docs: reorganize navigation and group detector pages by ecosystem

CONTRIBUTING.md

@@ -133,7 +133,7 @@ User-facing docs live in [`docs/`](docs/). Most pages are handwritten; some are
 Run `make generate` after changing any of:
 
 - `internal/config/config.go` — regenerates `docs/CONFIG_REFERENCE.md`
-- `sdk/catalog.go`, `sdk/support_matrix.go`, `internal/registry/support.go` — regenerates `docs/SUPPORT_MATRIX.md` and `docs/detectors/ecosystems/*.md`
+- `sdk/catalog.go`, `sdk/support_matrix.go`, `internal/registry/support.go` — regenerates `docs/SUPPORT_MATRIX.md` and `docs/detectors/*.md`
 - `internal/output/*` or scan/explain/diff response types — regenerates `docs/schemas/*.md`
 - `internal/support/component_docs.go` — regenerates `docs/{DETECTORS,MATCHERS,AUDITORS}.md` and `docs/matchers/*.md`
 

docs/DETECTORS.md

@@ -20,7 +20,7 @@ For example, the `npm` chain is `npm-detector` → `syft-detector`:
 1. `npm-detector` parses `package-lock.json` directly and resolves the full transitive graph.
 2. `syft-detector` runs only if the native detector cannot produce graph data (for example, no lockfile present), and emits a flat package list.
 
-Per-ecosystem chains are listed in [`detectors/ecosystems/`](detectors/ecosystems/). The full live list lives in the CLI:
+Per-detector chains are listed in the [detector reference](detectors/). The full live list lives in the CLI:
 
 ```bash
 bomly plugins list --detectors
@@ -82,7 +82,7 @@ resolution.
 
 The build-tool-primary detectors invoke commands you would already run locally (`go list`, `mvn dependency:tree`, `gradle dependencies`, `sbt dependencyTree`). Whether they hit the network is a property of those tools and your local cache state, not a Bomly choice. To keep these scans fully offline, pre-warm the local cache (`go mod download`, `mvn dependency:go-offline`, etc.) or commit a lockfile when the ecosystem supports one.
 
-Per-PM pages under [`detectors/ecosystems/`](detectors/ecosystems/) document the exact command each detector runs and whether it touches the network.
+Each page under [`detectors/`](detectors/) documents the exact command that detector runs and whether it touches the network.
 
 ## `--install-first` {#install-first}
 
@@ -112,7 +112,7 @@ Pass `--install-first` to let supporting detectors run their normal dependency-i
 
 Detectors without an `Install` implementation (e.g. NuGet, GitHub Actions, SBOM ingest, Syft) silently skip the step when `--install-first` is set. Bomly does **not** install package managers themselves — only their dependencies.
 
-Each package-manager page under [`detectors/ecosystems/`](detectors/ecosystems/) lists whether `--install-first` is supported and the exact command that runs.
+Each page under [`detectors/`](detectors/) lists whether `--install-first` is supported and the exact command that runs.
 
 ### Customizing the install command with `--install-arg`
 
@@ -182,7 +182,7 @@ bomly scan --image ghcr.io/example/app:latest
 
 ## See also
 
-- [Ecosystem guides](detectors/ecosystems/) — generated per-ecosystem detector chains, evidence patterns, and `PATH` requirements
+- [Detector reference](detectors/) — one generated page per native detector, plus [Syft fallback](detectors/syft.md) for everything else
 - [Support matrix](SUPPORT_MATRIX.md) — generated overview of every supported ecosystem
 - [CI-readiness warnings](CI_READINESS.md) — the package-manager mismatches detectors report alongside the graph
 - [Plugins](PLUGINS.md) — author and install external detectors

docs/INTEGRATIONS.md

@@ -47,6 +47,20 @@ External detectors, matchers, and auditors install as managed plugins (versioned
 
 Write your own: [Plugins](PLUGINS.md) and the per-role implementation guides.
 
+### Marketplace
+
+The [Bomly marketplace](https://bomly.dev/marketplace) lists every component that can take part in a scan — detectors, matchers, auditors, and analyzers — filterable by kind and ecosystem. It covers built-in components alongside external plugins, so you can see what already runs before installing anything.
