@socketsecurity/cli-with-sentry 1.1.152 → 1.1.153

package/dist/cli.js

@@ -333,9 +333,9 @@ const hidden$x = false;
 const cmdAnalytics = {
   description: description$F,
   hidden: hidden$x,
-  run: run$U
+  run: run$V
 };
-async function run$U(argv, importMeta, {
+async function run$V(argv, importMeta, {
   parentName
 }) {
   const config = {
@@ -756,9 +756,9 @@ const hidden$w = false;
 const cmdAuditLog = {
   description: description$E,
   hidden: hidden$w,
-  run: run$T
+  run: run$U
 };
-async function run$T(argv, importMeta, {
+async function run$U(argv, importMeta, {
   parentName
 }) {
   const config = {
@@ -4342,6 +4342,41 @@ async function extractBazelToMaven(opts) {
   }
 }
 
+const ENV_VAR_REF = /\$\$|\$\{(\w+)\}|\$(\w+)/g;
+
+// Expands `$VAR`/`${VAR}` references (e.g. a team-shared `javaHome:
+// "$JAVA11_HOME"`) against the CLI process's own environment, so a socket.json
+// value works across machines instead of hardcoding one developer's path.
+// `$$` is a literal `$`, for a value that must contain a literal `$WORD`.
+function expandEnvVarRefs(value) {
+  const missing = [];
+  const expanded = value.replace(ENV_VAR_REF, (match, braced, bare) => {
+    if (match === '$$') {
+      return '$';
+    }
+    const name = braced ?? bare;
+    const resolved = process.env[name];
+    if (resolved === undefined) {
+      if (!missing.includes(name)) {
+        missing.push(name);
+      }
+      return '';
+    }
+    return resolved;
+  });
+  return missing.length ? {
+    missing,
+    value: expanded
+  } : {
+    value: expanded
+  };
+}
+function formatMissingEnvVarRefs(missing) {
+  const names = missing.map(name => `\`${name}\``).join(', ');
+  const verb = missing.length > 1 ? 'are' : 'is';
+  return `references ${names}, which ${verb} not set in this environment`;
+}
+
 // Gradle's variant-aware resolver: distinct exceptions give mutually-exclusive
 // phrasing, so most-specific-first substring checks classify reliably.
 function classifyGradleFailure(detail) {
@@ -5097,6 +5132,141 @@ function resolveBuildToolBin(tool, projectDir, bin) {
   return DEFAULT_BUILD_TOOL_BIN[tool];
 }
 
+// Single source of truth for --exclude-paths glob semantics against a JVM
+// build root's subproject dirs: anchored, relative, case-sensitive; `*`
+// within one path segment, `**` across zero or more segments, `?` within one
+// segment, and `[...]` character classes with `[!..]`/`[^..]` negation.
+// Entries are assumed pre-validated by assertValidExcludePaths (relative, no
+// negation, no `..`, balanced brackets, comma-free). A malformed entry falls
+// back to a literal match, never throws.
+//
+// Compiled HERE, once, and handed to every producer (the gradle/sbt/maven
+// facts and workspaces scripts) pre-compiled, so there is exactly one
+// implementation and one test suite instead of the same algorithm
+// re-implemented per language.
+//
+// Portability contract: gradle/sbt/maven all run on the JVM and share the
+// exact same regex engine (java.util.regex), so the same emitted subset
+// (`.*`, `[^/]*`, `[^/]`, `[...]`, `[^...]`, backslash-escaped
+// metacharacters) is authoritative for every producer - this compiler and JS
+// RegExp agree on the identical subset. Class bodies escape `&` because Java
+// classes support `&&` intersection (JS treats it literally). Each compiled
+// pattern already means "this path OR its whole subtree", matching the
+// documented --exclude-paths contract, so a producer never needs its own
+// "self + /**" expansion. Patterns transport comma-joined: an input glob can
+// never contain a comma, since --exclude-paths is comma-split before glob
+// parsing reaches this module.
+
+function literalSource(glob) {
+  const escaped = glob.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return `^(?:${escaped})(?:/.*)?$`;
+}
+
+// Strips a trailing `/**` (and trailing slashes) so `dir` and `dir/**` both
+// compile to the same base pattern - the "self OR subtree" wrap below is
+// what actually encodes matching the subtree, not the user's own suffix.
+function stripTrailingGlobstar(glob) {
+  let g = glob;
+  while (g.endsWith('/')) {
+    g = g.slice(0, -1);
+  }
+  while (g.endsWith('/**')) {
+    g = g.slice(0, -3);
+    while (g.endsWith('/')) {
+      g = g.slice(0, -1);
+    }
+  }
+  return g;
+}
+
+// Translates one path segment's `*`/`?`/`[...]` - never crosses a `/`.
+function translateSegment(segment) {
+  let sb = '';
+  let i = 0;
+  const n = segment.length;
+  while (i < n) {
+    const ch = segment.charAt(i);
+    if (ch === '*') {
+      sb += '[^/]*';
+      i += 1;
+    } else if (ch === '?') {
+      sb += '[^/]';
+      i += 1;
+    } else if (ch === '[') {
+      const j = segment.indexOf(']', i + 1);
+      // Treat as a class only with a non-empty body; else a literal `[`.
+      if (j <= i + 1) {
+        sb += '\\[';
+        i += 1;
+      } else {
+        let body = segment.slice(i + 1, j);
+        const neg = body.startsWith('!') || body.startsWith('^');
+        if (neg) {
+          body = body.slice(1);
+        }
+        if (!body) {
+          // `[!]`/`[^]` would emit `[^]`, which JS accepts but Java rejects;
+          // signal the caller to fall back to a whole-glob literal match.
+          throw new Error('empty-class');
+        }
+        // Only literal chars and `-` ranges are meaningful; neutralize
+        // regex-class tricks (`&` guards Java's `&&` class intersection).
+        body = body.replace(/\\/g, '\\\\').replace(/\[/g, '\\[').replace(/\]/g, '\\]').replace(/&/g, '\\&');
+        sb += `[${neg ? '^' : ''}${body}]`;
+        i = j + 1;
+      }
+    } else if ('.\\^$|+(){}]'.includes(ch)) {
+      sb += `\\${ch}`;
+      i += 1;
+    } else {
+      sb += ch;
+      i += 1;
+    }
+  }
+  return sb;
+}
+function excludePathGlobToRegexSource(glob) {
+  const stripped = stripTrailingGlobstar(glob);
+  if (!stripped) {
+    // Defensive only: assertValidExcludePaths already rejects a pattern that
+    // reduces to "match everything".
+    return literalSource(glob);
+  }
+  try {
+    const segments = stripped.split('/');
+    let base = '';
+    segments.forEach((segment, i) => {
+      const isLast = i === segments.length - 1;
+      if (segment === '**') {
+        // Zero or more whole segments: mid-pattern, each consumed segment
+        // carries its own trailing slash; as the last segment, anything
+        // (including nothing) for the rest of the path.
+        base += isLast ? '.*' : '(?:[^/]+/)*';
+      } else {
+        base += translateSegment(segment);
+        if (!isLast) {
+          base += '/';
+        }
+      }
+    });
+    const source = `^(?:${base})(?:/.*)?$`;
+    // eslint-disable-next-line no-new
+    new RegExp(source);
+    return source;
+  } catch {
+    return literalSource(glob);
+  }
+}
+function compileExcludePathPatterns(paths) {
+  return (paths ?? []).map(excludePathGlobToRegexSource);
+}
+
+// Transport form handed to the build-tool scripts: comma-joined pattern
+// sources. Empty string when there are no patterns.
+function serializeExcludePathPatterns(paths) {
+  return compileExcludePathPatterns(paths).join(',');
+}
+
 // Line-protocol the build-tool scripts emit to a records file (NOT stdout — sbt
 // prints unsilenceable resolution noise there). One record per line, fields
 // backslash-escaped (\\, \t, \n, \r) so a value can't break framing:
@@ -5283,8 +5453,11 @@ function parseRecords(text) {
 }
 
 const FACTS_TASK = 'socketFacts';
-const SBT_PLUGIN_FILENAME = 'SocketFactsPlugin.scala';
-
+const WORKSPACES_TASK = 'socketWorkspaces';
+// Destination filename inside sbt's isolated plugins/ dir; unrelated to the source filename, which
+// is whatever socket-facts.plugin.scala / socket-workspaces.plugin.scala are called on disk.
+const SBT_FACTS_PLUGIN_FILENAME = 'SocketFactsPlugin.scala';
+const SBT_WORKSPACES_PLUGIN_FILENAME = 'SocketWorkspacesPlugin.scala';
 // Bundled emitter assets, copied into dist by the rollup build.
 function manifestScriptsPath(...parts) {
   return path.join(constants.default.distPath, 'manifest-scripts', ...parts);
@@ -5329,13 +5502,13 @@ async function runNeverThrow(bin, args, opts) {
     throw e;
   }
 }
-async function writeSbtPlugin(globalBase) {
-  const src = await fs$1.promises.readFile(manifestScriptsPath('socket-facts.plugin.scala'), 'utf8');
+async function writeSbtPlugin(globalBase, sourceFilename, destFilename) {
+  const src = await fs$1.promises.readFile(manifestScriptsPath(sourceFilename), 'utf8');
   const pluginsDir = path.join(globalBase, 'plugins');
   await fs$1.promises.mkdir(pluginsDir, {
     recursive: true
   });
-  await fs$1.promises.writeFile(path.join(pluginsDir, SBT_PLUGIN_FILENAME), src);
+  await fs$1.promises.writeFile(path.join(pluginsDir, destFilename), src);
 }
 async function assembleFromRecords(out, recordsFile) {
   const text = fs$1.existsSync(recordsFile) ? await fs$1.promises.readFile(recordsFile, 'utf8') : '';
@@ -5375,6 +5548,18 @@ async function runManifestScript(tool, opts) {
       return await runMaven(opts);
   }
 }
+
+// Emits only `project` records, never resolving dependencies, for discovery
+// before committing to a full `runManifestScript` resolution cost.
+async function enumerateWorkspaces$1(tool, opts) {
+  const result = await (tool === 'gradle' ? enumerateGradleWorkspaces(opts) : tool === 'sbt' ? enumerateSbtWorkspaces(opts) : enumerateMavenWorkspaces(opts));
+  return {
+    code: result.code,
+    projects: result.facts.projects ?? [],
+    stderr: result.stderr,
+    stdout: result.stdout
+  };
+}
 function commonProps(opts, prefix) {
   const props = [];
   if (opts.withFiles) {
@@ -5389,27 +5574,35 @@ function commonProps(opts, prefix) {
   if (opts.excludeConfigs) {
     props.push(`${prefix}socket.excludeConfigs=${opts.excludeConfigs}`);
   }
-  if (opts.excludePaths?.length) {
-    // CSV: `--exclude-paths` is comma-split at the CLI, so an entry can never
-    // contain a comma.
-    props.push(`${prefix}socket.excludePaths=${opts.excludePaths.join(',')}`);
+  // Globs compile to regex pattern sources HERE (exclude-paths-glob.mts is
+  // the single glob implementation); the scripts just Pattern.compile what
+  // they receive.
+  const excludePatterns = serializeExcludePathPatterns(opts.excludePaths);
+  if (excludePatterns) {
+    props.push(`${prefix}socket.excludePaths=${excludePatterns}`);
   }
   return props;
 }
-async function runGradle(opts) {
-  const initScript = manifestScriptsPath('socket-facts.init.gradle');
-  return await utils.withTmpDir('socket-gradle-facts-', async tmp => {
+async function invokeGradle(opts, initScriptFilename, task, tmpDirPrefix) {
+  const initScript = manifestScriptsPath(initScriptFilename);
+  return await utils.withTmpDir(tmpDirPrefix, async tmp => {
     const recordsFile = path.join(tmp, 'records.tsv');
     const bin = resolveBuildToolBin('gradle', opts.projectDir, opts.bin);
     // Disable the configuration cache: the init script's legacy
     // resolvedConfiguration API and shared accumulator aren't cache-safe.
-    const args = ['--init-script', initScript, '-Dorg.gradle.configuration-cache=false', `-Psocket.recordsFile=${recordsFile}`, ...commonProps(opts, '-P'), ...(opts.toolOpts ?? []), FACTS_TASK, '--no-daemon', '--console=plain'];
+    const args = ['--init-script', initScript, '-Dorg.gradle.configuration-cache=false', `-Psocket.recordsFile=${recordsFile}`, ...commonProps(opts, '-P'), ...(opts.toolOpts ?? []), task, '--no-daemon', '--console=plain'];
     const out = await runNeverThrow(bin, args, opts);
     return await assembleFromRecords(out, recordsFile);
   });
 }
-async function runSbtIn(globalBase, opts) {
-  await writeSbtPlugin(globalBase);
+async function runGradle(opts) {
+  return await invokeGradle(opts, 'socket-facts.init.gradle', FACTS_TASK, 'socket-gradle-facts-');
+}
+async function enumerateGradleWorkspaces(opts) {
+  return await invokeGradle(opts, 'socket-workspaces.init.gradle', WORKSPACES_TASK, 'socket-gradle-workspaces-');
+}
+async function invokeSbtIn(globalBase, opts, pluginSourceFilename, pluginDestFilename, task) {
+  await writeSbtPlugin(globalBase, pluginSourceFilename, pluginDestFilename);
   const recordsFile = path.join(globalBase, 'records.tsv');
   const bin = resolveBuildToolBin('sbt', opts.projectDir, opts.bin);
   // Fresh per-run global base (not ~/.sbt): sbt executes everything under
@@ -5423,30 +5616,44 @@ async function runSbtIn(globalBase, opts) {
   // caller-supplied --java-home.
   const javaHome = opts.env?.['JAVA_HOME'] ?? process.env['JAVA_HOME'];
   const javaHomeOpt = javaHome && !(opts.toolOpts ?? []).includes('--java-home') ? ['--java-home', javaHome] : [];
-  const args = [...javaHomeOpt, ...props, ...(opts.toolOpts ?? []), '--batch', FACTS_TASK];
+  const args = [...javaHomeOpt, ...props, ...(opts.toolOpts ?? []), '--batch', task];
   const out = await runNeverThrow(bin, args, opts);
   return await assembleFromRecords(out, recordsFile);
 }
 async function runSbt(opts) {
+  const run = globalBase => invokeSbtIn(globalBase, opts, 'socket-facts.plugin.scala', SBT_FACTS_PLUGIN_FILENAME, FACTS_TASK);
   if (opts.tmpDir) {
-    return await runSbtIn(opts.tmpDir, opts);
+    return await run(opts.tmpDir);
   }
-  return await utils.withTmpDir('socket-sbt-facts-', globalBase => runSbtIn(globalBase, opts));
+  return await utils.withTmpDir('socket-sbt-facts-', run);
 }
-async function runMaven(opts) {
+async function enumerateSbtWorkspaces(opts) {
+  const run = globalBase => invokeSbtIn(globalBase, opts, 'socket-workspaces.plugin.scala', SBT_WORKSPACES_PLUGIN_FILENAME, WORKSPACES_TASK);
+  if (opts.tmpDir) {
+    return await run(opts.tmpDir);
+  }
+  return await utils.withTmpDir('socket-sbt-workspaces-', run);
+}
+async function invokeMaven(opts, coanaTask, tmpDirPrefix) {
   const jarPath = manifestScriptsPath('maven-extension', 'coana-maven-extension.jar');
   assertMavenExtensionBuilt(jarPath);
-  return await utils.withTmpDir('socket-maven-facts-', async tmp => {
+  return await utils.withTmpDir(tmpDirPrefix, async tmp => {
     const recordsFile = path.join(tmp, 'records.tsv');
     const bin = resolveBuildToolBin('maven', opts.projectDir, opts.bin);
-    // `validate` is the cheapest phase that triggers the afterSessionEnd
-    // extension; no compile needed (analysis uses configured paths, not classes).
-    const props = [`-Dmaven.ext.class.path=${jarPath}`, '-Dcoana.task=socket-facts', `-Dsocket.recordsFile=${recordsFile}`, ...commonProps(opts, '-D')];
+    // `validate` is the cheapest phase that triggers the extension; no compile
+    // needed (analysis uses configured paths, not classes).
+    const props = [`-Dmaven.ext.class.path=${jarPath}`, `-Dcoana.task=${coanaTask}`, `-Dsocket.recordsFile=${recordsFile}`, ...commonProps(opts, '-D')];
     const args = [...props, ...(opts.toolOpts ?? []), '--batch-mode', 'validate'];
     const out = await runNeverThrow(bin, args, opts);
     return await assembleFromRecords(out, recordsFile);
   });
 }
+async function runMaven(opts) {
+  return await invokeMaven(opts, 'socket-facts', 'socket-maven-facts-');
+}
+async function enumerateMavenWorkspaces(opts) {
+  return await invokeMaven(opts, 'socket-workspaces', 'socket-maven-workspaces-');
+}
 
