@socketsecurity/cli-with-sentry 1.0.91 → 1.0.93

package/dist/cli.js

@@ -322,27 +322,37 @@ async function handleAnalytics({
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$M
 } = constants;
-const config$M = {
-  commandName: 'analytics',
-  description: 'Look up analytics data',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    ...flags.outputFlags,
-    file: {
-      type: 'string',
-      description: 'Path to store result, only valid with --json/--markdown'
-    }
-  },
-  help: (command, {
-    flags
-  }) => `
+const CMD_NAME$w = 'analytics';
+const description$C = 'Look up analytics data';
+const hidden$u = false;
+const cmdAnalytics = {
+  description: description$C,
+  hidden: hidden$u,
+  run: run$P
+};
+async function run$P(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$w,
+    description: description$C,
+    hidden: hidden$u,
+    flags: {
+      ...flags.commonFlags,
+      ...flags.outputFlags,
+      file: {
+        type: 'string',
+        description: 'Path to store result, only valid with --json/--markdown'
+      }
+    },
+    help: (command, {
+      flags
+    }) => `
     Usage
       $ ${command} [options] [ "org" | "repo" <reponame>] [TIME]
 
     API Token Requirements
-      - Quota: 1 unit
-      - Permissions: report:write
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$w}`)}
 
     The scope is either org or repo level, defaults to org.
 
@@ -358,18 +368,10 @@ const config$M = {
       $ ${command} repo test-repo 30
       $ ${command} 90
   `
-};
-const cmdAnalytics = {
-  description: config$M.description,
-  hidden: config$M.hidden,
-  run: run$P
-};
-async function run$P(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$M,
+    config,
     importMeta,
     parentName
   });
@@ -753,39 +755,49 @@ const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$L,
   SOCKET_WEBSITE_URL: SOCKET_WEBSITE_URL$3
 } = constants;
-const config$L = {
-  commandName: 'audit-log',
-  description: 'Look up the audit log for an organization',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    ...flags.outputFlags,
-    interactive: {
-      type: 'boolean',
-      default: true,
-      description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
-    },
-    org: {
-      type: 'string',
-      description: 'Force override the organization slug, overrides the default org from config'
-    },
-    page: {
-      type: 'number',
-      description: 'Result page to fetch'
+const CMD_NAME$v = 'audit-log';
+const description$B = 'Look up the audit log for an organization';
+const hidden$t = false;
+const cmdAuditLog = {
+  description: description$B,
+  hidden: hidden$t,
+  run: run$O
+};
+async function run$O(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$v,
+    description: description$B,
+    hidden: hidden$t,
+    flags: {
+      ...flags.commonFlags,
+      ...flags.outputFlags,
+      interactive: {
+        type: 'boolean',
+        default: true,
+        description: 'Allow for interactive elements, asking for input.\nUse --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+      },
+      org: {
+        type: 'string',
+        description: 'Force override the organization slug, overrides the default org from config'
+      },
+      page: {
+        type: 'number',
+        description: 'Result page to fetch'
+      },
+      perPage: {
+        type: 'number',
+        default: 30,
+        description: 'Results per page - default is 30'
+      }
     },
-    perPage: {
-      type: 'number',
-      default: 30,
-      description: 'Results per page - default is 30'
-    }
-  },
-  help: (command, config) => `
+    help: (command, config) => `
     Usage
       $ ${command} [options] [FILTER]
 
     API Token Requirements
-      - Quota: 1 unit
-      - Permissions: audit-log:list
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$v}`)}
 
     This feature requires an Enterprise Plan. To learn more about getting access
     to this feature and many more, please visit ${SOCKET_WEBSITE_URL$3}/pricing
@@ -807,20 +819,12 @@ const config$L = {
 
     Examples
       $ ${command}
-      $ ${command} deleteReport --page 2 --perPage 10
+      $ ${command} deleteReport --page 2 --per-page 10
   `
-};
-const cmdAuditLog = {
-  description: config$L.description,
-  hidden: config$L.hidden,
-  run: run$O
-};
-async function run$O(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$L,
+    config,
     importMeta,
     parentName
   });
@@ -1522,9 +1526,14 @@ async function outputCreateNewScan(result, options) {
     }
     return;
   }
-  const link = vendor.yoctocolorsCjsExports.underline(vendor.yoctocolorsCjsExports.cyan(`${result.data.html_report_url}`));
   logger.logger.log('');
-  logger.logger.log(`Available at: ${link}`);
+  logger.logger.success('Scan completed successfully!');
+  const htmlReportUrl = result.data.html_report_url;
+  if (htmlReportUrl) {
+    logger.logger.log(`View report at: ${vendor.terminalLinkExports(htmlReportUrl, htmlReportUrl)}`);
+  } else {
+    logger.logger.log('No report available.');
+  }
   if (interactive && (await prompts.confirm({
     message: 'Would you like to open it in your browser?',
     default: false
@@ -1608,7 +1617,9 @@ async function performReachabilityAnalysis(options) {
   if (branchName) {
     env['SOCKET_BRANCH_NAME'] = branchName;
   }
-  const coanaResult = await utils.spawnCoana(coanaArgs, {
+
+  // Run Coana with the manifests tar hash.
+  const coanaResult = await utils.spawnCoana(coanaArgs, orgSlug, {
     cwd,
     env,
     spinner,
@@ -2160,11 +2171,11 @@ async function handleCreateNewScan({
   const packagePaths = await utils.getPackageFilesForScan(targets, supportedFiles, {
     cwd
   });
-  spinner.stop();
+  spinner.successAndStop(`Found ${packagePaths.length} ${words.pluralize('file', packagePaths.length)} to include in scan.`);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: packagePaths.length > 0,
-    fail: 'found no eligible files to scan',
+    fail: `found no eligible files to scan. See supported manifest files at ${vendor.terminalLinkExports('docs.socket.dev', 'https://docs.socket.dev/docs/manifest-file-detection-in-socket')}`,
     message: 'TARGET (file/dir) must contain matching / supported file types for a scan'
   });
   if (!wasValidInput) {
@@ -2266,10 +2277,8 @@ async function handleCi(autoManifest) {
   }
   const orgSlug = orgSlugCResult.data;
   const cwd = process.cwd();
-  // Lazily access constants.SOCKET_DEFAULT_BRANCH.
-  const branchName = (await utils.gitBranch(cwd)) || constants.SOCKET_DEFAULT_BRANCH;
-  // Lazily access constants.SOCKET_DEFAULT_REPOSITORY.
-  const repoName = (await utils.getRepoName(cwd)) || constants.SOCKET_DEFAULT_REPOSITORY;
+  const branchName = (await utils.gitBranch(cwd)) || (await utils.detectDefaultBranch(cwd));
+  const repoName = await utils.getRepoName(cwd);
   await handleCreateNewScan({
     autoManifest,
     branchName,
@@ -2304,7 +2313,7 @@ async function handleCi(autoManifest) {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$K
 } = constants;
-const config$K = {
+const config$k = {
   commandName: 'ci',
   description: 'Shorthand for `socket scan create --report --no-interactive`',
   hidden: false,
@@ -2322,26 +2331,26 @@ const config$K = {
       $ ${command} [options]
 
     Options
-      ${utils.getFlagListOutput(config$K.flags)}
+      ${utils.getFlagListOutput(config$k.flags)}
 
     This command is intended to use in CI runs to allow automated systems to
     accept or reject a current build. It will use the default org of the
     Socket API token. The exit code will be non-zero when the scan does not pass
     your security policy.
 
-    The --autoManifest flag does the same as the one from \`socket scan create\`
+    The --auto-manifest flag does the same as the one from \`socket scan create\`
     but is not enabled by default since the CI is less likely to be set up with
     all the necessary dev tooling. Enable it if you want the scan to include
     locally generated manifests like for gradle and sbt.
 
     Examples
       $ ${command}
-      $ ${command} --autoManifest
+      $ ${command} --auto-manifest
   `
 };
 const cmdCI = {
-  description: config$K.description,
-  hidden: config$K.hidden,
+  description: config$k.description,
+  hidden: config$k.hidden,
   run: run$N
 };
 async function run$N(argv, importMeta, {
@@ -2349,7 +2358,7 @@ async function run$N(argv, importMeta, {
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$K,
+    config: config$k,
     importMeta,
     parentName
   });
@@ -2593,20 +2602,21 @@ async function handleConfigAuto({
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$J
 } = constants;
-const description$a = 'Automatically discover and set the correct value config item';
-const hidden$2 = false;
+const CMD_NAME$u = 'auto';
+const description$A = 'Automatically discover and set the correct value config item';
+const hidden$s = false;
 const cmdConfigAuto = {
-  description: description$a,
-  hidden: hidden$2,
+  description: description$A,
+  hidden: hidden$s,
   run: run$M
 };
 async function run$M(argv, importMeta, {
   parentName
 }) {
   const config = {
-    commandName: 'auto',
-    description: description$a,
-    hidden: hidden$2,
+    commandName: CMD_NAME$u,
+    description: description$A,
+    hidden: hidden$s,
     flags: {
       ...flags.commonFlags,
       ...flags.outputFlags
@@ -2704,7 +2714,7 @@ async function handleConfigGet({
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$I
 } = constants;
-const config$J = {
+const config$j = {
   commandName: 'get',
   description: 'Get the value of a local CLI config item',
   hidden: false,
@@ -2731,8 +2741,8 @@ ${utils.getSupportedConfigEntries().map(([key, desc]) => `     - ${key} -- ${des
   `
 };
 const cmdConfigGet = {
-  description: config$J.description,
-  hidden: config$J.hidden,
+  description: config$j.description,
+  hidden: config$j.hidden,
   run: run$L
 };
 async function run$L(argv, importMeta, {
@@ -2740,7 +2750,7 @@ async function run$L(argv, importMeta, {
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$J,
+    config: config$j,
     importMeta,
     parentName
   });
@@ -2845,7 +2855,7 @@ async function outputConfigList({
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$H
 } = constants;
-const config$I = {
+const config$i = {
   commandName: 'list',
   description: 'Show all local CLI config items and their values',
   hidden: false,
@@ -2870,8 +2880,8 @@ const config$I = {
   `
 };
 const cmdConfigList = {
-  description: config$I.description,
-  hidden: config$I.hidden,
+  description: config$i.description,
+  hidden: config$i.hidden,
   run: run$K
 };
 async function run$K(argv, importMeta, {
@@ -2879,7 +2889,7 @@ async function run$K(argv, importMeta, {
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$I,
+    config: config$i,
     importMeta,
     parentName
   });
@@ -2951,20 +2961,21 @@ async function handleConfigSet({
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$G
 } = constants;
-const description$9 = 'Update the value of a local CLI config item';
-const hidden$1 = false;
+const CMD_NAME$t = 'set';
+const description$z = 'Update the value of a local CLI config item';
+const hidden$r = false;
 const cmdConfigSet = {
-  description: description$9,
-  hidden: hidden$1,
+  description: description$z,
+  hidden: hidden$r,
   run: run$J
 };
 async function run$J(argv, importMeta, {
   parentName
 }) {
   const config = {
-    commandName: 'set',
-    description: description$9,
-    hidden: hidden$1,
+    commandName: CMD_NAME$t,
+    description: description$z,
+    hidden: hidden$r,
     flags: {
       ...flags.commonFlags,
       ...flags.outputFlags
@@ -3077,20 +3088,21 @@ async function handleConfigUnset({
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$F
 } = constants;
-const description$8 = 'Clear the value of a local CLI config item';
-const hidden = false;
+const CMD_NAME$s = 'unset';
+const description$y = 'Clear the value of a local CLI config item';
+const hidden$q = false;
 const cmdConfigUnset = {
-  description: description$8,
-  hidden,
+  description: description$y,
+  hidden: hidden$q,
   run: run$I
 };
 async function run$I(argv, importMeta, {
   parentName
 }) {
   const config = {
-    commandName: 'unset',
-    description: description$8,
-    hidden,
+    commandName: CMD_NAME$s,
+    description: description$y,
+    hidden: hidden$q,
     flags: {
       ...flags.commonFlags,
       ...flags.outputFlags
@@ -3149,9 +3161,9 @@ ${utils.getSupportedConfigEntries().map(([key, desc]) => `     - ${key} -- ${des
   });
 }
 
-const description$7 = 'Manage Socket CLI configuration';
+const description$x = 'Manage Socket CLI configuration';
 const cmdConfig = {
-  description: description$7,
+  description: description$x,
   hidden: false,
   async run(argv, importMeta, {
     parentName
@@ -3164,7 +3176,7 @@ const cmdConfig = {
       unset: cmdConfigUnset
     }, {
       argv,
-      description: description$7,
+      description: description$x,
       importMeta,
       name: `${parentName} config`
     });
@@ -3213,12 +3225,9 @@ async function coanaFix(fixConfig) {
   }
   const isAllOrAuto = ghsas.length === 1 && (ghsas[0] === 'all' || ghsas[0] === 'auto');
   const ids = isAllOrAuto ? ['all'] : ghsas;
-  const fixCResult = ids.length ? await utils.spawnCoana(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ...ids, ...fixConfig.unknownFlags], {
+  const fixCResult = ids.length ? await utils.spawnCoana(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ...ids, ...fixConfig.unknownFlags], fixConfig.orgSlug, {
     cwd,
-    spinner,
-    env: {
-      SOCKET_ORG_SLUG: orgSlug
-    }
+    spinner
   }) : undefined;
   if (fixCResult) {
     lastCResult = fixCResult;
@@ -4385,7 +4394,7 @@ async function agentFix(pkgEnvDetails, actualTree, alertsMap, installer, {
   };
 }
 
