@socketsecurity/cli-with-sentry 0.15.43 → 0.15.44

package/dist/cli.js

@@ -303,9 +303,9 @@ async function handleAnalytics({
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$N
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$O
 } = constants;
-const config$S = {
+const config$T = {
   commandName: 'analytics',
   description: `Look up analytics data`,
   hidden: false,
@@ -367,16 +367,16 @@ const config$S = {
   .replace(/\n(?: *\n)+/g, '\n\n')
 };
 const cmdAnalytics = {
-  description: config$S.description,
-  hidden: config$S.hidden,
-  run: run$S
+  description: config$T.description,
+  hidden: config$T.hidden,
+  run: run$T
 };
-async function run$S(argv, importMeta, {
+async function run$T(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$S,
+    config: config$T,
     importMeta,
     parentName
   });
@@ -480,7 +480,7 @@ async function run$S(argv, importMeta, {
     return;
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$N);
+    logger.logger.log(DRY_RUN_BAILING_NOW$O);
     return;
   }
   return await handleAnalytics({
@@ -660,10 +660,10 @@ async function handleAuditLog({
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$M,
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$N,
   SOCKET_WEBSITE_URL: SOCKET_WEBSITE_URL$3
 } = constants;
-const config$R = {
+const config$S = {
   commandName: 'audit-log',
   description: 'Look up the audit log for an organization',
   hidden: false,
@@ -717,16 +717,16 @@ const config$R = {
   `
 };
 const cmdAuditLog = {
-  description: config$R.description,
-  hidden: config$R.hidden,
-  run: run$R
+  description: config$S.description,
+  hidden: config$S.hidden,
+  run: run$S
 };
-async function run$R(argv, importMeta, {
+async function run$S(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$R,
+    config: config$S,
     importMeta,
     parentName
   });
@@ -767,7 +767,7 @@ async function run$R(argv, importMeta, {
     return;
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$M);
+    logger.logger.log(DRY_RUN_BAILING_NOW$N);
     return;
   }
   await handleAuditLog({
@@ -780,14 +780,14 @@ async function run$R(argv, importMeta, {
 }
 
 const {
-  NPM: NPM$b,
+  NPM: NPM$9,
   NPX: NPX$1,
   PACKAGE_LOCK_JSON,
   PNPM: PNPM$8,
   YARN,
   YARN_LOCK
 } = constants;
-const nodejsPlatformTypes = new Set(['javascript', 'js', 'nodejs', NPM$b, PNPM$8, 'ts', 'tsx', 'typescript']);
+const nodejsPlatformTypes = new Set(['javascript', 'js', 'nodejs', NPM$9, PNPM$8, 'ts', 'tsx', 'typescript']);
 function argvToArray(argv) {
   if (argv['help']) {
     return ['--help'];
@@ -829,7 +829,7 @@ async function runCdxgen(yargvWithYes) {
   const yesArgs = yes ? ['--yes'] : [];
   if (yargv.type !== YARN && nodejsPlatformTypes.has(yargv.type) && fs$1.existsSync(`./${YARN_LOCK}`)) {
     if (fs$1.existsSync(`./${PACKAGE_LOCK_JSON}`)) {
-      yargv.type = NPM$b;
+      yargv.type = NPM$9;
     } else {
       // Use synp to create a package-lock.json from the yarn.lock,
       // based on the node_modules folder, for a more accurate SBOM.
@@ -837,7 +837,7 @@ async function runCdxgen(yargvWithYes) {
         await shadowBin(NPX$1, [...yesArgs,
         // Lazily access constants.ENV.INLINED_SYNP_VERSION.
         `synp@${constants.ENV.INLINED_SYNP_VERSION}`, '--source-file', `./${YARN_LOCK}`]);
-        yargv.type = NPM$b;
+        yargv.type = NPM$9;
         cleanupPackageLock = true;
       } catch {}
     }
@@ -857,7 +857,7 @@ async function runCdxgen(yargvWithYes) {
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$L
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$M
 } = constants;
 
 // TODO: Convert yargs to meow.
@@ -1059,7 +1059,7 @@ const yargsConfig = {
   'usages-slices-file' // hidden
   ]
 };
-const config$Q = {
+const config$R = {
   commandName: 'cdxgen',
   description: 'Create an SBOM with CycloneDX generator (cdxgen)',
   hidden: false,
@@ -1069,17 +1069,17 @@ const config$Q = {
   help: () => ''
 };
 const cmdManifestCdxgen = {
-  description: config$Q.description,
-  hidden: config$Q.hidden,
-  run: run$Q
+  description: config$R.description,
+  hidden: config$R.hidden,
+  run: run$R
 };
-async function run$Q(argv, importMeta, {
+async function run$R(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     // Don't let meow take over --help.
     argv: argv.filter(a => !utils.isHelpFlag(a)),
-    config: config$Q,
+    config: config$R,
     importMeta,
     parentName
   });
@@ -1101,7 +1101,7 @@ async function run$Q(argv, importMeta, {
     return;
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$L);
+    logger.logger.log(DRY_RUN_BAILING_NOW$M);
     return;
   }
 
@@ -1130,15 +1130,15 @@ async function handleCdxgen(argv, importMeta, {
   });
 }
 
-const config$P = {
+const config$Q = {
   description: 'Create an SBOM with CycloneDX generator (cdxgen)',
   hidden: true};
 const cmdCdxgen = {
-  description: config$P.description,
-  hidden: config$P.hidden,
-  run: run$P
+  description: config$Q.description,
+  hidden: config$Q.hidden,
+  run: run$Q
 };
-async function run$P(argv, importMeta, {
+async function run$Q(argv, importMeta, {
   parentName
 }) {
   logger.logger.warn('Warning: The `socket cdxgen` command moved to `socket manifest cdxgen` and will be removed as a toplevel command in the next major bump.');
@@ -2371,9 +2371,9 @@ async function handleCI(autoManifest) {
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$K
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$L
 } = constants;
-const config$O = {
+const config$P = {
   commandName: 'ci',
   description: 'Create a new scan and report whether it passes your security policy',
   hidden: true,
@@ -2391,7 +2391,7 @@ const config$O = {
       $ ${parentName}
 
     Options
-      ${utils.getFlagListOutput(config$O.flags, 6)}
+      ${utils.getFlagListOutput(config$P.flags, 6)}
 
