socket 1.1.112 → 1.1.114

package/dist/types/commands/manifest/bazel/bazel-cquery.d.mts

@@ -0,0 +1,70 @@
+import type { BazelQueryOptions } from './bazel-query-runner.mts';
+// One Maven artifact recovered from the cquery stream. `ruleKind` is whatever
+// `ruleClass` jsonproto reports (`jvm_import`, `aar_import`, `java_library`,
+// `kt_jvm_import`, any future rules_jvm_external rule), so the type is open.
+// `deps` holds resolved versionless Maven coordinates (the parser resolves the
+// rule's label edges against this repo's own targets), not raw Bazel labels.
+export type ExtractedArtifact = {
+    deps: string[];
+    mavenCoordinates: string;
+    ruleKind: string;
+    ruleName: string;
+    sourceRepo?: string | undefined;
+};
+export type CqueryStatus = 'ok' | 'partial' | 'timeout' | 'empty' | 'error';
+export type CqueryRepoResult = {
+    repoName: string;
+    workspaceRelPath: string;
+    status: CqueryStatus;
+    artifacts: ExtractedArtifact[];
+    // Hub-prefixed dep labels the parser could not resolve to a coordinate
+    // (missing target or ambiguous suffix). A non-empty list means the graph
+    // is known-incomplete; the orchestrator flips the hub partial.
+    unresolvedLabels: string[];
+    stderr: string;
+    durationMs: number;
+};
+export type RunMetadataCqueryArgs = {
+    repoName: string;
+    workspaceRoot: string;
+    // Provenance label (e.g. "examples/dagger"). Empty string for the root
+    // workspace. Embedded in each artifact's `sourceRepo` as
+    // `workspace:<path>+repo:<name>`.
+    workspaceRelPath: string;
+    // Per-repo timeout in milliseconds. 60s default for auto-manifest;
+    // 120s for explicit invocation. Orchestrator picks; runner just enforces.
+    timeoutMs: number;
+    opts: BazelQueryOptions;
+};
+// Result of parsing one repo's cquery stream: the recovered artifacts (with
+// resolved coordinate edges in `deps`) plus any hub-prefixed dep labels that
+// could not be resolved.
+export type ParseCqueryResult = {
+    artifacts: ExtractedArtifact[];
+    unresolvedLabels: string[];
+};
+// Build the full cquery argv for a per-repo metadata cquery. Exposed for
+// argv-shape unit tests without touching `spawn`.
+export declare function buildMetadataCqueryArgv(repoName: string, opts: BazelQueryOptions): string[];
+// Strip the trailing version segment from a Maven coordinate, preserving any
+// packaging/classifier segments. `g:a:v` -> `g:a`,
+// `g:a:packaging:v` -> `g:a:packaging`,
+// `g:a:packaging:classifier:v` -> `g:a:packaging:classifier`. Coordinates with
+// fewer than 3 segments have no version to strip and are returned unchanged.
+// This matches depscan's `coordinateToParts` keying (position 3 = extension,
+// position 4 = classifier on the versionless key), so AAR/classifier artifacts
+// key correctly instead of being mis-keyed as bare `group:artifact` jars.
+export declare function versionlessCoordinate(coord: string): string;
+// Pure parser for the jsonproto cquery stream. Returns one
+// `ExtractedArtifact` per rule with a recoverable maven coordinate (its `deps`
+// holding resolved versionless coordinates) plus the set of hub-prefixed dep
+// labels that could not be resolved. The `sourceRepo` field carries
+// `<workspaceRelPath>:<repoName>` provenance when a workspace path was
+// provided; otherwise just the repo name.
+export declare function parseCqueryJsonproto(stdout: string, repoName: string, workspaceRelPath: string): ParseCqueryResult;
+// Spawn the per-repo metadata cquery, parse the result, and return a
+// structured outcome. On spawn timeout, return `status: 'timeout'` so the
+// orchestrator can reap the server (`bazel --output_user_root=<dir>
+// shutdown` + `rm -rf`) before moving on.
+export declare function runMetadataCqueryForRepo(args: RunMetadataCqueryArgs): Promise<CqueryRepoResult>;
+//# sourceMappingURL=bazel-cquery.d.mts.map

package/dist/types/commands/manifest/bazel/bazel-cquery.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bazel-cquery.d.mts","sourceRoot":"","sources":["../../../../../src/commands/manifest/bazel/bazel-cquery.mts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAEjE,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,gBAAgB,EAAE,MAAM,CAAA;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAA;AAE3E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,gBAAgB,EAAE,MAAM,CAAA;IACxB,MAAM,EAAE,YAAY,CAAA;IACpB,SAAS,EAAE,iBAAiB,EAAE,CAAA;IAC9B,uEAAuE;IACvE,yEAAyE;IACzE,+DAA+D;IAC/D,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,uEAAuE;IACvE,yDAAyD;IACzD,kCAAkC;IAClC,gBAAgB,EAAE,MAAM,CAAA;IACxB,mEAAmE;IACnE,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,iBAAiB,CAAA;CACxB,CAAA;AAED,4EAA4E;AAC5E,6EAA6E;AAC7E,yBAAyB;AACzB,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,iBAAiB,EAAE,CAAA;IAC9B,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAC3B,CAAA;AAqCD,yEAAyE;AACzE,kDAAkD;AAClD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,iBAAiB,GACtB,MAAM,EAAE,CAwBV;AAyED,6EAA6E;AAC7E,mDAAmD;AACnD,wCAAwC;AACxC,+EAA+E;AAC/E,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,0EAA0E;AAC1E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM3D;AAiKD,2DAA2D;AAC3D,+EAA+E;AAC/E,6EAA6E;AAC7E,oEAAoE;AACpE,uEAAuE;AACvE,0CAA0C;AAC1C,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,MAAM,GACvB,iBAAiB,CAmFnB;AAyBD,qEAAqE;AACrE,0EAA0E;AAC1E,oEAAoE;AACpE,0CAA0C;AAC1C,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,gBAAgB,CAAC,CAuE3B"}

package/dist/types/commands/manifest/bazel/bazel-pypi-discovery.d.mts

@@ -1,4 +1,17 @@
-import type { RepoProbe, ValidationResult } from './bazel-repo-discovery.mts';
+import type { RepoProbe } from './bazel-repo-discovery.mts';
+// Result shape returned by `validatePypiHub`. Kept local to the PyPI module
+// since validation here is hub-alias-marker based (different from the
+// Maven-side tri-state classifier).
+export type ValidationResult = {
+    valid: boolean;
+    // Probe stdout — populated whenever the probe was reachable, even when
+    // validation rejects the hub. Empty string when the probe itself threw.
+    stdout: string;
+};
+// Parse `bazel mod dump_repo_mapping "" --output=json` output. Also accepts
+// the older streamed jsonproto shape (apparentName / apparent_name records).
+// PyPI-only; the Maven path consumes `bazel mod show_extension` instead.
+export declare function parseVisibleRepoCandidates(output: string): string[];
 export type PypiHubInfo = {
     hubName: string;
     source: 'MODULE.bazel' | 'WORKSPACE' | 'WORKSPACE.bazel' | '.bzl' | 'visible-repos' | 'default-seed' | 'bazel-mod-show-extension';

