@cdxgen/cdxgen 13.4.0 → 13.6.0

package/lib/evinser/evinser.js

@@ -1,10 +1,12 @@
 import fs from "node:fs";
+import { builtinModules } from "node:module";
 import path, { basename, join, resolve } from "node:path";
 import process from "node:process";
 
 import { Purl } from "@cdxgen/cdx-purl";
 
 import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
+import { recordDegradation } from "../core/buildLedger.js";
 import { PROJECT_TYPE_ALIASES } from "../core/env.js";
 import {
   getAllFiles,
@@ -15,6 +17,7 @@ import {
   safeRmSync,
   safeWriteSync,
 } from "../core/fs.js";
+import { isProjectToolingAllowed } from "../core/projectTooling.js";
 import { hasCppSources } from "../ecosystems/cppEvidence.js";
 import {
   createIncludeAttributor,
@@ -23,11 +26,11 @@ import {
 import {
   analyzeGolemProject,
   collectGolemEvidence,
+  collectGolemServices,
   isGolemGoLanguage,
 } from "../ecosystems/golem.js";
 import {
   collectGradleDependencies,
-  getGradleCommand,
   getMavenCommand,
 } from "../ecosystems/gradleutils.js";
 import {
@@ -52,6 +55,8 @@ import {
   isScalasemLanguage,
 } from "../ecosystems/scalasem.js";
 import {
+  atomBomFileArgs,
+  atomBuildToolArgs,
   atomCompileCommandsArgs,
   buildAtomCommandEnv,
   executeAtom,
@@ -77,7 +82,10 @@ import {
   collectDosaiServicesFromMethods,
   createDosaiDataFlowSlice,
   createDosaiMethodsSlice,
-  dosaiRunWasStopped,
+  dosaiFailureReported,
+  dosaiOmittedSections,
+  dosaiReportFileOmittedSections,
+  dosaiSectionsCdxgenReads,
   isDosaiDotnetLanguage,
   normalizeDosaiServiceMap,
   persistDosaiSemanticsReport,
@@ -85,6 +93,7 @@ import {
   readDosaiMethodsReport,
 } from "../inventory/dosai.js";
 import { parseOccurrenceEvidenceLocation } from "../inventory/evidenceUtils.js";
+import { splitPurlLoose } from "../inventory/purl.js";
 import { executeOsQuery } from "../managers/binary.js";
 import { MAX_JSON_TEXT_BYTES, readJsonFile } from "../parsers/largeJson.js";
 import { postProcess } from "../stages/postgen/postgen.js";
@@ -92,7 +101,8 @@ import { createOrLoad } from "./db.js";
 import { findPurlLocations } from "./scalasem.js";
 import { createSemanticsSlices } from "./swiftsem.js";
 
-const typePurlsCache = {};
+// keyed by type names, which can be "constructor", "toString", ...: no prototype
+const typePurlsCache = Object.create(null);
 
 function appendUniqueProperty(properties, name, value) {
   if (value === undefined || value === null || value === "") {
@@ -255,6 +265,7 @@ export function buildEvinseOptions(options, args, input) {
     force: false,
     withReachables: options.deep,
     usagesSlicesFile: options.usagesSlicesFile,
+    callsitesSlicesFile: options.callsitesSlicesFile,
     dataFlowSlicesFile: options.dataFlowSlicesFile,
     reachablesSlicesFile: options.reachablesSlicesFile,
     semanticsSlicesFile: options.semanticsSlicesFile,
@@ -401,9 +412,25 @@ export async function catalogMavenDeps(
   options = {},
 ) {
   let jarNSMapping = readNamespaceMap(dirPath, options);
-  if (!jarNSMapping) {
+  if (!jarNSMapping && !isProjectToolingAllowed(options)) {
+    // `mvn dependency:copy-dependencies` evaluates the project's build and
+    // its `.mvn` configuration, so only the local repository is read.
+    console.log(
+      options.withDeepJarCollector
+        ? "Skipping 'mvn dependency:copy-dependencies' since dependency installation is disabled. Only the jars already in the local Maven repository are used."
