circle-ir-ai 4.5.0 → 4.6.0

package/CHANGELOG.md

@@ -5,6 +5,48 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.6.0] - 2026-08-23
+
+### Fixed — cognium-ai#334 (P1): window-growth must not shrink the verify chunk
+
+Successor to #332. #332 fixed the token ceiling; the OTHER chunk limiter — the
+window↔chunk coupling (#244) — was directionally backwards: `windowScale =
+baseWindow / currentWindow`, so when the AIMD window GROWS above its start
+(80→120, which happens on healthy/fast endpoints where AIMD ramps the window up
+on success streaks), `coupledMax` SHRANK 20→13, splitting every file with >13
+pairs into extra LLM calls — a 20–40× slowdown on exactly the fast endpoints AIMD
+was rewarding (h2database: 313/313 coupling events at `coupledMax`, window pinned
+at 120, ~732 verify calls, 0 HTTP 429s). Fix: clamp the scale to ≥ 1 (new pure
+`computeCoupledMax`) — a growing window never reduces the chunk below the AIMD
+base; the shrink-boost (window < base → more pairs) is preserved. The token
+ceiling (#332) already bounds pairs-per-call by real token cost, so window growth
+carries no token argument for a smaller chunk. window=120 → `coupledMax` 20 (was
+13); files with ≤20 pairs do ONE call again. Test: `tests/verify-coupled-max-334.test.ts`
+(+5). **#332 + #334 together are the complete verify-slowdown fix.**
+
+### Added — Conformis layer-BOM engine op (9-layer detect + usage index) + coverage map
+
+The inventory + receipt spine of the Conformis loop (conformis-execution-plan.md
+§7, A3-S2 "Join"), all in `src/bom/` + `src/coverage-map/`:
+- **BOM** (`generateBom`): dependencies across all ecosystems (composes circle-ir's
+  npm/pypi/pyproject/maven/gradle/go/cargo parsers) with **transitive resolution**
+  from lockfiles (`direct` flag from the sibling manifest); a curated deterministic
+  **classifier** sorting the dependency BOM into L3 Protocols / L5 Framework / L7
+  Data usage layers; L2 runtime; L6/L8 from file detection; and a **usage index**
+  (which of the repo's own files import each classified component, via circle-ir
+  `parse` + `extractImports`).
+- **Coverage map** (`computeCoverage`): the architect-view *receipt* — per component,
+  `settles_now` / `signal_until_harness` / `not_diffable` / `uncovered`, grounded in
+  the canon §3 per-layer inherited/extracted split. Emits counts + a
+  `declaredCoverablePct` explicitly labelled **PROJECTED** — never a settled-%.
+- **BOM×KB join** (`joinCoverageWithKb`): fleet-memory skeleton — a `KnowledgeBase`
+  contract (the service plane implements it against the anchor store) + an
+  in-memory stub. A `settles_now` component with a fleet witness → `witnessed`; a
+  real `witnessedCount` distinct from the projected %.
+
+Exposed via the cognium-ai `bom` CLI (`--coverage`), circle-pack `POST /api/bom`,
+and the `layer_bom` MCP tool. Additive — no existing behaviour changed. +23 tests.
+
 ## [4.5.0] - 2026-08-22
 
 ### Changed — bump `circle-ir` 4.8.2 → 4.9.7

package/dist/bom/assemble.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Pure BOM assembly: dependencies + detected files → {@link RepoBom}.
+ *
+ * Kept pure (no fs, no circle-ir) so the layer mapping is unit-testable without
+ * a repo. `generateBom(repoPath)` (index.ts) does the IO — collect deps via
+ * circle-ir, walk for L6/L8 files — then calls this.
+ */
+import { type ClassifiableDependency } from './classify.js';
+import { type BomLayer, type RepoBom } from './types.js';
+/** A dependency as fed to the assembler (adds scope/direct over the classifier shape). */
+export interface BomInputDependency extends ClassifiableDependency {
+    scope?: 'required' | 'optional' | 'dev';
+    direct?: boolean;
+}
+/** A non-dependency component found by walking the repo (L6 config, L8 spec). */
+export interface DetectedFile {
+    layer: Extract<BomLayer, 'L6' | 'L8'>;
+    /** e.g. `container`, `ci`, `k8s` (L6); `openapi-spec`, `graphql-schema`, `proto` (L8). */
+    kind: string;
+    path: string;
+    name?: string;
+}
+export interface AssembleBomParams {
+    target: string;
+    dependencies: BomInputDependency[];
+    files?: DetectedFile[];
+}
+export declare function assembleBom(params: AssembleBomParams): RepoBom;
+//# sourceMappingURL=assemble.d.ts.map

