feat(manifest): mark build modules as firstParty in facts components (#1569)

* feat(manifest): mark build modules as firstParty in facts components

Components whose exact GAV is a module of the scanned build now carry
`firstParty: true` in .socket.facts.json, for maven, gradle and sbt. This
lets dependency resolution stop treating the build's own modules as
published packages that block upgrades. The match reuses the same GAV
lookup that attaches project sources/targets. Published releases of a
sibling module stay unmarked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test(manifest): pin firstParty to sidecar components, never projects

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor(manifest): type firstParty as true-only

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: jfblaa

src/commands/manifest/scripts/assemble.mts

@@ -54,7 +54,11 @@ export function assembleFacts(
   const { directByRoot, finalNodes } = mergeByCoordinate(perRoot)
 
   const tool = (parsed.tool || 'gradle') as SocketFactsSbomMetadata['tool']
-  const components = buildComponents(finalNodes)
+  const projectsByGav = new Map<string, RawProject>()
+  for (const p of parsed.projects.values()) {
+    projectsByGav.set(gav(p.group, p.name, p.version), p)
+  }
+  const components = buildComponents(finalNodes, projectsByGav)
   const projects =
     opts.emitProjects === false
       ? []
@@ -77,6 +81,7 @@ export function assembleFacts(
     artifactPaths: buildArtifactPaths(
       finalNodes,
       [...parsed.projects.values()],
+      projectsByGav,
       perRoot,
       fileExists,
     ),
@@ -173,6 +178,7 @@ function mergeByCoordinate(perRoot: Map<string, PerRoot>): {
 
 function buildComponents(
   finalNodes: Map<string, MergedNode>,
+  projectsByGav: Map<string, RawProject>,
 ): SocketFactsSbomComponent[] {
   return [...finalNodes.keys()].sort().map(id => {
     const fn = finalNodes.get(id)!
@@ -200,6 +206,9 @@ function buildComponents(
     if (!fn.prod) {
       comp.dev = true
     }
+    if (projectsByGav.has(gav(c.group, c.name, c.version ?? ''))) {
+      comp.firstParty = true
+    }
     if (fn.children.size) {
       comp.dependencies = [...fn.children].sort()
     }
@@ -303,19 +312,10 @@ function buildClasspathByProject(
 function buildArtifactPaths(
   finalNodes: Map<string, MergedNode>,
   projects: RawProject[],
+  projectsByGav: Map<string, RawProject>,
   perRoot: Map<string, PerRoot>,
   fileExists: (path: string) => boolean,
 ): ResolvedArtifactPaths {
-  const projectsByGav = new Map<
-    string,
-    { sources: string[]; targets: string[] }
-  >()
-  for (const p of projects) {
-    projectsByGav.set(gav(p.group, p.name, p.version), {
-      sources: p.sources,
-      targets: p.targets,
-    })
-  }
   const targetsByCoord = new Map<string, string[]>()
   const targetsByGav = new Map<string, string[]>()
   const sourcesByCoord = new Map<string, string[]>()

src/commands/manifest/scripts/assemble.test.mts

@@ -116,4 +116,37 @@ describe('records → assemble → sidecar', () => {
       'g:lib:jar:1',
     ])
   })
+  it('marks only components with the exact coordinate of a build module as firstParty', () => {
+    const records = [
+      'meta\tmaven\t3.9.6\t17',
+      'project\t:a\tg\ta\t1.0-SNAPSHOT\ta',
+      'project\t:b\tg\tb\t1.0-SNAPSHOT\tb',
+      'root\tr1\t:a\truntimeClasspath\t1',
+      'node\tr1\tg:ext:jar:2\tg\text\t2\tjar\t\t1',
+      'root\tr2\t:b\truntimeClasspath\t1',
+      'node\tr2\tg:a:jar:1.0-SNAPSHOT\tg\ta\t1.0-SNAPSHOT\tjar\t\t1',
+      'node\tr2\tg:ext:jar:2\tg\text\t2\tjar\t\t0',
+      'edge\tr2\tg:a:jar:1.0-SNAPSHOT\tg:ext:jar:2',
+      'node\tr2\tg:b:jar:0.9\tg\tb\t0.9\tjar\t\t1',
+    ].join('\n')
+    const { artifactPaths, facts } = assembleFacts(parseRecords(records))
+
+    expect(facts.components.map(c => [c.id, c.firstParty ?? 'absent'])).toEqual(
+      [
+        ['g:a:jar:1.0-SNAPSHOT', true],
+        ['g:b:jar:0.9', 'absent'],
+        ['g:ext:jar:2', 'absent'],
+      ],
+    )
+
+    const acc: SidecarAccumulator = new Map()
+    accumulateSidecar(acc, facts, artifactPaths, '/abs/.socket.facts.json')
+    const bucket = serializeSidecar(acc)['/abs/.socket.facts.json']!
+    expect(
+      bucket.components.find(c => c.id === 'g:a:jar:1.0-SNAPSHOT')?.firstParty,
+    ).toBe(true)
+    for (const project of bucket.projects) {
+      expect(project).not.toHaveProperty('firstParty')
+    }
+  })
 })

src/commands/manifest/scripts/facts.mts

@@ -27,6 +27,8 @@ export type SocketFactsSbomComponent = AnyPURL & {
   id: string
   direct?: boolean | undefined
   dev?: boolean | undefined
+  // A module of the scanned build itself (same GAV as a projects[] entry).
+  firstParty?: true | undefined
   dependencies?: string[] | undefined
 }