Question about direct and transitive dependencies

[almaz045]

Let's imagine a situation where we import a transitive dependency from the main dependency:
import {transitive_dep} from {direct_dep}.

In the main dependency, we have transitive dependency export allowed:
export {transitive_dep}

In this case, will depscan mark the used {transitive_dev} dependency in our code as a direct dependency or also a transitive one?

[prabhu]

@almaz045 Easier to test with a sample repo. It's also an atom or cdxgen question more than dep-scan, since dep-scan relies on the scope attribute and the occurrence evidence in the SBOM for determining direct vs indirect.