 // Frozen contract with `coana run --compute-artifacts-sidecar`; change only in
 // sync with the coana consumer. Per coordinate: targets/sources present →
@@ -5520,6 +5727,11 @@ function tailBuildOutput(stdout, stderr) {
   return combined.split('\n').slice(-40).join('\n');
 }
 
+// `null` = a real failure (crash, missing config, blocking unresolved
+// dependency); `undefined` = genuinely nothing to resolve, not a failure.
+// Distinguishing the two here means callers never have to infer it from
+// `process.exitCode`, which can already be non-zero for an unrelated reason.
+
 // Runs the bundled build-tool resolution script for a JVM project and writes
 // `.socket.facts.json`. `withFiles` (reachability only) additionally folds
 // resolved artifact paths into `sidecarAcc`. A blocking resolution failure sets
@@ -5535,17 +5747,33 @@ async function runManifestFacts({
   excludePaths,
   ignoreUnresolved,
   includeConfigs,
+  javaHome,
   sidecarAcc,
   tmpDir,
   verbose,
   withFiles
 }) {
   const factsPath = path.join(cwd, constants.default.DOT_SOCKET_DOT_FACTS_JSON);
-  logger.logger.log(`Generating Socket facts for the ${ecosystem} project at \`${cwd}\` ...`);
+  let resolvedJavaHome;
+  if (javaHome) {
+    const expanded = expandEnvVarRefs(javaHome);
+    if (expanded.missing) {
+      process.exitCode = 1;
+      logger.logger.fail(`javaHome (\`${javaHome}\`) ${formatMissingEnvVarRefs(expanded.missing)}.`);
+      return null;
+    }
+    resolvedJavaHome = expanded.value;
+  }
+  logger.logger.info(`Generating Socket facts for the ${ecosystem} project at \`${cwd}\` ...`);
   const scriptOpts = {
     bin: bin || undefined,
     excludeConfigs: excludeConfigs || undefined,
     excludePaths: excludePaths?.length ? excludePaths : undefined,
+    // `env` replaces the spawned process's whole environment, not just JAVA_HOME.
+    env: resolvedJavaHome ? {
+      ...process.env,
+      JAVA_HOME: resolvedJavaHome
+    } : undefined,
     includeConfigs: includeConfigs || undefined,
     projectDir: cwd,
     // Stream the build tool's output only when asked; otherwise capture it and
@@ -5580,8 +5808,8 @@ async function runManifestFacts({
       spinner.failAndStop(`Failed to run ${ecosystem}.`);
     }
     process.exitCode = 1;
-    logger.logger.fail(`Could not run the ${ecosystem} build tool` + (verbose ? `: ${e}` : ' (run with --verbose for details).'));
-    return;
+    logger.logger.fail(`Could not run the ${ecosystem} build tool` + (verbose ? `: ${utils.getErrorMessageOr(e, String(e))}` : ' (run with --verbose for details).'));
+    return null;
   }
   const {
     artifactPaths,
@@ -5602,16 +5830,16 @@ async function runManifestFacts({
       process.exitCode = 1;
       logger.logger.fail(rendered.summary);
       if (verbose && rendered.details) {
-        logger.logger.log(rendered.details);
+        logger.logger.info(rendered.details);
       }
-      return;
+      return null;
     }
   }
   if (rendered.nonBlockingNotice) {
     logger.logger.info(rendered.nonBlockingNotice);
   }
   if (verbose && rendered.details) {
-    logger.logger.log(rendered.details);
+    logger.logger.info(rendered.details);
   }
 
   // A non-zero build exit with no usable output (no graph, no first-party
@@ -5635,7 +5863,7 @@ async function runManifestFacts({
     // successful run couldn't resolve.
     process.exitCode = 1;
     logger.logger.fail(`The ${ecosystem} build failed (exit code ${code}) before producing any Socket facts.`);
-    return;
+    return null;
   }
 
   // Nothing resolved at all — no dependencies and no first-party modules. A
@@ -5650,6 +5878,10 @@ async function runManifestFacts({
     accumulateSidecar(sidecarAcc, facts, artifactPaths);
   }
   logger.logger.success('Generated Socket facts');
+  return {
+    factsPath,
+    projects: facts.projects ?? []
+  };
 }
 
 // Generates `.socket.facts.json` for a Gradle project via the bundled init script.
@@ -5661,6 +5893,7 @@ async function convertGradleToFacts({
   gradleOpts,
   ignoreUnresolved,
   includeConfigs,
+  javaHome,
   sidecarAcc,
   verbose,
   withFiles
@@ -5674,6 +5907,7 @@ async function convertGradleToFacts({
     excludePaths,
     ignoreUnresolved,
     includeConfigs,
+    javaHome,
     sidecarAcc,
     verbose,
     withFiles
@@ -5688,6 +5922,7 @@ async function convertMavenToFacts({
   excludePaths,
   ignoreUnresolved,
   includeConfigs,
+  javaHome,
   mavenOpts,
   sidecarAcc,
   verbose,
@@ -5702,6 +5937,7 @@ async function convertMavenToFacts({
     excludePaths,
     ignoreUnresolved,
     includeConfigs,
+    javaHome,
     sidecarAcc,
     verbose,
     withFiles
@@ -5718,6 +5954,7 @@ async function convertSbtToFacts({
   excludePaths,
   ignoreUnresolved,
   includeConfigs,
+  javaHome,
   sbtOpts,
   sidecarAcc,
   tmpDir,
@@ -5733,6 +5970,7 @@ async function convertSbtToFacts({
     excludePaths,
     ignoreUnresolved,
     includeConfigs,
+    javaHome,
     sidecarAcc,
     tmpDir,
     verbose,
@@ -6279,7 +6517,7 @@ async function generateAutoManifest({
       // Note: `sbt` is more likely to be resolved against PATH env.
       bin: sockJson.defaults?.manifest?.sbt?.bin ?? 'sbt',
       cwd,
-      sbtOpts: parseBuildToolOpts(sockJson.defaults?.manifest?.sbt?.sbtOpts),
+      sbtOpts: parseBuildToolOpts(sockJson.defaults?.manifest?.sbt?.sbtOpts ?? undefined),
       verbose: Boolean(sockJson.defaults?.manifest?.sbt?.verbose)
     };
     // Socket facts is the default; opt into pom generation with
@@ -6293,6 +6531,7 @@ async function generateAutoManifest({
         excludePaths,
         ignoreUnresolved: Boolean(sockJson.defaults?.manifest?.sbt?.ignoreUnresolved),
         includeConfigs: sockJson.defaults?.manifest?.sbt?.includeConfigs ?? '',
+        javaHome: sockJson.defaults?.manifest?.sbt?.javaHome ?? undefined,
         sidecarAcc,
         tmpDir,
         withFiles: computeArtifactsSidecar
@@ -6314,7 +6553,7 @@ async function generateAutoManifest({
       bin: sockJson.defaults?.manifest?.gradle?.bin ? path.resolve(cwd, sockJson.defaults.manifest.gradle.bin) : resolveBuildToolBin('gradle', cwd),
       cwd,
       verbose: Boolean(sockJson.defaults?.manifest?.gradle?.verbose),
-      gradleOpts: parseBuildToolOpts(sockJson.defaults?.manifest?.gradle?.gradleOpts)
+      gradleOpts: parseBuildToolOpts(sockJson.defaults?.manifest?.gradle?.gradleOpts ?? undefined)
     };
     // Socket facts is the default; opt into pom generation with
     // `defaults.manifest.gradle.facts: false` in socket.json.
@@ -6327,6 +6566,7 @@ async function generateAutoManifest({
         excludePaths,
         ignoreUnresolved: Boolean(sockJson.defaults?.manifest?.gradle?.ignoreUnresolved),
         includeConfigs: sockJson.defaults?.manifest?.gradle?.includeConfigs ?? '',
+        javaHome: sockJson.defaults?.manifest?.gradle?.javaHome ?? undefined,
         sidecarAcc,
         withFiles: computeArtifactsSidecar
       });
@@ -6349,7 +6589,8 @@ async function generateAutoManifest({
       excludePaths,
       ignoreUnresolved: Boolean(sockJson.defaults?.manifest?.maven?.ignoreUnresolved),
       includeConfigs: sockJson.defaults?.manifest?.maven?.includeConfigs ?? '',
-      mavenOpts: parseBuildToolOpts(sockJson.defaults?.manifest?.maven?.mavenOpts),
+      javaHome: sockJson.defaults?.manifest?.maven?.javaHome ?? undefined,
+      mavenOpts: parseBuildToolOpts(sockJson.defaults?.manifest?.maven?.mavenOpts ?? undefined),
       sidecarAcc,
       verbose: Boolean(sockJson.defaults?.manifest?.maven?.verbose),
       withFiles: computeArtifactsSidecar
@@ -6780,7 +7021,7 @@ async function handleCi(autoManifest) {
   });
 }
 
-const config$m = {
+const config$n = {
   commandName: 'ci',
   description: 'Alias for `socket scan create --report` (creates report and exits with error if unhealthy)',
   hidden: false,
@@ -6798,7 +7039,7 @@ const config$m = {
       $ ${command} [options]
 
     Options
-      ${utils.getFlagListOutput(config$m.flags)}
+      ${utils.getFlagListOutput(config$n.flags)}
 
     This command is intended to use in CI runs to allow automated systems to
     accept or reject a current build. It will use the default org of the
@@ -6816,16 +7057,16 @@ const config$m = {
   `
 };
 const cmdCI = {
-  description: config$m.description,
-  hidden: config$m.hidden,
-  run: run$S
+  description: config$n.description,
+  hidden: config$n.hidden,
+  run: run$T
 };
-async function run$S(argv, importMeta, {
+async function run$T(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$m,
+    config: config$n,
     parentName,
     importMeta
   });
@@ -7068,9 +7309,9 @@ const hidden$v = false;
 const cmdConfigAuto = {
   description: description$D,
   hidden: hidden$v,
-  run: run$R
+  run: run$S
 };
-async function run$R(argv, importMeta, {
+async function run$S(argv, importMeta, {
   parentName
 }) {
   const config = {
@@ -7186,7 +7427,7 @@ async function handleConfigGet({
   await outputConfigGet(key, result, outputKind);
 }
 
-const config$l = {
+const config$m = {
   commandName: 'get',
   description: 'Get the value of a local CLI config item',
   hidden: false,
@@ -7216,16 +7457,16 @@ ${utils.getSupportedConfigEntries().map(({
   `
 };
 const cmdConfigGet = {
-  description: config$l.description,
-  hidden: config$l.hidden,
-  run: run$Q
+  description: config$m.description,
+  hidden: config$m.hidden,
+  run: run$R
 };
-async function run$Q(argv, importMeta, {
+async function run$R(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$l,
+    config: config$m,
     importMeta,
     parentName
   });
@@ -7327,7 +7568,7 @@ async function outputConfigList({
   }
 }
 
-const config$k = {
+const config$l = {
   commandName: 'list',
   description: 'Show all local CLI config items and their values',
   hidden: false,
@@ -7352,16 +7593,16 @@ const config$k = {
   `
 };
 const cmdConfigList = {
-  description: config$k.description,
-  hidden: config$k.hidden,
-  run: run$P
+  description: config$l.description,
+  hidden: config$l.hidden,
+  run: run$Q
 };
-async function run$P(argv, importMeta, {
+async function run$Q(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$k,
+    config: config$l,
     importMeta,
     parentName
   });
@@ -7451,9 +7692,9 @@ const hidden$u = false;
 const cmdConfigSet = {
   description: description$C,
   hidden: hidden$u,
-  run: run$O
+  run: run$P
 };
-async function run$O(argv, importMeta, {
+async function run$P(argv, importMeta, {
   parentName
 }) {
   const config = {
@@ -7578,9 +7819,9 @@ const hidden$t = false;
 const cmdConfigUnset = {
   description: description$B,
   hidden: hidden$t,
-  run: run$N
+  run: run$O
 };
-async function run$N(argv, importMeta, {
+async function run$O(argv, importMeta, {
   parentName
 }) {
   const config = {
@@ -8880,7 +9121,7 @@ const hidden$s = false;
 const cmdFix = {
   description: description$z,
   hidden: hidden$s,
-  run: run$M
+  run: run$N
 };
 const generalFlags$2 = {
   autopilot: {
@@ -9055,7 +9296,7 @@ const hiddenFlags = {
     hidden: true
   }
 };
-async function run$M(argv, importMeta, {
+async function run$N(argv, importMeta, {
   parentName
 }) {
   const config = {
@@ -9384,7 +9625,7 @@ async function handleInstallCompletion(targetName) {
   await outputInstallCompletion(result);
 }
 
-const config$j = {
+const config$k = {
   commandName: 'completion',
   description: 'Install bash completion for Socket CLI',
   hidden: false,
@@ -9421,16 +9662,16 @@ const config$j = {
   `
 };
 const cmdInstallCompletion = {
-  description: config$j.description,
-  hidden: config$j.hidden,
-  run: run$L
+  description: config$k.description,
+  hidden: config$k.hidden,
+  run: run$M
 };
-async function run$L(argv, importMeta, {
+async function run$M(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$j,
+    config: config$k,
     parentName,
     importMeta
   });
@@ -9487,7 +9728,7 @@ async function handleCmdJson(cwd) {
   await outputCmdJson(cwd);
 }
 
-const config$i = {
+const config$j = {
   commandName: 'json',
   description: `Display the \`${constants.SOCKET_JSON}\` that would be applied for target folder`,
   hidden: true,
@@ -9506,16 +9747,16 @@ const config$i = {
   `
 };
 const cmdJson = {
-  description: config$i.description,
-  hidden: config$i.hidden,
-  run: run$K
+  description: config$j.description,
+  hidden: config$j.hidden,
+  run: run$L
 };
-async function run$K(argv, importMeta, {
+async function run$L(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$i,
+    config: config$j,
     parentName,
     importMeta
   });
@@ -9670,9 +9911,9 @@ const hidden$r = false;
 const cmdLogin = {
   description: description$x,
   hidden: hidden$r,
-  run: run$J
+  run: run$K
 };
-async function run$J(argv, importMeta, {
+async function run$K(argv, importMeta, {
   parentName
 }) {
   const config = {
@@ -9750,7 +9991,7 @@ function attemptLogout() {
   }
 }
 
-const config$h = {
+const config$i = {
   commandName: 'logout',
   description: 'Socket API logout',
   hidden: false,
@@ -9768,16 +10009,16 @@ const config$h = {
   `
 };
 const cmdLogout = {
-  description: config$h.description,
-  hidden: config$h.hidden,
-  run: run$I
+  description: config$i.description,
+  hidden: config$i.hidden,
+  run: run$J
 };
-async function run$I(argv, importMeta, {
+async function run$J(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$h,
+    config: config$i,
     importMeta,
     parentName
   });
@@ -10090,7 +10331,7 @@ const yargsConfig = {
   'usages-slices-file' // hidden
   ]
 };
-const config$g = {
+const config$h = {
   commandName: 'cdxgen',
   description: 'Run cdxgen for SBOM generation',
   hidden: false,
@@ -10100,11 +10341,11 @@ const config$g = {
   help: () => ''
 };
 const cmdManifestCdxgen = {
-  description: config$g.description,
-  hidden: config$g.hidden,
-  run: run$H
+  description: config$h.description,
+  hidden: config$h.hidden,
+  run: run$I
 };
-async function run$H(argv, importMeta, context) {
+async function run$I(argv, importMeta, context) {
   const {
     parentName
   } = {
@@ -10114,7 +10355,7 @@ async function run$H(argv, importMeta, context) {
   const cli = utils.meowOrExit({
     // Don't let meow take over --help.
     argv: argv.filter(a => !utils.isHelpFlag(a)),
-    config: config$g,
+    config: config$h,
     importMeta,
     parentName
   });
@@ -11153,7 +11394,7 @@ async function buildSpokeTagLookup(reached, queryOpts, verbose) {
   return lookup;
 }
 