package/dist/bom/assemble.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assemble.d.ts","sourceRoot":"","sources":["../../src/bom/assemble.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAGL,KAAK,sBAAsB,EAE5B,MAAM,eAAe,CAAC;AACvB,OAAO,EAGL,KAAK,QAAQ,EAEb,KAAK,OAAO,EACb,MAAM,YAAY,CAAC;AAIpB,0FAA0F;AAC1F,MAAM,WAAW,kBAAmB,SAAQ,sBAAsB;IAChE,KAAK,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,KAAK,CAAC;IACxC,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC;IACtC,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC;CACxB;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CA+E9D"}

package/dist/bom/assemble.js

@@ -0,0 +1,81 @@
+/**
+ * Pure BOM assembly: dependencies + detected files → {@link RepoBom}.
+ *
+ * Kept pure (no fs, no circle-ir) so the layer mapping is unit-testable without
+ * a repo. `generateBom(repoPath)` (index.ts) does the IO — collect deps via
+ * circle-ir, walk for L6/L8 files — then calls this.
+ */
+import { classifyDependency, runtimeForEcosystem, } from './classify.js';
+import { BOM_LAYER_TITLES, } from './types.js';
+const ALL_LAYERS = ['L2', 'L3', 'L4', 'L5', 'L6', 'L7', 'L8', 'L9'];
+export function assembleBom(params) {
+    const { target, dependencies, files = [] } = params;
+    const buckets = {
+        L2: [], L3: [], L4: [], L5: [], L6: [], L7: [], L8: [], L9: [],
+    };
+    const ecosystems = new Set();
+    for (const dep of dependencies) {
+        ecosystems.add(dep.ecosystem);
+        // Every dependency is L4 supply chain (the recursive dependency BOM).
+        buckets.L4.push({
+            name: dep.name,
+            version: dep.version,
+            layer: 'L4',
+            kind: dep.scope === 'dev' ? 'dependency:dev' : 'dependency',
+            ecosystem: dep.ecosystem,
+            source: 'dependency',
+            direct: dep.direct,
+        });
+        // …and, if it is a protocol/framework/data library, its usage layer too.
+        const cls = classifyDependency(dep);
+        if (cls) {
+            buckets[cls.layer].push({
+                name: dep.name,
+                version: dep.version,
+                layer: cls.layer,
+                kind: cls.kind,
+                ecosystem: dep.ecosystem,
+                source: 'dependency',
+                direct: dep.direct,
+            });
+        }
+    }
+    // L2 Runtime — one component per distinct ecosystem present.
+    for (const eco of ecosystems) {
+        buckets.L2.push({
+            name: runtimeForEcosystem(eco),
+            layer: 'L2',
+            kind: runtimeForEcosystem(eco),
+            ecosystem: eco,
+            source: 'runtime',
+        });
+    }
+    // L6 / L8 — file-detected components.
+    for (const f of files) {
+        buckets[f.layer].push({
+            name: f.name ?? f.path,
+            layer: f.layer,
+            kind: f.kind,
+            source: 'file',
+            path: f.path,
+        });
+    }
+    const layers = {};
+    for (const layer of ALL_LAYERS) {
+        layers[layer] = { layer, title: BOM_LAYER_TITLES[layer], components: buckets[layer] };
+    }
+    const totalComponents = ALL_LAYERS.reduce((n, l) => n + buckets[l].length, 0);
+    const populatedLayers = ALL_LAYERS.filter((l) => buckets[l].length > 0);
+    return {
+        target,
+        languages: [...ecosystems].sort(),
+        layers,
+        meta: {
+            generatedAt: new Date().toISOString(),
+            totalDependencies: dependencies.length,
+            totalComponents,
+            populatedLayers,
+        },
+    };
+}
+//# sourceMappingURL=assemble.js.map

package/dist/bom/assemble.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assemble.js","sourceRoot":"","sources":["../../src/bom/assemble.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GAGpB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,gBAAgB,GAKjB,MAAM,YAAY,CAAC;AAEpB,MAAM,UAAU,GAAe,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAuBhF,MAAM,UAAU,WAAW,CAAC,MAAyB;IACnD,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC;IAEpD,MAAM,OAAO,GAAqC;QAChD,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;KAC/D,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAa,CAAC;IAExC,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE9B,sEAAsE;QACtE,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY;YAC3D,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC,CAAC;QAEH,yEAAyE;QACzE,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;gBACtB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6DAA6D;IAC7D,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,mBAAmB,CAAC,GAAG,CAAC;YAC9B,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,mBAAmB,CAAC,GAAG,CAAC;YAC9B,SAAS,EAAE,GAAG;YACd,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;IACL,CAAC;IAED,sCAAsC;IACtC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;YACpB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI;YACtB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,EAAgC,CAAC;IAChD,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IACxF,CAAC;IAED,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9E,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAExE,OAAO;QACL,MAAM;QACN,SAAS,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE;QACjC,MAAM;QACN,IAAI,EAAE;YACJ,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,iBAAiB,EAAE,YAAY,CAAC,MAAM;YACtC,eAAe;YACf,eAAe;SAChB;KACF,CAAC;AACJ,CAAC"}