     This command is intended to use in CI runs to allow automated systems to
     accept or reject a current build. When the scan does not pass your security
@@ -2406,21 +2406,21 @@ const config$O = {
   `
 };
 const cmdCI = {
-  description: config$O.description,
-  hidden: config$O.hidden,
-  run: run$O
+  description: config$P.description,
+  hidden: config$P.hidden,
+  run: run$P
 };
-async function run$O(argv, importMeta, {
+async function run$P(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$O,
+    config: config$P,
     importMeta,
     parentName
   });
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$K);
+    logger.logger.log(DRY_RUN_BAILING_NOW$L);
     return;
   }
   await handleCI(Boolean(cli.flags['autoManifest']));
@@ -2664,9 +2664,9 @@ async function handleConfigAuto({
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$J
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$K
 } = constants;
-const config$N = {
+const config$O = {
   commandName: 'auto',
   description: 'Automatically discover and set the correct value config item',
   hidden: false,
@@ -2695,16 +2695,16 @@ ${Array.from(utils.supportedConfigKeys.entries()).map(([key, desc]) => `     - $
   `
 };
 const cmdConfigAuto = {
-  description: config$N.description,
-  hidden: config$N.hidden,
-  run: run$N
+  description: config$O.description,
+  hidden: config$O.hidden,
+  run: run$O
 };
-async function run$N(argv, importMeta, {
+async function run$O(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$N,
+    config: config$O,
     importMeta,
     parentName
   });
@@ -2730,7 +2730,7 @@ async function run$N(argv, importMeta, {
     return;
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$J);
+    logger.logger.log(DRY_RUN_BAILING_NOW$K);
     return;
   }
   await handleConfigAuto({
@@ -2778,9 +2778,9 @@ async function handleConfigGet({
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$I
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$J
 } = constants;
-const config$M = {
+const config$N = {
   commandName: 'get',
   description: 'Get the value of a local CLI config item',
   hidden: false,
@@ -2804,16 +2804,16 @@ ${Array.from(utils.supportedConfigKeys.entries()).map(([key, desc]) => `     - $
   `
 };
 const cmdConfigGet = {
-  description: config$M.description,
-  hidden: config$M.hidden,
-  run: run$M
+  description: config$N.description,
+  hidden: config$N.hidden,
+  run: run$N
 };
-async function run$M(argv, importMeta, {
+async function run$N(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$M,
+    config: config$N,
     importMeta,
     parentName
   });
@@ -2839,7 +2839,7 @@ async function run$M(argv, importMeta, {
     return;
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$I);
+    logger.logger.log(DRY_RUN_BAILING_NOW$J);
     return;
   }
   await handleConfigGet({
@@ -2916,9 +2916,9 @@ async function outputConfigList({
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$H
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$I
 } = constants;
-const config$L = {
+const config$M = {
   commandName: 'list',
   description: 'Show all local CLI config items and their values',
   hidden: false,
@@ -2947,16 +2947,16 @@ ${Array.from(utils.supportedConfigKeys.entries()).map(([key, desc]) => `     - $
   `
 };
 const cmdConfigList = {
-  description: config$L.description,
-  hidden: config$L.hidden,
-  run: run$L
+  description: config$M.description,
+  hidden: config$M.hidden,
+  run: run$M
 };
-async function run$L(argv, importMeta, {
+async function run$M(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$L,
+    config: config$M,
     importMeta,
     parentName
   });
@@ -2977,7 +2977,7 @@ async function run$L(argv, importMeta, {
     return;
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$H);
+    logger.logger.log(DRY_RUN_BAILING_NOW$I);
     return;
   }
   await outputConfigList({
@@ -3026,9 +3026,9 @@ async function handleConfigSet({
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$G
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$H
 } = constants;
-const config$K = {
+const config$L = {
   commandName: 'set',
   description: 'Update the value of a local CLI config item',
   hidden: false,
@@ -3057,16 +3057,16 @@ ${Array.from(utils.supportedConfigKeys.entries()).map(([key, desc]) => `     - $
   `
 };
 const cmdConfigSet = {
-  description: config$K.description,
-  hidden: config$K.hidden,
-  run: run$K
+  description: config$L.description,
+  hidden: config$L.hidden,
+  run: run$L
 };
-async function run$K(argv, importMeta, {
+async function run$L(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$K,
+    config: config$L,
     importMeta,
     parentName
   });
@@ -3099,7 +3099,7 @@ async function run$K(argv, importMeta, {
     return;
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$G);
+    logger.logger.log(DRY_RUN_BAILING_NOW$H);
     return;
   }
   await handleConfigSet({
@@ -3148,9 +3148,9 @@ async function handleConfigUnset({
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$F
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$G
 } = constants;
-const config$J = {
+const config$K = {
   commandName: 'unset',
   description: 'Clear the value of a local CLI config item',
   hidden: false,
@@ -3174,16 +3174,16 @@ ${Array.from(utils.supportedConfigKeys.entries()).map(([key, desc]) => `     - $
   `
 };
 const cmdConfigUnset = {
-  description: config$J.description,
-  hidden: config$J.hidden,
-  run: run$J
+  description: config$K.description,
+  hidden: config$K.hidden,
+  run: run$K
 };
-async function run$J(argv, importMeta, {
+async function run$K(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$J,
+    config: config$K,
     importMeta,
     parentName
   });
@@ -3209,7 +3209,7 @@ async function run$J(argv, importMeta, {
     return;
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$F);
+    logger.logger.log(DRY_RUN_BAILING_NOW$G);
     return;
   }
   await handleConfigUnset({
@@ -3318,9 +3318,9 @@ async function handleDependencies({
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$E
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$F
 } = constants;
-const config$I = {
+const config$J = {
   commandName: 'dependencies',
   description: 'Search for any dependency that is being used in your organization',
   hidden: false,
@@ -3356,16 +3356,16 @@ const config$I = {
   `
 };
 const cmdScanCreate$1 = {
-  description: config$I.description,
-  hidden: config$I.hidden,
-  run: run$I
+  description: config$J.description,
+  hidden: config$J.hidden,
+  run: run$J
 };
-async function run$I(argv, importMeta, {
+async function run$J(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$I,
+    config: config$J,
     importMeta,
     parentName
   });
@@ -3394,7 +3394,7 @@ async function run$I(argv, importMeta, {
     return;
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$E);
+    logger.logger.log(DRY_RUN_BAILING_NOW$F);
     return;
   }
   await handleDependencies({
@@ -3491,9 +3491,9 @@ async function handleDiffScan$1({
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$D
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$E
 } = constants;
-const config$H = {
+const config$I = {
   commandName: 'get',
   description: 'Get a diff scan for an organization',
   hidden: false,
@@ -3552,16 +3552,16 @@ const config$H = {
   `
 };
 const cmdDiffScanGet = {
-  description: config$H.description,
-  hidden: config$H.hidden,
-  run: run$H
+  description: config$I.description,
+  hidden: config$I.hidden,
+  run: run$I
 };
-async function run$H(argv, importMeta, {
+async function run$I(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$H,
+    config: config$I,
     importMeta,
     parentName
   });
@@ -3606,7 +3606,7 @@ async function run$H(argv, importMeta, {
   }
   logger.logger.fail('Warning: this command is deprecated in favor of `socket scan diff` and will be removed in the next major bump.');
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$D);
+    logger.logger.log(DRY_RUN_BAILING_NOW$E);
     return;
   }
   await handleDiffScan$1({
@@ -3658,7 +3658,7 @@ async function outputFixResult(result, outputKind) {
 }
 
 function formatBranchName(name) {
-  return name.replace(/[-_.\\/]+/g, '-').replace(/[^-a-zA-Z0-9]+/g, '').replace(/^-+|-+$/g, '');
+  return name.replace(/[^-a-zA-Z0-9/._-]+/g, '+');
 }
 function getBaseGitBranch() {
   // Lazily access constants.ENV.GITHUB_REF_NAME.
@@ -3667,13 +3667,28 @@ function getBaseGitBranch() {
   // https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/about-branches#about-the-default-branch
   'main';
 }
-function getSocketBranchName(purl, newVersion, workspace) {
+function getSocketBranchPurlTypeComponent(purl) {
   const purlObj = utils.getPurlObject(purl);
-  const fmtType = formatBranchName(purlObj.type);
-  const fmtWorkspace = workspace ? `${formatBranchName(workspace)}` : 'root';
+  return formatBranchName(purlObj.type);
+}
+function getSocketBranchFullNameComponent(pkgName) {
+  const purlObj = utils.getPurlObject(typeof pkgName === 'string' && !pkgName.startsWith('pkg:') ? vendor.packageurlJsExports.PackageURL.fromString(`pkg:unknown/${pkgName}`) : pkgName);
   const fmtMaybeNamespace = purlObj.namespace ? `${formatBranchName(purlObj.namespace)}--` : '';
-  const fmtFullName = `${fmtMaybeNamespace}${formatBranchName(purlObj.name)}`;
-  const fmtVersion = formatBranchName(purlObj.version);
+  return `${fmtMaybeNamespace}${formatBranchName(purlObj.name)}`;
+}
+function getSocketBranchPackageVersionComponent(version) {
+  const purlObj = utils.getPurlObject(typeof version === 'string' && !version.startsWith('pkg:') ? vendor.packageurlJsExports.PackageURL.fromString(`pkg:unknown/unknown@${version}`) : version);
+  return formatBranchName(purlObj.version);
+}
+function getSocketBranchWorkspaceComponent(workspace) {
+  return workspace ? formatBranchName(workspace) : 'root';
+}
+function getSocketBranchName(purl, newVersion, workspace) {
+  const purlObj = utils.getPurlObject(purl);
+  const fmtType = getSocketBranchPurlTypeComponent(purlObj);
+  const fmtWorkspace = getSocketBranchWorkspaceComponent(workspace);
+  const fmtFullName = getSocketBranchFullNameComponent(purlObj);
+  const fmtVersion = getSocketBranchPackageVersionComponent(purlObj.version);
   const fmtNewVersion = formatBranchName(newVersion);
   return `socket/${fmtType}_${fmtWorkspace}_${fmtFullName}_${fmtVersion}_${fmtNewVersion}`;
 }
@@ -3698,7 +3713,6 @@ function getSocketBranchPattern(options) {
 function createSocketBranchParser(options) {
   const pattern = getSocketBranchPattern(options);
   return function parse(branch) {
-    debug.debugFn('pattern', pattern.toString());
     const match = pattern.exec(branch);
     if (!match) {
       return null;
@@ -3711,26 +3725,28 @@ function createSocketBranchParser(options) {
       5: newVersion
     } = match;
     return {
-      newVersion,
-      purl: utils.getPurlObject(`pkg:${type}/${fullName}@${version}`),
-      workspace
+      fullName,
+      newVersion: vendor.semverExports.coerce(newVersion.replaceAll('+', '.'))?.version,
+      type,
+      workspace,
+      version: vendor.semverExports.coerce(version.replaceAll('+', '.'))?.version
     };
   };
 }
 function getSocketPullRequestTitle(purl, newVersion, workspace) {
   const purlObj = utils.getPurlObject(purl);
-  const fullName = utils.getPkgFullNameFromPurlObj(purlObj);
+  const fullName = utils.getPkgFullNameFromPurl(purlObj);
   return `Bump ${fullName} from ${purlObj.version} to ${newVersion}${workspace ? ` in ${workspace}` : ''}`;
 }
 function getSocketPullRequestBody(purl, newVersion, workspace) {
   const purlObj = utils.getPurlObject(purl);
-  const fullName = utils.getPkgFullNameFromPurlObj(purlObj);
+  const fullName = utils.getPkgFullNameFromPurl(purlObj);
   const pkgOverviewUrl = utils.getSocketDevPackageOverviewUrlFromPurl(purlObj);
   return `Bump [${fullName}](${pkgOverviewUrl}) from ${purlObj.version} to ${newVersion}${workspace ? ` in ${workspace}` : ''}.`;
 }
 function getSocketCommitMessage(purl, newVersion, workspace) {
   const purlObj = utils.getPurlObject(purl);
-  const fullName = utils.getPkgFullNameFromPurlObj(purlObj);
+  const fullName = utils.getPkgFullNameFromPurl(purlObj);
   return `socket: Bump ${fullName} from ${purlObj.version} to ${newVersion}${workspace ? ` in ${workspace}` : ''}`;
 }
 async function gitCleanFdx(cwd = process.cwd()) {
@@ -3929,16 +3945,19 @@ async function cleanupOpenPrs(owner, repo, options) {
     __proto__: null,
     ...options
   };
+  const branchParser = createSocketBranchParser(options);
   const octokit = getOctokit();
   const settledMatches = await Promise.allSettled(contextualMatches.map(async ({
     context,
     match
   }) => {
     const {
-      newVersion: prToVersion,
       number: prNum
     } = match;
     const prRef = `PR #${prNum}`;
+    const parsedBranch = branchParser(match.headRefName);
+    const prToVersion = parsedBranch?.newVersion;
+
     // Close older PRs.
     if (prToVersion && newVersion && vendor.semverExports.lt(prToVersion, newVersion)) {
       try {
@@ -4021,7 +4040,7 @@ async function enablePrAutoMerge({
   } catch (e) {
     error = e;
   }
-  if (error instanceof vendor.GraphqlResponseError && Array.isArray(error.errors)) {
+  if (error instanceof vendor.GraphqlResponseError && Array.isArray(error.errors) && error.errors.length) {
     const details = error.errors.map(({
       message
     }) => message.trim());
@@ -4066,7 +4085,7 @@ async function getOpenSocketPrsWithContext(owner, repo, options_) {
   const checkAuthor = strings.isNonEmptyString(author);
   const octokit = getOctokit();
   const octokitGraphql = getOctokitGraphql();
-  const prBranchParser = createSocketBranchParser(options);
+  const branchPattern = getSocketBranchPattern(options);
   const contextualMatches = [];
   try {
     // Optimistically fetch only the first 50 open PRs using GraphQL to minimize
@@ -4100,7 +4119,7 @@ async function getOpenSocketPrsWithContext(owner, repo, options_) {
       const node = nodes[i];
       const login = node.author?.login;
       const matchesAuthor = checkAuthor ? login === author : true;
-      const matchesBranch = prBranchParser(node.headRefName);
+      const matchesBranch = branchPattern.test(node.headRefName);
       if (matchesAuthor && matchesBranch) {
         contextualMatches.push({
           context: {
@@ -4113,7 +4132,6 @@ async function getOpenSocketPrsWithContext(owner, repo, options_) {
           },
           match: {
             ...node,
-            ...matchesBranch,
             author: login ?? '<unknown>'
           }
         });
@@ -4144,7 +4162,7 @@ async function getOpenSocketPrsWithContext(owner, repo, options_) {
     const pr = allOpenPrs[i];
     const login = pr.user?.login;
     const matchesAuthor = checkAuthor ? login === author : true;
-    const matchesBranch = prBranchParser(pr.head.ref);
+    const matchesBranch = branchPattern.test(pr.head.ref);
     if (matchesAuthor && matchesBranch) {
       contextualMatches.push({
         context: {
@@ -4156,7 +4174,6 @@ async function getOpenSocketPrsWithContext(owner, repo, options_) {
           parent: allOpenPrs
         },
         match: {
-          ...matchesBranch,
           author: login ?? '<unknown>',
           baseRefName: pr.base.ref,
           headRefName: pr.head.ref,
@@ -4198,7 +4215,7 @@ async function openPr(owner, repo, branch, purl, newVersion, options) {
   } catch (e) {
     let message = `Failed to open pull request`;
     const errors = e instanceof vendor.RequestError ? e.response?.data?.['errors'] : undefined;
-    if (Array.isArray(errors)) {
+    if (Array.isArray(errors) && errors.length) {
       const details = errors.map(d => `- ${d.message?.trim() ?? `${d.resource}.${d.field} (${d.code})`}`).join('\n');
       message += `:\n${details}`;
     }
@@ -4252,9 +4269,6 @@ function getAlertsMapOptions(options = {}) {
   };
 }
 