-const config$f = {
+const config$g = {
   commandName: 'bazel',
   description: '[beta] Bazel SBOM support — generate manifest files for a Bazel project (Maven, PyPI)',
   hidden: false,
@@ -11237,9 +11478,9 @@ const config$f = {
 // shorter default lives in extract_bazel_to_maven.mts.
 const EXPLICIT_PER_REPO_TIMEOUT_MS = 120_000;
 const cmdManifestBazel = {
-  description: config$f.description,
-  hidden: config$f.hidden,
-  run: run$G
+  description: config$g.description,
+  hidden: config$g.hidden,
+  run: run$H
 };
 // Pure outcome-matrix evaluator. Exported so dispatcher behavior can be
 // unit-tested without spawning the CLI binary. Throws InputError on
@@ -11323,12 +11564,12 @@ function pypiOutcome(result) {
     status: 'hardFailure'
   };
 }
-async function run$G(argv, importMeta, {
+async function run$H(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$f,
+    config: config$g,
     importMeta,
     parentName
   });
@@ -11416,7 +11657,7 @@ async function run$G(argv, importMeta, {
     }
   }
   if (verbose) {
-    logger.logger.group('- ', parentName, config$f.commandName, ':');
+    logger.logger.group('- ', parentName, config$g.commandName, ':');
     logger.logger.group('- flags:', cli.flags);
     logger.logger.groupEnd();
     logger.logger.log('- input:', cli.input);
@@ -11493,136 +11734,29 @@ async function run$G(argv, importMeta, {
   evaluateEcosystemOutcomes(outcomes, wasExplicitEcosystemSelection);
 }
 
-const reachabilityFlags = {
-  dynamicSbomInference: {
-    type: 'boolean',
-    default: false,
-    hidden: true,
-    description: 'Internal: enables dynamic SBOM inference for full application reachability analysis. Passes --maven-use-only-root-socket-facts to Coana and implies --auto-manifest.'
-  },
-  reachVersion: {
-    type: 'string',
-    description: `Override the version of @coana-tech/cli used for reachability analysis. Default: ${constants.default.ENV.INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION}.`
-  },
-  reachAnalysisMemoryLimit: {
-    type: 'string',
-    default: '8192',
-    description: 'The maximum memory for the reachability analysis as a whole number optionally followed by MB or GB (e.g. 512MB, 8GB). The default is 8GB.'
-  },
-  reachAnalysisTimeout: {
+// Manifest-scoped variant of `../scan/reachability-flags.mts`'s
+// `excludePathsFlag`: description avoids "scan"/reachability wording since
+// these commands only ever generate a manifest/facts file.
+const excludePathsFlag$1 = {
+  excludePaths: {
     type: 'string',
-    default: '',
-    description: 'Set the timeout for the reachability analysis as a whole number optionally followed by s, m or h (e.g. 90s, 10m, 1h). Defaults to 10m. Split analysis runs may cause the total scan time to exceed this timeout significantly.'
-  },
-  reachConcurrency: {
-    type: 'number',
-    default: 1,
-    description: 'Set the maximum number of concurrent reachability analysis runs. It is recommended to choose a concurrency level that ensures each analysis run has at least the --reach-analysis-memory-limit amount of memory available.'
-  },
-  reachContinueOnAnalysisErrors: {
-    type: 'boolean',
-    default: false,
-    description: 'Continue reachability analysis when errors occur (timeouts, OOM, parse errors, etc.), falling back to precomputed reachability results. By default, the CLI halts on analysis errors.'
-  },
-  reachContinueOnInstallErrors: {
-    type: 'boolean',
-    default: false,
-    description: 'Continue reachability analysis when package installation fails, falling back to precomputed reachability results. By default, the CLI halts on installation errors.'
-  },
-  reachContinueOnMissingLockFiles: {
-    type: 'boolean',
-    default: false,
-    description: 'Continue reachability analysis when a Gradle or SBT project is missing its lock file (or version catalog / pre-generated SBOM). By default, the CLI halts.'
-  },
-  reachContinueOnNoSourceFiles: {
-    type: 'boolean',
-    default: false,
-    description: 'Continue reachability analysis when a workspace contains no source files for its ecosystem. By default, the CLI halts.'
-  },
-  reachDisableExternalToolChecks: {
-    type: 'boolean',
-    default: false,
-    description: 'Disable external tool checks during reachability analysis.'
-  },
-  reachDebug: {
-    type: 'boolean',
-    default: false,
-    description: 'Enable debug mode for reachability analysis. Provides verbose logging from the reachability CLI.'
-  },
-  reachDetailedAnalysisLogFile: {
-    type: 'boolean',
-    default: false,
-    description: 'A log file with detailed analysis logs is written to root of each analyzed workspace.'
-  },
-  reachDisableAnalytics: {
-    type: 'boolean',
-    default: false,
-    description: 'Disable reachability analytics sharing with Socket. Also disables caching-based optimizations.'
-  },
-  reachDisableAnalysisSplitting: {
-    type: 'boolean',
-    default: false,
-    hidden: true,
-    description: 'Deprecated: Analysis splitting is now disabled by default. This flag is a no-op.'
-  },
-  reachEnableAnalysisSplitting: {
-    type: 'boolean',
-    default: false,
-    description: 'Allow the reachability analysis to partition CVEs into buckets that are processed in separate analysis runs. May improve accuracy, but not recommended by default.'
-  },
-  reachEcosystems: {
-    type: 'string',
-    isMultiple: true,
-    description: `List of ecosystems to conduct reachability analysis on, as either a comma separated value or as multiple flags. Supported: ${utils.getReachabilityEcosystemChoices().join(', ')}. Defaults to all supported ecosystems.`
-  },
-  reachExcludePaths: {
-    type: 'string',
-    isMultiple: true,
-    hidden: true,
-    description: 'Deprecated: use --exclude-paths instead. List of paths to exclude from reachability analysis, as either a comma separated value or as multiple flags.'
-  },
-  reachLazyMode: {
-    type: 'boolean',
-    default: false,
-    description: 'Enable lazy mode for reachability analysis.',
-    hidden: true
-  },
-  reachRetainFactsFile: {
-    type: 'boolean',
-    default: false,
-    description: 'Keep the `.socket.facts.json` reachability report that the analysis writes to the scan directory instead of deleting it after a successful scan. IMPORTANT: you must delete this file before running a fresh full application reachability scan. A stale `.socket.facts.json` left in place is picked up as a pre-generated input and silently overrides fresh analysis, so the new scan results will not be reliable.'
-  },
-  reachSkipCache: {
-    type: 'boolean',
-    default: false,
-    description: 'Skip caching-based optimizations. By default, the reachability analysis will use cached configurations from previous runs to speed up the analysis.'
-  },
-  reachUseOnlyPregeneratedSboms: {
-    type: 'boolean',
-    default: false,
-    description: 'When using this option, the scan is created based only on pre-generated CDX and SPDX files in your project.'
-  }
-};
-const excludePathsFlag = {
-  excludePaths: {
-    type: 'string',
-    isMultiple: true,
-    description: 'List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (`--cwd` if set), not the reachability target: `tests` matches only `<cwd>/tests`; use `**/tests` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags.'
-  }
-};
-
-const config$e = {
-  commandName: 'auto',
-  description: 'Auto-detect build and attempt to generate manifest file',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    ...excludePathsFlag,
-    verbose: {
-      type: 'boolean',
-      default: false,
-      description: 'Enable debug output (only for auto itself; sub-steps need to have it pre-configured), may help when running into errors'
-    }
+    isMultiple: true,
+    description: 'List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (`--cwd` if set): `tests` matches only `<cwd>/tests`; use `**/tests` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags.'
+  }
+};
+
+const config$f = {
+  commandName: 'auto',
+  description: 'Auto-detect build and attempt to generate manifest file',
+  hidden: false,
+  flags: {
+    ...flags.commonFlags,
+    ...excludePathsFlag$1,
+    verbose: {
+      type: 'boolean',
+      default: false,
+      description: 'Enable debug output (only for auto itself; sub-steps need to have it pre-configured), may help when running into errors'
+    }
   },
   help: (command, config) => `
     Usage
@@ -11645,16 +11779,16 @@ const config$e = {
   `
 };
 const cmdManifestAuto = {
-  description: config$e.description,
-  hidden: config$e.hidden,
-  run: run$F
+  description: config$f.description,
+  hidden: config$f.hidden,
+  run: run$G
 };
-async function run$F(argv, importMeta, {
+async function run$G(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$e,
+    config: config$f,
     importMeta,
     parentName
   });
@@ -11672,7 +11806,7 @@ async function run$F(argv, importMeta, {
   cwd = path.resolve(process.cwd(), cwd);
   const outputKind = utils.getOutputKind(json, markdown);
   if (verbose) {
-    logger.logger.group('- ', parentName, config$e.commandName, ':');
+    logger.logger.group('- ', parentName, config$f.commandName, ':');
     logger.logger.group('- flags:', cli.flags);
     logger.logger.groupEnd();
     logger.logger.log('- input:', cli.input);
@@ -11710,7 +11844,7 @@ async function run$F(argv, importMeta, {
   logger.logger.success(`Finished. Should have attempted to generate manifest files for ${detected.count} targets.`);
 }
 
-const config$d = {
+const config$e = {
   commandName: 'conda',
   description: `[beta] Convert a Conda ${constants.ENVIRONMENT_YML} file to a python ${constants.REQUIREMENTS_TXT}`,
   hidden: false,
@@ -11763,16 +11897,16 @@ const config$d = {
   `
 };
 const cmdManifestConda = {
-  description: config$d.description,
-  hidden: config$d.hidden,
-  run: run$E
+  description: config$e.description,
+  hidden: config$e.hidden,
+  run: run$F
 };
-async function run$E(argv, importMeta, {
+async function run$F(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$d,
+    config: config$e,
     importMeta,
     parentName
   });
@@ -11830,7 +11964,7 @@ async function run$E(argv, importMeta, {
     verbose = false;
   }
   if (verbose) {
-    logger.logger.group('- ', parentName, config$d.commandName, ':');
+    logger.logger.group('- ', parentName, config$e.commandName, ':');
     logger.logger.group('- flags:', cli.flags);
     logger.logger.groupEnd();
     logger.logger.log('- target:', cwd);
@@ -11866,260 +12000,481 @@ async function run$E(argv, importMeta, {
   });
 }
 
-const config$c = {
-  commandName: 'gradle',
-  description: '[beta] Generate a Socket facts file (or `pom.xml` with --pom) for a Gradle/Java/Kotlin/etc project',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    bin: {
-      type: 'string',
-      description: 'Location of the gradle binary to use, default: ./gradlew if present, else gradle on PATH'
-    },
-    facts: {
-      type: 'boolean',
-      description: 'Emit a Socket facts JSON file (`.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead'
-    },
-    pom: {
-      type: 'boolean',
-      description: 'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`.socket.facts.json`)'
-    },
-    includeConfigs: {
-      type: 'string',
-      description: 'When generating facts: comma-separated glob patterns matched against Gradle configuration names (case-sensitive; `*`, `?`, and `[...]` wildcards). Only configurations matching at least one pattern are resolved. e.g. `*CompileClasspath,*RuntimeClasspath`. Default: every resolvable configuration'
-    },
-    excludeConfigs: {
-      type: 'string',
-      description: 'When generating facts: comma-separated glob patterns; Gradle configurations matching any pattern are skipped (applied after --include-configs)'
-    },
-    ...excludePathsFlag,
-    ignoreUnresolved: {
-      type: 'boolean',
-      description: 'When generating facts: warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file)'
-    },
-    gradleOpts: {
-      type: 'string',
-      description: 'Additional options to pass on to ./gradlew, see `./gradlew --help`'
-    },
-    verbose: {
-      type: 'boolean',
-      description: 'Print debug messages'
-    }
-  },
-  help: (command, config) => `
-    Usage
-      $ ${command} [options] [CWD=.]
-
-    Options
-      ${utils.getFlagListOutput(config.flags)}
-
-    By default, emits a single \`.socket.facts.json\` describing the resolved
-    dependency graph of the whole build, using gradle (preferably your local
-    \`gradlew\`). An unresolved dependency is a fatal error. You can pass
-    --include-configs / --exclude-configs (comma-separated glob patterns) to
-    control which configurations are resolved (e.g.
-    --include-configs=\`*CompileClasspath,*RuntimeClasspath\`), and
-    --ignore-unresolved to warn on unresolved dependencies instead of failing.
-
-    Pass --pom to instead generate \`pom.xml\` manifest files via gradle (one per
-    task). The \`pom.xml\` is a manifest file similar to \`package.json\` for npm
-    (or ${constants.REQUIREMENTS_TXT} for PyPi), but specifically for Maven, which is
-    Java's dependency repository. Caveats of the \`pom.xml\` conversion:
-
-    - each task generates its own xml file (one per task by default)
-
-    - certain features may not translate well into the xml; reach out if
-      something you need is missing
-
-    - it works with your \`gradlew\` from your repo and local settings and config
-
-    Support is beta. Please report issues or give us feedback on what's missing.
-
-    Examples
+const BUILD_TOOLS = ['gradle', 'maven', 'sbt'];
 
-      $ ${command} .
-      $ ${command} --pom .
-      $ ${command} --bin=../gradlew .
-  `
+// One glob-suffix set per ecosystem's build-descriptor marker(s); `settings.gradle(.kts)`
+// covers Kotlin-DSL roots that have no root `build.gradle`.
+const MARKERS_BY_TOOL = {
+  __proto__: null,
+  gradle: ['build.gradle', 'build.gradle.kts', 'settings.gradle', 'settings.gradle.kts'],
+  maven: ['pom.xml'],
+  sbt: ['build.sbt']
 };
-const cmdManifestGradle = {
-  description: config$c.description,
-  hidden: config$c.hidden,
-  run: run$D
+const TOOL_BY_MARKER = {
+  __proto__: null
 };
-async function run$D(argv, importMeta, {
-  parentName
-}) {
-  const cli = utils.meowOrExit({
-    argv,
-    config: config$c,
-    importMeta,
-    parentName
-  });
-  const {
-    json = false,
-    markdown = false
-  } = cli.flags;
-  const dryRun = !!cli.flags['dryRun'];
-
-  // TODO: Implement json/md further.
-  const outputKind = utils.getOutputKind(json, markdown);
-  let [cwd = '.'] = cli.input;
-  // Note: path.resolve vs .join:
-  // If given path is absolute then cwd should not affect it.
-  cwd = path.resolve(process.cwd(), cwd);
-  const sockJson = utils.readOrDefaultSocketJson(cwd);
-  debug.debugFn('inspect', `override: ${constants.SOCKET_JSON} gradle`, sockJson?.defaults?.manifest?.gradle);
-  let {
-    bin,
-    excludeConfigs,
-    facts,
-    gradleOpts,
-    ignoreUnresolved,
-    includeConfigs,
-    verbose
-  } = cli.flags;
+for (const tool of BUILD_TOOLS) {
+  for (const marker of MARKERS_BY_TOOL[tool]) {
+    TOOL_BY_MARKER[marker] = tool;
+  }
+}
 