package/dist/bom/classify.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Dependency → layer classifier (the BOM's core intelligence).
+ *
+ * The insight behind the 9-layer inventory: **L3 (Protocols), L5 (Framework),
+ * and L7 (Data) are, at the component level, the L4 dependency BOM sorted into
+ * buckets.** A JWT library is an L3 protocol component; React is an L5 framework
+ * component; Prisma is an L7 data component — all of them are also L4 supply
+ * chain. So the classifier maps a dependency to its *usage* layer (L3/L5/L7),
+ * and the assembler always also lists it under L4. Unclassified deps are L4-only.
+ *
+ * The map is deterministic + curated (no LLM) and seeded from the conformis lane
+ * targets (conformis-execution-plan.md §2–3b): OpenAPI/GraphQL/gRPC + JWT/OAuth
+ * (Lane A/D), React/Expo (Lane B), Spring/Django, ORMs (Lane C data). Extend by
+ * adding rows — it is intentionally a plain table, not a heuristic.
+ */
+import type { BomLayer } from './types.js';
+/** Package ecosystem, aligned with circle-ir's `Ecosystem` (purl `pkg:<type>`). */
+export type Ecosystem = 'npm' | 'pypi' | 'maven' | 'cargo' | 'golang';
+/** The minimal dependency shape the classifier needs (decoupled from circle-ir's union). */
+export interface ClassifiableDependency {
+    name: string;
+    version?: string;
+    ecosystem: Ecosystem;
+}
+export interface Classification {
+    layer: Extract<BomLayer, 'L3' | 'L5' | 'L7'>;
+    /** Sub-kind, e.g. `jwt`, `framework:react`, `orm:prisma`. */
+    kind: string;
+}
+/**
+ * Classify a dependency into its usage layer (L3/L5/L7), or `null` if it is
+ * plain supply chain (L4-only). First matching rule wins.
+ */
+export declare function classifyDependency(dep: ClassifiableDependency): Classification | null;
+/** Ecosystem → L2 runtime component name (JLS/ECMA/CPython families). */
+export declare function runtimeForEcosystem(ecosystem: Ecosystem): string;
+//# sourceMappingURL=classify.d.ts.map

package/dist/bom/classify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../../src/bom/classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,mFAAmF;AACnF,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEtE,4FAA4F;AAC5F,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IAC7C,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;CACd;AA4DD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,sBAAsB,GAAG,cAAc,GAAG,IAAI,CAOrF;AAED,yEAAyE;AACzE,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,CAQhE"}