+        : "Skipping 'mvn dependency:copy-dependencies' since dependency installation is disabled. Pass --with-deep-jar-collector to use the jars already in the local Maven repository.",
+    );
+    if (options.withDeepJarCollector) {
+      jarNSMapping = await collectMvnDependencies(
+        undefined,
+        undefined,
+        true,
+        true,
+      );
+    }
+  } else if (!jarNSMapping) {
     console.log("About to collect jar dependencies for the path", dirPath);
-    const mavenCmd = getMavenCommand(dirPath, dirPath);
+    const mavenCmd = getMavenCommand(dirPath, dirPath, options);
     // collect all jars including from the cache if data-flow mode is enabled
     jarNSMapping = await collectMvnDependencies(
       mavenCmd,
@@ -457,10 +484,10 @@ export async function catalogGradleDeps(
     console.log(
       "About to collect jar dependencies from the gradle cache. This would take a while ...",
     );
-    const gradleCmd = getGradleCommand(dirPath, dirPath);
-    // collect all jars including from the cache if data-flow mode is enabled
+    // Only the Gradle cache is read, so no Gradle command is resolved: that
+    // would probe the project's own gradlew.
     jarNSMapping = await collectGradleDependencies(
-      gradleCmd,
+      undefined,
       dirPath,
       false,
       true,
@@ -645,9 +672,9 @@ export async function createSlice(
             resolve(slicesFile),
             options,
           );
-    // A stopped run has already said why; it says nothing about whether the
-    // project is supported (issue 4438).
-    if (!sliceResult && !dosaiRunWasStopped(resolve(slicesFile))) {
+    // A stopped run, or one the .NET host refused to start, has already said
+    // why; it says nothing about whether the project is supported (issue 4438).
+    if (!sliceResult && !dosaiFailureReported(resolve(slicesFile))) {
       console.warn(
         `Unable to generate ${sliceType} slice using dosai. Check if this is a supported .NET project.`,
       );
@@ -658,6 +685,13 @@ export async function createSlice(
       slicesFile,
     };
   }
+  const buildToolArgs = atomBuildToolArgs(language, options);
+  if (!buildToolArgs) {
+    console.log(
+      `Skipping the ${sliceType} slice for ${resolve(filePath)} since dependency installation is disabled and the installed atom cannot be stopped from running Maven. Upgrade atom to slice this project without its build.`,
+    );
+    return { tempDir: sliceOutputDir, tempDirOwned };
+  }
   console.log(
     `Creating ${sliceType} slice for ${resolve(filePath)}. Please wait ...`,
   );
@@ -705,7 +739,9 @@ export async function createSlice(
     args.push("--slice-depth");
     args.push(readEnvironmentVariable("ATOM_SLICE_DEPTH"));
   }
+  args.push(...atomBomFileArgs(sliceType, options));
   args.push(...atomCompileCommandsArgs(filePath, language, options));
+  args.push(...buildToolArgs);
   args.push(resolve(filePath));
   const atomExcludeEnv = buildAtomCommandEnv(options, language);
   // Execute atom
@@ -1143,6 +1179,49 @@ export function mergeServiceDefinitions(target, source) {
   return target;
 }
 
+/**
+ * Collect the services of a Go project for the golem evidence path (#4498).
+ *
+ * Two sources are kept and merged by service name, the way the Scala path
+ * merges a user-provided spec into its report's services. They roll services
+ * up differently — golem per server, OpenAPI per path and method — so a
+ * route both name appears under both entries:
+ *
+ * - the golem report itself, whose `services[]` section rolls the registered
+ *   routes up per server (a gin engine, a net/http listener) with methods and
+ *   frameworks, and the outbound hosts it calls into `kind: "external"`
+ *   services flagged as trust-boundary crossings;
+ * - an OpenAPI document, either the one `--openapi-spec-file` names or the
+ *   `openapi.json` an earlier `atom-tools convert -t go` left in the repo,
+ *   which is reused when present so `golem`/`atom-tools` and `cdxgen` can be
+ *   run as separate steps.
+ *
+ * @param {object|null|undefined} golemReport Parsed golem analysis report,
+ *   when one was produced; a missing or `null` report adds no services.
+ * @param {string} dirPath Project directory the report was produced from.
+ * @param {Object} options Command line options.
+ * @param {Object} [servicesMap={}] Service map to populate.
