@cdxgen/cdxgen 13.6.0 → 13.7.0

package/lib/cli/jsBom.js

@@ -1073,6 +1073,7 @@ export async function createNodejsBom(path, options) {
         allImports,
         allExports,
         options.deep,
+        { srcDir: path },
       );
       return buildBomNSData(options, pkgList, "npm", {
         allImports,
@@ -1106,6 +1107,7 @@ export async function createNodejsBom(path, options) {
         allImports,
         allExports,
         options.deep,
+        { srcDir: path, dependencies },
       );
       pkgList = propagateRequiredScopeFromDependencies(pkgList, dependencies);
       pkgList = markNpmTypesPackagesAsExcluded(pkgList);
@@ -1551,6 +1553,7 @@ export async function createNodejsBom(path, options) {
     allImports,
     allExports,
     options.deep,
+    { srcDir: path, dependencies, parentComponent },
   );
   if (mcpInventory.components?.length) {
     pkgList = trimComponents(pkgList.concat(mcpInventory.components));

package/lib/cli/jvmBom.js

@@ -41,11 +41,14 @@ import {
 } from "../core/projectTooling.js";
 import { extractJarArchive, getMvnMetadata } from "../ecosystems/ecosystems.js";
 import {
+  applyGradleVerificationMetadata,
   buildGradleCommandArguments,
   buildObjectForGradleModule,
   collectGradleDependencies,
   excludeGradleBuildTooling,
   executeParallelGradleProperties,
+  findGradleLockfiles,
+  findGradleVerificationMetadata,
   findMillDaemons,
   getGradleCommand,
   getMavenCommand,
@@ -53,14 +56,18 @@ import {
   getMillVersion,
   gradleArgsFromEnv,
   gradleDependencyTasks,
+  gradleVerificationMainArtifact,
   hasGradleInvocationFailure,
   isProjectToolingAllowed,
   loadGradleModulesForReports,
   parseGradleDep,
   parseGradleInfoLogsForUrls,
+  parseGradleLockfiles,
   parseGradleProperties,
   parseGradleResolvedDistributions,
+  parseGradleVerificationMetadata,
   parseGradleVersionCatalog,
+  readGradleRootProjectName,
   reconcileGradleComponents,
   recordGradleInvocationFailure,
   splitOutputByGradleProjects,
@@ -645,6 +652,33 @@ export async function createJavaBom(path, options) {
   let jarNSMapping = {};
   let pkgList = [];
   let dependencies = [];
+  // The committed gradle/verification-metadata.xml of this build, if any,
+  // and the metadata parsed from it exactly once. These live at function
+  // scope because the fallback runs inside the Gradle block below while the
+  // enrichment runs after getMvnMetadata, outside the try that guards the
+  // per-tool sections, so a deferred failure keeps the enrichment too.
+  let gradleVerificationFile;
+  let gradleVerificationRootDir;
+  let gradleVerificationData;
+  let gradleVerificationParsed = false;
+  const gradleVerification = () => {
+    if (!gradleVerificationParsed) {
+      gradleVerificationParsed = true;
+      if (gradleVerificationFile) {
+        gradleVerificationData = parseGradleVerificationMetadata(
+          gradleVerificationFile,
+          { rootDir: gradleVerificationRootDir },
+        );
+        if (gradleVerificationData) {
+          const { configuration } = gradleVerificationData;
+          thoughtLog(
+            `${gradleVerificationFile} records ${configuration.trustedKeyCount} trusted key(s), ${configuration.trustedArtifactRuleCount} trust rule(s), ${configuration.ignoredKeyCount} ignored key(s) and ${configuration.keyServerCount} key server(s).`,
+          );
+        }
+      }
+    }
+    return gradleVerificationData;
+  };
   // cyclone-dx-maven plugin creates a component for the app under metadata
   // This is subsequently referred to in the dependencies list
   let parentComponent = {};
@@ -1436,15 +1470,51 @@ export async function createJavaBom(path, options) {
         "Hmm, there is a gradle.properties file. Do we need any private modules or custom JVM arguments for this project 🤔?",
       );
     }
-    // Execute gradle properties
-    if (
-      gradleFiles?.length &&
-      isPackageManagerAllowed(
-        "gradle",
-        ["maven", "bazel", "sbt", "mill"],
-        options,
-      )
-    ) {
+    // The package-manager gate the Gradle invocations below share: a scan
+    // that prefers another JVM build tool over Gradle reads no Gradle
+    // lockfiles either.
+    const gradleManagerAllowed = isPackageManagerAllowed(
+      "gradle",
+      ["maven", "bazel", "sbt", "mill"],
+      options,
+    );
+    // The committed Gradle dependency lockfiles record the resolved versions
+    // of every locked configuration, so they are an inventory source that
+    // needs no Gradle run. They are looked for only in a Gradle build: a
+    // Maven-rooted scan does not pick up a nested sample's lockfile.
+    const gradleLockFiles =
+      gradleFiles?.length && gradleManagerAllowed
+        ? findGradleLockfiles(gradleRootPath, options)
+        : [];
+    // The committed gradle/verification-metadata.xml records the checksums
+    // and PGP key ids Gradle verified when `gradle
