@socketsecurity/cli 1.1.101 → 1.1.151

package/dist/types/commands/audit-log/output-audit-log.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"output-audit-log.d.mts","sourceRoot":"","sources":["../../../../src/commands/audit-log/output-audit-log.mts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC1D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAKjE,wBAAsB,cAAc,CAClC,MAAM,EAAE,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC,EACpE,EACE,OAAO,EACP,OAAO,EACP,UAAU,EACV,IAAI,EACJ,OAAO,EACR,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB,GACA,OAAO,CAAC,IAAI,CAAC,CAkCf;AAsBD,wBAAsB,YAAY,CAChC,SAAS,EAAE,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC,EACvE,EACE,OAAO,EACP,OAAO,EACP,IAAI,EACJ,OAAO,EACR,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB,GACA,OAAO,CAAC,MAAM,CAAC,CAsCjB;AAED,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,sBAAsB,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,EAC9D,EACE,OAAO,EACP,OAAO,EACP,IAAI,EACJ,OAAO,EACR,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;CAChB,GACA,OAAO,CAAC,MAAM,CAAC,CAiCjB"}
+{"version":3,"file":"output-audit-log.d.mts","sourceRoot":"","sources":["../../../../src/commands/audit-log/output-audit-log.mts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC1D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAKjE,wBAAsB,cAAc,CAClC,MAAM,EAAE,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC,EACpE,EACE,OAAO,EACP,OAAO,EACP,UAAU,EACV,IAAI,EACJ,OAAO,EACR,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB,GACA,OAAO,CAAC,IAAI,CAAC,CAkCf;AAsBD,wBAAsB,YAAY,CAChC,SAAS,EAAE,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC,EACvE,EACE,OAAO,EACP,OAAO,EACP,IAAI,EACJ,OAAO,EACR,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB,GACA,OAAO,CAAC,MAAM,CAAC,CA0CjB;AAED,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,sBAAsB,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,EAC9D,EACE,OAAO,EACP,OAAO,EACP,IAAI,EACJ,OAAO,EACR,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;CAChB,GACA,OAAO,CAAC,MAAM,CAAC,CAiCjB"}

package/dist/types/commands/ci/fetch-default-org-slug.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch-default-org-slug.d.mts","sourceRoot":"","sources":["../../../../src/commands/ci/fetch-default-org-slug.mts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAE9C,sEAAsE;AACtE,wBAAsB,iBAAiB,CACrC,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAoD1B"}
+{"version":3,"file":"fetch-default-org-slug.d.mts","sourceRoot":"","sources":["../../../../src/commands/ci/fetch-default-org-slug.mts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAE9C,sEAAsE;AACtE,wBAAsB,iBAAiB,CACrC,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAwD1B"}

package/dist/types/commands/ci/handle-ci.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"handle-ci.d.mts","sourceRoot":"","sources":["../../../../src/commands/ci/handle-ci.mts"],"names":[],"mappings":"AAaA,wBAAsB,QAAQ,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAqEnE"}
+{"version":3,"file":"handle-ci.d.mts","sourceRoot":"","sources":["../../../../src/commands/ci/handle-ci.mts"],"names":[],"mappings":"AAaA,wBAAsB,QAAQ,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAuEnE"}

package/dist/types/commands/config/handle-config-get.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"handle-config-get.d.mts","sourceRoot":"","sources":["../../../../src/commands/config/handle-config-get.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAEzD,wBAAsB,eAAe,CAAC,EACpC,GAAG,EACH,UAAU,EACX,EAAE;IACD,GAAG,EAAE,MAAM,WAAW,CAAA;IACtB,UAAU,EAAE,UAAU,CAAA;CACvB,iBAIA"}
+{"version":3,"file":"handle-config-get.d.mts","sourceRoot":"","sources":["../../../../src/commands/config/handle-config-get.mts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAW,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAEzD,wBAAsB,eAAe,CAAC,EACpC,GAAG,EACH,UAAU,EACX,EAAE;IACD,GAAG,EAAE,MAAM,WAAW,CAAA;IACtB,UAAU,EAAE,UAAU,CAAA;CACvB,iBAgBA"}

package/dist/types/commands/config/handle-config-set.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"handle-config-set.d.mts","sourceRoot":"","sources":["../../../../src/commands/config/handle-config-set.mts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAEzD,wBAAsB,eAAe,CAAC,EACpC,GAAG,EACH,UAAU,EACV,KAAK,EACN,EAAE;IACD,GAAG,EAAE,MAAM,WAAW,CAAA;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;CACd,iBAUA"}
+{"version":3,"file":"handle-config-set.d.mts","sourceRoot":"","sources":["../../../../src/commands/config/handle-config-set.mts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAW,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAEzD,wBAAsB,eAAe,CAAC,EACpC,GAAG,EACH,UAAU,EACV,KAAK,EACN,EAAE;IACD,GAAG,EAAE,MAAM,WAAW,CAAA;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;CACd,iBAyBA"}

package/dist/types/commands/config/output-config-set.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"output-config-set.d.mts","sourceRoot":"","sources":["../../../../src/commands/config/output-config-set.mts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAE1D,wBAAsB,eAAe,CACnC,MAAM,EAAE,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,EACnC,UAAU,EAAE,UAAU,iBA+BvB"}
+{"version":3,"file":"output-config-set.d.mts","sourceRoot":"","sources":["../../../../src/commands/config/output-config-set.mts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAE1D,wBAAsB,eAAe,CACnC,MAAM,EAAE,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,EACnC,UAAU,EAAE,UAAU,iBAwBvB"}

package/dist/types/commands/fix/cmd-fix.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"cmd-fix.d.mts","sourceRoot":"","sources":["../../../../src/commands/fix/cmd-fix.mts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAEV,iBAAiB,EAClB,MAAM,uCAAuC,CAAA;AAG9C,eAAO,MAAM,QAAQ,QAAQ,CAAA;AAQ7B,eAAO,MAAM,MAAM;;;;CAIlB,CAAA;AAgMD,iBAAe,GAAG,CAChB,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EAClC,UAAU,EAAE,UAAU,EACtB,EAAE,UAAU,EAAE,EAAE,iBAAiB,GAChC,OAAO,CAAC,IAAI,CAAC,CAwQf"}
+{"version":3,"file":"cmd-fix.d.mts","sourceRoot":"","sources":["../../../../src/commands/fix/cmd-fix.mts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAEV,iBAAiB,EAClB,MAAM,uCAAuC,CAAA;AAG9C,eAAO,MAAM,QAAQ,QAAQ,CAAA;AAQ7B,eAAO,MAAM,MAAM;;;;CAIlB,CAAA;AA4MD,iBAAe,GAAG,CAChB,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EAClC,UAAU,EAAE,UAAU,EACtB,EAAE,UAAU,EAAE,EAAE,iBAAiB,GAChC,OAAO,CAAC,IAAI,CAAC,CAqRf"}