-const {
-  NPM: NPM$a
-} = constants;
 async function install$1(arb, options) {
   const {
     cwd = process.cwd()
@@ -4329,10 +4343,10 @@ async function npmFix(pkgEnvDetails, {
       cause: e?.message || 'Unknown Socket batch PURL API error.'
     };
   }
-  const infoByPkgName = utils.getCveInfoFromAlertsMap(alertsMap, {
+  const infoByPartialPurl = utils.getCveInfoFromAlertsMap(alertsMap, {
     limit: limit + openPrs.length
   });
-  if (!infoByPkgName) {
+  if (!infoByPartialPurl) {
     spinner?.stop();
     logger.logger.info('No fixable vulns found.');
     return {
@@ -4343,11 +4357,12 @@ async function npmFix(pkgEnvDetails, {
     };
   }
   const baseBranch = isCi ? getBaseGitBranch() : '';
+  const branchParser = isCi ? createSocketBranchParser() : null;
   const workspacePkgJsonPaths = await utils.globWorkspace(pkgEnvDetails.agent, rootPath);
   const pkgJsonPaths = [...workspacePkgJsonPaths,
   // Process the workspace root last since it will add an override to package.json.
   pkgEnvDetails.editablePkgJson.filename];
-  const sortedInfoEntries = [...infoByPkgName.entries()].sort((a, b) => sorts.naturalCompare(a[0], b[0]));
+  const sortedInfoEntries = [...infoByPartialPurl.entries()].sort((a, b) => sorts.naturalCompare(a[0], b[0]));
   const handleInstallFail = () => {
     debug.debugFn(`fail: ${pkgEnvDetails.agent} install\n`);
     logger.logger.dedent();
@@ -4364,18 +4379,28 @@ async function npmFix(pkgEnvDetails, {
     } = sortedInfoEntries; i < length; i += 1) {
     const isLastInfoEntry = i === length - 1;
     const infoEntry = sortedInfoEntries[i];
-    const {
-      0: name
-    } = infoEntry;
-    const openPrsForPkg = openPrs.filter(pr => name === packages.resolvePackageName(pr.purl));
-    const infos = [...infoEntry[1].values()].filter(info => !openPrsForPkg.find(pr => pr.newVersion === info.firstPatchedVersionIdentifier));
+    const partialPurlObj = utils.getPurlObject(infoEntry[0]);
+    const name = packages.resolvePackageName(partialPurlObj);
+    let infos = [...infoEntry[1].values()];
+    if (isCi) {
+      const branchFullName = getSocketBranchFullNameComponent(partialPurlObj);
+      const branchPurlType = getSocketBranchPurlTypeComponent(partialPurlObj);
+      const activeBranches = [];
+      for (const pr of openPrs) {
+        const parsedBranch = branchParser(pr.headRefName);
+        if (branchPurlType === parsedBranch?.type && branchFullName === parsedBranch?.fullName) {
+          activeBranches.push(parsedBranch);
+        }
+      }
+      infos = infos.filter(info => !activeBranches.find(b => b.newVersion === info.firstPatchedVersionIdentifier));
+    }
     if (!infos.length) {
       continue infoEntriesLoop;
     }
     logger.logger.log(`Processing vulns for ${name}:`);
     logger.logger.indent();
     spinner?.indent();
-    if (registry.getManifestData(NPM$a, name)) {
+    if (registry.getManifestData(partialPurlObj.type, name)) {
       debug.debugFn(`found: Socket Optimize variant for ${name}`);
     }
     // eslint-disable-next-line no-await-in-loop
@@ -4422,7 +4447,7 @@ async function npmFix(pkgEnvDetails, {
       }
       oldVersionsLoop: for (const oldVersion of oldVersions) {
         const oldId = `${name}@${oldVersion}`;
-        const oldPurl = utils.idToPurl(oldId);
+        const oldPurl = utils.idToPurl(oldId, partialPurlObj.type);
         const node = shadowInject.findPackageNode(actualTree, name, oldVersion);
         if (!node) {
           debug.debugFn(`skip: ${oldId} not found`);
@@ -4673,7 +4698,6 @@ async function npmFix(pkgEnvDetails, {
 }
 