+    // --write-verification-metadata` last ran. Like the lockfiles, it is an
+    // inventory source that needs no Gradle run, and it is looked for only in
+    // a Gradle build.
+    gradleVerificationFile =
+      gradleFiles?.length && gradleManagerAllowed
+        ? findGradleVerificationMetadata(gradleRootPath)
+        : undefined;
+    gradleVerificationRootDir = gradleRootPath;
+    // `gradle properties` evaluates the project's build scripts and `gradle
+    // dependencies` resolves the graph, so both belong to the
+    // dependency-tooling surface. The properties task runs whenever
+    // `isProjectToolingAllowed` lets it, as it names the root project and
+    // the subprojects; only the gradle-prefer-lockfile preference holds it
+    // back. The dependencies task also needs `options.installDeps`. When
+    // either check would stop the dependencies task, or when the preference
+    // asks for it, the lockfiles supply the components instead.
+    const gradleToolingAllowed = isProjectToolingAllowed(options);
+    const gradlePreferLockfile = isFeatureEnabled(
+      options,
+      "gradle-prefer-lockfile",
+    );
+    const gradleSkipProperties =
+      gradlePreferLockfile && gradleLockFiles.length > 0;
+    const gradleUseLockfiles =
+      gradleLockFiles.length > 0 &&
+      (gradlePreferLockfile || !gradleToolingAllowed || !options.installDeps);
+    if (gradleFiles?.length && gradleManagerAllowed) {
       const wrapperInfo = readGradleWrapperVersion(gradleRootPath);
       if (wrapperInfo) {
         try {
@@ -1506,6 +1576,177 @@ export async function createJavaBom(path, options) {
           // ignore
         }
       }
+    }
+    // A module of this build that another one consumes by its coordinates is
+    // a project, not a dependency, so the fallback sources below drop it.
+    const dropGradleModuleComponents = (pkgs) => {
+      const moduleRefs = new Set(
+        [parentComponent, ...(parentComponent?.components || [])]
+          .map((c) => c?.["bom-ref"])
+          .filter(Boolean),
+      );
+      return pkgs.filter((pkg) => !moduleRefs.has(pkg["bom-ref"]));
+    };
+    // Without `gradle properties` nothing named the root project. The
+    // settings script names it, and the directory name stands in when it
+    // does not, so the BOM still has a primary component.
+    const ensureGradleParentComponent = () => {
+      if (!parentComponent || !Object.keys(parentComponent).length) {
+        const rootProjectName = readGradleRootProjectName(gradleRootPath);
+        parentComponent = createDefaultParentComponent(
+          gradleRootPath,
+          "maven",
+          rootProjectName && !("project-name" in options)
+            ? {
+                ...options,
+                "project-name": rootProjectName,
+                projectName: rootProjectName,
+              }
+            : options,
+        );
+      }
+    };
+    // The lockfiles stand in for the Gradle dependency resolution this scan
+    // is not making, prefers not to make, or that produced nothing. They
+    // record resolved versions but no graph, so the components carry no
+    // dependency edges and the scan records what that costs. Returns the
+    // number of components added.
+    const addGradleLockfileComponents = () => {
+      const lockfilePkgs = dropGradleModuleComponents(
+        parseGradleLockfiles(gradleLockFiles, {
+          rootDir: gradleRootPath,
+        }),
+      );
+      if (!lockfilePkgs.length) {
+        return 0;
+      }
+      pkgList = pkgList.concat(lockfilePkgs);
+      recordDegradation("jvm.gradle.lockfile-only", {
+        ecosystem: "java",
+        tool: "gradle",
+        impact: "transitive-deps",
+        detail:
+          "The components came from Gradle dependency lockfiles, which record no dependency graph between them.",
+      });
+      ensureGradleParentComponent();
+      return lockfilePkgs.length;
+    };
+    // The version catalog and, on request, the verification file declare
+    // coordinates without resolving them, so both are used only when Gradle
+    // and the lockfiles produced no dependency information at all. The call
+    // inside the Gradle run block happens before its failure paths, so a
+    // build whose static sources resolved it is not degraded twice and not
+    // failed with --fail-on-error over a BOM that has components. The
+    // verification fallback stays off unless the
+    // gradle-verification-fallback feature flag asks for it: the file
+    // records what the build resolved when --write-verification-metadata
+    // ran, which may be stale, and its components can only be optional.
+    // Both belong to a Gradle build, so a scan without Gradle build files,
+    // or one that prefers another JVM build tool, reads neither.
+    const addGradleStaticFallbackComponents = () => {