package/dist/types/commands/manifest/bazel/bazel-pypi-discovery.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"bazel-pypi-discovery.d.mts","sourceRoot":"","sources":["../../../../../src/commands/manifest/bazel/bazel-pypi-discovery.mts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAwC7E,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EACF,cAAc,GACd,WAAW,GACX,iBAAiB,GACjB,MAAM,GACN,eAAe,GACf,cAAc,GACd,0BAA0B,CAAA;IAC9B,aAAa,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAA;IAC9C,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1C,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,WAAW,EAAE,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;CACxC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,WAAW,EACX,aAAa,GAAG,kBAAkB,CACnC,CAAA;AAED,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,OAAO,GAChB,gBAAgB,EAAE,CAoCpB;AA8GD,4EAA4E;AAC5E,iCAAiC;AACjC,EAAE;AACF,0EAA0E;AAC1E,4EAA4E;AAC5E,iEAAiE;AACjE,yEAAyE;AACzE,0EAA0E;AAC1E,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,OAAO,GAChB,gBAAgB,EAAE,CAoGpB;AAED,mEAAmE;AACnE,kEAAkE;AAClE,mDAAmD;AACnD,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,SAAS,EAChB,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,gBAAgB,CAAC,CA8B3B;AAOD,4EAA4E;AAC5E,6DAA6D;AAC7D,uDAAuD;AACvD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,EAChB,gBAAgB,CAAC,EAAE,MAAM,EAAE,EAC3B,OAAO,CAAC,EAAE,OAAO,EACjB,sBAAsB,CAAC,EAAE,gBAAgB,EAAE,GAC1C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAyDnC"}
+{"version":3,"file":"bazel-pypi-discovery.d.mts","sourceRoot":"","sources":["../../../../../src/commands/manifest/bazel/bazel-pypi-discovery.mts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAE3D,4EAA4E;AAC5E,sEAAsE;AACtE,oCAAoC;AACpC,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,OAAO,CAAA;IACd,yEAAuE;IACvE,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AA6CD,4EAA4E;AAC5E,6EAA6E;AAC7E,yEAAyE;AACzE,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CA8BnE;AAwCD,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EACF,cAAc,GACd,WAAW,GACX,iBAAiB,GACjB,MAAM,GACN,eAAe,GACf,cAAc,GACd,0BAA0B,CAAA;IAC9B,aAAa,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAA;IAC9C,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1C,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,WAAW,EAAE,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;CACxC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,WAAW,EACX,aAAa,GAAG,kBAAkB,CACnC,CAAA;AAED,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,OAAO,GAChB,gBAAgB,EAAE,CAoCpB;AA8GD,4EAA4E;AAC5E,iCAAiC;AACjC,EAAE;AACF,0EAA0E;AAC1E,4EAA4E;AAC5E,iEAAiE;AACjE,yEAAyE;AACzE,0EAA0E;AAC1E,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,OAAO,GAChB,gBAAgB,EAAE,CAoGpB;AAED,mEAAmE;AACnE,kEAAkE;AAClE,mDAAmD;AACnD,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,SAAS,EAChB,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,gBAAgB,CAAC,CA8B3B;AAOD,4EAA4E;AAC5E,6DAA6D;AAC7D,uDAAuD;AACvD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,EAChB,gBAAgB,CAAC,EAAE,MAAM,EAAE,EAC3B,OAAO,CAAC,EAAE,OAAO,EACjB,sBAAsB,CAAC,EAAE,gBAAgB,EAAE,GAC1C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAyDnC"}