-  // Set defaults for any flag/arg that is not given. Check socket.json first.
-  if (!bin) {
-    if (sockJson.defaults?.manifest?.gradle?.bin) {
-      bin = sockJson.defaults?.manifest?.gradle?.bin;
-      logger.logger.info(`Using default --bin from ${constants.SOCKET_JSON}:`, bin);
-    } else {
-      // Prefer the project's ./gradlew wrapper, else `gradle` on PATH.
-      bin = resolveBuildToolBin('gradle', cwd);
+// A disabled ecosystem is skipped entirely by the glob scan below, so a
+// nested socket.json re-enabling it would never even be searched for. Callers
+// that need the cascade (not just the root file) to decide skip vs. include
+// must strip `disabled` here first, and let their own per-directory cascade
+// check apply it instead.
+function withoutDisabledFlags(sockJson) {
+  const manifest = sockJson.defaults?.manifest;
+  if (!manifest) {
+    return sockJson;
+  }
+  const stripped = {
+    ...manifest
+  };
+  for (const tool of BUILD_TOOLS) {
+    const section = manifest[tool];
+    if (section?.disabled) {
+      stripped[tool] = {
+        ...section,
+        disabled: false
+      };
     }
   }
-  if (!gradleOpts) {
-    if (sockJson.defaults?.manifest?.gradle?.gradleOpts) {
-      gradleOpts = sockJson.defaults?.manifest?.gradle?.gradleOpts;
-      logger.logger.info(`Using default --gradle-opts from ${constants.SOCKET_JSON}:`, gradleOpts);
-    } else {
-      gradleOpts = '';
+  return {
+    ...sockJson,
+    defaults: {
+      ...sockJson.defaults,
+      manifest: stripped
     }
+  };
+}
+async function realpathOrResolved(dir) {
+  try {
+    return await fs$1.promises.realpath(dir);
+  } catch {
+    return path.resolve(dir);
   }
-  if (verbose === undefined) {
-    if (sockJson.defaults?.manifest?.gradle?.verbose !== undefined) {
-      verbose = sockJson.defaults?.manifest?.gradle?.verbose;
-      logger.logger.info(`Using default --verbose from ${constants.SOCKET_JSON}:`, verbose);
-    } else {
-      verbose = false;
+}
+function sortByDepthThenPath(dirs, cwd) {
+  return [...dirs].sort((a, b) => {
+    const relA = path.relative(cwd, a);
+    const relB = path.relative(cwd, b);
+    const depthA = relA === '' ? 0 : relA.split(path.sep).length;
+    const depthB = relB === '' ? 0 : relB.split(path.sep).length;
+    if (depthA !== depthB) {
+      return depthA - depthB;
     }
+    return relA < relB ? -1 : relA > relB ? 1 : 0;
+  });
+}
+
+// Depth-sorted (root-most first) so the caller, using each build root's
+// `subprojectDir` facts, visits a reactor root before its own members and can
+// skip subprojects a parent root already covers.
+async function findBuildToolCandidates({
+  cwd,
+  excludePaths,
+  sockJson
+}) {
+  const enabledTools = BUILD_TOOLS.filter(tool => !sockJson.defaults?.manifest?.[tool]?.disabled);
+  const result = new Map();
+  if (!enabledTools.length) {
+    return result;
   }
-  if (facts === undefined) {
-    if (sockJson.defaults?.manifest?.gradle?.facts !== undefined) {
-      facts = sockJson.defaults?.manifest?.gradle?.facts;
-      logger.logger.info(`Using default --facts from ${constants.SOCKET_JSON}:`, facts);
-    } else {
-      // Socket facts generation is the default; pass --pom to generate poms.
-      facts = true;
+  const patterns = enabledTools.flatMap(tool => MARKERS_BY_TOOL[tool].map(marker => `**/${marker}`));
+  const additionalIgnores = (excludePaths ?? []).flatMap(excludePathToScanIgnores);
+  const hits = await utils.globWithGitIgnore(patterns, {
+    absolute: true,
+    additionalIgnores,
+    cwd
+  });
+  const dirSetsByTool = new Map(enabledTools.map(tool => [tool, new Set()]));
+  const resolvedHits = await Promise.all(hits.map(async hit => ({
+    dir: await realpathOrResolved(path.dirname(hit)),
+    tool: TOOL_BY_MARKER[path.basename(hit)]
+  })));
+  for (const {
+    dir,
+    tool
+  } of resolvedHits) {
+    if (tool) {
+      dirSetsByTool.get(tool)?.add(dir);
     }
   }
-  // --pom opts into legacy pom.xml generation. It overrides the facts default
-  // (and the socket.json default) but conflicts with an explicit --facts.
-  if (cli.flags['pom']) {
-    if (cli.flags['facts'] !== undefined) {
-      logger.logger.warn('The `--facts` and `--pom` options are mutually exclusive; generating Socket facts.');
-    } else {
-      facts = false;
-    }
+  const realCwd = await realpathOrResolved(cwd);
+  for (const tool of enabledTools) {
+    result.set(tool, sortByDepthThenPath([...(dirSetsByTool.get(tool) ?? [])], realCwd));
   }
-  if (includeConfigs === undefined) {
-    if (sockJson.defaults?.manifest?.gradle?.includeConfigs !== undefined) {
-      includeConfigs = sockJson.defaults?.manifest?.gradle?.includeConfigs;
-      logger.logger.info(`Using default --include-configs from ${constants.SOCKET_JSON}:`, includeConfigs);
-    } else {
-      includeConfigs = '';
-    }
+  return result;
+}
+
+// A cascaded (not just root-level) disabled additionally skips this one build
+// root here, on top of its existing root-only ecosystem-wide meaning for
+// auto/gradle/etc. facts:false has no pom-mode equivalent here (facts-only),
+// so it skips too.
+function getSkipReason(disabled, facts) {
+  if (disabled) {
+    return 'defaults.manifest.<ecosystem>.disabled is true';
   }
-  if (excludeConfigs === undefined) {
-    if (sockJson.defaults?.manifest?.gradle?.excludeConfigs !== undefined) {
-      excludeConfigs = sockJson.defaults?.manifest?.gradle?.excludeConfigs;
-      logger.logger.info(`Using default --exclude-configs from ${constants.SOCKET_JSON}:`, excludeConfigs);
-    } else {
-      excludeConfigs = '';
-    }
+  if (facts === false) {
+    return 'defaults.manifest.<ecosystem>.facts is false (pom mode)';
   }
-  if (ignoreUnresolved === undefined) {
-    if (sockJson.defaults?.manifest?.gradle?.ignoreUnresolved !== undefined) {
-      ignoreUnresolved = sockJson.defaults?.manifest?.gradle?.ignoreUnresolved;
-      logger.logger.info(`Using default --ignore-unresolved from ${constants.SOCKET_JSON}:`, ignoreUnresolved);
-    } else {
-      ignoreUnresolved = false;
+  return undefined;
+}
+// Nearest already-confirmed-disabled ancestor of `dir`, if any - lets the
+// caller shorten `readSocketJsonCascade`'s walk to start there instead of
+// all the way back at `cwd`, without skipping any nested override.
+function nearestDisabledRoot(dir, disabledRoots) {
+  let nearest;
+  for (const root of disabledRoots) {
+    if (dir.startsWith(`${root.dir}${path.sep}`) && (!nearest || root.dir.length > nearest.dir.length)) {
+      nearest = root;
     }
   }
+  return nearest;
+}
 
-  // `--include-configs`, `--exclude-configs`, and `--ignore-unresolved` only
-  // affect facts generation; the pom path has no equivalent knobs. Warn rather
-  // than silently ignore an explicitly-passed flag. (socket.json defaults don't
-  // trip this — only a flag actually present on the command line does.)
-  if (!facts && (cli.flags['includeConfigs'] !== undefined || cli.flags['excludeConfigs'] !== undefined || cli.flags['ignoreUnresolved'] !== undefined)) {
-    logger.logger.warn('The `--include-configs`, `--exclude-configs`, and `--ignore-unresolved` options only apply when generating Socket facts (not with `--pom`); ignoring them.');
+// A wrapper-preferred `bin` default is resolved per-root (`dir`, not `cwd`)
+// since a wrapper script only exists at the actual build root. Exported for
+// reuse by the recursive setup wizard's reactor-coverage pruning.
+function resolveEcosystemConfig(ecosystem, dir, sockJson) {
+  if (ecosystem === 'sbt') {
+    const config = sockJson.defaults?.manifest?.sbt;
+    const bin = config?.bin ?? undefined;
+    return {
+      bin: bin ?? 'sbt',
+      buildOpts: parseBuildToolOpts(config?.sbtOpts ?? undefined),
+      excludeConfigs: config?.excludeConfigs ?? '',
+      ignoreUnresolved: Boolean(config?.ignoreUnresolved),
+      includeConfigs: config?.includeConfigs ?? '',
+      javaHome: config?.javaHome ?? undefined,
+      skipReason: getSkipReason(config?.disabled, config?.facts)
+    };
+  }
+  if (ecosystem === 'gradle') {
+    const config = sockJson.defaults?.manifest?.gradle;
+    const bin = config?.bin ?? undefined;
+    return {
+      bin: bin ? path.resolve(dir, bin) : resolveBuildToolBin('gradle', dir),
+      buildOpts: parseBuildToolOpts(config?.gradleOpts ?? undefined),
+      excludeConfigs: config?.excludeConfigs ?? '',
+      ignoreUnresolved: Boolean(config?.ignoreUnresolved),
+      includeConfigs: config?.includeConfigs ?? '',
+      javaHome: config?.javaHome ?? undefined,
+      skipReason: getSkipReason(config?.disabled, config?.facts)
+    };
+  }
+  const config = sockJson.defaults?.manifest?.maven;
+  const bin = config?.bin ?? undefined;
+  return {
+    bin: bin ?? resolveBuildToolBin('maven', dir),
+    buildOpts: parseBuildToolOpts(config?.mavenOpts ?? undefined),
+    excludeConfigs: config?.excludeConfigs ?? '',
+    ignoreUnresolved: Boolean(config?.ignoreUnresolved),
+    includeConfigs: config?.includeConfigs ?? '',
+    javaHome: config?.javaHome ?? undefined,
+    skipReason: getSkipReason(config?.disabled)
+  };
+}
+
+// Generates one .socket.facts.json per independent gradle/sbt/maven build
+// root under `cwd`. Coverage is tracked per ecosystem via the facts SBOM's
+// own projects[].subprojectDir, not by pruning the whole discovered subtree,
+// so an unrelated nested project a reactor doesn't declare still gets its
+// own invocation. Fail-closed per ecosystem, not globally: a root whose
+// workspace layout can't be determined aborts only that ecosystem's own
+// remaining walk (marking its untried candidates 'aborted'), since coverage
+// is tracked per ecosystem and an unrelated one has nothing to lose from it.
+async function generateRecursiveManifests({
+  cwd,
+  excludePaths,
+  verbose
+}) {
+  const rootSockJson = utils.readOrDefaultSocketJson(cwd);
+  // Candidate dirs come back realpath-resolved (findBuildToolCandidates); cwd
+  // must match or every boundary/relative-path comparison below breaks as
+  // soon as cwd contains a symlink (macOS /tmp -> /private/tmp, etc.).
+  const realCwd = await realpathOrResolved(cwd);
+  // A root-disabled ecosystem must still be scanned for - a nested socket.json
+  // may re-enable it - so the per-directory cascade below, not this scan, is
+  // what actually decides skip vs. include.
+  const candidatesByTool = await findBuildToolCandidates({
+    cwd,
+    excludePaths,
+    sockJson: withoutDisabledFlags(rootSockJson)
+  });
+  const outcomes = [];
+  for (const [ecosystem, dirs] of candidatesByTool) {
+    const covered = new Set();
+    const disabledRoots = [];
+    for (let dirIndex = 0; dirIndex < dirs.length; dirIndex += 1) {
+      const dir = dirs[dirIndex];
+      if (covered.has(dir)) {
+        outcomes.push({
+          dir,
+          ecosystem,
+          status: 'skippedCovered'
+        });
+        continue;
+      }
+      const nearestRoot = nearestDisabledRoot(dir, disabledRoots);
+      const sockJson = nearestRoot ? utils.readSocketJsonCascade(dir, nearestRoot.dir, nearestRoot.sockJson) : utils.readSocketJsonCascade(dir, realCwd, rootSockJson);
+      const {
+        bin,
+        buildOpts,
+        excludeConfigs,
+        ignoreUnresolved,
+        includeConfigs,
+        javaHome,
+        skipReason
+      } = resolveEcosystemConfig(ecosystem, dir, sockJson);
+      if (skipReason) {
+        // Only warn for a genuinely new disabled root, not one already
+        // covered by an ancestor's warning above - otherwise a big disabled
+        // reactor with hundreds of nested poms would spam one warning line
+        // per pom for what's really a single root cause. The aggregate
+        // count still shows up in the final summary either way.
+        if (!nearestRoot) {
+          logger.logger.warn(`Skipping ${dir} (${ecosystem}): ${skipReason}.`);
+        }
+        outcomes.push({
+          dir,
+          ecosystem,
+          status: 'skippedDisabled'
+        });
+        disabledRoots.push({
+          dir,
+          sockJson
+        });
+        continue;
+      }
+      const excludePathsForRoot = projectIgnorePathsToReachExcludePaths(excludePaths, {
+        cwd: realCwd,
+        target: dir
+      });
+
+      // eslint-disable-next-line no-await-in-loop
+      const result = await runManifestFacts({
+        bin,
+        buildOpts,
+        cwd: dir,
+        ecosystem,
+        excludeConfigs,
+        excludePaths: excludePathsForRoot,
+        ignoreUnresolved,
+        includeConfigs,
+        javaHome,
+        verbose
+      });
+      if (result === null) {
+        outcomes.push({
+          dir,
+          ecosystem,
+          status: 'failed'
+        });
+        logger.logger.warn(`Aborting ${ecosystem} discovery: ${dir}'s workspace layout could not be determined, so its remaining build roots cannot be safely classified as covered or independent.`);
+        for (const abortedDir of dirs.slice(dirIndex + 1)) {
+          outcomes.push({
+            dir: abortedDir,
+            ecosystem,
+            status: 'aborted'
+          });
+        }
+        break;
+      }
+      if (!result) {
+        outcomes.push({
+          dir,
+          ecosystem,
+          status: 'empty'
+        });
+        continue;
+      }
+      covered.add(dir);
+      // eslint-disable-next-line no-await-in-loop
+      const resolvedSubprojectDirs = await Promise.all(result.projects.map(project => realpathOrResolved(path.resolve(dir, project.subprojectDir))));
+      for (const subprojectDir of resolvedSubprojectDirs) {
+        covered.add(subprojectDir);
+      }
+      outcomes.push({
+        dir,
+        ecosystem,
+        factsPath: result.factsPath,
+        status: 'generated'
+      });
+    }
   }
   if (verbose) {
-    logger.logger.group('- ', parentName, config$c.commandName, ':');
+    logger.logger.info(`Discovered ${outcomes.length} build-tool candidate(s).`);
+  }
+  return outcomes;
+}
+
+function renderTable(outcomes) {
+  // A covered reactor member is implied by its parent's line above it.
+  return outcomes.filter(o => o.status !== 'skippedCovered').map(o => `- ${o.dir} (${o.ecosystem}): ${o.status}${o.factsPath ? ` -> ${o.factsPath}` : ''}`).join('\n');
+}
+function summarize(outcomes) {
+  const generated = outcomes.filter(o => o.status === 'generated').length;
+  return `Generated ${generated} Socket facts file(s).`;
+}
+async function outputManifestDynamicSbomInference(result, outputKind) {
+  if (!result.ok) {
+    process.exitCode = result.code ?? 1;
+  }
+  if (outputKind === 'json') {
+    logger.logger.log(utils.serializeResultJson(result));
+    return;
+  }
+  if (!result.ok) {
+    logger.logger.fail(utils.failMsgWithBadge(result.message, result.cause));
+    const data = result.data;
+    if (Array.isArray(data)) {
+      const table = renderTable(data);
+      if (table) {
+        logger.logger.log(table);
+      }
+      logger.logger.log(summarize(data));
+    }
+    return;
+  }
+  const table = renderTable(result.data);
+  if (outputKind === 'markdown') {
+    logger.logger.log(['# Dynamic SBOM inference', '', ...(table ? [table, ''] : []), summarize(result.data)].join('\n'));
+    return;
+  }
+  if (table) {
+    logger.logger.log(table);
+  }
+  logger.logger.log(summarize(result.data));
+}
+
+async function handleManifestDynamicSbomInference({
+  cwd,
+  excludePaths,
+  outputKind,
+  verbose
+}) {
+  const outcomes = await generateRecursiveManifests({
+    cwd,
+    excludePaths,
+    verbose
+  });
+  const result = outcomes.some(o => o.status === 'failed') ? {
+    ok: false,
+    code: 1,
+    message: 'One or more build roots failed to generate Socket facts.',
+    data: outcomes
+  } : {
+    ok: true,
+    data: outcomes
+  };
+  await outputManifestDynamicSbomInference(result, outputKind);
+}
+
+const config$d = {
+  commandName: 'dynamic-sbom-inference',
+  description: 'Recursively discover gradle/sbt/maven build roots and generate a Socket facts SBOM for each',
+  // Hidden: `--dynamic-sbom-inference` already names an unrelated, root-only
+  // scan create/reach flag (see reachability-flags.mts). Keep this hidden
+  // until the naming collision between the two is resolved.
+  hidden: true,
+  flags: {
+    ...flags.commonFlags,
+    ...flags.outputFlags,
+    ...excludePathsFlag$1,
+    verbose: {
+      type: 'boolean',
+      default: false,
+      description: 'Print debug messages'
+    }
+  },
+  help: (command, config) => `
+    Usage
+      $ ${command} [options] [CWD=.]
+
+    Recursively walks CWD, discovers independent gradle, sbt, and maven build
+    roots, and generates a Socket facts SBOM (.socket.facts.json) for each,
+    skipping subproject/reactor-module directories a parent build root already
+    covers. Unlike \`socket manifest auto\`, this looks beyond CWD itself.
+
+    Options
+      ${utils.getFlagListOutput(config.flags)}
+
+    Examples
+
+      $ ${command}
+      $ ${command} ./monorepo
+  `
+};
+const cmdManifestDynamicSbomInference = {
+  description: config$d.description,
+  hidden: config$d.hidden,
+  run: run$E
+};
+async function run$E(argv, importMeta, {
+  parentName
+}) {
+  const cli = utils.meowOrExit({
+    argv,
+    config: config$d,
+    importMeta,
+    parentName
+  });
+  const {
+    dryRun,
+    json,
+    markdown,
+    verbose: verboseFlag
+  } = cli.flags;
+  const verbose = !!verboseFlag;
+  let [cwd = '.'] = cli.input;
+  // Note: path.resolve vs .join:
+  // If given path is absolute then cwd should not affect it.
+  cwd = path.resolve(process.cwd(), cwd);
+
+  // This debug block prints to stdout; --json's payload does too, so skip it
+  // here (unlike the other manifest commands, this one supports --json).
+  if (verbose && !json) {
+    logger.logger.group('- ', parentName, config$d.commandName, ':');
     logger.logger.group('- flags:', cli.flags);
     logger.logger.groupEnd();
-    logger.logger.log('- input:', cli.input);
+    logger.logger.log('- target:', cwd);
     logger.logger.groupEnd();
   }
-
-  // TODO: We're not sure it's feasible to parse source file from stdin. We could
-  //       try, store contents in a file in some folder, target that folder... what
-  //       would the file name be?
-
+  const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: cli.input.length <= 1,
     message: 'Can only accept one DIR (make sure to escape spaces!)',
-    fail: 'received ' + cli.input.length
+    fail: `received ${cli.input.length}`
+  }, {
+    nook: true,
+    test: !json || !markdown,
+    message: `The \`${constants.FLAG_JSON}\` and \`${constants.FLAG_MARKDOWN}\` flags can not be used at the same time`,
+    fail: 'bad'
   });
   if (!wasValidInput) {
     return;
   }
-  if (verbose) {
-    logger.logger.group();
-    logger.logger.info('- cwd:', cwd);
-    logger.logger.info('- gradle bin:', bin);
-    logger.logger.groupEnd();
-  }
-  if (dryRun) {
-    logger.logger.log(constants.default.DRY_RUN_BAILING_NOW);
-    return;
-  }
-  const parsedGradleOpts = parseBuildToolOpts(String(gradleOpts || ''));
   const excludePaths = utils.cmdFlagValueToArray(cli.flags['excludePaths']);
   assertValidExcludePaths(excludePaths);
-  if (facts) {
-    await convertGradleToFacts({
-      bin: String(bin),
-      cwd,
-      excludeConfigs: String(excludeConfigs || ''),
-      excludePaths,
-      gradleOpts: parsedGradleOpts,
-      ignoreUnresolved: Boolean(ignoreUnresolved),
-      includeConfigs: String(includeConfigs || ''),
-      verbose: Boolean(verbose)
-    });
+  if (dryRun) {
+    logger.logger.log(constants.default.DRY_RUN_BAILING_NOW);
     return;
   }
-  await convertGradleToMaven({
-    bin: String(bin),
+  await handleManifestDynamicSbomInference({
     cwd,
     excludePaths,
-    gradleOpts: parsedGradleOpts,
-    verbose: Boolean(verbose)
+    outputKind,
+    verbose
   });
 }
 