+ * @returns {Object} The service map
+ */
+export function collectGoServices(
+  golemReport,
+  dirPath,
+  options = {},
+  servicesMap = {},
+) {
+  servicesMap = collectGolemServices(golemReport, servicesMap);
+  const openapiSpecFile = resolve(
+    dirPath,
+    options.openapiSpecFile || "openapi.json",
+  );
+  if (safeExistsSync(openapiSpecFile)) {
+    const openapiServices = {};
+    detectServicesFromOpenAPI("go", openapiSpecFile, openapiServices);
+    mergeServiceDefinitions(servicesMap, openapiServices);
+  }
+  return servicesMap;
+}
+
 /**
  * Function to analyze the project
  *
@@ -1183,6 +1262,7 @@ export async function analyzeProject(dbObjMap, options) {
 
   if (isGolemGoLanguage(language)) {
     const golemReport = analyzeGolemProject(dirPath, options);
+    servicesMap = collectGoServices(golemReport, dirPath, options, servicesMap);
     if (golemReport && Object.keys(golemReport).length) {
       const golemEvidence = collectGolemEvidence(golemReport, [
         bomJson.metadata?.component,
@@ -1329,24 +1409,58 @@ export async function analyzeProject(dbObjMap, options) {
       options.withDataFlow = true;
       options.includeCrypto = true;
     }
+    let needsUsagesRun = true;
     if (
       options.usagesSlicesFile &&
       usableSlicesFile(options.usagesSlicesFile)
     ) {
       usageSlice = readDosaiMethodsReport(options.usagesSlicesFile);
       usagesSlicesFile = options.usagesSlicesFile;
+      needsUsagesRun = false;
+      // A user-supplied usages slice is used as given. When it was written
+      // with --sections and left out a section cdxgen reads, the evidence
+      // lacks that input; persistDosaiSemanticsReport reports separately
+      // that the persisted report is partial.
+      const missingInputs = dosaiSectionsCdxgenReads(
+        dosaiOmittedSections(usageSlice),
+      );
+      if (missingInputs.length) {
+        recordDegradation("dosai.usages.trimmed-report", {
+          ecosystem: "csharp",
+          tool: "dosai",
+          impact: "components",
+          command: `usages ${usagesSlicesFile}`,
+          detail: `The supplied dosai methods report was written without sections cdxgen reads: ${missingInputs.join(", ")}. The evidence from those sections is missing. Run dosai methods without --sections, or with every section cdxgen reads.`,
+        });
+      }
     } else if (usableSlicesFile(options.depsSlicesFile)) {
       // createCsharpBom already ran dosai methods on this tree for --deep runs
       // and wrote the deps slice. For dosai, that output IS the usages slice,
-      // so reuse it instead of invoking dosai a second time.
-      if (DEBUG_MODE) {
-        console.log(
-          `Reusing the dosai deps slices file "${options.depsSlicesFile}" for the usages analysis.`,
-        );
+      // so reuse it instead of invoking dosai a second time - unless it was
+      // written with --sections (a --deep run that performs no evidence
+      // analysis trims it): evinse persists this file as the full native
+      // report, so it must not build on a trimmed one and dosai runs again.
+      const omittedSections = dosaiReportFileOmittedSections(
+        options.depsSlicesFile,
+      );
+      if (omittedSections.length) {
+        if (DEBUG_MODE) {
+          console.log(
+            `The dosai deps slices file "${options.depsSlicesFile}" omits sections (${omittedSections.join(", ")}); running dosai for the full usages report.`,
+          );
+        }
+      } else {
+        if (DEBUG_MODE) {
+          console.log(
+            `Reusing the dosai deps slices file "${options.depsSlicesFile}" for the usages analysis.`,
+          );
+        }
+        usageSlice = readDosaiMethodsReport(options.depsSlicesFile);
+        usagesSlicesFile = options.depsSlicesFile;
+        needsUsagesRun = false;
       }
-      usageSlice = readDosaiMethodsReport(options.depsSlicesFile);
-      usagesSlicesFile = options.depsSlicesFile;
-    } else {
+    }
+    if (needsUsagesRun) {
       retMap = await createSlice(language, dirPath, "usages", options);
       if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
         usageSlice = readDosaiMethodsReport(retMap.slicesFile);
@@ -1465,6 +1579,7 @@ export async function analyzeProject(dbObjMap, options) {
     cryptoGeneratePurls = retMap.cryptoGeneratePurls;
   }
   // Reuse existing usages slices
+  let usagesAtomFile;
   if (options.usagesSlicesFile && usableSlicesFile(options.usagesSlicesFile)) {
     usageSlice = filterAtomSliceData(
       readSlicesFile(options.usagesSlicesFile, "usages"),
@@ -1474,6 +1589,7 @@ export async function analyzeProject(dbObjMap, options) {
   } else {
     // Generate our own slices
     retMap = await createSlice(language, dirPath, "usages", options);
+    usagesAtomFile = retMap?.atomFile || "";
     if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
       usageSlice = filterAtomSliceData(
         readSlicesFile(retMap.slicesFile, "usages"),
@@ -1553,6 +1669,35 @@ export async function analyzeProject(dbObjMap, options) {
     servicesMap = retMap.servicesMap;
     userDefinedTypesMap = retMap.userDefinedTypesMap;
   }
+  // Parse the callsites slice (JS/TS): one record per external use site, each
+  // record's own (file, line) is an occurrence of the module's package. The
+  // usages slice above still provides services and endpoints.