package/dist/types/commands/manifest/bazel/bazel-query-runner.d.mts

@@ -6,6 +6,13 @@ export type BazelQueryOptions = {
     bazelRc?: string;
     bazelFlags?: string;
     bazelOutputBase?: string;
+    // Per-invocation `--output_user_root` for server isolation. When set, all
+    // argv builders inject it as a startup flag so a timed-out Bazel server
+    // can be reaped via `bazel --output_user_root=<this> shutdown` + `rm -rf`
+    // without disturbing the user's shared output_user_root. The Maven
+    // orchestrator mkdtemp's a fresh path per invocation; the legacy PyPI
+    // path may leave it unset for now.
+    outputUserRoot?: string;
     env?: NodeJS.ProcessEnv;
     verbose?: boolean;
 };
@@ -19,6 +26,21 @@ export type BazelQueryResult = {
 // whitespace are not supported (documented limitation; same trust model as
 // gradleOpts).
 export declare function splitBazelFlags(flags: string | undefined): string[];
+// Build the shared startup-flag prefix for any bazel invocation. Centralised
+// so `--output_user_root` propagates to every spawn — principle 7 of the
+// Maven design requires per-invocation server isolation across query,
+// cquery, and `bazel mod` commands alike.
+declare function buildStartupFlags(opts: BazelQueryOptions): string[];
+declare function buildBazelModShowVisibleReposArgv(opts: BazelQueryOptions): string[];
+declare function buildBazelModShowMavenExtensionArgv(opts: BazelQueryOptions): string[];
+declare function buildBazelModShowPipExtensionArgv(opts: BazelQueryOptions): string[];
+declare function buildBazelArgv(queryStr: string, opts: BazelQueryOptions, output?: string): string[];
+// Lightweight presence-check cquery used by the tri-state probe classifier.
+// `--keep_going --output=label` keeps it fast even on partial-analysis
+// repos and avoids paying for `--output=jsonproto` plus
+// `--proto:output_rule_attrs` (which the heavier metadata extraction in
+// `bazel-cquery.mts` needs but the probe does not).
+declare function buildBazelProbeCqueryArgv(repoName: string, opts: BazelQueryOptions): string[];
 /**
  * Run `bazel query` with the standardized argv shape and capture
  * stdout/stderr/code. Wraps the call in a spinner that resolves on success
@@ -27,29 +49,51 @@ export declare function splitBazelFlags(flags: string | undefined): string[];
  */
 export declare function runBazelQuery(queryStr: string, opts: BazelQueryOptions, output?: string): Promise<BazelQueryResult>;
 /**
- * Bzlmod-native visible repository enumeration. This is only a candidate
- * source; callers must still validate each returned apparent repo name with a
- * semantic query for generated ecosystem rules.
+ * Bzlmod-native visible repository enumeration. NOTE: only consumed by the
+ * legacy PyPI path; the Maven path uses `runBazelModShowMavenExtension`
+ * instead because `dump_repo_mapping` over-enumerates apparent names that
+ * are not Maven hubs.
  */
 export declare function runBazelModShowVisibleRepos(opts: BazelQueryOptions): Promise<BazelQueryResult>;
 /**
- * Bzlmod-native rules_python pip extension usage inspection. This is the
- * authoritative source for root-module pip.parse metadata when Bazel supports
- * the command; callers keep bounded static parsing as fallback.
+ * Bzlmod-native Maven hub enumeration via the rules_jvm_external maven
+ * extension. The text-format report lists every repo the extension
+ * generated; `parseShowExtensionOutput` (bazel-repo-discovery.mts)
+ * extracts the hubs from the `Fetched repositories:` section.
+ */
+export declare function runBazelModShowMavenExtension(opts: BazelQueryOptions): Promise<BazelQueryResult>;
+/**
+ * Bzlmod-native rules_python pip extension usage inspection. Used by the
+ * PyPI path; kept here since the argv shape is identical to the maven
+ * variant modulo the extension target.
  */
 export declare function runBazelModShowPipExtension(opts: BazelQueryOptions): Promise<BazelQueryResult>;
 /**
- * Build a `RepoProbe` (compatible with bazel-repo-discovery) bound to opts.
- * Used by `discoverMavenRepos` to validate candidate Maven repo
- * names against the running workspace.
+ * Build a `RepoProbe` (compatible with bazel-repo-discovery's tri-state
+ * classifier) bound to opts. Runs the lightweight presence-check cquery
+ * `@<name>//... --output=label --keep_going` — cheap enough to attempt
+ * every conventional Maven hub name without triggering `repository_rule`
+ * fetches on undefined names (Exp 3).
  */
-export declare function buildProbeFor(opts: BazelQueryOptions): RepoProbe;
+export declare function buildMavenProbeFor(opts: BazelQueryOptions): RepoProbe;
 /**
  * Build a `RepoProbe` for validating pip hub candidates.
- * Queries the hub for package targets (e.g. `@<hub>//...`) and returns
- * stdout so the caller can check for `:pkg` labels or alias rules.
- * Does NOT require `pypi_name=` tags in the hub output, because those
- * tags live on spoke repos, not the hub alias layer.
+ * Queries the hub for package targets (e.g. `@<hub>//...`) and returns the
+ * full result triple so the caller can check for `:pkg` labels or alias
+ * rules. Does NOT require `pypi_name=` tags in the hub output, because
+ * those tags live on spoke repos, not the hub alias layer.
  */
 export declare function buildPypiProbeFor(opts: BazelQueryOptions): RepoProbe;
+// Re-exported for direct test access — useful when asserting on argv shape
+// without spawning. Returns the exact argv `runBazelModShowMavenExtension`
+// would pass to spawn.
+export declare const _internalArgvBuilders: {
+    buildBazelArgv: typeof buildBazelArgv;
+    buildBazelModShowMavenExtensionArgv: typeof buildBazelModShowMavenExtensionArgv;
+    buildBazelModShowPipExtensionArgv: typeof buildBazelModShowPipExtensionArgv;
+    buildBazelModShowVisibleReposArgv: typeof buildBazelModShowVisibleReposArgv;
+    buildBazelProbeCqueryArgv: typeof buildBazelProbeCqueryArgv;
+    buildStartupFlags: typeof buildStartupFlags;
+};
+export {};
 //# sourceMappingURL=bazel-query-runner.d.mts.map

package/dist/types/commands/manifest/bazel/bazel-query-runner.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"bazel-query-runner.d.mts","sourceRoot":"","sources":["../../../../../src/commands/manifest/bazel/bazel-query-runner.mts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAE3D,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAQD,+DAA+D;AAC/D,+EAA6E;AAC7E,2EAA2E;AAC3E,eAAe;AACf,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAKnE;AA8ID;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,gBAAgB,CAAC,CAsC3B;AAED;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,gBAAgB,CAAC,CA0B3B;AAED;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,gBAAgB,CAAC,CA0B3B;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,SAAS,CAMhE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,GAAG,SAAS,CAMpE"}
+{"version":3,"file":"bazel-query-runner.d.mts","sourceRoot":"","sources":["../../../../../src/commands/manifest/bazel/bazel-query-runner.mts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAE3D,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,mEAAmE;IACnE,sEAAsE;IACtE,mCAAmC;IACnC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAQD,+DAA+D;AAC/D,+EAA6E;AAC7E,2EAA2E;AAC3E,eAAe;AACf,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAKnE;AAED,6EAA6E;AAC7E,2EAAyE;AACzE,sEAAsE;AACtE,0CAA0C;AAC1C,iBAAS,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAY5D;AAED,iBAAS,iCAAiC,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAU5E;AAED,iBAAS,mCAAmC,CAC1C,IAAI,EAAE,iBAAiB,GACtB,MAAM,EAAE,CAcV;AAED,iBAAS,iCAAiC,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAU5E;AAED,iBAAS,cAAc,CACrB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,iBAAiB,EACvB,MAAM,SAAU,GACf,MAAM,EAAE,CAeV;AAED,4EAA4E;AAC5E,uEAAuE;AACvE,wDAAwD;AACxD,wEAAwE;AACxE,oDAAoD;AACpD,iBAAS,yBAAyB,CAChC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,iBAAiB,GACtB,MAAM,EAAE,CAaV;AA4ED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,gBAAgB,CAAC,CAsC3B;AAiCD;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,gBAAgB,CAAC,CAM3B;AAED;;;;;GAKG;AACH,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,gBAAgB,CAAC,CAM3B;AAED;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,gBAAgB,CAAC,CAM3B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,GAAG,SAAS,CAUrE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,GAAG,SAAS,CAMpE;AAED,6EAA2E;AAC3E,2EAA2E;AAC3E,uBAAuB;AACvB,eAAO,MAAM,qBAAqB;;;;;;;CAOjC,CAAA"}