+      if (!gradleFiles?.length || !gradleManagerAllowed || pkgList.length) {
+        return;
+      }
+      const catalogFiles = getAllFiles(
+        path,
+        `${options.multiProject ? "**/" : ""}gradle/libs.versions.toml`,
+        options,
+      );
+      for (const catalogFile of catalogFiles) {
+        if (DEBUG_MODE) {
+          console.log(`Parsing ${catalogFile}`);
+        }
+        const dlist = parseGradleVersionCatalog(catalogFile);
+        if (dlist?.length) {
+          pkgList = pkgList.concat(dlist);
+        }
+      }
+      if (
+        pkgList.length ||
+        !gradleVerificationFile ||
+        !isFeatureEnabled(options, "gradle-verification-fallback")
+      ) {
+        return;
+      }
+      const verificationMetadata = gradleVerification();
+      if (!verificationMetadata) {
+        return;
+      }
+      const verificationPkgs = [];
+      for (const component of verificationMetadata.components.values()) {
+        // A Gradle plugin marker coordinate publishes only a POM that
+        // points at the real plugin, so it is not a dependency of the
+        // build, and a coordinate without a main artifact is a parent or a
+        // BOM rather than a component of this BOM.
+        if (component.name.endsWith(".gradle.plugin")) {
+          continue;
+        }
+        if (!gradleVerificationMainArtifact(component, false)) {
+          continue;
+        }
+        const purl = mavenPurl(
+          component.group,
+          component.name,
+          component.version,
+          {
+            type: "jar",
+          },
+        );
+        if (!purl) {
+          continue;
+        }
+        verificationPkgs.push({
+          group: component.group,
+          name: component.name,
+          version: component.version,
+          qualifiers: { type: "jar" },
+          type: "library",
+          // A component with no scope counts as required, and the file
+          // cannot tell a runtime dependency from build tooling, so the
+          // components are optional.
+          scope: "optional",
+          purl,
+          "bom-ref": decodeURIComponent(purl),
+          // The digests are merged in at the end of the scan, from the file
+          // or from the artifact itself when the local cache holds it.
+          properties: [
+            { name: "internal:SrcFile", value: gradleVerificationFile },
+            { name: "cdx:gradle:verificationMetadata", value: "true" },
+          ],
+          evidence: {
+            identity: {
+              field: "purl",
+              confidence: 1,
+              concludedValue: purl,
+              methods: [
+                {
+                  technique: "manifest-analysis",
+                  confidence: 1,
+                  value: gradleVerificationFile,
+                },
+              ],
+            },
+          },
+        });
+      }
+      const addedPkgs = dropGradleModuleComponents(verificationPkgs);
+      if (addedPkgs.length) {
+        pkgList = pkgList.concat(addedPkgs);
+        recordDegradation("jvm.gradle.verification-metadata-only", {
+          ecosystem: "java",
+          tool: "gradle",
+          impact: "transitive-deps",
+          detail:
+            "The components came from gradle/verification-metadata.xml, which records no dependency graph between them.",
+        });
+        ensureGradleParentComponent();
+        thoughtLog(
+          `Obtained ${addedPkgs.length} components from ${gradleVerificationFile}. It says nothing about which module depends on which, and nothing about scopes.`,
+        );
+      }
+    };
+    // Execute gradle properties
+    if (gradleFiles?.length && gradleManagerAllowed && !gradleSkipProperties) {
       let includedBuilds = [];
       let allProjectsStr = [];
       if (readEnvironmentVariable("GRADLE_INCLUDED_BUILDS")) {
@@ -1529,10 +1770,6 @@ export async function createJavaBom(path, options) {
       if (resolveGradleDistribution && gradleInitArgs.length) {
         gradleInitArgs.push("-PcdxgenResolveDistribution=true");
       }
-      // `gradle properties` evaluates the project's build scripts, so it is
-      // part of the dependency-tooling surface gated by --no-install-deps
-      // (and the pre-build lifecycle).
-      const gradleToolingAllowed = isProjectToolingAllowed(options);
       if (gradleToolingAllowed) {
         parallelPropTaskOut = executeParallelGradleProperties(
           gradleRootPath,
@@ -1712,14 +1949,39 @@ export async function createJavaBom(path, options) {
         });
       }
     }
+    if (gradleUseLockfiles) {
+      const lockfileCount = addGradleLockfileComponents();
+      if (lockfileCount) {
+        console.log(
+          `Using the dependencies locked by ${gradleLockFiles.length} Gradle lockfile(s) instead of executing 'gradle dependencies'.`,
+        );
+        thoughtLog(
