicesFile)
       ) {
         dataFlowSlicesFile = options.dataFlowSlicesFile;
-        dataFlowSlice = JSON.parse(
-          fs.readFileSync(options.dataFlowSlicesFile, "utf-8"),
-        );
+        dataFlowSlice = readDosaiDataFlowReport(options.dataFlowSlicesFile);
       } else {
         retMap = await createSlice(language, dirPath, "data-flow", options);
         if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
           dataFlowSlicesFile = retMap.slicesFile;
-          dataFlowSlice = JSON.parse(
-            fs.readFileSync(retMap.slicesFile, "utf-8"),
-          );
+          dataFlowSlice = readDosaiDataFlowReport(retMap.slicesFile);
         }
       }
       if (dataFlowSlice && Object.keys(dataFlowSlice).length) {
-        dataFlowFrames = collectDosaiDataFlowFrames(dataFlowSlice, components);
+        dataFlowFrames = collectDosaiDataFlowFrames(dataFlowSlice, components, {
+          srcPath: resolve(dirPath),
+        });
       }
     }
     if (options.includeCrypto) {
@@ -923,7 +1443,7 @@ export async function analyzeProject(dbObjMap, options) {
     ) {
       reachablesSlicesFile = options.reachablesSlicesFile;
       reachablesSlice = filterAtomSliceData(
-        JSON.parse(fs.readFileSync(options.reachablesSlicesFile, "utf-8")),
+        readReachablesSlices(options.reachablesSlicesFile),
         options,
       );
     } else {
@@ -931,7 +1451,7 @@ export async function analyzeProject(dbObjMap, options) {
       if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
         reachablesSlicesFile = retMap.slicesFile;
         reachablesSlice = filterAtomSliceData(
-          JSON.parse(fs.readFileSync(retMap.slicesFile, "utf-8")),
+          readReachablesSlices(retMap.slicesFile),
           options,
         );
       }
@@ -947,7 +1467,7 @@ export async function analyzeProject(dbObjMap, options) {
   // Reuse existing usages slices
   if (options.usagesSlicesFile && usableSlicesFile(options.usagesSlicesFile)) {
     usageSlice = filterAtomSliceData(
-      JSON.parse(fs.readFileSync(options.usagesSlicesFile, "utf-8")),
+      readSlicesFile(options.usagesSlicesFile, "usages"),
       options,
     );
     usagesSlicesFile = options.usagesSlicesFile;
@@ -956,7 +1476,7 @@ export async function analyzeProject(dbObjMap, options) {
     retMap = await createSlice(language, dirPath, "usages", options);
     if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
       usageSlice = filterAtomSliceData(
-        JSON.parse(fs.readFileSync(retMap.slicesFile, "utf-8")),
+        readSlicesFile(retMap.slicesFile, "usages"),
         options,
       );
       usagesSlicesFile = retMap.slicesFile;
@@ -976,31 +1496,48 @@ export async function analyzeProject(dbObjMap, options) {
     }
   }
   // Support for semantics slicing
-  if (
-    (PROJECT_TYPE_ALIASES.swift.includes(language) ||
-      PROJECT_TYPE_ALIASES.scala.includes(language)) &&
-    components.length
-  ) {
-    // Reuse existing semantics slices for swift and scala
-    if (
-      options.semanticsSlicesFile &&
-      safeExistsSync(options.semanticsSlicesFile)
-    ) {
-      semanticsSlice = JSON.parse(
-        fs.readFileSync(options.semanticsSlicesFile, "utf-8"),
-      );
+  if (PROJECT_TYPE_ALIASES.swift.includes(language) && components.length) {
+    // Reuse existing semantics slices for swift
+    const reusableSlice = loadReusableSemanticsSlice(
+      language,
+      options.semanticsSlicesFile,
+      bomFile,
+      dirPath,
+    );
+    if (reusableSlice) {
+      semanticsSlice = reusableSlice;
       semanticsSlicesFile = options.semanticsSlicesFile;
-    } else if (PROJECT_TYPE_ALIASES.swift.includes(language)) {
+    } else {
       // Generate our own slices for swift
       retMap = await createSlice(language, dirPath, "semantics", options);
       if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
-        semanticsSlice = JSON.parse(
-          fs.readFileSync(retMap.slicesFile, "utf-8"),
-        );
+        semanticsSlice = readSlicesFile(retMap.slicesFile, "semantics");
