@cdxgen/cdxgen 13.4.0 → 13.6.0

package/lib/ecosystems/scalasem.js

@@ -1,5 +1,13 @@
-import { lstatSync, readFileSync, statSync } from "node:fs";
-import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
+import { lstatSync, readFileSync, realpathSync, statSync } from "node:fs";
+import {
+  basename,
+  dirname,
+  isAbsolute,
+  join,
+  relative,
+  resolve,
+  sep,
+} from "node:path";
 import process from "node:process";
 
 import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
@@ -8,16 +16,17 @@ import { PROJECT_TYPE_ALIASES } from "../core/env.js";
 import {
   getAllFiles,
   getTmpDir,
-  safeCopyFileSync,
   safeExistsSync,
   safeMkdirSync,
   safeMkdtempSync,
   safeRmSync,
   safeSpawnSync,
+  safeWriteSync,
 } from "../core/fs.js";
 import { dirNameStr } from "../core/paths.js";
 import { resolvePluginSourceDir } from "../core/pluginRun.js";
 import { formatDuration } from "../core/processTree.js";
+import { isProjectToolingAllowed } from "../core/projectTooling.js";
 import { parsetoolsFile } from "../inventory/atomUtils.js";
 import { applyAlgorithmProperties } from "../inventory/cryptoAlgorithmFamily.js";
 import { getJarClasses } from "../inventory/deps.js";
@@ -146,22 +155,25 @@ function scalasemTimeoutMs(options = {}) {
 const TIMEOUT_GRACE_MS = 30_000;
 
 // The build files that identify a Scala project, for a source argument that
-// names the working directory relative to itself.
+// names the working directory relative to itself, and that a persisted report
+// must be newer than. sbt 0.13 builds may define everything under project/.
 const SCALA_BUILD_MARKERS = [
   "build.sbt",
   "build.sc",
   "build.mill",
   "pom.xml",
   "project.scala",
+  join("project", "build.properties"),
 ];
 
 /**
  * Where the scalasem report is persisted. An absolute --semantics-slices-file
  * keeps its directory; anything else lands in the evinse output directory, the
- * same rule the atom slice writer follows.
+ * same rule the atom slice writer follows. Without either there is nowhere to
+ * keep it, and the report lives only as long as the run.
  *
  * @param {Object} options CLI options carrying `output` and `semanticsSlicesFile`.
- * @returns {string} Absolute report path.
+ * @returns {string|undefined} Absolute report path.
  */
 export function scalasemOutputFile(options = {}) {
   const requested = options.semanticsSlicesFile || "semantics.slices.json";
@@ -170,21 +182,18 @@ export function scalasemOutputFile(options = {}) {
   if (isAbsolute(requested)) {
     return requested;
   }
-  let outputDir;
-  if (options.output) {
-    const resolvedOutput = resolve(options.output);
-    let isDir = false;
-    try {
-      isDir =
-        safeExistsSync(resolvedOutput) &&
-        lstatSync(resolvedOutput).isDirectory();
-    } catch (_err) {
-      isDir = false;
-    }
-    outputDir = isDir ? resolvedOutput : dirname(resolvedOutput);
-  } else {
-    outputDir = safeMkdtempSync(join(getTmpDir(), "scalasem-"));
+  if (!options.output) {
+    return undefined;
+  }
+  const resolvedOutput = resolve(options.output);
+  let isDir = false;
+  try {
+    isDir =
+      safeExistsSync(resolvedOutput) && lstatSync(resolvedOutput).isDirectory();
+  } catch (_err) {
+    isDir = false;
   }
+  const outputDir = isDir ? resolvedOutput : dirname(resolvedOutput);
   return join(outputDir, basename(requested));
 }
 
@@ -223,6 +232,18 @@ export function isV1SemanticsSlice(parsed) {
   return Object.keys(parsed).some((key) => key.endsWith(".scala"));
 }
 
+// Whether a path lies below a directory. A prefix test fails for a root
+// directory (`/`, `C:\\`), whose path already ends in the separator.
+function isInside(directory, path) {
+  const rel = relative(directory, path);
+  return (
+    Boolean(rel) &&
+    rel !== ".." &&
+    !rel.startsWith(`..${sep}`) &&
+    !isAbsolute(rel)
+  );
+}
+
 /**
  * Whether a version 1 slice describes this project: it names no project, so
  * every source file it lists must exist under the project directory.
@@ -233,15 +254,104 @@ function isV1SliceOfProject(slice, projectDir) {
     files.length > 0 &&
     files.every((file) => {
       const path = resolve(projectDir, file);
-      return path.startsWith(`${projectDir}${sep}`) && safeExistsSync(path);
+      return isInside(projectDir, path) && safeExistsSync(path);
     })
   );
 }
 