+  if (JS_LANGUAGES.includes(language)) {
+    let callsitesSlice;
+    if (
+      options.callsitesSlicesFile &&
+      usableSlicesFile(options.callsitesSlicesFile)
+    ) {
+      callsitesSlice = readSlicesFile(options.callsitesSlicesFile, "callsites");
+    } else if (
+      usagesAtomFile !== undefined &&
+      !safeExistsSync(usagesAtomFile)
+    ) {
+      // The usages run above built no atom (stopped at the timeout, or atom
+      // failed); a callsites run would rebuild the same atom and fail the same way.
+      console.log(
+        "Skipping the callsites slice since atom could not build the atom for the usages slice.",
+      );
+    } else {
+      retMap = await createSlice(language, dirPath, "callsites", options);
+      if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
+        callsitesSlice = readSlicesFile(retMap.slicesFile, "callsites");
+      }
+    }
+    if (callsitesSlice?.callsites?.length) {
+      attributeJsCallsites(callsitesSlice, purlImportsMap, purlLocationMap);
+    }
+  }
   // A component whose calls the slices do not show (code inside the project,
   // such as a vendored library) is still used where its header is included
   for (const [purl, includeLocations] of cIncludeLocations) {
@@ -1860,8 +2005,15 @@ export async function parseSliceUsages(
 ) {
   const fileName = slice.fileName;
   const typesToLookup = new Set();
-  const lKeyOverrides = {};
-  const usages = slice.usages || [];
+  // keyed by type names, which can be "constructor", "toString", ...: no prototype
+  const lKeyOverrides = Object.create(null);
+  // A user defined type has no usages; its fields' types are evidence at the fields' lines.
+  const usages =
+    slice.usages ||
+    (slice.fields || [])
+      .filter((f) => f?.typeFullName)
+      .map((f) => ({ targetObj: f }));
+  const isJs = JS_LANGUAGES.includes(language);
   // What should be the line number to use. slice.lineNumber would be quite coarse and could lead to reports such as
   // #1670. Line numbers under targetObj and definedBy is a safe bet for dynamic languages, but occassionally leads to
   // confusion when inter-procedural tracking works better than expected.
@@ -1884,13 +2036,27 @@ export async function parseSliceUsages(
       sliceLineNumber ||
       ausage?.targetObj?.lineNumber ||
       ausage?.definedBy?.lineNumber;
+    // JavaScript entries name the imported module they resolve to; attribute those by package
+    // and keep the symbol-based matching below for entries without one.