         semanticsSlicesFile = retMap.slicesFile;
       }
     }
   }
+  let cIncludeLocations = new Map();
+  // A C/C++ include names the file it resolved to and the functions the
+  // including file calls from it (atom 4 and later): those functions are the
+  // usages of the component that provides the file
+  if (
+    ["c", "cpp", "c++"].includes(language) &&
+    usageSlice &&
+    Object.keys(usageSlice).length
+  ) {
+    const attributed = attributeCIncludes(
+      usageSlice,
+      components,
+      dirPath,
+      options,
+    );
+    for (const [purl, names] of attributed.symbols) {
+      purlImportsMap[purl] = Array.from(
+        new Set([...(purlImportsMap[purl] || []), ...names]),
+      );
+    }
+    cIncludeLocations = attributed.locations;
+  }
   // Parse usage slices
   if (usageSlice && Object.keys(usageSlice).length) {
     const retMap = await parseObjectSlices(
@@ -1016,7 +1553,14 @@ export async function analyzeProject(dbObjMap, options) {
     servicesMap = retMap.servicesMap;
     userDefinedTypesMap = retMap.userDefinedTypesMap;
   }
-  // Parse the semantics slices for swift and scala
+  // A component whose calls the slices do not show (code inside the project,
+  // such as a vendored library) is still used where its header is included
+  for (const [purl, includeLocations] of cIncludeLocations) {
+    if (!purlLocationMap[purl]?.size) {
+      purlLocationMap[purl] = new Set(includeLocations);
+    }
+  }
+  // Parse the semantics slices for swift
   if (
     semanticsSlice &&
     Object.keys(semanticsSlice).length &&
@@ -1024,7 +1568,25 @@ export async function analyzeProject(dbObjMap, options) {
   ) {
     // Identify the purl locations
     const retMap = parseSemanticSlices(language, components, semanticsSlice);
-    purlLocationMap = retMap.purlLocationMap;
+    // The usages step may already have locations for a purl; the semantics
+    // pass adds its own rather than replacing them.
+    for (const [apurl, locations] of Object.entries(
+      retMap.purlLocationMap || {},
+    )) {
+      purlLocationMap[apurl] ??= new Set();
+      for (const alocation of locations) {
+        purlLocationMap[apurl].add(alocation);
+      }
+    }
+  }
+  // A user-supplied OpenAPI spec must yield services even when the usages
+  // slice is empty.
+  if (
+    openapiSpecFile &&
+    safeExistsSync(openapiSpecFile) &&
+    !Object.keys(servicesMap).length
+  ) {
+    detectServicesFromOpenAPI(language, openapiSpecFile, servicesMap);
   }
   if (options.withDataFlow) {
     if (
@@ -1033,7 +1595,7 @@ export async function analyzeProject(dbObjMap, options) {
     ) {
       dataFlowSlicesFile = options.dataFlowSlicesFile;
       dataFlowSlice = filterAtomSliceData(
-        JSON.parse(fs.readFileSync(options.dataFlowSlicesFile, "utf-8")),
+        readSlicesFile(options.dataFlowSlicesFile, "data-flow"),
         options,
       );
     } else if (!PROJECT_TYPE_ALIASES.scala.includes(language)) {
@@ -1041,7 +1603,7 @@ export async function analyzeProject(dbObjMap, options) {
       if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
         dataFlowSlicesFile = retMap.slicesFile;
         dataFlowSlice = filterAtomSliceData(
-          JSON.parse(fs.readFileSync(retMap.slicesFile, "utf-8")),
+          readSlicesFile(retMap.slicesFile, "data-flow"),
           options,
         );
       }
@@ -1093,6 +1655,125 @@ export async function analyzeProject(dbObjMap, options) {
  * @param {string} [openapiSpecFile=undefined] Optional path to an OpenAPI spec used for service detection
  * @returns {Promise<Object>} Map with `purlLocationMap`, `servicesMap`, and `userDefinedTypesMap`
  */
+/**
+ * Attribute the include slices of a C/C++ usages report to the BOM
+ * components that provide the files they resolved to: each header's imported
+ * symbols (the functions the including file calls that it declares), and the
+ * include directive's location. Reports from atom releases that do not name
+ * the resolved file attribute nothing.