package/dist/types/commands/fix/coana-fix.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"coana-fix.d.mts","sourceRoot":"","sources":["../../../../src/commands/fix/coana-fix.mts"],"names":[],"mappings":"AAmDA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAiE9C,wBAAsB,QAAQ,CAC5B,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC,CAAC,CA+nBjE"}
+{"version":3,"file":"coana-fix.d.mts","sourceRoot":"","sources":["../../../../src/commands/fix/coana-fix.mts"],"names":[],"mappings":"AAoDA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAwI9C,wBAAsB,QAAQ,CAC5B,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC,CAAC,CAsqBjE"}

package/dist/types/commands/fix/handle-fix.d.mts

@@ -17,6 +17,6 @@ type ConvertIdsOptions = {
  * Filters out invalid IDs and logs conversion results.
  */
 export declare function convertIdsToGhsas(ids: string[], options?: ConvertIdsOptions | undefined): Promise<string[]>;
-export declare function handleFix({ all, applyFixes, autopilot, coanaVersion, cwd, debug, disableExternalToolChecks, disableMajorUpdates, ecosystems, exclude, ghsas, include, minSatisfying, minimumReleaseAge, orgSlug, outputFile, outputKind, packageManagers, prCheck, prLimit, rangeStyle, showAffectedDirectDependencies, silence, spinner, unknownFlags }: HandleFixConfig): Promise<void>;
+export declare function handleFix({ all, applyFixes, autopilot, coanaVersion, cwd, debug, disableExternalToolChecks, disableMajorUpdates, ecosystems, exclude, excludePaths, ghsas, include, minSatisfying, minimumReleaseAge, orgSlug, outputFile, outputKind, packageManagers, prCheck, prLimit, rangeStyle, showAffectedDirectDependencies, silence, spinner, unknownFlags }: HandleFixConfig): Promise<void>;
 export {};
 //# sourceMappingURL=handle-fix.d.mts.map

package/dist/types/commands/fix/handle-fix.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"handle-fix.d.mts","sourceRoot":"","sources":["../../../../src/commands/fix/handle-fix.mts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sCAAsC,CAAA;AAKjE,MAAM,MAAM,eAAe,GAAG,KAAK,CACjC,SAAS,GAAG;IACV,UAAU,EAAE,OAAO,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,MAAM,EAAE,CAAA;CACvB,CACF,CAAA;AAED,KAAK,iBAAiB,GAAG;IACvB,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;CAC9B,CAAA;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EAAE,EACb,OAAO,CAAC,EAAE,iBAAiB,GAAG,SAAS,GACtC,OAAO,CAAC,MAAM,EAAE,CAAC,CA2EnB;AAED,wBAAsB,SAAS,CAAC,EAC9B,GAAG,EACH,UAAU,EACV,SAAS,EACT,YAAY,EACZ,GAAG,EACH,KAAK,EACL,yBAAyB,EACzB,mBAAmB,EACnB,UAAU,EACV,OAAO,EACP,KAAK,EACL,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,OAAO,EACP,UAAU,EACV,UAAU,EACV,eAAe,EACf,OAAO,EACP,OAAO,EACP,UAAU,EACV,8BAA8B,EAC9B,OAAO,EACP,OAAO,EACP,YAAY,EACb,EAAE,eAAe,iBA0DjB"}
+{"version":3,"file":"handle-fix.d.mts","sourceRoot":"","sources":["../../../../src/commands/fix/handle-fix.mts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sCAAsC,CAAA;AAKjE,MAAM,MAAM,eAAe,GAAG,KAAK,CACjC,SAAS,GAAG;IACV,UAAU,EAAE,OAAO,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,MAAM,EAAE,CAAA;CACvB,CACF,CAAA;AAED,KAAK,iBAAiB,GAAG;IACvB,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;CAC9B,CAAA;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EAAE,EACb,OAAO,CAAC,EAAE,iBAAiB,GAAG,SAAS,GACtC,OAAO,CAAC,MAAM,EAAE,CAAC,CA2EnB;AAED,wBAAsB,SAAS,CAAC,EAC9B,GAAG,EACH,UAAU,EACV,SAAS,EACT,YAAY,EACZ,GAAG,EACH,KAAK,EACL,yBAAyB,EACzB,mBAAmB,EACnB,UAAU,EACV,OAAO,EACP,YAAY,EACZ,KAAK,EACL,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,OAAO,EACP,UAAU,EACV,UAAU,EACV,eAAe,EACf,OAAO,EACP,OAAO,EACP,UAAU,EACV,8BAA8B,EAC9B,OAAO,EACP,OAAO,EACP,YAAY,EACb,EAAE,eAAe,iBA4DjB"}

package/dist/types/commands/fix/types.d.mts

@@ -12,6 +12,7 @@ export type FixConfig = {
     disableMajorUpdates: boolean;
     ecosystems: PURL_Type[];
     exclude: string[];
+    excludePaths: string[];
     ghsas: string[];
     include: string[];
     minimumReleaseAge: string;

package/dist/types/commands/fix/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","sourceRoot":"","sources":["../../../../src/commands/fix/types.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sCAAsC,CAAA;AAEnE,MAAM,MAAM,SAAS,GAAG;IACtB,GAAG,EAAE,OAAO,CAAA;IACZ,UAAU,EAAE,OAAO,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;IAClB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,OAAO,CAAA;IACd,yBAAyB,EAAE,OAAO,CAAA;IAClC,mBAAmB,EAAE,OAAO,CAAA;IAC5B,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,iBAAiB,EAAE,MAAM,CAAA;IACzB,aAAa,EAAE,OAAO,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,8BAA8B,EAAE,OAAO,CAAA;IACvC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,OAAO,GAAG,SAAS,CAAA;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAA;CACvB,CAAA"}
+{"version":3,"file":"types.d.mts","sourceRoot":"","sources":["../../../../src/commands/fix/types.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sCAAsC,CAAA;AAEnE,MAAM,MAAM,SAAS,GAAG;IACtB,GAAG,EAAE,OAAO,CAAA;IACZ,UAAU,EAAE,OAAO,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;IAClB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,OAAO,CAAA;IACd,yBAAyB,EAAE,OAAO,CAAA;IAClC,mBAAmB,EAAE,OAAO,CAAA;IAC5B,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,iBAAiB,EAAE,MAAM,CAAA;IACzB,aAAa,EAAE,OAAO,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,8BAA8B,EAAE,OAAO,CAAA;IACvC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,OAAO,GAAG,SAAS,CAAA;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAA;CACvB,CAAA"}