-// TODO: We may want to dedupe some pieces for all gradle languages. I think it
-//       makes sense to have separate commands for them and I think it makes
-//       sense for the help panels to note the requested language, rather than
-//       `socket manifest kotlin` to print help screens with `gradle` as the
-//       command. Room for improvement.
-const config$b = {
-  commandName: 'kotlin',
-  description: '[beta] Generate a Socket facts file (or `pom.xml` with --pom) for a Kotlin project',
+const config$c = {
+  commandName: 'gradle',
+  description: '[beta] Generate a Socket facts file (or `pom.xml` with --pom) for a Gradle/Java/Kotlin/etc project',
   hidden: false,
   flags: {
     ...flags.commonFlags,
@@ -12143,7 +12498,7 @@ const config$b = {
       type: 'string',
       description: 'When generating facts: comma-separated glob patterns; Gradle configurations matching any pattern are skipped (applied after --include-configs)'
     },
-    ...excludePathsFlag,
+    ...excludePathsFlag$1,
     ignoreUnresolved: {
       type: 'boolean',
       description: 'When generating facts: warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file)'
@@ -12193,17 +12548,17 @@ const config$b = {
       $ ${command} --bin=../gradlew .
   `
 };
-const cmdManifestKotlin = {
-  description: config$b.description,
-  hidden: config$b.hidden,
-  run: run$C
+const cmdManifestGradle = {
+  description: config$c.description,
+  hidden: config$c.hidden,
+  run: run$D
 };
-async function run$C(argv, importMeta, {
+async function run$D(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
     argv,
-    config: config$b,
+    config: config$c,
     importMeta,
     parentName
   });
@@ -12276,16 +12631,16 @@ async function run$C(argv, importMeta, {
     }
   }
   if (includeConfigs === undefined) {
-    if (sockJson.defaults?.manifest?.gradle?.includeConfigs !== undefined) {
-      includeConfigs = sockJson.defaults?.manifest?.gradle?.includeConfigs;
+    if (sockJson.defaults?.manifest?.gradle?.includeConfigs) {
+      includeConfigs = sockJson.defaults.manifest.gradle.includeConfigs;
       logger.logger.info(`Using default --include-configs from ${constants.SOCKET_JSON}:`, includeConfigs);
     } else {
       includeConfigs = '';
     }
   }
   if (excludeConfigs === undefined) {
-    if (sockJson.defaults?.manifest?.gradle?.excludeConfigs !== undefined) {
-      excludeConfigs = sockJson.defaults?.manifest?.gradle?.excludeConfigs;
+    if (sockJson.defaults?.manifest?.gradle?.excludeConfigs) {
+      excludeConfigs = sockJson.defaults.manifest.gradle.excludeConfigs;
       logger.logger.info(`Using default --exclude-configs from ${constants.SOCKET_JSON}:`, excludeConfigs);
     } else {
       excludeConfigs = '';
@@ -12301,12 +12656,14 @@ async function run$C(argv, importMeta, {
   }
 
   // `--include-configs`, `--exclude-configs`, and `--ignore-unresolved` only
-  // affect facts generation; the pom path has no equivalent knobs.
+  // affect facts generation; the pom path has no equivalent knobs. Warn rather
+  // than silently ignore an explicitly-passed flag. (socket.json defaults don't
+  // trip this — only a flag actually present on the command line does.)
   if (!facts && (cli.flags['includeConfigs'] !== undefined || cli.flags['excludeConfigs'] !== undefined || cli.flags['ignoreUnresolved'] !== undefined)) {
     logger.logger.warn('The `--include-configs`, `--exclude-configs`, and `--ignore-unresolved` options only apply when generating Socket facts (not with `--pom`); ignoring them.');
   }
   if (verbose) {
-    logger.logger.group('- ', parentName, config$b.commandName, ':');
+    logger.logger.group('- ', parentName, config$c.commandName, ':');
     logger.logger.group('- flags:', cli.flags);
     logger.logger.groupEnd();
     logger.logger.log('- input:', cli.input);
@@ -12326,10 +12683,12 @@ async function run$C(argv, importMeta, {
   if (!wasValidInput) {
     return;
   }
+  const javaHome = sockJson.defaults?.manifest?.gradle?.javaHome ?? undefined;
   if (verbose) {
     logger.logger.group();
     logger.logger.info('- cwd:', cwd);
     logger.logger.info('- gradle bin:', bin);
+    logger.logger.info('- java home:', javaHome || '(inherited)');
     logger.logger.groupEnd();
   }
   if (dryRun) {
@@ -12348,6 +12707,7 @@ async function run$C(argv, importMeta, {
       gradleOpts: parsedGradleOpts,
       ignoreUnresolved: Boolean(ignoreUnresolved),
       includeConfigs: String(includeConfigs || ''),
+      javaHome,
       verbose: Boolean(verbose)
     });
     return;
@@ -12361,16 +12721,268 @@ async function run$C(argv, importMeta, {
   });
 }
 