+ *
+ * @param {Object} usageSlice Parsed usages report
+ * @param {Object[]} components Components of the input BOM
+ * @param {string} dirPath Source directory
+ * @param {Object} options CLI options
+ * @returns {{symbols: Map<string, Set<string>>, locations: Map<string, Set<string>>}}
+ *   Imported symbols and include locations (`file#line`) by purl
+ */
+export function attributeCIncludes(
+  usageSlice,
+  components,
+  dirPath,
+  options = {},
+) {
+  const symbols = new Map();
+  const locations = new Map();
+  const includes = [...parseCIncludeSlices(usageSlice)].filter(
+    ([, e]) => e.paths.size && e.symbols.size,
+  );
+  if (!includes.length || !components?.length) {
+    return { symbols, locations };
+  }
+  const attribute = createIncludeAttributor({
+    src: dirPath,
+    components,
+    buildDirs: cmakeBuildDirCandidates(dirPath, options),
+  });
+  const withPurl = components.filter((c) => c?.purl);
+  const byName = (name, purlType) =>
+    withPurl.find(
+      (c) =>
+        c.name?.toLowerCase() === `${name}`.toLowerCase() &&
+        (!purlType || c.purl.startsWith(`pkg:${purlType}/`)),
+    );
+  const purlByHeader = new Map();
+  for (const [header, entry] of includes) {
+    const target = attribute(entry.paths);
+    let component;
+    if (target?.kind === "component") {
+      component = target.component;
+    } else if (target?.kind === "os") {
+      component =
+        withPurl.find((c) => c.purl === target.pkgInfo.purl) ||
+        byName(target.pkgInfo.name);
+    } else if (target?.kind === "vcpkg") {
+      component = byName(target.port);
+    } else if (target?.kind === "conan") {
+      component = byName(target.name, "conan") || byName(target.name);
+    }
+    if (!component?.purl) {
+      continue;
+    }
+    purlByHeader.set(header, component.purl);
+    const known = symbols.get(component.purl) || new Set();
+    for (const symbol of entry.symbols) {
+      known.add(symbol);
+    }
+    symbols.set(component.purl, known);
+  }
+  // the directives that include an attributed header and use it
+  for (const slice of usageSlice?.objectSlices || []) {
+    const purl = purlByHeader.get(slice?.fullName);
+    if (
+      !purl ||
+      !`${slice.code || ""}`.startsWith("#include") ||
+      !slice.fileName ||
+      !slice.importedSymbols?.length
+    ) {
+      continue;
+    }
+    const known = locations.get(purl) || new Set();
+    known.add(
+      slice.lineNumber
+        ? `${slice.fileName}#${slice.lineNumber}`
+        : slice.fileName,
+    );
+    locations.set(purl, known);
+  }
+  return { symbols, locations };
+}
+
+/**
+ * Seed the C/C++ imports from the include slices of a usages report (see
+ * `attributeCIncludes`).
+ *
+ * @param {Object} usageSlice Parsed usages report
+ * @param {Object[]} components Components of the input BOM
+ * @param {string} dirPath Source directory
+ * @param {Object} purlImportsMap Imports by purl, extended in place
+ * @param {Object} options CLI options
+ * @returns {Object} purlImportsMap
+ */
+export function seedCImportsFromIncludes(
+  usageSlice,
+  components,
+  dirPath,
+  purlImportsMap = {},
+  options = {},
+) {
+  const { symbols } = attributeCIncludes(
+    usageSlice,
+    components,
+    dirPath,
+    options,
+  );
+  for (const [purl, names] of symbols) {
+    purlImportsMap[purl] = Array.from(
+      new Set([...(purlImportsMap[purl] || []), ...names]),
+    );
+  }
+  return purlImportsMap;
+}
+
 export async function parseObjectSlices(
   language,
   usageSlice,
@@ -1400,99 +2081,64 @@ export async function parseSliceUsages(
 /**
  * Method to parse semantic slice data. Currently supported for swift and scala languages.