package/dist/types/commands/manifest/bazel/bazel-repo-discovery.d.mts

@@ -1,34 +1,47 @@
-// Parse `bazel mod dump_repo_mapping "" --output=json` output. Also accept the
-// older streamed jsonproto shape in case older Bazel versions or fixtures still
-// return repository records with apparentName fields.
-export declare function parseVisibleRepoCandidates(output: string): string[];
-// Step 1: parse candidate Maven repo names from Bzlmod and legacy entry points.
-export declare function parseMavenRepoCandidates(cwd: string, verbose?: boolean): string[];
-export type RepoProbe = (repoName: string) => Promise<{
-    stdout: string;
+// The importer token Bazel prints for a hub generated for the root module
+// itself (`(imported by <root>, …)`). Hubs imported only by rulesets
+// (`rules_jvm_external@6.7`, `stardoc@0.7.2`, …) are build-tooling, not the
+// user's SBOM, and are filtered out by the orchestrator.
+export declare const ROOT_MODULE_IMPORTER = "<root>";
+// One hub repo from a `bazel mod show_extension` report: its name plus the
+// modules that imported it (the `(imported by …)` annotation), merged across
+// every line the repo appears on.
+export type ShowExtensionRepo = {
+    name: string;
+    importers: string[];
+};
+export type ProbeResult = {
     code: number;
-}>;
-export type ValidationResult = {
-    valid: boolean;
-    // Probe stdout — populated whenever the probe was reachable, even when
-    // validation rejects the repo. Empty string when the probe itself threw.
     stdout: string;
+    stderr: string;
 };
-// Step 2: validate a candidate by running the probe and confirming
-// `maven_coordinates=` appears in stdout (the marker emitted by jvm_import /
-// aar_import rules generated by rules_jvm_external). Returns the probe
-// stdout alongside the verdict so the caller can cache it and reuse it
-// instead of running an identical extraction query.
-export declare function validateMavenRepo(repoName: string, probe: RepoProbe, verbose?: boolean): Promise<ValidationResult>;
-// Composition: parse, then validate each candidate; return validated subset
-// as a Map keyed by repo name with the validated probe stdout as value.
-// Map iteration order matches insertion order, so callers that just want
-// the list of repo names can call `Array.from(repos.keys())`. Callers that
-// want to skip re-running the same `bazel query` during extraction can read
-// the cached stdout off the Map and parse it directly.
-//
-// Always seeds with the default `@maven` repo name so repos whose
-// maven_install is defined in a sub-directory .bzl file (not reachable by
-// the top-level static scan) can still be discovered via probe validation.
-export declare function discoverMavenRepos(cwd: string, probe: RepoProbe, nativeCandidates?: string[], verbose?: boolean): Promise<Map<string, string>>;
+export type RepoProbe = (repoName: string) => Promise<ProbeResult>;
+export type ProbeStatus = 'populated' | 'empty' | 'not-defined';
+// Conventional Maven hub names rules_jvm_external sets up under
+// WORKSPACE-mode invocations. Probing each one is cheap (a failed visibility
+// lookup never triggers a `repository_rule` fetch) so the orchestrator can
+// try them all without paying the cost of a real cquery on undefined repos.
+export declare const CONVENTIONAL_MAVEN_REPO_NAMES: readonly string[];
+// Pure parser for `bazel mod show_extension @rules_jvm_external//:extensions.bzl%maven`
+// stdout. Returns the hub repos listed under `Fetched repositories:` — i.e.
+// items annotated with `(imported by ...)` — each carrying the set of modules
+// that imported it. Generated per-artifact repos (no annotation) are skipped.
+// A repo can legitimately appear on multiple lines with different importers,
+// so importers are merged per repo (name-only dedupe would lose that, and the
+// importers data is what lets the orchestrator keep only root-imported hubs).
+// Output is sorted by name. Tolerant of `DEBUG:` / `WARNING:` lines from
+// Bazel; the section header `## @@<canonical>//:extensions.bzl%maven:` is the
+// anchor.
+export declare function parseShowExtensionOutput(stdout: string): ShowExtensionRepo[];
+// Classify a raw probe result into one of three states. The probe contract
+// is whatever the runner emits — typically a lightweight
+// `cquery '@<name>//...' --keep_going --output=label`. The orchestrator
+// treats `empty` and `not-defined` uniformly as no-ops; the distinction
+// is preserved for verbose-mode diagnostics.
+export declare function classifyProbeResult(result: ProbeResult): ProbeStatus;
+// Convenience: probe a single candidate and return its classified status,
+// with optional verbose logging. Pure orchestration around `probe` +
+// `classifyProbeResult`; isolated so the test suite can exercise the
+// logging contract independently of the runner implementation.
+export declare function probeCandidate(repoName: string, probe: RepoProbe, verbose?: boolean): Promise<ProbeStatus>;
 //# sourceMappingURL=bazel-repo-discovery.d.mts.map

package/dist/types/commands/manifest/bazel/bazel-repo-discovery.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"bazel-repo-discovery.d.mts","sourceRoot":"","sources":["../../../../../src/commands/manifest/bazel/bazel-repo-discovery.mts"],"names":[],"mappings":"AAoIA,+EAA+E;AAC/E,gFAAgF;AAChF,sDAAsD;AACtD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAuBnE;AAED,gFAAgF;AAChF,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,OAAO,GAChB,MAAM,EAAE,CA8DV;AAED,MAAM,MAAM,SAAS,GAAG,CACtB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAE9C,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,OAAO,CAAA;IACd,yEAAuE;IACvE,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED,mEAAmE;AACnE,6EAA6E;AAC7E,uEAAuE;AACvE,uEAAuE;AACvE,oDAAoD;AACpD,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,SAAS,EAChB,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,gBAAgB,CAAC,CA8B3B;AAOD,4EAA4E;AAC5E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,4EAA4E;AAC5E,uDAAuD;AACvD,EAAE;AACF,kEAAkE;AAClE,0EAA0E;AAC1E,2EAA2E;AAC3E,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,EAChB,gBAAgB,CAAC,EAAE,MAAM,EAAE,EAC3B,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA4C9B"}
+{"version":3,"file":"bazel-repo-discovery.d.mts","sourceRoot":"","sources":["../../../../../src/commands/manifest/bazel/bazel-repo-discovery.mts"],"names":[],"mappings":"AAgBA,0EAA0E;AAC1E,uEAAqE;AACrE,8EAA4E;AAC5E,yDAAyD;AACzD,eAAO,MAAM,oBAAoB,WAAW,CAAA;AAE5C,2EAA2E;AAC3E,+EAA6E;AAC7E,kCAAkC;AAClC,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;AAElE,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,OAAO,GAAG,aAAa,CAAA;AAE/D,gEAAgE;AAChE,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAM1D,CAAA;AA4BD,wFAAwF;AACxF,8EAA4E;AAC5E,gFAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAC9E,UAAU;AACV,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,EAAE,CA0C5E;AAED,2EAA2E;AAC3E,2DAAyD;AACzD,wEAAwE;AACxE,wEAAwE;AACxE,6CAA6C;AAC7C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CA0BpE;AAED,0EAA0E;AAC1E,qEAAqE;AACrE,qEAAqE;AACrE,+DAA+D;AAC/D,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,SAAS,EAChB,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,WAAW,CAAC,CAmBtB"}