-const config$a = {
-  commandName: 'maven',
-  description: '[beta] Generate a Socket facts file from a Maven `pom.xml` project',
-  hidden: false,
-  flags: {
-    ...flags.commonFlags,
-    bin: {
-      type: 'string',
-      description: 'Location of the maven binary to use, default: ./mvnw if present, else mvn on PATH'
-    },
+// TODO: We may want to dedupe some pieces for all gradle languages. I think it
+//       makes sense to have separate commands for them and I think it makes
+//       sense for the help panels to note the requested language, rather than
+//       `socket manifest kotlin` to print help screens with `gradle` as the
+//       command. Room for improvement.
+const config$b = {
+  commandName: 'kotlin',
+  description: '[beta] Generate a Socket facts file (or `pom.xml` with --pom) for a Kotlin project',
+  hidden: false,
+  flags: {
+    ...flags.commonFlags,
+    bin: {
+      type: 'string',
+      description: 'Location of the gradle binary to use, default: ./gradlew if present, else gradle on PATH'
+    },
+    facts: {
+      type: 'boolean',
+      description: 'Emit a Socket facts JSON file (`.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead'
+    },
+    pom: {
+      type: 'boolean',
+      description: 'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`.socket.facts.json`)'
+    },
+    includeConfigs: {
+      type: 'string',
+      description: 'When generating facts: comma-separated glob patterns matched against Gradle configuration names (case-sensitive; `*`, `?`, and `[...]` wildcards). Only configurations matching at least one pattern are resolved. e.g. `*CompileClasspath,*RuntimeClasspath`. Default: every resolvable configuration'
+    },
+    excludeConfigs: {
+      type: 'string',
+      description: 'When generating facts: comma-separated glob patterns; Gradle configurations matching any pattern are skipped (applied after --include-configs)'
+    },
+    ...excludePathsFlag$1,
+    ignoreUnresolved: {
+      type: 'boolean',
+      description: 'When generating facts: warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file)'
+    },
+    gradleOpts: {
+      type: 'string',
+      description: 'Additional options to pass on to ./gradlew, see `./gradlew --help`'
+    },
+    verbose: {
+      type: 'boolean',
+      description: 'Print debug messages'
+    }
+  },
+  help: (command, config) => `
+    Usage
+      $ ${command} [options] [CWD=.]
+
+    Options
+      ${utils.getFlagListOutput(config.flags)}
+
+    By default, emits a single \`.socket.facts.json\` describing the resolved
+    dependency graph of the whole build, using gradle (preferably your local
+    \`gradlew\`). An unresolved dependency is a fatal error. You can pass
+    --include-configs / --exclude-configs (comma-separated glob patterns) to
+    control which configurations are resolved (e.g.
+    --include-configs=\`*CompileClasspath,*RuntimeClasspath\`), and
+    --ignore-unresolved to warn on unresolved dependencies instead of failing.
+
+    Pass --pom to instead generate \`pom.xml\` manifest files via gradle (one per
+    task). The \`pom.xml\` is a manifest file similar to \`package.json\` for npm
+    (or ${constants.REQUIREMENTS_TXT} for PyPi), but specifically for Maven, which is
+    Java's dependency repository. Caveats of the \`pom.xml\` conversion:
+
+    - each task generates its own xml file (one per task by default)
+
+    - certain features may not translate well into the xml; reach out if
+      something you need is missing
+
+    - it works with your \`gradlew\` from your repo and local settings and config
+
+    Support is beta. Please report issues or give us feedback on what's missing.
+
+    Examples
+
+      $ ${command} .
+      $ ${command} --pom .
+      $ ${command} --bin=../gradlew .
+  `
+};
+const cmdManifestKotlin = {
+  description: config$b.description,
+  hidden: config$b.hidden,
+  run: run$C
+};
+async function run$C(argv, importMeta, {
+  parentName
+}) {
+  const cli = utils.meowOrExit({
+    argv,
+    config: config$b,
+    importMeta,
+    parentName
+  });
+  const {
+    json = false,
+    markdown = false
+  } = cli.flags;
+  const dryRun = !!cli.flags['dryRun'];
+
+  // TODO: Implement json/md further.
+  const outputKind = utils.getOutputKind(json, markdown);
+  let [cwd = '.'] = cli.input;
+  // Note: path.resolve vs .join:
+  // If given path is absolute then cwd should not affect it.
+  cwd = path.resolve(process.cwd(), cwd);
+  const sockJson = utils.readOrDefaultSocketJson(cwd);
+  debug.debugFn('inspect', `override: ${constants.SOCKET_JSON} gradle`, sockJson?.defaults?.manifest?.gradle);
+  let {
+    bin,
+    excludeConfigs,
+    facts,
+    gradleOpts,
+    ignoreUnresolved,
+    includeConfigs,
+    verbose
+  } = cli.flags;
+
+  // Set defaults for any flag/arg that is not given. Check socket.json first.
+  if (!bin) {
+    if (sockJson.defaults?.manifest?.gradle?.bin) {
+      bin = sockJson.defaults?.manifest?.gradle?.bin;
+      logger.logger.info(`Using default --bin from ${constants.SOCKET_JSON}:`, bin);
+    } else {
+      // Prefer the project's ./gradlew wrapper, else `gradle` on PATH.
+      bin = resolveBuildToolBin('gradle', cwd);
+    }
+  }
+  if (!gradleOpts) {
+    if (sockJson.defaults?.manifest?.gradle?.gradleOpts) {
+      gradleOpts = sockJson.defaults?.manifest?.gradle?.gradleOpts;
+      logger.logger.info(`Using default --gradle-opts from ${constants.SOCKET_JSON}:`, gradleOpts);
+    } else {
+      gradleOpts = '';
+    }
+  }
+  if (verbose === undefined) {
+    if (sockJson.defaults?.manifest?.gradle?.verbose !== undefined) {
+      verbose = sockJson.defaults?.manifest?.gradle?.verbose;
+      logger.logger.info(`Using default --verbose from ${constants.SOCKET_JSON}:`, verbose);
+    } else {
+      verbose = false;
+    }
+  }
+  if (facts === undefined) {
+    if (sockJson.defaults?.manifest?.gradle?.facts !== undefined) {
+      facts = sockJson.defaults?.manifest?.gradle?.facts;
+      logger.logger.info(`Using default --facts from ${constants.SOCKET_JSON}:`, facts);
+    } else {
+      // Socket facts generation is the default; pass --pom to generate poms.
+      facts = true;
+    }
+  }
+  // --pom opts into legacy pom.xml generation. It overrides the facts default
+  // (and the socket.json default) but conflicts with an explicit --facts.
+  if (cli.flags['pom']) {
+    if (cli.flags['facts'] !== undefined) {
+      logger.logger.warn('The `--facts` and `--pom` options are mutually exclusive; generating Socket facts.');
+    } else {
+      facts = false;
+    }
+  }
+  if (includeConfigs === undefined) {
+    if (sockJson.defaults?.manifest?.gradle?.includeConfigs) {
+      includeConfigs = sockJson.defaults.manifest.gradle.includeConfigs;
+      logger.logger.info(`Using default --include-configs from ${constants.SOCKET_JSON}:`, includeConfigs);
+    } else {
+      includeConfigs = '';
+    }
+  }
+  if (excludeConfigs === undefined) {
+    if (sockJson.defaults?.manifest?.gradle?.excludeConfigs) {
+      excludeConfigs = sockJson.defaults.manifest.gradle.excludeConfigs;
+      logger.logger.info(`Using default --exclude-configs from ${constants.SOCKET_JSON}:`, excludeConfigs);
+    } else {
+      excludeConfigs = '';
+    }
+  }
+  if (ignoreUnresolved === undefined) {
+    if (sockJson.defaults?.manifest?.gradle?.ignoreUnresolved !== undefined) {
+      ignoreUnresolved = sockJson.defaults?.manifest?.gradle?.ignoreUnresolved;
+      logger.logger.info(`Using default --ignore-unresolved from ${constants.SOCKET_JSON}:`, ignoreUnresolved);
+    } else {
+      ignoreUnresolved = false;
+    }
+  }
+
+  // `--include-configs`, `--exclude-configs`, and `--ignore-unresolved` only
+  // affect facts generation; the pom path has no equivalent knobs.
+  if (!facts && (cli.flags['includeConfigs'] !== undefined || cli.flags['excludeConfigs'] !== undefined || cli.flags['ignoreUnresolved'] !== undefined)) {
+    logger.logger.warn('The `--include-configs`, `--exclude-configs`, and `--ignore-unresolved` options only apply when generating Socket facts (not with `--pom`); ignoring them.');
+  }
+  if (verbose) {
+    logger.logger.group('- ', parentName, config$b.commandName, ':');
+    logger.logger.group('- flags:', cli.flags);
+    logger.logger.groupEnd();
+    logger.logger.log('- input:', cli.input);
+    logger.logger.groupEnd();
+  }
+
+  // TODO: We're not sure it's feasible to parse source file from stdin. We could
+  //       try, store contents in a file in some folder, target that folder... what
+  //       would the file name be?
+
+  const wasValidInput = utils.checkCommandInput(outputKind, {
+    nook: true,
+    test: cli.input.length <= 1,
+    message: 'Can only accept one DIR (make sure to escape spaces!)',
+    fail: 'received ' + cli.input.length
+  });
+  if (!wasValidInput) {
+    return;
+  }
+  const javaHome = sockJson.defaults?.manifest?.gradle?.javaHome ?? undefined;
+  if (verbose) {
+    logger.logger.group();
+    logger.logger.info('- cwd:', cwd);
+    logger.logger.info('- gradle bin:', bin);
+    logger.logger.info('- java home:', javaHome || '(inherited)');
+    logger.logger.groupEnd();
+  }
+  if (dryRun) {
+    logger.logger.log(constants.default.DRY_RUN_BAILING_NOW);
+    return;
+  }
+  const parsedGradleOpts = parseBuildToolOpts(String(gradleOpts || ''));
+  const excludePaths = utils.cmdFlagValueToArray(cli.flags['excludePaths']);
+  assertValidExcludePaths(excludePaths);
+  if (facts) {
+    await convertGradleToFacts({
+      bin: String(bin),
+      cwd,
+      excludeConfigs: String(excludeConfigs || ''),
+      excludePaths,
+      gradleOpts: parsedGradleOpts,
+      ignoreUnresolved: Boolean(ignoreUnresolved),
+      includeConfigs: String(includeConfigs || ''),
+      javaHome,
+      verbose: Boolean(verbose)
+    });
+    return;
+  }
+  await convertGradleToMaven({
+    bin: String(bin),
+    cwd,
+    excludePaths,
+    gradleOpts: parsedGradleOpts,
+    verbose: Boolean(verbose)
+  });
+}
+
+const config$a = {
+  commandName: 'maven',
+  description: '[beta] Generate a Socket facts file from a Maven `pom.xml` project',
+  hidden: false,
+  flags: {
+    ...flags.commonFlags,
+    bin: {
+      type: 'string',
+      description: 'Location of the maven binary to use, default: ./mvnw if present, else mvn on PATH'
+    },
     includeConfigs: {
       type: 'string',
       description: 'Comma-separated glob patterns matched against Maven dependency scopes (case-sensitive; `*`, `?`, and `[...]` wildcards). Only scopes matching at least one pattern are resolved. e.g. `compile,runtime`. Default: every scope'
@@ -12379,7 +12991,7 @@ const config$a = {
       type: 'string',
       description: 'Comma-separated glob patterns; Maven scopes matching any pattern are skipped (applied after --include-configs)'
     },
-    ...excludePathsFlag,
+    ...excludePathsFlag$1,
     ignoreUnresolved: {
       type: 'boolean',
       description: 'Warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file)'
@@ -12477,16 +13089,16 @@ async function run$B(argv, importMeta, {
     }
   }
   if (includeConfigs === undefined) {
-    if (sockJson.defaults?.manifest?.maven?.includeConfigs !== undefined) {
-      includeConfigs = sockJson.defaults?.manifest?.maven?.includeConfigs;
+    if (sockJson.defaults?.manifest?.maven?.includeConfigs) {
+      includeConfigs = sockJson.defaults.manifest.maven.includeConfigs;
       logger.logger.info(`Using default --include-configs from ${constants.SOCKET_JSON}:`, includeConfigs);
     } else {
       includeConfigs = '';
     }
   }
   if (excludeConfigs === undefined) {
-    if (sockJson.defaults?.manifest?.maven?.excludeConfigs !== undefined) {
-      excludeConfigs = sockJson.defaults?.manifest?.maven?.excludeConfigs;
+    if (sockJson.defaults?.manifest?.maven?.excludeConfigs) {
+      excludeConfigs = sockJson.defaults.manifest.maven.excludeConfigs;
       logger.logger.info(`Using default --exclude-configs from ${constants.SOCKET_JSON}:`, excludeConfigs);
     } else {
       excludeConfigs = '';
@@ -12524,10 +13136,12 @@ async function run$B(argv, importMeta, {
   if (!wasValidInput) {
     return;
   }
+  const javaHome = sockJson.defaults?.manifest?.maven?.javaHome ?? undefined;
   if (verbose) {
     logger.logger.group();
     logger.logger.info('- cwd:', cwd);
     logger.logger.info('- maven bin:', bin);
+    logger.logger.info('- java home:', javaHome || '(inherited)');
     logger.logger.groupEnd();
   }
   if (dryRun) {
@@ -12544,6 +13158,7 @@ async function run$B(argv, importMeta, {
     excludePaths,
     ignoreUnresolved: Boolean(ignoreUnresolved),
     includeConfigs: String(includeConfigs || ''),
+    javaHome,
     mavenOpts: parsedMavenOpts,
     verbose: Boolean(verbose)
   });
@@ -12575,7 +13190,7 @@ const config$9 = {
       type: 'string',
       description: 'When generating facts: comma-separated glob patterns; sbt configurations matching any pattern are skipped (applied after --include-configs)'
     },
-    ...excludePathsFlag,
+    ...excludePathsFlag$1,
     ignoreUnresolved: {
       type: 'boolean',
       description: 'When generating facts: warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file)'
@@ -12713,16 +13328,16 @@ async function run$A(argv, importMeta, {
     }
   }
   if (includeConfigs === undefined) {
-    if (sockJson.defaults?.manifest?.sbt?.includeConfigs !== undefined) {
-      includeConfigs = sockJson.defaults?.manifest?.sbt?.includeConfigs;
+    if (sockJson.defaults?.manifest?.sbt?.includeConfigs) {
+      includeConfigs = sockJson.defaults.manifest.sbt.includeConfigs;
       logger.logger.info(`Using default --include-configs from ${constants.SOCKET_JSON}:`, includeConfigs);
     } else {
       includeConfigs = '';
     }
   }
   if (excludeConfigs === undefined) {
-    if (sockJson.defaults?.manifest?.sbt?.excludeConfigs !== undefined) {
-      excludeConfigs = sockJson.defaults?.manifest?.sbt?.excludeConfigs;
+    if (sockJson.defaults?.manifest?.sbt?.excludeConfigs) {
+      excludeConfigs = sockJson.defaults.manifest.sbt.excludeConfigs;
       logger.logger.info(`Using default --exclude-configs from ${constants.SOCKET_JSON}:`, excludeConfigs);
     } else {
       excludeConfigs = '';
@@ -12803,11 +13418,13 @@ async function run$A(argv, importMeta, {
   if (!wasValidInput) {
     return;
   }
+  const javaHome = sockJson.defaults?.manifest?.sbt?.javaHome ?? undefined;
   if (verbose) {
     logger.logger.group();
     logger.logger.log('- target:', cwd);
     logger.logger.log('- sbt bin:', bin);
     logger.logger.log('- out:', out);
+    logger.logger.log('- java home:', javaHome || '(inherited)');
     logger.logger.groupEnd();
   }
   if (dryRun) {
@@ -12825,6 +13442,7 @@ async function run$A(argv, importMeta, {
       excludePaths,
       ignoreUnresolved: Boolean(ignoreUnresolved),
       includeConfigs: String(includeConfigs || ''),
+      javaHome,
       sbtOpts: parsedSbtOpts,
       tmpDir,
       verbose: Boolean(verbose)
@@ -12980,7 +13598,7 @@ async function setupManifestConfig(cwd, defaultOnReadError = false) {
       }
     default:
       {
-        result = canceledByUser$1();
+        result = canceledByUser$2();
       }
   }
   if (!result.ok || result.data.canceled) {
@@ -13003,12 +13621,12 @@ async function setupManifestConfig(cwd, defaultOnReadError = false) {
   })) {
     return await utils.writeSocketJson(cwd, sockJson);
   }
-  return canceledByUser$1();
+  return canceledByUser$2();
 }
 async function setupConda(config) {
   const on = await askForEnabled(!config.disabled);
   if (on === undefined) {
-    return canceledByUser$1();
+    return canceledByUser$2();
   } else if (on) {
     delete config.disabled;
   } else {
@@ -13016,7 +13634,7 @@ async function setupConda(config) {
   }
   const infile = await askForInputFile(config.infile || 'environment.yml');
   if (infile === undefined) {
-    return canceledByUser$1();
+    return canceledByUser$2();
   } else if (infile === '-') {
     config.stdin = true;
   } else {
@@ -13029,7 +13647,7 @@ async function setupConda(config) {
   }
   const stdout = await askForStdout(config.stdout);
   if (stdout === undefined) {
-    return canceledByUser$1();
+    return canceledByUser$2();
   } else if (stdout === 'yes') {
     config.stdout = true;
   } else if (stdout === 'no') {
@@ -13040,7 +13658,7 @@ async function setupConda(config) {
   if (!config.stdout) {
     const out = await askForOutputFile(config.outfile || constants.REQUIREMENTS_TXT);
     if (out === undefined) {
-      return canceledByUser$1();
+      return canceledByUser$2();
     } else if (out === '-') {
       config.stdout = true;
     } else {
@@ -13054,23 +13672,43 @@ async function setupConda(config) {
   }
   const verbose = await askForVerboseFlag(config.verbose);
   if (verbose === undefined) {
-    return canceledByUser$1();
+    return canceledByUser$2();
   } else if (verbose === 'yes' || verbose === 'no') {
     config.verbose = verbose === 'yes';
   } else {
     delete config.verbose;
   }
-  return notCanceled$1();
+  return notCanceled$2();
 }
-async function setupGradle(config) {
-  const bin = await askForBin(config.bin || './gradlew');
+async function setupGradle(config,
+// Set by the recursive dynamic-sbom-inference wizard, which has no
+// pom-mode equivalent - skips the facts/pom question entirely.
+{
+  factsOnly = false
+} = {}) {
+  const priorBin = config.bin;
+  const bin = await askForBin(config.bin || '', './gradlew');
   if (bin === undefined) {
-    return canceledByUser$1();
+    return canceledByUser$2();
   } else if (bin) {
     config.bin = bin;
+  } else if (priorBin !== undefined) {
+    config.bin = null;
   } else {
     delete config.bin;
   }
+  const priorJavaHome = config.javaHome;
+  const javaHome = await askForJavaHome(config.javaHome || '');
+  if (javaHome === undefined) {
+    return canceledByUser$2();
+  } else if (javaHome) {
+    config.javaHome = javaHome;
+  } else if (priorJavaHome !== undefined) {
+    config.javaHome = null;
+  } else {
+    delete config.javaHome;
+  }
+  const priorGradleOpts = config.gradleOpts;
   const opts = await prompts.input({
     message: '(--gradle-opts) Enter gradle options to pass through',
     default: config.gradleOpts || '',
@@ -13078,24 +13716,28 @@ async function setupGradle(config) {
     // validate: async string => bool
   });
   if (opts === undefined) {
-    return canceledByUser$1();
+    return canceledByUser$2();
   } else if (opts) {
     config.gradleOpts = opts;
+  } else if (priorGradleOpts !== undefined) {
+    config.gradleOpts = null;
   } else {
     delete config.gradleOpts;
   }
-  const facts = await askForFactsFlag(config.facts);
-  if (facts === undefined) {
-    return canceledByUser$1();
-  } else if (facts === 'yes' || facts === 'no') {
-    config.facts = facts === 'yes';
-  } else {
-    delete config.facts;
+  if (!factsOnly) {
+    const facts = await askForFactsFlag(config.facts);
+    if (facts === undefined) {
+      return canceledByUser$2();
+    } else if (facts === 'yes' || facts === 'no') {
+      config.facts = facts === 'yes';
+    } else {
+      delete config.facts;
+    }
   }
 
   // The config filters and --ignore-unresolved only apply to facts generation
   // (the default); skip them when pom generation (--pom) is selected.
-  if (config.facts !== false) {
+  if (factsOnly || config.facts !== false) {
     const factsOptions = await setupFactsOptions(config);
     if (!factsOptions.ok || factsOptions.data.canceled) {
       return factsOptions;
@@ -13103,32 +13745,49 @@ async function setupGradle(config) {
   }
   const verbose = await askForVerboseFlag(config.verbose);
   if (verbose === undefined) {
-    return canceledByUser$1();
+    return canceledByUser$2();
   } else if (verbose === 'yes' || verbose === 'no') {
     config.verbose = verbose === 'yes';
   } else {
     delete config.verbose;
   }
-  return notCanceled$1();
+  return notCanceled$2();
 }
 async function setupMaven(config) {
-  const bin = await askForBin(config.bin || 'mvn');
+  const priorBin = config.bin;
+  const bin = await askForBin(config.bin || '', 'mvn');
   if (bin === undefined) {
-    return canceledByUser$1();
+    return canceledByUser$2();
   } else if (bin) {
     config.bin = bin;
+  } else if (priorBin !== undefined) {
+    config.bin = null;
   } else {
     delete config.bin;
   }
+  const priorJavaHome = config.javaHome;
+  const javaHome = await askForJavaHome(config.javaHome || '');
+  if (javaHome === undefined) {
+    return canceledByUser$2();
+  } else if (javaHome) {
+    config.javaHome = javaHome;
+  } else if (priorJavaHome !== undefined) {
+    config.javaHome = null;
+  } else {
+    delete config.javaHome;
+  }
+  const priorMavenOpts = config.mavenOpts;
   const opts = await prompts.input({
     message: '(--maven-opts) Enter maven options to pass through',
     default: config.mavenOpts || '',
     required: false
   });
   if (opts === undefined) {
-    return canceledByUser$1();
+    return canceledByUser$2();
   } else if (opts) {
     config.mavenOpts = opts;
+  } else if (priorMavenOpts !== undefined) {
+    config.mavenOpts = null;
   } else {
     delete config.mavenOpts;
   }
@@ -13141,23 +13800,42 @@ async function setupMaven(config) {
   }
   const verbose = await askForVerboseFlag(config.verbose);
   if (verbose === undefined) {
-    return canceledByUser$1();
+    return canceledByUser$2();
   } else if (verbose === 'yes' || verbose === 'no') {
     config.verbose = verbose === 'yes';
   } else {
     delete config.verbose;
   }
-  return notCanceled$1();
+  return notCanceled$2();
 }
-async function setupSbt(config) {
-  const bin = await askForBin(config.bin || 'sbt');
+async function setupSbt(config,
+// See setupGradle's matching parameter for why.
+{
+  factsOnly = false
+} = {}) {
+  const priorBin = config.bin;
+  const bin = await askForBin(config.bin || '', 'sbt');
   if (bin === undefined) {
-    return canceledByUser$1();
+    return canceledByUser$2();
   } else if (bin) {
     config.bin = bin;
+  } else if (priorBin !== undefined) {
+    config.bin = null;
   } else {
     delete config.bin;
   }
+  const priorJavaHome = config.javaHome;
+  const javaHome = await askForJavaHome(config.javaHome || '');
+  if (javaHome === undefined) {
+    return canceledByUser$2();
+  } else if (javaHome) {
+    config.javaHome = javaHome;
+  } else if (priorJavaHome !== undefined) {
+    config.javaHome = null;
+  } else {
+    delete config.javaHome;
+  }
+  const priorSbtOpts = config.sbtOpts;
   const opts = await prompts.input({
     message: '(--sbt-opts) Enter sbt options to pass through',
     default: config.sbtOpts || '',
@@ -13165,28 +13843,32 @@ async function setupSbt(config) {
     // validate: async string => bool
   });
   if (opts === undefined) {
-    return canceledByUser$1();
+    return canceledByUser$2();
   } else if (opts) {
     config.sbtOpts = opts;
+  } else if (priorSbtOpts !== undefined) {
+    config.sbtOpts = null;
   } else {
     delete config.sbtOpts;
   }
-  const facts = await askForFactsFlag(config.facts);
-  if (facts === undefined) {
-    return canceledByUser$1();
-  } else if (facts === 'yes' || facts === 'no') {
-    config.facts = facts === 'yes';
-  } else {
-    delete config.facts;
+  if (!factsOnly) {
+    const facts = await askForFactsFlag(config.facts);
+    if (facts === undefined) {
+      return canceledByUser$2();
+    } else if (facts === 'yes' || facts === 'no') {
+      config.facts = facts === 'yes';
+    } else {
+      delete config.facts;
+    }
   }
 