 const {
-  NPM: NPM$9,
   OVERRIDES: OVERRIDES$2,
   PNPM: PNPM$7
 } = constants;
@@ -4809,10 +4833,10 @@ async function pnpmFix(pkgEnvDetails, {
       cause: e?.message || 'Unknown Socket batch PURL API error.'
     };
   }
-  const infoByPkgName = utils.getCveInfoFromAlertsMap(alertsMap, {
+  const infoByPartialPurl = utils.getCveInfoFromAlertsMap(alertsMap, {
     limit: limit + openPrs.length
   });
-  if (!infoByPkgName) {
+  if (!infoByPartialPurl) {
     spinner?.stop();
     logger.logger.info('No fixable vulns found.');
     return {
@@ -4823,11 +4847,12 @@ async function pnpmFix(pkgEnvDetails, {
     };
   }
   const baseBranch = isCi ? getBaseGitBranch() : '';
+  const branchParser = isCi ? createSocketBranchParser() : null;
   const workspacePkgJsonPaths = await utils.globWorkspace(pkgEnvDetails.agent, rootPath);
   const pkgJsonPaths = [...workspacePkgJsonPaths,
   // Process the workspace root last since it will add an override to package.json.
   pkgEnvDetails.editablePkgJson.filename];
-  const sortedInfoEntries = [...infoByPkgName.entries()].sort((a, b) => sorts.naturalCompare(a[0], b[0]));
+  const sortedInfoEntries = [...infoByPartialPurl.entries()].sort((a, b) => sorts.naturalCompare(a[0], b[0]));
   const handleInstallFail = () => {
     logger.logger.dedent();
     spinner?.dedent();
@@ -4843,22 +4868,28 @@ async function pnpmFix(pkgEnvDetails, {
     } = sortedInfoEntries; i < length; i += 1) {
     const isLastInfoEntry = i === length - 1;
     const infoEntry = sortedInfoEntries[i];
-    const {
-      0: name
-    } = infoEntry;
-    const openPrsForPkg = openPrs.filter(pr => name === packages.resolvePackageName(pr.purl));
-    const infos = [...infoEntry[1].values()].filter(info => {
-      debug.debugFn('pr.newVersion', openPrsForPkg.map(pr => pr.newVersion));
-      debug.debugFn('info.firstPatchedVersionIdentifier', info.firstPatchedVersionIdentifier);
-      return !openPrsForPkg.find(pr => pr.newVersion === info.firstPatchedVersionIdentifier);
-    });
+    const partialPurlObj = utils.getPurlObject(infoEntry[0]);
+    const name = packages.resolvePackageName(partialPurlObj);
+    let infos = [...infoEntry[1].values()];
+    if (isCi) {
+      const branchFullName = getSocketBranchFullNameComponent(partialPurlObj);
+      const branchPurlType = getSocketBranchPurlTypeComponent(partialPurlObj);
+      const activeBranches = [];
+      for (const pr of openPrs) {
+        const parsedBranch = branchParser(pr.headRefName);
+        if (branchPurlType === parsedBranch?.type && branchFullName === parsedBranch?.fullName) {
+          activeBranches.push(parsedBranch);
+        }
+      }
+      infos = infos.filter(info => !activeBranches.find(b => b.newVersion === info.firstPatchedVersionIdentifier));
+    }
     if (!infos.length) {
       continue infoEntriesLoop;
     }
     logger.logger.log(`Processing vulns for ${name}:`);
     logger.logger.indent();
     spinner?.indent();
-    if (registry.getManifestData(NPM$9, name)) {
+    if (registry.getManifestData(partialPurlObj.type, name)) {
       debug.debugFn(`found: Socket Optimize variant for ${name}`);
     }
     // eslint-disable-next-line no-await-in-loop
@@ -4935,7 +4966,7 @@ async function pnpmFix(pkgEnvDetails, {
       }
       oldVersionsLoop: for (const oldVersion of oldVersions) {
         const oldId = `${name}@${oldVersion}`;
-        const oldPurl = utils.idToPurl(oldId);
+        const oldPurl = utils.idToPurl(oldId, partialPurlObj.type);
         const node = shadowInject.findPackageNode(actualTree, name, oldVersion);
         if (!node) {
           debug.debugFn(`skip: ${oldId} not found`);
@@ -5332,7 +5363,7 @@ async function handleFix({
 const {
   DRY_RUN_NOT_SAVING
 } = constants;
-const config$G = {
+const config$H = {
   commandName: 'fix',
   description: 'Update dependencies with "fixable" Socket alerts',
   hidden: false,
@@ -5400,16 +5431,16 @@ const config$G = {
   `
 };
 const cmdFix = {
-  description: config$G.description,
-  hidden: config$G.hidden,
-  run: run$G
+  description: config$H.description,
+  hidden: config$H.hidden,
+  run: run$H
 };
-async function run$G(argv, importMeta, {
+async function run$H(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$G,
+    config: config$H,
     importMeta,
     parentName
   });
@@ -5611,9 +5642,9 @@ async function handlePackageInfo({
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$C
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$D
 } = constants;
-const config$F = {
+const config$G = {
   commandName: 'info',
   description: 'Look up info regarding a package',
   hidden: true,
@@ -5638,16 +5669,16 @@ const config$F = {
   `
 };
 const cmdInfo = {
-  description: config$F.description,
-  hidden: config$F.hidden,
-  run: run$F
+  description: config$G.description,
+  hidden: config$G.hidden,
+  run: run$G
 };
-async function run$F(argv, importMeta, {
+async function run$G(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$F,
+    config: config$G,
     importMeta,
     parentName
   });
@@ -5684,11 +5715,11 @@ async function run$F(argv, importMeta, {
   const pkgName = versionSeparator < 1 ? rawPkgName : rawPkgName.slice(0, versionSeparator);
   const pkgVersion = versionSeparator < 1 ? 'latest' : rawPkgName.slice(versionSeparator + 1);
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$C);
+    logger.logger.log(DRY_RUN_BAILING_NOW$D);
     return;
   }
   await handlePackageInfo({
-    commandName: `${parentName} ${config$F.commandName}`,
+    commandName: `${parentName} ${config$G.commandName}`,
     includeAllIssues: Boolean(all),
     outputKind,
     pkgName,
@@ -5816,9 +5847,9 @@ async function handleInstallCompletion(targetName) {
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$B
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$C
 } = constants;
-const config$E = {
+const config$F = {
   commandName: 'completion',
   description: 'Install bash completion for Socket CLI',
   hidden: true,
@@ -5856,22 +5887,22 @@ const config$E = {
   `
 };
 const cmdInstallCompletion = {
-  description: config$E.description,
-  hidden: config$E.hidden,
-  run: run$E
+  description: config$F.description,
+  hidden: config$F.hidden,
+  run: run$F
 };
-async function run$E(argv, importMeta, {
+async function run$F(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$E,
+    config: config$F,
     importMeta,
     parentName
   });
   const targetName = cli.input[0] || 'socket';
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$B);
+    logger.logger.log(DRY_RUN_BAILING_NOW$C);
     return;
   }
   await handleInstallCompletion(String(targetName));
@@ -5989,9 +6020,9 @@ async function attemptLogin(apiBaseUrl, apiProxy) {
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$A
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$B
 } = constants;
-const config$D = {
+const config$E = {
   commandName: 'login',
   description: 'Socket API login',
   hidden: false,
@@ -6024,23 +6055,23 @@ const config$D = {
   `
 };
 const cmdLogin = {
-  description: config$D.description,
-  hidden: config$D.hidden,
-  run: run$D
+  description: config$E.description,
+  hidden: config$E.hidden,
+  run: run$E
 };
-async function run$D(argv, importMeta, {
+async function run$E(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$D,
+    config: config$E,
     importMeta,
     parentName
   });
   const apiBaseUrl = cli.flags['apiBaseUrl'];
   const apiProxy = cli.flags['apiProxy'];
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$A);
+    logger.logger.log(DRY_RUN_BAILING_NOW$B);
     return;
   }
   if (!vendor.isInteractiveExports()) {
@@ -6070,9 +6101,9 @@ function attemptLogout() {
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$z
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$A
 } = constants;
-const config$C = {
+const config$D = {
   commandName: 'logout',
   description: 'Socket API logout',
   hidden: false,
@@ -6087,30 +6118,30 @@ const config$C = {
   `
 };
 const cmdLogout = {
-  description: config$C.description,
-  hidden: config$C.hidden,
-  run: run$C
+  description: config$D.description,
+  hidden: config$D.hidden,
+  run: run$D
 };
-async function run$C(argv, importMeta, {
+async function run$D(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$C,
+    config: config$D,
     importMeta,
     parentName
   });
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$z);
+    logger.logger.log(DRY_RUN_BAILING_NOW$A);
     return;
   }
   attemptLogout();
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$y
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$z
 } = constants;
-const config$B = {
+const config$C = {
   commandName: 'auto',
   description: 'Auto-detect build and attempt to generate manifest file',
   hidden: false,
@@ -6143,16 +6174,16 @@ const config$B = {
   `
 };
 const cmdManifestAuto = {
-  description: config$B.description,
-  hidden: config$B.hidden,
-  run: run$B
+  description: config$C.description,
+  hidden: config$C.hidden,
+  run: run$C
 };
-async function run$B(argv, importMeta, {
+async function run$C(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$B,
+    config: config$C,
     importMeta,
     parentName
   });
@@ -6168,7 +6199,7 @@ async function run$B(argv, importMeta, {
   // If given path is absolute then cwd should not affect it.
   cwd = path.resolve(process.cwd(), cwd);
   if (verbose) {
-    logger.logger.group('- ', parentName, config$B.commandName, ':');
+    logger.logger.group('- ', parentName, config$C.commandName, ':');
     logger.logger.group('- flags:', cli.flags);
     logger.logger.groupEnd();
     logger.logger.log('- input:', cli.input);
@@ -6179,7 +6210,7 @@ async function run$B(argv, importMeta, {
   const detected = await detectManifestActions(socketJson, cwd);
   debug.debugLog('[DEBUG]', detected);
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$y);
+    logger.logger.log(DRY_RUN_BAILING_NOW$z);
     return;
   }
   if (!detected.count) {
@@ -6201,9 +6232,9 @@ async function run$B(argv, importMeta, {
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$x
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$y
 } = constants;
-const config$A = {
+const config$B = {
   commandName: 'conda',
   description: '[beta] Convert a Conda environment.yml file to a python requirements.txt',
   hidden: false,
@@ -6254,16 +6285,16 @@ const config$A = {
   `
 };
 const cmdManifestConda = {
-  description: config$A.description,
-  hidden: config$A.hidden,
-  run: run$A
+  description: config$B.description,
+  hidden: config$B.hidden,
+  run: run$B
 };
-async function run$A(argv, importMeta, {
+async function run$B(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$A,
+    config: config$B,
     importMeta,
     parentName
   });
@@ -6321,7 +6352,7 @@ async function run$A(argv, importMeta, {
     verbose = false;
   }
   if (verbose) {
-    logger.logger.group('- ', parentName, config$A.commandName, ':');
+    logger.logger.group('- ', parentName, config$B.commandName, ':');
     logger.logger.group('- flags:', cli.flags);
     logger.logger.groupEnd();
     logger.logger.log('- target:', cwd);
@@ -6346,7 +6377,7 @@ async function run$A(argv, importMeta, {
   }
   logger.logger.warn('Warning: This will approximate your Conda dependencies using PyPI. We do not yet officially support Conda. Use at your own risk.');
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$x);
+    logger.logger.log(DRY_RUN_BAILING_NOW$y);
     return;
   }
   await handleManifestConda({
@@ -6359,9 +6390,9 @@ async function run$A(argv, importMeta, {
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$w
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$x
 } = constants;
-const config$z = {
+const config$A = {
   commandName: 'gradle',
   description: '[beta] Use Gradle to generate a manifest file (`pom.xml`) for a Gradle/Java/Kotlin/etc project',
   hidden: false,
@@ -6414,16 +6445,16 @@ const config$z = {
   `
 };
 const cmdManifestGradle = {
-  description: config$z.description,
-  hidden: config$z.hidden,
-  run: run$z
+  description: config$A.description,
+  hidden: config$A.hidden,
+  run: run$A
 };
-async function run$z(argv, importMeta, {
+async function run$A(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$z,
+    config: config$A,
     importMeta,
     parentName
   });
@@ -6470,7 +6501,7 @@ async function run$z(argv, importMeta, {
     }
   }
   if (verbose) {
-    logger.logger.group('- ', parentName, config$z.commandName, ':');
+    logger.logger.group('- ', parentName, config$A.commandName, ':');
     logger.logger.group('- flags:', cli.flags);
     logger.logger.groupEnd();
     logger.logger.log('- input:', cli.input);
@@ -6498,7 +6529,7 @@ async function run$z(argv, importMeta, {
     logger.logger.groupEnd();
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$w);
+    logger.logger.log(DRY_RUN_BAILING_NOW$x);
     return;
   }
   await convertGradleToMaven({
@@ -6510,7 +6541,7 @@ async function run$z(argv, importMeta, {
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$v
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$w
 } = constants;
 