-const CMD_NAME$1 = 'socket fix';
+const CMD_NAME$r = 'socket fix';
 function getFixAlertsMapOptions(options = {}) {
   return {
     __proto__: null,
@@ -4835,7 +4844,7 @@ async function handleFix({
     return;
   }
   const pkgEnvCResult = await utils.detectAndValidatePackageEnvironment(cwd, {
-    cmdName: CMD_NAME$1,
+    cmdName: CMD_NAME$r,
     logger: logger.logger
   });
   if (!pkgEnvCResult.ok) {
@@ -4896,63 +4905,74 @@ async function handleFix({
 const {
   DRY_RUN_NOT_SAVING
 } = constants;
+const CMD_NAME$q = 'fix';
 const DEFAULT_LIMIT = 10;
-const config$H = {
-  commandName: 'fix',
-  description: 'Update dependencies with "fixable" Socket alerts',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    autoMerge: {
-      type: 'boolean',
-      default: false,
-      description: `Enable auto-merge for pull requests that Socket opens.\nSee ${vendor.terminalLinkExports('GitHub documentation', 'https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-auto-merge-for-pull-requests-in-your-repository')} for managing auto-merge for pull requests in your repository.`
-    },
-    autopilot: {
-      type: 'boolean',
-      default: false,
-      description: `Shorthand for --autoMerge --test`
-    },
-    ghsa: {
-      type: 'string',
-      default: [],
-      description: `Provide a list of ${vendor.terminalLinkExports('GHSA IDs', 'https://docs.github.com/en/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/about-the-github-advisory-database#about-ghsa-ids')} to compute fixes for, as either a comma separated value or as multiple flags.\nUse '--ghsa all' to lookup all GHSA IDs and compute fixes for them.`,
-      isMultiple: true,
-      hidden: true
-    },
-    limit: {
-      type: 'number',
-      default: DEFAULT_LIMIT,
-      description: `The number of fixes to attempt at a time (default ${DEFAULT_LIMIT})`
-    },
-    maxSatisfying: {
-      type: 'boolean',
-      default: true,
-      description: 'Use the maximum satisfying version for dependency updates',
-      hidden: true
-    },
-    minSatisfying: {
-      type: 'boolean',
-      default: false,
-      description: 'Constrain dependency updates to the minimum satisfying version'
-    },
-    prCheck: {
-      type: 'boolean',
-      default: true,
-      description: 'Check for an existing PR before attempting a fix',
-      hidden: true
-    },
-    purl: {
-      type: 'string',
-      default: [],
-      description: `Provide a list of ${vendor.terminalLinkExports('PURLs', 'https://github.com/package-url/purl-spec?tab=readme-ov-file#purl')} to compute fixes for, as either a comma separated value or as\nmultiple flags, instead of querying the Socket API`,
-      isMultiple: true,
-      shortFlag: 'p'
-    },
-    rangeStyle: {
-      type: 'string',
-      default: 'preserve',
-      description: `
+const description$w = 'Update dependencies with "fixable" Socket alerts';
+const hidden$p = false;
+const cmdFix = {
+  description: description$w,
+  hidden: hidden$p,
+  run: run$H
+};
+async function run$H(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$q,
+    description: description$w,
+    hidden: hidden$p,
+    flags: {
+      ...flags.commonFlags,
+      autoMerge: {
+        type: 'boolean',
+        default: false,
+        description: `Enable auto-merge for pull requests that Socket opens.\nSee ${vendor.terminalLinkExports('GitHub documentation', 'https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-auto-merge-for-pull-requests-in-your-repository')} for managing auto-merge for pull requests in your repository.`
+      },
+      autopilot: {
+        type: 'boolean',
+        default: false,
+        description: `Shorthand for --auto-merge --test`
+      },
+      ghsa: {
+        type: 'string',
+        default: [],
+        description: `Provide a list of ${vendor.terminalLinkExports('GHSA IDs', 'https://docs.github.com/en/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/about-the-github-advisory-database#about-ghsa-ids')} to compute fixes for, as either a comma separated value or as multiple flags.\nUse '--ghsa all' to lookup all GHSA IDs and compute fixes for them.`,
+        isMultiple: true,
+        hidden: true
+      },
+      limit: {
+        type: 'number',
+        default: DEFAULT_LIMIT,
+        description: `The number of fixes to attempt at a time (default ${DEFAULT_LIMIT})`
+      },
+      maxSatisfying: {
+        type: 'boolean',
+        default: true,
+        description: 'Use the maximum satisfying version for dependency updates',
+        hidden: true
+      },
+      minSatisfying: {
+        type: 'boolean',
+        default: false,
+        description: 'Constrain dependency updates to the minimum satisfying version'
+      },
+      prCheck: {
+        type: 'boolean',
+        default: true,
+        description: 'Check for an existing PR before attempting a fix',
+        hidden: true
+      },
+      purl: {
+        type: 'string',
+        default: [],
+        description: `Provide a list of ${vendor.terminalLinkExports('PURLs', 'https://github.com/package-url/purl-spec?tab=readme-ov-file#purl')} to compute fixes for, as either a comma separated value or as\nmultiple flags, instead of querying the Socket API`,
+        isMultiple: true,
+        shortFlag: 'p'
+      },
+      rangeStyle: {
+        type: 'string',
+        default: 'preserve',
+        description: `
 Define how dependency version ranges are updated in package.json (default 'preserve').
 Available styles:
   * caret - Use ^ range for compatible updates (e.g. ^1.2.3)
@@ -4964,42 +4984,37 @@ Available styles:
   * preserve - Retain the existing version range style as-is
   * tilde - Use ~ range for patch/minor updates (e.g. ~1.2.3)
       `.trim()
+      },
+      test: {
+        type: 'boolean',
+        default: false,
+        description: 'Verify the fix by running unit tests'
+      },
+      testScript: {
+        type: 'string',
+        default: 'test',
+        description: "The test script to run for fix attempts (default 'test')"
+      }
     },
-    test: {
-      type: 'boolean',
-      default: false,
-      description: 'Verify the fix by running unit tests'
-    },
-    testScript: {
-      type: 'string',
-      default: 'test',
-      description: "The test script to run for fix attempts (default 'test')"
-    }
-  },
-  help: (command, config) => `
+    help: (command, config) => `
     Usage
       $ ${command} [options] [CWD=.]
 
+    API Token Requirements
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$q}`)}
+
     Options
       ${utils.getFlagListOutput(config.flags)}
 
     Examples
       $ ${command}
-      $ ${command} ./proj/tree --autoMerge
-  `
-};
-const cmdFix = {
-  description: config$H.description,
-  hidden: config$H.hidden,
-  run: run$H
-};
-async function run$H(argv, importMeta, {
-  parentName
-}) {
+      $ ${command} ./proj/tree --auto-merge
+    `
+  };
   const cli = utils.meowOrExit({
     allowUnknownFlags: false,
     argv,
-    config: config$H,
+    config,
     importMeta,
     parentName
   });
@@ -5208,7 +5223,7 @@ async function handleInstallCompletion(targetName) {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$E
 } = constants;
-const config$G = {
+const config$h = {
   commandName: 'completion',
   description: 'Install bash completion for Socket CLI',
   hidden: false,
@@ -5245,8 +5260,8 @@ const config$G = {
   `
 };
 const cmdInstallCompletion = {
-  description: config$G.description,
-  hidden: config$G.hidden,
+  description: config$h.description,
+  hidden: config$h.hidden,
   run: run$G
 };
 async function run$G(argv, importMeta, {
@@ -5254,7 +5269,7 @@ async function run$G(argv, importMeta, {
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$G,
+    config: config$h,
     importMeta,
     parentName
   });
@@ -5267,9 +5282,9 @@ async function run$G(argv, importMeta, {
   await handleInstallCompletion(String(targetName));
 }
 
-const description$6 = 'Install Socket CLI tab completion';
+const description$v = 'Install Socket CLI tab completion';
 const cmdInstall = {
-  description: description$6,
+  description: description$v,
   hidden: false,
   async run(argv, importMeta, {
     parentName
@@ -5278,7 +5293,7 @@ const cmdInstall = {
       completion: cmdInstallCompletion
     }, {
       argv,
-      description: description$6,
+      description: description$v,
       importMeta,
       name: `${parentName} install`
     });
@@ -5309,7 +5324,7 @@ async function handleCmdJson(cwd) {
   await outputCmdJson(cwd);
 }
 
-const config$F = {
+const config$g = {
   commandName: 'json',
   description: 'Display the `socket.json` that would be applied for target folder',
   hidden: true,
@@ -5328,8 +5343,8 @@ const config$F = {
   `
 };
 const cmdJson = {
-  description: config$F.description,
-  hidden: config$F.hidden,
+  description: config$g.description,
+  hidden: config$g.hidden,
   run: run$F
 };
 async function run$F(argv, importMeta, {
@@ -5337,7 +5352,7 @@ async function run$F(argv, importMeta, {
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$F,
+    config: config$g,
     importMeta,
     parentName
   });
@@ -5490,27 +5505,38 @@ async function attemptLogin(apiBaseUrl, apiProxy) {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$D
 } = constants;
-const config$E = {
-  commandName: 'login',
-  description: 'Setup Socket CLI with an API token and defaults',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    apiBaseUrl: {
-      type: 'string',
-      description: 'API server to connect to for login'
+const CMD_NAME$p = 'login';
+const description$u = 'Setup Socket CLI with an API token and defaults';
+const hidden$o = false;
+const cmdLogin = {
+  description: description$u,
+  hidden: hidden$o,
+  run: run$E
+};
+async function run$E(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$p,
+    description: description$u,
+    hidden: hidden$o,
+    flags: {
+      ...flags.commonFlags,
+      apiBaseUrl: {
+        type: 'string',
+        description: 'API server to connect to for login'
+      },
+      apiProxy: {
+        type: 'string',
+        description: 'Proxy to use when making connection to API server'
+      }
     },
-    apiProxy: {
-      type: 'string',
-      description: 'Proxy to use when making connection to API server'
-    }
-  },
-  help: (command, config) => `
+    help: (command, config) => `
     Usage
       $ ${command} [options]
 
     API Token Requirements
-      - Quota: 1 unit
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$p}`)}
 
     Logs into the Socket API by prompting for an API token
 
@@ -5521,18 +5547,10 @@ const config$E = {
       $ ${command}
       $ ${command} --api-proxy=http://localhost:1234
   `
-};
-const cmdLogin = {
-  description: config$E.description,
-  hidden: config$E.hidden,
-  run: run$E
-};
-async function run$E(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$E,
+    config,
     importMeta,
     parentName
   });
@@ -5542,7 +5560,7 @@ async function run$E(argv, importMeta, {
     return;
   }
   if (!vendor.isInteractiveExports()) {
-    throw new utils.InputError('Cannot prompt for credentials in a non-interactive shell');
+    throw new utils.InputError('Cannot prompt for credentials in a non-interactive shell. Use SOCKET_CLI_API_TOKEN environment variable instead');
   }
   const apiBaseUrl = cli.flags['apiBaseUrl'];
   const apiProxy = cli.flags['apiProxy'];
@@ -5572,7 +5590,7 @@ function attemptLogout() {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$C
 } = constants;
-const config$D = {
+const config$f = {
   commandName: 'logout',
   description: 'Socket API logout',
   hidden: false,
@@ -5590,8 +5608,8 @@ const config$D = {
   `
 };
 const cmdLogout = {
-  description: config$D.description,
-  hidden: config$D.hidden,
+  description: config$f.description,
+  hidden: config$f.hidden,
   run: run$D
 };
 async function run$D(argv, importMeta, {
@@ -5599,7 +5617,7 @@ async function run$D(argv, importMeta, {
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$D,
+    config: config$f,
     importMeta,
     parentName
   });
@@ -5894,7 +5912,7 @@ const yargsConfig = {
   'usages-slices-file' // hidden
   ]
 };
-const config$C = {
+const config$e = {
   commandName: 'cdxgen',
   description: 'Create an SBOM with CycloneDX generator (cdxgen)',
   hidden: false,
@@ -5904,8 +5922,8 @@ const config$C = {
   help: () => ''
 };
 const cmdManifestCdxgen = {
-  description: config$C.description,
-  hidden: config$C.hidden,
+  description: config$e.description,
+  hidden: config$e.hidden,
   run: run$C
 };
 async function run$C(argv, importMeta, {
@@ -5914,7 +5932,7 @@ async function run$C(argv, importMeta, {
   const cli = utils.meowOrExit({
     // Don't let meow take over --help.
     argv: argv.filter(a => !utils.isHelpFlag(a)),
-    config: config$C,
+    config: config$e,
     importMeta,
     parentName
   });
@@ -5970,7 +5988,7 @@ async function run$C(argv, importMeta, {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$A
 } = constants;
-const config$B = {
+const config$d = {
   commandName: 'auto',
   description: 'Auto-detect build and attempt to generate manifest file',
   hidden: false,
@@ -6003,8 +6021,8 @@ const config$B = {
   `
 };
 const cmdManifestAuto = {
-  description: config$B.description,
-  hidden: config$B.hidden,
+  description: config$d.description,
+  hidden: config$d.hidden,
   run: run$B
 };
 async function run$B(argv, importMeta, {
@@ -6012,7 +6030,7 @@ async function run$B(argv, importMeta, {
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$B,
+    config: config$d,
     importMeta,
     parentName
   });
@@ -6030,7 +6048,7 @@ async function run$B(argv, importMeta, {
   cwd = path.resolve(process.cwd(), cwd);
   const outputKind = utils.getOutputKind(json, markdown);
   if (verbose) {
-    logger.logger.group('- ', parentName, config$B.commandName, ':');
+    logger.logger.group('- ', parentName, config$d.commandName, ':');
     logger.logger.group('- flags:', cli.flags);
     logger.logger.groupEnd();
     logger.logger.log('- input:', cli.input);
@@ -6067,7 +6085,7 @@ async function run$B(argv, importMeta, {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$z
 } = constants;
-const config$A = {
+const config$c = {
   commandName: 'conda',
   description: '[beta] Convert a Conda environment.yml file to a python requirements.txt',
   hidden: false,
@@ -6118,8 +6136,8 @@ const config$A = {
   `
 };
 const cmdManifestConda = {
-  description: config$A.description,
-  hidden: config$A.hidden,
+  description: config$c.description,
+  hidden: config$c.hidden,
   run: run$A
 };
 async function run$A(argv, importMeta, {
@@ -6127,7 +6145,7 @@ async function run$A(argv, importMeta, {
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$A,
+    config: config$c,
     importMeta,
     parentName
   });
@@ -6185,7 +6203,7 @@ async function run$A(argv, importMeta, {
     verbose = false;
   }
   if (verbose) {
-    logger.logger.group('- ', parentName, config$A.commandName, ':');
+    logger.logger.group('- ', parentName, config$c.commandName, ':');
     logger.logger.group('- flags:', cli.flags);
     logger.logger.groupEnd();
     logger.logger.log('- target:', cwd);
@@ -6224,7 +6242,7 @@ async function run$A(argv, importMeta, {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$y
 } = constants;
-const config$z = {
+const config$b = {
   commandName: 'gradle',
   description: '[beta] Use Gradle to generate a manifest file (`pom.xml`) for a Gradle/Java/Kotlin/etc project',
   hidden: false,
@@ -6277,8 +6295,8 @@ const config$z = {
   `
 };
 const cmdManifestGradle = {
-  description: config$z.description,
-  hidden: config$z.hidden,
+  description: config$b.description,
+  hidden: config$b.hidden,
   run: run$z
 };
 async function run$z(argv, importMeta, {
@@ -6286,7 +6304,7 @@ async function run$z(argv, importMeta, {
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$z,
+    config: config$b,
     importMeta,
     parentName
   });
@@ -6322,7 +6340,7 @@ async function run$z(argv, importMeta, {
   if (!gradleOpts) {
     if (sockJson.defaults?.manifest?.gradle?.gradleOpts) {
       gradleOpts = sockJson.defaults?.manifest?.gradle?.gradleOpts;
-      logger.logger.info('Using default --gradleOpts from socket.json:', gradleOpts);
+      logger.logger.info('Using default --gradle-opts from socket.json:', gradleOpts);
     } else {
       gradleOpts = '';
     }
@@ -6336,7 +6354,7 @@ async function run$z(argv, importMeta, {
     }
   }
   if (verbose) {
-    logger.logger.group('- ', parentName, config$z.commandName, ':');
+    logger.logger.group('- ', parentName, config$b.commandName, ':');
     logger.logger.group('- flags:', cli.flags);
     logger.logger.groupEnd();
     logger.logger.log('- input:', cli.input);
@@ -6383,7 +6401,7 @@ const {
 //       sense for the help panels to note the requested language, rather than
 //       `socket manifest kotlin` to print help screens with `gradle` as the
 //       command. Room for improvement.
-const config$y = {
+const config$a = {
   commandName: 'kotlin',
   description: '[beta] Use Gradle to generate a manifest file (`pom.xml`) for a Kotlin project',
   hidden: false,
@@ -6436,8 +6454,8 @@ const config$y = {
   `
 };
 const cmdManifestKotlin = {
-  description: config$y.description,
-  hidden: config$y.hidden,
+  description: config$a.description,
+  hidden: config$a.hidden,
   run: run$y
 };
 async function run$y(argv, importMeta, {
@@ -6445,7 +6463,7 @@ async function run$y(argv, importMeta, {
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$y,
+    config: config$a,
     importMeta,
     parentName
   });
@@ -6481,7 +6499,7 @@ async function run$y(argv, importMeta, {
   if (!gradleOpts) {
     if (sockJson.defaults?.manifest?.gradle?.gradleOpts) {
       gradleOpts = sockJson.defaults?.manifest?.gradle?.gradleOpts;
-      logger.logger.info('Using default --gradleOpts from socket.json:', gradleOpts);
+      logger.logger.info('Using default --gradle-opts from socket.json:', gradleOpts);
     } else {
       gradleOpts = '';
     }
@@ -6495,7 +6513,7 @@ async function run$y(argv, importMeta, {
     }
   }
   if (verbose) {
-    logger.logger.group('- ', parentName, config$y.commandName, ':');
+    logger.logger.group('- ', parentName, config$a.commandName, ':');
     logger.logger.group('- flags:', cli.flags);
     logger.logger.groupEnd();
     logger.logger.log('- input:', cli.input);
@@ -6536,7 +6554,7 @@ async function run$y(argv, importMeta, {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$w
 } = constants;
-const config$x = {
+const config$9 = {
   commandName: 'scala',
   description: "[beta] Generate a manifest file (`pom.xml`) from Scala's `build.sbt` file",
   hidden: false,
@@ -6602,8 +6620,8 @@ const config$x = {
   `
 };
 const cmdManifestScala = {
-  description: config$x.description,
-  hidden: config$x.hidden,
+  description: config$9.description,
+  hidden: config$9.hidden,
   run: run$x
 };
 async function run$x(argv, importMeta, {
@@ -6611,7 +6629,7 @@ async function run$x(argv, importMeta, {
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$x,
+    config: config$9,
     importMeta,
     parentName
   });
@@ -6663,7 +6681,7 @@ async function run$x(argv, importMeta, {
   if (!sbtOpts) {
     if (sockJson.defaults?.manifest?.sbt?.sbtOpts) {
       sbtOpts = sockJson.defaults?.manifest?.sbt?.sbtOpts;
-      logger.logger.info('Using default --sbtOpts from socket.json:', sbtOpts);
+      logger.logger.info('Using default --sbt-opts from socket.json:', sbtOpts);
     } else {
       sbtOpts = '';
     }
@@ -6675,7 +6693,7 @@ async function run$x(argv, importMeta, {
     verbose = false;
   }
   if (verbose) {
-    logger.logger.group('- ', parentName, config$x.commandName, ':');
+    logger.logger.group('- ', parentName, config$9.commandName, ':');
     logger.logger.group('- flags:', cli.flags);
     logger.logger.groupEnd();
     logger.logger.log('- input:', cli.input);
@@ -6935,7 +6953,7 @@ async function setupGradle(config) {
     delete config.bin;
   }
   const opts = await prompts.input({
-    message: '(--gradleOpts) Enter gradle options to pass through',
+    message: '(--gradle-opts) Enter gradle options to pass through',
     default: config.gradleOpts || '',
     required: false
     // validate: async string => bool
@@ -6967,7 +6985,7 @@ async function setupSbt(config) {
     delete config.bin;
   }
   const opts = await prompts.input({
-    message: '(--sbtOpts) Enter sbt options to pass through',
+    message: '(--sbt-opts) Enter sbt options to pass through',
     default: config.sbtOpts || '',
     required: false
     // validate: async string => bool
@@ -7123,7 +7141,7 @@ async function handleManifestSetup(cwd, defaultOnReadError) {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$v
 } = constants;
-const config$w = {
+const config$8 = {
   commandName: 'setup',
   description: 'Start interactive configurator to customize default flag values for `socket manifest` in this dir',
   hidden: false,
@@ -7166,8 +7184,8 @@ const config$w = {
   `
 };
 const cmdManifestSetup = {
-  description: config$w.description,
-  hidden: config$w.hidden,
+  description: config$8.description,
+  hidden: config$8.hidden,
   run: run$w
 };
 async function run$w(argv, importMeta, {
@@ -7175,7 +7193,7 @@ async function run$w(argv, importMeta, {
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$w,
+    config: config$8,
     importMeta,
     parentName
   });
@@ -7194,7 +7212,7 @@ async function run$w(argv, importMeta, {
   await handleManifestSetup(cwd, Boolean(defaultOnReadError));
 }
 