+
+Each entry is labelled by origin, and the label tells you who wrote the code:
+
+- **Core** — Bomly's own components, shipped in the binary.
+- **Bundled** — third-party engines compiled in, such as Syft and Grype.
+- **External plugin** — installed at runtime from its own repository.
+
+External plugins run as separate processes and stay disabled until you enable them. Read [Security and Trust Boundaries](SECURITY.md) for what a plugin can and cannot reach, and [Plugins](PLUGINS.md) for the install, verify, and enable workflow.
+
+To get a plugin listed, open a submission from the marketplace page. Entries are reviewed and added by hand — there is no automatic index.
+
 ## Community
 
 No community integrations are listed yet — if you've built one (a CI orb, an IDE extension, a dashboard that reads Bomly JSON), open a pull request adding it here with a one-line description and a link.

docs/README.md

@@ -7,8 +7,8 @@ Start with [Getting Started](GETTING_STARTED.md) if you're new. Otherwise pick t
 Install Bomly and run your first scan.
 
 - [Getting Started](GETTING_STARTED.md) — first scan, enrich, audit, diff
-- [Tutorial](TUTORIAL.md) — from first scan to a CI gate on a real project, with representative output from the workflow
 - [Installation](INSTALLATION.md) — install methods, `bomly` vs `bomly-lite`, checksum verification, uninstall
+- [Tutorial](TUTORIAL.md) — from first scan to a CI gate on a real project, with representative output from the workflow
 - [Use Cases](USE_CASES.md) — recipes for PR gates, SBOMs, triage, license and offline scans
 - [Scan Targets](SCAN_TARGETS.md) — directories, Git repos, containers, SBOMs
 - [Output Formats](OUTPUT_FORMATS.md) — text, JSON, SARIF, SBOM
@@ -19,43 +19,43 @@ Install Bomly and run your first scan.
 
 What Bomly does, and why each piece exists.
 
-- [Architecture](ARCHITECTURE.md) — the scan pipeline, domain model, and network behavior
-- [Network and Privacy](NETWORK.md) — every network trigger, what it transmits, and how to stay offline
-- [Security and Trust Boundaries](SECURITY.md) — permissions, network behavior, plugins, input limits, and residual risks
+- [Commands](COMMANDS.md) — per-command reference for [scan](commands/scan.md), [explain](commands/explain.md), and [diff](commands/diff.md)
 - [Detectors](DETECTORS.md) — turning project evidence into a dependency graph
 - [Matchers](MATCHERS.md) — enriching the graph with vulnerability, license, lifecycle data
 - [Auditors](AUDITORS.md) — evaluating the graph against policy
-- [MCP Server](MCP.md) — connect Bomly to Claude Code, Cursor, VS Code, or another MCP client
 - [Plugins](PLUGINS.md) — install, trust, configure, and package external plugins
 - Plugin implementation guides: [detector](plugins/how-to-implement-detector.md), [matcher](plugins/how-to-implement-matcher.md), [auditor](plugins/how-to-implement-auditor.md)
 - Example plugin repos: [Bun detector](https://github.com/bomly-dev/bomly-plugin-bun-lock-detector), [ClearlyDefined matcher](https://github.com/bomly-dev/bomly-plugin-clearlydefined-matcher), [EOL lifecycle matcher](https://github.com/bomly-dev/bomly-plugin-eol-matcher), [Meme auditor](https://github.com/bomly-dev/bomly-plugin-meme-auditor)
+- [MCP Server](MCP.md) — connect Bomly to Claude Code, Cursor, VS Code, or another MCP client
+- [Bomly Guard](BOMLY_GUARD.md) — the turnkey GitHub Action for PR dependency review
+
+## Operations
+
+Running Bomly in CI and keeping pipelines healthy.
+
+- [Integrations](INTEGRATIONS.md) — CI actions, AI agents, code scanning, install channels, plugins, and the marketplace
+- [CI Integration](CI_INTEGRATION.md) — GitHub Actions, GitLab, Jenkins, Azure, CircleCI
+- [CI-Readiness Warnings](CI_READINESS.md) — package-manager, lockfile-format, and install-policy mismatches that fail CI on their own
+- [Finding Baselines](BASELINES.md) — keep accepted package findings visible without failing audits
+- [Troubleshooting](TROUBLESHOOTING.md) — common errors and fixes
 
 ## Reference
 
-Specifications and matrices. The generated pages are regenerated from code by `make generate` — treat those as authoritative.