  *
+ * Swift slices created by cdxgen record, for every indexed source file, the
+ * lines that reference each dependency module (`moduleReferences`); the module
+ * of a reference is the declaring module recovered from the compiler-resolved
+ * USR. Components are mapped to their package's modules through the
+ * `packages` slice, so every occurrence is backed by a resolved reference.
+ * Slices without `moduleReferences` (created by older cdxgen versions) fall
+ * back to matching symbol names.
+ *
  * @param {String} language Project language.
  * @param {Array} components Components from the input SBOM
  * @param {Object} semanticsSlice Semantic slice data
  * @returns {Object} Parsed metadata
  */
-export function parseSemanticSlices(language, components, semanticsSlice) {
-  // For scala, use the dedicated scalasem module.
-  if (language === "scala") {
-    return findPurlLocations(components, semanticsSlice);
-  }
+export function parseSemanticSlices(_language, components, semanticsSlice) {
   if (!components) {
     return undefined;
   }
-  const componentNamePurlMap = {};
-  const componentSymbolsMap = {};
-  const allObfuscationsMap = {};
-  // We have two attributes in the semantics slice to expand a given module to its constituent symbols
-  // - A less precise buildSymbols, which is obtained by parsing the various output-file-map.json files
-  // - A granular and precise moduleInfos, which has the exact classes, protocols, enums etc belonging to each module
-  // The objective then is to build the purlLocationMap, which is the list of locations where a given purl is used
-  // For this, we have two attributes:
-  // - A simpler fileStructures attribute that has the mapping between a swift file and the list of referenced types
-  // - A granular fileIndexes attribute that contains information about the clang modules and line number information
-
-  // We first need to map out the component names to their purls
-  // This is because the semantics slice use the module names everywhere
+  const fileIndexes = semanticsSlice?.fileIndexes || {};
+  const hasModuleReferences = Object.values(fileIndexes).some(
+    (afileIndex) => afileIndex?.moduleReferences,
+  );
+  const purlLocationsSet = {};
   for (const comp of components) {
-    componentNamePurlMap[comp.name] = comp.purl;
-    if (!componentSymbolsMap[comp.name]) {
-      componentSymbolsMap[comp.name] = new Set();
-    }
-    if (semanticsSlice?.buildSymbols[comp.name]) {
-      for (const asym of semanticsSlice.buildSymbols[comp.name]) {
-        componentSymbolsMap[comp.name].add(asym);
-      }
-    }
-    const moduleInfo = semanticsSlice?.moduleInfos[comp.name] || {};
-    if (moduleInfo.classes) {
-      for (const asym of moduleInfo.classes) {
-        componentSymbolsMap[comp.name].add(asym);
-      }
-    }
-    if (moduleInfo.protocols) {
-      for (const asym of moduleInfo.protocols) {
-        componentSymbolsMap[comp.name].add(asym);
-      }
-    }
-    if (moduleInfo.enums) {
-      for (const asym of moduleInfo.enums) {
-        componentSymbolsMap[comp.name].add(asym);
-      }
+    // Local packages and the root application have no purl, so there is
+    // nothing the evidence could be attached to downstream
+    if (!comp?.purl) {
+      continue;
     }
-    // Now collect the method signatures from class and protocol methods
-    if (moduleInfo.classMethods) {
-      for (const aclassName of Object.keys(moduleInfo.classMethods)) {
-        for (const asym of moduleInfo.classMethods[aclassName]) {
-          componentSymbolsMap[comp.name].add(asym);
-        }
-      }
+    const moduleNames = resolveSwiftComponentModules(comp, semanticsSlice);
+    if (!moduleNames.size) {
+      continue;
     }
-    if (moduleInfo.protocolMethods) {
-      for (const aclassName of Object.keys(moduleInfo.protocolMethods)) {
-        for (const asym of moduleInfo.protocolMethods[aclassName]) {