 // TODO: we may want to dedupe some pieces for all gradle languages. I think it
@@ -6518,7 +6549,7 @@ const {
 //       sense for the help panels to note the requested language, rather than
 //       `socket manifest kotlin` to print help screens with `gradle` as the
 //       command. Room for improvement.
-const config$y = {
+const config$z = {
   commandName: 'kotlin',
   description: '[beta] Use Gradle to generate a manifest file (`pom.xml`) for a Kotlin project',
   hidden: false,
@@ -6571,16 +6602,16 @@ const config$y = {
   `
 };
 const cmdManifestKotlin = {
-  description: config$y.description,
-  hidden: config$y.hidden,
-  run: run$y
+  description: config$z.description,
+  hidden: config$z.hidden,
+  run: run$z
 };
-async function run$y(argv, importMeta, {
+async function run$z(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$y,
+    config: config$z,
     importMeta,
     parentName
   });
@@ -6627,7 +6658,7 @@ async function run$y(argv, importMeta, {
     }
   }
   if (verbose) {
-    logger.logger.group('- ', parentName, config$y.commandName, ':');
+    logger.logger.group('- ', parentName, config$z.commandName, ':');
     logger.logger.group('- flags:', cli.flags);
     logger.logger.groupEnd();
     logger.logger.log('- input:', cli.input);
@@ -6655,7 +6686,7 @@ async function run$y(argv, importMeta, {
     logger.logger.groupEnd();
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$v);
+    logger.logger.log(DRY_RUN_BAILING_NOW$w);
     return;
   }
   await convertGradleToMaven({
@@ -6667,9 +6698,9 @@ async function run$y(argv, importMeta, {
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$u
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$v
 } = constants;
-const config$x = {
+const config$y = {
   commandName: 'scala',
   description: "[beta] Generate a manifest file (`pom.xml`) from Scala's `build.sbt` file",
   hidden: false,
@@ -6735,16 +6766,16 @@ const config$x = {
   `
 };
 const cmdManifestScala = {
-  description: config$x.description,
-  hidden: config$x.hidden,
-  run: run$x
+  description: config$y.description,
+  hidden: config$y.hidden,
+  run: run$y
 };
-async function run$x(argv, importMeta, {
+async function run$y(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$x,
+    config: config$y,
     importMeta,
     parentName
   });
@@ -6805,7 +6836,7 @@ async function run$x(argv, importMeta, {
     verbose = false;
   }
   if (verbose) {
-    logger.logger.group('- ', parentName, config$x.commandName, ':');
+    logger.logger.group('- ', parentName, config$y.commandName, ':');
     logger.logger.group('- flags:', cli.flags);
     logger.logger.groupEnd();
     logger.logger.log('- input:', cli.input);
@@ -6834,7 +6865,7 @@ async function run$x(argv, importMeta, {
     logger.logger.groupEnd();
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$u);
+    logger.logger.log(DRY_RUN_BAILING_NOW$v);
     return;
   }
   await convertSbtToMaven({
@@ -7250,9 +7281,9 @@ async function handleManifestSetup(cwd, defaultOnReadError) {
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$t
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$u
 } = constants;
-const config$w = {
+const config$x = {
   commandName: 'setup',
   description: 'Start interactive configurator to customize default flag values for `socket manifest` in this dir',
   hidden: false,
@@ -7296,16 +7327,16 @@ const config$w = {
   `
 };
 const cmdManifestSetup = {
-  description: config$w.description,
-  hidden: config$w.hidden,
-  run: run$w
+  description: config$x.description,
+  hidden: config$x.hidden,
+  run: run$x
 };
-async function run$w(argv, importMeta, {
+async function run$x(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$w,
+    config: config$x,
     importMeta,
     parentName
   });
@@ -7317,13 +7348,13 @@ async function run$w(argv, importMeta, {
   // If given path is absolute then cwd should not affect it.
   cwd = path.resolve(process.cwd(), cwd);
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$t);
+    logger.logger.log(DRY_RUN_BAILING_NOW$u);
     return;
   }
   await handleManifestSetup(cwd, Boolean(defaultOnReadError));
 }
 
-const config$v = {
+const config$w = {
   commandName: 'manifest',
   description: 'Generate a dependency manifest for given file or dir',
   hidden: false,
@@ -7331,11 +7362,11 @@ const config$v = {
     ...utils.commonFlags
   }};
 const cmdManifest = {
-  description: config$v.description,
-  hidden: config$v.hidden,
-  run: run$v
+  description: config$w.description,
+  hidden: config$w.hidden,
+  run: run$w
 };
-async function run$v(argv, importMeta, {
+async function run$w(argv, importMeta, {
   parentName
 }) {
   await utils.meowWithSubcommands({
@@ -7350,23 +7381,23 @@ async function run$v(argv, importMeta, {
     argv,
     aliases: {
       yolo: {
-        description: config$v.description,
+        description: config$w.description,
         hidden: true,
         argv: ['auto']
       }
     },
-    description: config$v.description,
+    description: config$w.description,
     importMeta,
-    flags: config$v.flags,
-    name: `${parentName} ${config$v.commandName}`
+    flags: config$w.flags,
+    name: `${parentName} ${config$w.commandName}`
   });
 }
 
 const require$3 =Module.createRequire(require$$0.pathToFileURL(__filename).href)
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$s
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$t
 } = constants;
-const config$u = {
+const config$v = {
   commandName: 'npm',
   description: `npm wrapper functionality`,
   hidden: false,
@@ -7379,21 +7410,21 @@ const config$u = {
   `
 };
 const cmdNpm = {
-  description: config$u.description,
-  hidden: config$u.hidden,
-  run: run$u
+  description: config$v.description,
+  hidden: config$v.hidden,
+  run: run$v
 };
-async function run$u(argv, importMeta, {
+async function run$v(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$u,
+    config: config$v,
     importMeta,
     parentName
   });
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$s);
+    logger.logger.log(DRY_RUN_BAILING_NOW$t);
     return;
   }
 
@@ -7404,9 +7435,9 @@ async function run$u(argv, importMeta, {
 
 const require$2 =Module.createRequire(require$$0.pathToFileURL(__filename).href)
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$r
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$s
 } = constants;
-const config$t = {
+const config$u = {
   commandName: 'npx',
   description: `npx wrapper functionality`,
   hidden: false,
@@ -7419,21 +7450,21 @@ const config$t = {
   `
 };
 const cmdNpx = {
-  description: config$t.description,
-  hidden: config$t.hidden,
-  run: run$t
+  description: config$u.description,
+  hidden: config$u.hidden,
+  run: run$u
 };
-async function run$t(argv, importMeta, {
+async function run$u(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$t,
+    config: config$u,
     importMeta,
     parentName
   });
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$r);
+    logger.logger.log(DRY_RUN_BAILING_NOW$s);
     return;
   }
 