+    if (isJs) {
+      attributeJsModules(ausage, fileName, purlImportsMap, purlLocationMap);
+    }
+    const viaSymbols = (o) => !(isJs && o?.module);
     // First capture the types in the targetObj and definedBy
     for (const atype of [
-      [ausage?.targetObj?.isExternal, ausage?.targetObj?.typeFullName],
-      [ausage?.targetObj?.isExternal, ausage?.targetObj?.resolvedMethod],
-      [ausage?.definedBy?.name?.includes("::"), ausage?.definedBy?.name],
-      [ausage?.definedBy?.isExternal, ausage?.definedBy?.typeFullName],
-      [ausage?.definedBy?.isExternal, ausage?.definedBy?.resolvedMethod],
+      ...(viaSymbols(ausage?.targetObj)
+        ? [
+            [ausage?.targetObj?.isExternal, ausage?.targetObj?.typeFullName],
+            [ausage?.targetObj?.isExternal, ausage?.targetObj?.resolvedMethod],
+          ]
+        : []),
+      ...(viaSymbols(ausage?.definedBy)
+        ? [
+            [ausage?.definedBy?.name?.includes("::"), ausage?.definedBy?.name],
+            [ausage?.definedBy?.isExternal, ausage?.definedBy?.typeFullName],
+            [ausage?.definedBy?.isExternal, ausage?.definedBy?.resolvedMethod],
+          ]
+        : []),
       ...(ausage?.fields || []).map((f) => [f?.isExternal, f?.typeFullName]),
     ]) {
       if (
@@ -1931,7 +2097,8 @@ export async function parseSliceUsages(
     for (const acall of []
       .concat(ausage?.invokedCalls || [])
       .concat(ausage?.argToCalls || [])
-      .concat(ausage?.procedures || [])) {
+      .concat(ausage?.procedures || [])
+      .filter(viaSymbols)) {
       if (
         acall.resolvedMethod?.startsWith("@") ||
         acall?.callName?.includes("::")
@@ -2031,9 +2198,7 @@ export async function parseSliceUsages(
               if (!purlLocationMap[apurl]) {
                 purlLocationMap[apurl] = new Set();
               }
-              if (lKeyOverrides[atype]) {
-                purlLocationMap[apurl].add(...lKeyOverrides[atype]);
-              }
+              addAllLocations(purlLocationMap[apurl], lKeyOverrides[atype]);
             }
           }
         } else {
@@ -2041,9 +2206,7 @@ export async function parseSliceUsages(
             if (!purlLocationMap[apurl]) {
               purlLocationMap[apurl] = new Set();
             }
-            if (lKeyOverrides[atype]) {
-              purlLocationMap[apurl].add(...lKeyOverrides[atype]);
-            }
+            addAllLocations(purlLocationMap[apurl], lKeyOverrides[atype]);
           }
         }
       }
@@ -2065,9 +2228,7 @@ export async function parseSliceUsages(
           if (!purlLocationMap[ns.purl]) {
             purlLocationMap[ns.purl] = new Set();
           }
-          if (lKeyOverrides[atype]) {
-            purlLocationMap[ns.purl].add(...lKeyOverrides[atype]);
-          }
+          addAllLocations(purlLocationMap[ns.purl], lKeyOverrides[atype]);
         }
         typePurlsCache[atype] = nsHits;
       } else {
@@ -2475,6 +2636,17 @@ export function detectServicesFromOpenAPI(
  * @param {Array} slice Usages array for each objectSlice
  * @param {Object} servicesMap Existing service map
  */
+/**
+ * The text routes and endpoints are read from: JavaScript slices keep a call's source text in
+ * `code` and the resolved callee name in `resolvedMethod`; other languages have only the latter.
+ *
+ * @param {Object|undefined} entry slice entry
+ * @returns {string|undefined} text
+ */
+function sourceTextOf(entry) {
+  return entry?.code || entry?.resolvedMethod;
+}
+
 export function detectServicesFromUsages(language, slice, servicesMap = {}) {
   const usages = slice.usages;
   if (!usages) {
@@ -2487,30 +2659,30 @@ export function detectServicesFromUsages(language, slice, servicesMap = {}) {
     let authenticated;
     if (language === "ruby" && definedBy?.name?.includes("/")) {
       endpoints = extractEndpoints(language, definedBy.name);
-    } else if (targetObj?.resolvedMethod) {
+    } else if (sourceTextOf(targetObj)) {
       if (language !== "php") {
-        endpoints = extractEndpoints(language, targetObj?.resolvedMethod);
+        endpoints = extractEndpoints(language, sourceTextOf(targetObj));
       }
-      if (targetObj?.resolvedMethod.toLowerCase().includes("auth")) {
+      if (sourceTextOf(targetObj).toLowerCase().includes("auth")) {
         authenticated = true;
       }
-    } else if (definedBy?.resolvedMethod) {
+    } else if (sourceTextOf(definedBy)) {
       if (language !== "php") {
-        endpoints = extractEndpoints(language, definedBy?.resolvedMethod);
+        endpoints = extractEndpoints(language, sourceTextOf(definedBy));
       }
-      if (definedBy?.resolvedMethod.toLowerCase().includes("auth")) {
+      if (sourceTextOf(definedBy).toLowerCase().includes("auth")) {
         authenticated = true;
       }
     }
     if (usage.invokedCalls) {
       for (const acall of usage.invokedCalls) {
-        if (acall.resolvedMethod) {
+        if (sourceTextOf(acall)) {
           if (language !== "php") {
             const tmpEndpoints = extractEndpoints(
               language,
-              acall.resolvedMethod,
+              sourceTextOf(acall),
             );
-            if (acall.resolvedMethod.toLowerCase().includes("auth")) {
+            if (sourceTextOf(acall).toLowerCase().includes("auth")) {
               authenticated = true;
             }
             if (tmpEndpoints?.length) {
@@ -2716,6 +2888,72 @@ export function extractEndpoints(language, code) {
   return endpoints;
 }
 
+/**
+ * Key naming the package a purl refers to, independent of its version,
+ * qualifiers and subpath. Namespace and name are the decoded purl segments,
+ * so an encoded scope (`%40angular/common`) keys like a plain one.