-          componentSymbolsMap[comp.name].add(asym);
+    const locations = purlLocationsSet[comp.purl] || new Set();
+    if (hasModuleReferences) {
+      for (const [aswiftFile, afileIndex] of Object.entries(fileIndexes)) {
+        for (const [amodule, lines] of Object.entries(
+          afileIndex?.moduleReferences || {},
+        )) {
+          if (!moduleNames.has(amodule)) {
+            continue;
+          }
+          for (const aline of lines) {
+            locations.add(`${aswiftFile}#${aline}`);
+          }
         }
       }
-    }
-    // Build a large obfuscation map
-    if (moduleInfo.obfuscationMap) {
-      for (const asym of Object.keys(moduleInfo.obfuscationMap)) {
-        allObfuscationsMap[asym] = moduleInfo.obfuscationMap[asym];
-      }
-    }
-  }
-  const purlLocationsSet = {};
-  // We now have a good set of data in componentSymbolsMap and allObfuscationsMap
-  // We can iterate these symbols and check if they exist under fileIndexes.symbolLocations
-  for (const compName of Object.keys(componentSymbolsMap)) {
-    const compSymbols = Array.from(componentSymbolsMap[compName]);
-    const searchHits = searchSymbolLocations(
-      compSymbols,
-      semanticsSlice?.fileIndexes,
-    );
-    // We have an occurrence hit. Let's populate the purlLocationMap
-    if (searchHits?.length) {
-      const locations =
-        purlLocationsSet[componentNamePurlMap[compName]] || new Set();
-      for (const ahit of searchHits) {
+    } else {
+      for (const ahit of searchSymbolLocations(
+        collectLegacySwiftSymbols(moduleNames, semanticsSlice),
+        fileIndexes,
+      )) {
         for (const aline of ahit.lineNumbers) {
           locations.add(`${ahit.file}#${aline}`);
         }
       }
-      purlLocationsSet[componentNamePurlMap[compName]] = locations;
+    }
+    if (locations.size) {
+      purlLocationsSet[comp.purl] = locations;
     }
   }
   const purlLocationMap = {};
@@ -1502,22 +2148,184 @@ export function parseSemanticSlices(language, components, semanticsSlice) {
   return { purlLocationMap };
 }
 
-function searchSymbolLocations(compSymbols, fileIndexes) {
-  const searchHits = [];
-  if (!fileIndexes) {
+/**
+ * Normalise a repository location or Swift purl into `host/owner/name`.
+ *
+ * @param {String} value Repository URL, scp-style git location, or swift purl
+ * @returns {undefined|String} Lowercase `host/path` without scheme and `.git`
+ */
+function normalizeSwiftPackageLocation(value) {
+  if (!value || typeof value !== "string") {
     return undefined;
   }
-  for (const aswiftFile of Object.keys(fileIndexes)) {
-    if (!fileIndexes[aswiftFile].symbolLocations) {
+  let text = value.trim();
+  if (text.startsWith("pkg:swift/")) {
+    text = text.slice("pkg:swift/".length).split("?")[0].split("#")[0];
+    const at = text.lastIndexOf("@");
+    if (at > 0) {
+      text = text.slice(0, at);
+    }
+    try {
+      text = decodeURIComponent(text);
+    } catch (_e) {
+      // Keep the raw value
+    }
+  } else {
+    text = text.split("?")[0].split("#")[0];
+    const scheme = text.indexOf("://");
+    if (scheme >= 0) {
+      text = text.slice(scheme + 3);
+      // Drop userinfo such as git@
+      const slash = text.indexOf("/");
+      const at = text.indexOf("@");
+      if (at >= 0 && (slash < 0 || at < slash)) {
+        text = text.slice(at + 1);
+      }
+    } else if (text.includes("@") && text.includes(":")) {
+      // scp-style git@github.com:owner/name.git
+      text = text.slice(text.indexOf("@") + 1).replace(":", "/");
+    } else {
+      return undefined;
+    }
+  }
+  text = text.replace(/\/+$/, "");
+  if (text.endsWith(".git")) {
+    text = text.slice(0, -4);
+  }
+  if (text.startsWith("www.")) {
+    text = text.slice(4);
+  }
+  return text.toLowerCase() || undefined;
+}
+
+/**
+ * Resolve the Swift module names that belong to a SBOM component.