@@ -7443,9 +7474,9 @@ async function run$t(argv, importMeta, {
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$q
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$r
 } = constants;
-const config$s = {
+const config$t = {
   commandName: 'oops',
   description: 'Trigger an intentional error (for development)',
   hidden: true,
@@ -7461,16 +7492,16 @@ const config$s = {
   `
 };
 const cmdOops = {
-  description: config$s.description,
-  hidden: config$s.hidden,
-  run: run$s
+  description: config$t.description,
+  hidden: config$t.hidden,
+  run: run$t
 };
-async function run$s(argv, importMeta, {
+async function run$t(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$s,
+    config: config$t,
     importMeta,
     parentName
   });
@@ -7479,7 +7510,7 @@ async function run$s(argv, importMeta, {
     markdown
   } = cli.flags;
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$q);
+    logger.logger.log(DRY_RUN_BAILING_NOW$r);
     return;
   }
   if (json) {
@@ -7669,7 +7700,7 @@ function cleanupQueryStdout(stdout) {
   try {
     pkgs = JSON.parse(stdout);
   } catch {}
-  if (!Array.isArray(pkgs)) {
+  if (!Array.isArray(pkgs) || !pkgs.length) {
     return '';
   }
   const names = new Set();
@@ -8235,9 +8266,9 @@ async function handleOptimize({
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$p
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$q
 } = constants;
-const config$r = {
+const config$s = {
   commandName: 'optimize',
   description: 'Optimize dependencies with @socketregistry overrides',
   hidden: false,
@@ -8267,16 +8298,16 @@ const config$r = {
   `
 };
 const cmdOptimize = {
-  description: config$r.description,
-  hidden: config$r.hidden,
-  run: run$r
+  description: config$s.description,
+  hidden: config$s.hidden,
+  run: run$s
 };
-async function run$r(argv, importMeta, {
+async function run$s(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$r,
+    config: config$s,
     importMeta,
     parentName
   });
@@ -8294,7 +8325,7 @@ async function run$r(argv, importMeta, {
   // If given path is absolute then cwd should not affect it.
   cwd = path.resolve(process.cwd(), cwd);
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$p);
+    logger.logger.log(DRY_RUN_BAILING_NOW$q);
     return;
   }
   await handleOptimize({
@@ -8370,9 +8401,9 @@ async function handleOrganizationList(outputKind = 'text') {
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$o
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$p
 } = constants;
-const config$q = {
+const config$r = {
   commandName: 'list',
   description: 'List organizations associated with the API key used',
   hidden: false,
@@ -8389,20 +8420,20 @@ const config$q = {
       - Permissions: none (does need a token)
 
     Options
-      ${utils.getFlagListOutput(config$q.flags, 6)}
+      ${utils.getFlagListOutput(config$r.flags, 6)}
   `
 };
 const cmdOrganizationList = {
-  description: config$q.description,
-  hidden: config$q.hidden,
-  run: run$q
+  description: config$r.description,
+  hidden: config$r.hidden,
+  run: run$r
 };
-async function run$q(argv, importMeta, {
+async function run$r(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$q,
+    config: config$r,
     importMeta,
     parentName
   });
@@ -8429,7 +8460,7 @@ async function run$q(argv, importMeta, {
     return;
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$o);
+    logger.logger.log(DRY_RUN_BAILING_NOW$p);
     return;
   }
   await handleOrganizationList(outputKind);
@@ -8475,11 +8506,11 @@ async function handleLicensePolicy(orgSlug, outputKind) {
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$n
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$o
 } = constants;
 
 // TODO: secret toplevel alias `socket license policy`?
-const config$p = {
+const config$q = {
   commandName: 'license',
   description: 'Retrieve the license policy of an organization',
   hidden: true,
@@ -8505,7 +8536,7 @@ const config$p = {
       - Permissions: license-policy:read
 
     Options
-      ${utils.getFlagListOutput(config$p.flags, 6)}
+      ${utils.getFlagListOutput(config$q.flags, 6)}
 
     Your API token will need the \`license-policy:read\` permission otherwise
     the request will fail with an authentication error.
@@ -8516,16 +8547,16 @@ const config$p = {
   `
 };
 const cmdOrganizationPolicyLicense = {
-  description: config$p.description,
-  hidden: config$p.hidden,
-  run: run$p
+  description: config$q.description,
+  hidden: config$q.hidden,
+  run: run$q
 };
-async function run$p(argv, importMeta, {
+async function run$q(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$p,
+    config: config$q,
     importMeta,
     parentName
   });
@@ -8562,7 +8593,7 @@ async function run$p(argv, importMeta, {
     return;
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$n);
+    logger.logger.log(DRY_RUN_BAILING_NOW$o);
     return;
   }
   await handleLicensePolicy(orgSlug, outputKind);
@@ -8609,11 +8640,11 @@ async function handleSecurityPolicy(orgSlug, outputKind) {
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$m
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$n
 } = constants;
 
 // TODO: secret toplevel alias `socket security policy`?
-const config$o = {
+const config$p = {
   commandName: 'security',
   description: 'Retrieve the security policy of an organization',
   hidden: true,
@@ -8639,7 +8670,7 @@ const config$o = {
       - Permissions: security-policy:read
 
     Options
-      ${utils.getFlagListOutput(config$o.flags, 6)}
+      ${utils.getFlagListOutput(config$p.flags, 6)}
 
     Your API token will need the \`security-policy:read\` permission otherwise
     the request will fail with an authentication error.
@@ -8650,16 +8681,16 @@ const config$o = {
   `
 };
 const cmdOrganizationPolicyPolicy = {
-  description: config$o.description,
-  hidden: config$o.hidden,
-  run: run$o
+  description: config$p.description,
+  hidden: config$p.hidden,
+  run: run$p
 };
-async function run$o(argv, importMeta, {
+async function run$p(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$o,
+    config: config$p,
     importMeta,
     parentName
   });
@@ -8696,7 +8727,7 @@ async function run$o(argv, importMeta, {
     return;
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$m);
+    logger.logger.log(DRY_RUN_BAILING_NOW$n);
     return;
   }
   await handleSecurityPolicy(orgSlug, outputKind);
@@ -8765,9 +8796,9 @@ async function handleQuota(outputKind = 'text') {
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$l
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$m
 } = constants;
-const config$n = {
+const config$o = {
   commandName: 'quota',
   description: 'List organizations associated with the API key used',
   hidden: true,
@@ -8780,20 +8811,20 @@ const config$n = {
       $ ${command}
 
     Options
-      ${utils.getFlagListOutput(config$n.flags, 6)}
+      ${utils.getFlagListOutput(config$o.flags, 6)}
   `
 };
 const cmdOrganizationQuota = {
-  description: config$n.description,
-  hidden: config$n.hidden,
-  run: run$n
+  description: config$o.description,
+  hidden: config$o.hidden,
+  run: run$o
 };
-async function run$n(argv, importMeta, {
+async function run$o(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$n,
+    config: config$o,
     importMeta,
     parentName
   });
@@ -8818,7 +8849,7 @@ async function run$n(argv, importMeta, {
     return;
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$l);
+    logger.logger.log(DRY_RUN_BAILING_NOW$m);
     return;
   }
   await handleQuota(outputKind);
@@ -9066,9 +9097,9 @@ function parsePackageSpecifiers(ecosystem, pkgs) {
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$k
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$l
 } = constants;
-const config$m = {
+const config$n = {
   commandName: 'score',
   description: '[beta] Look up score for one package which reflects all of its transitive dependencies as well',
   hidden: false,
@@ -9110,16 +9141,16 @@ const config$m = {
   `
 };
 const cmdPackageScore = {
-  description: config$m.description,
-  hidden: config$m.hidden,
-  run: run$m
+  description: config$n.description,
+  hidden: config$n.hidden,
+  run: run$n
 };
-async function run$m(argv, importMeta, {
+async function run$n(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$m,
+    config: config$n,
     importMeta,
     parentName
   });
@@ -9161,7 +9192,7 @@ async function run$m(argv, importMeta, {
     return;
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$k);
+    logger.logger.log(DRY_RUN_BAILING_NOW$l);
     return;
   }
   await handlePurlDeepScore(purls[0] || '', outputKind);
@@ -9298,9 +9329,9 @@ async function handlePurlsShallowScore({
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$j
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$k
 } = constants;
-const config$l = {
+const config$m = {
   commandName: 'shallow',
   description: '[beta] Look up info regarding one or more packages but not their transitives',
   hidden: false,
@@ -9342,23 +9373,23 @@ const config$l = {
   `
 };
 const cmdPackageShallow = {
-  description: config$l.description,
-  hidden: config$l.hidden,
+  description: config$m.description,
+  hidden: config$m.hidden,
   alias: {
     shallowScore: {
-      description: config$l.description,
+      description: config$m.description,
       hidden: true,
       argv: []
     }
   },
-  run: run$l
+  run: run$m
 };
-async function run$l(argv, importMeta, {
+async function run$m(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$l,
+    config: config$m,
     importMeta,
     parentName
   });
@@ -9393,7 +9424,7 @@ async function run$l(argv, importMeta, {
     return;
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$j);
+    logger.logger.log(DRY_RUN_BAILING_NOW$k);
     return;
   }
   await handlePurlsShallowScore({
@@ -9447,10 +9478,10 @@ async function runRawNpm(argv) {
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$i,
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$j,
   NPM
 } = constants;
-const config$k = {
+const config$l = {
   commandName: 'raw-npm',
   description: `Temporarily disable the Socket ${NPM} wrapper`,
   hidden: false,
@@ -9464,21 +9495,21 @@ const config$k = {
   `
 };
 const cmdRawNpm = {
-  description: config$k.description,
-  hidden: config$k.hidden,
-  run: run$k
+  description: config$l.description,
+  hidden: config$l.hidden,
+  run: run$l
 };
-async function run$k(argv, importMeta, {
+async function run$l(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$k,
+    config: config$l,
     importMeta,
     parentName
   });
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$i);
+    logger.logger.log(DRY_RUN_BAILING_NOW$j);
     return;
   }
   await runRawNpm(argv);
@@ -9503,10 +9534,10 @@ async function runRawNpx(argv) {
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$h,
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$i,
   NPX
 } = constants;
-const config$j = {
+const config$k = {
   commandName: 'raw-npx',
   description: `Temporarily disable the Socket ${NPX} wrapper`,
   hidden: false,
@@ -9520,27 +9551,27 @@ const config$j = {
   `
 };
 const cmdRawNpx = {
-  description: config$j.description,
-  hidden: config$j.hidden,
-  run: run$j
+  description: config$k.description,
+  hidden: config$k.hidden,
+  run: run$k
 };
-async function run$j(argv, importMeta, {
+async function run$k(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$j,
+    config: config$k,
     importMeta,
     parentName
   });
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$h);
+    logger.logger.log(DRY_RUN_BAILING_NOW$i);
     return;
   }
   await runRawNpx(argv);
 }
 