+ *
+ * @param {string} purl Purl string
+ * @returns {string|undefined} `type/namespace/name`, or undefined for a non-purl
+ */
+export function versionlessPurlKey(purl) {
+  const parts = splitPurlLoose(purl);
+  if (!parts) {
+    return undefined;
+  }
+  return `${parts.type}/${parts.namespace || ""}/${parts.name}`;
+}
+
+/**
+ * Index the data-flow frames recorded under versionless flow purls by
+ * {@link versionlessPurlKey}. A flow purl without a version attaches to every
+ * BOM component of the same package name, whatever its version (maintainer
+ * decision, 2026-10-27); chen leaves the version off exactly when it cannot
+ * pick one between apps that pin the package differently.
+ *
+ * @param {Object} dataFlowFrames Frames keyed by flow purl
+ * @returns {Object} Frames keyed by versionless purl key
+ */
+export function indexVersionlessPurls(dataFlowFrames) {
+  const index = {};
+  for (const [purl, frames] of Object.entries(dataFlowFrames || {})) {
+    if (splitPurlLoose(purl)?.version === null) {
+      const key = versionlessPurlKey(purl);
+      if (!key) {
+        continue;
+      }
+      index[key] ??= [];
+      index[key].push(...frames);
+    }
+  }
+  return index;
+}
+
+/**
+ * Index the crypto generate pools recorded under versionless flow purls by
+ * {@link versionlessPurlKey}, the crypto counterpart of
+ * {@link indexVersionlessPurls}.
+ *
+ * @param {Object} cryptoGeneratePurls Algorithm bom-refs keyed by flow purl
+ * @returns {Object} Algorithm bom-ref sets keyed by versionless purl key
+ */
+export function indexVersionlessCrypto(cryptoGeneratePurls) {
+  const index = {};
+  for (const [purl, algos] of Object.entries(cryptoGeneratePurls || {})) {
+    if (splitPurlLoose(purl)?.version === null) {
+      const key = versionlessPurlKey(purl);
+      if (!key) {
+        continue;
+      }
+      index[key] ??= new Set();
+      for (const ref of algos || []) {
+        index[key].add(ref);
+      }
+    }
+  }
+  return index;
+}
+
 /**
  * Method to create the SBOM with evidence file called evinse file.
  *
@@ -2767,6 +3005,15 @@ export async function createEvinseFile(sliceArtefacts, options) {
   let servicesPresent = false;
   const propertyEvidencePresent =
     metadataProperties.length || Object.keys(componentPropertiesMap).length;
+  // Versionless flow purls attach to every same-name component (see
+  // indexVersionlessPurls), so look both ways: exact purl first, then the
+  // versionless index.
+  const versionlessFrames = indexVersionlessPurls(dataFlowFrames);
+  const versionlessCrypto = indexVersionlessCrypto(cryptoGeneratePurls);
+  const depCryptoPurls =
+    Object.keys(versionlessCrypto).length && cryptoGeneratePurls
+      ? { ...cryptoGeneratePurls }
+      : cryptoGeneratePurls;
   for (const comp of [bomJson.metadata?.component, ...components]) {
     if (!comp?.purl) {
       continue;
@@ -2787,7 +3034,12 @@ export async function createEvinseFile(sliceArtefacts, options) {
         .map((l) => parseOccurrenceEvidenceLocation(l));
       occEvidencePresent = true;
     }
-    const dfFrames = dataFlowFrames[comp.purl];
+    const compKey = versionlessPurlKey(comp.purl);
+    let dfFrames = dataFlowFrames[comp.purl];
+    const extraFrames = compKey ? versionlessFrames[compKey] : undefined;
+    if (extraFrames?.length) {
+      dfFrames = [...(dfFrames || []), ...extraFrames];
+    }
     if (dfFrames?.length) {
       if (!comp.evidence) {
         comp.evidence = {};
@@ -2801,10 +3053,20 @@ export async function createEvinseFile(sliceArtefacts, options) {
       }
     }
     // Add crypto tags if this purl offers any generation algorithm
-    if (
-      cryptoGeneratePurls?.[comp.purl] &&
-      Array.from(cryptoGeneratePurls[comp.purl]).length
-    ) {
+    let compCryptoPurls = cryptoGeneratePurls?.[comp.purl];
+    const extraCrypto = compKey ? versionlessCrypto[compKey] : undefined;
+    if (extraCrypto?.size) {
+      compCryptoPurls = new Set([...(compCryptoPurls || []), ...extraCrypto]);
+      // The provides section below looks pool entries up by bom-ref, so the
+      // merged set has to be reachable that way too.