package/dist/bom/classify.js

@@ -0,0 +1,82 @@
+/**
+ * Dependency → layer classifier (the BOM's core intelligence).
+ *
+ * The insight behind the 9-layer inventory: **L3 (Protocols), L5 (Framework),
+ * and L7 (Data) are, at the component level, the L4 dependency BOM sorted into
+ * buckets.** A JWT library is an L3 protocol component; React is an L5 framework
+ * component; Prisma is an L7 data component — all of them are also L4 supply
+ * chain. So the classifier maps a dependency to its *usage* layer (L3/L5/L7),
+ * and the assembler always also lists it under L4. Unclassified deps are L4-only.
+ *
+ * The map is deterministic + curated (no LLM) and seeded from the conformis lane
+ * targets (conformis-execution-plan.md §2–3b): OpenAPI/GraphQL/gRPC + JWT/OAuth
+ * (Lane A/D), React/Expo (Lane B), Spring/Django, ORMs (Lane C data). Extend by
+ * adding rows — it is intentionally a plain table, not a heuristic.
+ */
+// Ordered: first matching rule wins. Keep specific before generic.
+const RULES = [
+    // ── L3 Protocols ───────────────────────────────────────────────────────────
+    { layer: 'L3', kind: 'jwt', names: ['jsonwebtoken', 'jose', 'jwt-decode', 'fast-jwt', 'pyjwt', 'jjwt'], prefixes: ['@panva/jose', 'com.auth0:java-jwt', 'io.jsonwebtoken'] },
+    { layer: 'L3', kind: 'oauth', names: ['passport', 'oauth', 'openid-client', 'simple-oauth2', 'authlib', 'oauthlib'], prefixes: ['passport-', '@node-oauth', 'next-auth', '@auth/'] },
+    { layer: 'L3', kind: 'grpc', names: ['grpc', '@grpc/grpc-js', 'grpcio', 'nice-grpc'], prefixes: ['@grpc/', 'io.grpc:'] },
+    { layer: 'L3', kind: 'graphql-transport', names: ['graphql', 'graphql-ws', 'subscriptions-transport-ws'] },
+    { layer: 'L3', kind: 'websocket', names: ['ws', 'socket.io', 'socket.io-client', 'websockets'] },
+    { layer: 'L3', kind: 'http-client', names: ['axios', 'node-fetch', 'got', 'undici', 'superagent', 'requests', 'httpx', 'aiohttp'], prefixes: ['okhttp', 'org.apache.httpcomponents'] },
+    { layer: 'L3', kind: 'tls', names: ['node-forge', 'pyopenssl', 'cryptography'] },
+    // ── L5 Framework ───────────────────────────────────────────────────────────
+    { layer: 'L5', kind: 'framework:expo', names: ['expo'], prefixes: ['expo-', '@expo/'] },
+    { layer: 'L5', kind: 'framework:react-native', names: ['react-native'], prefixes: ['react-native-', '@react-native'] },
+    { layer: 'L5', kind: 'framework:react', names: ['react', 'react-dom', 'next'], prefixes: ['@remix-run', 'gatsby'] },
+    { layer: 'L5', kind: 'framework:vue', names: ['vue', 'nuxt'], prefixes: ['@vue/'] },
+    { layer: 'L5', kind: 'framework:angular', prefixes: ['@angular/'] },
+    { layer: 'L5', kind: 'framework:svelte', names: ['svelte', '@sveltejs/kit'] },
+    { layer: 'L5', kind: 'framework:node-http', names: ['express', 'koa', 'fastify', 'hapi', 'hono'], prefixes: ['@nestjs/'] },
+    { layer: 'L5', kind: 'framework:spring', ecosystem: 'maven', prefixes: ['org.springframework'] },
+    { layer: 'L5', kind: 'framework:python-web', ecosystem: 'pypi', names: ['django', 'flask', 'fastapi', 'starlette', 'tornado'] },
+    // ── L7 Data ────────────────────────────────────────────────────────────────
+    { layer: 'L7', kind: 'orm:prisma', names: ['prisma', '@prisma/client'], prefixes: ['@prisma/'] },
+    { layer: 'L7', kind: 'orm:sequelize', names: ['sequelize'] },
+    { layer: 'L7', kind: 'orm:typeorm', names: ['typeorm'] },
+    { layer: 'L7', kind: 'orm:mongoose', names: ['mongoose'] },
+    { layer: 'L7', kind: 'orm:drizzle', names: ['drizzle-orm'] },
+    { layer: 'L7', kind: 'query-builder', names: ['knex', 'kysely'] },
+    { layer: 'L7', kind: 'orm:python', ecosystem: 'pypi', names: ['sqlalchemy', 'alembic', 'django-orm', 'peewee', 'tortoise-orm'] },
+    { layer: 'L7', kind: 'orm:jpa', ecosystem: 'maven', prefixes: ['org.hibernate', 'jakarta.persistence', 'javax.persistence', 'org.mybatis'] },
+    { layer: 'L7', kind: 'db-driver', names: ['pg', 'mysql', 'mysql2', 'sqlite3', 'better-sqlite3', 'ioredis', 'redis', 'mongodb', 'psycopg2', 'psycopg2-binary', 'asyncpg', 'pymysql'] },
+];
+const lc = (s) => s.toLowerCase();
+function matches(rule, name, ecosystem) {
+    if (rule.ecosystem && rule.ecosystem !== ecosystem)
+        return false;
+    const n = lc(name);
+    if (rule.names?.some((x) => n === lc(x)))
+        return true;
+    if (rule.prefixes?.some((x) => n.startsWith(lc(x))))
+        return true;
+    if (rule.contains?.some((x) => n.includes(lc(x))))
+        return true;
+    return false;
+}
+/**
+ * Classify a dependency into its usage layer (L3/L5/L7), or `null` if it is
+ * plain supply chain (L4-only). First matching rule wins.
+ */
+export function classifyDependency(dep) {
+    for (const rule of RULES) {
+        if (matches(rule, dep.name, dep.ecosystem)) {
+            return { layer: rule.layer, kind: rule.kind };
+        }
+    }
+    return null;
+}
+/** Ecosystem → L2 runtime component name (JLS/ECMA/CPython families). */
+export function runtimeForEcosystem(ecosystem) {
+    switch (ecosystem) {
+        case 'npm': return 'runtime:node';
+        case 'pypi': return 'runtime:python';
+        case 'maven': return 'runtime:jvm';
+        case 'cargo': return 'runtime:rust';
+        case 'golang': return 'runtime:go';
+    }
+}
+//# sourceMappingURL=classify.js.map

