@socketsecurity/cli-with-sentry 1.1.147 → 1.1.151

package/dist/cli.js

@@ -3,11 +3,11 @@
 
 var require$$0$1 = require('node:url');
 var vendor = require('./vendor.js');
-var require$$9 = require('../external/@socketsecurity/registry/lib/debug');
+var debug = require('../external/@socketsecurity/registry/lib/debug');
 var logger = require('../external/@socketsecurity/registry/lib/logger');
 var utils = require('./utils.js');
 var fs = require('node:fs/promises');
-var require$$5 = require('node:module');
+var require$$1 = require('node:module');
 var constants = require('./constants.js');
 var flags = require('./flags.js');
 var path = require('node:path');
@@ -23,13 +23,13 @@ var childProcess = require('node:child_process');
 var fs$2 = require('../external/@socketsecurity/registry/lib/fs');
 var strings = require('../external/@socketsecurity/registry/lib/strings');
 var path$1 = require('../external/@socketsecurity/registry/lib/path');
-var require$$11 = require('../external/@socketsecurity/registry/lib/objects');
+var objects = require('../external/@socketsecurity/registry/lib/objects');
 var registry = require('../external/@socketsecurity/registry');
 var packages = require('../external/@socketsecurity/registry/lib/packages');
-var require$$12 = require('../external/@socketsecurity/registry/lib/promises');
+var promises = require('../external/@socketsecurity/registry/lib/promises');
 var regexps = require('../external/@socketsecurity/registry/lib/regexps');
-var require$$1 = require('node:util');
-var promises = require('node:stream/promises');
+var require$$10 = require('node:util');
+var require$$9 = require('node:stream/promises');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 async function fetchOrgAnalyticsData(time, options) {
@@ -68,7 +68,7 @@ async function fetchRepoAnalyticsData(repo, time, options) {
 
 // Note: Widgets does not seem to actually work as code :'(
 
-const require$7 = require$$5.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.js', document.baseURI).href)));
+const require$7 = require$$1.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.js', document.baseURI).href)));
 const METRICS = ['total_critical_alerts', 'total_high_alerts', 'total_medium_alerts', 'total_low_alerts', 'total_critical_added', 'total_medium_added', 'total_low_added', 'total_high_added', 'total_critical_prevented', 'total_high_prevented', 'total_medium_prevented', 'total_low_prevented'];
 
 // Note: This maps `new Date(date).getMonth()` to English three letters
@@ -504,7 +504,7 @@ async function fetchAuditLog(config, options) {
   });
 }
 
-const require$6 = require$$5.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.js', document.baseURI).href)));
+const require$6 = require$$1.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.js', document.baseURI).href)));
 async function outputAuditLog(result, {
   logType,
   orgSlug,
@@ -619,8 +619,8 @@ ${table}
   } catch (e) {
     process.exitCode = 1;
     logger.logger.fail(`There was a problem converting the logs to Markdown, please try the \`${constants.FLAG_JSON}\` flag`);
-    require$$9.debugFn('error', 'Markdown conversion failed');
-    require$$9.debugDir('error', e);
+    debug.debugFn('error', 'Markdown conversion failed');
+    debug.debugDir('error', e);
     return 'Failed to generate the markdown report';
   }
 }
@@ -1100,7 +1100,8 @@ async function fetchCreateOrgFullScan(packagePaths, orgSlug, config, options) {
     }));
     logger.logger.info(`[DEBUG] ${new Date().toISOString()} Uploading full scan manifests: ${JSON.stringify(fileInfo)}`);
   }
-  return await utils.handleApiCall(sockSdk.createOrgFullScan(orgSlug, packagePaths, cwd, {
+  return await utils.handleApiCall(sockSdk.createFullScan(orgSlug, packagePaths, {
+    pathsRelativeTo: cwd,
     ...(branchName ? {
       branch: branchName
     } : {}),
@@ -1113,17 +1114,25 @@ async function fetchCreateOrgFullScan(packagePaths, orgSlug, config, options) {
     ...(committers ? {
       committers
     } : {}),
-    make_default_branch: String(defaultBranch),
+    ...(defaultBranch !== undefined ? {
+      make_default_branch: defaultBranch
+    } : {}),
     ...(pullRequest ? {
-      pull_request: String(pullRequest)
+      pull_request: pullRequest
+    } : {}),
+    ...(scanType ? {
+      scan_type: scanType
     } : {}),
-    scan_type: scanType,
     repo: repoName,
     ...(workspace ? {
       workspace
     } : {}),
-    set_as_pending_head: String(pendingHead),
-    tmp: String(tmp)
+    ...(pendingHead !== undefined ? {
+      set_as_pending_head: pendingHead
+    } : {}),
+    ...(tmp !== undefined ? {
+      tmp
+    } : {})
   }), {
     description: 'to create a scan'
   });
@@ -1131,6 +1140,7 @@ async function fetchCreateOrgFullScan(packagePaths, orgSlug, config, options) {
 
 async function fetchSupportedScanFileNames(options) {
   const {
+    orgSlug,
     sdkOpts,
     silence = false,
     spinner
@@ -1143,7 +1153,18 @@ async function fetchSupportedScanFileNames(options) {
     return sockSdkCResult;
   }
   const sockSdk = sockSdkCResult.data;
-  return await utils.handleApiCall(sockSdk.getSupportedScanFiles(), {
+
+  // getSupportedFiles is org-scoped in SDK v4. Use the provided org or
+  // discover the default one.
+  let resolvedOrgSlug = orgSlug;
+  if (!resolvedOrgSlug) {
+    const orgSlugCResult = await utils.getDefaultOrgSlug();
+    if (!orgSlugCResult.ok) {
+      return orgSlugCResult;
+    }
+    resolvedOrgSlug = orgSlugCResult.data;
+  }
+  return await utils.handleApiCall(sockSdk.getSupportedFiles(resolvedOrgSlug), {
     description: 'supported scan file types',
     spinner,
     silence
@@ -1226,8 +1247,8 @@ async function fetchScanData(orgSlug, scanId, options) {
         return JSON.parse(line);
       } catch (e) {
         ok = false;
-        require$$9.debugFn('error', 'Failed to parse report data line as JSON');
-        require$$9.debugDir('error', {
+        debug.debugFn('error', 'Failed to parse report data line as JSON');
+        debug.debugDir('error', {
           error: e,
           line
         });
@@ -1853,7 +1874,9 @@ async function performReachabilityAnalysis(options) {
     // legitimate INPUT to compute-artifacts, so we now upload them. Stale
     // facts files are cleaned up downstream — see the post-success
     // deletion in handle-create-new-scan.mts.
-    const uploadCResult = await utils.handleApiCall(sockSdk.uploadManifestFiles(orgSlug, packagePaths, path.resolve(cwd, analysisTarget)), {
+    const uploadCResult = await utils.handleApiCall(sockSdk.uploadManifestFiles(orgSlug, packagePaths, {
+      pathsRelativeTo: path.resolve(cwd, analysisTarget)
+    }), {
       description: 'upload manifests',
       spinner
     });
@@ -1893,7 +1916,7 @@ async function performReachabilityAnalysis(options) {
   // Build Coana arguments.
   const coanaArgs = ['run', analysisTarget, '--output-dir', path.dirname(outputFilePath), '--socket-mode', outputFilePath, '--disable-report-submission', ...(isOmittedReachValue(reachabilityOptions.reachAnalysisTimeout) ? [] : ['--analysis-timeout', reachabilityOptions.reachAnalysisTimeout]), ...(isOmittedReachValue(reachabilityOptions.reachAnalysisMemoryLimit) ? [] : ['--memory-limit', reachabilityOptions.reachAnalysisMemoryLimit]), ...(reachabilityOptions.reachConcurrency ? ['--concurrency', `${reachabilityOptions.reachConcurrency}`] : []), ...(reachabilityOptions.reachContinueOnAnalysisErrors ? ['--reach-continue-on-analysis-errors'] : []), ...(reachabilityOptions.reachContinueOnInstallErrors ? ['--reach-continue-on-install-errors'] : []), ...(reachabilityOptions.reachContinueOnMissingLockFiles ? ['--reach-continue-on-missing-lock-files'] : []), ...(reachabilityOptions.reachContinueOnNoSourceFiles ? ['--reach-continue-on-no-source-files'] : []), ...(reachabilityOptions.reachDebug ? ['--debug'] : []), ...(reachabilityOptions.reachDetailedAnalysisLogFile ? ['--print-analysis-log-file'] : []), ...(reachabilityOptions.reachDisableAnalytics ? ['--disable-analytics-sharing'] : []), ...(reachabilityOptions.reachDisableExternalToolChecks ? ['--disable-external-tool-checks'] : []), ...(reachabilityOptions.reachEnableAnalysisSplitting ? [] : ['--disable-analysis-splitting']), ...(tarHash ? ['--run-without-docker', '--manifests-tar-hash', tarHash] : []),
   // Empty reachEcosystems implies scanning all ecosystems.
-  ...(reachabilityOptions.reachEcosystems.length ? ['--purl-types', ...reachabilityOptions.reachEcosystems] : []), ...(reachabilityOptions.reachExcludePaths.length ? ['--exclude-dirs', ...reachabilityOptions.reachExcludePaths] : []), ...(reachabilityOptions.reachLazyMode ? ['--lazy-mode'] : []), ...(reachabilityOptions.reachSkipCache ? ['--skip-cache-usage'] : []), ...(reachabilityOptions.reachUseOnlyPregeneratedSboms ? ['--use-only-pregenerated-sboms'] : []), ...(sidecarPath ? ['--compute-artifacts-sidecar', sidecarPath] : [])];
+  ...(reachabilityOptions.reachEcosystems.length ? ['--purl-types', ...reachabilityOptions.reachEcosystems] : []), ...(reachabilityOptions.reachExcludePaths.length ? ['--exclude-dirs', ...reachabilityOptions.reachExcludePaths] : []), ...(reachabilityOptions.dynamicSbomInference ? ['--maven-use-only-root-socket-facts'] : []), ...(reachabilityOptions.reachLazyMode ? ['--lazy-mode'] : []), ...(reachabilityOptions.reachSkipCache ? ['--skip-cache-usage'] : []), ...(reachabilityOptions.reachUseOnlyPregeneratedSboms ? ['--use-only-pregenerated-sboms'] : []), ...(sidecarPath ? ['--compute-artifacts-sidecar', sidecarPath] : [])];
 