-const config$v = {
+const config$7 = {
   commandName: 'manifest',
   description: 'Generate a dependency manifest for certain ecosystems',
   hidden: false,
@@ -7202,8 +7220,8 @@ const config$v = {
     ...flags.commonFlags
   }};
 const cmdManifest = {
-  description: config$v.description,
-  hidden: config$v.hidden,
+  description: config$7.description,
+  hidden: config$7.hidden,
   run: run$v
 };
 async function run$v(argv, importMeta, {
@@ -7221,15 +7239,15 @@ async function run$v(argv, importMeta, {
     argv,
     aliases: {
       yolo: {
-        description: config$v.description,
+        description: config$7.description,
         hidden: true,
         argv: ['auto']
       }
     },
-    description: config$v.description,
+    description: config$7.description,
     importMeta,
-    flags: config$v.flags,
-    name: `${parentName} ${config$v.commandName}`
+    flags: config$7.flags,
+    name: `${parentName} ${config$7.commandName}`
   });
 }
 
@@ -7237,42 +7255,44 @@ const require$3 = require$$5.createRequire(require('node:url').pathToFileURL(__f
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$u
 } = constants;
-const config$u = {
-  commandName: 'npm',
-  description: 'Run npm with the Socket wrapper',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags
-  },
-  help: command => `
+const CMD_NAME$o = 'npm';
+const description$t = 'Run npm with the Socket wrapper';
+const hidden$n = false;
+const cmdNpm = {
+  description: description$t,
+  hidden: hidden$n,
+  run: run$u
+};
+async function run$u(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$o,
+    description: description$t,
+    hidden: hidden$n,
+    flags: {
+      ...flags.commonFlags
+    },
+    help: command => `
     Usage
       $ ${command} ...
 
-    This runs npm but checks packages through Socket before installing anything.
-    See docs for more details.
+    API Token Requirements
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$o}`)}
 
-    Note: Everything after "npm" is sent straight to the npm command.
-          Only the \`--dryRun\` and \`--help\` flags are caught here.
+    Note: Everything after "npm" is passed to the npm command.
+          Only the \`--dry-run\` and \`--help\` flags are caught here.
 
-    Use \`socket wrapper on\` to automatically enable this such that you don't
-    have to write \`socket npm\` for that purpose.
+    Use \`socket wrapper on\` to alias this command as \`npm\`.
 
     Examples
       $ ${command}
-      $ ${command} install -g socket
-  `
-};
-const cmdNpm = {
-  description: config$u.description,
-  hidden: config$u.hidden,
-  run: run$u
-};
-async function run$u(argv, importMeta, {
-  parentName
-}) {
+      $ ${command} install -g cowsay
+    `
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$u,
+    config,
     importMeta,
     parentName
   });
@@ -7291,42 +7311,43 @@ const require$2 = require$$5.createRequire(require('node:url').pathToFileURL(__f
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$t
 } = constants;
-const config$t = {
-  commandName: 'npx',
-  description: 'Run npx with the Socket wrapper',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags
-  },
-  help: (command, _config) => `
+const CMD_NAME$n = 'npx';
+const description$s = 'Run npx with the Socket wrapper';
+const hidden$m = false;
+const cmdNpx = {
+  description: description$s,
+  hidden: hidden$m,
+  run: run$t
+};
+async function run$t(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$n,
+    description: description$s,
+    hidden: hidden$m,
+    flags: {
+      ...flags.commonFlags
+    },
+    help: (command, _config) => `
     Usage
       $ ${command} ...
 
-    This runs npx but checks packages through Socket before running them.
-    See docs for more details.
+    API Token Requirements
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$n}`)}
 
-    Note: Everything after "npx" is sent straight to the npx command.
-          Only the \`--dryRun\` and \`--help\` flags are caught here.
+    Note: Everything after "npx" is passed to the npx command.
+          Only the \`--dry-run\` and \`--help\` flags are caught here.
 
-    Use \`socket wrapper on\` to automatically enable this such that you don't
-    have to write \`socket npx\` for that purpose.
+    Use \`socket wrapper on\` to alias this command as \`npx\`.
 
     Examples
-      $ ${command}
-      $ ${command} prettier
+      $ ${command} cowsay
   `
-};
-const cmdNpx = {
-  description: config$t.description,
-  hidden: config$t.hidden,
-  run: run$t
-};
-async function run$t(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$t,
+    config,
     importMeta,
     parentName
   });
@@ -7344,7 +7365,7 @@ async function run$t(argv, importMeta, {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$s
 } = constants;
-const config$s = {
+const config$6 = {
   commandName: 'oops',
   description: 'Trigger an intentional error (for development)',
   hidden: true,
@@ -7365,8 +7386,8 @@ const config$s = {
   `
 };
 const cmdOops = {
-  description: config$s.description,
-  hidden: config$s.hidden,
+  description: config$6.description,
+  hidden: config$6.hidden,
   run: run$s
 };
 async function run$s(argv, importMeta, {
@@ -7374,7 +7395,7 @@ async function run$s(argv, importMeta, {
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$s,
+    config: config$6,
     importMeta,
     parentName
   });
@@ -7710,7 +7731,7 @@ async function listPackages(pkgEnvDetails, options) {
   }
 }
 
-const CMD_NAME = 'socket optimize';
+const CMD_NAME$m = 'socket optimize';
 
 const {
   BUN,
@@ -7885,7 +7906,7 @@ async function addOverrides(pkgEnvDetails, pkgPath, options) {
   npmExecPath === NPM && !state.warnedPnpmWorkspaceRequiresNpm) {
     state.warnedPnpmWorkspaceRequiresNpm = true;
     spinner?.stop();
-    logger?.warn(utils.cmdPrefixMessage(CMD_NAME, `${agent} workspace support requires \`npm ls\`, falling back to \`${agent} list\``));
+    logger?.warn(utils.cmdPrefixMessage(CMD_NAME$m, `${agent} workspace support requires \`npm ls\`, falling back to \`${agent} list\``));
     spinner?.start();
   }
   const overridesDataObjects = [];
@@ -8116,7 +8137,7 @@ async function applyOptimization(pkgEnvDetails, {
   const pkgJsonChanged = addedCount > 0 || updatedCount > 0;
   if (pkgJsonChanged || pkgEnvDetails.features.npmBuggyOverrides) {
     const result = await updateLockfile(pkgEnvDetails, {
-      cmdName: CMD_NAME,
+      cmdName: CMD_NAME$m,
       logger: logger.logger,
       spinner
     });
@@ -8178,7 +8199,7 @@ async function handleOptimize({
   prod
 }) {
   const pkgEnvCResult = await utils.detectAndValidatePackageEnvironment(cwd, {
-    cmdName: CMD_NAME,
+    cmdName: CMD_NAME$m,
     logger: logger.logger,
     prod
   });
@@ -8203,7 +8224,7 @@ async function handleOptimize({
     await outputOptimizeResult({
       ok: false,
       message: 'Unsupported',
-      cause: utils.cmdPrefixMessage(CMD_NAME, `${agent} v${agentVersion} does not support overrides.`)
+      cause: utils.cmdPrefixMessage(CMD_NAME$m, `${agent} v${agentVersion} does not support overrides.`)
     }, outputKind);
     return;
   }
@@ -8217,27 +8238,41 @@ async function handleOptimize({
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$r
 } = constants;
-const config$r = {
-  commandName: 'optimize',
-  description: 'Optimize dependencies with @socketregistry overrides',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    pin: {
-      type: 'boolean',
-      default: false,
-      description: 'Pin overrides to their latest version'
+const CMD_NAME$l = 'optimize';
+const description$r = 'Optimize dependencies with @socketregistry overrides';
+const hidden$l = false;
+const cmdOptimize = {
+  description: description$r,
+  hidden: hidden$l,
+  run: run$r
+};
+async function run$r(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$l,
+    description: description$r,
+    hidden: hidden$l,
+    flags: {
+      ...flags.commonFlags,
+      pin: {
+        type: 'boolean',
+        default: false,
+        description: 'Pin overrides to their latest version'
+      },
+      prod: {
+        type: 'boolean',
+        default: false,
+        description: 'Only add overrides for production dependencies'
+      }
     },
-    prod: {
-      type: 'boolean',
-      default: false,
-      description: 'Only add overrides for production dependencies'
-    }
-  },
-  help: (command, config) => `
+    help: (command, config) => `
     Usage
       $ ${command} [options] [CWD=.]
 