package/dist/bom/classify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.js","sourceRoot":"","sources":["../../src/bom/classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAiCH,mEAAmE;AACnE,MAAM,KAAK,GAAW;IACpB,8EAA8E;IAC9E,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,aAAa,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,EAAE;IAC5K,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE;IACpL,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE;IACxH,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,4BAA4B,CAAC,EAAE;IAC1G,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,kBAAkB,EAAE,YAAY,CAAC,EAAE;IAChG,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,2BAA2B,CAAC,EAAE;IACtL,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,cAAc,CAAC,EAAE;IAEhF,8EAA8E;IAC9E,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;IACvF,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,CAAC,eAAe,EAAE,eAAe,CAAC,EAAE;IACtH,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE;IACnH,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE;IACnF,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE;IACnE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE;IAC7E,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE;IAC1H,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,qBAAqB,CAAC,EAAE;IAChG,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE;IAE/H,8EAA8E;IAC9E,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE;IAChG,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE;IAC5D,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE;IACxD,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE;IAC1D,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE;IAC5D,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;IACjE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,CAAC,EAAE;IAChI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,aAAa,CAAC,EAAE;IAC5I,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,iBAAiB,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE;CACtL,CAAC;AAEF,MAAM,EAAE,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAElD,SAAS,OAAO,CAAC,IAAU,EAAE,IAAY,EAAE,SAAoB;IAC7D,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACjE,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACnB,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAA2B;IAC5D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QAChD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CAAC,SAAoB;IACtD,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,KAAK,CAAC,CAAC,OAAO,cAAc,CAAC;QAClC,KAAK,MAAM,CAAC,CAAC,OAAO,gBAAgB,CAAC;QACrC,KAAK,OAAO,CAAC,CAAC,OAAO,aAAa,CAAC;QACnC,KAAK,OAAO,CAAC,CAAC,OAAO,cAAc,CAAC;QACpC,KAAK,QAAQ,CAAC,CAAC,OAAO,YAAY,CAAC;IACrC,CAAC;AACH,CAAC"}

package/dist/bom/index.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Layer-BOM engine op — `generateBom(repoPath)` (Conformis inventory step).
+ *
+ * Composes: (a) dependencies (all ecosystems, via circle-ir's manifest parsers)
+ * → L4 + classified L3/L5/L7; (b) L2 runtime from ecosystems; (c) L6/L8 file
+ * detection (config + API specs); (d) the usage index (import sites per
+ * classified component, via circle-ir `parse` + `extractImports`). The
+ * classification/assembly is pure (assemble.ts); this module does the IO.
+ */
+import { type BomInputDependency, type DetectedFile } from './assemble.js';
+import type { RepoBom } from './types.js';
+export * from './types.js';
+export * from './classify.js';
+export { assembleBom } from './assemble.js';
+export type { BomInputDependency, DetectedFile } from './assemble.js';
+export { buildUsageIndex } from './usage.js';
+/** Read npm dependencies from a single package.json (kept for direct callers). */
+export declare function readNpmDependencies(repoPath: string): BomInputDependency[];
+/**
+ * Collect the dependency set across all ecosystems. Per directory: a lockfile,
+ * when present, gives the full direct+transitive graph (and `direct` is set from
+ * the sibling manifest's declared names); otherwise the manifest gives the
+ * direct set. Aggregated across the repo (monorepo-aware) and deduped by
+ * `(ecosystem, name)` — a dep declared direct anywhere stays direct; a resolved
+ * version wins over an `unknown`.
+ */
+export declare function readDependencies(repoPath: string): BomInputDependency[];
+/** Walk the repo (bounded) for L6 (config) + L8 (API spec) file components. */
+export declare function detectFiles(repoPath: string): DetectedFile[];
+export interface GenerateBomOptions {
+    /** Override the detected dependency set (e.g. inject a pre-collected list). */
+    dependencies?: BomInputDependency[];
+    /** Skip the L6/L8 file walk. */
+    skipFiles?: boolean;
+    /** Build the usage index (import sites per classified component). Default true. */
+    usage?: boolean;
+}
+/** Generate the layer-BOM for a repo (async: the usage index parses source). */
+export declare function generateBom(repoPath: string, opts?: GenerateBomOptions): Promise<RepoBom>;
+//# sourceMappingURL=index.d.ts.map

package/dist/bom/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/bom/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgBH,OAAO,EAAe,KAAK,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAExF,OAAO,KAAK,EAAY,OAAO,EAAE,MAAM,YAAY,CAAC;AAEpD,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAgC7C,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAQ1E;AAYD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAuDvE;AAED,+EAA+E;AAC/E,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,EAAE,CAuC5D;AAMD,MAAM,WAAW,kBAAkB;IACjC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACpC,gCAAgC;IAChC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,mFAAmF;IACnF,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,gFAAgF;AAChF,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CAsBnG"}