   // Build environment variables.
   const coanaEnv = {};
@@ -1979,44 +2002,44 @@ sockJson, cwd = process.cwd()) {
     sbt: false
   };
   if (sockJson?.defaults?.manifest?.bazel?.disabled) {
-    require$$9.debugLog('notice', `[DEBUG] - bazel auto-detection is disabled in ${constants.SOCKET_JSON}`);
+    debug.debugLog('notice', `[DEBUG] - bazel auto-detection is disabled in ${constants.SOCKET_JSON}`);
   } else if (fs$1.existsSync(path.join(cwd, 'MODULE.bazel')) || fs$1.existsSync(path.join(cwd, 'WORKSPACE')) || fs$1.existsSync(path.join(cwd, 'WORKSPACE.bazel'))) {
-    require$$9.debugLog('notice', '[DEBUG] - Detected a Bazel workspace');
+    debug.debugLog('notice', '[DEBUG] - Detected a Bazel workspace');
     output.bazel = true;
     output.count += 1;
   }
   if (sockJson?.defaults?.manifest?.sbt?.disabled) {
-    require$$9.debugLog('notice', `[DEBUG] - sbt auto-detection is disabled in ${constants.SOCKET_JSON}`);
+    debug.debugLog('notice', `[DEBUG] - sbt auto-detection is disabled in ${constants.SOCKET_JSON}`);
   } else if (fs$1.existsSync(path.join(cwd, 'build.sbt'))) {
-    require$$9.debugLog('notice', '[DEBUG] - Detected a Scala sbt build file');
+    debug.debugLog('notice', '[DEBUG] - Detected a Scala sbt build file');
     output.sbt = true;
     output.count += 1;
   }
   if (sockJson?.defaults?.manifest?.gradle?.disabled) {
-    require$$9.debugLog('notice', `[DEBUG] - gradle auto-detection is disabled in ${constants.SOCKET_JSON}`);
+    debug.debugLog('notice', `[DEBUG] - gradle auto-detection is disabled in ${constants.SOCKET_JSON}`);
   } else if (fs$1.existsSync(path.join(cwd, 'build.gradle')) || fs$1.existsSync(path.join(cwd, 'build.gradle.kts')) || fs$1.existsSync(path.join(cwd, 'settings.gradle')) || fs$1.existsSync(path.join(cwd, 'settings.gradle.kts'))) {
     // Detect by build descriptor, not the `gradlew` wrapper (a project can build via
     // `gradle` on PATH). `settings.gradle(.kts)` covers Kotlin-DSL roots with no root build script.
-    require$$9.debugLog('notice', '[DEBUG] - Detected a gradle build file');
+    debug.debugLog('notice', '[DEBUG] - Detected a gradle build file');
     output.gradle = true;
     output.count += 1;
   }
   if (sockJson?.defaults?.manifest?.maven?.disabled) {
-    require$$9.debugLog('notice', `[DEBUG] - maven auto-detection is disabled in ${constants.SOCKET_JSON}`);
+    debug.debugLog('notice', `[DEBUG] - maven auto-detection is disabled in ${constants.SOCKET_JSON}`);
   } else if (fs$1.existsSync(path.join(cwd, 'pom.xml'))) {
-    require$$9.debugLog('notice', '[DEBUG] - Detected a Maven pom.xml build file');
+    debug.debugLog('notice', '[DEBUG] - Detected a Maven pom.xml build file');
     output.maven = true;
     output.count += 1;
   }
   if (sockJson?.defaults?.manifest?.conda?.disabled) {
-    require$$9.debugLog('notice', `[DEBUG] - conda auto-detection is disabled in ${constants.SOCKET_JSON}`);
+    debug.debugLog('notice', `[DEBUG] - conda auto-detection is disabled in ${constants.SOCKET_JSON}`);
   } else {
     const envyml = path.join(cwd, constants.ENVIRONMENT_YML);
     const hasEnvyml = fs$1.existsSync(envyml);
     const envyaml = path.join(cwd, constants.ENVIRONMENT_YAML);
     const hasEnvyaml = !hasEnvyml && fs$1.existsSync(envyaml);
     if (hasEnvyml || hasEnvyaml) {
-      require$$9.debugLog('notice', '[DEBUG] - Detected an environment.yml Conda file');
+      debug.debugLog('notice', '[DEBUG] - Detected an environment.yml Conda file');
       output.conda = true;
       output.count += 1;
     }
@@ -4978,8 +5001,8 @@ function buildArtifactPaths(finalNodes, projects, fileExists) {
     }
     coords.add(coordKey);
     const pi = projectsByGav.get(gav(c.group, c.name, c.version ?? ''));
-    const sources = (pi?.sources ?? []).filter(fileExists);
-    const targets = [...new Set([...fn.targets, ...(pi?.targets ?? [])])].filter(fileExists).sort();
+    const sources = (pi?.sources ?? []).filter(fileExists).sort();
+    const targets = [...new Set(pi ? pi.targets : fn.targets)].filter(fileExists).sort();
     if (sources.length) {
       sourcesByCoord.set(coordKey, sources);
     }
@@ -5306,17 +5329,6 @@ async function runNeverThrow(bin, args, opts) {
     throw e;
   }
 }
-async function withTmpDir(prefix, fn) {
-  const tmpDir = await fs$1.promises.mkdtemp(path.join(os.tmpdir(), prefix));
-  try {
-    return await fn(tmpDir);
-  } finally {
-    await fs$1.promises.rm(tmpDir, {
-      recursive: true,
-      force: true
-    }).catch(() => {});
-  }
-}
 async function writeSbtPlugin(globalBase) {
   const src = await fs$1.promises.readFile(manifestScriptsPath('socket-facts.plugin.scala'), 'utf8');
   const pluginsDir = path.join(globalBase, 'plugins');
@@ -5386,7 +5398,7 @@ function commonProps(opts, prefix) {
 }
 async function runGradle(opts) {
   const initScript = manifestScriptsPath('socket-facts.init.gradle');
-  return await withTmpDir('socket-gradle-facts-', async tmp => {
+  return await utils.withTmpDir('socket-gradle-facts-', async tmp => {
     const recordsFile = path.join(tmp, 'records.tsv');
     const bin = resolveBuildToolBin('gradle', opts.projectDir, opts.bin);
     // Disable the configuration cache: the init script's legacy
@@ -5396,27 +5408,35 @@ async function runGradle(opts) {
     return await assembleFromRecords(out, recordsFile);
   });
 }
+async function runSbtIn(globalBase, opts) {
+  await writeSbtPlugin(globalBase);
+  const recordsFile = path.join(globalBase, 'records.tsv');
+  const bin = resolveBuildToolBin('sbt', opts.projectDir, opts.bin);
+  // Fresh per-run global base (not ~/.sbt): sbt executes everything under
+  // plugins/, so a shared path is a code-injection surface. BSP off for this
+  // run. sbt also provisions the project's Scala toolchain under
+  // <global.base>/boot; when opts.tmpDir was supplied, the caller keeps this
+  // directory (and that toolchain) alive until it's done with withFiles'
+  // artifactPaths, so no special-casing is needed here.
+  const props = [`-Dsbt.global.base=${globalBase}`, '-Dsbt.server.autostart=false', `-Dsocket.recordsFile=${recordsFile}`, ...commonProps(opts, '-D')];
+  // sbt's launcher doesn't always honor JAVA_HOME; never override a
+  // caller-supplied --java-home.
+  const javaHome = opts.env?.['JAVA_HOME'] ?? process.env['JAVA_HOME'];
+  const javaHomeOpt = javaHome && !(opts.toolOpts ?? []).includes('--java-home') ? ['--java-home', javaHome] : [];
+  const args = [...javaHomeOpt, ...props, ...(opts.toolOpts ?? []), '--batch', FACTS_TASK];
+  const out = await runNeverThrow(bin, args, opts);
+  return await assembleFromRecords(out, recordsFile);
+}
 async function runSbt(opts) {
-  return await withTmpDir('socket-sbt-facts-', async globalBase => {
-    await writeSbtPlugin(globalBase);
-    const recordsFile = path.join(globalBase, 'records.tsv');
-    const bin = resolveBuildToolBin('sbt', opts.projectDir, opts.bin);
-    // Fresh per-run global base (not ~/.sbt): sbt executes everything under
-    // plugins/, so a shared path is a code-injection surface. BSP off for this run.
-    const props = [`-Dsbt.global.base=${globalBase}`, '-Dsbt.server.autostart=false', `-Dsocket.recordsFile=${recordsFile}`, ...commonProps(opts, '-D')];
-    // sbt's launcher doesn't always honor JAVA_HOME; never override a
-    // caller-supplied --java-home.
-    const javaHome = opts.env?.['JAVA_HOME'] ?? process.env['JAVA_HOME'];
-    const javaHomeOpt = javaHome && !(opts.toolOpts ?? []).includes('--java-home') ? ['--java-home', javaHome] : [];
-    const args = [...javaHomeOpt, ...props, ...(opts.toolOpts ?? []), '--batch', FACTS_TASK];
-    const out = await runNeverThrow(bin, args, opts);
-    return await assembleFromRecords(out, recordsFile);
-  });
+  if (opts.tmpDir) {
+    return await runSbtIn(opts.tmpDir, opts);
+  }
+  return await utils.withTmpDir('socket-sbt-facts-', globalBase => runSbtIn(globalBase, opts));
 }
 async function runMaven(opts) {
   const jarPath = manifestScriptsPath('maven-extension', 'coana-maven-extension.jar');
   assertMavenExtensionBuilt(jarPath);
-  return await withTmpDir('socket-maven-facts-', async tmp => {
+  return await utils.withTmpDir('socket-maven-facts-', async tmp => {
     const recordsFile = path.join(tmp, 'records.tsv');
     const bin = resolveBuildToolBin('maven', opts.projectDir, opts.bin);
     // `validate` is the cheapest phase that triggers the afterSessionEnd
@@ -5516,6 +5536,7 @@ async function runManifestFacts({
   ignoreUnresolved,
   includeConfigs,
   sidecarAcc,
+  tmpDir,
   verbose,
   withFiles
 }) {
@@ -5530,6 +5551,7 @@ async function runManifestFacts({
     // Stream the build tool's output only when asked; otherwise capture it and
     // show a spinner, surfacing the output only if the build crashes.
     stdio: verbose ? 'inherit' : 'pipe',
+    tmpDir,
     toolOpts: buildOpts,
     withFiles
   };
@@ -5698,6 +5720,7 @@ async function convertSbtToFacts({
   includeConfigs,
   sbtOpts,
   sidecarAcc,
+  tmpDir,
   verbose,
   withFiles
 }) {
@@ -5711,6 +5734,7 @@ async function convertSbtToFacts({
     ignoreUnresolved,
     includeConfigs,
     sidecarAcc,
+    tmpDir,
     verbose,
     withFiles
   });
@@ -6236,6 +6260,7 @@ async function generateAutoManifest({
   detected,
   excludePaths,
   outputKind,
+  tmpDir,
   verbose
 }) {
   const sockJson = utils.readOrDefaultSocketJson(cwd);
@@ -6269,6 +6294,7 @@ async function generateAutoManifest({
         ignoreUnresolved: Boolean(sockJson.defaults?.manifest?.sbt?.ignoreUnresolved),
         includeConfigs: sockJson.defaults?.manifest?.sbt?.includeConfigs ?? '',
         sidecarAcc,
+        tmpDir,
         withFiles: computeArtifactsSidecar
       });
       abortManifestRunIfFailed('sbt', beforeExitCode);
@@ -6431,8 +6457,8 @@ async function handleCreateNewScan({
   workspace
 }) {
   let scanTargets = targets;
-  require$$9.debugFn('notice', `Creating new scan for ${orgSlug}/${workspace ? `${workspace}/` : ''}${repoName}`);
-  require$$9.debugDir('inspect', {
+  debug.debugFn('notice', `Creating new scan for ${orgSlug}/${workspace ? `${workspace}/` : ''}${repoName}`);
+  debug.debugDir('inspect', {
     autoManifest,
     branchName,
     commitHash,
@@ -6450,234 +6476,244 @@ async function handleCreateNewScan({
 
   // Sidecar forwarded to reachability; populated only when reach runs.
   let resolvedPathsSidecar;
-  if (autoManifest) {
-    logger.logger.info('Auto-generating manifest files ...');
-    require$$9.debugFn('notice', 'Auto-manifest mode enabled');
-    const sockJson = utils.readOrDefaultSocketJson(cwd);
-    const detected = await detectManifestActions(sockJson, cwd);
-    require$$9.debugDir('inspect', {
-      detected
-    });
-    const autoManifestResult = await generateAutoManifest({
-      computeArtifactsSidecar: reach.runReachabilityAnalysis,
-      cwd,
-      detected,
-      excludePaths: reach.excludePaths,
-      outputKind,
-      verbose: false
-    });
-    resolvedPathsSidecar = autoManifestResult.resolvedPathsSidecar;
-    if (autoManifestResult.generatedFiles.length) {
-      scanTargets = Array.from(new Set([...targets, ...autoManifestResult.generatedFiles]));
-    }
-    logger.logger.info('Auto-generation finished. Proceeding with Scan creation.');
-  }
-  const {
-    spinner
-  } = constants.default;
-  const supportedFilesCResult = await fetchSupportedScanFileNames({
-    spinner
-  });
-  if (!supportedFilesCResult.ok) {
-    require$$9.debugFn('warn', 'Failed to fetch supported scan file names');
-    require$$9.debugDir('inspect', {
-      supportedFilesCResult
-    });
-    await outputCreateNewScan(supportedFilesCResult, {
-      interactive,
-      outputKind
-    });
-    return;
-  }
-  require$$9.debugFn('notice', `Fetched ${supportedFilesCResult.data['size']} supported file types`);
-  spinner.start('Searching for local files to include in scan...');
-  const supportedFiles = supportedFilesCResult.data;
-
-  // Load socket.yml to respect projectIgnorePaths when collecting files.
-  const socketYmlResult = utils.findSocketYmlSync(cwd);
-  const socketConfig = socketYmlResult.ok ? socketYmlResult.data?.parsed : undefined;
-  const {
-    additionalScaIgnores,
-    mergedReachabilityOptions
-  } = applyFullExcludePaths({
-    cwd,
-    reachabilityOptions: reach,
-    target: targets[0]
-  });
-  const packagePaths = await utils.getPackageFilesForScan(scanTargets, supportedFiles, {
-    additionalIgnores: additionalScaIgnores,
-    config: socketConfig,
-    cwd
-  });
-  spinner.successAndStop(`Found ${packagePaths.length} ${words.pluralize('file', packagePaths.length)} to include in scan.`);
-  const wasValidInput = utils.checkCommandInput(outputKind, {
-    nook: true,
-    test: packagePaths.length > 0,
-    fail: `found no eligible files to scan. See supported manifest files at ${utils.socketDocsLink('/docs/manifest-file-detection-in-socket', 'docs.socket.dev')}`,
-    message: 'TARGET (file/dir) must contain matching / supported file types for a scan'
-  });
-  if (!wasValidInput) {
-    require$$9.debugFn('warn', 'No eligible files found to scan');
-    return;
-  }
-  logger.logger.success(`Found ${packagePaths.length} local ${words.pluralize('file', packagePaths.length)}`);
-  require$$9.debugDir('inspect', {
-    packagePaths
-  });
-  if (readOnly) {
-    logger.logger.log('[ReadOnly] Bailing now');
-    require$$9.debugFn('notice', 'Read-only mode, exiting early');
-    return;
-  }
-  let scanPaths = packagePaths;
-  let tier1ReachabilityScanId;
-  let reachabilityReport;
 