+    API Token Requirements
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$l}`)}
+
     Options
       ${utils.getFlagListOutput(config.flags)}
 
@@ -8245,18 +8280,10 @@ const config$r = {
       $ ${command}
       $ ${command} ./proj/tree --pin
   `
-};
-const cmdOptimize = {
-  description: config$r.description,
-  hidden: config$r.hidden,
-  run: run$r
-};
-async function run$r(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$r,
+    config,
     importMeta,
     parentName
   });
@@ -8390,31 +8417,41 @@ async function handleDependencies({
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$q
 } = constants;
-const config$q = {
-  commandName: 'dependencies',
-  description: 'Search for any dependency that is being used in your organization',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    limit: {
-      type: 'number',
-      default: 50,
-      description: 'Maximum number of dependencies returned'
-    },
-    offset: {
-      type: 'number',
-      default: 0,
-      description: 'Page number'
+const CMD_NAME$k = 'dependencies';
+const description$q = 'Search for any dependency that is being used in your organization';
+const hidden$k = false;
+const cmdOrganizationDependencies = {
+  description: description$q,
+  hidden: hidden$k,
+  run: run$q
+};
+async function run$q(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$k,
+    description: description$q,
+    hidden: hidden$k,
+    flags: {
+      ...flags.commonFlags,
+      limit: {
+        type: 'number',
+        default: 50,
+        description: 'Maximum number of dependencies returned'
+      },
+      offset: {
+        type: 'number',
+        default: 0,
+        description: 'Page number'
+      },
+      ...flags.outputFlags
     },
-    ...flags.outputFlags
-  },
-  help: (command, config) => `
+    help: (command, config) => `
     Usage
       ${command} [options]
 
     API Token Requirements
-      - Quota: 1 unit
-      - Permissions: none (does need token with access to target org)
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$k}`)}
 
     Options
       ${utils.getFlagListOutput(config.flags)}
@@ -8423,18 +8460,10 @@ const config$q = {
       ${command}
       ${command} --limit 20 --offset 10
   `
-};
-const cmdOrganizationDependencies = {
-  description: config$q.description,
-  hidden: config$q.hidden,
-  run: run$q
-};
-async function run$q(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$q,
+    config,
     importMeta,
     parentName
   });
@@ -8525,33 +8554,43 @@ async function handleLicensePolicy(orgSlug, outputKind) {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$p
 } = constants;
-const config$p = {
-  commandName: 'license',
-  description: 'Retrieve the license policy of an organization',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    ...flags.outputFlags,
-    interactive: {
-      type: 'boolean',
-      default: true,
-      description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+const CMD_NAME$j = 'license';
+const description$p = 'Retrieve the license policy of an organization';
+const hidden$j = false;
+const cmdOrganizationPolicyLicense = {
+  description: description$p,
+  hidden: hidden$j,
+  run: run$p
+};
+async function run$p(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$j,
+    description: description$p,
+    hidden: hidden$j,
+    flags: {
+      ...flags.commonFlags,
+      ...flags.outputFlags,
+      interactive: {
+        type: 'boolean',
+        default: true,
+        description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+      },
+      org: {
+        type: 'string',
+        description: 'Force override the organization slug, overrides the default org from config'
+      }
     },
-    org: {
-      type: 'string',
-      description: 'Force override the organization slug, overrides the default org from config'
-    }
-  },
-  help: (command, _config) => `
+    help: command => `
     Usage
       $ ${command} [options]
 
     API Token Requirements
-      - Quota: 1 unit
-      - Permissions: license-policy:read
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$j}`)}
 
     Options
-      ${utils.getFlagListOutput(config$p.flags)}
+      ${utils.getFlagListOutput(config.flags)}
 
     Your API token will need the \`license-policy:read\` permission otherwise
     the request will fail with an authentication error.
@@ -8560,18 +8599,10 @@ const config$p = {
       $ ${command}
       $ ${command} --json
   `
-};
-const cmdOrganizationPolicyLicense = {
-  description: config$p.description,
-  hidden: config$p.hidden,
-  run: run$p
-};
-async function run$p(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$p,
+    config,
     importMeta,
     parentName
   });
@@ -8660,33 +8691,43 @@ async function handleSecurityPolicy(orgSlug, outputKind) {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$o
 } = constants;
-const config$o = {
-  commandName: 'security',
-  description: 'Retrieve the security policy of an organization',
-  hidden: true,
-  flags: {
-    ...flags.commonFlags,
-    ...flags.outputFlags,
-    interactive: {
-      type: 'boolean',
-      default: true,
-      description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+const CMD_NAME$i = 'security';
+const description$o = 'Retrieve the security policy of an organization';
+const hidden$i = true;
+const cmdOrganizationPolicySecurity = {
+  description: description$o,
+  hidden: hidden$i,
+  run: run$o
+};
+async function run$o(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$i,
+    description: description$o,
+    hidden: hidden$i,
+    flags: {
+      ...flags.commonFlags,
+      ...flags.outputFlags,
+      interactive: {
+        type: 'boolean',
+        default: true,
+        description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+      },
+      org: {
+        type: 'string',
+        description: 'Force override the organization slug, overrides the default org from config'
+      }
     },
-    org: {
-      type: 'string',
-      description: 'Force override the organization slug, overrides the default org from config'
-    }
-  },
-  help: (command, _config) => `
+    help: (command, _config) => `
     Usage
       $ ${command} [options]
 
     API Token Requirements
-      - Quota: 1 unit
-      - Permissions: security-policy:read
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$i}`)}
 
     Options
-      ${utils.getFlagListOutput(config$o.flags)}
+      ${utils.getFlagListOutput(config.flags)}
 
     Your API token will need the \`security-policy:read\` permission otherwise
     the request will fail with an authentication error.
@@ -8695,18 +8736,10 @@ const config$o = {
       $ ${command}
       $ ${command} --json
   `
-};
-const cmdOrganizationPolicySecurity = {
-  description: config$o.description,
-  hidden: config$o.hidden,
-  run: run$o
-};
-async function run$o(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$o,
+    config,
     importMeta,
     parentName
   });
@@ -8799,41 +8832,43 @@ async function handleOrganizationList(outputKind = 'text') {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$n
 } = constants;
-const config$n = {
-  commandName: 'list',
-  description: 'List organizations associated with the Socket API token',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    ...flags.outputFlags
-  },
-  help: (command, _config) => `
+const CMD_NAME$h = 'list';
+const description$n = 'List organizations associated with the Socket API token';
+const hidden$h = false;
+const cmdOrganizationList = {
+  description: description$n,
+  hidden: hidden$h,
+  run: run$n
+};
+async function run$n(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$h,
+    description: description$n,
+    hidden: hidden$h,
+    flags: {
+      ...flags.commonFlags,
+      ...flags.outputFlags
+    },
+    help: (command, _config) => `
     Usage
       $ ${command} [options]
 
     API Token Requirements
-      - Quota: 1 unit
-      - Permissions: none (does need a token)
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$h}`)}
 
     Options
-      ${utils.getFlagListOutput(config$n.flags)}
+      ${utils.getFlagListOutput(config.flags)}
 
     Examples
       $ ${command}
       $ ${command} --json
   `
-};
-const cmdOrganizationList = {
-  description: config$n.description,
-  hidden: config$n.hidden,
-  run: run$n
-};
-async function run$n(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$n,
+    config,
     importMeta,
     parentName
   });
@@ -8865,9 +8900,9 @@ async function run$n(argv, importMeta, {
   await handleOrganizationList(outputKind);
 }
 
-const description$5 = 'Organization policy details';
+const description$m = 'Organization policy details';
 const cmdOrganizationPolicy = {
-  description: description$5,
+  description: description$m,
   // Hidden because it was broken all this time (nobody could be using it)
   // and we're not sure if it's useful to anyone in its current state.
   // Until we do, we'll hide this to keep the help tidier.
@@ -8881,7 +8916,7 @@ const cmdOrganizationPolicy = {
       license: cmdOrganizationPolicyLicense
     }, {
       argv,
-      description: description$5,
+      description: description$m,
       defaultSub: 'list',
       // Backwards compat
       importMeta,
@@ -8938,7 +8973,7 @@ async function handleQuota(outputKind = 'text') {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$m
 } = constants;
-const config$m = {
+const config$5 = {
   commandName: 'quota',
   description: 'List organizations associated with the Socket API token',
   hidden: true,
@@ -8951,7 +8986,7 @@ const config$m = {
       $ ${command} [options]
 
     Options
-      ${utils.getFlagListOutput(config$m.flags)}
+      ${utils.getFlagListOutput(config$5.flags)}
 
     Examples
       $ ${command}
@@ -8959,8 +8994,8 @@ const config$m = {
   `
 };
 const cmdOrganizationQuota = {
-  description: config$m.description,
-  hidden: config$m.hidden,
+  description: config$5.description,
+  hidden: config$5.hidden,
   run: run$m
 };
 async function run$m(argv, importMeta, {
@@ -8968,7 +9003,7 @@ async function run$m(argv, importMeta, {
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$m,
+    config: config$5,
     importMeta,
     parentName
   });
@@ -8998,9 +9033,9 @@ async function run$m(argv, importMeta, {
   await handleQuota(outputKind);
 }
 
-const description$4 = 'Manage Socket organization account details';
+const description$l = 'Manage Socket organization account details';
 const cmdOrganization = {
-  description: description$4,
+  description: description$l,
   hidden: false,
   async run(argv, importMeta, {
     parentName
@@ -9029,7 +9064,7 @@ const cmdOrganization = {
         }
       },
       argv,
-      description: description$4,
+      description: description$l,
       importMeta,
       name: `${parentName} organization`
     });
@@ -9257,21 +9292,31 @@ function parsePackageSpecifiers(ecosystem, pkgs) {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$l
 } = constants;
-const config$l = {
-  commandName: 'score',
-  description: 'Look up score for one package which reflects all of its transitive dependencies as well',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    ...flags.outputFlags
-  },
-  help: (command, config) => `
+const CMD_NAME$g = 'score';
+const description$k = 'Look up score for one package which reflects all of its transitive dependencies as well';
+const hidden$g = false;
+const cmdPackageScore = {
+  description: description$k,
+  hidden: hidden$g,
+  run: run$l
+};
+async function run$l(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$g,
+    description: description$k,
+    hidden: hidden$g,
+    flags: {
+      ...flags.commonFlags,
+      ...flags.outputFlags
+    },
+    help: (command, config) => `
     Usage
       $ ${command} [options] <<ECOSYSTEM> <NAME> | <PURL>>
 
     API Token Requirements
-      - Quota: 100 units
-      - Permissions: packages:list
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$g}`)}
 
     Options
       ${utils.getFlagListOutput(config.flags)}
@@ -9301,18 +9346,10 @@ const config$l = {
       $ ${command} pkg:golang/github.com/steelpoor/tlsproxy@v0.0.0-20250304082521-29051ed19c60
       $ ${command} nuget/needpluscommonlibrary@1.0.0 --markdown
   `
-};
-const cmdPackageScore = {
-  description: config$l.description,
-  hidden: config$l.hidden,
-  run: run$l
-};
-async function run$l(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$l,
+    config,
     importMeta,
     parentName
   });
@@ -9417,7 +9454,7 @@ function outputPurlsShallowScore(purls, result, outputKind) {
   const txt = generateTextReport(rows, missing);
   logger.logger.log(txt);
 }
-function formatReportCard(artifact, color) {
+function formatReportCard(artifact, colorize) {
   const scoreResult = {
     'Supply Chain Risk': Math.floor((artifact.score?.supplyChain ?? 0) * 100),
     Maintenance: Math.floor((artifact.score?.maintenance ?? 0) * 100),
@@ -9425,16 +9462,32 @@ function formatReportCard(artifact, color) {
     Vulnerabilities: Math.floor((artifact.score?.vulnerability ?? 0) * 100),
     License: Math.floor((artifact.score?.license ?? 0) * 100)
   };
-  const alertString = getAlertString(artifact.alerts, !color);
+  const alertString = getAlertString(artifact.alerts, {
+    colorize
+  });
   if (!artifact.ecosystem) {
     require$$6.debugFn('notice', 'miss: artifact ecosystem', artifact);
   }
   const purl = `pkg:${artifact.ecosystem}/${artifact.name}${artifact.version ? '@' + artifact.version : ''}`;
-  return ['Package: ' + (color ? vendor.yoctocolorsCjsExports.bold(purl) : purl), '', ...Object.entries(scoreResult).map(score => `- ${score[0]}:`.padEnd(20, ' ') + `  ${formatScore(score[1], !color, true)}`), alertString].join('\n');
+
+  // Calculate proper padding based on longest label.
+  const maxLabelLength = Math.max(...Object.keys(scoreResult).map(label => label.length));
+  const labelPadding = maxLabelLength + 2; // +2 for ": "
+
+  return ['Package: ' + (colorize ? vendor.yoctocolorsCjsExports.bold(purl) : purl), '', ...Object.entries(scoreResult).map(score => `- ${score[0]}:`.padEnd(labelPadding, ' ') + `  ${formatScore(score[1], {
+    colorize
+  })}`), alertString].join('\n');
 }
-function formatScore(score, noColor = false, pad = false) {
-  const padded = String(score).padStart(pad ? 3 : 0, ' ');
-  if (noColor) {
+function formatScore(score, options) {
+  const {
+    colorize,
+    padding = 3
+  } = {
+    __proto__: null,
+    ...options
+  };
+  const padded = String(score).padStart(padding, ' ');
+  if (!colorize) {
     return padded;
   }
   if (score >= 80) {
@@ -9445,9 +9498,15 @@ function formatScore(score, noColor = false, pad = false) {
   }
   return vendor.yoctocolorsCjsExports.red(padded);
 }
-function getAlertString(alerts, noColor = false) {
+function getAlertString(alerts, options) {
+  const {
+    colorize
+  } = {
+    __proto__: null,
+    ...options
+  };
   if (!alerts.size) {
-    return noColor ? `- Alerts: none!` : `- Alerts: ${vendor.yoctocolorsCjsExports.green('none')}!`;
+    return `- Alerts: ${colorize ? vendor.yoctocolorsCjsExports.green('none') : 'none'}!`;
   }
   const o = Array.from(alerts.values());
   const bad = o.filter(alert => alert.severity !== 'low' && alert.severity !== 'middle').sort((a, b) => a.type < b.type ? -1 : a.type > b.type ? 1 : 0);
@@ -9457,10 +9516,11 @@ function getAlertString(alerts, noColor = false) {
   // We need to create the no-color string regardless because the actual string
   // contains a bunch of invisible ANSI chars which would screw up length checks.
   const colorless = `- Alerts (${bad.length}/${mid.length.toString()}/${low.length}):`;
-  if (noColor) {
-    return colorless + ' '.repeat(Math.max(0, 20 - colorless.length)) + '  ' + [bad.map(alert => `[${alert.severity}] ` + alert.type).join(', '), mid.map(alert => `[${alert.severity}] ` + alert.type).join(', '), low.map(alert => `[${alert.severity}] ` + alert.type).join(', ')].filter(Boolean).join(', ');
+  const padding = `  ${' '.repeat(Math.max(0, 20 - colorless.length))}`;
+  if (colorize) {
+    return `- Alerts (${vendor.yoctocolorsCjsExports.red(bad.length.toString())}/${vendor.yoctocolorsCjsExports.yellow(mid.length.toString())}/${low.length}):` + padding + [bad.map(a => vendor.yoctocolorsCjsExports.red(`${vendor.yoctocolorsCjsExports.dim(`[${a.severity}] `)}${a.type}`)).join(', '), mid.map(a => vendor.yoctocolorsCjsExports.yellow(`${vendor.yoctocolorsCjsExports.dim(`[${a.severity}] `)}${a.type}`)).join(', '), low.map(a => `${vendor.yoctocolorsCjsExports.dim(`[${a.severity}] `)}${a.type}`).join(', ')].filter(Boolean).join(', ');
   }
-  return `- Alerts (${vendor.yoctocolorsCjsExports.red(bad.length.toString())}/${vendor.yoctocolorsCjsExports.yellow(mid.length.toString())}/${low.length}):` + ' '.repeat(Math.max(0, 20 - colorless.length)) + '  ' + [bad.map(alert => vendor.yoctocolorsCjsExports.red(vendor.yoctocolorsCjsExports.dim(`[${alert.severity}] `) + alert.type)).join(', '), mid.map(alert => vendor.yoctocolorsCjsExports.yellow(vendor.yoctocolorsCjsExports.dim(`[${alert.severity}] `) + alert.type)).join(', '), low.map(alert => vendor.yoctocolorsCjsExports.dim(`[${alert.severity}] `) + alert.type).join(', ')].filter(Boolean).join(', ');
+  return colorless + padding + [bad.map(a => `[${a.severity}] ${a.type}`).join(', '), mid.map(a => `[${a.severity}] ${a.type}`).join(', '), low.map(a => `[${a.severity}] ${a.type}`).join(', ')].filter(Boolean).join(', ');
 }
 function preProcess(artifacts, requestedPurls) {
   // Dedupe results (for example, pypi will emit one package for each system release (win/mac/cpu) even if it's
@@ -9617,21 +9677,38 @@ async function handlePurlsShallowScore({
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$k
 } = constants;
-const config$k = {
-  commandName: 'shallow',
-  description: 'Look up info regarding one or more packages but not their transitives',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    ...flags.outputFlags
+const CMD_NAME$f = 'shallow';
+const description$j = 'Look up info regarding one or more packages but not their transitives';
+const hidden$f = false;
+const cmdPackageShallow = {
+  description: description$j,
+  hidden: hidden$f,
+  alias: {
+    shallowScore: {
+      description: description$j,
+      hidden: true,
+      argv: []
+    }
   },
-  help: (command, config) => `
+  run: run$k
+};
+async function run$k(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$f,
+    description: description$j,
+    hidden: hidden$f,
+    flags: {
+      ...flags.commonFlags,
+      ...flags.outputFlags
+    },
+    help: (command, config) => `
     Usage
       $ ${command} [options] <<ECOSYSTEM> <PKGNAME> [<PKGNAME> ...] | <PURL> [<PURL> ...]>
 