package/dist/bom/index.js

@@ -0,0 +1,245 @@
+/**
+ * Layer-BOM engine op — `generateBom(repoPath)` (Conformis inventory step).
+ *
+ * Composes: (a) dependencies (all ecosystems, via circle-ir's manifest parsers)
+ * → L4 + classified L3/L5/L7; (b) L2 runtime from ecosystems; (c) L6/L8 file
+ * detection (config + API specs); (d) the usage index (import sites per
+ * classified component, via circle-ir `parse` + `extractImports`). The
+ * classification/assembly is pure (assemble.ts); this module does the IO.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { parseNpmDependencies, parsePypiDependencies, parsePyprojectDependencies, parseMavenDependencies, parseGradleDependencies, parseGoDependencies, parseCargoDependencies, parseNpmLockDependencies, parseCargoLockDependencies, parsePoetryLockDependencies, } from 'circle-ir';
+import { assembleBom } from './assemble.js';
+import { buildUsageIndex } from './usage.js';
+export * from './types.js';
+export * from './classify.js';
+export { assembleBom } from './assemble.js';
+export { buildUsageIndex } from './usage.js';
+const IGNORE_DIRS = new Set(['node_modules', '.git', 'dist', 'build', 'coverage', '.next', 'vendor', 'target', '__pycache__']);
+const MAX_WALK_DEPTH = 6;
+/** Manifest filename → circle-ir parser (each takes the file *content*). */
+const MANIFEST_PARSERS = [
+    { file: 'package.json', parse: parseNpmDependencies },
+    { file: 'requirements.txt', parse: parsePypiDependencies },
+    { file: 'pyproject.toml', parse: parsePyprojectDependencies },
+    { file: 'pom.xml', parse: parseMavenDependencies },
+    { file: 'build.gradle', parse: parseGradleDependencies },
+    { file: 'build.gradle.kts', parse: parseGradleDependencies },
+    { file: 'go.mod', parse: parseGoDependencies },
+    { file: 'Cargo.toml', parse: parseCargoDependencies },
+];
+const MANIFEST_NAMES = new Set(MANIFEST_PARSERS.map((m) => m.file));
+/**
+ * Lockfile parsers — the *complete resolved* graph (direct + transitive, exact
+ * versions). When a lockfile is present it supersedes its sibling manifest for
+ * that ecosystem; `direct` is then set by whether the dep is declared in the
+ * manifest. Java (Maven/Gradle) + Go have no statically-parseable lock graph
+ * here, so they stay direct-from-manifest (best-effort).
+ */
+const LOCK_PARSERS = [
+    { file: 'package-lock.json', parse: parseNpmLockDependencies },
+    { file: 'Cargo.lock', parse: parseCargoLockDependencies },
+    { file: 'poetry.lock', parse: parsePoetryLockDependencies },
+];
+const LOCK_NAMES = new Set(LOCK_PARSERS.map((m) => m.file));
+/** Read npm dependencies from a single package.json (kept for direct callers). */
+export function readNpmDependencies(repoPath) {
+    const pkgPath = path.join(repoPath, 'package.json');
+    if (!fs.existsSync(pkgPath))
+        return [];
+    try {
+        return parseNpmDependencies(fs.readFileSync(pkgPath, 'utf-8')).map(toInputDep);
+    }
+    catch {
+        return [];
+    }
+}
+function toInputDep(d) {
+    return {
+        name: d.name,
+        version: d.version,
+        ecosystem: d.ecosystem,
+        scope: d.scope ?? 'required',
+        direct: true,
+    };
+}
+/**
+ * Collect the dependency set across all ecosystems. Per directory: a lockfile,
+ * when present, gives the full direct+transitive graph (and `direct` is set from
+ * the sibling manifest's declared names); otherwise the manifest gives the
+ * direct set. Aggregated across the repo (monorepo-aware) and deduped by
+ * `(ecosystem, name)` — a dep declared direct anywhere stays direct; a resolved
+ * version wins over an `unknown`.
+ */
+export function readDependencies(repoPath) {
+    // Per-directory: manifest-declared names + parsed manifest/lock deps.
+    const perDir = new Map();
+    const dirOf = (d) => {
+        let v = perDir.get(d);
+        if (!v) {
+            v = { manifestNames: new Set(), fromManifest: [], fromLock: [] };
+            perDir.set(d, v);
+        }
+        return v;
+    };
+    const walk = (dir, depth) => {
+        if (depth > MAX_WALK_DEPTH)
+            return;
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            const abs = path.join(dir, e.name);
+            if (e.isDirectory()) {
+                if (IGNORE_DIRS.has(e.name) || e.name.startsWith('.'))
+                    continue;
+                walk(abs, depth + 1);
+            }
+            else if (e.isFile() && MANIFEST_NAMES.has(e.name)) {
+                const parser = MANIFEST_PARSERS.find((m) => m.file === e.name);
+                if (!parser)
+                    continue;
+                try {
+                    const deps = parser.parse(fs.readFileSync(abs, 'utf-8')).map(toInputDep);
+                    const d = dirOf(dir);
+                    for (const dep of deps) {
+                        d.fromManifest.push(dep);
+                        d.manifestNames.add(dep.name);
+                    }
+                }