+// The run settings a report depends on. cdxgen records them in the report it
+// keeps, so a later run reuses that report only when it would ask for the
+// same: tests included or not, the build run or not.
+const RUN_SETTINGS_KEY = "cdxgenRunSettings";
+
+function scalasemRunSettings(options) {
+  return {
+    build: isProjectToolingAllowed(options),
+    includeTests: Boolean(
+      options.scalasemIncludeTests && !options.requiredOnly,
+    ),
+  };
+}
+
+function canonicalPath(path) {
+  try {
+    return realpathSync(path);
+  } catch (_err) {
+    return resolve(path);
+  }
+}
+
+// Whether two paths name one directory, through symbolic links such as
+// /var and /private/var, and in any case on Windows.
+function isSamePath(left, right) {
+  const a = canonicalPath(left);
+  const b = canonicalPath(right);
+  return process.platform === "win32"
+    ? a.toLowerCase() === b.toLowerCase()
+    : a === b;
+}
+
+function modifiedAt(file) {
+  try {
+    return statSync(file).mtimeMs;
+  } catch (_err) {
+    return undefined;
+  }
+}
+
+/**
+ * Why a persisted report cannot stand in for a new run: it describes another
+ * project, it predates the input BOM, cdxgen kept it from a run with other
+ * settings, or a build file or a source it describes changed or went away
+ * since it was written.
+ *
+ * @returns {string|undefined} The reason, or undefined when it can be reused.
+ */
+function reportReuseProblem(report, reportFile, analysisDir, options) {
+  const projectPath = report._meta?.projectPath;
+  if (!projectPath || !isSamePath(projectPath, analysisDir)) {
+    return "it describes another project";
+  }
+  if (!isNewerThan(reportFile, options.input)) {
+    return "it is older than the input BOM";
+  }
+  const recorded = report._meta[RUN_SETTINGS_KEY];
+  const wanted = scalasemRunSettings(options);
+  if (
+    recorded &&
+    (recorded.build !== wanted.build ||
+      recorded.includeTests !== wanted.includeTests)
+  ) {
+    return "it was made with other settings";
+  }
+  const writtenAt = modifiedAt(reportFile);
+  if (writtenAt === undefined) {
+    return "its modification time is unknown";
+  }
+  for (const marker of SCALA_BUILD_MARKERS) {
+    const changedAt = modifiedAt(join(analysisDir, marker));
+    if (changedAt !== undefined && changedAt > writtenAt) {
+      return `${marker} changed since`;
+    }
+  }
+  for (const key of Object.keys(report)) {
+    const file = isReportFileKey(key) ? resolve(analysisDir, key) : undefined;
+    if (!file || !isInside(analysisDir, file)) {
+      continue;
+    }
+    const changedAt = modifiedAt(file);
+    if (changedAt === undefined || changedAt > writtenAt) {
+      return `${key} changed since`;
+    }
+  }
+  return undefined;
+}
+
 /**
  * Run scalasem over a Scala project and return its report, reusing a
- * persisted version 2 report that belongs to this project and is newer than
- * the input BOM.
+ * persisted version 2 report that belongs to this project, is newer than the
+ * input BOM and than the build files and sources it describes, and, when
+ * cdxgen kept it, was made with the settings this run asks for.
  *
  * Failures are visible rather than silent: the reason is printed once, the
  * run's diagnostics reach the caller as `cdx:scalasem:diagnostic` properties,
@@ -279,10 +389,18 @@ export function analyzeScalaProject(src, options = {}) {
   for (const candidate of candidates) {
     const existing = readScalasemReport(candidate);
     if (existing?._meta?.schemaVersion === "scalasem/2") {
-      if (
-        resolve(existing._meta.projectPath || "") === analysisDir &&
-        isNewerThan(candidate, options.input)
-      ) {
+      const problem = reportReuseProblem(
+        existing,
+        candidate,
+        analysisDir,
+        options,
+      );
+      if (problem && DEBUG_MODE) {
+        console.log(
+          `Not reusing the scalasem report "${candidate}": ${problem}.`,
+        );
+      }
+      if (!problem) {
         if (DEBUG_MODE) {
           console.log(`Reusing the scalasem report "${candidate}".`);
         }
@@ -339,12 +457,38 @@ function runScalasem(analysisDir, options, requestedFile, v1Slice, v1File) {
   // earlier run (or another project's run) had left there, and a report
   // written within the millisecond the run started passed for fresh.
   const runDir = safeMkdtempSync(join(getTmpDir(), "scalasem-"));
+  try {
+    return runScalasemIn(
+      runDir,
+      scalasem,
+      analysisDir,
+      options,
+      requestedFile,
+      v1Slice,
+      v1File,
+    );
+  } finally {
+    safeRmSync(runDir, { recursive: true, force: true });
+  }
+}
+
+function runScalasemIn(
+  runDir,
+  scalasem,
+  analysisDir,
+  options,
+  requestedFile,
+  v1Slice,
+  v1File,
+) {
   const runReportFile = join(runDir, "scalasem.slices.json");
   const args = [scalasem, analysisDir, runReportFile];
-  if (options.installDeps === false) {
+  const settings = scalasemRunSettings(options);
+  // The build runs the project's sbt definitions
+  if (!settings.build) {
     args.push("--no-build");
   }
-  if (options.scalasemIncludeTests && !options.requiredOnly) {
+  if (settings.includeTests) {
     args.push("--include-tests");
   }
   if (DEBUG_MODE) {
@@ -355,17 +499,24 @@ function runScalasem(analysisDir, options, requestedFile, v1Slice, v1File) {
   // scalasem enforces the limit itself, so the builds it started stop with
   // it; cdxgen's own timeout is the backstop. Naming cdxgen as the supervisor
   // stops scalasem when cdxgen is killed.
-  const result = safeSpawnSync(process.execPath, args, {
-    cwd: analysisDir,
-    shell: false,
-    killSignal: "SIGKILL",
-    timeout: timeoutMs + Math.min(TIMEOUT_GRACE_MS, timeoutMs),
-    env: {
-      ...process.env,
-      ATOM_PARENT_PID: String(process.pid),
-      SCALASEM_TIMEOUT: String(timeoutMs),
-    },
-  });
+  // A spawn that throws, such as a command the allow list refuses, degrades
+  // the evidence like any other run that could not start.
+  let result;
+  try {
+    result = safeSpawnSync(process.execPath, args, {
+      cwd: analysisDir,
+      shell: false,
+      killSignal: "SIGKILL",
+      timeout: timeoutMs + Math.min(TIMEOUT_GRACE_MS, timeoutMs),
+      env: {
+        ...process.env,
+        ATOM_PARENT_PID: String(process.pid),
+        SCALASEM_TIMEOUT: String(timeoutMs),
+      },
+    });
+  } catch (err) {
+    result = { error: err };
+  }
   const elapsedMs = Date.now() - startedAt;
   const wroteReport = safeExistsSync(runReportFile);
   const written = wroteReport ? readScalasemReport(runReportFile) : undefined;
@@ -429,7 +580,9 @@ function runScalasem(analysisDir, options, requestedFile, v1Slice, v1File) {
         ),
       ];
     }
-    const summary = summarizeDiagnostics(report._meta.diagnostics);
+    const summary = summarizeDiagnostics(
+      degradingDiagnostics(report._meta.diagnostics),
+    );
     if (summary) {
       console.warn(
         `scalasem: the report is degraded: ${summary}. The cdx:scalasem:diagnostic:* metadata properties of the BOM say where.`,
@@ -441,19 +594,26 @@ function runScalasem(analysisDir, options, requestedFile, v1Slice, v1File) {
   }
   // Only a usable report replaces the one at the requested path, and a
   // version 1 slice there stays as the user left it.
+  // The kept copy records the settings of this run, so a later run reuses it
+  // only when it asks for the same.
   let reportFile;
-  if (usable && v1File !== requestedFile) {
+  if (usable && requestedFile && v1File !== requestedFile) {
     try {
       safeMkdirSync(dirname(requestedFile), { recursive: true });
-      safeCopyFileSync(runReportFile, requestedFile);
-      reportFile = requestedFile;
+      safeWriteSync(
+        requestedFile,
+        JSON.stringify({
+          ...report,
+          _meta: { ...report._meta, [RUN_SETTINGS_KEY]: settings },
+        }),
+      );
+      reportFile = safeExistsSync(requestedFile) ? requestedFile : undefined;
     } catch (err) {
       console.warn(
         `scalasem: the report could not be kept at ${requestedFile} (${err.message}); this run still uses it.`,
       );
     }
   }
-  safeRmSync(runDir, { recursive: true, force: true });
   return {
     report,
     reportFile,
@@ -462,6 +622,21 @@ function runScalasem(analysisDir, options, requestedFile, v1Slice, v1File) {
   };
 }
 