-const config$i = {
+const config$j = {
   commandName: 'create',
   description: '[Deprecated] Create a project report',
   hidden: false,
@@ -9554,16 +9585,16 @@ const config$i = {
   `
 };
 const cmdReportCreate = {
-  description: config$i.description,
-  hidden: config$i.hidden,
-  run: run$i
+  description: config$j.description,
+  hidden: config$j.hidden,
+  run: run$j
 };
-async function run$i(argv, importMeta, {
+async function run$j(argv, importMeta, {
   parentName
 }) {
   utils.meowOrExit({
     argv,
-    config: config$i,
+    config: config$j,
     importMeta,
     parentName
   });
@@ -9571,7 +9602,7 @@ async function run$i(argv, importMeta, {
   process.exitCode = 1;
 }
 
-const config$h = {
+const config$i = {
   commandName: 'view',
   description: '[Deprecated] View a project report',
   hidden: false,
@@ -9585,16 +9616,16 @@ const config$h = {
   `
 };
 const cmdReportView = {
-  description: config$h.description,
-  hidden: config$h.hidden,
-  run: run$h
+  description: config$i.description,
+  hidden: config$i.hidden,
+  run: run$i
 };
-async function run$h(argv, importMeta, {
+async function run$i(argv, importMeta, {
   parentName
 }) {
   utils.meowOrExit({
     argv,
-    config: config$h,
+    config: config$i,
     importMeta,
     parentName
   });
@@ -9682,9 +9713,9 @@ async function handleCreateRepo({
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$g
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$h
 } = constants;
-const config$g = {
+const config$h = {
   commandName: 'create',
   description: 'Create a repository in an organization',
   hidden: false,
@@ -9747,16 +9778,16 @@ const config$g = {
   `
 };
 const cmdReposCreate = {
-  description: config$g.description,
-  hidden: config$g.hidden,
-  run: run$g
+  description: config$h.description,
+  hidden: config$h.hidden,
+  run: run$h
 };
-async function run$g(argv, importMeta, {
+async function run$h(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$g,
+    config: config$h,
     importMeta,
     parentName
   });
@@ -9801,7 +9832,7 @@ async function run$g(argv, importMeta, {
     return;
   }
   if (dryRun) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$g);
+    logger.logger.log(DRY_RUN_BAILING_NOW$h);
     return;
   }
   await handleCreateRepo({
@@ -9844,9 +9875,9 @@ async function handleDeleteRepo(orgSlug, repoName, outputKind) {
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$f
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$g
 } = constants;
-const config$f = {
+const config$g = {
   commandName: 'del',
   description: 'Delete a repository in an organization',
   hidden: false,
@@ -9879,16 +9910,16 @@ const config$f = {
   `
 };
 const cmdReposDel = {
-  description: config$f.description,
-  hidden: config$f.hidden,
-  run: run$f
+  description: config$g.description,
+  hidden: config$g.hidden,
+  run: run$g
 };
-async function run$f(argv, importMeta, {
+async function run$g(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$f,
+    config: config$g,
     importMeta,
     parentName
   });
@@ -9925,7 +9956,7 @@ async function run$f(argv, importMeta, {
     return;
   }
   if (dryRun) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$f);
+    logger.logger.log(DRY_RUN_BAILING_NOW$g);
     return;
   }
   await handleDeleteRepo(orgSlug, repoName, outputKind);
@@ -10087,9 +10118,9 @@ async function handleListRepos({
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$e
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$f
 } = constants;
-const config$e = {
+const config$f = {
   commandName: 'list',
   description: 'List repositories in an organization',
   hidden: false,
@@ -10150,16 +10181,16 @@ const config$e = {
   `
 };
 const cmdReposList = {
-  description: config$e.description,
-  hidden: config$e.hidden,
-  run: run$e
+  description: config$f.description,
+  hidden: config$f.hidden,
+  run: run$f
 };
-async function run$e(argv, importMeta, {
+async function run$f(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$e,
+    config: config$f,
     importMeta,
     parentName
   });
@@ -10204,7 +10235,7 @@ async function run$e(argv, importMeta, {
     return;
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$e);
+    logger.logger.log(DRY_RUN_BAILING_NOW$f);
     return;
   }
   await handleListRepos({
@@ -10276,9 +10307,9 @@ async function handleUpdateRepo({
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$d
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$e
 } = constants;
-const config$d = {
+const config$e = {
   commandName: 'update',
   description: 'Update a repository in an organization',
   hidden: false,
@@ -10341,16 +10372,16 @@ const config$d = {
   `
 };
 const cmdReposUpdate = {
-  description: config$d.description,
-  hidden: config$d.hidden,
-  run: run$d
+  description: config$e.description,
+  hidden: config$e.hidden,
+  run: run$e
 };
-async function run$d(argv, importMeta, {
+async function run$e(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$d,
+    config: config$e,
     importMeta,
     parentName
   });
@@ -10395,7 +10426,7 @@ async function run$d(argv, importMeta, {
     return;
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$d);
+    logger.logger.log(DRY_RUN_BAILING_NOW$e);
     return;
   }
   await handleUpdateRepo({
@@ -10463,9 +10494,9 @@ async function handleViewRepo(orgSlug, repoName, outputKind) {
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$c
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$d
 } = constants;
-const config$c = {
+const config$d = {
   commandName: 'view',
   description: 'View repositories in an organization',
   hidden: false,
@@ -10503,16 +10534,16 @@ const config$c = {
   `
 };
 const cmdReposView = {
-  description: config$c.description,
-  hidden: config$c.hidden,
-  run: run$c
+  description: config$d.description,
+  hidden: config$d.hidden,
+  run: run$d
 };
-async function run$c(argv, importMeta, {
+async function run$d(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$c,
+    config: config$d,
     importMeta,
     parentName
   });
@@ -10562,7 +10593,7 @@ async function run$c(argv, importMeta, {
     return;
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$c);
+    logger.logger.log(DRY_RUN_BAILING_NOW$d);
     return;
   }
   await handleViewRepo(orgSlug, String(repoName), outputKind);
@@ -10610,9 +10641,9 @@ async function suggestTarget() {
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$b
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$c
 } = constants;
-const config$b = {
+const config$c = {
   commandName: 'create',
   description: 'Create a scan',
   hidden: false,
@@ -10744,16 +10775,16 @@ const config$b = {
   `
 };
 const cmdScanCreate = {
-  description: config$b.description,
-  hidden: config$b.hidden,
-  run: run$b
+  description: config$c.description,
+  hidden: config$c.hidden,
+  run: run$c
 };
-async function run$b(argv, importMeta, {
+async function run$c(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$b,
+    config: config$c,
     importMeta,
     parentName
   });
@@ -10904,7 +10935,7 @@ async function run$b(argv, importMeta, {
 