+Specifications, matrices, and design deep dives. The generated pages are regenerated from code by `make generate` — treat those as authoritative.
 
-- [Commands](COMMANDS.md) — per-command reference for [scan](commands/scan.md), [explain](commands/explain.md), and [diff](commands/diff.md)
 - [Support Matrix](SUPPORT_MATRIX.md) — every ecosystem and package manager
 - [Config Reference](CONFIG_REFERENCE.md) — every config key, env var, default, flag
 - [Exit Codes](EXIT_CODES.md) — what each process exit value means
 - [Interactive TUI](TUI.md) — keybindings and tabs for `--interactive`
 - [JSON Schemas](SCHEMAS.md) — scan, explain, diff output shapes
-- [Glossary](GLOSSARY.md) — every term, one sentence each
-- [Detector Ecosystem Guides](detectors/ecosystems/) — per-ecosystem detector chains
+- [Detector Reference](detectors/) — per-ecosystem detector pages, plus [Syft fallback](detectors/syft.md) for everything else
 - [Matcher Reference](matchers/) — per-matcher behavior, cache, output
 - [Auditor Reference](auditors/) — per-auditor options, examples, limitations
+- [Architecture](ARCHITECTURE.md) — the scan pipeline, domain model, and network behavior
+- [Network and Privacy](NETWORK.md) — every network trigger, what it transmits, and how to stay offline
+- [Security and Trust Boundaries](SECURITY.md) — permissions, network behavior, plugins, input limits, and residual risks
 - [Reproducible Evidence](EVIDENCE.md) — public inputs, commands, results, and limitations behind important behavior claims
-
-## Operations
-
-Running Bomly in CI and keeping pipelines healthy.
-
-- [Integrations](INTEGRATIONS.md) — CI actions, AI agents, code scanning, install channels, and plugins
-- [CI Integration](CI_INTEGRATION.md) — GitHub Actions, GitLab, Jenkins, Azure, CircleCI
-- [CI-Readiness Warnings](CI_READINESS.md) — package-manager, lockfile-format, and install-policy mismatches that fail CI on their own
-- [Bomly Guard](BOMLY_GUARD.md) — the turnkey GitHub Action for PR dependency review
-- [Finding Baselines](BASELINES.md) — keep accepted package findings visible without failing audits
-- [Troubleshooting](TROUBLESHOOTING.md) — common errors and fixes
+- [Glossary](GLOSSARY.md) — every term, one sentence each
 
 ## Experimental
 

docs/SBOM.md

@@ -141,4 +141,4 @@ Bomly does not advertise a one-shot `convert` command — the scan pipeline is t
 
 - [Scan targets](SCAN_TARGETS.md) — every input Bomly accepts
 - [Output formats](OUTPUT_FORMATS.md) — text, JSON, SARIF, SBOM details
-- [SBOM detector](detectors/ecosystems/sbom/sbom.md) — ingest specifics
+- [SBOM detector](detectors/sbom/sbom.md) — ingest specifics

docs/detectors/README.md

@@ -0,0 +1,46 @@
+# Detector Reference
+
+<!-- The reference table below this banner is regenerated by `make generate`. Handwritten prose below the table lives in internal/support/prose/. -->
+
+One page per package manager Bomly resolves natively, grouped by ecosystem, plus a single page for everything covered through the bundled Syft cataloger.
+
+## Native detectors
+
+These read a lockfile, manifest, or build tool directly and produce a full dependency graph with edges.