     API Token Requirements
-      - Quota: 100 units
-      - Permissions: packages:list
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$f}`)}
 
     Options
       ${utils.getFlagListOutput(config.flags)}
@@ -9660,25 +9737,10 @@ const config$k = {
       $ ${command} npm/webtorrent golang/babel
       $ ${command} npm npm/webtorrent@1.0.1 babel
   `
-};
-const cmdPackageShallow = {
-  description: config$k.description,
-  hidden: config$k.hidden,
-  alias: {
-    shallowScore: {
-      description: config$k.description,
-      hidden: true,
-      argv: []
-    }
-  },
-  run: run$k
-};
-async function run$k(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$k,
+    config,
     importMeta,
     parentName
   });
@@ -9720,9 +9782,9 @@ async function run$k(argv, importMeta, {
   });
 }
 
-const description$3 = 'Look up published package details';
+const description$i = 'Look up published package details';
 const cmdPackage = {
-  description: description$3,
+  description: description$i,
   hidden: false,
   async run(argv, importMeta, {
     parentName
@@ -9733,13 +9795,13 @@ const cmdPackage = {
     }, {
       aliases: {
         deep: {
-          description: description$3,
+          description: description$i,
           hidden: true,
           argv: ['score']
         }
       },
       argv,
-      description: description$3,
+      description: description$i,
       importMeta,
       name: `${parentName} package`
     });
@@ -9767,7 +9829,7 @@ async function runRawNpm(argv) {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$j
 } = constants;
-const config$j = {
+const config$4 = {
   commandName: 'raw-npm',
   description: 'Run npm without the Socket wrapper',
   hidden: false,
@@ -9778,20 +9840,20 @@ const config$j = {
     Usage
       $ ${command} ...
 
-    This does the opposite of \`socket npm\`: it will execute the real \`npm\`
-    command without Socket. This can be useful when you have the wrapper on
-    and want to install a certain package anyways. Use at your own risk.
+    Execute \`npm\` without gating installs through the Socket API.
+    Useful when  \`socket wrapper on\` is enabled and you want to bypass
+    the Socket wrapper. Use at your own risk.
 
-    Note: Everything after "raw-npm" is sent straight to the npm command.
-          Only the \`--dryRun\` and \`--help\` flags are caught here.
+    Note: Everything after "raw-npm" is passed to the npm command.
+          Only the \`--dry-run\` and \`--help\` flags are caught here.
 
     Examples
-      $ ${command} install -g socket
+      $ ${command} install -g cowsay
   `
 };
 const cmdRawNpm = {
-  description: config$j.description,
-  hidden: config$j.hidden,
+  description: config$4.description,
+  hidden: config$4.hidden,
   run: run$j
 };
 async function run$j(argv, importMeta, {
@@ -9799,7 +9861,7 @@ async function run$j(argv, importMeta, {
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$j,
+    config: config$4,
     importMeta,
     parentName
   });
@@ -9832,7 +9894,7 @@ async function runRawNpx(argv) {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$i
 } = constants;
-const config$i = {
+const config$3 = {
   commandName: 'raw-npx',
   description: 'Run npx without the Socket wrapper',
   hidden: false,
@@ -9843,20 +9905,20 @@ const config$i = {
     Usage
       $ ${command} ...
 
-    This does the opposite of \`socket npx\`: it will execute the real \`npx\`
-    command without Socket. This can be useful when you have the wrapper on
-    and want to run a certain package anyways. Use at your own risk.
+    Execute \`npx\` without gating installs through the Socket API.
+    Useful when  \`socket wrapper on\` is enabled and you want to bypass
+    the Socket wrapper. Use at your own risk.
 
-    Note: Everything after "raw-npx" is sent straight to the npx command.
-          Only the \`--dryRun\` and \`--help\` flags are caught here.
+    Note: Everything after "raw-npx" is passed to the npx command.
+          Only the \`--dry-run\` and \`--help\` flags are caught here.
 
     Examples
-      $ ${command} prettier
+      $ ${command} cowsay
   `
 };
 const cmdRawNpx = {
-  description: config$i.description,
-  hidden: config$i.hidden,
+  description: config$3.description,
+  hidden: config$3.hidden,
   run: run$i
 };
 async function run$i(argv, importMeta, {
@@ -9864,7 +9926,7 @@ async function run$i(argv, importMeta, {
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$i,
+    config: config$3,
     importMeta,
     parentName
   });
@@ -9947,50 +10009,60 @@ async function handleCreateRepo({
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$h
 } = constants;
-const config$h = {
-  commandName: 'create',
-  description: 'Create a repository in an organization',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    ...flags.outputFlags,
-    defaultBranch: {
-      type: 'string',
-      default: 'main',
-      description: 'Repository default branch. Defaults to "main"'
-    },
-    homepage: {
-      type: 'string',
-      default: '',
-      description: 'Repository url'
-    },
-    interactive: {
-      type: 'boolean',
-      default: true,
-      description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
-    },
-    org: {
-      type: 'string',
-      description: 'Force override the organization slug, overrides the default org from config'
-    },
-    repoDescription: {
-      type: 'string',
-      default: '',
-      description: 'Repository description'
+const CMD_NAME$e = 'create';
+const description$h = 'Create a repository in an organization';
+const hidden$e = false;
+const cmdRepositoryCreate = {
+  description: description$h,
+  hidden: hidden$e,
+  run: run$h
+};
+async function run$h(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$e,
+    description: description$h,
+    hidden: hidden$e,
+    flags: {
+      ...flags.commonFlags,
+      ...flags.outputFlags,
+      defaultBranch: {
+        type: 'string',
+        default: 'main',
+        description: 'Repository default branch. Defaults to "main"'
+      },
+      homepage: {
+        type: 'string',
+        default: '',
+        description: 'Repository url'
+      },
+      interactive: {
+        type: 'boolean',
+        default: true,
+        description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+      },
+      org: {
+        type: 'string',
+        description: 'Force override the organization slug, overrides the default org from config'
+      },
+      repoDescription: {
+        type: 'string',
+        default: '',
+        description: 'Repository description'
+      },
+      visibility: {
+        type: 'string',
+        default: 'private',
+        description: 'Repository visibility (Default Private)'
+      }
     },
-    visibility: {
-      type: 'string',
-      default: 'private',
-      description: 'Repository visibility (Default Private)'
-    }
-  },
-  help: (command, config) => `
+    help: (command, config) => `
     Usage
       $ ${command} [options] <REPO>
 
     API Token Requirements
-      - Quota: 1 unit
-      - Permissions: repo:create
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$e}`)}
 
     The REPO name should be a "slug". Follows the same naming convention as GitHub.
 
@@ -10001,18 +10073,10 @@ const config$h = {
       $ ${command} test-repo
       $ ${command} our-repo --homepage=socket.dev --default-branch=trunk
   `
-};
-const cmdRepositoryCreate = {
-  description: config$h.description,
-  hidden: config$h.hidden,
-  run: run$h
-};
-async function run$h(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$h,
+    config,
     importMeta,
     parentName
   });
@@ -10105,30 +10169,40 @@ async function handleDeleteRepo(orgSlug, repoName, outputKind) {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$g
 } = constants;
-const config$g = {
-  commandName: 'del',
-  description: 'Delete a repository in an organization',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    ...flags.outputFlags,
-    interactive: {
-      type: 'boolean',
-      default: true,
-      description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+const CMD_NAME$d = 'del';
+const description$g = 'Delete a repository in an organization';
+const hidden$d = false;
+const cmdRepositoryDel = {
+  description: description$g,
+  hidden: hidden$d,
+  run: run$g
+};
+async function run$g(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$d,
+    description: description$g,
+    hidden: hidden$d,
+    flags: {
+      ...flags.commonFlags,
+      ...flags.outputFlags,
+      interactive: {
+        type: 'boolean',
+        default: true,
+        description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+      },
+      org: {
+        type: 'string',
+        description: 'Force override the organization slug, overrides the default org from config'
+      }
     },
-    org: {
-      type: 'string',
-      description: 'Force override the organization slug, overrides the default org from config'
-    }
-  },
-  help: (command, config) => `
+    help: (command, config) => `
     Usage
       $ ${command} [options] <REPO>
 
     API Token Requirements
-      - Quota: 1 unit
-      - Permissions: repo:delete
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$d}`)}
 
     Options
       ${utils.getFlagListOutput(config.flags)}
@@ -10136,18 +10210,10 @@ const config$g = {
     Examples
       $ ${command} test-repo
   `
-};
-const cmdRepositoryDel = {
-  description: config$g.description,
-  hidden: config$g.hidden,
-  run: run$g
-};
-async function run$g(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$g,
+    config,
     importMeta,
     parentName
   });
@@ -10367,58 +10433,68 @@ async function handleListRepos({
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$f
 } = constants;
-const config$f = {
-  commandName: 'list',
-  description: 'List repositories in an organization',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    ...flags.outputFlags,
-    all: {
-      type: 'boolean',
-      default: false,
-      description: 'By default view shows the last n repos. This flag allows you to fetch the entire list. Will ignore --page and --perPage.'
-    },
-    direction: {
-      type: 'string',
-      default: 'desc',
-      description: 'Direction option'
-    },
-    interactive: {
-      type: 'boolean',
-      default: true,
-      description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
-    },
-    org: {
-      type: 'string',
-      description: 'Force override the organization slug, overrides the default org from config'
-    },
-    perPage: {
-      type: 'number',
-      shortFlag: 'pp',
-      default: 30,
-      description: 'Number of results per page'
-    },
-    page: {
-      type: 'number',
-      shortFlag: 'p',
-      default: 1,
-      description: 'Page number'
+const CMD_NAME$c = 'list';
+const description$f = 'List repositories in an organization';
+const hidden$c = false;
+const cmdRepositoryList = {
+  description: description$f,
+  hidden: hidden$c,
+  run: run$f
+};
+async function run$f(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$c,
+    description: description$f,
+    hidden: hidden$c,
+    flags: {
+      ...flags.commonFlags,
+      ...flags.outputFlags,
+      all: {
+        type: 'boolean',
+        default: false,
+        description: 'By default view shows the last n repos. This flag allows you to fetch the entire list. Will ignore --page and --per-page.'
+      },
+      direction: {
+        type: 'string',
+        default: 'desc',
+        description: 'Direction option'
+      },
+      interactive: {
+        type: 'boolean',
+        default: true,
+        description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+      },
+      org: {
+        type: 'string',
+        description: 'Force override the organization slug, overrides the default org from config'
+      },
+      perPage: {
+        type: 'number',
+        shortFlag: 'pp',
+        default: 30,
+        description: 'Number of results per page'
+      },
+      page: {
+        type: 'number',
+        shortFlag: 'p',
+        default: 1,
+        description: 'Page number'
+      },
+      sort: {
+        type: 'string',
+        shortFlag: 's',
+        default: 'created_at',
+        description: 'Sorting option'
+      }
     },
-    sort: {
-      type: 'string',
-      shortFlag: 's',
-      default: 'created_at',
-      description: 'Sorting option'
-    }
-  },
-  help: (command, config) => `
+    help: (command, config) => `
     Usage
       $ ${command} [options]
 
     API Token Requirements
-      - Quota: 1 unit
-      - Permissions: repo:list
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$c}`)}
 
     Options
       ${utils.getFlagListOutput(config.flags)}
@@ -10427,18 +10503,10 @@ const config$f = {
       $ ${command}
       $ ${command} --json
   `
-};
-const cmdRepositoryList = {
-  description: config$f.description,
-  hidden: config$f.hidden,
-  run: run$f
-};
-async function run$f(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$f,
+    config,
     importMeta,
     parentName
   });
@@ -10565,54 +10633,64 @@ async function handleUpdateRepo({
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$e
 } = constants;
-const config$e = {
-  commandName: 'update',
-  description: 'Update a repository in an organization',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    ...flags.outputFlags,
-    defaultBranch: {
-      type: 'string',
-      shortFlag: 'b',
-      default: 'main',
-      description: 'Repository default branch'
-    },
-    homepage: {
-      type: 'string',
-      shortFlag: 'h',
-      default: '',
-      description: 'Repository url'
-    },
-    interactive: {
-      type: 'boolean',
-      default: true,
-      description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
-    },
-    org: {
-      type: 'string',
-      description: 'Force override the organization slug, overrides the default org from config'
-    },
-    repoDescription: {
-      type: 'string',
-      shortFlag: 'd',
-      default: '',
-      description: 'Repository description'
+const CMD_NAME$b = 'update';
+const description$e = 'Update a repository in an organization';
+const hidden$b = false;
+const cmdRepositoryUpdate = {
+  description: description$e,
+  hidden: hidden$b,
+  run: run$e
+};
+async function run$e(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$b,
+    description: description$e,
+    hidden: hidden$b,
+    flags: {
+      ...flags.commonFlags,
+      ...flags.outputFlags,
+      defaultBranch: {
+        type: 'string',
+        shortFlag: 'b',
+        default: 'main',
+        description: 'Repository default branch'
+      },
+      homepage: {
+        type: 'string',
+        shortFlag: 'h',
+        default: '',
+        description: 'Repository url'
+      },
+      interactive: {
+        type: 'boolean',
+        default: true,
+        description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+      },
+      org: {
+        type: 'string',
+        description: 'Force override the organization slug, overrides the default org from config'
+      },
+      repoDescription: {
+        type: 'string',
+        shortFlag: 'd',
+        default: '',
+        description: 'Repository description'
+      },
+      visibility: {
+        type: 'string',
+        shortFlag: 'v',
+        default: 'private',
+        description: 'Repository visibility (Default Private)'
+      }
     },
-    visibility: {
-      type: 'string',
-      shortFlag: 'v',
-      default: 'private',
-      description: 'Repository visibility (Default Private)'
-    }
-  },
-  help: (command, config) => `
+    help: (command, config) => `
     Usage
       $ ${command} [options] <REPO>
 