-  // If reachability is enabled, perform reachability analysis.
-  if (reach.runReachabilityAnalysis) {
-    logger.logger.error('');
-    logger.logger.info('Starting reachability analysis...');
-    require$$9.debugFn('notice', 'Reachability analysis enabled');
-    require$$9.debugDir('inspect', {
-      reachabilityOptions: mergedReachabilityOptions
-    });
-    spinner.start();
-    const reachResult = await performReachabilityAnalysis({
-      branchName,
-      cwd,
+  // sbt provisions its Scala toolchain under the directory passed as its
+  // isolated global base; withFiles' artifactPaths point into it, so it must
+  // stay on disk until the reachability analysis below has consumed those
+  // paths. Always allocated (even when unused) to keep this uniform rather
+  // than conditional on autoManifest/reach.
+  await utils.withTmpDir('socket-auto-manifest-', async manifestTmpDir => {
+    if (autoManifest) {
+      logger.logger.info('Auto-generating manifest files ...');
+      debug.debugFn('notice', 'Auto-manifest mode enabled');
+      const sockJson = utils.readOrDefaultSocketJson(cwd);
+      const detected = await detectManifestActions(sockJson, cwd);
+      debug.debugDir('inspect', {
+        detected
+      });
+      const autoManifestResult = await generateAutoManifest({
+        computeArtifactsSidecar: reach.runReachabilityAnalysis,
+        cwd,
+        detected,
+        excludePaths: reach.excludePaths,
+        outputKind,
+        tmpDir: manifestTmpDir,
+        verbose: false
+      });
+      resolvedPathsSidecar = autoManifestResult.resolvedPathsSidecar;
+      if (autoManifestResult.generatedFiles.length) {
+        scanTargets = Array.from(new Set([...targets, ...autoManifestResult.generatedFiles]));
+      }
+      logger.logger.info('Auto-generation finished. Proceeding with Scan creation.');
+    }
+    const {
+      spinner
+    } = constants.default;
+    const supportedFilesCResult = await fetchSupportedScanFileNames({
       orgSlug,
-      outputKind,
-      packagePaths,
-      reachabilityOptions: mergedReachabilityOptions,
-      repoName,
-      resolvedPathsSidecar,
-      spinner,
-      target: targets[0]
+      spinner
     });
-    spinner.stop();
-    if (!reachResult.ok) {
-      await outputCreateNewScan(reachResult, {
+    if (!supportedFilesCResult.ok) {
+      debug.debugFn('warn', 'Failed to fetch supported scan file names');
+      debug.debugDir('inspect', {
+        supportedFilesCResult
+      });
+      await outputCreateNewScan(supportedFilesCResult, {
         interactive,
         outputKind
       });
       return;
     }
-    logger.logger.success('Reachability analysis completed successfully');
-    reachabilityReport = reachResult.data?.reachabilityReport;
-
-    // When using only pre-generated SBOMs, build the scan from those inputs —
-    // CycloneDX, SPDX, and Socket facts (`.socket.facts.json`) — matching
-    // Coana's `--use-only-pregenerated-sboms` selection. Otherwise drop any
-    // stray `.socket.facts.json`; coana's fresh reachability report (appended
-    // below) is the authoritative facts file for the scan.
-    const pathsForScan = reach.reachUseOnlyPregeneratedSboms ? filterToPregeneratedSboms(packagePaths, supportedFiles) : packagePaths.filter(p => path.basename(p) !== constants.default.DOT_SOCKET_DOT_FACTS_JSON);
-
-    // Append coana's reachability report, but not twice: a pre-generated facts
-    // input can resolve to the same path coana wrote its report to.
-    const reportPath = reachabilityReport ? path.resolve(cwd, reachabilityReport) : undefined;
-    scanPaths = [...pathsForScan.filter(p => path.resolve(cwd, p) !== reportPath), ...(reachabilityReport ? [reachabilityReport] : [])];
-    tier1ReachabilityScanId = reachResult.data?.tier1ReachabilityScanId;
-  }
-
-  // Brotli-compress any .socket.facts.json paths in scanPaths just before
-  // upload. depscan's api-v0 multipart boundary streams brotli decode based
-  // on the .br filename suffix. Coana keeps writing plain .socket.facts.json
-  // on disk, so the local read paths (extractTier1ReachabilityScanId,
-  // extractReachabilityErrors) stay correct. The cleanup() in the finally
-  // block removes the temp dirs whether the upload succeeded or threw.
-  const compressed = await utils.compressSocketFactsForUpload(scanPaths);
-  let fullScanCResult;
-  try {
-    fullScanCResult = await fetchCreateOrgFullScan(compressed.paths, orgSlug, {
-      commitHash,
-      commitMessage,
-      committers,
-      pullRequest,
-      repoName,
-      branchName,
-      scanType: reach.runReachabilityAnalysis ? constants.default.SCAN_TYPE_SOCKET_TIER1 : constants.default.SCAN_TYPE_SOCKET,
-      workspace
-    }, {
+    debug.debugFn('notice', `Fetched ${supportedFilesCResult.data['size']} supported file types`);
+    spinner.start('Searching for local files to include in scan...');
+    const supportedFiles = supportedFilesCResult.data;
+
+    // Load socket.yml to respect projectIgnorePaths when collecting files.
+    const socketYmlResult = utils.findSocketYmlSync(cwd);
+    const socketConfig = socketYmlResult.ok ? socketYmlResult.data?.parsed : undefined;
+    const {
+      additionalScaIgnores,
+      mergedReachabilityOptions
+    } = applyFullExcludePaths({
       cwd,
-      defaultBranch,
-      pendingHead,
-      tmp
+      reachabilityOptions: reach,
+      target: targets[0]
     });
-  } finally {
-    await compressed.cleanup();
-  }
-  const scanId = fullScanCResult.ok ? fullScanCResult.data?.id : undefined;
-  if (reach && scanId && tier1ReachabilityScanId) {
-    await finalizeTier1Scan(tier1ReachabilityScanId, scanId);
-  } else if (reach.runReachabilityAnalysis && scanId && !tier1ReachabilityScanId) {
-    // Reachability analysis ran and a scan was created, but no full
-    // application reachability scan id was extracted from the facts file.
-    // Surface this instead of silently skipping finalize — otherwise the
-    // reachability row stays stuck (e.g. at COANA_DONE) and the full scan is
-    // never linked to its reachability report.
-    logger.logger.warn('Reachability analysis ran but no full application reachability scan ID was found; skipping reachability finalize. The scan was created but its reachability report was not linked.');
-  }
-
-  // On a successful scan, clean up the `.socket.facts.json` coana wrote at
-  // the path we instructed it to write to (via `--socket-mode`). Failed
-  // scans leave the file in place for debugging. Producer-written files
-  // (e.g. from `socket manifest gradle --facts`) are NOT touched here —
-  // those are user-owned input that the user can clean up themselves; in
-  // the --reach path coana overwrites that file with its enriched output
-  // anyway, so it's the same path that gets removed. `--reach-retain-facts-file`
-  // opts out of this cleanup so the report can be inspected; the user is then
-  // responsible for deleting it before the next full application reachability
-  // scan (a stale file is picked up as pre-generated input and would make those
-  // results unreliable).
-  if (fullScanCResult.ok && scanId && reachabilityReport && !reach.reachRetainFactsFile) {
-    try {
-      await fs.unlink(path.resolve(cwd, reachabilityReport));
-      require$$9.debugFn('notice', `[socket-facts] removed coana output after successful scan: ${reachabilityReport}`);
-    } catch {
-      // Best-effort — file may already be gone or unwritable.
+    const packagePaths = await utils.getPackageFilesForScan(scanTargets, supportedFiles, {
+      additionalIgnores: additionalScaIgnores,
+      config: socketConfig,
+      cwd
+    });
+    spinner.successAndStop(`Found ${packagePaths.length} ${words.pluralize('file', packagePaths.length)} to include in scan.`);
+    const wasValidInput = utils.checkCommandInput(outputKind, {
+      nook: true,
+      test: packagePaths.length > 0,
+      fail: `found no eligible files to scan. See supported manifest files at ${utils.socketDocsLink('/docs/manifest-file-detection-in-socket', 'docs.socket.dev')}`,
+      message: 'TARGET (file/dir) must contain matching / supported file types for a scan'
+    });
+    if (!wasValidInput) {
+      debug.debugFn('warn', 'No eligible files found to scan');
+      return;
     }
-  }
-  if (report && fullScanCResult.ok) {
-    if (scanId) {
-      await handleScanReport({
-        filepath: '-',
-        fold: constants.default.FOLD_SETTING_VERSION,
-        includeLicensePolicy: true,
+    logger.logger.success(`Found ${packagePaths.length} local ${words.pluralize('file', packagePaths.length)}`);
+    debug.debugDir('inspect', {
+      packagePaths
+    });
+    if (readOnly) {
+      logger.logger.log('[ReadOnly] Bailing now');
+      debug.debugFn('notice', 'Read-only mode, exiting early');
+      return;
+    }
+    let scanPaths = packagePaths;
+    let tier1ReachabilityScanId;
+    let reachabilityReport;
+
+    // If reachability is enabled, perform reachability analysis.
+    if (reach.runReachabilityAnalysis) {
+      logger.logger.error('');
+      logger.logger.info('Starting reachability analysis...');
+      debug.debugFn('notice', 'Reachability analysis enabled');
+      debug.debugDir('inspect', {
+        reachabilityOptions: mergedReachabilityOptions
+      });
+      spinner.start();
+      const reachResult = await performReachabilityAnalysis({
+        branchName,
+        cwd,
         orgSlug,
         outputKind,
-        reportLevel,
-        scanId,
-        short: false
+        packagePaths,
+        reachabilityOptions: mergedReachabilityOptions,
+        repoName,
+        resolvedPathsSidecar,
+        spinner,
+        target: targets[0]
       });
-    } else {
-      await outputCreateNewScan({
-        ok: false,
-        message: 'Missing Scan ID',
-        cause: 'Server did not respond with a scan ID',
-        data: fullScanCResult.data
+      spinner.stop();
+      if (!reachResult.ok) {
+        await outputCreateNewScan(reachResult, {
+          interactive,
+          outputKind
+        });
+        return;
+      }
+      logger.logger.success('Reachability analysis completed successfully');
+      reachabilityReport = reachResult.data?.reachabilityReport;
+
+      // When using only pre-generated SBOMs, build the scan from those inputs —
+      // CycloneDX, SPDX, and Socket facts (`.socket.facts.json`) — matching
+      // Coana's `--use-only-pregenerated-sboms` selection. Otherwise drop any
+      // stray `.socket.facts.json`; coana's fresh reachability report (appended
+      // below) is the authoritative facts file for the scan.
+      const pathsForScan = reach.reachUseOnlyPregeneratedSboms ? filterToPregeneratedSboms(packagePaths, supportedFiles) : packagePaths.filter(p => path.basename(p) !== constants.default.DOT_SOCKET_DOT_FACTS_JSON);
+
+      // Append coana's reachability report, but not twice: a pre-generated facts
+      // input can resolve to the same path coana wrote its report to.
+      const reportPath = reachabilityReport ? path.resolve(cwd, reachabilityReport) : undefined;
+      scanPaths = [...pathsForScan.filter(p => path.resolve(cwd, p) !== reportPath), ...(reachabilityReport ? [reachabilityReport] : [])];
+      tier1ReachabilityScanId = reachResult.data?.tier1ReachabilityScanId;
+    }
+
+    // Brotli-compress any .socket.facts.json paths in scanPaths just before
+    // upload. depscan's api-v0 multipart boundary streams brotli decode based
+    // on the .br filename suffix. Coana keeps writing plain .socket.facts.json
+    // on disk, so the local read paths (extractTier1ReachabilityScanId,
+    // extractReachabilityErrors) stay correct. The cleanup() in the finally
+    // block removes the temp dirs whether the upload succeeded or threw.
+    const compressed = await utils.compressSocketFactsForUpload(scanPaths);
+    let fullScanCResult;
+    try {
+      fullScanCResult = await fetchCreateOrgFullScan(compressed.paths, orgSlug, {
+        commitHash,
+        commitMessage,
+        committers,
+        pullRequest,
+        repoName,
+        branchName,
+        scanType: reach.runReachabilityAnalysis ? constants.default.SCAN_TYPE_SOCKET_TIER1 : constants.default.SCAN_TYPE_SOCKET,
+        workspace
       }, {
+        cwd,
+        defaultBranch,
+        pendingHead,
+        tmp
+      });
+    } finally {
+      await compressed.cleanup();
+    }
+    const scanId = fullScanCResult.ok ? fullScanCResult.data?.id : undefined;
+    if (reach && scanId && tier1ReachabilityScanId) {
+      await finalizeTier1Scan(tier1ReachabilityScanId, scanId);
+    } else if (reach.runReachabilityAnalysis && scanId && !tier1ReachabilityScanId) {
+      // Reachability analysis ran and a scan was created, but no full
+      // application reachability scan id was extracted from the facts file.
+      // Surface this instead of silently skipping finalize — otherwise the
+      // reachability row stays stuck (e.g. at COANA_DONE) and the full scan is
+      // never linked to its reachability report.
+      logger.logger.warn('Reachability analysis ran but no full application reachability scan ID was found; skipping reachability finalize. The scan was created but its reachability report was not linked.');
+    }
+
+    // On a successful scan, clean up the `.socket.facts.json` coana wrote at
+    // the path we instructed it to write to (via `--socket-mode`). Failed
+    // scans leave the file in place for debugging. Producer-written files
+    // (e.g. from `socket manifest gradle --facts`) are NOT touched here —
+    // those are user-owned input that the user can clean up themselves; in
+    // the --reach path coana overwrites that file with its enriched output
+    // anyway, so it's the same path that gets removed. `--reach-retain-facts-file`
+    // opts out of this cleanup so the report can be inspected; the user is then
+    // responsible for deleting it before the next full application reachability
+    // scan (a stale file is picked up as pre-generated input and would make those
+    // results unreliable).
+    if (fullScanCResult.ok && scanId && reachabilityReport && !reach.reachRetainFactsFile) {
+      try {
+        await fs.unlink(path.resolve(cwd, reachabilityReport));
+        debug.debugFn('notice', `[socket-facts] removed coana output after successful scan: ${reachabilityReport}`);
+      } catch {
+        // Best-effort — file may already be gone or unwritable.
+      }
+    }
+    if (report && fullScanCResult.ok) {
+      if (scanId) {
+        await handleScanReport({
+          filepath: '-',
+          fold: constants.default.FOLD_SETTING_VERSION,
+          includeLicensePolicy: true,
+          orgSlug,
+          outputKind,
+          reportLevel,
+          scanId,
+          short: false
+        });
+      } else {
+        await outputCreateNewScan({
+          ok: false,
+          message: 'Missing Scan ID',
+          cause: 'Server did not respond with a scan ID',
+          data: fullScanCResult.data
+        }, {
+          interactive,
+          outputKind
+        });
+      }
+    } else {
+      spinner.stop();
+      await outputCreateNewScan(fullScanCResult, {
         interactive,
         outputKind
       });
     }
-  } else {
-    spinner.stop();
-    await outputCreateNewScan(fullScanCResult, {
-      interactive,
-      outputKind
-    });
-  }
+  });
 }
 
 async function handleCi(autoManifest) {
-  require$$9.debugFn('notice', 'Starting CI scan');
-  require$$9.debugDir('inspect', {
+  debug.debugFn('notice', 'Starting CI scan');
+  debug.debugDir('inspect', {
     autoManifest
   });
   const orgSlugCResult = await utils.getDefaultOrgSlug();
   if (!orgSlugCResult.ok) {
-    require$$9.debugFn('warn', 'Failed to get default org slug');
-    require$$9.debugDir('inspect', {
+    debug.debugFn('warn', 'Failed to get default org slug');
+    debug.debugDir('inspect', {
       orgSlugCResult
     });
     process.exitCode = orgSlugCResult.code ?? 1;
@@ -6689,8 +6725,8 @@ async function handleCi(autoManifest) {
   const cwd = process.cwd();
   const branchName = (await utils.gitBranch(cwd)) || (await utils.detectDefaultBranch(cwd));
   const repoName = await utils.getRepoName(cwd);
-  require$$9.debugFn('notice', `CI scan for ${orgSlug}/${repoName} on branch ${branchName}`);
-  require$$9.debugDir('inspect', {
+  debug.debugFn('notice', `CI scan for ${orgSlug}/${repoName} on branch ${branchName}`);
+  debug.debugDir('inspect', {
     orgSlug,
     cwd,
     branchName,
@@ -6711,6 +6747,7 @@ async function handleCi(autoManifest) {
     pendingHead: true,
     pullRequest: 0,
     reach: {
+      dynamicSbomInference: false,
       excludePaths: [],
       reachAnalysisMemoryLimit: '',
       reachAnalysisTimeout: '',
@@ -7381,8 +7418,8 @@ async function handleConfigSet({
   outputKind,
   value
 }) {
-  require$$9.debugFn('notice', `Setting config ${key} = ${value}`);
-  require$$9.debugDir('inspect', {
+  debug.debugFn('notice', `Setting config ${key} = ${value}`);
+  debug.debugDir('inspect', {
     key,
     value,
     outputKind
@@ -7400,8 +7437,8 @@ async function handleConfigSet({
     message: `Config key '${key}' was not saved`,
     cause: result.data
   } : result;
-  require$$9.debugFn('notice', `Config update ${outcome.ok ? 'succeeded' : 'failed'}`);
-  require$$9.debugDir('inspect', {
+  debug.debugFn('notice', `Config update ${outcome.ok ? 'succeeded' : 'failed'}`);
+  debug.debugDir('inspect', {
     outcome,
     result
   });
@@ -7651,11 +7688,11 @@ const cmdConfig = {
  */
 async function cleanupStaleBranch(branch, ghsaId, cwd) {
   logger.logger.warn(`Stale branch ${branch} found without open PR, cleaning up...`);
-  require$$9.debugFn('notice', `cleanup: deleting stale branch ${branch}`);
+  debug.debugFn('notice', `cleanup: deleting stale branch ${branch}`);
   const deleted = await utils.gitDeleteRemoteBranch(branch, cwd);
   if (!deleted) {
     logger.logger.error(`Failed to delete stale remote branch ${branch}, skipping ${ghsaId}.`);
-    require$$9.debugFn('error', `cleanup: remote deletion failed for ${branch}`);
+    debug.debugFn('error', `cleanup: remote deletion failed for ${branch}`);
     return false;
   }
 