+ *
+ * A component is named after its package repository or identity while the
+ * semantic slices are keyed by module names. With the `packages` slice, a
+ * package cloned from a repository matches the component whose purl names
+ * the same repository, so a fork with the same name never inherits another
+ * package's evidence; registry and local packages, which have no repository
+ * URL, match by identity or name. Older slices only carry the
+ * `packageModules` aliases (identity, package name, repository name), which
+ * are matched against the component name and the `cdx:swift:packageName`
+ * property, so that `swift-argument-parser` resolves to its `ArgumentParser`
+ * module.
+ *
+ * @param {Object} comp SBOM component
+ * @param {Object} semanticsSlice Semantic slice data
+ * @returns {Set<string>} Module names associated with the component
+ */
+function resolveSwiftComponentModules(comp, semanticsSlice) {
+  const moduleNames = new Set();
+  if (!comp?.name) {
+    return moduleNames;
+  }
+  const aliases = new Set(
+    [comp.name, getPropertyValue(comp, "cdx:swift:packageName")]
+      .filter(Boolean)
+      .map((alias) => String(alias).toLowerCase()),
+  );
+  if (Array.isArray(semanticsSlice?.packages)) {
+    const componentLocation = normalizeSwiftPackageLocation(comp.purl);
+    for (const apkg of semanticsSlice.packages) {
+      const packageLocation = normalizeSwiftPackageLocation(apkg?.location);
+      const matches =
+        packageLocation && componentLocation
+          ? packageLocation === componentLocation
+          : [apkg?.identity, apkg?.name].some(
+              (alias) => alias && aliases.has(String(alias).toLowerCase()),
+            );
+      if (matches) {
+        for (const amodule of apkg.modules || []) {
+          moduleNames.add(amodule);
+        }
+      }
+    }
+    return moduleNames;
+  }
+  const packageModules = semanticsSlice?.packageModules || {};
+  for (const alias of new Set([comp.name, ...aliases])) {
+    if (Array.isArray(packageModules[alias])) {
+      for (const amodule of packageModules[alias]) {
+        moduleNames.add(amodule);
+      }
+    }
+  }
+  // Modules named after the package (Yams, SWXMLHash) still match
+  if (!moduleNames.size) {
+    moduleNames.add(comp.name);
+  }
+  return moduleNames;
+}
+
+function getPropertyValue(comp, propertyName) {
+  for (const aproperty of comp?.properties || []) {
+    if (aproperty?.name === propertyName) {
+      return aproperty.value;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Collect the symbol names of a component's modules from slices that predate
+ * `moduleReferences`, using the moduleInfos data and the coarser buildSymbols
+ * derived from the build's output file maps.
+ *
+ * @param {Set<String>} moduleNames Module names of the component
+ * @param {Object} semanticsSlice Semantic slice data
+ * @returns {Object} `{ symbols, freeFunctions }` name sets
+ */
+function collectLegacySwiftSymbols(moduleNames, semanticsSlice) {
+  const symbols = new Set();
+  const freeFunctions = new Set();
+  for (const moduleName of moduleNames) {
+    for (const asym of semanticsSlice?.buildSymbols?.[moduleName] || []) {
+      symbols.add(asym);
+    }
+    const moduleInfo = semanticsSlice?.moduleInfos?.[moduleName] || {};
+    for (const asym of [
+      ...(moduleInfo.classes || []),
+      ...(moduleInfo.protocols || []),
+      ...(moduleInfo.enums || []),
+    ]) {
+      symbols.add(asym);
+    }
+    for (const methods of [
+      ...Object.values(moduleInfo.classMethods || {}),
+      ...Object.values(moduleInfo.protocolMethods || {}),
+    ]) {
+      for (const asym of methods || []) {
+        symbols.add(asym);
+      }
+    }
+    for (const asym of moduleInfo.functions || []) {
+      freeFunctions.add(asym);
+    }
+  }
+  return { symbols, freeFunctions };
+}
+
+function searchSymbolLocations(componentSymbols, fileIndexes) {
+  const searchHits = [];
+  const { symbols, freeFunctions } = componentSymbols;
+  for (const aswiftFile of Object.keys(fileIndexes || {})) {