+// Diagnostics scalasem counts on a healthy run: symbols its semantic pass
+// could not resolve, and stale build outputs it correctly skipped. They say
+// the analysis is incomplete, not that it is degraded, so they stay out of
+// the BOM and out of the degraded flag.
+const INFORMATIONAL_DIAGNOSTIC_CODES = new Set([
+  "unresolved-symbols",
+  "stale-output",
+]);
+
+function degradingDiagnostics(diagnostics = []) {
+  return (diagnostics || []).filter(
+    (diagnostic) => !INFORMATIONAL_DIAGNOSTIC_CODES.has(diagnostic?.code),
+  );
+}
+
 function summarizeDiagnostics(diagnostics = []) {
   const byCode = new Map();
   for (const diagnostic of diagnostics || []) {
@@ -488,8 +663,9 @@ function summarizeDiagnostics(diagnostics = []) {
  */
 export function scalasemMetadataProperties(
   report,
-  diagnostics = report?._meta?.diagnostics || [],
+  allDiagnostics = report?._meta?.diagnostics || [],
 ) {
+  const diagnostics = degradingDiagnostics(allDiagnostics);
   const properties = [];
   const meta = report?._meta || {};
   appendUniqueProperty(
@@ -551,20 +727,23 @@ export function sortedCsv(values) {
 
 /**
  * The platform a purl's artifact name targets: `_sjs1` is Scala.js,
- * `_native0.x` is Scala Native, and neither is the JVM.
+ * `_native0.x` is Scala Native, and neither is the JVM. The platform suffix
+ * counts whether the Scala binary suffix follows it (`upickle_sjs1_3`, the
+ * published name a jar scan keeps) or not (`upickle_sjs1`, the sbt name).
  *
  * @param {string} purl Package URL.
  * @returns {"jvm"|"js"|"native"} Platform key.
  */
 export function scalaPurlPlatform(purl) {
-  const name = purlPurlName(purl);
-  if (!name) {
-    return "jvm";
-  }
-  if (/_(sjs\d+(?:\.\d+)?)$/.test(name)) {
+  return scalaNamePlatform(purlPurlName(purl));
+}
+
+function scalaNamePlatform(name) {
+  const { platformSuffix } = parseScalaArtifact(name);
+  if (platformSuffix.startsWith("_sjs")) {
     return "js";
   }
-  if (/_(native\d+(?:\.\d+)*)$/.test(name)) {
+  if (platformSuffix.startsWith("_native")) {
     return "native";
   }
   return "jvm";
@@ -582,6 +761,20 @@ function purlPurlName(purl) {
   }
 }
 
+// A compiler-generated class: a `$`-separated part that is empty past the
+// top-level name (`$$`) or numeric, or one of the anonymous and lambda markers.
+function isSyntheticClassName(symbol, dollar) {
+  return symbol
+    .slice(dollar + 1)
+    .split("$")
+    .some(
+      (part, index, parts) =>
+        (part === "" && index < parts.length - 1) ||
+        /^\d+$/.test(part) ||
+        ["anon", "anonfun", "Lambda", "lambda"].includes(part),
+    );
+}
+
 /**
  * The class and package index that joins scalasem symbols to component purls.
  *
@@ -631,11 +824,22 @@ export class ScalaJoinIndex {
       if (!symbol || symbol.includes(" ") || symbol.includes("/")) {
         continue;
       }
-      indexed.push(symbol);
-      const dollar = symbol.indexOf("$");
+      // A `$` inside the simple name separates nested classes; one that starts
+      // it belongs to an encoded operator name (`$colon$colon` for `::`).
+      const simpleName = symbol.lastIndexOf(".") + 1;
+      const dollar = symbol.startsWith("$", simpleName)
+        ? -1
+        : symbol.indexOf("$", simpleName);
       const topLevel = dollar > 0 ? symbol.slice(0, dollar) : symbol;
+      // Anonymous classes and lambdas (`Foo$$anon$1`, `Foo$$anonfun$bar$1`,
+      // `Foo$$Lambda$12`) are no names a source can reference; their outer
+      // class speaks for them.
+      const synthetic = dollar > 0 && isSyntheticClassName(symbol, dollar);
+      if (!synthetic) {
+        indexed.push(symbol);
+      }
       this.addSymbol(this.classPurls, topLevel, purl, source);
-      if (dollar > 0) {
+      if (dollar > 0 && !synthetic) {
         const nested = symbol.replaceAll("$", ".").replace(/\.+$/, "");
         if (nested !== topLevel) {
           this.addSymbol(this.classPurls, nested, purl, source);
@@ -732,15 +936,25 @@ export class ScalaJoinIndex {
    * sits in. A package the project also fills is ambiguous and joins nothing,
    * and `javax.` names join only through an exact class, since the JDK ships
    * most of them.
+   *
+   * The package is the part of the symbol before its first type name, which
+   * starts with a capital letter (`io.circe` of `io.circe.Json.fromString`). A
+   * symbol without one names a package (`io.circe`) or a member of one, such
+   * as a package object member (`io.circe.syntax.asJson`). Parent packages
+   * never answer: a missing `io.circe.generic` is not circe-core.
    */
   packageOwners(symbol) {
     if (symbol.startsWith(JDK_EXTENSION_PREFIX)) {
       return undefined;
     }
     const parts = symbol.replace(/\$+$/, "").split(".");
-    for (let i = parts.length; i > 0; i--) {
-      const name = parts.slice(0, i).join(".");
-      const owners = this.packagePurls.get(name);
+    const firstType = parts.findIndex((part) => /^[A-Z]/.test(part));
+    const packages =
+      firstType >= 0
+        ? [parts.slice(0, firstType).join(".")]
+        : [parts.join("."), parts.slice(0, -1).join(".")];
+    for (const name of packages) {
+      const owners = name ? this.packagePurls.get(name) : undefined;
       if (owners?.size) {
         return this.projectPackages.has(name) ? undefined : owners;
       }
@@ -873,41 +1087,83 @@ function componentBinaryVersions(component, coordinate) {
   );
 }
 