+          `Obtained ${lockfileCount} components from ${gradleLockFiles.length} Gradle lockfile(s). A lockfile is flat, so it says nothing about which module depends on which.`,
+        );
+        // --deep reads the jar namespaces of the versions the local Gradle
+        // cache holds, as it does after a Gradle run; a cold cache yields
+        // nothing.
+        if (options.resolveClass || options.deep) {
+          const tmpjarNSMapping = await collectJarNS(GRADLE_CACHE_DIR);
+          if (tmpjarNSMapping && Object.keys(tmpjarNSMapping).length) {
+            jarNSMapping = { ...jarNSMapping, ...tmpjarNSMapping };
+          }
+        }
+      } else {
+        thoughtLog(
+          "The Gradle lockfiles yielded no components, so the remaining static sources are tried.",
+        );
+      }
+    }
+    // Components that came from somewhere other than this Gradle run, such
+    // as a Maven build in the same root, so the decisions below look only at
+    // what Gradle itself produced.
+    const pkgCountBeforeGradleRun = pkgList.length;
     if (
       gradleFiles?.length &&
       options.installDeps &&
-      isPackageManagerAllowed(
-        "gradle",
-        ["maven", "bazel", "sbt", "mill"],
-        options,
-      )
+      gradleManagerAllowed &&
+      !gradleUseLockfiles
     ) {
       allProjects.push(parentComponent);
       const gradleCmd = getGradleCommand(gradleRootPath, null, options);
@@ -1848,6 +2110,23 @@ export async function createJavaBom(path, options) {
         }
         reconcileGradleComponents(pkgList);
       }
+      const gradleRunPkgCount = pkgList.length - pkgCountBeforeGradleRun;
+      if (!gradleRunPkgCount && gradleLockFiles.length) {
+        // Gradle produced no components of its own. The lockfiles are the
+        // next source before the failure paths below: Gradle may have run
+        // fine over configurations the project never locked, or failed
+        // outright while the committed lockfiles still describe the build.
+        const lockfileCount = addGradleLockfileComponents();
+        if (lockfileCount) {
+          thoughtLog(
+            `Gradle produced no components, so the ${lockfileCount} components of ${gradleLockFiles.length} Gradle lockfile(s) were used instead.`,
+          );
+        }
+      }
+      // A catalog or verification fallback can supply these components when
+      // Gradle produced none, so they pass through the same distribution and
+      // subproject handling below.
+      addGradleStaticFallbackComponents();
       if (pkgList.length) {
         const fileToUrlMap = parseGradleInfoLogsForUrls(sstdout);
         // When the `resolve-gradle-distribution` feature flag is enabled, the init script
@@ -1894,11 +2173,21 @@ export async function createJavaBom(path, options) {
           }
         }
         thoughtLog(
-          `Obtained ${pkgList.length} components by executing the '${basename(gradleCmd)}' command.`,
+          gradleRunPkgCount
+            ? `Obtained ${pkgList.length} components by executing the '${basename(gradleCmd)}' command.`
+            : `Obtained ${pkgList.length} components from the static Gradle sources after '${basename(gradleCmd)}' produced none.`,
         );
         if (DEBUG_MODE) {
           console.log("Obtained", pkgList.length, "from this gradle project.");
         }
+        if (gradleRunPkgCount && gradleLockFiles.length) {
+          // Gradle resolved against the lockfiles itself, so the versions it
+          // reports already are the locked ones and parsing the files again
+          // would add nothing.
+          thoughtLog(
+            `Gradle enforced the ${gradleLockFiles.length} Gradle lockfile(s) of this build, so they are not parsed separately.`,
+          );
+        }
       } else if (hasGradleInvocationFailure()) {
         // The invocation failure is already ranked, and an empty
         // configuration is what that failure looks like from here: reporting
@@ -1964,29 +2253,14 @@ export async function createJavaBom(path, options) {
           jarNSMapping = { ...jarNSMapping, ...tmpjarNSMapping };
         }
       }
-
-      // A version catalog declares coordinates without resolving them, so it
-      // is used only when Gradle produced no dependency information at all.
-      // The emitted components carry cdx:gradle:catalog=true to mark them as
-      // declared rather than resolved.
-      if (!pkgList.length) {
-        const catalogFiles = getAllFiles(
-          path,
-          `${options.multiProject ? "**/" : ""}gradle/libs.versions.toml`,
-          options,
-        );
-        for (const catalogFile of catalogFiles) {
-          if (DEBUG_MODE) {
-            console.log(`Parsing ${catalogFile}`);
-          }
-          const dlist = parseGradleVersionCatalog(catalogFile);
-          if (dlist?.length) {
-            pkgList = pkgList.concat(dlist);
-          }
-        }
-      }
     }
 