+
+| Ecosystem | Package manager | Detector chain | Install-first support |
+| --- | --- | --- | --- |
+| `cpp` | [`conan`](cpp/conan.md) | `conan-detector`, `syft-detector` | No |
+| `dart` | [`pub`](dart/pub.md) | `pub-native-detector`, `pub-detector`, `syft-detector` | No |
+| `dotnet` | [`nuget`](dotnet/nuget.md) | `nuget-detector`, `syft-detector` | No |
+| `elixir` | [`mix`](elixir/mix.md) | `mix-detector`, `syft-detector` | No |
+| `github-actions` | [`github-actions`](github-actions/github-actions.md) | `github-actions-detector`, `syft-detector` | No |
+| `go` | [`gomod`](go/gomod.md) | `go-detector`, `syft-detector` | Yes |
+| `maven` | [`gradle`](maven/gradle.md) | `gradle-detector`, `syft-detector` | Yes |
+|  | [`maven`](maven/maven.md) | `maven-detector`, `syft-detector` | Yes |
+| `npm` | [`bun`](npm/bun.md) | `bun-detector`, `bun-native-detector`, `syft-detector` | Yes |
+|  | [`npm`](npm/npm.md) | `npm-detector`, `npm-native-detector`, `syft-detector` | Yes |
+|  | [`pnpm`](npm/pnpm.md) | `pnpm-detector`, `pnpm-native-detector`, `syft-detector` | Yes |
+|  | [`yarn`](npm/yarn.md) | `yarn-detector`, `yarn-native-detector`, `syft-detector` | Yes |
+| `php` | [`composer`](php/composer.md) | `composer-detector`, `syft-detector` | Yes |
+| `python` | [`pip`](python/pip.md) | `pip-detector`, `syft-detector` | Yes |
+|  | [`pipenv`](python/pipenv.md) | `pipenv-detector`, `syft-detector` | Yes |
+|  | [`poetry`](python/poetry.md) | `poetry-detector`, `syft-detector` | Yes |
+|  | [`uv`](python/uv.md) | `uv-detector`, `syft-detector` | Yes |
+| `ruby` | [`bundler`](ruby/bundler.md) | `bundler-detector`, `syft-detector` | Yes |
+| `rust` | [`cargo`](rust/cargo.md) | `cargo-detector`, `syft-detector` | Yes |
+| `sbom` | [`sbom`](sbom/sbom.md) | `sbom-detector` | No |
+| `scala` | [`sbt`](scala/sbt.md) | `sbt-native-detector`, `sbt-detector` | No |
+| `swift` | [`cocoapods`](swift/cocoapods.md) | `cocoapods-detector`, `syft-detector` | No |
+|  | [`swiftpm`](swift/swiftpm.md) | `swiftpm-native-detector`, `swiftpm-detector`, `syft-detector` | No |
+
+## Syft-backed coverage
+
+[Syft fallback](syft.md) covers 23 more package managers, mostly OS package databases and ecosystems without a native detector. Those produce a flat package list rather than a graph.
+
+## How to read this
+
+- Bomly tries detector chains left to right. Later entries are fallbacks used when the preferred detector cannot produce graph data.
+- Install-first support means `--install-first` can run the package manager's normal install command before graph resolution. That downloads packages and modifies the filesystem; see [Detectors](../DETECTORS.md#install-first).
+- Remediation hints are read-only package-manager guidance used during `--enrich`. Detectors never choose the final action or change project files.
+- Every ecosystem and package manager, native or not, is listed in the [Support matrix](../SUPPORT_MATRIX.md).

docs/detectors/ecosystems/cpp/conan.md → docs/detectors/cpp/conan.md

@@ -1,4 +1,4 @@
-# `conan` (cpp ecosystem)
+# conan
 
 <!-- The reference table below this banner is regenerated by `make generate`. Handwritten prose below the table lives in internal/support/prose/. -->
 

docs/detectors/ecosystems/dart/pub.md → docs/detectors/dart/pub.md

@@ -1,4 +1,4 @@
-# `pub` (dart ecosystem)
+# pub
 
 <!-- The reference table below this banner is regenerated by `make generate`. Handwritten prose below the table lives in internal/support/prose/. -->
 

docs/detectors/ecosystems/dotnet/nuget.md → docs/detectors/dotnet/nuget.md

@@ -1,4 +1,4 @@
-# `nuget` (dotnet ecosystem)
+# nuget
 
 <!-- The reference table below this banner is regenerated by `make generate`. Handwritten prose below the table lives in internal/support/prose/. -->