package/dist/types/commands/manifest/bazel/bazel-workspace-walk.d.mts

@@ -0,0 +1,18 @@
+export type FindWorkspaceRootsOptions = {
+    cwd: string;
+    // Directory basenames to skip outright (exact match). Pass the union of
+    // the codebase-wide ignore set (`IGNORED_DIRS` in `src/utils/glob.mts`)
+    // and any caller-specific additions (e.g. `.socket-auto-manifest`).
+    ignoreDirNames?: ReadonlySet<string>;
+    // Directory basename prefixes to skip. Bazel callers pass `['bazel-']` so
+    // the walk never descends into Bazel's output_base symlinks.
+    ignoreDirPrefixes?: readonly string[];
+    // Visited-directory budget override (testing); defaults to MAX_WALK_DIRS.
+    maxWalkDirs?: number;
+    verbose?: boolean;
+};
+// Walks the tree rooted at `opts.cwd` and returns absolute paths to every
+// directory that contains at least one workspace marker file. Output is
+// sorted for determinism and capped at MAX_WORKSPACE_ROOTS.
+export declare function findWorkspaceRoots(opts: FindWorkspaceRootsOptions): string[];
+//# sourceMappingURL=bazel-workspace-walk.d.mts.map

package/dist/types/commands/manifest/bazel/bazel-workspace-walk.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bazel-workspace-walk.d.mts","sourceRoot":"","sources":["../../../../../src/commands/manifest/bazel/bazel-workspace-walk.mts"],"names":[],"mappings":"AA+CA,MAAM,MAAM,yBAAyB,GAAG;IACtC,GAAG,EAAE,MAAM,CAAA;IACX,wEAAwE;IACxE,wEAAwE;IACxE,oEAAoE;IACpE,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACpC,0EAA0E;IAC1E,6DAA6D;IAC7D,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,CAAA;AAKD,0EAA0E;AAC1E,wEAAwE;AACxE,4DAA4D;AAC5D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,yBAAyB,GAAG,MAAM,EAAE,CAyF5E"}

package/dist/types/commands/manifest/bazel/cmd-manifest-bazel.d.mts

@@ -1,3 +1,4 @@
+import type { ExtractBazelStatus } from './extract_bazel_to_maven.mts';
 import type { CliCommandContext } from '../../../utils/meow-with-subcommands.mts';
 export declare const cmdManifestBazel: {
     description: string;
@@ -6,22 +7,23 @@ export declare const cmdManifestBazel: {
 };
 export type EcosystemOutcome = {
     ecosystem: 'maven' | 'pypi';
-    ok: boolean;
-    noEcosystemFound?: boolean | undefined;
-    hardFailure?: boolean;
-    manifestPath?: string | undefined;
+    status: ExtractBazelStatus;
+    manifestPaths: string[];
 };
 // Pure outcome-matrix evaluator. Exported so dispatcher behavior can be
 // unit-tested without spawning the CLI binary. Throws InputError on
 // failures that must propagate to a non-zero CLI exit; returns void on
 // success.
 //
-// - Hard failure: ok === false && !noEcosystemFound. The ecosystem was
-//   detected (or the runner crashed), but extraction failed. Always a
-//   non-zero exit, even when another ecosystem succeeded.
-// - No-discovery: noEcosystemFound === true. Genuinely absent ecosystem.
-//   Auto-detect mode tolerates this when at least one other ecosystem
-//   succeeded; explicit mode treats it as an error.
+// - `complete`/`partial` both count as produced output (>=1 manifest).
+//   `partial` additionally warns — a known-incomplete SBOM is still emitted,
+//   not a hard error.
+// - `hardFailure`: the ecosystem was detected (or the runner crashed) but
+//   wrote zero manifests. Always a non-zero exit, even when another
+//   ecosystem succeeded.
+// - `noEcosystem`: genuinely absent ecosystem. Auto-detect mode tolerates it
+//   when at least one other ecosystem produced output; explicit mode treats
+//   it as an error (the user requested an ecosystem that isn't there).
 export declare function evaluateEcosystemOutcomes(outcomes: readonly EcosystemOutcome[], isExplicit: boolean): void;
 declare function run(argv: string[] | readonly string[], importMeta: ImportMeta, { parentName }: CliCommandContext): Promise<void>;
 export {};

package/dist/types/commands/manifest/bazel/cmd-manifest-bazel.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"cmd-manifest-bazel.d.mts","sourceRoot":"","sources":["../../../../../src/commands/manifest/bazel/cmd-manifest-bazel.mts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAEV,iBAAiB,EAClB,MAAM,0CAA0C,CAAA;AA2EjD,eAAO,MAAM,gBAAgB;;;;CAI5B,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,OAAO,GAAG,MAAM,CAAA;IAC3B,EAAE,EAAE,OAAO,CAAA;IACX,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IACtC,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAClC,CAAA;AAED,wEAAwE;AACxE,oEAAoE;AACpE,uEAAuE;AACvE,WAAW;AACX,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,0DAA0D;AAC1D,yEAAyE;AACzE,sEAAsE;AACtE,oDAAoD;AACpD,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,EACrC,UAAU,EAAE,OAAO,GAClB,IAAI,CAiCN;AAED,iBAAe,GAAG,CAChB,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EAClC,UAAU,EAAE,UAAU,EACtB,EAAE,UAAU,EAAE,EAAE,iBAAiB,GAChC,OAAO,CAAC,IAAI,CAAC,CA+Kf"}
+{"version":3,"file":"cmd-manifest-bazel.d.mts","sourceRoot":"","sources":["../../../../../src/commands/manifest/bazel/cmd-manifest-bazel.mts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AACtE,OAAO,KAAK,EAEV,iBAAiB,EAClB,MAAM,0CAA0C,CAAA;AAkFjD,eAAO,MAAM,gBAAgB;;;;CAI5B,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,OAAO,GAAG,MAAM,CAAA;IAC3B,MAAM,EAAE,kBAAkB,CAAA;IAC1B,aAAa,EAAE,MAAM,EAAE,CAAA;CACxB,CAAA;AAED,wEAAwE;AACxE,oEAAoE;AACpE,uEAAuE;AACvE,WAAW;AACX,EAAE;AACF,uEAAuE;AACvE,+EAA6E;AAC7E,sBAAsB;AACtB,0EAA0E;AAC1E,oEAAoE;AACpE,yBAAyB;AACzB,6EAA6E;AAC7E,4EAA4E;AAC5E,uEAAuE;AACvE,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,EACrC,UAAU,EAAE,OAAO,GAClB,IAAI,CA8CN;AAuBD,iBAAe,GAAG,CAChB,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EAClC,UAAU,EAAE,UAAU,EACtB,EAAE,UAAU,EAAE,EAAE,iBAAiB,GAChC,OAAO,CAAC,IAAI,CAAC,CA4Kf"}