package/dist/types/commands/manifest/bazel/bazel-cquery.d.mts

@@ -0,0 +1,70 @@
+import type { BazelQueryOptions } from './bazel-query-runner.mts';
+// One Maven artifact recovered from the cquery stream. `ruleKind` is whatever
+// `ruleClass` jsonproto reports (`jvm_import`, `aar_import`, `java_library`,
+// `kt_jvm_import`, any future rules_jvm_external rule), so the type is open.
+// `deps` holds resolved versionless Maven coordinates (the parser resolves the
+// rule's label edges against this repo's own targets), not raw Bazel labels.
+export type ExtractedArtifact = {
+    deps: string[];
+    mavenCoordinates: string;
+    ruleKind: string;
+    ruleName: string;
+    sourceRepo?: string | undefined;
+};
+export type CqueryStatus = 'ok' | 'partial' | 'timeout' | 'empty' | 'error';
+export type CqueryRepoResult = {
+    repoName: string;
+    workspaceRelPath: string;
+    status: CqueryStatus;
+    artifacts: ExtractedArtifact[];
+    // Hub-prefixed dep labels the parser could not resolve to a coordinate
+    // (missing target or ambiguous suffix). A non-empty list means the graph
+    // is known-incomplete; the orchestrator flips the hub partial.
+    unresolvedLabels: string[];
+    stderr: string;
+    durationMs: number;
+};
+export type RunMetadataCqueryArgs = {
+    repoName: string;
+    workspaceRoot: string;
+    // Provenance label (e.g. "examples/dagger"). Empty string for the root
+    // workspace. Embedded in each artifact's `sourceRepo` as
+    // `workspace:<path>+repo:<name>`.
+    workspaceRelPath: string;
+    // Per-repo timeout in milliseconds. 60s default for auto-manifest;
+    // 120s for explicit invocation. Orchestrator picks; runner just enforces.
+    timeoutMs: number;
+    opts: BazelQueryOptions;
+};
+// Result of parsing one repo's cquery stream: the recovered artifacts (with
+// resolved coordinate edges in `deps`) plus any hub-prefixed dep labels that
+// could not be resolved.
+export type ParseCqueryResult = {
+    artifacts: ExtractedArtifact[];
+    unresolvedLabels: string[];
+};
+// Build the full cquery argv for a per-repo metadata cquery. Exposed for
+// argv-shape unit tests without touching `spawn`.
+export declare function buildMetadataCqueryArgv(repoName: string, opts: BazelQueryOptions): string[];
+// Strip the trailing version segment from a Maven coordinate, preserving any
+// packaging/classifier segments. `g:a:v` -> `g:a`,
+// `g:a:packaging:v` -> `g:a:packaging`,
+// `g:a:packaging:classifier:v` -> `g:a:packaging:classifier`. Coordinates with
+// fewer than 3 segments have no version to strip and are returned unchanged.
+// This matches depscan's `coordinateToParts` keying (position 3 = extension,
+// position 4 = classifier on the versionless key), so AAR/classifier artifacts
+// key correctly instead of being mis-keyed as bare `group:artifact` jars.
+export declare function versionlessCoordinate(coord: string): string;
+// Pure parser for the jsonproto cquery stream. Returns one
+// `ExtractedArtifact` per rule with a recoverable maven coordinate (its `deps`
+// holding resolved versionless coordinates) plus the set of hub-prefixed dep
+// labels that could not be resolved. The `sourceRepo` field carries
+// `<workspaceRelPath>:<repoName>` provenance when a workspace path was
+// provided; otherwise just the repo name.
+export declare function parseCqueryJsonproto(stdout: string, repoName: string, workspaceRelPath: string): ParseCqueryResult;
+// Spawn the per-repo metadata cquery, parse the result, and return a
+// structured outcome. On spawn timeout, return `status: 'timeout'` so the
+// orchestrator can reap the server (`bazel --output_user_root=<dir>
+// shutdown` + `rm -rf`) before moving on.
+export declare function runMetadataCqueryForRepo(args: RunMetadataCqueryArgs): Promise<CqueryRepoResult>;
+//# sourceMappingURL=bazel-cquery.d.mts.map

package/dist/types/commands/manifest/bazel/bazel-cquery.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bazel-cquery.d.mts","sourceRoot":"","sources":["../../../../../src/commands/manifest/bazel/bazel-cquery.mts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAEjE,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,gBAAgB,EAAE,MAAM,CAAA;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAA;AAE3E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,gBAAgB,EAAE,MAAM,CAAA;IACxB,MAAM,EAAE,YAAY,CAAA;IACpB,SAAS,EAAE,iBAAiB,EAAE,CAAA;IAC9B,uEAAuE;IACvE,yEAAyE;IACzE,+DAA+D;IAC/D,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,uEAAuE;IACvE,yDAAyD;IACzD,kCAAkC;IAClC,gBAAgB,EAAE,MAAM,CAAA;IACxB,mEAAmE;IACnE,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,iBAAiB,CAAA;CACxB,CAAA;AAED,4EAA4E;AAC5E,6EAA6E;AAC7E,yBAAyB;AACzB,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,iBAAiB,EAAE,CAAA;IAC9B,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAC3B,CAAA;AAqCD,yEAAyE;AACzE,kDAAkD;AAClD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,iBAAiB,GACtB,MAAM,EAAE,CAwBV;AAyED,6EAA6E;AAC7E,mDAAmD;AACnD,wCAAwC;AACxC,+EAA+E;AAC/E,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,0EAA0E;AAC1E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM3D;AAiKD,2DAA2D;AAC3D,+EAA+E;AAC/E,6EAA6E;AAC7E,oEAAoE;AACpE,uEAAuE;AACvE,0CAA0C;AAC1C,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,MAAM,GACvB,iBAAiB,CAmFnB;AAyBD,qEAAqE;AACrE,0EAA0E;AAC1E,oEAAoE;AACpE,0CAA0C;AAC1C,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,gBAAgB,CAAC,CAwE3B"}