+    // Outside the installDeps block on purpose: a scan with dependency
+    // installation disabled reaches the static sources through the lockfile
+    // path instead of the Gradle run, and a scan whose Gradle run was
+    // skipped entirely needs them here.
+    addGradleStaticFallbackComponents();
+
     // Bazel
     // Look for the BUILD file only in the root directory
     // NOTE: This can match BUILD files used by perl, so could lead to errors in some projects
@@ -2907,6 +3181,57 @@ export async function createJavaBom(path, options) {
   pkgList = await getMvnMetadata(pkgList, jarNSMapping, false, {
     skipPurls: ownComponentRefs(parentComponent),
   });
+  // The verification file is the last enrichment, after getMvnMetadata has
+  // hashed the jars of the local cache: a digest of the artifact itself is
+  // the stronger claim, so the recorded digests only fill the algorithms a
+  // component still lacks, and a differing digest of the same algorithm is
+  // flagged, never applied. Whatever source found the component keeps the
+  // identity evidence of that source.
+  if (gradleVerificationFile) {
+    const verificationMetadata = gradleVerification();
+    if (verificationMetadata) {
+      const enrichedCount = applyGradleVerificationMetadata(
+        pkgList,
+        verificationMetadata,
+        gradleVerificationFile,
+      );
+      if (enrichedCount) {
+        thoughtLog(
+          `Enriched ${enrichedCount} component(s) with the checksums that ${gradleVerificationFile} records.`,
+        );
+      }
+      // Whether Gradle verified metadata and signatures is a fact about the
+      // whole build, so it lands on the primary component. Only the flags
+      // the file actually writes are emitted.
+      const { configuration } = verificationMetadata;
+      if (parentComponent && Object.keys(parentComponent).length) {
+        const parentProperties = parentComponent.properties || [];
+        if (
+          configuration.verifyMetadata !== undefined &&
+          !parentProperties.some((p) => p.name === "cdx:gradle:verifyMetadata")
+        ) {
+          parentProperties.push({
+            name: "cdx:gradle:verifyMetadata",
+            value: String(configuration.verifyMetadata),
+          });
+        }
+        if (
+          configuration.verifySignatures !== undefined &&
+          !parentProperties.some(
+            (p) => p.name === "cdx:gradle:verifySignatures",
+          )
+        ) {
+          parentProperties.push({
+            name: "cdx:gradle:verifySignatures",
+            value: String(configuration.verifySignatures),
+          });
+        }
+        if (parentProperties.length) {
+          parentComponent.properties = parentProperties;
+        }
+      }
+    }
+  }
   return buildBomNSData(options, pkgList, "maven", {
     src: path,
     nsMapping: jarNSMapping,