   // Socket facts is the default. The pom output questions (stdout/outfile)
   // only apply when pom generation (--pom) is explicitly selected; otherwise
   // ask the facts-only options.
-  if (config.facts === false) {
+  if (!factsOnly && config.facts === false) {
     const stdout = await askForStdout(config.stdout);
     if (stdout === undefined) {
-      return canceledByUser$1();
+      return canceledByUser$2();
     } else if (stdout === 'yes') {
       config.stdout = true;
     } else if (stdout === 'no') {
@@ -13197,7 +13879,7 @@ async function setupSbt(config) {
     if (config.stdout !== true) {
       const out = await askForOutputFile(config.outfile || 'sbt.pom.xml');
       if (out === undefined) {
-        return canceledByUser$1();
+        return canceledByUser$2();
       } else if (out === '-') {
         config.stdout = true;
       } else {
@@ -13217,13 +13899,13 @@ async function setupSbt(config) {
   }
   const verbose = await askForVerboseFlag(config.verbose);
   if (verbose === undefined) {
-    return canceledByUser$1();
+    return canceledByUser$2();
   } else if (verbose === 'yes' || verbose === 'no') {
     config.verbose = verbose === 'yes';
   } else {
     delete config.verbose;
   }
-  return notCanceled$1();
+  return notCanceled$2();
 }
 async function askForStdout(defaultValue) {
   return await prompts.select({
@@ -13279,14 +13961,25 @@ async function askForOutputFile(defaultName = '') {
     // validate: async string => bool
   });
 }
-async function askForBin(defaultName = '') {
+
+// `defaultName` must be a prior explicit/cascaded value, never the tool's
+// hardcoded fallback (e.g. `mvn`) - pre-filling that would freeze it into
+// socket.json on a bare Enter. `fallbackHint` is informational text only.
+async function askForBin(defaultName = '', fallbackHint = '') {
   return await prompts.input({
-    message: '(--bin) What should be the command to execute? Usually your build binary.' + (defaultName ? ' (Backspace to leave default)' : ''),
+    message: '(--bin) What should be the command to execute? Usually your build binary.' + (defaultName ? ' (Backspace to leave default)' : fallbackHint ? ` (blank = ${fallbackHint})` : ''),
     default: defaultName,
     required: false
     // validate: async string => bool
   });
 }
+async function askForJavaHome(defaultName = '') {
+  return await prompts.input({
+    message: 'What JDK should this build tool use? Leave blank to use the JDK already on PATH/JAVA_HOME. Supports $VAR/${VAR}.' + (defaultName ? ' (Backspace to leave default)' : ''),
+    default: defaultName,
+    required: false
+  });
+}
 async function askForVerboseFlag(current) {
   return await prompts.select({
     message: '(--verbose) Should this run in verbose mode by default?',
@@ -13348,62 +14041,897 @@ async function askForIgnoreUnresolvedFlag(current) {
 // Prompts for the facts-only options shared by gradle and sbt: the config
 // include/exclude filters and --ignore-unresolved. Mutates `config` in place.
 async function setupFactsOptions(config) {
+  const priorIncludeConfigs = config.includeConfigs;
   const includeConfigs = await prompts.input({
     message: '(--include-configs) Comma-separated config-name globs to resolve (blank = all configurations)',
     default: config.includeConfigs || '',
     required: false
   });
   if (includeConfigs === undefined) {
-    return canceledByUser$1();
+    return canceledByUser$2();
   } else if (includeConfigs) {
     config.includeConfigs = includeConfigs;
+  } else if (priorIncludeConfigs !== undefined) {
+    // Was previously set; clear it explicitly instead of just deleting the
+    // key, so it doesn't silently start inheriting an ancestor's value again.
+    config.includeConfigs = null;
   } else {
     delete config.includeConfigs;
   }
+  const priorExcludeConfigs = config.excludeConfigs;
   const excludeConfigs = await prompts.input({
     message: '(--exclude-configs) Comma-separated config-name globs to skip (blank = none)',
     default: config.excludeConfigs || '',
     required: false
   });
-  if (excludeConfigs === undefined) {
-    return canceledByUser$1();
-  } else if (excludeConfigs) {
-    config.excludeConfigs = excludeConfigs;
-  } else {
-    delete config.excludeConfigs;
+  if (excludeConfigs === undefined) {
+    return canceledByUser$2();
+  } else if (excludeConfigs) {
+    config.excludeConfigs = excludeConfigs;
+  } else if (priorExcludeConfigs !== undefined) {
+    config.excludeConfigs = null;
+  } else {
+    delete config.excludeConfigs;
+  }
+  const ignoreUnresolved = await askForIgnoreUnresolvedFlag(config.ignoreUnresolved);
+  if (ignoreUnresolved === undefined) {
+    return canceledByUser$2();
+  } else if (ignoreUnresolved === 'yes' || ignoreUnresolved === 'no') {
+    config.ignoreUnresolved = ignoreUnresolved === 'yes';
+  } else {
+    delete config.ignoreUnresolved;
+  }
+  return notCanceled$2();
+}
+function canceledByUser$2() {
+  logger.logger.log('');
+  logger.logger.info('User canceled');
+  logger.logger.log('');
+  return {
+    ok: true,
+    data: {
+      canceled: true
+    }
+  };
+}
+function notCanceled$2() {
+  return {
+    ok: true,
+    data: {
+      canceled: false
+    }
+  };
+}
+
+// Cheap subproject discovery (no dependency resolution) for
+// `socket manifest setup --dynamic-sbom-inference`; dynamic-sbom-inference
+// itself instead gets this list for free as a side effect of its own full
+// facts run.
+async function enumerateWorkspaces({
+  bin,
+  buildOpts,
+  cwd,
+  ecosystem,
+  excludePaths,
+  javaHome,
+  verbose
+}) {
+  let resolvedJavaHome;
+  if (javaHome) {
+    const expanded = expandEnvVarRefs(javaHome);
+    if (expanded.missing) {
+      process.exitCode = 1;
+      logger.logger.fail(`javaHome (\`${javaHome}\`) ${formatMissingEnvVarRefs(expanded.missing)}.`);
+      return;
+    }
+    resolvedJavaHome = expanded.value;
+  }
+  const scriptOpts = {
+    bin: bin || undefined,
+    excludePaths: excludePaths?.length ? excludePaths : undefined,
+    // `env` replaces the spawned process's whole environment, not just JAVA_HOME.
+    env: resolvedJavaHome ? {
+      ...process.env,
+      JAVA_HOME: resolvedJavaHome
+    } : undefined,
+    projectDir: cwd,
+    stdio: 'pipe',
+    toolOpts: buildOpts
+  };
+  let result;
+  try {
+    result = await enumerateWorkspaces$1(ecosystem, scriptOpts);
+  } catch (e) {
+    process.exitCode = 1;
+    logger.logger.fail(`Could not run the ${ecosystem} build tool` + (' (run with --verbose for details).'));
+    return;
+  }
+  if (!result.projects.length) {
+    process.exitCode = 1;
+    logger.logger.fail(`The ${ecosystem} build produced no workspace records (exit code ${result.code}); every build reports at least its own root project, so the enumeration task did not run.`);
+    return;
+  }
+  return {
+    projects: result.projects
+  };
+}
+
+// A single discovered build root - a directory with its own gradle/sbt/maven
+// marker file.
+
+const ROOT_ECOSYSTEMS = ['maven', 'gradle', 'sbt'];
+const ECOSYSTEM_LABELS = {
+  __proto__: null,
+  gradle: 'Gradle',
+  maven: 'Maven',
+  sbt: 'sbt'
+};
+
+// The shallowest directory matching `--exclude-paths`, not necessarily a
+// project dir itself - one write here covers every project beneath it.
+
+function canceledByUser$1() {
+  logger.logger.log('');
+  logger.logger.info('User canceled');
+  logger.logger.log('');
+  return {
+    ok: true,
+    data: {
+      canceled: true
+    }
+  };
+}
+function notCanceled$1() {
+  return {
+    ok: true,
+    data: {
+      canceled: false
+    }
+  };
+}
+function getEcosystemSection(sockJson, ecosystem) {
+  return sockJson.defaults?.manifest?.[ecosystem] ?? {};
+}
+
+// Depth-then-path sort: for exclusion roots it's just stable log ordering;
+// for candidates it's load-bearing, since a parent must be prompted before
+// its children so a child's shown default reflects a parent's just-written
+// cascade instead of its pre-run value.
+function sortCandidatesForDisplay(candidates, cwd) {
+  return [...candidates].sort((a, b) => {
+    const relA = path.relative(cwd, a.dir);
+    const relB = path.relative(cwd, b.dir);
+    const depthA = relA.split(path.sep).length;
+    const depthB = relB.split(path.sep).length;
+    if (depthA !== depthB) {
+      return depthA - depthB;
+    }
+    return relA < relB ? -1 : relA > relB ? 1 : 0;
+  });
+}
+function toPosixRelative(cwd, dir) {
+  return path.relative(cwd, dir).split(path.sep).join('/');
+}
+
+// Shallowest prefix of `relDir` that matches an --exclude-paths pattern -
+// the directory to write `disabled` to, so one write covers everything
+// beneath it, even if that directory isn't itself a build root.
+function findExclusionRoot(relDir, ignorePatterns) {
+  const segments = relDir.split('/');
+  for (let depth = 1; depth <= segments.length; depth += 1) {
+    const prefix = segments.slice(0, depth).join('/');
+    if (vendor.micromatchExports.isMatch(prefix, ignorePatterns, {
+      dot: true
+    })) {
+      return prefix;
+    }
+  }
+  return relDir;
+}
+// Both the unfiltered and --exclude-paths-filtered scans, once, so ecosystem
+// detection and later include/exclude grouping (see discoverBuildRoots)
+// never re-walk the same tree.
+async function scanBuildRoots({
+  cwd,
+  excludePaths,
+  sockJson
+}) {
+  const [fullByTool, includedByTool] = await Promise.all([findBuildToolCandidates({
+    cwd,
+    sockJson
+  }), findBuildToolCandidates({
+    cwd,
+    excludePaths,
+    sockJson
+  })]);
+  return {
+    fullByTool,
+    includedByTool
+  };
+}
+// Splits an already-scanned candidate set into `included` (the interactive
+// walk) and `excluded`, grouped by the shallowest --exclude-paths match (see
+// findExclusionRoot). `cwd` is excluded from both (it got its own wizard
+// pass) and realpath-resolved to match findBuildToolCandidates' own
+// resolution - otherwise macOS's /tmp -> /private/tmp breaks the comparison.
+async function discoverBuildRoots({
+  cwd,
+  excludePaths,
+  fullByTool,
+  includedByTool
+}) {
+  const realCwd = await realpathOrResolved(cwd);
+  const included = [];
+  const ignorePatterns = (excludePaths ?? []).flatMap(excludePathToScanIgnores);
+  const ecosystemsByRoot = new Map();
+  for (const [ecosystem, fullDirs] of fullByTool) {
+    const includedDirs = new Set(includedByTool.get(ecosystem) ?? []);
+    for (const dir of fullDirs) {
+      if (dir === realCwd) {
+        continue;
+      }
+      if (includedDirs.has(dir)) {
+        included.push({
+          dir,
+          ecosystem
+        });
+        continue;
+      }
+      const relDir = toPosixRelative(realCwd, dir);
+      const rootRelDir = findExclusionRoot(relDir, ignorePatterns);
+      const rootDir = path.join(realCwd, rootRelDir);
+      const ecosystems = ecosystemsByRoot.get(rootDir) ?? new Set();
+      ecosystems.add(ecosystem);
+      ecosystemsByRoot.set(rootDir, ecosystems);
+    }
+  }
+  return {
+    excluded: [...ecosystemsByRoot].map(([dir, ecosystems]) => ({
+      dir,
+      ecosystems: [...ecosystems].sort()
+    })),
+    included
+  };
+}
+
+// Enumerates one build root's declared workspace members (see
+// enumerate-workspaces.mts) and folds them into `coveredByEcosystem`, so a
+// later candidate matching one is recognized as a reactor member rather than
+// independent. Called per-candidate right after its own prompt, not as a
+// bulk pass, so the build invocation never blocks candidates that don't need
+// it. A disabled candidate is skipped (no point invoking an off build tool);
+// otherwise this fails closed, same reasoning as generateRecursiveManifests -
+// if enumeration fails there's no way to tell covered from independent, so
+// the caller aborts rather than guess.
+async function markWorkspaceCoverage({
+  candidate,
+  coveredByEcosystem,
+  cwd,
+  excludePaths,
+  rootSockJson
+}) {
+  const cascade = utils.readSocketJsonCascade(candidate.dir, cwd, rootSockJson);
+  const {
+    bin,
+    buildOpts,
+    javaHome,
+    skipReason
+  } = resolveEcosystemConfig(candidate.ecosystem, candidate.dir, cascade);
+  if (skipReason) {
+    return {
+      ok: true,
+      data: undefined
+    };
+  }
+  const excludePathsForCandidate = projectIgnorePathsToReachExcludePaths(excludePaths, {
+    cwd,
+    target: candidate.dir
+  });
+  const enumResult = await enumerateWorkspaces({
+    bin,
+    buildOpts,
+    cwd: candidate.dir,
+    ecosystem: candidate.ecosystem,
+    excludePaths: excludePathsForCandidate,
+    javaHome,
+    verbose: false
+  });
+  if (!enumResult) {
+    const relDir = path.relative(cwd, candidate.dir) || '.';
+    return {
+      ok: false,
+      message: `Could not determine ${candidate.ecosystem} workspace layout for ${relDir}; aborting rather than risk misclassifying its members.`
+    };
+  }
+  const set = coveredByEcosystem.get(candidate.ecosystem) ?? new Set();
+  set.add(candidate.dir);
+  const resolvedSubprojectDirs = await Promise.all(enumResult.projects.map(project => realpathOrResolved(path.resolve(candidate.dir, project.subprojectDir))));
+  for (const subprojectDir of resolvedSubprojectDirs) {
+    set.add(subprojectDir);
+  }
+  coveredByEcosystem.set(candidate.ecosystem, set);
+  return {
+    ok: true,
+    data: undefined
+  };
+}
+
+// Marks one exclusion root's own socket.json `disabled: true` for whichever
+// of its ecosystems aren't already disabled via cascade (an already-disabled
+// ancestor from a prior run) - a no-op write is skipped entirely so re-running
+// the wizard doesn't keep rewriting already-disabled roots.
+async function disableExclusionRoot({
+  cwd,
+  dir,
+  ecosystems,
+  rootSockJson
+}) {
+  const relDir = path.relative(cwd, dir) || '.';
+  const cascade = utils.readSocketJsonCascade(dir, cwd, rootSockJson);
+  const needsWrite = ecosystems.filter(ecosystem => getEcosystemSection(cascade, ecosystem)['disabled'] !== true);
+  if (!needsWrite.length) {
+    return notCanceled$1();
+  }
+  const ownSockJson = utils.readOrDefaultSocketJson(dir);
+  if (!ownSockJson.defaults) {
+    ownSockJson.defaults = {};
+  }
+  if (!ownSockJson.defaults.manifest) {
+    ownSockJson.defaults.manifest = {};
+  }
+  const manifest = ownSockJson.defaults.manifest;
+  for (const ecosystem of needsWrite) {
+    manifest[ecosystem] = {
+      ...getEcosystemSection(ownSockJson, ecosystem),
+      disabled: true
+    };
+  }
+  const writeResult = await utils.writeSocketJson(dir, ownSockJson);
+  if (!writeResult.ok) {
+    return writeResult;
+  }
+  logger.logger.success(`Disabled ${relDir} (${needsWrite.join(', ')})`);
+  return notCanceled$1();
+}
+
+// Dispatches to the right ecosystem-specific wizard. `factsOnly` skips the
+// facts/pom question - dynamic-sbom-inference never generates a pom.xml, it
+// just skips a project resolved to `facts: false` (see
+// generateRecursiveManifests' skipReason), so offering that choice here
+// would be misleading.
+async function runEcosystemWizard(ecosystem, config) {
+  if (ecosystem === 'gradle') {
+    return await setupGradle(config, {
+      factsOnly: true
+    });
+  }
+  if (ecosystem === 'maven') {
+    return await setupMaven(config);
+  }
+  return await setupSbt(config, {
+    factsOnly: true
+  });
+}
+
+// Seeds the wizard with this candidate's effective (cascaded) value for any
+// field its own file doesn't already set, so accepting every prompt
+// unchanged preserves what it currently inherits, while an actual change
+// writes an explicit override.
+async function configureCandidate({
+  cwd,
+  dir,
+  ecosystem,
+  rootSockJson
+}) {
+  const relDir = path.relative(cwd, dir) || '.';
+  const ownSockJson = utils.readOrDefaultSocketJson(dir);
+  if (!ownSockJson.defaults) {
+    ownSockJson.defaults = {};
+  }
+  if (!ownSockJson.defaults.manifest) {
+    ownSockJson.defaults.manifest = {};
+  }
+
+  // Ancestor-only baseline (excludes dir's own file, unlike the cascade below)