package/dist/types/commands/manifest/bazel/extract_bazel_to_maven.d.mts

@@ -1,4 +1,4 @@
-import type { ExtractedArtifact } from './bazel-build-parser.mts';
+import type { ExtractedArtifact } from './bazel-cquery.mts';
 export type ExtractBazelOptions = {
     bazelFlags: string | undefined;
     bazelOutputBase: string | undefined;
@@ -7,28 +7,90 @@ export type ExtractBazelOptions = {
     cwd: string;
     // Optional env override used for python-shim PATH augmentation.
     env?: NodeJS.ProcessEnv;
+    // Directory basenames the workspace walker must not descend into.
+    // Caller-supplied so the orchestrator stays generic; the CLI command
+    // composes the codebase-wide `IGNORED_DIRS` with Bazel-specific dirs
+    // like `.socket-auto-manifest`.
+    ignoreDirNames?: ReadonlySet<string> | undefined;
+    // Directory basename prefixes the workspace walker must not descend
+    // into. Caller-supplied so the orchestrator stays generic; the CLI
+    // command supplies `bazel-` for Bazel's output_base symlinks.
+    ignoreDirPrefixes?: readonly string[] | undefined;
     out: string;
     // Use the auto-manifest sibling directory instead of writing directly to `out`.
     outLayout?: 'flat';
+    // Per-repo cquery timeout in milliseconds. Auto-manifest default is 60s
+    // (the orchestrator's job is to not stall the wider scan); explicit
+    // invocations may bump it.
+    perRepoTimeoutMs?: number | undefined;
     verbose: boolean;
 };
+// Best-effort-per-hub produces four distinct run outcomes a single `ok`
+// boolean would conflate:
+//  - `complete`    — every discovered hub extracted cleanly; >=1 manifest.
+//  - `partial`     — >=1 manifest written, but at least one hub failed,
+//                    timed out, or dropped edges. Worth uploading, but the
+//                    graph is known-incomplete.
+//  - `noEcosystem` — no Bazel/Maven found. Whether that's an error is
+//                    caller-dependent (tolerated in auto mode, error in
+//                    explicit mode), so it must NOT be flattened into the
+//                    failure states.
+//  - `hardFailure` — zero manifests written and it wasn't `noEcosystem`
+//                    (discovery threw, or every discovered hub failed).
+//                    Always an error for every caller.
+export type ExtractBazelStatus = 'complete' | 'hardFailure' | 'noEcosystem' | 'partial';
 export type ExtractBazelResult = {
     artifactCount: number;
-    manifestPath?: string | undefined;
-    noEcosystemFound?: boolean | undefined;
-    ok: boolean;
+    manifestPaths: string[];
+    status: ExtractBazelStatus;
 };
+// Default directory-prune policy for the Bazel workspace walk. The
+// orchestrator applies this unconditionally so neither caller (the explicit
+// `socket manifest bazel` command nor `--auto-manifest`) can omit it and let
+// the walk descend `node_modules`/VCS/vendored trees. Callers may
+// pass extra names/prefixes to EXTEND, not replace, this set.
+export declare const DEFAULT_BAZEL_WALKER_IGNORE_DIR_NAMES: ReadonlySet<string>;
+// Bazel's `bazel-*` output_base symlinks.
+export declare const DEFAULT_BAZEL_WALKER_IGNORE_DIR_PREFIXES: readonly string[];
 type MavenInstallJsonCurrent = {
     artifacts: Record<string, {
-        shasums: {
-            jar?: string;
-        };
         version: string;
     }>;
     dependencies: Record<string, string[]>;
     repositories?: Record<string, string[]>;
 };
-export declare function normalizeToMavenInstallJson(artifacts: ExtractedArtifact[]): MavenInstallJsonCurrent;
+export type NormalizeResult = {
+    json: MavenInstallJsonCurrent;
+    // Versionless keys skipped because the coordinate was malformed (key shape
+    // outside 2-4 non-empty segments, or an empty version). Known data loss.
+    droppedArtifacts: string[];
+    // `source -> target` edges pruned because one endpoint wasn't an emitted
+    // artifact. Known data loss.
+    prunedEdges: string[];
+};
+// Builds a modern `maven_install.json` from artifacts whose `deps` already
+// hold resolved versionless coordinates (the cquery parser resolves edge
+// labels against each repo's own targets while `repoName` is in scope, so no
+// label-to-coordinate resolution happens here). Keys are versionless `g:a`
+// (preserving any packaging/classifier segments); dependency values are the
+// resolved coordinate sets.
+//
+// Two-phase so the emitted graph is internally closed and survives the server
+// parser, which rejects malformed coordinates and edges referencing unlisted
+// artifacts (and can abort after enough errors). Phase 1 builds (and
+// validates) the artifact keys; phase 2 emits only edges whose source AND
+// target are valid emitted keys. Anything dropped is reported so the caller
+// can flip the hub partial — never silently lost post-upload.
+export declare function normalizeToMavenInstallJson(artifacts: ExtractedArtifact[]): NormalizeResult;
+// Cross-workspace dedup keyed on the full Maven coordinate string
+// (`g:a:v[:classifier]`). The metadata cquery emits one entry per rule,
+// so the same `androidx.annotation:annotation:1.8.2` can show up in
+// `examples/dagger/@maven` and `examples/ksp/@maven` in rules_kotlin —
+// downstream only needs it once. Each occurrence resolves its edges against
+// its own repo's targets, so the resolved `deps` can legitimately differ
+// between occurrences; union them rather than keeping only the first, or
+// real graph edges would be silently dropped.
+export declare function dedupArtifactsByCoord(artifacts: ExtractedArtifact[]): ExtractedArtifact[];
 export declare function extractBazelToMaven(opts: ExtractBazelOptions): Promise<ExtractBazelResult>;
 export {};
 //# sourceMappingURL=extract_bazel_to_maven.d.mts.map