+                catch { /* skip unparseable manifest */ }
+            }
+            else if (e.isFile() && LOCK_NAMES.has(e.name)) {
+                const parser = LOCK_PARSERS.find((m) => m.file === e.name);
+                if (!parser)
+                    continue;
+                try {
+                    dirOf(dir).fromLock.push(...parser.parse(fs.readFileSync(abs, 'utf-8')).map(toInputDep));
+                }
+                catch { /* skip unparseable lockfile */ }
+            }
+        }
+    };
+    walk(repoPath, 0);
+    const byKey = new Map();
+    const upsert = (dep) => {
+        const key = `${dep.ecosystem}:${dep.name}`;
+        const existing = byKey.get(key);
+        if (!existing) {
+            byKey.set(key, dep);
+            return;
+        }
+        if (dep.direct && !existing.direct)
+            existing.direct = true;
+        if ((!existing.version || existing.version === 'unknown') && dep.version && dep.version !== 'unknown')
+            existing.version = dep.version;
+    };
+    for (const info of perDir.values()) {
+        if (info.fromLock.length > 0) {
+            // Lockfile wins: full graph, `direct` = declared in the sibling manifest.
+            for (const dep of info.fromLock) {
+                dep.direct = info.manifestNames.has(dep.name);
+                upsert(dep);
+            }
+        }
+        else {
+            for (const dep of info.fromManifest)
+                upsert(dep);
+        }
+    }
+    return [...byKey.values()];
+}
+/** Walk the repo (bounded) for L6 (config) + L8 (API spec) file components. */
+export function detectFiles(repoPath) {
+    const found = [];
+    const rel = (p) => path.relative(repoPath, p) || path.basename(p);
+    const classifyFile = (abs, base) => {
+        const lower = base.toLowerCase();
+        if (lower === 'dockerfile' || lower.startsWith('dockerfile.'))
+            return { layer: 'L6', kind: 'container', path: rel(abs), name: base };
+        if (lower === 'docker-compose.yml' || lower === 'docker-compose.yaml')
+            return { layer: 'L6', kind: 'compose', path: rel(abs), name: base };
+        if (lower.endsWith('.graphql') || lower.endsWith('.graphqls'))
+            return { layer: 'L8', kind: 'graphql-schema', path: rel(abs), name: base };
+        if (lower.endsWith('.proto'))
+            return { layer: 'L8', kind: 'proto', path: rel(abs), name: base };
+        if (/^(openapi|swagger)\.(ya?ml|json)$/.test(lower))
+            return { layer: 'L8', kind: 'openapi-spec', path: rel(abs), name: base };
+        return null;
+    };
+    const walk = (dir, depth) => {
+        if (depth > MAX_WALK_DEPTH)
+            return;
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            const abs = path.join(dir, e.name);
+            if (e.isDirectory()) {
+                if (e.name === '.github') {
+                    const wf = path.join(abs, 'workflows');
+                    for (const f of safeReaddir(wf)) {
+                        if (/\.ya?ml$/i.test(f))
+                            found.push({ layer: 'L6', kind: 'ci', path: rel(path.join(wf, f)), name: f });
+                    }
+                    continue;
+                }
+                if (IGNORE_DIRS.has(e.name) || e.name.startsWith('.'))
+                    continue;
+                walk(abs, depth + 1);
+            }
+            else if (e.isFile()) {
+                const hit = classifyFile(abs, e.name);
+                if (hit)
+                    found.push(hit);
+            }
+        }
+    };
+    walk(repoPath, 0);
+    return found;
+}
+function safeReaddir(dir) {
+    try {
+        return fs.readdirSync(dir);
+    }
+    catch {
+        return [];
+    }
+}
+/** Generate the layer-BOM for a repo (async: the usage index parses source). */
+export async function generateBom(repoPath, opts = {}) {
+    const dependencies = opts.dependencies ?? readDependencies(repoPath);
+    const files = opts.skipFiles ? [] : detectFiles(repoPath);
+    const bom = assembleBom({ target: repoPath, dependencies, files });
+    if (opts.usage === false)
+        return bom;
+    // Usage index over the classified (L3/L5/L7) component names — the "which of
+    // your call-sites" set. L4-only supply-chain isn't usage-indexed (noise).
+    const classifiedLayers = ['L3', 'L5', 'L7'];
+    const names = [...new Set(classifiedLayers.flatMap((l) => bom.layers[l].components.map((c) => c.name)))];
+    const usageIndex = await buildUsageIndex(repoPath, names);
+    for (const layer of classifiedLayers) {
+        for (const c of bom.layers[layer].components) {
+            const sites = usageIndex[c.name];
+            if (sites) {
+                c.usageSites = sites;
+                c.usageCount = sites.length;
+            }
+            else {
+                c.usageCount = 0;
+            }
+        }
+    }
+    bom.usageIndex = usageIndex;
+    return bom;
+}
+//# sourceMappingURL=index.js.map