+    const symbolLocations = fileIndexes[aswiftFile]?.symbolLocations;
+    if (!symbolLocations) {
       continue;
     }
-    for (const asym of Object.keys(fileIndexes[aswiftFile].symbolLocations)) {
-      const lineNumbers = fileIndexes[aswiftFile].symbolLocations[asym];
-      if (compSymbols.includes(asym)) {
+    for (const asym of Object.keys(symbolLocations)) {
+      // The index records free functions by their full selector
+      // (`dump(object:canonical:...)`) while module interfaces give the base
+      // name. Only top-level functions are matched by base name: members such
+      // as `encode(to:)` exist in nearly every module
+      const baseName = asym.includes("(") ? asym.split("(")[0] : undefined;
+      if (symbols.has(asym) || (baseName && freeFunctions.has(baseName))) {
         searchHits.push({
           file: aswiftFile,
           symbol: asym,
-          lineNumbers,
+          lineNumbers: symbolLocations[asym],
         });
       }
     }
@@ -1950,7 +2758,10 @@ export async function createEvinseFile(sliceArtefacts, options) {
       bomJson.metadata.component = workspaceComponent;
     }
   }
-  appendComponentProperties(bomJson.metadata?.component, metadataProperties);
+  mergeAnalyzerMetadataProperties(
+    bomJson.metadata?.component,
+    metadataProperties,
+  );
   let occEvidencePresent = false;
   let csEvidencePresent = false;
   let servicesPresent = false;
@@ -2009,8 +2820,15 @@ export async function createEvinseFile(sliceArtefacts, options) {
     servicesPresent = true;
   }
   // Add the crypto components to the components list
+  // Multi-type scans may have collected the same crypto assets during BOM
+  // generation, so skip any bom-ref already present to keep the BOM valid.
   if (cryptoComponents?.length) {
-    bomJson.components = bomJson.components.concat(cryptoComponents);
+    const existingRefs = new Set(
+      bomJson.components.map((comp) => comp["bom-ref"]).filter(Boolean),
+    );
+    bomJson.components = bomJson.components.concat(
+      cryptoComponents.filter((comp) => !existingRefs.has(comp["bom-ref"])),
+    );
   }
   // Add the AI components (machine-learning-model, dataset) discovered by dosai
   if (aiComponents?.length) {
@@ -2035,28 +2853,27 @@ export async function createEvinseFile(sliceArtefacts, options) {
     bomJson.dependencies = newDependencies;
   }
   if (options.annotate) {
-    if (usagesSlicesFile && safeExistsSync(usagesSlicesFile)) {
-      bomJson.annotations.push({
-        subjects: [bomJson.serialNumber],
-        annotator: { component: bomJson.metadata.tools.components[0] },
-        timestamp: getTimestamp(),
-        text: fs.readFileSync(usagesSlicesFile, "utf8"),
-      });
-    }
-    if (dataFlowSlicesFile && safeExistsSync(dataFlowSlicesFile)) {
-      bomJson.annotations.push({
-        subjects: [bomJson.serialNumber],
-        annotator: { component: bomJson.metadata.tools.components[0] },
-        timestamp: getTimestamp(),
-        text: fs.readFileSync(dataFlowSlicesFile, "utf8"),
-      });
-    }
-    if (reachablesSlicesFile && safeExistsSync(reachablesSlicesFile)) {
+    for (const slicesFile of [
+      usagesSlicesFile,
+      dataFlowSlicesFile,
+      reachablesSlicesFile,
+    ]) {
+      if (!slicesFile || !safeExistsSync(slicesFile)) {
+        continue;
+      }
+      // The annotation embeds the slice as one string, which a file this
+      // large cannot become.
+      if (fs.statSync(slicesFile).size > MAX_JSON_TEXT_BYTES) {
+        console.warn(
+          `Not annotating the BOM with the slices file "${slicesFile}", which is too large to embed as text.`,
+        );
+        continue;
+      }
       bomJson.annotations.push({
         subjects: [bomJson.serialNumber],
         annotator: { component: bomJson.metadata.tools.components[0] },
         timestamp: getTimestamp(),
-        text: fs.readFileSync(reachablesSlicesFile, "utf8"),
+        text: fs.readFileSync(slicesFile, "utf8"),
       });
     }
   }