@@ -7760,7 +7797,7 @@ async function openSocketFixPr(owner, repo, branch, ghsaIds, options) {
       base: baseBranch,
       body: getSocketFixPullRequestBody(ghsaIds, ghsaDetails)
     };
-    require$$9.debugDir('inspect', {
+    debug.debugDir('inspect', {
       octokitPullsCreateParams
     });
     const pr = await octokit.pulls.create(octokitPullsCreateParams);
@@ -7776,7 +7813,7 @@ async function openSocketFixPr(owner, repo, branch, ghsaIds, options) {
 
       // Check for "PR already exists" error.
       if (errorMessages.some(msg => msg.toLowerCase().includes('pull request already exists'))) {
-        require$$9.debugFn('error', 'Failed to open pull request: already exists');
+        debug.debugFn('error', 'Failed to open pull request: already exists');
         return {
           ok: false,
           reason: 'already_exists',
@@ -7787,7 +7824,7 @@ async function openSocketFixPr(owner, repo, branch, ghsaIds, options) {
       // Check for validation errors (e.g., no commits between branches).
       if (errors && errors.length > 0) {
         const details = errorMessages.map(d => `- ${d}`).join('\n');
-        require$$9.debugFn('error', `Failed to open pull request:\n${details}`);
+        debug.debugFn('error', `Failed to open pull request:\n${details}`);
         return {
           ok: false,
           reason: 'validation_error',
@@ -7798,7 +7835,7 @@ async function openSocketFixPr(owner, repo, branch, ghsaIds, options) {
 
       // Check HTTP status codes.
       if (e.status === 403 || e.status === 401) {
-        require$$9.debugFn('error', 'Failed to open pull request: permission denied');
+        debug.debugFn('error', 'Failed to open pull request: permission denied');
         return {
           ok: false,
           reason: 'permission_denied',
@@ -7806,7 +7843,7 @@ async function openSocketFixPr(owner, repo, branch, ghsaIds, options) {
         };
       }
       if (e.status && e.status >= 500) {
-        require$$9.debugFn('error', 'Failed to open pull request: network error');
+        debug.debugFn('error', 'Failed to open pull request: network error');
         return {
           ok: false,
           reason: 'network_error',
@@ -7816,7 +7853,7 @@ async function openSocketFixPr(owner, repo, branch, ghsaIds, options) {
     }
 
     // Unknown error.
-    require$$9.debugFn('error', `Failed to open pull request: ${e}`);
+    debug.debugFn('error', `Failed to open pull request: ${e}`);
     return {
       ok: false,
       reason: 'unknown',
@@ -7918,7 +7955,7 @@ async function getSocketFixPrsWithContext(owner, repo, options) {
 
       // Safety limit to prevent infinite loops.
       if (pageIndex === constants.GQL_PAGE_SENTINEL) {
-        require$$9.debugFn('warn', `GraphQL pagination reached safety limit (${constants.GQL_PAGE_SENTINEL} pages) for ${owner}/${repo}`);
+        debug.debugFn('warn', `GraphQL pagination reached safety limit (${constants.GQL_PAGE_SENTINEL} pages) for ${owner}/${repo}`);
         break;
       }
 
@@ -7929,8 +7966,8 @@ async function getSocketFixPrsWithContext(owner, repo, options) {
       }
     }
   } catch (e) {
-    require$$9.debugFn('error', `GraphQL pagination failed for ${owner}/${repo}`);
-    require$$9.debugDir('error', e);
+    debug.debugFn('error', `GraphQL pagination failed for ${owner}/${repo}`);
+    debug.debugDir('error', e);
   }
   return contextualMatches;
 }
@@ -7940,7 +7977,7 @@ function ciRepoInfo() {
     GITHUB_REPOSITORY
   } = constants.default.ENV;
   if (!GITHUB_REPOSITORY) {
-    require$$9.debugFn('notice', 'miss: GITHUB_REPOSITORY env var');
+    debug.debugFn('notice', 'miss: GITHUB_REPOSITORY env var');
   }
   const ownerSlashRepo = GITHUB_REPOSITORY;
   const slashIndex = ownerSlashRepo.indexOf('/');
@@ -8016,8 +8053,8 @@ async function getFixEnv() {
   // If not in CI but some CI-related env vars are set.
   !constants.default.ENV.CI && envCheck.present.length &&
   // then log about it when in debug mode.
-  require$$9.isDebug('notice')) {
-    require$$9.debugFn('notice', `miss: fixEnv.isCi is false, expected ${arrays.joinAnd(envCheck.missing)} to be set`);
+  debug.isDebug('notice')) {
+    debug.debugFn('notice', `miss: fixEnv.isCi is false, expected ${arrays.joinAnd(envCheck.missing)} to be set`);
   }
   let repoInfo;
   if (isCi) {
@@ -8025,7 +8062,7 @@ async function getFixEnv() {
   }
   if (!repoInfo) {
     if (isCi) {
-      require$$9.debugFn('notice', 'falling back to `git remote get-url origin`');
+      debug.debugFn('notice', 'falling back to `git remote get-url origin`');
     }
     repoInfo = await utils.getRepoInfo();
   }
@@ -8044,6 +8081,57 @@ async function getFixEnv() {
   };
 }
 
+async function readStructuredDiscoveryResult(outputFile, silence) {
+  let raw;
+  try {
+    raw = await fs$1.promises.readFile(outputFile, 'utf8');
+  } catch {
+    return {
+      ok: false,
+      message: 'Coana did not write a vulnerability discovery result file',
+      cause: `Expected \`find-vulnerabilities --output-file\` to create ${outputFile}.`
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return {
+      ok: false,
+      message: 'Could not parse the vulnerability discovery result written by Coana',
+      cause: `Expected JSON in ${outputFile}, got:\n  ${raw.slice(0, 500)}`
+    };
+  }
+  if (parsed === null || typeof parsed !== 'object') {
+    return {
+      ok: false,
+      message: 'Coana wrote an unexpected vulnerability discovery result',
+      cause: `Expected a JSON object with a ghsaIds string array, got:\n  ${raw.slice(0, 500)}`
+    };
+  }
+  const {
+    artifactCount,
+    ghsaIds
+  } = parsed;
+  if (!Array.isArray(ghsaIds) || ghsaIds.some(id => typeof id !== 'string')) {
+    return {
+      ok: false,
+      message: 'Coana wrote an unexpected vulnerability discovery result',
+      cause: `Expected a JSON object with a ghsaIds string array, got:\n  ${raw.slice(0, 500)}`
+    };
+  }
+
+  // Zero artifacts means the backend resolved nothing — suspicious when
+  // manifests were uploaded, so warn even though discovery itself succeeded.
+  if (artifactCount === 0 && !silence) {
+    logger.logger.warn('The Socket backend resolved 0 artifacts, so vulnerability discovery may be incomplete.');
+  }
+  return {
+    ok: true,
+    data: ghsaIds
+  };
+}
+
 /**
  * Discovers GHSA IDs by running coana without applying fixes.
  * Returns a list of GHSA IDs, optionally limited.
@@ -8059,23 +8147,31 @@ async function discoverGhsaIds(orgSlug, tarHash, options) {
     __proto__: null,
     ...options
   };
-  const foundCResult = await utils.spawnCoanaDlx(['find-vulnerabilities', cwd, '--manifests-tar-hash', tarHash, ...(ecosystems?.length ? ['--purl-types', ...ecosystems] : []), ...(packageManagers?.length ? ['--package-managers', ...packageManagers] : [])], orgSlug, {
+
+  // Coana writes a structured JSON result ({ ghsaIds, artifactCount,
+  // filteredArtifactCount }) via --output-file (available since coana 15.9.7,
+  // older than the pinned @coana-tech/cli version).
+  const outputFile = path.join(os.tmpdir(), `socket-fix-discovery-${Date.now()}.json`);
+  const foundCResult = await utils.spawnCoanaDlx(['find-vulnerabilities', cwd, '--manifests-tar-hash', tarHash, '--output-file', outputFile, ...(ecosystems?.length ? ['--purl-types', ...ecosystems] : []), ...(packageManagers?.length ? ['--package-managers', ...packageManagers] : [])], orgSlug, {
     cwd,
     spinner: silence ? undefined : spinner,
     coanaVersion: options?.coanaVersion
   }, {
     stdio: 'pipe'
   });
-  if (foundCResult.ok) {
-    try {
-      // Coana prints ghsaIds as json-formatted string on the final line of the output.
-      const ghsaIdsRaw = foundCResult.data.trim().split('\n').pop();
-      if (ghsaIdsRaw) {
-        return JSON.parse(ghsaIdsRaw);
-      }
-    } catch {}
+  if (!foundCResult.ok) {
+    await fs$1.promises.rm(outputFile, {
+      force: true
+    }).catch(() => {});
+    return foundCResult;
+  }
+  try {
+    return await readStructuredDiscoveryResult(outputFile, silence);
+  } finally {
+    await fs$1.promises.rm(outputFile, {
+      force: true
+    }).catch(() => {});
   }
-  return [];
 }
 async function coanaFix(fixConfig) {
   const {
@@ -8084,7 +8180,7 @@ async function coanaFix(fixConfig) {
     autopilot,
     coanaVersion,
     cwd,
-    debug,
+    debug: debug$1,
     disableExternalToolChecks,
     disableMajorUpdates,
     ecosystems,
@@ -8102,7 +8198,7 @@ async function coanaFix(fixConfig) {
     spinner
   } = fixConfig;
   const fixEnv = await getFixEnv();
-  require$$9.debugDir('inspect', {
+  debug.debugDir('inspect', {
     fixEnv
   });
   if (!silence) {
@@ -8114,6 +8210,7 @@ async function coanaFix(fixConfig) {
   }
   const sockSdk = sockSdkCResult.data;
   const supportedFilesCResult = await fetchSupportedScanFileNames({
+    orgSlug,
     spinner: silence ? undefined : spinner,
     silence
   });
@@ -8155,7 +8252,9 @@ async function coanaFix(fixConfig) {
       cause: `Delete the following ${words.pluralize('file', factsFiles.length)} before running socket fix again:\n` + factsFiles.map(p => `  - ${p}`).join('\n')
     };
   }
-  const uploadCResult = await utils.handleApiCall(sockSdk.uploadManifestFiles(orgSlug, scanFilepaths, cwd), {
+  const uploadCResult = await utils.handleApiCall(sockSdk.uploadManifestFiles(orgSlug, scanFilepaths, {
+    pathsRelativeTo: cwd
+  }), {
     description: 'upload manifests',
     spinner,
     silence
@@ -8197,14 +8296,26 @@ async function coanaFix(fixConfig) {
     }
 