+// Which of two components standing for the same library is the one evidence
+// attaches to: the plain purl over one with qualifiers, then the shorter, then
+// the lexicographically first, so the choice never depends on BOM order.
+function preferredComponent(current, candidate) {
+  const rank = (component) => [
+    component.purl.includes("?") ? 1 : 0,
+    component.purl.length,
+  ];
+  const [currentQualified, currentLength] = rank(current);
+  const [candidateQualified, candidateLength] = rank(candidate);
+  if (currentQualified !== candidateQualified) {
+    return candidateQualified < currentQualified ? candidate : current;
+  }
+  if (currentLength !== candidateLength) {
+    return candidateLength < currentLength ? candidate : current;
+  }
+  return candidate.purl < current.purl ? candidate : current;
+}
+
 /**
  * Index the BOM components by their normalized Scala coordinates, both with
  * and without the version, so a classpath jar, a namespace property and a map
  * entry of the same library meet on one component. Each entry keeps the Scala
- * binary version the component was built for, so the `_2.13` and `_3`
- * artifacts of one library in a Maven build stay apart.
+ * binary versions the component was built for, so the `_2.13` and `_3`
+ * artifacts of one library in a Maven build stay apart. Components that share
+ * a normalized coordinate and were built for an overlapping set of Scala
+ * binary versions are one library listed more than once (a repository_url
+ * qualifier, a `_3` suffix beside the sbt name built for 2.13 and 3, a stale
+ * duplicate), so they share one entry, which the preferred component of the
+ * group stands for.
  */
 export function componentCoordinateIndex(components = []) {
-  const byVersion = new Map();
-  const withoutVersion = new Map();
+  const groupsByKey = new Map();
   for (const component of components) {
     const coordinate = scalaCoordinateOfPurl(component?.purl);
     if (!coordinate) {
       continue;
     }
-    const [type, group, artifactBase, platformSuffix] =
-      coordinate.key.split(":");
-    const entry = {
+    const binaryVersions = componentBinaryVersions(component, coordinate);
+    const groups = groupsByKey.get(coordinate.key) || [];
+    groupsByKey.set(coordinate.key, groups);
+    // Every group this component overlaps becomes one with it.
+    const overlapping = groups.filter((group) =>
+      binaryVersions.size
+        ? [...binaryVersions].some((version) =>
+            group.binaryVersions.has(version),
+          )
+        : !group.binaryVersions.size,
+    );
+    const merged = {
       component,
-      binaryVersions: componentBinaryVersions(component, coordinate),
+      binaryVersions: new Set(binaryVersions),
     };
-    if (!byVersion.has(coordinate.key)) {
-      byVersion.set(coordinate.key, []);
+    for (const group of overlapping) {
+      merged.component = preferredComponent(merged.component, group.component);
+      for (const version of group.binaryVersions) {
+        merged.binaryVersions.add(version);
+      }
+      groups.splice(groups.indexOf(group), 1);
     }
-    byVersion.get(coordinate.key).push(entry);
-    const key = scalaCoordinateKey({
+    groups.push(merged);
+  }
+  const byVersion = new Map();
+  const withoutVersion = new Map();
+  for (const [key, groups] of groupsByKey) {
+    const [type, group, artifactBase, platformSuffix] = key.split(":");
+    byVersion.set(key, groups);
+    const versionless = scalaCoordinateKey({
       type,
       group,
       artifactBase,
       platformSuffix,
     });
-    if (!withoutVersion.has(key)) {
-      withoutVersion.set(key, []);
-    }
-    withoutVersion.get(key).push(entry);
+    withoutVersion.set(versionless, [
+      ...(withoutVersion.get(versionless) || []),
+      ...groups,
+    ]);
   }
   return { byVersion, withoutVersion };
 }
@@ -942,11 +1198,126 @@ function pickByBinaryVersion(entries, binaryVersion) {
  * @returns {{component: Object, exact: boolean}|undefined} The component, and
  *   whether its version is the one on the classpath.
  */
-export function matchClasspathEntry(
-  entry,
-  { byVersion, withoutVersion },
-  platform,
-) {
+export function matchClasspathEntry(entry, coordinateIndex, platform) {
+  const direct =
+    entry?.group && entry?.artifact
+      ? matchCoordinates(entry, coordinateIndex, platform)
+      : undefined;
+  if (direct?.component || direct?.ambiguous) {
+    return direct.component ? direct : undefined;
+  }
+  // The report reads coordinates from a Maven repository layout and can take
+  // directories above the group for part of it (`maven.io.circe` for jars
+  // under `<repository>/maven/io/circe/`), and reads none from the Gradle and
+  // Ivy cache layouts. The coordinates the jar's own path spells are tried
+  // then, and must still meet a component on artifact and version.
+  for (const coordinates of jarPathCoordinates(entry)) {
+    const byPath = matchCoordinates(
+      { ...entry, ...coordinates },
+      coordinateIndex,
+      platform,
+    );
+    if (byPath?.exact) {
+      return byPath;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * The coordinates a classpath jar's path spells, for the layouts the report
+ * does not read itself, most specific first:
+ *
+ * - a Maven layout `<group dirs>/<artifact>/<version>/<file>` whose group is
+ *   a dotted tail of the group the report recorded, so a group is only ever
+ *   shortened by the directories the report took for it, never guessed
+ * - the Gradle cache `files-2.1/<group>/<artifact>/<version>/<sha1>/<file>`
+ * - an Ivy cache `<org>/<artifact>/jars/<artifact>-<version>.jar`, as sbt 0.13
+ *   and sbt 1.0 to 1.2 keep it, and an Ivy local repository
+ *   `<org>/<artifact>/<version>/jars/<artifact>.jar`
+ *
+ * @param {Object} entry Classpath entry with `path` and, when the report read
+ *   them, `group`, `artifact` and `version`.
+ * @returns {{group: string, artifact: string, version: string}[]}
+ */
+export function jarPathCoordinates(entry) {
+  if (!entry?.path) {
+    return [];
+  }
+  const segments = String(entry.path).split(/[\\/]/).filter(Boolean);
+  const total = segments.length;
+  const file = segments[total - 1] || "";
+  if (total < 4 || !file.toLowerCase().endsWith(".jar")) {
+    return [];
+  }
+  const found = [];
+  if (entry.group && entry.artifact && entry.version) {
+    const artifactIndex = total - 3;
+    if (
+      segments[artifactIndex] === entry.artifact &&
+      segments[artifactIndex + 1] === entry.version
+    ) {
+      const groupParts = entry.group.split(".");
+      for (let start = 1; start < groupParts.length; start++) {
+        const tail = groupParts.slice(start);
+        const directories = segments.slice(
+          artifactIndex - tail.length,
+          artifactIndex,
+        );
+        if (
+          artifactIndex - tail.length >= 0 &&
+          directories.join("/") === tail.join("/")
+        ) {
+          found.push({
+            group: tail.join("."),
+            artifact: entry.artifact,
+            version: entry.version,
+          });
+        }
+      }
+    }
+  }
+  const gradle = segments.lastIndexOf("files-2.1");
+  if (gradle >= 0 && gradle + 5 === total - 1) {
+    found.push({
+      group: segments[gradle + 1],
+      artifact: segments[gradle + 2],
+      version: segments[gradle + 3],
+    });
+  }
+  const stem = file.slice(0, -".jar".length);
+  if (["jars", "bundles"].includes(segments[total - 2])) {
+    // Ivy local: <org>/<artifact>/<version>/jars/<artifact>.jar
+    if (total >= 5 && stem === segments[total - 4]) {
+      found.push({
+        group: segments[total - 5],
+        artifact: segments[total - 4],
+        version: segments[total - 3],
+      });
+    } else if (stem.startsWith(`${segments[total - 3]}-`)) {
+      // Ivy cache: <org>/<artifact>/jars/<artifact>-<version>.jar
+      found.push({
+        group: segments[total - 4],
+        artifact: segments[total - 3],
+        version: stem.slice(segments[total - 3].length + 1),
+      });
+    }
+  }
+  return found.filter(
+    (coordinates) =>
+      coordinates.group &&
+      coordinates.artifact &&
+      coordinates.version &&
+      (coordinates.group !== entry.group ||
+        coordinates.artifact !== entry.artifact ||
+        coordinates.version !== entry.version),
+  );
+}
+
+// The component a set of coordinates names: `{component, exact}` for a single
+// owner, `{ambiguous: true}` when several components answer, undefined when
+// none does.
+function matchCoordinates(entry, { byVersion, withoutVersion }, platform) {
   const parsed = parseScalaArtifact(entry?.artifact);
   const parts = {
     group: entry?.group,
@@ -961,7 +1332,7 @@ export function matchClasspathEntry(
     return { component: exact[0].component, exact: true };
   }
   if (exact.length > 1) {
-    return undefined;
+    return { ambiguous: true };
   }
   const candidates = pickByBinaryVersion(
     withoutVersion.get(scalaCoordinateKey(parts)),
@@ -971,9 +1342,10 @@ export function matchClasspathEntry(
     (candidate) => scalaPurlPlatform(candidate.component.purl) === platform,
   );
   const pool = matching.length ? matching : candidates;
-  return pool.length === 1
-    ? { component: pool[0].component, exact: false }
-    : undefined;
+  if (pool.length === 1) {
+    return { component: pool[0].component, exact: false };
+  }
+  return pool.length > 1 ? { ambiguous: true } : undefined;
 }
 