+      if (depCryptoPurls) {
+        depCryptoPurls[comp.purl] = compCryptoPurls;
+        if (comp["bom-ref"]) {
+          depCryptoPurls[comp["bom-ref"]] = compCryptoPurls;
+        }
+      }
+    }
+    if (compCryptoPurls && Array.from(compCryptoPurls).length) {
       comp.tags = ["crypto", "crypto-generate"];
     }
   } // for
@@ -2836,14 +3098,14 @@ export async function createEvinseFile(sliceArtefacts, options) {
   }
   // Fix the dependencies section with provides information
   if (
-    cryptoGeneratePurls &&
-    Object.keys(cryptoGeneratePurls).length &&
+    depCryptoPurls &&
+    Object.keys(depCryptoPurls).length &&
     bomJson.dependencies
   ) {
     const newDependencies = [];
     for (const depObj of bomJson.dependencies) {
-      if (depObj.ref && cryptoGeneratePurls[depObj.ref]) {
-        const providedAlgos = Array.from(cryptoGeneratePurls[depObj.ref]);
+      if (depObj.ref && depCryptoPurls[depObj.ref]) {
+        const providedAlgos = Array.from(depCryptoPurls[depObj.ref]);
         if (providedAlgos.length) {
           depObj.provides = providedAlgos;
         }
@@ -3088,15 +3350,15 @@ export function collectReachableFrames(_language, reachablesSlice) {
       if (tagStr.includes("crypto")) {
         isCryptoFlow = true;
       }
+      // Join with a space: findCryptoAlgos treats every non-alphanumeric as a
+      // word separator, and a space is the one separator cleanStr keeps.
       if (isCryptoFlow && fnode.code) {
-        codeSnippets = `${codeSnippets}\\n${fnode.code}`;
+        codeSnippets = `${codeSnippets} ${fnode.code}`;
       }
-      if (
-        tagStr.includes("crypto-generate") ||
-        fnode.code.includes("encrypt") ||
-        fnode.code.includes("decrypt") ||
-        fnode.code.includes("sign")
-      ) {
+      // Pool membership is tag-driven: a node contributes its pkg: tags only
+      // when the tagger marked it crypto-generate. Code substring tests read
+      // assign/design/signup into encrypt/decrypt/sign and are gone.
+      if (tagStr.includes("crypto-generate")) {
         cpurls = tagStr.split(", ").filter((t) => t.startsWith("pkg:"));
         for (const cpurl of cpurls) {
           if (!cryptoGeneratePurls[cpurl]) {
@@ -3299,6 +3561,155 @@ export function getClassTypeFromSignature(language, typeFullName) {
   return simplifyType(typeFullName);
 }
 
+const JS_LANGUAGES = ["javascript", "js", "ts", "typescript"];
+
+/**
+ * Add every location of a set to a purl's locations (Set.add takes a single value).
+ *
+ * @param {Set<string>} target purl location set
+ * @param {Set<string>|undefined} locations locations to add
+ */
+function addAllLocations(target, locations) {
+  for (const l of locations || []) {
+    target.add(l);
+  }
+}
+
+/**
+ * npm package name of a JavaScript module specifier: `@scope/pkg/sub` -> `@scope/pkg`,
+ * `lodash/fp` -> `lodash`. Node.js builtins (`node:fs`, `fs`) are not packages.