     // In local mode, process all discovered/provided IDs (no limit).
-    const ids = shouldDiscoverGhsaIds ? await discoverGhsaIds(orgSlug, tarHash, {
-      coanaVersion,
-      cwd,
-      ecosystems,
-      packageManagers,
-      silence,
-      spinner
-    }) : ghsas;
+    let ids;
+    if (shouldDiscoverGhsaIds) {
+      const discoverCResult = await discoverGhsaIds(orgSlug, tarHash, {
+        coanaVersion,
+        cwd,
+        ecosystems,
+        packageManagers,
+        silence,
+        spinner
+      });
+      if (!discoverCResult.ok) {
+        if (!silence) {
+          spinner?.stop();
+        }
+        return discoverCResult;
+      }
+      ids = discoverCResult.data;
+    } else {
+      ids = ghsas;
+    }
     if (ids.length === 0) {
       if (!silence) {
         spinner?.stop();
@@ -8222,7 +8333,7 @@ async function coanaFix(fixConfig) {
     const tmpDir = os.tmpdir();
     const tmpFile = path.join(tmpDir, `socket-fix-${Date.now()}.json`);
     try {
-      const fixCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ...ids, ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(minimumReleaseAge ? ['--minimum-release-age', minimumReleaseAge] : []), ...(include.length ? ['--include', ...include] : []), ...(coanaExcludePatterns.length ? ['--exclude', ...coanaExcludePatterns] : []), ...(ecosystems.length ? ['--purl-types', ...ecosystems] : []), ...(packageManagers.length ? ['--package-managers', ...packageManagers] : []), ...(!applyFixes ? [constants.FLAG_DRY_RUN] : []), '--output-file', tmpFile, ...(debug ? ['--debug'] : []), ...(disableExternalToolChecks ? ['--disable-external-tool-checks'] : []), ...(disableMajorUpdates ? ['--disable-major-updates'] : []), ...(showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), ...fixConfig.unknownFlags], fixConfig.orgSlug, {
+      const fixCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ...ids, ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(minimumReleaseAge ? ['--minimum-release-age', minimumReleaseAge] : []), ...(include.length ? ['--include', ...include] : []), ...(coanaExcludePatterns.length ? ['--exclude', ...coanaExcludePatterns] : []), ...(ecosystems.length ? ['--purl-types', ...ecosystems] : []), ...(packageManagers.length ? ['--package-managers', ...packageManagers] : []), ...(!applyFixes ? [constants.FLAG_DRY_RUN] : []), '--output-file', tmpFile, ...(debug$1 ? ['--debug'] : []), ...(disableExternalToolChecks ? ['--disable-external-tool-checks'] : []), ...(disableMajorUpdates ? ['--disable-major-updates'] : []), ...(showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), ...fixConfig.unknownFlags], fixConfig.orgSlug, {
         coanaVersion,
         cwd,
         spinner: silence ? undefined : spinner,
@@ -8276,30 +8387,41 @@ async function coanaFix(fixConfig) {
       // Reduce limit by number of open PRs to avoid creating too many.
       adjustedPrLimit = Math.max(0, prLimit - openPrCount);
       if (openPrCount > 0) {
-        require$$9.debugFn('notice', `prLimit: adjusted from ${prLimit} to ${adjustedPrLimit} (${openPrCount} open Socket Fix ${words.pluralize('PR', openPrCount)}`);
+        debug.debugFn('notice', `prLimit: adjusted from ${prLimit} to ${adjustedPrLimit} (${openPrCount} open Socket Fix ${words.pluralize('PR', openPrCount)}`);
       }
     } catch (e) {
-      require$$9.debugFn('warn', 'Failed to count open PRs, using original limit');
-      require$$9.debugDir('error', e);
+      debug.debugFn('warn', 'Failed to count open PRs, using original limit');
+      debug.debugDir('error', e);
     }
   }
   const shouldSpawnCoana = adjustedPrLimit > 0;
   let ids;
   if (shouldSpawnCoana) {
-    ids = (shouldDiscoverGhsaIds ? await discoverGhsaIds(orgSlug, tarHash, {
-      coanaVersion,
-      cwd,
-      ecosystems,
-      packageManagers,
-      silence,
-      spinner
-    }) : ghsas).slice(0, adjustedPrLimit);
+    if (shouldDiscoverGhsaIds) {
+      const discoverCResult = await discoverGhsaIds(orgSlug, tarHash, {
+        coanaVersion,
+        cwd,
+        ecosystems,
+        packageManagers,
+        silence,
+        spinner
+      });
+      if (!discoverCResult.ok) {
+        if (!silence) {
+          spinner?.stop();
+        }
+        return discoverCResult;
+      }
+      ids = discoverCResult.data.slice(0, adjustedPrLimit);
+    } else {
+      ids = ghsas.slice(0, adjustedPrLimit);
+    }
   }
   if (!ids?.length) {
-    require$$9.debugFn('notice', 'miss: no GHSA IDs to process');
+    debug.debugFn('notice', 'miss: no GHSA IDs to process');
   }
   if (!fixEnv.repoInfo) {
-    require$$9.debugFn('notice', 'miss: no repo info detected');
+    debug.debugFn('notice', 'miss: no repo info detected');
   }
   if (!ids?.length || !fixEnv.repoInfo) {
     if (!silence) {
@@ -8313,10 +8435,10 @@ async function coanaFix(fixConfig) {
       }
     };
   }
-  require$$9.debugFn('notice', `fetch: ${ids.length} GHSA details for ${arrays.joinAnd(ids)}`);
+  debug.debugFn('notice', `fetch: ${ids.length} GHSA details for ${arrays.joinAnd(ids)}`);
   const ghsaDetails = await utils.fetchGhsaDetails(ids);
   const scanBaseNames = new Set(scanFilepaths.map(p => path.basename(p)));
-  require$$9.debugFn('notice', `found: ${ghsaDetails.size} GHSA details`);
+  debug.debugFn('notice', `found: ${ghsaDetails.size} GHSA details`);
   let count = 0;
   let overallFixed = false;
   const ghsaFixResults = [];
@@ -8326,7 +8448,7 @@ async function coanaFix(fixConfig) {
       length
     } = ids; i < length; i += 1) {
     const ghsaId = ids[i];
-    require$$9.debugFn('notice', `check: ${ghsaId}`);
+    debug.debugFn('notice', `check: ${ghsaId}`);
 
     // Create a temporary file for Coana output.
     const tmpDir = os.tmpdir();
@@ -8334,7 +8456,7 @@ async function coanaFix(fixConfig) {
 
     // Apply fix for single GHSA ID.
     // eslint-disable-next-line no-await-in-loop
-    const fixCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ghsaId, ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(minimumReleaseAge ? ['--minimum-release-age', minimumReleaseAge] : []), ...(include.length ? ['--include', ...include] : []), ...(coanaExcludePatterns.length ? ['--exclude', ...coanaExcludePatterns] : []), ...(ecosystems.length ? ['--purl-types', ...ecosystems] : []), ...(packageManagers.length ? ['--package-managers', ...packageManagers] : []), ...(debug ? ['--debug'] : []), ...(disableExternalToolChecks ? ['--disable-external-tool-checks'] : []), ...(disableMajorUpdates ? ['--disable-major-updates'] : []), ...(showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), '--output-file', tmpFile, ...fixConfig.unknownFlags], fixConfig.orgSlug, {
+    const fixCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ghsaId, ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(minimumReleaseAge ? ['--minimum-release-age', minimumReleaseAge] : []), ...(include.length ? ['--include', ...include] : []), ...(coanaExcludePatterns.length ? ['--exclude', ...coanaExcludePatterns] : []), ...(ecosystems.length ? ['--purl-types', ...ecosystems] : []), ...(packageManagers.length ? ['--package-managers', ...packageManagers] : []), ...(debug$1 ? ['--debug'] : []), ...(disableExternalToolChecks ? ['--disable-external-tool-checks'] : []), ...(disableMajorUpdates ? ['--disable-major-updates'] : []), ...(showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), '--output-file', tmpFile, ...fixConfig.unknownFlags], fixConfig.orgSlug, {
       coanaVersion,
       cwd,
       spinner: silence ? undefined : spinner,
@@ -8359,7 +8481,7 @@ async function coanaFix(fixConfig) {
     const unstagedCResult = await utils.gitUnstagedModifiedFiles(cwd);
     const modifiedFiles = unstagedCResult.ok ? unstagedCResult.data.filter(relPath => scanBaseNames.has(path.basename(relPath))) : [];
     if (!modifiedFiles.length) {
-      require$$9.debugFn('notice', `skip: no changes for ${ghsaId}`);
+      debug.debugFn('notice', `skip: no changes for ${ghsaId}`);
       // Clean up temp file before continuing.
       try {
         // eslint-disable-next-line no-await-in-loop
@@ -8383,7 +8505,7 @@ async function coanaFix(fixConfig) {
         if (!silence) {
           logger.logger.info(`PR #${prNum} already exists for ${ghsaId}, skipping.`);
         }
-        require$$9.debugFn('notice', `skip: open PR #${prNum} exists for ${ghsaId}`);
+        debug.debugFn('notice', `skip: open PR #${prNum} exists for ${ghsaId}`);
         continue ghsaLoop;
       }
 
@@ -8403,12 +8525,12 @@ async function coanaFix(fixConfig) {
         if (!silence) {
           logger.logger.error('Cannot create pull request: SOCKET_CLI_GITHUB_TOKEN environment variable is not set.\n' + 'Set SOCKET_CLI_GITHUB_TOKEN or GITHUB_TOKEN to enable PR creation.');
         }
-        require$$9.debugFn('error', `skip: missing GitHub token for ${ghsaId}`);
+        debug.debugFn('error', `skip: missing GitHub token for ${ghsaId}`);
         continue ghsaLoop;
       }
-      require$$9.debugFn('notice', `pr: creating for ${ghsaId}`);
+      debug.debugFn('notice', `pr: creating for ${ghsaId}`);
       const details = ghsaDetails.get(ghsaId);
-      require$$9.debugFn('notice', `ghsa: ${ghsaId} details ${details ? 'found' : 'missing'}`);
+      debug.debugFn('notice', `ghsa: ${ghsaId} details ${details ? 'found' : 'missing'}`);
       const pushed =
       // eslint-disable-next-line no-await-in-loop
       (await utils.gitCreateBranch(branch, cwd)) && (
@@ -8535,7 +8657,7 @@ async function coanaFix(fixConfig) {
       if (!silence) {
         logger.logger.warn(`Unexpected condition: Push failed for ${ghsaId}, skipping PR creation.`);
       }
-      require$$9.debugDir('error', e);
+      debug.debugDir('error', e);
       // Clean up branches (push may have succeeded before error).
       // eslint-disable-next-line no-await-in-loop
       const remoteBranchExists = await utils.gitRemoteBranchExists(branch, cwd);
@@ -8555,7 +8677,7 @@ async function coanaFix(fixConfig) {
       }
     }
     count += 1;
-    require$$9.debugFn('notice', `increment: count ${count}/${Math.min(adjustedPrLimit, ids.length)}`);
+    debug.debugFn('notice', `increment: count ${count}/${Math.min(adjustedPrLimit, ids.length)}`);
     if (count >= adjustedPrLimit) {
       break ghsaLoop;
     }
@@ -8601,8 +8723,8 @@ async function convertIdsToGhsas(ids, options) {
     __proto__: null,
     ...options
   };
-  require$$9.debugFn('notice', `Converting ${ids.length} IDs to GHSA format`);
-  require$$9.debugDir('inspect', {
+  debug.debugFn('notice', `Converting ${ids.length} IDs to GHSA format`);
+  debug.debugDir('inspect', {
     ids
   });
   const validGhsas = [];
@@ -8654,12 +8776,12 @@ async function convertIdsToGhsas(ids, options) {
     if (!silence) {
       logger.logger.warn(`Skipped ${errors.length} invalid IDs:\n${errors.map(e => `  - ${e}`).join('\n')}`);
     }
-    require$$9.debugDir('inspect', {
+    debug.debugDir('inspect', {
       errors
     });
   }
-  require$$9.debugFn('notice', `Converted to ${validGhsas.length} valid GHSA IDs`);
-  require$$9.debugDir('inspect', {
+  debug.debugFn('notice', `Converted to ${validGhsas.length} valid GHSA IDs`);
+  debug.debugDir('inspect', {
     validGhsas
   });
   return validGhsas;
@@ -8670,7 +8792,7 @@ async function handleFix({
   autopilot,
   coanaVersion,
   cwd,
-  debug,
+  debug: debug$1,
   disableExternalToolChecks,
   disableMajorUpdates,
   ecosystems,
@@ -8692,14 +8814,14 @@ async function handleFix({
   spinner,
   unknownFlags
 }) {
-  require$$9.debugFn('notice', `Starting fix command for ${orgSlug}`);
-  require$$9.debugDir('inspect', {
+  debug.debugFn('notice', `Starting fix command for ${orgSlug}`);
+  debug.debugDir('inspect', {
     all,
     applyFixes,
     autopilot,
     coanaVersion,
     cwd,
-    debug,
+    debug: debug$1,
     disableExternalToolChecks,
     disableMajorUpdates,
     ecosystems,
@@ -8725,7 +8847,7 @@ async function handleFix({
     autopilot,
     coanaVersion,
     cwd,
-    debug,
+    debug: debug$1,
     disableExternalToolChecks,
     disableMajorUpdates,
     ecosystems,
@@ -9193,9 +9315,9 @@ async function setupTabCompletion(targetName) {
 
   // Target dir is something like ~/.local/share/socket/settings/completion (linux)
   const targetDir = path.dirname(targetPath);
-  require$$9.debugFn('notice', 'target: path + dir', targetPath, targetDir);
+  debug.debugFn('notice', 'target: path + dir', targetPath, targetDir);
   if (!fs$1.existsSync(targetDir)) {
-    require$$9.debugFn('notice', 'create: target dir');
+    debug.debugFn('notice', 'create: target dir');
     fs$1.mkdirSync(targetDir, {
       recursive: true
     });
@@ -9453,8 +9575,8 @@ async function attemptLogin(apiBaseUrl, apiProxy) {
   logger.logger.success(`API token verified: ${arrays.joinAnd(orgSlugs)}`);
   const enterpriseOrgs = utils.getEnterpriseOrgs(organizations);
   const enforcedChoices = enterpriseOrgs.map(org => ({
-    name: org.name ?? 'undefined',
-    value: org.id
+    name: org['name'] ?? 'undefined',
+    value: org['id']
   }));
   let enforcedOrgs = [];
   if (enforcedChoices.length > 1) {
@@ -11223,7 +11345,7 @@ async function run$G(argv, importMeta, {
   // If given path is absolute then cwd should not affect it.
   cwd = path.resolve(process.cwd(), cwd);
   const sockJson = utils.readOrDefaultSocketJson(cwd);
-  require$$9.debugFn('inspect', `override: ${constants.SOCKET_JSON} bazel`, sockJson?.defaults?.manifest?.bazel);
+  debug.debugFn('inspect', `override: ${constants.SOCKET_JSON} bazel`, sockJson?.defaults?.manifest?.bazel);
   const {
     ecosystem
   } = cli.flags;
@@ -11372,6 +11494,12 @@ async function run$G(argv, importMeta, {
 }
 
 const reachabilityFlags = {
+  dynamicSbomInference: {
+    type: 'boolean',
+    default: false,
+    hidden: true,
+    description: 'Internal: enables dynamic SBOM inference for full application reachability analysis. Passes --maven-use-only-root-socket-facts to Coana and implies --auto-manifest.'
+  },
   reachVersion: {
     type: 'string',
     description: `Override the version of @coana-tech/cli used for reachability analysis. Default: ${constants.default.ENV.INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION}.`
@@ -11553,7 +11681,7 @@ async function run$F(argv, importMeta, {
   }
   const sockJson = utils.readOrDefaultSocketJson(cwd);
   const detected = await detectManifestActions(sockJson, cwd);
-  require$$9.debugDir('inspect', {
+  debug.debugDir('inspect', {
     detected
   });
   if (dryRun) {
@@ -11571,13 +11699,14 @@ async function run$F(argv, importMeta, {
   }
   const excludePaths = utils.cmdFlagValueToArray(cli.flags['excludePaths']);
   assertValidExcludePaths(excludePaths);
-  await generateAutoManifest({
+  await utils.withTmpDir('socket-manifest-auto-', tmpDir => generateAutoManifest({
     detected,
     cwd,
     excludePaths,
     outputKind,
+    tmpDir,
     verbose
-  });
+  }));
   logger.logger.success(`Finished. Should have attempted to generate manifest files for ${detected.count} targets.`);
 }
 