package/dist/types/commands/manifest/bazel/bazel-pypi-discovery.d.mts

@@ -0,0 +1,44 @@
+import type { RepoProbe } from './bazel-repo-discovery.mts';
+// Result shape returned by `validatePypiHub`. Kept local to the PyPI module
+// since validation here is hub-alias-marker based (different from the
+// Maven-side tri-state classifier).
+export type ValidationResult = {
+    valid: boolean;
+    // Probe stdout — populated whenever the probe was reachable, even when
+    // validation rejects the hub. Empty string when the probe itself threw.
+    stdout: string;
+};
+// Parse `bazel mod dump_repo_mapping "" --output=json` output. Also accepts
+// the older streamed jsonproto shape (apparentName / apparent_name records).
+// PyPI-only; the Maven path consumes `bazel mod show_extension` instead.
+export declare function parseVisibleRepoCandidates(output: string): string[];
+export type PypiHubInfo = {
+    hubName: string;
+    source: 'MODULE.bazel' | 'WORKSPACE' | 'WORKSPACE.bazel' | '.bzl' | 'visible-repos' | 'default-seed' | 'bazel-mod-show-extension';
+    workspaceMode: 'bzlmod' | 'legacy' | 'unknown';
+    pythonVersion?: string | undefined;
+    requirementsLockLabel?: string | undefined;
+    requirementsLockPath?: string | undefined;
+    probeStdout: string;
+    visibleRepoNames?: string[] | undefined;
+};
+export type PypiHubCandidate = Omit<PypiHubInfo, 'probeStdout' | 'visibleRepoNames'>;
+export declare function parseBazelModPipExtensionCandidates(stdout: string, verbose?: boolean): PypiHubCandidate[];
+// Step 1: parse candidate pip hub names from Bzlmod MODULE.bazel and legacy
+// WORKSPACE / .bzl entry points.
+//
+// Precedence: Bzlmod (MODULE.bazel pip.parse) hits are pushed first, then
+// legacy (pip_parse / pip_install / pip_repository) hits. dedupCapped keeps
+// the first occurrence, so during migration scenarios where both
+// MODULE.bazel and WORKSPACE define a hub with the same name, the Bzlmod
+// entry wins implicitly. Pass verbose=true to surface dropped duplicates.
+export declare function parsePypiHubCandidates(cwd: string, verbose?: boolean): PypiHubCandidate[];
+// Step 2: validate a candidate by running the probe and confirming
+// `:pkg` labels or alias rules appear in stdout. Does NOT require
+// `pypi_name=` (that marker lives on spoke repos).
+export declare function validatePypiHub(hubName: string, probe: RepoProbe, verbose?: boolean): Promise<ValidationResult>;
+// Composition: parse, then validate each candidate; return validated subset
+// as a Map keyed by hub name with the validated PypiHubInfo.
+// Always seeds with the default 'pypi' hub name first.
+export declare function discoverPypiHubs(cwd: string, probe: RepoProbe, nativeCandidates?: string[], verbose?: boolean, bazelCommandCandidates?: PypiHubCandidate[]): Promise<Map<string, PypiHubInfo>>;
+//# sourceMappingURL=bazel-pypi-discovery.d.mts.map

package/dist/types/commands/manifest/bazel/bazel-pypi-discovery.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bazel-pypi-discovery.d.mts","sourceRoot":"","sources":["../../../../../src/commands/manifest/bazel/bazel-pypi-discovery.mts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAE3D,4EAA4E;AAC5E,sEAAsE;AACtE,oCAAoC;AACpC,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,OAAO,CAAA;IACd,yEAAuE;IACvE,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AA6CD,4EAA4E;AAC5E,6EAA6E;AAC7E,yEAAyE;AACzE,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CA8BnE;AAwCD,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EACF,cAAc,GACd,WAAW,GACX,iBAAiB,GACjB,MAAM,GACN,eAAe,GACf,cAAc,GACd,0BAA0B,CAAA;IAC9B,aAAa,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAA;IAC9C,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1C,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,WAAW,EAAE,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;CACxC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,WAAW,EACX,aAAa,GAAG,kBAAkB,CACnC,CAAA;AAED,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,OAAO,GAChB,gBAAgB,EAAE,CAoCpB;AA8GD,4EAA4E;AAC5E,iCAAiC;AACjC,EAAE;AACF,0EAA0E;AAC1E,4EAA4E;AAC5E,iEAAiE;AACjE,yEAAyE;AACzE,0EAA0E;AAC1E,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,OAAO,GAChB,gBAAgB,EAAE,CAoGpB;AAED,mEAAmE;AACnE,kEAAkE;AAClE,mDAAmD;AACnD,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,SAAS,EAChB,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,gBAAgB,CAAC,CA8B3B;AAOD,4EAA4E;AAC5E,6DAA6D;AAC7D,uDAAuD;AACvD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,EAChB,gBAAgB,CAAC,EAAE,MAAM,EAAE,EAC3B,OAAO,CAAC,EAAE,OAAO,EACjB,sBAAsB,CAAC,EAAE,gBAAgB,EAAE,GAC1C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAyDnC"}

package/dist/types/commands/manifest/bazel/bazel-pypi-parser.d.mts

@@ -0,0 +1,46 @@
+export type ExtractedPypiPackage = {
+    name: string;
+    version: string;
+    bazelName: string;
+    source?: 'lockfile' | 'spoke-tag' | undefined;
+    originalLine?: string | undefined;
+};
+export type ReachedPypiLabel = {
+    hubName: string;
+    originalLabel: string;
+    bazelName: string;
+    normalizedName: string;
+    apparentLabel: string;
+    spokeLabel?: string | undefined;
+};
+// Normalize a PyPI package name per PEP 503:
+// lowercase, then collapse `.`, `_`, and `-` runs to a single `-`.
+export declare function normalizePypiName(name: string): string;
+// Convert a Bazel underscore_name to a PyPI hyphenated-name.
+export declare function bazelNameToPypiName(bazelName: string): string;
+// Resolves a Bazel label or workspace-relative path to a filesystem path.
+// Returns undefined for labels that cannot be resolved locally.
+export declare function resolveRequirementsLockPath(label: string | undefined, cwd: string): string | undefined;
+// Parse a `requirements_lock.txt`-style file into a map keyed by normalized
+// PyPI name. This intentionally ignores unpinned PEP 508 requirement forms
+// because the Bazel extractor must emit exact package versions.
+export declare function parseRequirementsLock(text: string): Map<string, ExtractedPypiPackage>;
+// Read and parse a requirements lockfile from a resolved path, capping file
+// size. Returns undefined when the file is missing, oversized, or unreadable.
+export declare function readRequirementsLockFile(resolvedPath: string | undefined): Map<string, ExtractedPypiPackage> | undefined;
+export declare function parsePypiTagsFromBuildOutput(text: string): ExtractedPypiPackage | null;
+export declare function parseAliasActualFromBuildOutput(text: string): string | undefined;
+// Extract hub package labels from `bazel query` output that match
+// `@<hub>//<name>:pkg` patterns (both line-start and embedded in
+// `--output=build` deps arrays).
+export declare function filterReachedPypiPackages(queryOutput: string, hubName: string): ReachedPypiLabel[];
+// Collect name==version pairs for the reached closure, resolving versions
+// from the lockfile fast path or spoke-tag fallback. Enforces version
+// conflict detection and deterministic output.
+export declare function collectPypiPackages(reached: ReachedPypiLabel[], lockfile: Map<string, ExtractedPypiPackage> | undefined, spokeTagLookup: Map<string, ExtractedPypiPackage> | undefined): Array<{
+    name: string;
+    version: string;
+    source: string;
+    label: string;
+}>;
+//# sourceMappingURL=bazel-pypi-parser.d.mts.map