     API Token Requirements
-      - Quota: 1 unit
-      - Permissions: repo:update
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$b}`)}
 
     Options
       ${utils.getFlagListOutput(config.flags)}
@@ -10621,18 +10699,10 @@ const config$e = {
       $ ${command} test-repo
       $ ${command} test-repo --homepage https://example.com
   `
-};
-const cmdRepositoryUpdate = {
-  description: config$e.description,
-  hidden: config$e.hidden,
-  run: run$e
-};
-async function run$e(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$e,
+    config,
     importMeta,
     parentName
   });
@@ -10750,30 +10820,40 @@ async function handleViewRepo(orgSlug, repoName, outputKind) {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$d
 } = constants;
-const config$d = {
-  commandName: 'view',
-  description: 'View repositories in an organization',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    ...flags.outputFlags,
-    interactive: {
-      type: 'boolean',
-      default: true,
-      description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+const CMD_NAME$a = 'view';
+const description$d = 'View repositories in an organization';
+const hidden$a = false;
+const cmdRepositoryView = {
+  description: description$d,
+  hidden: hidden$a,
+  run: run$d
+};
+async function run$d(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$a,
+    description: description$d,
+    hidden: hidden$a,
+    flags: {
+      ...flags.commonFlags,
+      ...flags.outputFlags,
+      interactive: {
+        type: 'boolean',
+        default: true,
+        description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+      },
+      org: {
+        type: 'string',
+        description: 'Force override the organization slug, overrides the default org from config'
+      }
     },
-    org: {
-      type: 'string',
-      description: 'Force override the organization slug, overrides the default org from config'
-    }
-  },
-  help: (command, config) => `
+    help: (command, config) => `
     Usage
       $ ${command} [options] <REPO>
 
     API Token Requirements
-      - Quota: 1 unit
-      - Permissions: repo:list
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$a}`)}
 
     Options
       ${utils.getFlagListOutput(config.flags)}
@@ -10782,18 +10862,10 @@ const config$d = {
       $ ${command} test-repo
       $ ${command} test-repo --json
   `
-};
-const cmdRepositoryView = {
-  description: config$d.description,
-  hidden: config$d.hidden,
-  run: run$d
-};
-async function run$d(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$d,
+    config,
     importMeta,
     parentName
   });
@@ -10844,9 +10916,9 @@ async function run$d(argv, importMeta, {
   await handleViewRepo(orgSlug, String(repoName), outputKind);
 }
 
-const description$2 = 'Manage registered repositories';
+const description$c = 'Manage registered repositories';
 const cmdRepository = {
-  description: description$2,
+  description: description$c,
   async run(argv, importMeta, {
     parentName
   }) {
@@ -10858,7 +10930,7 @@ const cmdRepository = {
       update: cmdRepositoryUpdate
     }, {
       argv,
-      description: description$2,
+      description: description$c,
       importMeta,
       name: `${parentName} repository`
     });
@@ -10912,10 +10984,11 @@ async function suggestTarget() {
 }
 
 const {
-  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$c,
-  SOCKET_DEFAULT_BRANCH: SOCKET_DEFAULT_BRANCH$1,
-  SOCKET_DEFAULT_REPOSITORY: SOCKET_DEFAULT_REPOSITORY$1
+  DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$c
 } = constants;
+const CMD_NAME$9 = 'create';
+const description$b = 'Create a new Socket scan and report';
+const hidden$9 = false;
 const generalFlags$1 = {
   ...flags.commonFlags,
   ...flags.outputFlags,
@@ -10963,7 +11036,7 @@ const generalFlags$1 = {
   pullRequest: {
     type: 'number',
     shortFlag: 'pr',
-    description: 'Commit hash'
+    description: 'Pull request number'
   },
   org: {
     type: 'string',
@@ -11001,22 +11074,29 @@ const generalFlags$1 = {
     description: 'Set the visibility (true/false) of the scan in your dashboard.'
   }
 };
-const config$c = {
-  commandName: 'create',
-  description: 'Create a new Socket scan and report',
-  hidden: false,
-  flags: {
-    ...generalFlags$1,
-    ...reachabilityFlags
-  },
-  // TODO: Your project's "socket.yml" file's "projectIgnorePaths".
-  help: command => `
+const cmdScanCreate = {
+  description: description$b,
+  hidden: hidden$9,
+  run: run$c
+};
+async function run$c(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$9,
+    description: description$b,
+    hidden: hidden$9,
+    flags: {
+      ...generalFlags$1,
+      ...reachabilityFlags
+    },
+    // TODO: Your project's "socket.yml" file's "projectIgnorePaths".
+    help: command => `
     Usage
       $ ${command} [options] [TARGET...]
 
     API Token Requirements
-      - Quota: 1 unit
-      - Permissions: full-scans:create
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$9}`)}
 
     Options
       ${utils.getFlagListOutput(generalFlags$1)}
@@ -11042,14 +11122,14 @@ const config$c = {
     The --repo and --branch flags tell Socket to associate this Scan with that
     repo/branch. The names will show up on your dashboard on the Socket website.
 
-    Note: for a first run you probably want to set --defaultBranch to indicate
+    Note: for a first run you probably want to set --default-branch to indicate
           the default branch name, like "main" or "master".
 
     The "alerts page" (https://socket.dev/dashboard/org/YOURORG/alerts) will show
     the results from the last scan designated as the "pending head" on the branch
     configured on Socket to be the "default branch". When creating a scan the
-    --setAsAlertsPage flag will default to true to update this. You can prevent
-    this by using --no-setAsAlertsPage. This flag is ignored for any branch that
+    --set-as-alerts-page flag will default to true to update this. You can prevent
+    this by using --no-set-as-alerts-page. This flag is ignored for any branch that
     is not designated as the "default branch". It is disabled when using --tmp.
 
     You can use \`socket scan setup\` to configure certain repo flag defaults.
@@ -11059,18 +11139,10 @@ const config$c = {
       $ ${command} ./proj --json
       $ ${command} --repo=test-repo --branch=main ./package.json
   `
-};
-const cmdScanCreate = {
-  description: config$c.description,
-  hidden: config$c.hidden,
-  run: run$c
-};
-async function run$c(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$c,
+    config,
     importMeta,
     parentName
   });
@@ -11123,7 +11195,7 @@ async function run$c(argv, importMeta, {
   if (typeof autoManifest !== 'boolean') {
     if (sockJson.defaults?.scan?.create?.autoManifest !== undefined) {
       autoManifest = sockJson.defaults.scan.create.autoManifest;
-      logger.logger.info('Using default --autoManifest from socket.json:', autoManifest);
+      logger.logger.info('Using default --auto-manifest from socket.json:', autoManifest);
     } else {
       autoManifest = false;
     }
@@ -11133,7 +11205,7 @@ async function run$c(argv, importMeta, {
       branchName = sockJson.defaults.scan.create.branch;
       logger.logger.info('Using default --branch from socket.json:', branchName);
     } else {
-      branchName = (await utils.gitBranch(cwd)) || SOCKET_DEFAULT_BRANCH$1;
+      branchName = (await utils.gitBranch(cwd)) || (await utils.detectDefaultBranch(cwd));
     }
   }
   if (!repoName) {
@@ -11141,7 +11213,7 @@ async function run$c(argv, importMeta, {
       repoName = sockJson.defaults.scan.create.repo;
       logger.logger.info('Using default --repo from socket.json:', repoName);
     } else {
-      repoName = (await utils.getRepoName(cwd)) || SOCKET_DEFAULT_REPOSITORY$1;
+      repoName = await utils.getRepoName(cwd);
     }
   }
   if (typeof report !== 'boolean') {
@@ -11196,7 +11268,7 @@ async function run$c(argv, importMeta, {
   }
   const detected = await detectManifestActions(sockJson, cwd);
   if (detected.count > 0 && !autoManifest) {
-    logger.logger.info(`Detected ${detected.count} manifest targets we could try to generate. Please set the --autoManifest flag if you want to include languages covered by \`socket manifest auto\` in the Scan.`);
+    logger.logger.info(`Detected ${detected.count} manifest targets we could try to generate. Please set the --auto-manifest flag if you want to include languages covered by \`socket manifest auto\` in the Scan.`);
   }
   if (updatedInput && orgSlug && targets.length) {
     logger.logger.info('Note: You can invoke this command next time to skip the interactive questions:');
@@ -11207,6 +11279,14 @@ async function run$c(argv, importMeta, {
     logger.logger.info('You can also run `socket scan setup` to persist these flag defaults to a socket.json file.');
     logger.logger.error('');
   }
+
+  // Validation helpers for better readability.
+  const hasReachEcosystems = reachEcosystems.length > 0;
+  const hasReachExcludePaths = reachExcludePaths.length > 0;
+  const isUsingNonDefaultMemoryLimit = reachAnalysisMemoryLimit !== reachabilityFlags['reachAnalysisMemoryLimit']?.default;
+  const isUsingNonDefaultTimeout = reachAnalysisTimeout !== reachabilityFlags['reachAnalysisTimeout']?.default;
+  const isUsingNonDefaultAnalytics = reachDisableAnalytics !== reachabilityFlags['reachDisableAnalytics']?.default;
+  const isUsingAnyReachabilityFlags = isUsingNonDefaultMemoryLimit || isUsingNonDefaultTimeout || isUsingNonDefaultAnalytics || hasReachEcosystems || hasReachExcludePaths;
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: !!orgSlug,
@@ -11226,41 +11306,21 @@ async function run$c(argv, importMeta, {
     test: hasApiToken,
     message: 'This command requires a Socket API token for access',
     fail: 'try `socket login`'
-  }, {
-    nook: true,
-    test: !pendingHead || !!branchName,
-    message: 'When --pendingHead is set, --branch is mandatory',
-    fail: 'missing branch name'
   }, {
     nook: true,
     test: !defaultBranch || !!branchName,
-    message: 'When --defaultBranch is set, --branch is mandatory',
+    message: 'When --default-branch is set, --branch is mandatory',
     fail: 'missing branch name'
   }, {
     nook: true,
-    test: reach || reachDisableAnalytics === reachabilityFlags['reachDisableAnalytics']?.default,
-    message: 'The --reachDisableAnalytics flag requires --reach to be set',
-    fail: 'missing --reach flag'
-  }, {
-    nook: true,
-    test: reach || reachAnalysisMemoryLimit === reachabilityFlags['reachAnalysisMemoryLimit']?.default,
-    message: 'The --reachAnalysisMemoryLimit flag requires --reach to be set',
-    fail: 'missing --reach flag'
-  }, {
-    nook: true,
-    test: reach || reachAnalysisTimeout === reachabilityFlags['reachAnalysisTimeout']?.default,
-    message: 'The --reachAnalysisTimeout flag requires --reach to be set',
-    fail: 'missing --reach flag'
-  }, {
-    nook: true,
-    test: reach || !reachEcosystems.length,
-    message: 'The --reachEcosystems flag requires --reach to be set',
-    fail: 'missing --reach flag'
+    test: !pendingHead || !!branchName,
+    message: 'When --pending-head is set, --branch is mandatory',
+    fail: 'missing branch name'
   }, {
     nook: true,
-    test: reach || !reachExcludePaths.length,
-    message: 'The --reachExcludePaths flag requires --reach to be set',
-    fail: 'missing --reach flag'
+    test: reach || !isUsingAnyReachabilityFlags,
+    message: 'Reachability analysis flags require --reach to be enabled',
+    fail: 'add --reach flag to use --reach-* options'
   });
   if (!wasValidInput) {
     return;
@@ -11338,30 +11398,40 @@ async function handleDeleteScan(orgSlug, scanId, outputKind) {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$b
 } = constants;
-const config$b = {
-  commandName: 'del',
-  description: 'Delete a scan',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    ...flags.outputFlags,
-    interactive: {
-      type: 'boolean',
-      default: true,
-      description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+const CMD_NAME$8 = 'del';
+const description$a = 'Delete a scan';
+const hidden$8 = false;
+const cmdScanDel = {
+  description: description$a,
+  hidden: hidden$8,
+  run: run$b
+};
+async function run$b(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$8,
+    description: description$a,
+    hidden: hidden$8,
+    flags: {
+      ...flags.commonFlags,
+      ...flags.outputFlags,
+      interactive: {
+        type: 'boolean',
+        default: true,
+        description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+      },
+      org: {
+        type: 'string',
+        description: 'Force override the organization slug, overrides the default org from config'
+      }
     },
-    org: {
-      type: 'string',
-      description: 'Force override the organization slug, overrides the default org from config'
-    }
-  },
-  help: (command, config) => `
+    help: (command, config) => `
     Usage
       $ ${command} [options] <SCAN_ID>
 
     API Token Requirements
-      - Quota: 1 unit
-      - Permissions: full-scans:delete
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$8}`)}
 