 /**
@@ -1041,8 +1413,14 @@ export async function buildScalaJoinIndex(report, components, jarNSMapping) {
     }
   }
   for (const mapPurl of Object.keys(jarNSMapping || {})) {
-    const entry = jarNSMapping[mapPurl] || {};
-    if (!Array.isArray(entry.namespaces) || !entry.namespaces.length) {
+    // Maps written before every producer used `{ namespaces }` hold the
+    // newline-joined namespaces of a jar-scanned component as a string.
+    const value = jarNSMapping[mapPurl];
+    const namespaces =
+      typeof value === "string"
+        ? value.split("\n").filter(Boolean)
+        : value?.namespaces;
+    if (!Array.isArray(namespaces) || !namespaces.length) {
       continue;
     }
     const segments = /^pkg:[^/]+\/(?:([^/@?]+)\/)?([^@?]+)@([^?#]*)/.exec(
@@ -1061,7 +1439,7 @@ export async function buildScalaJoinIndex(report, components, jarNSMapping) {
       scalaPurlPlatform(mapPurl),
     );
     if (matched) {
-      index.addNamespaces(matched.component.purl, entry.namespaces, 3);
+      index.addNamespaces(matched.component.purl, namespaces, 3);
     }
   }
   return index;
@@ -1308,10 +1686,11 @@ export function scalasemCryptoOidKey(name, keySize, mode, curve, padding) {
     return undefined;
   }
   if (SCALASEM_AES_NAMES.has(name)) {
+    const upperMode = mode?.toUpperCase();
     const modeKey =
-      SCALASEM_AES_MODE_KEYS[mode] ||
+      SCALASEM_AES_MODE_KEYS[upperMode] ||
       SCALASEM_AES_MODE_KEYS[name.split("-")[1]];
-    const wrap = name === "AES-KW" || mode === "KW";
+    const wrap = name === "AES-KW" || upperMode === "KW";
     if (keySize && (modeKey !== undefined || wrap)) {
       const sizedKey = wrap ? `aes${keySize}-wrap` : `aes${keySize}-${modeKey}`;
       const hit = SCALASEM_OID_KEYS.get(sizedKey.toLowerCase());
@@ -1454,6 +1833,7 @@ export async function collectScalasemEvidence(
     componentPropertiesMap,
     metadataProperties,
     options,
+    allowedPurlsByModule,
   );
   addJsModuleEvidence(
     report,
@@ -1786,7 +2166,17 @@ function stackTargetPurls(sink, fileEntry, joinIndex, platform, allowed) {
   return [...purls];
 }
 