@@ -11840,7 +11969,7 @@ async function run$D(argv, importMeta, {
   // If given path is absolute then cwd should not affect it.
   cwd = path.resolve(process.cwd(), cwd);
   const sockJson = utils.readOrDefaultSocketJson(cwd);
-  require$$9.debugFn('inspect', `override: ${constants.SOCKET_JSON} gradle`, sockJson?.defaults?.manifest?.gradle);
+  debug.debugFn('inspect', `override: ${constants.SOCKET_JSON} gradle`, sockJson?.defaults?.manifest?.gradle);
   let {
     bin,
     excludeConfigs,
@@ -12091,7 +12220,7 @@ async function run$C(argv, importMeta, {
   // If given path is absolute then cwd should not affect it.
   cwd = path.resolve(process.cwd(), cwd);
   const sockJson = utils.readOrDefaultSocketJson(cwd);
-  require$$9.debugFn('inspect', `override: ${constants.SOCKET_JSON} gradle`, sockJson?.defaults?.manifest?.gradle);
+  debug.debugFn('inspect', `override: ${constants.SOCKET_JSON} gradle`, sockJson?.defaults?.manifest?.gradle);
   let {
     bin,
     excludeConfigs,
@@ -12319,7 +12448,7 @@ async function run$B(argv, importMeta, {
   // If given path is absolute then cwd should not affect it.
   cwd = path.resolve(process.cwd(), cwd);
   const sockJson = utils.readOrDefaultSocketJson(cwd);
-  require$$9.debugFn('inspect', `override: ${constants.SOCKET_JSON} maven`, sockJson?.defaults?.manifest?.maven);
+  debug.debugFn('inspect', `override: ${constants.SOCKET_JSON} maven`, sockJson?.defaults?.manifest?.maven);
   let {
     bin,
     excludeConfigs,
@@ -12543,7 +12672,7 @@ async function run$A(argv, importMeta, {
   // TODO: Implement json/md further.
   const outputKind = utils.getOutputKind(json, markdown);
   const sockJson = utils.readOrDefaultSocketJson(cwd);
-  require$$9.debugFn('inspect', `override: ${constants.SOCKET_JSON} sbt`, sockJson?.defaults?.manifest?.sbt);
+  debug.debugFn('inspect', `override: ${constants.SOCKET_JSON} sbt`, sockJson?.defaults?.manifest?.sbt);
   let {
     bin,
     excludeConfigs,
@@ -12689,7 +12818,7 @@ async function run$A(argv, importMeta, {
   const excludePaths = utils.cmdFlagValueToArray(cli.flags['excludePaths']);
   assertValidExcludePaths(excludePaths);
   if (facts) {
-    await convertSbtToFacts({
+    await utils.withTmpDir('socket-manifest-scala-', tmpDir => convertSbtToFacts({
       bin: String(bin),
       cwd,
       excludeConfigs: String(excludeConfigs || ''),
@@ -12697,8 +12826,9 @@ async function run$A(argv, importMeta, {
       ignoreUnresolved: Boolean(ignoreUnresolved),
       includeConfigs: String(includeConfigs || ''),
       sbtOpts: parsedSbtOpts,
+      tmpDir,
       verbose: Boolean(verbose)
-    });
+    }));
     return;
   }
   await convertSbtToMaven({
@@ -12723,7 +12853,7 @@ async function outputManifestSetup(result) {
 
 async function setupManifestConfig(cwd, defaultOnReadError = false) {
   const detected = await detectManifestActions(null, cwd);
-  require$$9.debugDir('inspect', {
+  debug.debugDir('inspect', {
     detected
   });
 
@@ -13391,7 +13521,7 @@ async function run$y(argv, importMeta, {
   });
 }
 
-const require$5 = require$$5.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.js', document.baseURI).href)));
+const require$5 = require$$1.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.js', document.baseURI).href)));
 const CMD_NAME$q = constants.NPM;
 const description$w = 'Wraps npm with Socket security scanning';
 const hidden$q = false;
@@ -13477,7 +13607,7 @@ async function run$x(argv, importMeta, context) {
   await spawnPromise;
 }
 
-const require$4 = require$$5.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.js', document.baseURI).href)));
+const require$4 = require$$1.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.js', document.baseURI).href)));
 const CMD_NAME$p = constants.NPX;
 const description$v = 'Wraps npx with Socket security scanning';
 const hidden$p = false;
@@ -14039,8 +14169,8 @@ function updatePkgJsonField(editablePkgJson, field, value) {
   if (oldValue) {
     // The field already exists so we simply update the field value.
     if (field === PNPM) {
-      const isPnpmObj = require$$11.isObject(oldValue);
-      if (require$$11.hasKeys(value)) {
+      const isPnpmObj = objects.isObject(oldValue);
+      if (objects.hasKeys(value)) {
         editablePkgJson.update({
           [field]: {
             ...(isPnpmObj ? oldValue : {}),
@@ -14052,7 +14182,7 @@ function updatePkgJsonField(editablePkgJson, field, value) {
         });
       } else {
         // Properties with undefined values are deleted when saved as JSON.
-        editablePkgJson.update(require$$11.hasKeys(oldValue) ? {
+        editablePkgJson.update(objects.hasKeys(oldValue) ? {
           [field]: {
             ...(isPnpmObj ? oldValue : {}),
             overrides: undefined
@@ -14064,7 +14194,7 @@ function updatePkgJsonField(editablePkgJson, field, value) {
     } else if (field === OVERRIDES || field === RESOLUTIONS) {
       // Properties with undefined values are deleted when saved as JSON.
       editablePkgJson.update({
-        [field]: require$$11.hasKeys(value) ? value : undefined
+        [field]: objects.hasKeys(value) ? value : undefined
       });
     } else {
       editablePkgJson.update({
@@ -14073,7 +14203,7 @@ function updatePkgJsonField(editablePkgJson, field, value) {
     }
     return;
   }
-  if ((field === OVERRIDES || field === PNPM || field === RESOLUTIONS) && !require$$11.hasKeys(value)) {
+  if ((field === OVERRIDES || field === PNPM || field === RESOLUTIONS) && !objects.hasKeys(value)) {
     return;
   }
   // Since the field doesn't exist we want to insert it into the package.json
@@ -14199,7 +14329,7 @@ async function addOverrides(pkgEnvDetails, pkgPath, options) {
   let loggedAddingText = false;
 
   // Chunk package names to process them in parallel 3 at a time.
-  await require$$12.pEach(manifestNpmOverrides, async ({
+  await promises.pEach(manifestNpmOverrides, async ({
     1: data
   }) => {
     const {
@@ -14213,11 +14343,11 @@ async function addOverrides(pkgEnvDetails, pkgPath, options) {
     for (const {
       1: depObj
     } of depEntries) {
-      const sockSpec = require$$11.hasOwn(depObj, sockRegPkgName) ? depObj[sockRegPkgName] : undefined;
+      const sockSpec = objects.hasOwn(depObj, sockRegPkgName) ? depObj[sockRegPkgName] : undefined;
       if (sockSpec) {
         depAliasMap.set(sockRegPkgName, sockSpec);
       }
-      const origSpec = require$$11.hasOwn(depObj, origPkgName) ? depObj[origPkgName] : undefined;
+      const origSpec = objects.hasOwn(depObj, origPkgName) ? depObj[origPkgName] : undefined;
       if (origSpec) {
         let thisSpec = origSpec;
         // Add package aliases for direct dependencies to avoid npm EOVERRIDE
@@ -14253,11 +14383,11 @@ async function addOverrides(pkgEnvDetails, pkgPath, options) {
         npmExecPath
       });
       // Chunk package names to process them in parallel 3 at a time.
-      await require$$12.pEach(overridesDataObjects, async ({
+      await promises.pEach(overridesDataObjects, async ({
         overrides,
         type
       }) => {
-        const overrideExists = require$$11.hasOwn(overrides, origPkgName);
+        const overrideExists = objects.hasOwn(overrides, origPkgName);
         if (overrideExists || thingScanner(pkgEnvDetails, thingToScan, origPkgName, lockName)) {
           const oldSpec = overrideExists ? overrides[origPkgName] : undefined;
           const origDepAlias = depAliasMap.get(origPkgName);
@@ -14311,7 +14441,7 @@ async function addOverrides(pkgEnvDetails, pkgPath, options) {
   });
   if (isWorkspace) {
     // Chunk package names to process them in parallel 3 at a time.
-    await require$$12.pEach(workspacePkgJsonPaths, async workspacePkgJsonPath => {
+    await promises.pEach(workspacePkgJsonPaths, async workspacePkgJsonPath => {
       const otherState = await addOverrides(pkgEnvDetails, path.dirname(workspacePkgJsonPath), {
         logger,
         pin,
@@ -14334,7 +14464,7 @@ async function addOverrides(pkgEnvDetails, pkgPath, options) {
         overrides,
         type
       } of overridesDataObjects) {
-        updateManifest(type, pkgEnvDetails.editablePkgJson, require$$11.toSortedObject(overrides));
+        updateManifest(type, pkgEnvDetails.editablePkgJson, objects.toSortedObject(overrides));
       }
     }
     await pkgEnvDetails.editablePkgJson.save();
@@ -14366,8 +14496,8 @@ async function updateLockfile(pkgEnvDetails, options) {
     }
   } catch (e) {
     spinner?.stop();
-    require$$9.debugFn('error', 'Lockfile update failed');
-    require$$9.debugDir('error', e);
+    debug.debugFn('error', 'Lockfile update failed');
+    debug.debugDir('error', e);
     if (wasSpinning) {
       spinner.start();
     }
@@ -14467,8 +14597,8 @@ async function handleOptimize({
   pin,
   prod
 }) {
-  require$$9.debugFn('notice', `Starting optimization for ${cwd}`);
-  require$$9.debugDir('inspect', {
+  debug.debugFn('notice', `Starting optimization for ${cwd}`);
+  debug.debugDir('inspect', {
     cwd,
     outputKind,
     pin,
@@ -14481,8 +14611,8 @@ async function handleOptimize({
   });
   if (!pkgEnvCResult.ok) {
     process.exitCode = pkgEnvCResult.code ?? 1;
-    require$$9.debugFn('warn', 'Package environment validation failed');
-    require$$9.debugDir('inspect', {
+    debug.debugFn('warn', 'Package environment validation failed');
+    debug.debugDir('inspect', {
       pkgEnvCResult
     });
     await outputOptimizeResult(pkgEnvCResult, outputKind);
@@ -14491,7 +14621,7 @@ async function handleOptimize({
   const pkgEnvDetails = pkgEnvCResult.data;
   if (!pkgEnvDetails) {
     process.exitCode = 1;
-    require$$9.debugFn('warn', 'No package environment details found');
+    debug.debugFn('warn', 'No package environment details found');
     await outputOptimizeResult({
       ok: false,
       message: 'No package found.',
@@ -14499,8 +14629,8 @@ async function handleOptimize({
     }, outputKind);
     return;
   }
-  require$$9.debugFn('notice', `Detected package manager: ${pkgEnvDetails.agent} v${pkgEnvDetails.agentVersion}`);
-  require$$9.debugDir('inspect', {
+  debug.debugFn('notice', `Detected package manager: ${pkgEnvDetails.agent} v${pkgEnvDetails.agentVersion}`);
+  debug.debugDir('inspect', {
     pkgEnvDetails
   });
   const {
@@ -14509,7 +14639,7 @@ async function handleOptimize({
   } = pkgEnvDetails;
   if (agent === VLT) {
     process.exitCode = 1;
-    require$$9.debugFn('warn', `${agent} does not support overrides`);
+    debug.debugFn('warn', `${agent} does not support overrides`);
     await outputOptimizeResult({
       ok: false,
       message: 'Unsupported',
@@ -14518,7 +14648,7 @@ async function handleOptimize({
     return;
   }
   logger.logger.info(`Optimizing packages for ${agent} v${agentVersion}.\n`);
-  require$$9.debugFn('notice', 'Applying optimization');
+  debug.debugFn('notice', 'Applying optimization');
   const optimizationResult = await applyOptimization(pkgEnvDetails, {
     pin,
     prod
@@ -14526,8 +14656,8 @@ async function handleOptimize({
   if (!optimizationResult.ok) {
     process.exitCode = optimizationResult.code ?? 1;
   }
-  require$$9.debugFn('notice', `Optimization ${optimizationResult.ok ? 'succeeded' : 'failed'}`);
-  require$$9.debugDir('inspect', {
+  debug.debugFn('notice', `Optimization ${optimizationResult.ok ? 'succeeded' : 'failed'}`);
+  debug.debugDir('inspect', {
     optimizationResult
   });
   await outputOptimizeResult(optimizationResult, outputKind);
@@ -14698,8 +14828,8 @@ async function handleDependencies({
   offset,
   outputKind
 }) {
-  require$$9.debugFn('notice', `Fetching dependencies with limit=${limit}, offset=${offset}`);
-  require$$9.debugDir('inspect', {
+  debug.debugFn('notice', `Fetching dependencies with limit=${limit}, offset=${offset}`);
+  debug.debugDir('inspect', {
     limit,
     offset,
     outputKind
@@ -14708,8 +14838,8 @@ async function handleDependencies({
     limit,
     offset
   });
-  require$$9.debugFn('notice', `Dependencies ${result.ok ? 'fetched successfully' : 'fetch failed'}`);
-  require$$9.debugDir('inspect', {
+  debug.debugFn('notice', `Dependencies ${result.ok ? 'fetched successfully' : 'fetch failed'}`);
+  debug.debugDir('inspect', {
     result
   });
   await outputDependencies(result, {
@@ -15122,13 +15252,13 @@ async function outputOrganizationList(orgsCResult, outputKind = 'text') {
 }
 
 async function handleOrganizationList(outputKind = 'text') {
-  require$$9.debugFn('notice', 'Fetching organization list');
-  require$$9.debugDir('inspect', {
+  debug.debugFn('notice', 'Fetching organization list');
+  debug.debugDir('inspect', {
     outputKind
   });
   const data = await utils.fetchOrganization();
-  require$$9.debugFn('notice', `Organization list ${data.ok ? 'fetched successfully' : 'fetch failed'}`);
-  require$$9.debugDir('inspect', {
+  debug.debugFn('notice', `Organization list ${data.ok ? 'fetched successfully' : 'fetch failed'}`);
+  debug.debugDir('inspect', {
     data
   });
   await outputOrganizationList(data, outputKind);
@@ -15537,14 +15667,14 @@ function createMarkdownReport(data) {
 }
 
 async function handlePurlDeepScore(purl, outputKind) {
-  require$$9.debugFn('notice', `Fetching deep score for ${purl}`);
-  require$$9.debugDir('inspect', {
+  debug.debugFn('notice', `Fetching deep score for ${purl}`);
+  debug.debugDir('inspect', {
     purl,
     outputKind
   });
   const result = await fetchPurlDeepScore(purl);
-  require$$9.debugFn('notice', `Deep score ${result.ok ? 'fetched successfully' : 'fetch failed'}`);
-  require$$9.debugDir('inspect', {
+  debug.debugFn('notice', `Deep score ${result.ok ? 'fetched successfully' : 'fetch failed'}`);
+  debug.debugDir('inspect', {
     result
   });
   await outputPurlsDeepScore(purl, result, outputKind);
@@ -15774,7 +15904,7 @@ function formatReportCard(artifact, colorize) {
     colorize
   });
   if (!artifact.ecosystem) {
-    require$$9.debugFn('notice', 'miss: artifact ecosystem', artifact);
+    debug.debugFn('notice', 'miss: artifact ecosystem', artifact);
   }
   const purl = `pkg:${artifact.ecosystem}/${artifact.name}${artifact.version ? '@' + artifact.version : ''}`;
 