+ *
+ * @param {string} module module specifier
+ * @returns {string|undefined} package name
+ */
+export function jsPackageOfModule(module) {
+  if (!module || module.startsWith("node:") || module.startsWith(".")) {
+    return undefined;
+  }
+  const parts = module.split("/");
+  const pkg = module.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0];
+  if (isNodeBuiltin(pkg)) {
+    return undefined;
+  }
+  return pkg;
+}
+
+function isNodeBuiltin(name) {
+  return NODE_BUILTINS.has(name);
+}
+
+const NODE_BUILTINS = new Set(builtinModules);
+
+const jsPurlsByPackageCache = new WeakMap();
+
+function jsPurlsByPackage(purlImportsMap) {
+  let byPackage = jsPurlsByPackageCache.get(purlImportsMap);
+  if (!byPackage) {
+    byPackage = {};
+    for (const apurl of Object.keys(purlImportsMap || {})) {
+      try {
+        const purlObj = Purl.parse(apurl);
+        if (purlObj.type !== "npm") {
+          continue;
+        }
+        const name = purlObj.namespace
+          ? `${purlObj.namespace}/${purlObj.name}`
+          : purlObj.name;
+        (byPackage[name] = byPackage[name] || []).push(apurl);
+      } catch (_e) {
+        // not a valid purl
+      }
+    }
+    jsPurlsByPackageCache.set(purlImportsMap, byPackage);
+  }
+  return byPackage;
+}
+
+/**
+ * Attribute a JavaScript usage's module-qualified entries to the packages providing them.
+ *
+ * Each call entry with a `module` is a use of that module's package at the call's line. When
+ * the slice's object is an import binding (defined by a require/import naming the module),
+ * every call the object takes part in is a use of that package too.
+ *
+ * @param {Object} ausage usage entry of an object slice
+ * @param {string} fileName file of the slice
+ * @param {Object} purlImportsMap purl -> imported modules and symbols
+ * @param {Object} purlLocationMap purl -> Set of `file#line`
+ */
+export function attributeJsModules(
+  ausage,
+  fileName,
+  purlImportsMap,
+  purlLocationMap,
+) {
+  const byPackage = jsPurlsByPackage(purlImportsMap);
+  const record = (module, line) => {
+    const pkg = jsPackageOfModule(module);
+    if (!pkg || !line) {
+      return;
+    }
+    for (const apurl of byPackage[pkg] || []) {
+      if (!purlLocationMap[apurl]) {
+        purlLocationMap[apurl] = new Set();
+      }
+      purlLocationMap[apurl].add(`${fileName}#${line}`);
+    }
+  };
+  const calls = []
+    .concat(ausage?.invokedCalls || [])
+    .concat(ausage?.argToCalls || []);
+  for (const c of [ausage?.targetObj, ausage?.definedBy, ...calls]) {
+    if (c?.module) {
+      record(c.module, c.lineNumber);
+    }
+  }
+  // Only an import binding stands for its module: a value merely returned by a package's call
+  // (`const s = purl.toString()`) is not a use of that package wherever it goes.
+  const definedBy = ausage?.definedBy;
+  const isImportBinding =
+    definedBy?.name === "require" ||
+    definedBy?.name === "import" ||
+    /^(require|import)\(/.test(definedBy?.code || "");
+  const bindingModule = isImportBinding ? definedBy?.module : undefined;
+  if (bindingModule) {
+    for (const c of calls) {
+      record(bindingModule, c?.lineNumber);
+    }
+  }
+}
+
+/**
+ * Attribute a callsites slice's records to the packages providing their modules.
+ *
+ * Each record of `{"callsites": [...]}` (atom `callsites` command) is one external use site
+ * carrying its own file and line; the record is an occurrence of every purl whose package
+ * matches the record's module.
+ *
+ * @param {Object} callsitesSlice callsites slice with a `callsites` array
+ * @param {Object} purlImportsMap purl -> imported modules and symbols
+ * @param {Object} purlLocationMap purl -> Set of `file#line`
+ */
+export function attributeJsCallsites(
+  callsitesSlice,
+  purlImportsMap,
+  purlLocationMap,
+) {
+  const byPackage = jsPurlsByPackage(purlImportsMap);
+  for (const record of callsitesSlice?.callsites || []) {
+    const pkg = jsPackageOfModule(record?.module);
+    if (!pkg || !(record.line > 0)) {
+      continue;
+    }
+    for (const apurl of byPackage[pkg] || []) {
+      if (!purlLocationMap[apurl]) {
+        purlLocationMap[apurl] = new Set();
+      }
+      purlLocationMap[apurl].add(`${record.file}#${record.line}`);
+    }
+  }
+}
+
 function addToOverrides(lKeyOverrides, atype, fileName, ausageLineNumber) {
   if (!lKeyOverrides[atype]) {
     lKeyOverrides[atype] = new Set();