package/dist/bom/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/bom/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,WAAW,EAA8C,MAAM,eAAe,CAAC;AACxF,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAG7C,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AAC/H,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,4EAA4E;AAC5E,MAAM,gBAAgB,GAAqI;IACzJ,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,oBAA6B,EAAE;IAC9D,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,qBAA8B,EAAE;IACnE,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,0BAAmC,EAAE;IACtE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,sBAA+B,EAAE;IAC3D,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,uBAAgC,EAAE;IACjE,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,uBAAgC,EAAE;IACrE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAA4B,EAAE;IACvD,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,sBAA+B,EAAE;CAC/D,CAAC;AACF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAEpE;;;;;;GAMG;AACH,MAAM,YAAY,GAAqI;IACrJ,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,wBAAiC,EAAE;IACvE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,0BAAmC,EAAE;IAClE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,2BAAoC,EAAE;CACrE,CAAC;AACF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAE5D,kFAAkF;AAClF,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,oBAAoB,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAuE;IACzF,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,CAAC,CAAC,SAA4C;QACzD,KAAK,EAAG,CAAC,CAAC,KAAqC,IAAI,UAAU;QAC7D,MAAM,EAAE,IAAI;KACb,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,sEAAsE;IACtE,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8G,CAAC;IACrI,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE;QAC1B,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,CAAC,EAAE,CAAC;YAAC,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,GAAG,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAAC,CAAC;QAC/F,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAa,EAAQ,EAAE;QAChD,IAAI,KAAK,GAAG,cAAc;YAAE,OAAO;QACnC,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO;QAAC,CAAC;QACjF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpB,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAChE,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACvB,CAAC;iBAAM,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC/D,IAAI,CAAC,MAAM;oBAAE,SAAS;gBACtB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;oBACzE,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;oBACrB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;wBAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAAC,CAAC;gBACtF,CAAC;gBAAC,MAAM,CAAC,CAAC,+BAA+B,CAAC,CAAC;YAC7C,CAAC;iBAAM,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC3D,IAAI,CAAC,MAAM;oBAAE,SAAS;gBACtB,IAAI,CAAC;oBACH,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC3F,CAAC;gBAAC,MAAM,CAAC,CAAC,+BAA+B,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAElB,MAAM,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IACpD,MAAM,MAAM,GAAG,CAAC,GAAuB,EAAQ,EAAE;QAC/C,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC/C,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC;QAC3D,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;YAAE,QAAQ,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IACxI,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,0EAA0E;YAC1E,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;QAClG,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,YAAY;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAElF,MAAM,YAAY,GAAG,CAAC,GAAW,EAAE,IAAY,EAAuB,EAAE;QACtE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACrI,IAAI,KAAK,KAAK,oBAAoB,IAAI,KAAK,KAAK,qBAAqB;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC3I,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC1I,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAChG,IAAI,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC9H,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAa,EAAQ,EAAE;QAChD,IAAI,KAAK,GAAG,cAAc;YAAE,OAAO;QACnC,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO;QAAC,CAAC;QACjF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpB,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;oBACvC,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;wBAChC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;4BAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;oBACzG,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAChE,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACvB,CAAC;iBAAM,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBACtC,IAAI,GAAG;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAClB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QAAC,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAC1D,CAAC;AAWD,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,OAA2B,EAAE;IAC/E,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IAEnE,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,GAAG,CAAC;IAErC,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,gBAAgB,GAAe,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAE1D,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,KAAK,EAAE,CAAC;gBAAC,CAAC,CAAC,UAAU,GAAG,KAAK,CAAC;gBAAC,CAAC,CAAC,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC;YAAC,CAAC;iBAC5D,CAAC;gBAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC;YAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC"}