@@ -15978,14 +16108,14 @@ async function handlePurlsShallowScore({
   outputKind,
   purls
 }) {
-  require$$9.debugFn('notice', `Fetching shallow scores for ${purls.length} packages`);
-  require$$9.debugDir('inspect', {
+  debug.debugFn('notice', `Fetching shallow scores for ${purls.length} packages`);
+  debug.debugDir('inspect', {
     purls,
     outputKind
   });
   const packageData = await fetchPurlsShallowScore(purls);
-  require$$9.debugFn('notice', `Shallow scores ${packageData.ok ? 'fetched successfully' : 'fetch failed'}`);
-  require$$9.debugDir('inspect', {
+  debug.debugFn('notice', `Shallow scores ${packageData.ok ? 'fetched successfully' : 'fetch failed'}`);
+  debug.debugDir('inspect', {
     packageData
   });
   outputPurlsShallowScore(purls, packageData, outputKind);
@@ -16206,7 +16336,7 @@ async function run$m(argv, _importMeta, _context) {
   }
 }
 
-const require$3 = require$$5.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.js', document.baseURI).href)));
+const require$3 = require$$1.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.js', document.baseURI).href)));
 const CMD_NAME$g = constants.PNPM;
 const description$j = 'Wraps pnpm with Socket security scanning';
 const hidden$g = true;
@@ -16442,12 +16572,11 @@ async function fetchCreateRepo(config, options) {
     return sockSdkCResult;
   }
   const sockSdk = sockSdkCResult.data;
-  return await utils.handleApiCall(sockSdk.createOrgRepo(orgSlug, {
+  return await utils.handleApiCall(sockSdk.createRepository(orgSlug, repoName, {
     default_branch: defaultBranch,
     description,
     homepage,
-    name: repoName,
-    visibility
+    visibility: visibility
   }), {
     description: 'to create a repository'
   });
@@ -16479,8 +16608,8 @@ async function handleCreateRepo({
   repoName,
   visibility
 }, outputKind) {
-  require$$9.debugFn('notice', `Creating repository ${orgSlug}/${repoName}`);
-  require$$9.debugDir('inspect', {
+  debug.debugFn('notice', `Creating repository ${orgSlug}/${repoName}`);
+  debug.debugDir('inspect', {
     defaultBranch,
     description,
     homepage,
@@ -16497,8 +16626,8 @@ async function handleCreateRepo({
     repoName,
     visibility
   });
-  require$$9.debugFn('notice', `Repository creation ${data.ok ? 'succeeded' : 'failed'}`);
-  require$$9.debugDir('inspect', {
+  debug.debugFn('notice', `Repository creation ${data.ok ? 'succeeded' : 'failed'}`);
+  debug.debugDir('inspect', {
     data
   });
   outputCreateRepo(data, repoName, outputKind);
@@ -16638,7 +16767,7 @@ async function fetchDeleteRepo(orgSlug, repoName, options) {
     return sockSdkCResult;
   }
   const sockSdk = sockSdkCResult.data;
-  return await utils.handleApiCall(sockSdk.deleteOrgRepo(orgSlug, repoName), {
+  return await utils.handleApiCall(sockSdk.deleteRepository(orgSlug, repoName), {
     description: 'to delete a repository'
   });
 }
@@ -16781,12 +16910,16 @@ async function fetchListAllRepos(orgSlug, options) {
       };
     }
     // eslint-disable-next-line no-await-in-loop
-    const orgRepoListCResult = await utils.handleApiCall(sockSdk.getOrgRepoList(orgSlug, {
-      sort,
-      direction,
-      per_page: String(100),
+    const orgRepoListCResult = await utils.handleApiCall(sockSdk.listRepositories(orgSlug, {
+      ...(sort ? {
+        sort: sort
+      } : {}),
+      ...(direction ? {
+        direction: direction
+      } : {}),
+      per_page: 100,
       // max
-      page: String(nextPage)
+      page: nextPage
     }), {
       description: 'list of repositories'
     });
@@ -16827,11 +16960,15 @@ async function fetchListRepos(config, options) {
     return sockSdkCResult;
   }
   const sockSdk = sockSdkCResult.data;
-  return await utils.handleApiCall(sockSdk.getOrgRepoList(orgSlug, {
-    sort,
-    direction,
-    per_page: String(perPage),
-    page: String(page)
+  return await utils.handleApiCall(sockSdk.listRepositories(orgSlug, {
+    ...(sort ? {
+      sort: sort
+    } : {}),
+    ...(direction ? {
+      direction: direction
+    } : {}),
+    per_page: perPage,
+    page
   }), {
     description: 'list of repositories'
   });
@@ -16920,8 +17057,10 @@ async function handleListRepos({
     if (!data.ok) {
       await outputListRepos(data, outputKind, 0, 0, '', 0, direction);
     } else {
-      // Note: nextPage defaults to 0, is null when there's no next page
-      await outputListRepos(data, outputKind, page, data.data.nextPage, sort, perPage, direction);
+      // Note: nextPage defaults to 0, is null when there's no next page.
+      // The SDK's strict type marks it optional (absent === no next page), so
+      // coalesce undefined to null to match outputListRepos's number | null.
+      await outputListRepos(data, outputKind, page, data.data.nextPage ?? null, sort, perPage, direction);
     }
   }
 }
@@ -17083,7 +17222,7 @@ async function fetchUpdateRepo(config, options) {
     return sockSdkCResult;
   }
   const sockSdk = sockSdkCResult.data;
-  return await utils.handleApiCall(sockSdk.updateOrgRepo(orgSlug, repoName, {
+  return await utils.handleApiCall(sockSdk.updateRepository(orgSlug, repoName, {
     default_branch: defaultBranch,
     description,
     homepage,
@@ -17265,7 +17404,7 @@ async function fetchViewRepo(orgSlug, repoName, options) {
     return sockSdkCResult;
   }
   const sockSdk = sockSdkCResult.data;
-  return await utils.handleApiCall(sockSdk.getOrgRepo(orgSlug, repoName), {
+  return await utils.handleApiCall(sockSdk.getRepository(orgSlug, repoName), {
     description: 'repository data'
   });
 }
@@ -17672,6 +17811,7 @@ async function run$d(argv, importMeta, {
     committers,
     cwd: cwdOverride,
     defaultBranch,
+    dynamicSbomInference,
     interactive = true,
     json,
     markdown,
@@ -17728,6 +17868,11 @@ async function run$d(argv, importMeta, {
       autoManifest = false;
     }
   }
+  // --dynamic-sbom-inference requires auto-manifest to generate the
+  // per-workspace facts it feeds to Coana.
+  if (dynamicSbomInference) {
+    autoManifest = true;
+  }
   if (!branchName) {
     if (sockJson.defaults?.scan?.create?.branch) {
       branchName = sockJson.defaults.scan.create.branch;
@@ -17844,7 +17989,7 @@ async function run$d(argv, importMeta, {
   const isUsingNonDefaultConcurrency = reachConcurrency !== reachabilityFlags['reachConcurrency']?.default;
   const isUsingNonDefaultAnalytics = reachDisableAnalytics !== reachabilityFlags['reachDisableAnalytics']?.default;
   const isUsingNonDefaultVersion = reachVersion !== reachabilityFlags['reachVersion']?.default;
-  const isUsingAnyReachabilityFlags = hasReachEcosystems || hasReachExcludePaths || isUsingNonDefaultAnalytics || isUsingNonDefaultConcurrency || isUsingNonDefaultMemoryLimit || isUsingNonDefaultTimeout || isUsingNonDefaultVersion || reachContinueOnAnalysisErrors || reachContinueOnInstallErrors || reachContinueOnMissingLockFiles || reachContinueOnNoSourceFiles || reachEnableAnalysisSplitting || reachLazyMode || reachSkipCache || reachUseOnlyPregeneratedSboms;
+  const isUsingAnyReachabilityFlags = dynamicSbomInference || hasReachEcosystems || hasReachExcludePaths || isUsingNonDefaultAnalytics || isUsingNonDefaultConcurrency || isUsingNonDefaultMemoryLimit || isUsingNonDefaultTimeout || isUsingNonDefaultVersion || reachContinueOnAnalysisErrors || reachContinueOnInstallErrors || reachContinueOnMissingLockFiles || reachContinueOnNoSourceFiles || reachEnableAnalysisSplitting || reachLazyMode || reachSkipCache || reachUseOnlyPregeneratedSboms;
 
   // Validate target constraints when --reach is enabled.
   const reachTargetValidation = reach ? await validateReachabilityTarget(targets, cwd) : {
@@ -17929,6 +18074,7 @@ async function run$d(argv, importMeta, {
     pendingHead: Boolean(pendingHead),
     pullRequest: Number(pullRequest),
     reach: {
+      dynamicSbomInference: Boolean(dynamicSbomInference),
       excludePaths,
       reachAnalysisMemoryLimit,
       reachAnalysisTimeout,
@@ -17973,7 +18119,7 @@ async function fetchDeleteOrgFullScan(orgSlug, scanId, options) {
     return sockSdkCResult;
   }
   const sockSdk = sockSdkCResult.data;
-  return await utils.handleApiCall(sockSdk.deleteOrgFullScan(orgSlug, scanId), {
+  return await utils.handleApiCall(sockSdk.deleteFullScan(orgSlug, scanId), {
     description: 'to delete a scan'
   });
 }
@@ -18129,7 +18275,7 @@ async function outputDiffScan(result, {
   // Dump the JSON to CLI and let NodeJS deal with truncation
 
   logger.logger.log('Diff scan result:');
-  logger.logger.log(require$$1.inspect(result.data, {
+  logger.logger.log(require$$10.inspect(result.data, {
     showHidden: false,
     depth: depth > 0 ? depth : null,
     colors: true,
@@ -18543,13 +18689,14 @@ async function scanOneRepo(repoSlug, {
     };
   }
   const tmpDir = fs$1.mkdtempSync(path.join(os.tmpdir(), repoSlug));
-  require$$9.debugFn('notice', 'init: temp dir for scan root', tmpDir);
+  debug.debugFn('notice', 'init: temp dir for scan root', tmpDir);
   const downloadResult = await testAndDownloadManifestFiles({
     files,
     tmpDir,
     repoSlug,
     defaultBranch,
     orgGithub,
+    orgSlug,
     repoApiUrl,
     githubToken
   });
@@ -18589,6 +18736,7 @@ async function scanOneRepo(repoSlug, {
     pendingHead: true,
     pullRequest: 0,
     reach: {
+      dynamicSbomInference: false,
       excludePaths: [],
       reachAnalysisMemoryLimit: '',
       reachAnalysisTimeout: '',
@@ -18630,6 +18778,7 @@ async function testAndDownloadManifestFiles({
   files,
   githubToken,
   orgGithub,
+  orgSlug,
   repoApiUrl,
   repoSlug,
   tmpDir
@@ -18644,6 +18793,7 @@ async function testAndDownloadManifestFiles({
       file,
       tmpDir,
       defaultBranch,
+      orgSlug,
       repoApiUrl,
       githubToken
     });
@@ -18677,14 +18827,17 @@ async function testAndDownloadManifestFile({
   defaultBranch,
   file,
   githubToken,
+  orgSlug,
   repoApiUrl,
   tmpDir
 }) {
-  require$$9.debugFn('notice', 'testing: file', file);
-  const supportedFilesCResult = await fetchSupportedScanFileNames();
+  debug.debugFn('notice', 'testing: file', file);
+  const supportedFilesCResult = await fetchSupportedScanFileNames({
+    orgSlug
+  });
   const supportedFiles = supportedFilesCResult.ok ? supportedFilesCResult.data : undefined;
   if (!supportedFiles || !utils.isReportSupportedFile(file, supportedFiles)) {
-    require$$9.debugFn('notice', 'skip: not a known pattern');
+    debug.debugFn('notice', 'skip: not a known pattern');
     // Not an error.
     return {
       ok: true,
@@ -18693,7 +18846,7 @@ async function testAndDownloadManifestFile({
       }
     };
   }
-  require$$9.debugFn('notice', 'found: manifest file, going to attempt to download it;', file);
+  debug.debugFn('notice', 'found: manifest file, going to attempt to download it;', file);
   const result = await downloadManifestFile({
     file,
     tmpDir,
@@ -18715,9 +18868,9 @@ async function downloadManifestFile({
   repoApiUrl,
   tmpDir
 }) {
-  require$$9.debugFn('notice', 'request: download url from GitHub');
+  debug.debugFn('notice', 'request: download url from GitHub');
   const fileUrl = `${repoApiUrl}/contents/${file}?ref=${defaultBranch}`;
-  require$$9.debugDir('inspect', {
+  debug.debugDir('inspect', {
     fileUrl
   });
   utils.debugApiRequest('GET', fileUrl);
@@ -18734,9 +18887,9 @@ async function downloadManifestFile({
     utils.debugApiResponse('GET', fileUrl, undefined, e);
     throw e;
   }
-  require$$9.debugFn('notice', 'complete: request');
+  debug.debugFn('notice', 'complete: request');
   const downloadUrlText = await downloadUrlResponse.text();
-  require$$9.debugFn('inspect', 'response: raw download url', downloadUrlText);
+  debug.debugFn('inspect', 'response: raw download url', downloadUrlText);
   let downloadUrl;
   try {
     downloadUrl = JSON.parse(downloadUrlText).download_url;
@@ -18749,7 +18902,7 @@ async function downloadManifestFile({
     };
   }
   const localPath = path.join(tmpDir, file);
-  require$$9.debugFn('notice', 'download: manifest file started', downloadUrl, '->', localPath);
+  debug.debugFn('notice', 'download: manifest file started', downloadUrl, '->', localPath);
 