package/dist/types/commands/manifest/bazel/bazel-pypi-parser.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bazel-pypi-parser.d.mts","sourceRoot":"","sources":["../../../../../src/commands/manifest/bazel/bazel-pypi-parser.mts"],"names":[],"mappings":"AAoBA,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,UAAU,GAAG,WAAW,GAAG,SAAS,CAAA;IAC7C,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAChC,CAAA;AAED,6CAA6C;AAC7C,mEAAmE;AACnE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMtD;AAED,6DAA6D;AAC7D,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE7D;AAQD,0EAA0E;AAC1E,gEAAgE;AAChE,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,GAAG,EAAE,MAAM,GACV,MAAM,GAAG,SAAS,CAsDpB;AAsCD,4EAA4E;AAC5E,2EAA2E;AAC3E,gEAAgE;AAChE,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,GACX,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAkDnC;AAED,4EAA4E;AAC5E,8EAA8E;AAC9E,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,GAAG,SAAS,CAkB/C;AAOD,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,GACX,oBAAoB,GAAG,IAAI,CAiB7B;AAED,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CAGpB;AAED,kEAAkE;AAClE,iEAAiE;AACjE,iCAAiC;AACjC,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,GACd,gBAAgB,EAAE,CA2BpB;AAED,0EAA0E;AAC1E,sEAAsE;AACtE,+CAA+C;AAC/C,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,gBAAgB,EAAE,EAC3B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,GAAG,SAAS,EACvD,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,GAAG,SAAS,GAC5D,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqDzE"}

package/dist/types/commands/manifest/bazel/bazel-query-runner.d.mts

@@ -6,6 +6,13 @@ export type BazelQueryOptions = {
     bazelRc?: string;
     bazelFlags?: string;
     bazelOutputBase?: string;
+    // Per-invocation `--output_user_root` for server isolation. When set, all
+    // argv builders inject it as a startup flag so a timed-out Bazel server
+    // can be reaped via `bazel --output_user_root=<this> shutdown` + `rm -rf`
+    // without disturbing the user's shared output_user_root. The Maven
+    // orchestrator mkdtemp's a fresh path per invocation; the legacy PyPI
+    // path may leave it unset for now.
+    outputUserRoot?: string;
     env?: NodeJS.ProcessEnv;
     verbose?: boolean;
 };
@@ -19,23 +26,74 @@ export type BazelQueryResult = {
 // whitespace are not supported (documented limitation; same trust model as
 // gradleOpts).
 export declare function splitBazelFlags(flags: string | undefined): string[];
+// Build the shared startup-flag prefix for any bazel invocation. Centralised
+// so `--output_user_root` propagates to every spawn — principle 7 of the
+// Maven design requires per-invocation server isolation across query,
+// cquery, and `bazel mod` commands alike.
+declare function buildStartupFlags(opts: BazelQueryOptions): string[];
+declare function buildBazelModShowVisibleReposArgv(opts: BazelQueryOptions): string[];
+declare function buildBazelModShowMavenExtensionArgv(opts: BazelQueryOptions): string[];
+declare function buildBazelModShowPipExtensionArgv(opts: BazelQueryOptions): string[];
+declare function buildBazelArgv(queryStr: string, opts: BazelQueryOptions, output?: string): string[];
+// Lightweight presence-check cquery used by the tri-state probe classifier.
+// `--keep_going --output=label` keeps it fast even on partial-analysis
+// repos and avoids paying for `--output=jsonproto` plus
+// `--proto:output_rule_attrs` (which the heavier metadata extraction in
+// `bazel-cquery.mts` needs but the probe does not).
+declare function buildBazelProbeCqueryArgv(repoName: string, opts: BazelQueryOptions): string[];
 /**
  * Run `bazel query` with the standardized argv shape and capture
  * stdout/stderr/code. Wraps the call in a spinner that resolves on success
  * and fails on non-zero exit. Rejected spawn calls are normalized into a
  * BazelQueryResult so retry/skip handling can inspect stderr.
  */
-export declare function runBazelQuery(queryStr: string, opts: BazelQueryOptions): Promise<BazelQueryResult>;
+export declare function runBazelQuery(queryStr: string, opts: BazelQueryOptions, output?: string): Promise<BazelQueryResult>;
 /**
- * Bzlmod-native visible repository enumeration. This is only a candidate
- * source; callers must still validate each returned apparent repo name with a
- * semantic query for generated JVM Maven rules.
+ * Bzlmod-native visible repository enumeration. NOTE: only consumed by the
+ * legacy PyPI path; the Maven path uses `runBazelModShowMavenExtension`
+ * instead because `dump_repo_mapping` over-enumerates apparent names that
+ * are not Maven hubs.
  */
 export declare function runBazelModShowVisibleRepos(opts: BazelQueryOptions): Promise<BazelQueryResult>;
 /**
- * Build a `RepoProbe` (compatible with bazel-repo-discovery) bound to opts.
- * Used by `discoverMavenRepos` to validate candidate Maven repo
- * names against the running workspace.
+ * Bzlmod-native Maven hub enumeration via the rules_jvm_external maven
+ * extension. The text-format report lists every repo the extension
+ * generated; `parseShowExtensionOutput` (bazel-repo-discovery.mts)
+ * extracts the hubs from the `Fetched repositories:` section.
  */
-export declare function buildProbeFor(opts: BazelQueryOptions): RepoProbe;
+export declare function runBazelModShowMavenExtension(opts: BazelQueryOptions): Promise<BazelQueryResult>;
+/**
+ * Bzlmod-native rules_python pip extension usage inspection. Used by the
+ * PyPI path; kept here since the argv shape is identical to the maven
+ * variant modulo the extension target.
+ */
+export declare function runBazelModShowPipExtension(opts: BazelQueryOptions): Promise<BazelQueryResult>;
+/**
+ * Build a `RepoProbe` (compatible with bazel-repo-discovery's tri-state
+ * classifier) bound to opts. Runs the lightweight presence-check cquery
+ * `@<name>//... --output=label --keep_going` — cheap enough to attempt
+ * every conventional Maven hub name without triggering `repository_rule`
+ * fetches on undefined names (Exp 3).
+ */
+export declare function buildMavenProbeFor(opts: BazelQueryOptions): RepoProbe;
+/**
+ * Build a `RepoProbe` for validating pip hub candidates.
+ * Queries the hub for package targets (e.g. `@<hub>//...`) and returns the
+ * full result triple so the caller can check for `:pkg` labels or alias
+ * rules. Does NOT require `pypi_name=` tags in the hub output, because
+ * those tags live on spoke repos, not the hub alias layer.
+ */
+export declare function buildPypiProbeFor(opts: BazelQueryOptions): RepoProbe;
+// Re-exported for direct test access — useful when asserting on argv shape
+// without spawning. Returns the exact argv `runBazelModShowMavenExtension`
+// would pass to spawn.
+export declare const _internalArgvBuilders: {
+    buildBazelArgv: typeof buildBazelArgv;
+    buildBazelModShowMavenExtensionArgv: typeof buildBazelModShowMavenExtensionArgv;
+    buildBazelModShowPipExtensionArgv: typeof buildBazelModShowPipExtensionArgv;
+    buildBazelModShowVisibleReposArgv: typeof buildBazelModShowVisibleReposArgv;
+    buildBazelProbeCqueryArgv: typeof buildBazelProbeCqueryArgv;
+    buildStartupFlags: typeof buildStartupFlags;
+};
+export {};
 //# sourceMappingURL=bazel-query-runner.d.mts.map