+// The package of a class the report names. A class nested in an object reads
+// `Outer$.Inner`, so the package ends before the first part that is a type:
+// one that carries a `$` or starts with a capital letter.
 function packageOf(className) {
+  const parts = String(className || "").split(".");
+  const firstType = parts.findIndex(
+    (part) => part.includes("$") || /^[A-Z]/.test(part),
+  );
+  if (firstType > 0) {
+    return parts.slice(0, firstType).join(".");
+  }
   const text = String(className || "").replace(/\$+$/, "");
   const dot = text.lastIndexOf(".");
   return dot > 0 ? text.slice(0, dot) : "";
@@ -1846,9 +2236,22 @@ function providerAliases(purl, components = []) {
 /**
  * The component purl of the library a crypto finding names as its provider.
  * Maven coordinates match on group and base artifact; the short aliases cover
- * the providers the rules emit for libraries without a coordinate.
+ * the providers the rules emit for libraries without a coordinate. Of several
+ * matching components, one on the referencing module's classpath wins, then
+ * the artifact whose name extends the provider's least (`bcprov-jdk18on`
+ * over `bcprov-ext-jdk18on`), then the first purl, so the choice never
+ * depends on the order of the BOM.
+ *
+ * @param {string} provider Provider the finding names.
+ * @param {Object[]} components BOM components.
+ * @param {Set<string>} [classpathPurls] Purls on the module's classpath.
+ * @returns {string|undefined} Component purl.
  */
-export function scalasemProviderPurl(provider, components = []) {
+export function scalasemProviderPurl(
+  provider,
+  components = [],
+  classpathPurls = undefined,
+) {
   if (!provider) {
     return undefined;
   }
@@ -1863,6 +2266,7 @@ export function scalasemProviderPurl(provider, components = []) {
     return undefined;
   }
   const base = parseScalaArtifact(artifactPrefix).artifactBase;
+  const matches = [];
   for (const component of components) {
     if (!component?.purl) {
       continue;
@@ -1875,10 +2279,23 @@ export function scalasemProviderPurl(provider, components = []) {
     }
     const name = parseScalaArtifact(decodeSafe(segments[2])).artifactBase;
     if (name === base || name.startsWith(`${base}-`)) {
-      return component.purl;
+      matches.push({ purl: component.purl, name });
     }
   }
-  return undefined;
+  const rank = (match) => [
+    classpathPurls?.has(match.purl) ? 0 : 1,
+    match.name.length,
+  ];
+  matches.sort((left, right) => {
+    const [leftClasspath, leftLength] = rank(left);
+    const [rightClasspath, rightLength] = rank(right);
+    return (
+      leftClasspath - rightClasspath ||
+      leftLength - rightLength ||
+      (left.purl < right.purl ? -1 : left.purl > right.purl ? 1 : 0)
+    );
+  });
+  return matches[0]?.purl;
 }
 
 // Primitives a mode of operation applies to. RSA spells `RSA/ECB/...` in JCA,
@@ -1963,6 +2380,7 @@ function addCryptoEvidence(
   componentPropertiesMap,
   metadataProperties,
   options = {},
+  allowedPurlsByModule = new Map(),
 ) {
   const includeTests = options.scalasemIncludeTests === true;
   const nativeLibraryBySymbol = new Map();
@@ -1977,11 +2395,17 @@ function addCryptoEvidence(
     if (scope === "test" && !includeTests) {
       continue;
     }
-    const location = `${finding.file || ""}#${finding.line || 0}`;
+    const location = finding.line
+      ? `${finding.file || ""}#${finding.line}`
+      : finding.file || "";
     const nativeLibrary = finding.kind?.startsWith("native")
       ? nativeLibraryBySymbol.get(finding.name)
       : undefined;
-    const providerPurl = scalasemProviderPurl(finding.provider, components);
+    const providerPurl = scalasemProviderPurl(
+      finding.provider,
+      components,
+      allowedPurlsFor(report[finding.file], allowedPurlsByModule),
+    );
     const asset =
       finding.resolution === "unresolved"
         ? undefined
@@ -2052,12 +2476,18 @@ function addCryptoEvidence(
   }
 }
 
+// `file#line` as an occurrence. A location without a line, or whose `#` is
+// part of the file name, is the file alone.
 function parseLocationString(location) {
   const separator = location.lastIndexOf("#");
-  const line = Number.parseInt(location.slice(separator + 1), 10);
+  const suffix = separator >= 0 ? location.slice(separator + 1) : "";
+  if (!/^\d+$/.test(suffix)) {
+    return { location };
+  }
+  const line = Number.parseInt(suffix, 10);
   return {
     location: location.slice(0, separator),
-    ...(Number.isFinite(line) && line > 0 ? { line } : {}),
+    ...(line > 0 ? { line } : {}),
   };
 }
 
@@ -2185,6 +2615,191 @@ function cryptoAssetProperties(finding, nativeLibrary) {
   return properties;
 }
 