   // Now stream the file to that file...
   const result = await streamDownloadWithFetch(localPath, downloadUrl);
@@ -18758,7 +18911,7 @@ async function downloadManifestFile({
     logger.logger.fail(`Failed to download manifest file, skipping to next file. File: ${file}`);
     return result;
   }
-  require$$9.debugFn('notice', 'download: manifest file completed');
+  debug.debugFn('notice', 'download: manifest file completed');
   return {
     ok: true,
     data: undefined
@@ -18803,7 +18956,7 @@ async function streamDownloadWithFetch(localPath, downloadUrl) {
 
     // Using stream.pipeline for better error handling and cleanup
 
-    await promises.pipeline(response.body, fileStream);
+    await require$$9.pipeline(response.body, fileStream);
     // 'pipeline' will automatically handle closing streams and propagating errors.
     // It resolves when the piping is fully complete and fileStream is closed.
     return {
@@ -18815,7 +18968,7 @@ async function streamDownloadWithFetch(localPath, downloadUrl) {
       utils.debugApiResponse('GET', downloadUrl, undefined, e);
     }
     logger.logger.fail('An error was thrown while trying to download a manifest file... url:', downloadUrl);
-    require$$9.debugDir('error', e);
+    debug.debugDir('error', e);
 
     // If an error occurs and fileStream was created, attempt to clean up.
     if (fs$1.existsSync(localPath)) {
@@ -18837,7 +18990,7 @@ async function streamDownloadWithFetch(localPath, downloadUrl) {
       // If error was due to bad HTTP status
       detailedError += ` (HTTP Status: ${response.status} ${response.statusText})`;
     }
-    require$$9.debugFn('error', detailedError);
+    debug.debugFn('error', detailedError);
     return {
       ok: false,
       message: 'Download Failed',
@@ -18854,7 +19007,7 @@ async function getLastCommitDetails({
 }) {
   logger.logger.info(`Requesting last commit for default branch ${defaultBranch} for ${orgGithub}/${repoSlug}...`);
   const commitApiUrl = `${repoApiUrl}/commits?sha=${defaultBranch}&per_page=1`;
-  require$$9.debugFn('inspect', 'url: commit', commitApiUrl);
+  debug.debugFn('inspect', 'url: commit', commitApiUrl);
   utils.debugApiRequest('GET', commitApiUrl);
   let commitResponse;
   try {
@@ -18869,7 +19022,7 @@ async function getLastCommitDetails({
     throw e;
   }
   const commitText = await commitResponse.text();
-  require$$9.debugFn('inspect', 'response: commit', commitText);
+  debug.debugFn('inspect', 'response: commit', commitText);
   let lastCommit;
   try {
     lastCommit = JSON.parse(commitText)?.[0];
@@ -18956,7 +19109,7 @@ async function getRepoDetails({
   repoSlug
 }) {
   const repoApiUrl = `${githubApiUrl}/repos/${orgGithub}/${repoSlug}`;
-  require$$9.debugDir('inspect', {
+  debug.debugDir('inspect', {
     repoApiUrl
   });
   let repoDetailsResponse;
@@ -18975,7 +19128,7 @@ async function getRepoDetails({
   }
   logger.logger.success(`Request completed.`);
   const repoDetailsText = await repoDetailsResponse.text();
-  require$$9.debugFn('inspect', 'response: repo', repoDetailsText);
+  debug.debugFn('inspect', 'response: repo', repoDetailsText);
   let repoDetails;
   try {
     repoDetails = JSON.parse(repoDetailsText);
@@ -19014,7 +19167,7 @@ async function getRepoBranchTree({
 }) {
   logger.logger.info(`Requesting default branch file tree; branch \`${defaultBranch}\`, repo \`${orgGithub}/${repoSlug}\`...`);
   const treeApiUrl = `${repoApiUrl}/git/trees/${defaultBranch}?recursive=1`;
-  require$$9.debugFn('inspect', 'url: tree', treeApiUrl);
+  debug.debugFn('inspect', 'url: tree', treeApiUrl);
   let treeResponse;
   try {
     utils.debugApiRequest('GET', treeApiUrl);
@@ -19030,7 +19183,7 @@ async function getRepoBranchTree({
     throw e;
   }
   const treeText = await treeResponse.text();
-  require$$9.debugFn('inspect', 'response: tree', treeText);
+  debug.debugFn('inspect', 'response: tree', treeText);
   let treeDetails;
   try {
     treeDetails = JSON.parse(treeText);
@@ -19059,7 +19212,7 @@ async function getRepoBranchTree({
     };
   }
   if (!treeDetails.tree || !Array.isArray(treeDetails.tree)) {
-    require$$9.debugDir('inspect', {
+    debug.debugDir('inspect', {
       treeDetails: {
         tree: treeDetails.tree
       }
@@ -19340,18 +19493,22 @@ async function fetchOrgFullScanList(config, options) {
     __proto__: null,
     ...config
   };
-  return await utils.handleApiCall(sockSdk.getOrgFullScanList(orgSlug, {
+  return await utils.handleApiCall(sockSdk.listFullScans(orgSlug, {
     ...(branch ? {
       branch
     } : {}),
     ...(repo ? {
       repo
     } : {}),
-    sort,
-    direction,
+    ...(sort ? {
+      sort: sort
+    } : {}),
+    ...(direction ? {
+      direction: direction
+    } : {}),
     from: from_time,
-    page: String(page),
-    per_page: String(perPage)
+    page,
+    per_page: perPage
   }), {
     description: 'list of scans'
   });
@@ -19595,7 +19752,7 @@ async function fetchScanMetadata(orgSlug, scanId, options) {
     return sockSdkCResult;
   }
   const sockSdk = sockSdkCResult.data;
-  return await utils.handleApiCall(sockSdk.getOrgFullScanMetadata(orgSlug, scanId), {
+  return await utils.handleApiCall(sockSdk.getFullScanMetadata(orgSlug, scanId), {
     description: 'meta data for a full scan'
   });
 }
@@ -19780,6 +19937,7 @@ async function handleScanReach({
 
   // Get supported file names.
   const supportedFilesCResult = await fetchSupportedScanFileNames({
+    orgSlug,
     spinner
   });
   if (!supportedFilesCResult.ok) {
@@ -20041,6 +20199,9 @@ async function run$7(argv, importMeta, {
     outputKind,
     outputPath: outputPath || '',
     reachabilityOptions: {
+      // Not exposed here: it relies on --auto-manifest generating per-workspace
+      // Socket facts first, which `socket scan reach` never runs.
+      dynamicSbomInference: false,
       excludePaths,
       reachAnalysisMemoryLimit,
       reachAnalysisTimeout,
@@ -20588,39 +20749,71 @@ async function run$5(argv, importMeta, {
   await handleScanConfig(cwd, Boolean(defaultOnReadError));
 }
 
+// HTTP 202 Accepted: cached results are still being computed; poll again.
+const HTTP_STATUS_ACCEPTED = 202;
+const CACHED_POLL_INITIAL_DELAY_MS = 1000;
+const CACHED_POLL_MAX_DELAY_MS = 10_000;
+const CACHED_POLL_TIMEOUT_MS = 10 * 60 * 1000;
+function sleep(ms) {
+  return new Promise(resolve => {
+    setTimeout(resolve, ms);
+  });
+}
 async function fetchScan(orgSlug, scanId) {
-  const result = await utils.queryApiSafeText(`orgs/${orgSlug}/full-scans/${encodeURIComponent(scanId)}`, 'a scan');
-  if (!result.ok) {
-    return result;
+  // Serve pre-computed results from the immutable store (`?cached=true`): a
+  // 200 carries the ndjson body, a 202 means the server enqueued a background
+  // job to compute them — poll with backoff until the results are ready, so
+  // callers only ever observe the final scan.
+  const path = `orgs/${orgSlug}/full-scans/${encodeURIComponent(scanId)}?cached=true`;
+  const deadline = Date.now() + CACHED_POLL_TIMEOUT_MS;
+  let delayMs = CACHED_POLL_INITIAL_DELAY_MS;
+  for (;;) {
+    // eslint-disable-next-line no-await-in-loop
+    const result = await utils.queryApiSafeTextWithStatus(path, 'a scan');
+    if (!result.ok) {
+      return result;
+    }
+    if (result.data.status !== HTTP_STATUS_ACCEPTED) {
+      return parseArtifactsNdjson(result.data.text);
+    }
+    if (Date.now() >= deadline) {
+      return {
+        ok: false,
+        message: 'Scan results not ready',
+        cause: `The Socket API is still computing cached results for scan ${scanId} after ${CACHED_POLL_TIMEOUT_MS / 60_000} minutes (path: ${path}). Retry in a few minutes — the server keeps computing in the background.`
+      };
+    }
+    // eslint-disable-next-line no-await-in-loop
+    await sleep(delayMs);
+    delayMs = Math.min(delayMs * 2, CACHED_POLL_MAX_DELAY_MS);
   }
-  const jsonsString = result.data;
-
-  // This is nd-json; each line is a json object
+}
+function parseArtifactsNdjson(jsonsString) {
+  // This is nd-json; each line is a json object.
   const lines = jsonsString.split('\n').filter(Boolean);
-  let ok = true;
-  const data = lines.map(line => {
+  const data = [];
+  for (let i = 0, {
+      length
+    } = lines; i < length; i += 1) {
+    const line = lines[i];
     try {
-      return JSON.parse(line);
+      data.push(JSON.parse(line));
     } catch (e) {
-      ok = false;
-      require$$9.debugFn('error', 'Failed to parse scan result line as JSON');
-      require$$9.debugDir('error', {
+      debug.debugFn('error', 'Failed to parse scan result line as JSON');
+      debug.debugDir('error', {
         error: e,
         line
       });
-      return undefined;
+      return {
+        ok: false,
+        message: 'Invalid Socket API response',
+        cause: 'The Socket API responded with at least one line that was not valid JSON. Please report if this persists.'
+      };
     }
-  });
-  if (ok) {
-    return {
-      ok: true,
-      data
-    };
   }
   return {
-    ok: false,
-    message: 'Invalid Socket API response',
-    cause: 'The Socket API responded with at least one line that was not valid JSON. Please report if this persists.'
+    ok: true,
+    data
   };
 }
 
@@ -20715,7 +20908,9 @@ async function streamScan(orgSlug, scanId, options) {
   logger.logger.info('Requesting data from API...');
 
   // Note: this will write to stdout or target file. It's not a noop
-  return await utils.handleApiCall(sockSdk.getOrgFullScan(orgSlug, scanId, file === '-' ? undefined : file), {
+  return await utils.handleApiCall(sockSdk.streamFullScan(orgSlug, scanId, {
+    output: file === '-' ? undefined : file
+  }), {
     description: 'a scan'
   });
 }
@@ -20885,7 +21080,7 @@ async function fetchThreatFeed({
   return await utils.queryApiSafeJson(`orgs/${orgSlug}/threat-feed?${queryParams}`, 'the Threat Feed data');
 }
 
-const require$2 = require$$5.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.js', document.baseURI).href)));
+const require$2 = require$$1.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.js', document.baseURI).href)));
 async function outputThreatFeed(result, outputKind) {
   if (!result.ok) {
     process.exitCode = result.code ?? 1;
@@ -21488,8 +21683,8 @@ Do you want to install the Socket npm wrapper (this will create an alias to the
       }
     }
   } catch (e) {
-    require$$9.debugFn('warn', 'Tab completion setup failed (non-fatal)');
-    require$$9.debugDir('warn', e);
+    debug.debugFn('warn', 'Tab completion setup failed (non-fatal)');
+    debug.debugDir('warn', e);
     // Ignore. Skip tab completion setup.
   }
   if (!updatedTabCompletion) {
@@ -21654,7 +21849,7 @@ async function run$1(argv, importMeta, {
   }
 }
 
-const require$1 = require$$5.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.js', document.baseURI).href)));
+const require$1 = require$$1.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.js', document.baseURI).href)));
 const CMD_NAME = constants.YARN;
 const description = 'Wraps yarn with Socket security scanning';
 const hidden = true;
@@ -21879,8 +22074,8 @@ void (async () => {
 
     // Track CLI error for telemetry.
     await utils.trackCliError(process.argv, cliStartTime, e, process.exitCode);
-    require$$9.debugFn('error', 'CLI uncaught error');
-    require$$9.debugDir('error', e);
+    debug.debugFn('error', 'CLI uncaught error');
+    debug.debugDir('error', e);
     let errorBody;
     let errorTitle;
     let errorMessage = '';
@@ -21924,7 +22119,7 @@ void (async () => {
       logger.logger.error('\n');
       logger.logger.fail(utils.failMsgWithBadge(errorTitle, errorMessage));
       if (errorBody) {
-        require$$9.debugDir('inspect', {
+        debug.debugDir('inspect', {
           errorBody
         });
       }
@@ -21973,5 +22168,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=43870dc8-4dd6-46d5-b17f-6134bd10c1ad
+//# debugId=69b61d3f-9a18-4a06-a0cd-4567860caa90
 //# sourceMappingURL=cli.js.map