package/dist/types/commands/manifest/bazel/bazel-query-runner.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"bazel-query-runner.d.mts","sourceRoot":"","sources":["../../../../../src/commands/manifest/bazel/bazel-query-runner.mts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAE3D,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAMD,+DAA+D;AAC/D,+EAA6E;AAC7E,2EAA2E;AAC3E,eAAe;AACf,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAKnE;AAmED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,gBAAgB,CAAC,CA4B3B;AAED;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,gBAAgB,CAAC,CAgB3B;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,SAAS,CAMhE"}
+{"version":3,"file":"bazel-query-runner.d.mts","sourceRoot":"","sources":["../../../../../src/commands/manifest/bazel/bazel-query-runner.mts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAE3D,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,mEAAmE;IACnE,sEAAsE;IACtE,mCAAmC;IACnC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAQD,+DAA+D;AAC/D,+EAA6E;AAC7E,2EAA2E;AAC3E,eAAe;AACf,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAKnE;AAED,6EAA6E;AAC7E,2EAAyE;AACzE,sEAAsE;AACtE,0CAA0C;AAC1C,iBAAS,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAY5D;AAED,iBAAS,iCAAiC,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAU5E;AAED,iBAAS,mCAAmC,CAC1C,IAAI,EAAE,iBAAiB,GACtB,MAAM,EAAE,CAkBV;AAED,iBAAS,iCAAiC,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAc5E;AAED,iBAAS,cAAc,CACrB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,iBAAiB,EACvB,MAAM,SAAU,GACf,MAAM,EAAE,CAeV;AAED,4EAA4E;AAC5E,uEAAuE;AACvE,wDAAwD;AACxD,wEAAwE;AACxE,oDAAoD;AACpD,iBAAS,yBAAyB,CAChC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,iBAAiB,GACtB,MAAM,EAAE,CAaV;AA4ED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,gBAAgB,CAAC,CAsC3B;AAiCD;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,gBAAgB,CAAC,CAM3B;AAED;;;;;GAKG;AACH,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,gBAAgB,CAAC,CAM3B;AAED;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,gBAAgB,CAAC,CAM3B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,GAAG,SAAS,CAUrE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,GAAG,SAAS,CAMpE;AAED,6EAA2E;AAC3E,2EAA2E;AAC3E,uBAAuB;AACvB,eAAO,MAAM,qBAAqB;;;;;;;CAOjC,CAAA"}