     Options
       ${utils.getFlagListOutput(config.flags)}
@@ -11370,18 +11440,10 @@ const config$b = {
       $ ${command} 000aaaa1-0000-0a0a-00a0-00a0000000a0
       $ ${command} 000aaaa1-0000-0a0a-00a0-00a0000000a0 --json
   `
-};
-const cmdScanDel = {
-  description: config$b.description,
-  hidden: config$b.hidden,
-  run: run$b
-};
-async function run$b(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$b,
+    config,
     importMeta,
     parentName
   });
@@ -11612,45 +11674,55 @@ const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$a,
   SOCKET_WEBSITE_URL: SOCKET_WEBSITE_URL$1
 } = constants;
+const CMD_NAME$7 = 'diff';
 const SOCKET_SBOM_URL_PREFIX = `${SOCKET_WEBSITE_URL$1}/dashboard/org/SocketDev/sbom/`;
 const {
   length: SOCKET_SBOM_URL_PREFIX_LENGTH
 } = SOCKET_SBOM_URL_PREFIX;
-const config$a = {
-  commandName: 'diff',
-  description: 'See what changed between two Scans',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    ...flags.outputFlags,
-    depth: {
-      type: 'number',
-      default: 2,
-      description: 'Max depth of JSON to display before truncating, use zero for no limit (without --json/--file)'
-    },
-    file: {
-      type: 'string',
-      shortFlag: 'f',
-      default: '',
-      description: 'Path to a local file where the output should be saved. Use `-` to force stdout.'
-    },
-    interactive: {
-      type: 'boolean',
-      default: true,
-      description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+const description$9 = 'See what changed between two Scans';
+const hidden$7 = false;
+const cmdScanDiff = {
+  description: description$9,
+  hidden: hidden$7,
+  run: run$a
+};
+async function run$a(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$7,
+    description: description$9,
+    hidden: hidden$7,
+    flags: {
+      ...flags.commonFlags,
+      ...flags.outputFlags,
+      depth: {
+        type: 'number',
+        default: 2,
+        description: 'Max depth of JSON to display before truncating, use zero for no limit (without --json/--file)'
+      },
+      file: {
+        type: 'string',
+        shortFlag: 'f',
+        default: '',
+        description: 'Path to a local file where the output should be saved. Use `-` to force stdout.'
+      },
+      interactive: {
+        type: 'boolean',
+        default: true,
+        description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+      },
+      org: {
+        type: 'string',
+        description: 'Force override the organization slug, overrides the default org from config'
+      }
     },
-    org: {
-      type: 'string',
-      description: 'Force override the organization slug, overrides the default org from config'
-    }
-  },
-  help: (command, config) => `
+    help: (command, config) => `
     Usage
       $ ${command} [options] <SCAN_ID1> <SCAN_ID2>
 
     API Token Requirements
-      - Quota: 1 unit
-      - Permissions: full-scans:list
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$7}`)}
 
     This command displays the package changes between two scans. The full output
     can be pretty large depending on the size of your repo and time range. It is
@@ -11667,18 +11739,10 @@ const config$a = {
       $ ${command} aaa0aa0a-aaaa-0000-0a0a-0000000a00a0 aaa1aa1a-aaaa-1111-1a1a-1111111a11a1
       $ ${command} aaa0aa0a-aaaa-0000-0a0a-0000000a00a0 aaa1aa1a-aaaa-1111-1a1a-1111111a11a1 --json
   `
-};
-const cmdScanDiff = {
-  description: config$a.description,
-  hidden: config$a.hidden,
-  run: run$a
-};
-async function run$a(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$a,
+    config,
     importMeta,
     parentName
   });
@@ -12399,51 +12463,60 @@ async function handleCreateGithubScan({
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$9
 } = constants;
-const config$9 = {
-  commandName: 'github',
-  description: 'Create a scan for given GitHub repo',
-  hidden: true,
-  // wip
-  flags: {
-    ...flags.commonFlags,
-    ...flags.outputFlags,
-    all: {
-      type: 'boolean',
-      description: 'Apply for all known repositories reported by the Socket API. Supersedes `repos`.'
-    },
-    githubToken: {
-      type: 'string',
-      description: 'Required GitHub token for authentication.\nMay set environment variable GITHUB_TOKEN or SOCKET_CLI_GITHUB_TOKEN instead.'
-    },
-    githubApiUrl: {
-      type: 'string',
-      description: 'Base URL of the GitHub API (default: https://api.github.com)'
-    },
-    interactive: {
-      type: 'boolean',
-      default: true,
-      description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
-    },
-    org: {
-      type: 'string',
-      description: 'Force override the organization slug, overrides the default org from config'
-    },
-    orgGithub: {
-      type: 'string',
-      description: 'Alternate GitHub Org if the name is different than the Socket Org'
+const CMD_NAME$6 = 'github';
+const description$8 = 'Create a scan for given GitHub repo';
+const hidden$6 = true;
+const cmdScanGithub = {
+  description: description$8,
+  hidden: hidden$6,
+  run: run$9
+};
+async function run$9(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$6,
+    description: description$8,
+    hidden: hidden$6,
+    flags: {
+      ...flags.commonFlags,
+      ...flags.outputFlags,
+      all: {
+        type: 'boolean',
+        description: 'Apply for all known repositories reported by the Socket API. Supersedes `repos`.'
+      },
+      githubToken: {
+        type: 'string',
+        description: 'Required GitHub token for authentication.\nMay set environment variable GITHUB_TOKEN or SOCKET_CLI_GITHUB_TOKEN instead.'
+      },
+      githubApiUrl: {
+        type: 'string',
+        description: 'Base URL of the GitHub API (default: https://api.github.com)'
+      },
+      interactive: {
+        type: 'boolean',
+        default: true,
+        description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+      },
+      org: {
+        type: 'string',
+        description: 'Force override the organization slug, overrides the default org from config'
+      },
+      orgGithub: {
+        type: 'string',
+        description: 'Alternate GitHub Org if the name is different than the Socket Org'
+      },
+      repos: {
+        type: 'string',
+        description: 'List of repos to target in a comma-separated format (e.g., repo1,repo2). If not specified, the script will pull the list from Socket and ask you to pick one. Use --all to use them all.'
+      }
     },
-    repos: {
-      type: 'string',
-      description: 'List of repos to target in a comma-separated format (e.g., repo1,repo2). If not specified, the script will pull the list from Socket and ask you to pick one. Use --all to use them all.'
-    }
-  },
-  help: (command, config) => `
+    help: (command, config) => `
     Usage
       $ ${command} [options] [CWD=.]
 
     API Token Requirements
-      - Quota: 1 unit
-      - Permissions: full-scans:create
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$6}`)}
 
     This is similar to the \`socket scan create\` command except it pulls the files
     from GitHub. See the help for that command for more details.
@@ -12464,18 +12537,10 @@ const config$9 = {
       $ ${command}
       $ ${command} ./proj
   `
-};
-const cmdScanGithub = {
-  description: config$9.description,
-  hidden: config$9.hidden,
-  run: run$9
-};
-async function run$9(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$9,
+    config,
     importMeta,
     parentName
   });
@@ -12710,70 +12775,80 @@ async function handleListScans({
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$8
 } = constants;
-const config$8 = {
-  commandName: 'list',
-  description: 'List the scans for an organization',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    ...flags.outputFlags,
-    branch: {
-      type: 'string',
-      description: 'Filter to show only scans with this branch name'
-    },
-    direction: {
-      type: 'string',
-      shortFlag: 'd',
-      default: 'desc',
-      description: 'Direction option (`desc` or `asc`) - Default is `desc`'
-    },
-    fromTime: {
-      type: 'string',
-      shortFlag: 'f',
-      default: '',
-      description: 'From time - as a unix timestamp'
-    },
-    interactive: {
-      type: 'boolean',
-      default: true,
-      description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
-    },
-    page: {
-      type: 'number',
-      shortFlag: 'p',
-      default: 1,
-      description: 'Page number - Default is 1'
-    },
-    perPage: {
-      type: 'number',
-      shortFlag: 'pp',
-      default: 30,
-      description: 'Results per page - Default is 30'
-    },
-    org: {
-      type: 'string',
-      description: 'Force override the organization slug, overrides the default org from config'
-    },
-    sort: {
-      type: 'string',
-      shortFlag: 's',
-      default: 'created_at',
-      description: 'Sorting option (`name` or `created_at`) - default is `created_at`'
+const CMD_NAME$5 = 'list';
+const description$7 = 'List the scans for an organization';
+const hidden$5 = false;
+const cmdScanList = {
+  description: description$7,
+  hidden: hidden$5,
+  run: run$8
+};
+async function run$8(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$5,
+    description: description$7,
+    hidden: hidden$5,
+    flags: {
+      ...flags.commonFlags,
+      ...flags.outputFlags,
+      branch: {
+        type: 'string',
+        description: 'Filter to show only scans with this branch name'
+      },
+      direction: {
+        type: 'string',
+        shortFlag: 'd',
+        default: 'desc',
+        description: 'Direction option (`desc` or `asc`) - Default is `desc`'
+      },
+      fromTime: {
+        type: 'string',
+        shortFlag: 'f',
+        default: '',
+        description: 'From time - as a unix timestamp'
+      },
+      interactive: {
+        type: 'boolean',
+        default: true,
+        description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+      },
+      page: {
+        type: 'number',
+        shortFlag: 'p',
+        default: 1,
+        description: 'Page number - Default is 1'
+      },
+      perPage: {
+        type: 'number',
+        shortFlag: 'pp',
+        default: 30,
+        description: 'Results per page - Default is 30'
+      },
+      org: {
+        type: 'string',
+        description: 'Force override the organization slug, overrides the default org from config'
+      },
+      sort: {
+        type: 'string',
+        shortFlag: 's',
+        default: 'created_at',
+        description: 'Sorting option (`name` or `created_at`) - default is `created_at`'
+      },
+      untilTime: {
+        type: 'string',
+        shortFlag: 'u',
+        default: '',
+        description: 'Until time - as a unix timestamp'
+      }
     },
-    untilTime: {
-      type: 'string',
-      shortFlag: 'u',
-      default: '',
-      description: 'Until time - as a unix timestamp'
-    }
-  },
-  help: (command, config) => `
+    help: (command, config) => `
     Usage
       $ ${command} [options] [REPO [BRANCH]]
 
     API Token Requirements
-      - Quota: 1 unit
-      - Permissions: full-scans:list
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$5}`)}
 
     Optionally filter by REPO. If you specify a repo, you can also specify a
     branch to filter by. (Note: If you don't specify a repo then you must use
@@ -12786,18 +12861,10 @@ const config$8 = {
       $ ${command}
       $ ${command} webtools badbranch --markdown
   `
-};
-const cmdScanList = {
-  description: config$8.description,
-  hidden: config$8.hidden,
-  run: run$8
-};
-async function run$8(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$8,
+    config,
     importMeta,
     parentName
   });
@@ -12915,30 +12982,40 @@ async function handleOrgScanMetadata(orgSlug, scanId, outputKind) {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$7
 } = constants;
-const config$7 = {
-  commandName: 'metadata',
-  description: "Get a scan's metadata",
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    ...flags.outputFlags,
-    interactive: {
-      type: 'boolean',
-      default: true,
-      description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+const CMD_NAME$4 = 'metadata';
+const description$6 = "Get a scan's metadata";
+const hidden$4 = false;
+const cmdScanMetadata = {
+  description: description$6,
+  hidden: hidden$4,
+  run: run$7
+};
+async function run$7(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$4,
+    description: description$6,
+    hidden: hidden$4,
+    flags: {
+      ...flags.commonFlags,
+      ...flags.outputFlags,
+      interactive: {
+        type: 'boolean',
+        default: true,
+        description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+      },
+      org: {
+        type: 'string',
+        description: 'Force override the organization slug, overrides the default org from config'
+      }
     },
-    org: {
-      type: 'string',
-      description: 'Force override the organization slug, overrides the default org from config'
-    }
-  },
-  help: (command, config) => `
+    help: (command, config) => `
     Usage
       $ ${command} [options] <SCAN_ID>
 
     API Token Requirements
-      - Quota: 1 unit
-      - Permissions: full-scans:list
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$4}`)}
 
     Options
       ${utils.getFlagListOutput(config.flags)}
@@ -12947,18 +13024,10 @@ const config$7 = {
       $ ${command} 000aaaa1-0000-0a0a-00a0-00a0000000a0
       $ ${command} 000aaaa1-0000-0a0a-00a0-00a0000000a0 --json
   `
-};
-const cmdScanMetadata = {
-  description: config$7.description,
-  hidden: config$7.hidden,
-  run: run$7
-};
-async function run$7(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$7,
+    config,
     importMeta,
     parentName
   });
@@ -13053,7 +13122,7 @@ async function handleScanReach({
   const packagePaths = await utils.getPackageFilesForScan(targets, supportedFiles, {
     cwd
   });
-  spinner.stop();
+  spinner.successAndStop(`Found ${packagePaths.length} ${words.pluralize('manifest file', packagePaths.length)} for reachability analysis.`);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: packagePaths.length > 0,
@@ -13083,6 +13152,9 @@ async function handleScanReach({
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$6
 } = constants;
+const CMD_NAME$3 = 'reach';
+const description$5 = 'Compute tier 1 reachability';
+const hidden$3 = true;
 const generalFlags = {
   ...flags.commonFlags,
   ...flags.outputFlags,
@@ -13095,21 +13167,28 @@ const generalFlags = {
     description: 'Force override the organization slug, overrides the default org from config'
   }
 };
-const config$6 = {
-  commandName: 'reach',
-  description: 'Compute tier 1 reachability',
-  hidden: true,
-  flags: {
-    ...generalFlags,
-    ...reachabilityFlags
-  },
-  help: command => `
+const cmdScanReach = {
+  description: description$5,
+  hidden: hidden$3,
+  run: run$6
+};
+async function run$6(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$3,
+    description: description$5,
+    hidden: hidden$3,
+    flags: {
+      ...generalFlags,
+      ...reachabilityFlags
+    },
+    help: command => `
     Usage
       $ ${command} [options] [CWD=.]
 