   // Note exiting earlier to skirt a hidden auth requirement
   if (dryRun) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$b);
+    logger.logger.log(DRY_RUN_BAILING_NOW$c);
     return;
   }
   await handleCreateNewScan({
@@ -10958,9 +10989,9 @@ async function handleDeleteScan(orgSlug, scanId, outputKind) {
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$a
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$b
 } = constants;
-const config$a = {
+const config$b = {
   commandName: 'del',
   description: 'Delete a scan',
   hidden: false,
@@ -10993,16 +11024,16 @@ const config$a = {
   `
 };
 const cmdScanDel = {
-  description: config$a.description,
-  hidden: config$a.hidden,
-  run: run$a
+  description: config$b.description,
+  hidden: config$b.hidden,
+  run: run$b
 };
-async function run$a(argv, importMeta, {
+async function run$b(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$a,
+    config: config$b,
     importMeta,
     parentName
   });
@@ -11039,7 +11070,7 @@ async function run$a(argv, importMeta, {
     return;
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$a);
+    logger.logger.log(DRY_RUN_BAILING_NOW$b);
     return;
   }
   await handleDeleteScan(orgSlug, scanId, outputKind);
@@ -11233,14 +11264,14 @@ async function handleDiffScan({
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$9,
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$a,
   SOCKET_WEBSITE_URL: SOCKET_WEBSITE_URL$1
 } = constants;
 const SOCKET_SBOM_URL_PREFIX = `${SOCKET_WEBSITE_URL$1}/dashboard/org/SocketDev/sbom/`;
 const {
   length: SOCKET_SBOM_URL_PREFIX_LENGTH
 } = SOCKET_SBOM_URL_PREFIX;
-const config$9 = {
+const config$a = {
   commandName: 'diff',
   description: 'See what changed between two Scans',
   hidden: false,
@@ -11292,16 +11323,16 @@ const config$9 = {
   `
 };
 const cmdScanDiff = {
-  description: config$9.description,
-  hidden: config$9.hidden,
-  run: run$9
+  description: config$a.description,
+  hidden: config$a.hidden,
+  run: run$a
 };
-async function run$9(argv, importMeta, {
+async function run$a(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$9,
+    config: config$a,
     importMeta,
     parentName
   });
@@ -11353,7 +11384,7 @@ async function run$9(argv, importMeta, {
     return;
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$9);
+    logger.logger.log(DRY_RUN_BAILING_NOW$a);
     return;
   }
   await handleDiffScan({
@@ -11985,9 +12016,9 @@ async function handleCreateGithubScan({
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$8
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$9
 } = constants;
-const config$8 = {
+const config$9 = {
   commandName: 'github',
   description: 'Create a scan for given GitHub repo',
   hidden: true,
@@ -12054,16 +12085,16 @@ const config$8 = {
   `
 };
 const cmdScanGithub = {
-  description: config$8.description,
-  hidden: config$8.hidden,
-  run: run$8
+  description: config$9.description,
+  hidden: config$9.hidden,
+  run: run$9
 };
-async function run$8(argv, importMeta, {
+async function run$9(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$8,
+    config: config$9,
     importMeta,
     parentName
   });
@@ -12171,7 +12202,7 @@ async function run$8(argv, importMeta, {
 
   // Note exiting earlier to skirt a hidden auth requirement
   if (dryRun) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$8);
+    logger.logger.log(DRY_RUN_BAILING_NOW$9);
     return;
   }
   await handleCreateGithubScan({
@@ -12288,9 +12319,9 @@ async function handleListScans({
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$7
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$8
 } = constants;
-const config$7 = {
+const config$8 = {
   commandName: 'list',
   description: 'List the scans for an organization',
   hidden: false,
@@ -12367,16 +12398,16 @@ const config$7 = {
   `
 };
 const cmdScanList = {
-  description: config$7.description,
-  hidden: config$7.hidden,
-  run: run$7
+  description: config$8.description,
+  hidden: config$8.hidden,
+  run: run$8
 };
-async function run$7(argv, importMeta, {
+async function run$8(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$7,
+    config: config$8,
     importMeta,
     parentName
   });
@@ -12415,7 +12446,7 @@ async function run$7(argv, importMeta, {
     return;
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$7);
+    logger.logger.log(DRY_RUN_BAILING_NOW$8);
     return;
   }
   await handleListScans({
@@ -12475,9 +12506,9 @@ async function handleOrgScanMetadata(orgSlug, scanId, outputKind) {
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$6
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$7
 } = constants;
-const config$6 = {
+const config$7 = {
   commandName: 'metadata',
   description: "Get a scan's metadata",
   hidden: false,
@@ -12510,16 +12541,16 @@ const config$6 = {
   `
 };
 const cmdScanMetadata = {
-  description: config$6.description,
-  hidden: config$6.hidden,
-  run: run$6
+  description: config$7.description,
+  hidden: config$7.hidden,
+  run: run$7
 };
-async function run$6(argv, importMeta, {
+async function run$7(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$6,
+    config: config$7,
     importMeta,
     parentName
   });
@@ -12562,12 +12593,105 @@ async function run$6(argv, importMeta, {
     return;
   }
   if (cli.flags['dryRun']) {
-    logger.logger.log(DRY_RUN_BAILING_NOW$6);
+    logger.logger.log(DRY_RUN_BAILING_NOW$7);
     return;
   }
   await handleOrgScanMetadata(orgSlug, scanId, outputKind);
 }
 
+async function outputScanReach(result, cwd, outputKind) {
+  if (!result.ok) {
+    process.exitCode = result.code ?? 1;
+  }
+  if (outputKind === 'json') {
+    logger.logger.log(utils.serializeResultJson(result));
+    return;
+  }
+  if (!result.ok) {
+    logger.logger.fail(utils.failMsgWithBadge(result.message, result.cause));
+    return;
+  }
+  logger.logger.success('finished on', cwd);
+}
+
+async function scanReachability(cwd) {
+  logger.logger.log('Scanning now... as soon as you implement me! From', cwd);
+  return {
+    ok: true,
+    data: undefined
+  };
+}
+
+async function handleScanReach(cwd, outputKind) {
+  const result = await scanReachability(cwd);
+  await outputScanReach(result, cwd, outputKind);
+}
+
+const {
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$6
+} = constants;
+const config$6 = {
+  commandName: 'reach',
+  description: 'Compute tier 1 reachability',
+  hidden: true,
+  flags: {
+    ...utils.commonFlags,
+    ...utils.outputFlags,
+    interactive: {
+      type: 'boolean',
+      default: true,
+      description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+    }
+  },
+  help: (command, config) => `
+    Usage
+      $ ${command} [CWD=.]
+
+    Options
+      ${utils.getFlagListOutput(config.flags, 6)}
+
+    Examples
+      $ ${command}
+      $ ${command} ./proj
+  `
+};
+const cmdScanReach = {
+  description: config$6.description,
+  hidden: config$6.hidden,
+  run: run$6
+};
+async function run$6(argv, importMeta, {
+  parentName
+}) {
+  const cli = utils.meowOrExit({
+    argv,
+    config: config$6,
+    importMeta,
+    parentName
+  });
+  const {
+    dryRun,
+    interactive,
+    json,
+    markdown
+  } = cli.flags;
+  const outputKind = utils.getOutputKind(json, markdown);
+  let [cwd = '.'] = cli.input;
+  // Note: path.resolve vs .join:
+  // If given path is absolute then cwd should not affect it.
+  cwd = path.resolve(process.cwd(), cwd);
+  logger.logger.info('If you dont have any interactive bits then drop the flag', interactive);
+  const wasValidInput = utils.checkCommandInput(outputKind);
+  if (!wasValidInput) {
+    return;
+  }
+  if (dryRun) {
+    logger.logger.log(DRY_RUN_BAILING_NOW$6);
+    return;
+  }
+  await handleScanReach(cwd, outputKind);
+}
+
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$5
 } = constants;
@@ -13315,6 +13439,7 @@ const cmdScan = {
       github: cmdScanGithub,
       list: cmdScanList,
       metadata: cmdScanMetadata,
+      reach: cmdScanReach,
       report: cmdScanReport,
       setup: cmdScanSetup,
       view: cmdScanView
@@ -13980,22 +14105,34 @@ async function run(argv, importMeta, {
     parentName
   });
   const {
-    disable,
-    enable,
     json,
     markdown
   } = cli.flags;
+  let {
+    disable,
+    enable
+  } = cli.flags;
   const outputKind = utils.getOutputKind(json, markdown); // TODO: impl json/md further
 
+  if (utils.isTestingV1()) {
+    const [arg] = cli.input;
+    if (arg === 'on' || arg === 'enable' || arg === 'enabled') {
+      enable = true;
+      disable = false;
+    } else if (arg === 'off' || arg === 'disable' || arg === 'disabled') {
+      enable = false;
+      disable = true;
+    }
+  }
   const wasValidInput = utils.checkCommandInput(outputKind, {
     test: !!(enable || disable),
-    message: 'Must use --enabled or --disable',
+    message: utils.isTestingV1() ? 'Must use on or off argument' : 'Must use --enable or --disable',
     pass: 'ok',
     fail: 'missing'
   }, {
     nook: true,
     test: !enable || !disable,
-    message: 'Do not use both --enable and --disable',
+    message: utils.isTestingV1() ? 'Do not use both on and off' : 'Do not use both --enable and --disable',
     pass: 'ok',
     fail: 'missing'
   });
@@ -14110,5 +14247,5 @@ void (async () => {
     await utils.captureException(e);
   }
 })();
-//# debugId=be0da273-d5db-4d1d-8182-19605e9ce808
+//# debugId=4d928533-b1b0-4544-a736-d405169a5523
 //# sourceMappingURL=cli.js.map