+// The characters that end a host list: a path, URL parameters, and the
+// `;key=value` properties some JDBC drivers take.
+const ADDRESS_END = ["/", "?", "#", ";"];
+
+const HOST_PATTERN = /^(?:\[[0-9A-Fa-f:.]+\]|[A-Za-z0-9._%-]+)(?::\d+)?$/;
+
+function indexOfAny(text, characters, from = 0) {
+  let found = -1;
+  for (const character of characters) {
+    const index = text.indexOf(character, from);
+    if (index >= 0 && (found < 0 || index < found)) {
+      found = index;
+    }
+  }
+  return found;
+}
+
+function cutAt(text, characters) {
+  const index = indexOfAny(text, characters);
+  return index >= 0 ? text.slice(0, index) : text;
+}
+
+// `host`, `host:port`, `[ipv6]:port`, or a comma separated list of those.
+function isHostList(text) {
+  return (
+    Boolean(text) && text.split(",").every((host) => HOST_PATTERN.test(host))
+  );
+}
+
+/**
+ * Where the userinfo in front of a host ends, or -1 when there is none. A
+ * password may hold any of `/ ? # ; @ =`, so an `@` ends the userinfo unless a
+ * well-formed host list is followed by parameters that hold it
+ * (`host:1433;user=a@b`). Of several `@`, the last one before the first
+ * parameter ends it, and the last one of all when that leaves none: a host the
+ * split gets wrong costs a service name, a split that keeps a password leaks it.
+ *
+ * @param {string} rest The text after `//`, or after a JDBC subprotocol.
+ * @returns {number} Index of the `@` that ends the userinfo.
+ */
+function userinfoEnd(rest) {
+  const firstAt = rest.indexOf("@");
+  if (firstAt < 0) {
+    return -1;
+  }
+  const end = indexOfAny(rest, ADDRESS_END);
+  if (
+    end >= 0 &&
+    end < firstAt &&
+    isHostList(rest.slice(0, end)) &&
+    rest.slice(end + 1, firstAt).includes("=")
+  ) {
+    return -1;
+  }
+  const firstEquals = rest.indexOf("=");
+  const beforeParameters =
+    firstEquals >= 0 ? rest.lastIndexOf("@", firstEquals) : -1;
+  return beforeParameters >= 0 ? beforeParameters : rest.lastIndexOf("@");
+}
+
+/**
+ * The `host[:port]` list of a parenthesized address: MySQL
+ * `address=(host=h)(port=3306)` and `(host=h,port=3306,user=u)`, Oracle
+ * `(DESCRIPTION=(ADDRESS=(HOST=h)(PORT=1521)))`. Only host and port values are
+ * read, so a user or password beside them never leaves.
+ */
+function parenthesizedHosts(text) {
+  const hosts = [];
+  const ports = [];
+  for (const group of text.split(/[()]/)) {
+    for (const pair of group.split(",")) {
+      const equals = pair.indexOf("=");
+      if (equals <= 0) {
+        continue;
+      }
+      const key = pair.slice(0, equals).trim().toLowerCase();
+      const value = pair.slice(equals + 1).trim();
+      if (key === "host" && HOST_PATTERN.test(value)) {
+        hosts.push(value);
+      } else if (key === "port" && /^\d+$/.test(value)) {
+        ports[hosts.length ? hosts.length - 1 : 0] ??= value;
+      }
+    }
+  }
+  return hosts.map((host, index) =>
+    ports[index] && !host.includes(":") ? `${host}:${ports[index]}` : host,
+  );
+}
+
+// The hosts and database path of an authority, after its userinfo is gone.
+function parseAuthority(text) {
+  const parenthesized = text.startsWith("(") || /^[A-Za-z]+=\(/.test(text);
+  if (parenthesized) {
+    const close = text.lastIndexOf(")");
+    const after = close >= 0 ? text.slice(close + 1) : "";
+    return {
+      hosts: parenthesizedHosts(text.slice(0, close + 1)),
+      path: after.startsWith("/") ? cutAt(after, ["?", "#", ";", ":"]) : "",
+    };
+  }
+  const end = indexOfAny(text, ADDRESS_END);
+  const hostPart = end >= 0 ? text.slice(0, end) : text;
+  const hosts = isHostList(hostPart) ? hostPart.split(",") : [];
+  // DB2 and Informix append `:key=value;` properties to the database name.
+  const path =
+    hosts.length && end >= 0 && text[end] === "/"
+      ? cutAt(text.slice(end), ["?", "#", ";", ":"])
+      : "";
+  return { hosts, path };
+}
+
+/**
+ * Split a JDBC URL into its subprotocol, hosts and database path, dropping
+ * anything that may carry credentials: userinfo, the `user/password@` prefix
+ * Oracle takes, URL parameters, and the `;key=value` and `:key=value`
+ * properties some drivers take. Host values that do not look like hosts are
+ * dropped too, rather than passed on.
+ *
+ * @param {string} value JDBC URL.
+ * @returns {{scheme: string, hosts: string[], address: string}|undefined}
+ *   The first subprotocol, the hosts, and the address rebuilt from those
+ *   parts; undefined for anything but a JDBC URL.
+ */
+function parseJdbcUrl(value) {
+  const text = String(value || "").trim();
+  if (!/^jdbc:/i.test(text)) {
+    return undefined;
+  }
+  let rest = text.slice(5);
+  const tokens = [];
+  for (
+    let token = /^[A-Za-z][\w+.-]*:/.exec(rest);
+    token && !rest.startsWith("//");
+    token = /^[A-Za-z][\w+.-]*:/.exec(rest)
+  ) {
+    tokens.push(token[0]);
+    rest = rest.slice(token[0].length);
+  }
+  const scheme = (tokens[0] || "jdbc:").slice(0, -1).toLowerCase();
+  if (rest.startsWith("//")) {
+    const authority = rest.slice(2);
+    const { hosts, path } = parseAuthority(
+      authority.slice(userinfoEnd(authority) + 1),
+    );
+    return {
+      scheme,
+      hosts,
+      address: `jdbc:${tokens.join("")}//${hosts.join(",")}${path}`,
+    };
+  }
+  const at = userinfoEnd(rest);
+  if (at < 0) {
+    return {
+      scheme,
+      hosts: [],
+      address: `jdbc:${tokens.join("")}${cutAt(rest, ["?", "#", ";"])}`,
+    };
+  }
+  // `user/password@host:port:sid`: a word before the credentials can read as
+  // a subprotocol (`jdbc:db:user:password@host`), so only the driver keeps
+  // its tokens, and Oracle its driver type.
+  const kept = tokens.slice(0, scheme === "oracle" ? 2 : 1).join("");
+  const target = rest.slice(at + 1);
+  if (target.startsWith("//")) {
+    const { hosts, path } = parseAuthority(target.slice(2));
+    return {
+      scheme,
+      hosts,
+      address: `jdbc:${kept}@//${hosts.join(",")}${path}`,
+    };
+  }
+  if (target.startsWith("(")) {
+    const hosts = parenthesizedHosts(target);
+    return { scheme, hosts, address: `jdbc:${kept}@${hosts.join(",")}` };
+  }
+  const address = cutAt(target, ["?", "#", ";", "/"]);
+  const host = address.split(":")[0];
+  const hosts = HOST_PATTERN.test(host) ? [host] : [];
+  return {
+    scheme,
+    hosts,
+    address: `jdbc:${kept}@${hosts.length ? address : ""}`,
+  };
+}
+
 /**
  * A JDBC address without what may carry credentials: userinfo, the Oracle
  * `user/password@` prefix, URL parameters and the `;key=value` properties
@@ -2195,49 +2810,58 @@ function cryptoAssetProperties(finding, nativeLibrary) {
  * @returns {string} The address part.
  */
 export function sanitizeJdbcUrl(value) {
-  let text = String(value || "").trim();
-  if (!/^jdbc:/i.test(text)) {
-    return text;
-  }
-  text = `jdbc:${text.slice(5)}`;
-  for (const separator of ["?", "#", ";"]) {
-    const index = text.indexOf(separator);
-    if (index >= 0) {
-      text = text.slice(0, index);
-    }
-  }
-  const slashes = text.indexOf("//");
-  if (slashes >= 0) {
-    const authorityEnd = text.indexOf("/", slashes + 2);
-    const authority = text.slice(
-      slashes + 2,
-      authorityEnd >= 0 ? authorityEnd : undefined,
-    );
-    const at = authority.lastIndexOf("@");
-    if (at >= 0) {
-      text =
-        text.slice(0, slashes + 2) +
-        authority.slice(at + 1) +
-        (authorityEnd >= 0 ? text.slice(authorityEnd) : "");
-    }
-  }
-  // Oracle thin: jdbc:oracle:thin:user/password@host:port:sid
-  const thin = /^(jdbc:oracle:thin:)[^@]*@/i.exec(text);
-  if (thin) {
-    text = `${thin[1]}@${text.slice(thin[0].length)}`;
+  const parsed = parseJdbcUrl(value);
+  return parsed ? parsed.address : String(value || "").trim();
+}
+
+// The host name of `host`, `host:port` or `[ipv6]:port`.
+function hostName(host) {
+  if (host.startsWith("[")) {
+    const close = host.indexOf("]");
+    return close > 0 ? host.slice(1, close) : undefined;
   }
-  return text;
+  return host.split(":")[0] || undefined;
 }
 