package/dist/types/commands/manifest/bazel/extract_bazel_to_maven.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"extract_bazel_to_maven.d.mts","sourceRoot":"","sources":["../../../../../src/commands/manifest/bazel/extract_bazel_to_maven.mts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAGjE,MAAM,MAAM,mBAAmB,GAAG;IAChC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9B,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;IACnC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IACvB,GAAG,EAAE,MAAM,CAAA;IACX,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,GAAG,EAAE,MAAM,CAAA;IACX,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IACtC,EAAE,EAAE,OAAO,CAAA;CACZ,CAAA;AAiBD,KAAK,uBAAuB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACzE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;CACxC,CAAA;AA2DD,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,iBAAiB,EAAE,GAC7B,uBAAuB,CAqEzB;AA6HD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CA8K7B"}
+{"version":3,"file":"extract_bazel_to_maven.d.mts","sourceRoot":"","sources":["../../../../../src/commands/manifest/bazel/extract_bazel_to_maven.mts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAoB,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAI7E,MAAM,MAAM,mBAAmB,GAAG;IAChC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9B,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;IACnC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IACvB,GAAG,EAAE,MAAM,CAAA;IACX,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,kEAAkE;IAClE,qEAAqE;IACrE,qEAAqE;IACrE,gCAAgC;IAChC,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IAChD,oEAAoE;IACpE,mEAAmE;IACnE,8DAA8D;IAC9D,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;IACjD,GAAG,EAAE,MAAM,CAAA;IACX,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,wEAAwE;IACxE,oEAAoE;IACpE,2BAA2B;IAC3B,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACrC,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,wEAAwE;AACxE,0BAA0B;AAC1B,6EAA2E;AAC3E,0EAAwE;AACxE,2EAA2E;AAC3E,gDAAgD;AAChD,wEAAsE;AACtE,wEAAwE;AACxE,0EAA0E;AAC1E,qCAAqC;AACrC,0EAAwE;AACxE,wEAAwE;AACxE,uDAAuD;AACvD,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,aAAa,GACb,aAAa,GACb,SAAS,CAAA;AAEb,MAAM,MAAM,kBAAkB,GAAG;IAC/B,aAAa,EAAE,MAAM,CAAA;IACrB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,MAAM,EAAE,kBAAkB,CAAA;CAC3B,CAAA;AAKD,mEAAmE;AACnE,4EAA4E;AAC5E,6EAA6E;AAC7E,kEAAkE;AAClE,8DAA8D;AAC9D,eAAO,MAAM,qCAAqC,EAAE,WAAW,CAAC,MAAM,CASlE,CAAA;AACJ,0CAA0C;AAC1C,eAAO,MAAM,wCAAwC,EAAE,SAAS,MAAM,EAErE,CAAA;AAiBD,KAAK,uBAAuB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9C,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;CACxC,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,uBAAuB,CAAA;IAC7B,2EAA2E;IAC3E,yEAAyE;IACzE,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,yEAAyE;IACzE,6BAA6B;IAC7B,WAAW,EAAE,MAAM,EAAE,CAAA;CACtB,CAAA;AAcD,2EAA2E;AAC3E,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,4BAA4B;AAC5B,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,qEAAqE;AACrE,0EAA0E;AAC1E,4EAA4E;AAC5E,gEAA8D;AAC9D,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,iBAAiB,EAAE,GAC7B,eAAe,CAmEjB;AAED,kEAAkE;AAClE,wEAAwE;AACxE,oEAAoE;AACpE,yEAAuE;AACvE,4EAA4E;AAC5E,yEAAyE;AACzE,yEAAyE;AACzE,8CAA8C;AAC9C,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,iBAAiB,EAAE,GAC7B,iBAAiB,EAAE,CAerB;AA0MD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAsS7B"}

package/dist/types/commands/manifest/cmd-manifest-gradle.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"cmd-manifest-gradle.d.mts","sourceRoot":"","sources":["../../../../src/commands/manifest/cmd-manifest-gradle.mts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAEV,iBAAiB,EAClB,MAAM,uCAAuC,CAAA;AAiF9C,eAAO,MAAM,iBAAiB;;;;CAI7B,CAAA;AAED,iBAAe,GAAG,CAChB,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EAClC,UAAU,EAAE,UAAU,EACtB,EAAE,UAAU,EAAE,EAAE,iBAAiB,GAChC,OAAO,CAAC,IAAI,CAAC,CA8Jf"}
+{"version":3,"file":"cmd-manifest-gradle.d.mts","sourceRoot":"","sources":["../../../../src/commands/manifest/cmd-manifest-gradle.mts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAEV,iBAAiB,EAClB,MAAM,uCAAuC,CAAA;AAqF9C,eAAO,MAAM,iBAAiB;;;;CAI7B,CAAA;AAED,iBAAe,GAAG,CAChB,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EAClC,UAAU,EAAE,UAAU,EACtB,EAAE,UAAU,EAAE,EAAE,iBAAiB,GAChC,OAAO,CAAC,IAAI,CAAC,CAiMf"}

package/dist/types/commands/manifest/cmd-manifest-kotlin.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"cmd-manifest-kotlin.d.mts","sourceRoot":"","sources":["../../../../src/commands/manifest/cmd-manifest-kotlin.mts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAEV,iBAAiB,EAClB,MAAM,uCAAuC,CAAA;AA6E9C,eAAO,MAAM,iBAAiB;;;;CAI7B,CAAA;AAED,iBAAe,GAAG,CAChB,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EAClC,UAAU,EAAE,UAAU,EACtB,EAAE,UAAU,EAAE,EAAE,iBAAiB,GAChC,OAAO,CAAC,IAAI,CAAC,CAyJf"}
+{"version":3,"file":"cmd-manifest-kotlin.d.mts","sourceRoot":"","sources":["../../../../src/commands/manifest/cmd-manifest-kotlin.mts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAEV,iBAAiB,EAClB,MAAM,uCAAuC,CAAA;AA0F9C,eAAO,MAAM,iBAAiB;;;;CAI7B,CAAA;AAED,iBAAe,GAAG,CAChB,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EAClC,UAAU,EAAE,UAAU,EACtB,EAAE,UAAU,EAAE,EAAE,iBAAiB,GAChC,OAAO,CAAC,IAAI,CAAC,CA+Lf"}

package/dist/types/commands/manifest/cmd-manifest-scala.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"cmd-manifest-scala.d.mts","sourceRoot":"","sources":["../../../../src/commands/manifest/cmd-manifest-scala.mts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAEV,iBAAiB,EAClB,MAAM,uCAAuC,CAAA;AAiG9C,eAAO,MAAM,gBAAgB;;;;CAI5B,CAAA;AAED,iBAAe,GAAG,CAChB,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EAClC,UAAU,EAAE,UAAU,EACtB,EAAE,UAAU,EAAE,EAAE,iBAAiB,GAChC,OAAO,CAAC,IAAI,CAAC,CA6Lf"}
+{"version":3,"file":"cmd-manifest-scala.d.mts","sourceRoot":"","sources":["../../../../src/commands/manifest/cmd-manifest-scala.mts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAEV,iBAAiB,EAClB,MAAM,uCAAuC,CAAA;AA0G9C,eAAO,MAAM,gBAAgB;;;;CAI5B,CAAA;AAED,iBAAe,GAAG,CAChB,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EAClC,UAAU,EAAE,UAAU,EACtB,EAAE,UAAU,EAAE,EAAE,iBAAiB,GAChC,OAAO,CAAC,IAAI,CAAC,CAsOf"}