package/dist/types/commands/manifest/bazel/bazel-repo-discovery.d.mts

@@ -1,34 +1,74 @@
-// Parse `bazel mod show_repo --all_visible_repos --output=streamed_jsonproto`
-// output. Bazel's JSON proto field casing may vary by formatter; accept both
-// lowerCamel and snake_case, and tolerate wrapper objects around Repository.
-export declare function parseVisibleRepoCandidates(output: string): string[];
-// Step 1: parse candidate Maven repo names from Bzlmod and legacy entry points.
-export declare function parseMavenRepoCandidates(cwd: string, verbose?: boolean): string[];
-export type RepoProbe = (repoName: string) => Promise<{
-    stdout: string;
+// The importer token Bazel prints for a hub generated for the root module
+// itself (`(imported by <root>, …)`). Hubs imported only by rulesets
+// (`rules_jvm_external@6.7`, `stardoc@0.7.2`, …) are build-tooling, not the
+// user's SBOM, and are filtered out by the orchestrator.
+export declare const ROOT_MODULE_IMPORTER = "<root>";
+// One hub repo from a `bazel mod show_extension` report: its name plus the
+// modules that imported it (the `(imported by …)` annotation), merged across
+// every line the repo appears on.
+export type ShowExtensionRepo = {
+    name: string;
+    importers: string[];
+};
+export type ProbeResult = {
     code: number;
-}>;
-export type ValidationResult = {
-    valid: boolean;
-    // Probe stdout — populated whenever the probe was reachable, even when
-    // validation rejects the repo. Empty string when the probe itself threw.
     stdout: string;
+    stderr: string;
 };
-// Step 2: validate a candidate by running the probe and confirming
-// `maven_coordinates=` appears in stdout (the marker emitted by jvm_import /
-// aar_import rules generated by rules_jvm_external). Returns the probe
-// stdout alongside the verdict so the caller can cache it and reuse it
-// instead of running an identical extraction query.
-export declare function validateMavenRepo(repoName: string, probe: RepoProbe, verbose?: boolean): Promise<ValidationResult>;
-// Composition: parse, then validate each candidate; return validated subset
-// as a Map keyed by repo name with the validated probe stdout as value.
-// Map iteration order matches insertion order, so callers that just want
-// the list of repo names can call `Array.from(repos.keys())`. Callers that
-// want to skip re-running the same `bazel query` during extraction can read
-// the cached stdout off the Map and parse it directly.
+export type RepoProbe = (repoName: string) => Promise<ProbeResult>;
+// `indeterminate` means the probe could not be classified: an unrecognized
+// non-zero exit, or the probe threw outright (the Bazel invocation itself
+// failed). It is NOT evidence that the repo is undefined — treating it as
+// `not-defined` would silently under-report a hub that may well hold Maven
+// deps. The orchestrator must propagate it so the run is never reported
+// `complete` when a probe was indeterminate.
+export type ProbeStatus = 'populated' | 'empty' | 'not-defined' | 'indeterminate';
+// Conventional Maven hub names rules_jvm_external sets up under
+// WORKSPACE-mode invocations. Probing each one is cheap (a failed visibility
+// lookup never triggers a `repository_rule` fetch) so the orchestrator can
+// try them all without paying the cost of a real cquery on undefined repos.
+export declare const CONVENTIONAL_MAVEN_REPO_NAMES: readonly string[];
+// Outcome of running `bazel mod show_extension` for the maven extension,
+// distinct from the per-repo `ProbeStatus`:
+//   `not-defined`   — authoritative: no maven extension in this workspace
+//                     (clean run with zero kept hubs, OR rules_jvm_external is
+//                     not in the dependency graph).
+//   `indeterminate` — enumeration could not be performed (eval/load failure,
+//                     binary missing); the run must not be reported complete.
+//   `defined`       — the report parsed and yielded one or more root hubs;
+//                     the caller uses the parsed hub list directly.
+export type ShowExtensionStatus = 'defined' | 'indeterminate' | 'not-defined';
+// Classify a `bazel mod show_extension` result. `keptRootHubCount` is the
+// number of root-imported hubs the caller parsed from a code-0 run (see
+// `parseShowExtensionOutput` + the `<root>` importer filter); it disambiguates
+// the code-0 cases without re-parsing here.
 //
-// Always seeds with the default `@maven` repo name so repos whose
-// maven_install is defined in a sub-directory .bzl file (not reachable by
-// the top-level static scan) can still be discovered via probe validation.
-export declare function discoverMavenRepos(cwd: string, probe: RepoProbe, nativeCandidates?: string[], verbose?: boolean): Promise<Map<string, string>>;
+// IMPORTANT (security correctness): a non-zero exit is the DEFAULT outcome for
+// every bzlmod repo that does not use rules_jvm_external, so we must NOT treat
+// non-zero as indeterminate by default. We only escalate to `indeterminate`
+// when stderr looks like a real evaluation/load failure; an argument/resolution
+// error about the missing extension is the legitimate no-Maven case.
+export declare function classifyShowExtensionResult(result: ProbeResult, keptRootHubCount: number): ShowExtensionStatus;
+// Pure parser for `bazel mod show_extension @rules_jvm_external//:extensions.bzl%maven`
+// stdout. Returns the hub repos listed under `Fetched repositories:` — i.e.
+// items annotated with `(imported by ...)` — each carrying the set of modules
+// that imported it. Generated per-artifact repos (no annotation) are skipped.
+// A repo can legitimately appear on multiple lines with different importers,
+// so importers are merged per repo (name-only dedupe would lose that, and the
+// importers data is what lets the orchestrator keep only root-imported hubs).
+// Output is sorted by name. Tolerant of `DEBUG:` / `WARNING:` lines from
+// Bazel; the section header `## @@<canonical>//:extensions.bzl%maven:` is the
+// anchor.
+export declare function parseShowExtensionOutput(stdout: string): ShowExtensionRepo[];
+// Classify a raw probe result into one of three states. The probe contract
+// is whatever the runner emits — typically a lightweight
+// `cquery '@<name>//...' --keep_going --output=label`. The orchestrator
+// treats `empty` and `not-defined` uniformly as no-ops; the distinction
+// is preserved for verbose-mode diagnostics.
+export declare function classifyProbeResult(result: ProbeResult): ProbeStatus;
+// Convenience: probe a single candidate and return its classified status,
+// with optional verbose logging. Pure orchestration around `probe` +
+// `classifyProbeResult`; isolated so the test suite can exercise the
+// logging contract independently of the runner implementation.
+export declare function probeCandidate(repoName: string, probe: RepoProbe, verbose?: boolean): Promise<ProbeStatus>;
 //# sourceMappingURL=bazel-repo-discovery.d.mts.map

package/dist/types/commands/manifest/bazel/bazel-repo-discovery.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"bazel-repo-discovery.d.mts","sourceRoot":"","sources":["../../../../../src/commands/manifest/bazel/bazel-repo-discovery.mts"],"names":[],"mappings":"AAoHA,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAsBnE;AAED,gFAAgF;AAChF,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,OAAO,GAChB,MAAM,EAAE,CA8DV;AAED,MAAM,MAAM,SAAS,GAAG,CACtB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAE9C,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,OAAO,CAAA;IACd,yEAAuE;IACvE,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED,mEAAmE;AACnE,6EAA6E;AAC7E,uEAAuE;AACvE,uEAAuE;AACvE,oDAAoD;AACpD,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,SAAS,EAChB,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,gBAAgB,CAAC,CA8B3B;AAOD,4EAA4E;AAC5E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,4EAA4E;AAC5E,uDAAuD;AACvD,EAAE;AACF,kEAAkE;AAClE,0EAA0E;AAC1E,2EAA2E;AAC3E,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,EAChB,gBAAgB,CAAC,EAAE,MAAM,EAAE,EAC3B,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA4C9B"}
+{"version":3,"file":"bazel-repo-discovery.d.mts","sourceRoot":"","sources":["../../../../../src/commands/manifest/bazel/bazel-repo-discovery.mts"],"names":[],"mappings":"AAgBA,0EAA0E;AAC1E,uEAAqE;AACrE,8EAA4E;AAC5E,yDAAyD;AACzD,eAAO,MAAM,oBAAoB,WAAW,CAAA;AAE5C,2EAA2E;AAC3E,+EAA6E;AAC7E,kCAAkC;AAClC,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;AAElE,2EAA2E;AAC3E,0EAA0E;AAC1E,4EAA0E;AAC1E,2EAA2E;AAC3E,wEAAwE;AACxE,6CAA6C;AAC7C,MAAM,MAAM,WAAW,GACnB,WAAW,GACX,OAAO,GACP,aAAa,GACb,eAAe,CAAA;AAEnB,gEAAgE;AAChE,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAM1D,CAAA;AAyED,yEAAyE;AACzE,4CAA4C;AAC5C,4EAA0E;AAC1E,+EAA+E;AAC/E,oDAAoD;AACpD,+EAA6E;AAC7E,8EAA8E;AAC9E,6EAA2E;AAC3E,oEAAoE;AACpE,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,eAAe,GAAG,aAAa,CAAA;AAE7E,0EAA0E;AAC1E,wEAAwE;AACxE,+EAA+E;AAC/E,4CAA4C;AAC5C,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,gFAAgF;AAChF,qEAAqE;AACrE,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,WAAW,EACnB,gBAAgB,EAAE,MAAM,GACvB,mBAAmB,CAgCrB;AAED,wFAAwF;AACxF,8EAA4E;AAC5E,gFAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAC9E,UAAU;AACV,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,EAAE,CA0C5E;AAED,2EAA2E;AAC3E,2DAAyD;AACzD,wEAAwE;AACxE,wEAAwE;AACxE,6CAA6C;AAC7C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CA6BpE;AAED,0EAA0E;AAC1E,qEAAqE;AACrE,qEAAqE;AACrE,+DAA+D;AAC/D,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,SAAS,EAChB,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,WAAW,CAAC,CAuBtB"}