 function jdbcServiceName(value) {
-  const address = sanitizeJdbcUrl(value);
-  const scheme = address.slice(5).split(":", 1)[0].toLowerCase() || "jdbc";
-  let host = /\/\/([^/:]+)/.exec(address)?.[1];
-  if (!host) {
-    // Oracle thin and similar: the host follows the @.
-    host = /@(?:\/\/)?([^/:]+)/.exec(address)?.[1];
+  const { scheme, hosts } = parseJdbcUrl(value);
+  return [scheme, hosts.length ? hostName(hosts[0]) : undefined]
+    .filter(Boolean)
+    .join("-");
+}
+
+// A host value as `host[:port]`, without a scheme, userinfo, path or
+// parameters, or undefined when what is left is not a host.
+function bareHost(value) {
+  let text = String(value || "").trim();
+  const scheme = /^[A-Za-z][A-Za-z0-9+.-]*:\/\//.exec(text);
+  if (scheme) {
+    text = text.slice(scheme[0].length);
+  }
+  text = cutAt(text.slice(userinfoEnd(text) + 1), ADDRESS_END);
+  return HOST_PATTERN.test(text) ? text : undefined;
+}
+
+// The `host[:port]` a URL names. The userinfo is dropped before the URL is
+// parsed: a password holding `/` would otherwise end the authority early and
+// leave the user name to read as the host.
+function urlHost(value) {
+  const separator = value.indexOf("://");
+  if (separator <= 0) {
+    return undefined;
+  }
+  const rest = value.slice(separator + 3);
+  const withoutUserinfo = rest.slice(userinfoEnd(rest) + 1);
+  try {
+    const host = new URL(`${value.slice(0, separator)}://${withoutUserinfo}`)
+      .host;
+    if (host) {
+      return host;
+    }
+  } catch (_err) {
+    // Not a URL the WHATWG parser takes; the host is read by hand.
   }
-  return [scheme, host].filter(Boolean).join("-");
+  return bareHost(withoutUserinfo);
 }
 
 /**
@@ -2257,13 +2881,11 @@ export function scalasemServiceName(service) {
     return jdbcServiceName(value);
   }
   if (service?.host) {
-    return service.host.split(":")[0];
-  }
-  try {
-    return new URL(value).hostname || undefined;
-  } catch (_err) {
-    return undefined;
+    const host = bareHost(service.host);
+    return host ? hostName(host) : undefined;
   }
+  const host = urlHost(value);
+  return host ? hostName(host) : undefined;
 }
 
 /**
@@ -2285,15 +2907,12 @@ export function scalasemServiceEndpoint(service) {
     return sanitizeJdbcUrl(value);
   }
   if (service?.host) {
-    return service.host;
-  }
-  try {
-    const parsed = new URL(value);
-    return `${parsed.protocol}//${parsed.host}`;
-  } catch (_err) {
-    const hostMatch = /:\/\/([^/?#@]+@)?([^/?#]+)/.exec(value);
-    return hostMatch ? `${value.split("://")[0]}://${hostMatch[2]}` : undefined;
+    return bareHost(service.host);
   }
+  const host = urlHost(value);
+  return host
+    ? `${value.slice(0, value.indexOf("://")).toLowerCase()}://${host}`
+    : undefined;
 }
 
 function serviceLocation(service) {
@@ -2457,7 +3076,10 @@ export async function collectScalaJsNpmComponents(
 ) {
   const isScalaJs = pkgList.some((pkg) => {
     const name = pkg?.name || purlPurlName(pkg?.purl) || "";
-    return /_(sjs\d+(?:\.\d+)?)$/.test(name) || name === "scalajs-library";
+    return (
+      scalaNamePlatform(name) === "js" ||
+      parseScalaArtifact(name).artifactBase === "scalajs-library"
+    );
   });
   const empty = { components: [], roots: [], dependencies: [] };
   if (!isScalaJs) {
@@ -2546,6 +3168,24 @@ function npmNameFromPurl(purl) {
   }
 }
 
+function nodeModulesDepth(component) {
+  const location = (component.properties || []).find(
+    (property) => property.name === "internal:LocalNodeModulesPath",
+  )?.value;
+  return location
+    ? location.split("node_modules/").length - 1
+    : Number.POSITIVE_INFINITY;
+}
+
+function isPreferredNpmCopy(candidate, known) {
+  const candidateDepth = nodeModulesDepth(candidate);
+  const knownDepth = nodeModulesDepth(known);
+  if (candidateDepth !== knownDepth) {
+    return candidateDepth < knownDepth;
+  }
+  return candidate.purl < known.purl;
+}
+
 /**
  * Attribute the report's JavaScript module imports to the npm components the
  * build bundles. A module no component owns is reported on the project
@@ -2562,10 +3202,17 @@ function addJsModuleEvidence(
   if (!jsModules.length) {
     return;
   }
+  // Of several versions of one package, the one a bare import resolves to is
+  // the hoisted copy, the shallowest under node_modules; the first purl
+  // breaks a tie, so the choice never depends on the order of the BOM.
   const npmByName = new Map();
   for (const component of components) {
     const name = npmNameFromPurl(component?.purl);
-    if (name) {
+    if (!name) {
+      continue;
+    }
+    const known = npmByName.get(name);
+    if (!known || isPreferredNpmCopy(component, known)) {
       npmByName.set(name, component);
     }
   }