     API Token Requirements
-      - Quota: 1 unit
-      - Permissions: full-scans:create
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$3}`)}
 
     Options
       ${utils.getFlagListOutput(generalFlags)}
@@ -13129,18 +13208,10 @@ const config$6 = {
       $ ${command} ./proj
       $ ${command} ./proj --reach-ecosystems npm,pypi
   `
-};
-const cmdScanReach = {
-  description: config$6.description,
-  hidden: config$6.hidden,
-  run: run$6
-};
-async function run$6(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$6,
+    config,
     importMeta,
     parentName
   });
@@ -13207,9 +13278,9 @@ async function run$6(argv, importMeta, {
     targets,
     interactive,
     reachabilityOptions: {
-      reachDisableAnalytics: Boolean(reachDisableAnalytics),
       reachAnalysisTimeout: Number(reachAnalysisTimeout),
       reachAnalysisMemoryLimit: Number(reachAnalysisMemoryLimit),
+      reachDisableAnalytics: Boolean(reachDisableAnalytics),
       reachEcosystems,
       reachExcludePaths
     }
@@ -13219,50 +13290,60 @@ async function run$6(argv, importMeta, {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$5
 } = constants;
-const config$5 = {
-  commandName: 'report',
-  description: 'Check whether a scan result passes the organizational policies (security, license)',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    ...flags.outputFlags,
-    fold: {
-      type: 'string',
-      default: 'none',
-      description: 'Fold reported alerts to some degree'
-    },
-    interactive: {
-      type: 'boolean',
-      default: true,
-      description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
-    },
-    org: {
-      type: 'string',
-      description: 'Force override the organization slug, overrides the default org from config'
-    },
-    reportLevel: {
-      type: 'string',
-      default: 'warn',
-      description: 'Which policy level alerts should be reported'
-    },
-    short: {
-      type: 'boolean',
-      default: false,
-      description: 'Report only the healthy status'
+const CMD_NAME$2 = 'report';
+const description$4 = 'Check whether a scan result passes the organizational policies (security, license)';
+const hidden$2 = false;
+const cmdScanReport = {
+  description: description$4,
+  hidden: hidden$2,
+  run: run$5
+};
+async function run$5(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$2,
+    description: description$4,
+    hidden: hidden$2,
+    flags: {
+      ...flags.commonFlags,
+      ...flags.outputFlags,
+      fold: {
+        type: 'string',
+        default: 'none',
+        description: 'Fold reported alerts to some degree'
+      },
+      interactive: {
+        type: 'boolean',
+        default: true,
+        description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+      },
+      org: {
+        type: 'string',
+        description: 'Force override the organization slug, overrides the default org from config'
+      },
+      reportLevel: {
+        type: 'string',
+        default: 'warn',
+        description: 'Which policy level alerts should be reported'
+      },
+      short: {
+        type: 'boolean',
+        default: false,
+        description: 'Report only the healthy status'
+      },
+      license: {
+        type: 'boolean',
+        default: false,
+        description: 'Also report the license policy status. Default: false'
+      }
     },
-    license: {
-      type: 'boolean',
-      default: false,
-      description: 'Also report the license policy status. Default: false'
-    }
-  },
-  help: (command, config) => `
+    help: (command, config) => `
     Usage
       $ ${command} [options] <SCAN_ID> [OUTPUT_PATH]
 
     API Token Requirements
-      - Quota: 2 units
-      - Permissions: full-scans:list security-policy:read
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$2}`)}
 
     Options
       ${utils.getFlagListOutput(config.flags)}
@@ -13296,18 +13377,10 @@ const config$5 = {
       $ ${command} 000aaaa1-0000-0a0a-00a0-00a0000000a0 --json --fold=version
       $ ${command} 000aaaa1-0000-0a0a-00a0-00a0000000a0 --license --markdown --short
   `
-};
-const cmdScanReport = {
-  description: config$5.description,
-  hidden: config$5.hidden,
-  run: run$5
-};
-async function run$5(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$5,
+    config,
     importMeta,
     parentName
   });
@@ -13377,10 +13450,6 @@ async function outputScanConfigResult(result) {
   logger.logger.log('');
 }
 
-const {
-  SOCKET_DEFAULT_BRANCH,
-  SOCKET_DEFAULT_REPOSITORY
-} = constants;
 async function setupScanConfig(cwd, defaultOnReadError = false) {
   const jsonPath = path.join(cwd, `socket.json`);
   if (fs$1.existsSync(jsonPath)) {
@@ -13475,7 +13544,7 @@ async function setupScanConfig(cwd, defaultOnReadError = false) {
 async function configureScan(config, cwd = process.cwd()) {
   const defaultRepoName = await prompts.input({
     message: '(--repo) What repo name (slug) should be reported to Socket for this dir?',
-    default: config.repo || (await utils.getRepoName(cwd)) || SOCKET_DEFAULT_REPOSITORY,
+    default: config.repo || (await utils.getRepoName(cwd)),
     required: false
     // validate: async string => bool
   });
@@ -13483,15 +13552,15 @@ async function configureScan(config, cwd = process.cwd()) {
     return canceledByUser();
   }
   if (defaultRepoName) {
-    // Even if it's SOCKET_DEFAULT_REPOSITORY store it because if we change
-    // this default then an existing user probably would not expect the change?
+    // Store it even if it's constants.SOCKET_DEFAULT_REPOSITORY because if we
+    // change this default then an existing user probably would not expect the change.
     config.repo = defaultRepoName;
   } else {
     delete config.repo;
   }
   const defaultBranchName = await prompts.input({
     message: '(--branch) What branch name (slug) should be reported to Socket for this dir?',
-    default: config.branch || (await utils.gitBranch(cwd)) || SOCKET_DEFAULT_BRANCH,
+    default: config.branch || (await utils.gitBranch(cwd)) || (await utils.detectDefaultBranch(cwd)),
     required: false
     // validate: async string => bool
   });
@@ -13499,14 +13568,14 @@ async function configureScan(config, cwd = process.cwd()) {
     return canceledByUser();
   }
   if (defaultBranchName) {
-    // Even if it's SOCKET_DEFAULT_BRANCH store it because if we change
-    // this default then an existing user probably would not expect the change?
+    // Store it even if it's constants.SOCKET_DEFAULT_BRANCH because if we change
+    // this default then an existing user probably would not expect the change.
     config.branch = defaultBranchName;
   } else {
     delete config.branch;
   }
   const autoManifest = await prompts.select({
-    message: '(--autoManifest) Do you want to run `socket manifest auto` before creating a scan? You would need this for sbt, gradle, etc.',
+    message: '(--auto-manifest) Do you want to run `socket manifest auto` before creating a scan? You would need this for sbt, gradle, etc.',
     choices: [{
       name: 'no',
       value: 'no',
@@ -13608,7 +13677,7 @@ async function configureGithub(config) {
     }
   }
   const defaultGithubApiUrl = await prompts.input({
-    message: '(--githubApiUrl) Do you want to override the default github url?',
+    message: '(--github-api-url) Do you want to override the default github url?',
     default: config.githubApiUrl ||
     // Lazily access constants.ENV.GITHUB_API_URL.
     constants.ENV.GITHUB_API_URL,
@@ -13626,7 +13695,7 @@ async function configureGithub(config) {
     delete config.githubApiUrl;
   }
   const defaultOrgGithub = await prompts.input({
-    message: '(--orgGithub) Do you want to change the org slug that is used when talking to the GitHub API? Defaults to your Socket org slug.',
+    message: '(--org-github) Do you want to change the org slug that is used when talking to the GitHub API? Defaults to your Socket org slug.',
     default: config.orgGithub || '',
     required: false
     // validate: async string => bool
@@ -13669,7 +13738,7 @@ async function handleScanConfig(cwd, defaultOnReadError = false) {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$4
 } = constants;
-const config$4 = {
+const config$2 = {
   commandName: 'setup',
   description: 'Start interactive configurator to customize default flag values for `socket scan` in this dir',
   hidden: false,
@@ -13705,8 +13774,8 @@ const config$4 = {
   `
 };
 const cmdScanSetup = {
-  description: config$4.description,
-  hidden: config$4.hidden,
+  description: config$2.description,
+  hidden: config$2.hidden,
   run: run$4
 };
 async function run$4(argv, importMeta, {
@@ -13714,7 +13783,7 @@ async function run$4(argv, importMeta, {
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$4,
+    config: config$2,
     importMeta,
     parentName
   });
@@ -13871,35 +13940,45 @@ async function streamScan(orgSlug, scanId, options) {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$3
 } = constants;
-const config$3 = {
-  commandName: 'view',
-  description: 'View the raw results of a scan',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    ...flags.outputFlags,
-    stream: {
-      type: 'boolean',
-      default: false,
-      description: 'Only valid with --json. Streams the response as "ndjson" (chunks of valid json blobs).'
-    },
-    interactive: {
-      type: 'boolean',
-      default: true,
-      description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+const CMD_NAME$1 = 'view';
+const description$3 = 'View the raw results of a scan';
+const hidden$1 = false;
+const cmdScanView = {
+  description: description$3,
+  hidden: hidden$1,
+  run: run$3
+};
+async function run$3(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$1,
+    description: description$3,
+    hidden: hidden$1,
+    flags: {
+      ...flags.commonFlags,
+      ...flags.outputFlags,
+      stream: {
+        type: 'boolean',
+        default: false,
+        description: 'Only valid with --json. Streams the response as "ndjson" (chunks of valid json blobs).'
+      },
+      interactive: {
+        type: 'boolean',
+        default: true,
+        description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+      },
+      org: {
+        type: 'string',
+        description: 'Force override the organization slug, overrides the default org from config'
+      }
     },
-    org: {
-      type: 'string',
-      description: 'Force override the organization slug, overrides the default org from config'
-    }
-  },
-  help: (command, config) => `
+    help: (command, config) => `
     Usage
       $ ${command} [options] <SCAN_ID> [OUTPUT_FILE]
 
     API Token Requirements
-      - Quota: 1 unit
-      - Permissions: full-scans:list
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$1}`)}
 
     When no output path is given the contents is sent to stdout.
 
@@ -13910,18 +13989,10 @@ const config$3 = {
       $ ${command} 000aaaa1-0000-0a0a-00a0-00a0000000a0
       $ ${command} 000aaaa1-0000-0a0a-00a0-00a0000000a0 ./stream.txt
   `
-};
-const cmdScanView = {
-  description: config$3.description,
-  hidden: config$3.hidden,
-  run: run$3
-};
-async function run$3(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$3,
+    config,
     importMeta,
     parentName
   });
@@ -13978,9 +14049,9 @@ async function run$3(argv, importMeta, {
   }
 }
 
-const description$1 = 'Manage Socket scans';
+const description$2 = 'Manage Socket scans';
 const cmdScan = {
-  description: description$1,
+  description: description$2,
   async run(argv, importMeta, {
     parentName
   }) {
@@ -14009,7 +14080,7 @@ const cmdScan = {
         }
       },
       argv,
-      description: description$1,
+      description: description$2,
       importMeta,
       name: `${parentName} scan`
     });
@@ -14195,68 +14266,78 @@ async function handleThreatFeed({
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$2
 } = constants;
+const CMD_NAME = 'threat-feed';
 const ECOSYSTEMS = new Set(['gem', 'golang', 'maven', 'npm', 'nuget', 'pypi']);
 const TYPE_FILTERS = new Set(['anom', 'c', 'fp', 'joke', 'mal', 'secret', 'spy', 'tp', 'typo', 'u', 'vuln']);
-const config$2 = {
-  commandName: 'threat-feed',
-  description: '[Beta] View the threat feed',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    ...flags.outputFlags,
-    direction: {
-      type: 'string',
-      default: 'desc',
-      description: 'Order asc or desc by the createdAt attribute'
-    },
-    eco: {
-      type: 'string',
-      default: '',
-      description: 'Only show threats for a particular ecosystem'
-    },
-    filter: {
-      type: 'string',
-      default: 'mal',
-      description: 'Filter what type of threats to return'
-    },
-    interactive: {
-      type: 'boolean',
-      default: true,
-      description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
-    },
-    org: {
-      type: 'string',
-      description: 'Force override the organization slug, overrides the default org from config'
-    },
-    page: {
-      type: 'string',
-      default: '1',
-      description: 'Page token'
-    },
-    perPage: {
-      type: 'number',
-      shortFlag: 'pp',
-      default: 30,
-      description: 'Number of items per page'
-    },
-    pkg: {
-      type: 'string',
-      default: '',
-      description: 'Filter by this package name'
+const description$1 = '[Beta] View the threat-feed';
+const hidden = false;
+const cmdThreatFeed = {
+  description: description$1,
+  hidden,
+  run: run$2
+};
+async function run$2(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME,
+    description: description$1,
+    hidden,
+    flags: {
+      ...flags.commonFlags,
+      ...flags.outputFlags,
+      direction: {
+        type: 'string',
+        default: 'desc',
+        description: 'Order asc or desc by the createdAt attribute'
+      },
+      eco: {
+        type: 'string',
+        default: '',
+        description: 'Only show threats for a particular ecosystem'
+      },
+      filter: {
+        type: 'string',
+        default: 'mal',
+        description: 'Filter what type of threats to return'
+      },
+      interactive: {
+        type: 'boolean',
+        default: true,
+        description: 'Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no.'
+      },
+      org: {
+        type: 'string',
+        description: 'Force override the organization slug, overrides the default org from config'
+      },
+      page: {
+        type: 'string',
+        default: '1',
+        description: 'Page token'
+      },
+      perPage: {
+        type: 'number',
+        shortFlag: 'pp',
+        default: 30,
+        description: 'Number of items per page'
+      },
+      pkg: {
+        type: 'string',
+        default: '',
+        description: 'Filter by this package name'
+      },
+      version: {
+        type: 'string',
+        default: '',
+        description: 'Filter by this package version'
+      }
     },
-    version: {
-      type: 'string',
-      default: '',
-      description: 'Filter by this package version'
-    }
-  },
-  help: (command, config) => `
+    help: (command, config) => `
     Usage
       $ ${command} [options] [ECOSYSTEM] [TYPE_FILTER]
 
     API Token Requirements
-      - Quota: 1 unit
-      - Permissions: threat-feed:list
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME}`)}
       - Special access
 
     This feature requires a Threat Feed license. Please contact
@@ -14306,20 +14387,12 @@ const config$2 = {
       $ ${command}
       $ ${command} maven --json
       $ ${command} typo
-      $ ${command} npm joke 1.0.0 --perPage=5 --page=2 --direction=asc
+      $ ${command} npm joke 1.0.0 --per-page=5 --page=2 --direction=asc
   `
-};
-const cmdThreatFeed = {
-  description: config$2.description,
-  hidden: config$2.hidden,
-  run: run$2
-};
-async function run$2(argv, importMeta, {
-  parentName
-}) {
+  };
   const cli = utils.meowOrExit({
     argv,
-    config: config$2,
+    config,
     importMeta,
     parentName
   });
@@ -14816,7 +14889,7 @@ const rootCommands = {
   ci: cmdCI,
   cdxgen: cmdManifestCdxgen,
   config: cmdConfig,
-  deps: cmdOrganizationDependencies,
+  dependencies: cmdOrganizationDependencies,
   fix: cmdFix,
   install: cmdInstall,
   json: cmdJson,
@@ -14841,8 +14914,8 @@ const rootCommands = {
 };
 const rootAliases = {
   audit: {
-    description: cmdAuditLog.description,
-    hidden: true,
+    description: `${cmdAuditLog.description} (alias)`,
+    hidden: false,
     argv: ['audit-log']
   },
   auditLog: {
@@ -14860,14 +14933,19 @@ const rootAliases = {
     hidden: true,
     argv: ['audit-log']
   },
+  deps: {
+    description: `${cmdOrganizationDependencies.description} (alias)`,
+    hidden: false,
+    argv: ['dependencies']
+  },
   feed: {
-    description: cmdThreatFeed.description,
-    hidden: true,
+    description: `${cmdThreatFeed.description} (alias)`,
+    hidden: false,
     argv: ['threat-feed']
   },
   org: {
-    description: cmdOrganization.description,
-    hidden: true,
+    description: `${cmdOrganization.description} (alias)`,
+    hidden: false,
     argv: ['organization']
   },
   orgs: {
@@ -14891,13 +14969,13 @@ const rootAliases = {
     argv: ['organization']
   },
   pkg: {
-    description: cmdPackage.description,
-    hidden: true,
+    description: `${cmdPackage.description} (alias)`,
+    hidden: false,
     argv: ['package']
   },
   repo: {
-    description: cmdRepository.description,
-    hidden: true,
+    description: `${cmdRepository.description} (alias)`,
+    hidden: false,
     argv: ['repos']
   },
   repos: {
@@ -14994,5 +15072,5 @@ void (async () => {
     await utils.captureException(e);
   }
 })();
-//# debugId=304709a6-32b2-42d3-b457-92fb227a6703
+//# debugId=3642bd5d-1674-4ae6-aeda-814eaf5c0ffa
 //# sourceMappingURL=cli.js.map