package/dist/types/commands/manifest/bazel/bazel-workspace-walk.d.mts

@@ -0,0 +1,18 @@
+export type FindWorkspaceRootsOptions = {
+    cwd: string;
+    // Directory basenames to skip outright (exact match). Pass the union of
+    // the codebase-wide ignore set (`IGNORED_DIRS` in `src/utils/glob.mts`)
+    // and any caller-specific additions (e.g. `.socket-auto-manifest`).
+    ignoreDirNames?: ReadonlySet<string>;
+    // Directory basename prefixes to skip. Bazel callers pass `['bazel-']` so
+    // the walk never descends into Bazel's output_base symlinks.
+    ignoreDirPrefixes?: readonly string[];
+    // Visited-directory budget override (testing); defaults to MAX_WALK_DIRS.
+    maxWalkDirs?: number;
+    verbose?: boolean;
+};
+// Walks the tree rooted at `opts.cwd` and returns absolute paths to every
+// directory that contains at least one workspace marker file. Output is
+// sorted for determinism and capped at MAX_WORKSPACE_ROOTS.
+export declare function findWorkspaceRoots(opts: FindWorkspaceRootsOptions): string[];
+//# sourceMappingURL=bazel-workspace-walk.d.mts.map

package/dist/types/commands/manifest/bazel/bazel-workspace-walk.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bazel-workspace-walk.d.mts","sourceRoot":"","sources":["../../../../../src/commands/manifest/bazel/bazel-workspace-walk.mts"],"names":[],"mappings":"AA+CA,MAAM,MAAM,yBAAyB,GAAG;IACtC,GAAG,EAAE,MAAM,CAAA;IACX,wEAAwE;IACxE,wEAAwE;IACxE,oEAAoE;IACpE,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACpC,0EAA0E;IAC1E,6DAA6D;IAC7D,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,CAAA;AAKD,0EAA0E;AAC1E,wEAAwE;AACxE,4DAA4D;AAC5D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,yBAAyB,GAAG,MAAM,EAAE,CAyF5E"}

package/dist/types/commands/manifest/bazel/cmd-manifest-bazel.d.mts

@@ -1,9 +1,35 @@
+import type { ExtractBazelStatus } from './extract_bazel_to_maven.mts';
 import type { CliCommandContext } from '../../../utils/meow-with-subcommands.mts';
 export declare const cmdManifestBazel: {
     description: string;
     hidden: boolean;
     run: typeof run;
 };
+export type EcosystemOutcome = {
+    ecosystem: 'maven' | 'pypi';
+    status: ExtractBazelStatus;
+    manifestPaths: string[];
+    // Machine-readable completeness signal. True only when the ecosystem's
+    // extraction was complete; a `partial` upload sets this false so the CLI
+    // surfaces it honestly (exit 0 + prominent warning) rather than as plain
+    // success.
+    complete: boolean;
+};
+// Pure outcome-matrix evaluator. Exported so dispatcher behavior can be
+// unit-tested without spawning the CLI binary. Throws InputError on
+// failures that must propagate to a non-zero CLI exit; returns void on
+// success.
+//
+// - `complete`/`partial` both count as produced output (>=1 manifest).
+//   `partial` additionally warns — a known-incomplete SBOM is still emitted,
+//   not a hard error.
+// - `hardFailure`: the ecosystem was detected (or the runner crashed) but
+//   wrote zero manifests. Always a non-zero exit, even when another
+//   ecosystem succeeded.
+// - `noEcosystem`: genuinely absent ecosystem. Auto-detect mode tolerates it
+//   when at least one other ecosystem produced output; explicit mode treats
+//   it as an error (the user requested an ecosystem that isn't there).
+export declare function evaluateEcosystemOutcomes(outcomes: readonly EcosystemOutcome[], isExplicit: boolean): void;
 declare function run(argv: string[] | readonly string[], importMeta: ImportMeta, { parentName }: CliCommandContext): Promise<void>;
 export {};
 //# sourceMappingURL=cmd-manifest-bazel.d.mts.map

package/dist/types/commands/manifest/bazel/cmd-manifest-bazel.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"cmd-manifest-bazel.d.mts","sourceRoot":"","sources":["../../../../../src/commands/manifest/bazel/cmd-manifest-bazel.mts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAEV,iBAAiB,EAClB,MAAM,0CAA0C,CAAA;AA8DjD,eAAO,MAAM,gBAAgB;;;;CAI5B,CAAA;AAED,iBAAe,GAAG,CAChB,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EAClC,UAAU,EAAE,UAAU,EACtB,EAAE,UAAU,EAAE,EAAE,iBAAiB,GAChC,OAAO,CAAC,IAAI,CAAC,CA6Hf"}
+{"version":3,"file":"cmd-manifest-bazel.d.mts","sourceRoot":"","sources":["../../../../../src/commands/manifest/bazel/cmd-manifest-bazel.mts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AACtE,OAAO,KAAK,EAEV,iBAAiB,EAClB,MAAM,0CAA0C,CAAA;AA6FjD,eAAO,MAAM,gBAAgB;;;;CAI5B,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,OAAO,GAAG,MAAM,CAAA;IAC3B,MAAM,EAAE,kBAAkB,CAAA;IAC1B,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,WAAW;IACX,QAAQ,EAAE,OAAO,CAAA;CAClB,CAAA;AAED,wEAAwE;AACxE,oEAAoE;AACpE,uEAAuE;AACvE,WAAW;AACX,EAAE;AACF,uEAAuE;AACvE,+EAA6E;AAC7E,sBAAsB;AACtB,0EAA0E;AAC1E,oEAAoE;AACpE,yBAAyB;AACzB,6EAA6E;AAC7E,4EAA4E;AAC5E,uEAAuE;AACvE,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,EACrC,UAAU,EAAE,OAAO,GAClB,IAAI,CAwDN;AA2BD,iBAAe,GAAG,CAChB,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EAClC,UAAU,EAAE,UAAU,EACtB,EAAE,UAAU,EAAE,EAAE,iBAAiB,GAChC,OAAO,CAAC,IAAI,CAAC,CA4Lf"}