package/dist/types/commands/manifest/coana-manifest-facts.d.mts

@@ -0,0 +1,27 @@
+// Delegates Socket facts generation for a JVM build tool to the Coana CLI's
+// `manifest <ecosystem>` command. The build-tool resolution scripts (the Gradle
+// init script and the sbt plugin) live in Coana now, so socket-cli no longer
+// runs them itself; it only asks Coana for the uploadable `.socket.facts.json`.
+//
+// The resolved artifact-paths sidecar is intentionally NOT requested here: it
+// only matters for reachability analysis, which is internal to Coana, so Coana
+// emits it itself when it runs reachability. `socket manifest` only needs the
+// facts file.
+//
+// `spawnCoanaDlx` resolves the Coana CLI via dlx (or a local build when
+// `SOCKET_CLI_COANA_LOCAL_PATH` is set). `bin` (the gradle/sbt executable) is
+// always resolved by the caller to a concrete default (`<cwd>/gradlew`, or
+// `sbt` on PATH) before we get here, so it is forwarded verbatim; the empty
+// guard below is just a cheap safeguard against passing `--bin ''`.
+export declare function runCoanaManifestFacts({ bin, buildOpts, buildOptsFlag, cwd, ecosystem, excludeConfigs, ignoreUnresolved, includeConfigs, verbose }: {
+    bin: string;
+    buildOpts: string[];
+    buildOptsFlag: '--gradle-opts' | '--sbt-opts';
+    cwd: string;
+    ecosystem: 'gradle' | 'sbt';
+    excludeConfigs: string;
+    ignoreUnresolved: boolean;
+    includeConfigs: string;
+    verbose: boolean;
+}): Promise<void>;
+//# sourceMappingURL=coana-manifest-facts.d.mts.map

package/dist/types/commands/manifest/coana-manifest-facts.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coana-manifest-facts.d.mts","sourceRoot":"","sources":["../../../../src/commands/manifest/coana-manifest-facts.mts"],"names":[],"mappings":"AAQA,4EAA4E;AAC5E,gFAAgF;AAChF,6EAA6E;AAC7E,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAC9E,cAAc;AACd,EAAE;AACF,wEAAwE;AACxE,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,oEAAoE;AACpE,wBAAsB,qBAAqB,CAAC,EAC1C,GAAG,EACH,SAAS,EACT,aAAa,EACb,GAAG,EACH,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,OAAO,EACR,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,aAAa,EAAE,eAAe,GAAG,YAAY,CAAA;IAC7C,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,QAAQ,GAAG,KAAK,CAAA;IAC3B,cAAc,EAAE,MAAM,CAAA;IACtB,gBAAgB,EAAE,OAAO,CAAA;IACzB,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,OAAO,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgFhB"}

package/dist/types/commands/manifest/convert-gradle-to-facts.d.mts

@@ -1,9 +1,15 @@
-export declare function convertGradleToFacts({ bin, configs, cwd, gradleOpts, ignoreUnresolved, verbose }: {
+// Generates a `.socket.facts.json` for a Gradle project by delegating to the
+// Coana CLI's `manifest gradle` command (which owns the Gradle init script that
+// resolves the dependency graph). socket-cli no longer runs gradle itself; an
+// explicit `bin` is forwarded as `--bin`, otherwise Coana defaults to
+// `./gradlew`.
+export declare function convertGradleToFacts({ bin, cwd, excludeConfigs, gradleOpts, ignoreUnresolved, includeConfigs, verbose }: {
     bin: string;
-    configs: string;
     cwd: string;
+    excludeConfigs: string;
     gradleOpts: string[];
     ignoreUnresolved: boolean;
+    includeConfigs: string;
     verbose: boolean;
 }): Promise<void>;
 //# sourceMappingURL=convert-gradle-to-facts.d.mts.map

package/dist/types/commands/manifest/convert-gradle-to-facts.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"convert-gradle-to-facts.d.mts","sourceRoot":"","sources":["../../../../src/commands/manifest/convert-gradle-to-facts.mts"],"names":[],"mappings":"AAQA,wBAAsB,oBAAoB,CAAC,EACzC,GAAG,EACH,OAAO,EACP,GAAG,EACH,UAAU,EACV,gBAAgB,EAChB,OAAO,EACR,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,gBAAgB,EAAE,OAAO,CAAA;IACzB,OAAO,EAAE,OAAO,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0HhB"}
+{"version":3,"file":"convert-gradle-to-facts.d.mts","sourceRoot":"","sources":["../../../../src/commands/manifest/convert-gradle-to-facts.mts"],"names":[],"mappings":"AAEA,6EAA6E;AAC7E,gFAAgF;AAChF,8EAA8E;AAC9E,sEAAsE;AACtE,eAAe;AACf,wBAAsB,oBAAoB,CAAC,EACzC,GAAG,EACH,GAAG,EACH,cAAc,EACd,UAAU,EACV,gBAAgB,EAChB,cAAc,EACd,OAAO,EACR,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,EAAE,MAAM,CAAA;IACtB,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,gBAAgB,EAAE,OAAO,CAAA;IACzB,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,OAAO,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAYhB"}

package/dist/types/commands/manifest/convert-sbt-to-facts.d.mts

@@ -1,8 +1,16 @@
-export declare function convertSbtToFacts({ bin, configs, cwd, ignoreUnresolved, sbtOpts, verbose }: {
+// Generates a `.socket.facts.json` for an sbt project by delegating to the
+// Coana CLI's `manifest sbt` command (which owns the sbt plugin that resolves
+// the dependency graph). socket-cli no longer runs sbt itself; an explicit
+// `bin` is forwarded as `--bin`, otherwise Coana defaults to `sbt` on PATH.
+// JDK-compatibility guidance (sbt 0.13/early 1.x cannot run on modern JDKs) is
+// handled by Coana; pass a compatible JDK via `--sbt-opts "--java-home <path>"`
+// or `JAVA_HOME`.
+export declare function convertSbtToFacts({ bin, cwd, excludeConfigs, ignoreUnresolved, includeConfigs, sbtOpts, verbose }: {
     bin: string;
-    configs: string;
     cwd: string;
+    excludeConfigs: string;
     ignoreUnresolved: boolean;
+    includeConfigs: string;
     sbtOpts: string[];
     verbose: boolean;
 }): Promise<void>;