[vibgrate-team]

Summary

vg sbom export keeps vibgrate:scope / SPDX scope= as direct or transitive, and now reads the scanned manifest section when it writes dependency kind.

• A devDependencies row sets CycloneDX component scope to excluded and writes SPDX DEV_DEPENDENCY_OF from that package to SPDXRef-DOCUMENT. It stays out of the CycloneDX root dependsOn list. Child edges stay DEPENDS_ON.
• An optionalDependencies row sets component scope to optional and writes OPTIONAL_DEPENDENCY_OF in that same direction. That relationship replaces a root DEPENDS_ON when the lockfile already lists the package.
• Production, peer, and lockfile-only rows omit component scope. Peer edges stay DEPENDS_ON. required is never written. BUILD_DEPENDENCY_OF, TEST_DEPENDENCY_OF, and RUNTIME_DEPENDENCY_OF stay omitted.
• When the same name and version is declared in more than one section, one mark is written. Development wins when the package is not also in dependencies. Optional wins over a production listing. Production outranks development. Peer alone is unmarked. The same inputs produce the same mark whichever row is listed first.
• When the lockfile records no edges, CycloneDX still omits dependencies and SPDX still omits DEPENDS_ON. A scanned development or optional dependency still produces DEV_DEPENDENCY_OF or OPTIONAL_DEPENDENCY_OF, including under --no-transitive.
• The document id seed includes the mark, so a section-only change produces a new serialNumber / documentNamespace.

The contract, the worked scope-fixture example, and the gap list are updated in docs/sbom-dependency-scope.md, DOCS.md, and README.md.

Related issues

Fixes #418

Checklist

• pnpm test passes
• pnpm lint is clean
• pnpm typecheck is clean
• Docs updated (README / DOCS / ARCHITECTURE) where behavior changed
• Determinism preserved — identical input still produces identical graph.json / report output (content-hashed IDs, stable sorts; no time, randomness, or filesystem-order dependence)
• No proprietary or internal references — public, Apache-2.0 content only
• Commits use Conventional Commits and are signed off (git commit -s, DCO)

Notes for reviewers

excluded classifies a development dependency; it does not remove the component. An omitted component scope is what the spec reads as required, so production, peer, and lockfile-only rows stay distinct from a written optional or excluded. A child of a development package is not itself marked excluded or DEV_DEPENDENCY_OF. Lockfile flags (dev, optional, devOptional, and the equivalents in other ecosystems) are still not read.