package/lib/cli/managedBom.js

@@ -147,6 +147,7 @@ import {
   dosaiFailureReported,
   dosaiMethodsSectionsArgument,
   dosaiReportFileOmittedSections,
+  dosaiSlicesFileIsFresh,
   dosaiToolComponents,
   isDosaiDotnetLanguage,
   normalizeDosaiServiceMap,
@@ -2505,9 +2506,13 @@ export async function createCsharpBom(path, options) {
         // Anything else needs only the sections cdxgen reads, so dosai
         // leaves the rest out (Metadata.OmittedSections names it).
         const willRunEvinse = runsEvidenceAnalysis(options);
-        // Reuse an existing slice as-is, with one exception: a trimmed file
+        // Reuse an existing slice as-is, with two exceptions. A trimmed file
         // (an earlier --deep run left it behind) is regenerated full before
-        // an evidence run uses it, so dosai still runs once per scan.
+        // an evidence run uses it, so dosai still runs once per scan. A slice
+        // older than the sources it describes is regenerated for every run:
+        // it holds the occurrences of the sources as they were when it was
+        // written, so reusing one keeps occurrences of call sites that no
+        // longer exist (issue 4675).
         let reuseExisting = safeExistsSync(slicesFile);
         if (reuseExisting && willRunEvinse) {
           const omitted = dosaiReportFileOmittedSections(slicesFile);
@@ -2520,6 +2525,17 @@ export async function createCsharpBom(path, options) {
             reuseExisting = false;
           }
         }
+        if (
+          reuseExisting &&
+          !dosaiSlicesFileIsFresh(slicesFile, path, options)
+        ) {
+          if (DEBUG_MODE) {
+            console.log(
+              `The existing dosai methods slice "${slicesFile}" is older than the sources it describes; regenerating it.`,
+            );
+          }
+          reuseExisting = false;
+        }
         // Create the slices file if it doesn't exist
         if (!reuseExisting) {
           thoughtLog(
@@ -2551,7 +2567,7 @@ export async function createCsharpBom(path, options) {
           }
         } else if (DEBUG_MODE) {
           console.log(
-            `Reusing the existing dosai methods slice "${slicesFile}" without checking whether it honours the current --exclude patterns. Delete the file to force a fresh run.`,
+            `Reusing the existing dosai methods slice "${slicesFile}", which is newer than the sources it describes. The slice is still not checked against the current --exclude patterns; delete the file to force a fresh run.`,
           );
         }
         pkgList = addEvidenceForDotnet(pkgList, slicesFile, {

package/lib/cli/nativeBom.js

@@ -1429,6 +1429,16 @@ export async function createDartBom(path, options) {
         pkgList = pkgList.concat(retMap.pkgList);
       }
       if (retMap?.rootList?.length) {
+        // A pubspec.lock read without its pubspec.yaml still names the
+        // project's direct dependencies; the project is then named after the
+        // directory that holds the lock file.
+        if (!parentComponent) {
+          parentComponent = createDefaultParentComponent(
+            dirname(f),
+            "generic",
+            options,
+          );
+        }
         const thisParentDependsOn = [
           {
             ref: parentComponent["bom-ref"],

package/lib/core/env.js

@@ -541,6 +541,32 @@ export const PROJECT_TYPE_ALIASES = {
   "ai-provenance": ["ai-provenance", "ai-authorship", "aicode", "ai-codegen"],
 };
 
+/**
+ * Project types, with their aliases, that inventory the host cdxgen runs on
+ * rather than the scan path: installed packages, users, shell history, IDE
+ * and browser extensions, or the Maven, Gradle, sbt, Cargo and Helm caches in
+ * the user's home directory. Only the operator may select them; neither a
+ * server request nor a config file in the scanned directory can.
+ *
+ * @type {Set<string>}
+ */
+export const HOST_SCOPE_PROJECT_TYPES = new Set(
+  [
+    "os",
+    "hbom",
+    "cargo-cache",
+    "helm-index",
+    "gradle-index",
+    "sbt-index",
+    "maven-index",
+    "vscode-extension",
+    "chrome-extension",
+    "agentic",
+  ]
+    .flatMap((key) => PROJECT_TYPE_ALIASES[key] || [key])
+    .concat(["maven-repo"]),
+);
+
 /** Map of base package manager to the array of accepted alias strings. */
 export const PACKAGE_MANAGER_ALIASES = {
   scala: ["sbt"],