+  // so a field left exactly as shown can be told apart from one the user
+  // actually set - otherwise every accepted default gets written verbatim,
+  // permanently pinning it against future changes to an ancestor's value.
+  const inherited = getEcosystemSection(utils.readSocketJsonCascade(path.dirname(dir), cwd, rootSockJson), ecosystem);
+  const cascade = utils.readSocketJsonCascade(dir, cwd, rootSockJson);
+  const seed = {
+    ...getEcosystemSection(cascade, ecosystem),
+    ...getEcosystemSection(ownSockJson, ecosystem)
+  };
+  const result = await runEcosystemWizard(ecosystem, seed);
+  if (!result.ok || result.data.canceled) {
+    return result;
+  }
+  const toWrite = {};
+  for (const key of Object.keys(seed)) {
+    if (seed[key] !== inherited[key]) {
+      toWrite[key] = seed[key];
+    }
+  }
+  // Every field equals what dir would already inherit - writing it would just
+  // be noise (own file unaffected, dir keeps inheriting exactly as before).
+  if (!Object.keys(toWrite).length) {
+    logger.logger.log(`No changes for ${relDir} (${ecosystem}); nothing written.`);
+    return notCanceled$1();
+  }
+  const manifest = ownSockJson.defaults.manifest;
+  manifest[ecosystem] = toWrite;
+  const writeResult = await utils.writeSocketJson(dir, ownSockJson);
+  if (!writeResult.ok) {
+    return writeResult;
+  }
+  logger.logger.success(`Configured ${relDir} (${ecosystem})`);
+  return notCanceled$1();
+}
+// No disable choice here - that's --exclude-paths' job (see
+// findExclusionRoot), so a whole subtree still collapses to one write
+// instead of one per candidate.
+async function askCandidateAction(relDir, ecosystem) {
+  return await prompts.select({
+    message: `${relDir} (${ecosystem})`,
+    choices: [{
+      name: 'Leave as-is',
+      value: 'inherit',
+      description: "Make no change - keep this project's current effective configuration"
+    }, {
+      name: 'Configure',
+      value: 'configure',
+      description: 'Set bin/JDK/opts/etc. for this project specifically'
+    }],
+    default: 'inherit'
+  });
+}
+// Asks the standard configure-or-leave-as-is question and applies the
+// answer. Shared by the normal path and the post-re-enable path below, so
+// re-enabling a candidate isn't a dead end that skips straight past its own
+// bin/JDK/opts configuration.
+async function askAndApplyAction({
+  cwd,
+  dir,
+  ecosystem,
+  relDir,
+  rootSockJson
+}) {
+  const action = await askCandidateAction(relDir, ecosystem);
+  if (action === undefined || action === null) {
+    canceledByUser$1();
+    return {
+      ok: true,
+      data: {
+        canceled: true,
+        outcome: 'inherited'
+      }
+    };
+  }
+  if (action === 'configure') {
+    const result = await configureCandidate({
+      cwd,
+      dir,
+      ecosystem,
+      rootSockJson
+    });
+    if (!result.ok) {
+      return result;
+    }
+    return {
+      ok: true,
+      data: {
+        ...result.data,
+        outcome: 'configured'
+      }
+    };
+  }
+  // 'inherit', or any unexpected value - the safe no-op default.
+  return {
+    ok: true,
+    data: {
+      canceled: false,
+      outcome: 'inherited'
+    }
+  };
+}
+
+// Prompts for configure/inherit, unless the cascade shows the candidate
+// disabled: offer to re-enable if that's its own file, then continue into
+// the normal prompt; stay silent if it's only inherited from an ancestor's
+// bulk write (that's noise for a large excluded subtree).
+async function processCandidate({
+  cwd,
+  dir,
+  ecosystem,
+  rootSockJson
+}) {
+  const relDir = path.relative(cwd, dir) || '.';
+  const cascade = utils.readSocketJsonCascade(dir, cwd, rootSockJson);
+  if (getEcosystemSection(cascade, ecosystem)['disabled'] === true) {
+    const ownSockJson = utils.readOrDefaultSocketJson(dir);
+    if (getEcosystemSection(ownSockJson, ecosystem)['disabled'] !== true) {
+      // Inherited from an ancestor, not this candidate's own file - stay silent.
+      return {
+        ok: true,
+        data: {
+          canceled: false,
+          outcome: 'skipped',
+          reenabled: false
+        }
+      };
+    }
+    const wantsReenable = await askYesNo(`${relDir} (${ecosystem}) is disabled - re-enable it?`);
+    if (wantsReenable === undefined || wantsReenable === null) {
+      canceledByUser$1();
+      return {
+        ok: true,
+        data: {
+          canceled: true,
+          outcome: 'skipped',
+          reenabled: false
+        }
+      };
+    }
+    if (!wantsReenable) {
+      return {
+        ok: true,
+        data: {
+          canceled: false,
+          outcome: 'skipped',
+          reenabled: false
+        }
+      };
+    }
+    if (!ownSockJson.defaults) {
+      ownSockJson.defaults = {};
+    }
+    if (!ownSockJson.defaults.manifest) {
+      ownSockJson.defaults.manifest = {};
+    }
+    const manifest = ownSockJson.defaults.manifest;
+    manifest[ecosystem] = {
+      ...getEcosystemSection(ownSockJson, ecosystem),
+      disabled: false
+    };
+    const writeResult = await utils.writeSocketJson(dir, ownSockJson);
+    if (!writeResult.ok) {
+      return writeResult;
+    }
+    logger.logger.success(`Re-enabled ${relDir} (${ecosystem})`);
+    const result = await askAndApplyAction({
+      cwd,
+      dir,
+      ecosystem,
+      relDir,
+      rootSockJson
+    });
+    if (!result.ok) {
+      return result;
+    }
+    return {
+      ok: true,
+      data: {
+        ...result.data,
+        reenabled: true
+      }
+    };
+  }
+  const result = await askAndApplyAction({
+    cwd,
+    dir,
+    ecosystem,
+    relDir,
+    rootSockJson
+  });
+  if (!result.ok) {
+    return result;
+  }
+  return {
+    ok: true,
+    data: {
+      ...result.data,
+      reenabled: false
+    }
+  };
+}
+
+// Accepting every prompt's default leaves an ecosystem's section genuinely
+// empty (see askForBin in setup-manifest-config.mts) - drop it so
+// `configuredAny` reflects what was actually configured, not just which
+// ecosystems the user said "yes" to.
+function dropIfEmpty(manifest, ecosystem) {
+  const section = manifest[ecosystem];
+  if (section && Object.keys(section).length) {
+    return true;
+  }
+  delete manifest[ecosystem];
+  return false;
+}
+async function askYesNo(message) {
+  return await prompts.select({
+    message,
+    choices: [{
+      name: 'Yes',
+      value: true
+    }, {
+      name: 'No',
+      value: false
+    }]
+  });
+}
+
+// Unlike the plain single-project wizard, cwd here is often just a common
+// ancestor - so `ecosystemsAtCwd` (a subset of `ecosystems`) picks the
+// wording: cwd's own build root gets "configure this project's settings",
+// everything else gets "configure defaults for nested projects". A
+// pre-existing `disabled: true` gets a re-enable question first, otherwise
+// there'd be no way back from a prior disable. Declining everything is
+// normal, not an abort.
+async function setupRecursiveRootDefaults(cwd, defaultOnReadError, ecosystems, ecosystemsAtCwd) {
+  const jsonPath = path.join(cwd, constants.SOCKET_JSON);
+  if (fs$1.existsSync(jsonPath)) {
+    logger.logger.info(`Found ${constants.SOCKET_JSON} at ${jsonPath}`);
+  } else {
+    logger.logger.info(`No ${constants.SOCKET_JSON} found at ${cwd}, will generate a new one`);
+  }
+  logger.logger.log('');
+  logger.logger.log('Note: This tool will set up flag and argument defaults for certain');
+  logger.logger.log('      CLI commands. You can still override them by explicitly');
+  logger.logger.log('      setting the flag.');
+  logger.logger.log('');
+  logger.logger.log(`This command will generate a ${constants.SOCKET_JSON} file in ${cwd}.`);
+  logger.logger.log('socket.json properties are inherited by nested paths.');
+  logger.logger.log('');
+  const sockJsonCResult = utils.readSocketJsonSync(cwd, defaultOnReadError);
+  if (!sockJsonCResult.ok) {
+    return sockJsonCResult;
+  }
+  const sockJson = sockJsonCResult.data;
+  if (!sockJson.defaults) {
+    sockJson.defaults = {};
+  }
+  if (!sockJson.defaults.manifest) {
+    sockJson.defaults.manifest = {};
+  }
+  const manifest = sockJson.defaults.manifest;
+  let configuredAny = false;
+  for (const ecosystem of ecosystems) {
+    const label = ECOSYSTEM_LABELS[ecosystem];
+    const existingSection = manifest[ecosystem];
+    if (existingSection?.['disabled'] === true) {
+      // eslint-disable-next-line no-await-in-loop
+      const wantsReenable = await askYesNo(`${label} is currently disabled here - re-enable it?`);
+      if (wantsReenable === undefined || wantsReenable === null) {
+        return canceledByUser$1();
+      }
+      if (!wantsReenable) {
+        continue;
+      }
+      existingSection['disabled'] = false;
+      configuredAny = true;
+    }
+    const message = ecosystemsAtCwd.includes(ecosystem) ? `Configure ${label} settings for this project?` : `Configure ${label} defaults for any nested projects?`;
+    // eslint-disable-next-line no-await-in-loop
+    const wants = await askYesNo(message);
+    if (wants === undefined || wants === null) {
+      return canceledByUser$1();
+    }
+    if (!wants) {
+      continue;
+    }
+    if (!manifest[ecosystem]) {
+      manifest[ecosystem] = {};
+    }
+    // eslint-disable-next-line no-await-in-loop
+    const result = await runEcosystemWizard(ecosystem, manifest[ecosystem]);
+    if (!result.ok || result.data.canceled) {
+      return result;
+    }
+    if (dropIfEmpty(manifest, ecosystem)) {
+      configuredAny = true;
+    }
+  }
+  if (!configuredAny) {
+    logger.logger.log('');
+    logger.logger.log('No root-level defaults configured.');
+    return notCanceled$1();
+  }
+  logger.logger.log('');
+  logger.logger.log(`Writing ${constants.SOCKET_JSON} to ${jsonPath}`);
+  logger.logger.log('');
+  const writeResult = await utils.writeSocketJson(cwd, sockJson);
+  if (!writeResult.ok) {
+    return writeResult;
+  }
+  return notCanceled$1();
+}
+
+// `socket manifest setup --dynamic-sbom-inference`: the up-front scan (see
+// scanBuildRoots) only ever answers "which build tools exist", never "which
+// projects to configure". `--exclude-paths` matches are bulk-disabled
+// unconditionally, independent of the interactive walk below, so re-running
+// later with one more entry (or none) never re-answers settled decisions.
+// Everything else gets a configure-or-inherit prompt (see processCandidate),
+// except a workspace member a parent build already declares - learned via
+// markWorkspaceCoverage right after the parent's own prompt, not a separate
+// bulk pass, so a reactor member is silently skipped instead of prompted.
+async function setupRecursiveManifestConfig(cwd, defaultOnReadError, excludePaths) {
+  logger.logger.log('');
+  logger.logger.log(`Configuring ${cwd} ...`);
+  const initialSockJson = utils.readOrDefaultSocketJson(cwd);
+  // Resolved once here for sortCandidatesForDisplay/disableExclusionRoot's
+  // relative-path math, consistent with discoverBuildRoots' own internal
+  // resolution (see its comment for why this matters).
+  const realCwd = await realpathOrResolved(cwd);
+  logger.logger.log('');
+  logger.logger.log('Scanning for build roots ...');
+  const {
+    fullByTool,
+    includedByTool
+  } = await scanBuildRoots({
+    cwd,
+    excludePaths,
+    sockJson: withoutDisabledFlags(initialSockJson)
+  });
+  // includedByTool (not the unfiltered fullByTool), so an ecosystem whose
+  // only candidate is about to be excluded this same run isn't offered
+  // either - there'd be nothing left for its root defaults to apply to.
+  const detectedEcosystems = ROOT_ECOSYSTEMS.filter(ecosystem => (includedByTool.get(ecosystem)?.length ?? 0) > 0);
+  if (detectedEcosystems.length) {
+    logger.logger.log(`Detected: ${detectedEcosystems.map(ecosystem => ECOSYSTEM_LABELS[ecosystem]).join(', ')}.`);
+  } else {
+    logger.logger.log(`No gradle/maven/sbt build roots found beneath ${cwd}.`);
+  }
+  logger.logger.log('');
+
+  // Which detected ecosystems cwd is itself a build root for - see
+  // setupRecursiveRootDefaults' wording split.
+  const ecosystemsAtCwd = ROOT_ECOSYSTEMS.filter(ecosystem => (fullByTool.get(ecosystem) ?? []).includes(realCwd));
+  const rootResult = await setupRecursiveRootDefaults(cwd, defaultOnReadError, detectedEcosystems, ecosystemsAtCwd);
+  if (!rootResult.ok) {
+    return rootResult;
+  }
+  if (rootResult.data.canceled) {
+    return canceledByUser$1();
+  }
+
+  // Re-read: the root wizard may have just written a new socket.json.
+  const rootSockJson = utils.readOrDefaultSocketJson(cwd);
+  const {
+    excluded,
+    included
+  } = await discoverBuildRoots({
+    cwd,
+    excludePaths,
+    fullByTool,
+    includedByTool
+  });
+
+  // Applies regardless of the interactive walk below - see the module doc
+  // comment on why --exclude-paths is unconditional.
+  if (excludePaths?.length) {
+    if (!excluded.length) {
+      logger.logger.log('None matched --exclude-paths; nothing disabled.');
+    } else {
+      const orderedExcluded = sortCandidatesForDisplay(excluded, realCwd);
+      for (const candidate of orderedExcluded) {
+        // eslint-disable-next-line no-await-in-loop
+        const result = await disableExclusionRoot({
+          cwd: realCwd,
+          dir: candidate.dir,
+          ecosystems: candidate.ecosystems,
+          rootSockJson
+        });
+        if (!result.ok) {
+          return result;
+        }
+      }
+    }
   }
-  const ignoreUnresolved = await askForIgnoreUnresolvedFlag(config.ignoreUnresolved);
-  if (ignoreUnresolved === undefined) {
+  if (!included.length) {
+    logger.logger.log('');
+    logger.logger.success('Recursive setup complete.');
+    return notCanceled$1();
+  }
+  logger.logger.log('');
+  const wantsIndividual = await askYesNo('Configure other build roots found beneath this one, individually?');
+  if (wantsIndividual === undefined || wantsIndividual === null) {
     return canceledByUser$1();
-  } else if (ignoreUnresolved === 'yes' || ignoreUnresolved === 'no') {
-    config.ignoreUnresolved = ignoreUnresolved === 'yes';
-  } else {
-    delete config.ignoreUnresolved;
   }
-  return notCanceled$1();
-}
-function canceledByUser$1() {
+  if (!wantsIndividual) {
+    logger.logger.log('');
+    logger.logger.success('Recursive setup complete.');
+    return notCanceled$1();
+  }
   logger.logger.log('');
-  logger.logger.info('User canceled');
+  logger.logger.log('For each one, choose to configure it or leave it as-is. To disable one,');
+  logger.logger.log('re-run with --exclude-paths instead.');
   logger.logger.log('');
-  return {
-    ok: true,
-    data: {
-      canceled: true
+  const coveredByEcosystem = new Map();
+  // cwd never appears in `included`, but a reactor root often sits exactly
+  // at cwd - seed coverage from it first so its declared members still get
+  // recognized.
+  for (const ecosystem of ecosystemsAtCwd) {
+    // eslint-disable-next-line no-await-in-loop
+    const coverageResult = await markWorkspaceCoverage({
+      candidate: {
+        dir: realCwd,
+        ecosystem
+      },
+      coveredByEcosystem,
+      cwd: realCwd,
+      excludePaths,
+      rootSockJson
+    });
+    if (!coverageResult.ok) {
+      return coverageResult;
     }
+  }
+  const counts = {
+    configured: 0,
+    covered: 0,
+    inherited: 0,
+    reenabled: 0,
+    skipped: 0
   };
-}
-function notCanceled$1() {
-  return {
-    ok: true,
-    data: {
-      canceled: false
+  const orderedIncluded = sortCandidatesForDisplay(included, realCwd);
+  for (const candidate of orderedIncluded) {
+    const covered = coveredByEcosystem.get(candidate.ecosystem);
+    if (covered?.has(candidate.dir)) {
+      counts.covered += 1;
+      continue;
     }
-  };
+
+    // eslint-disable-next-line no-await-in-loop
+    const result = await processCandidate({
+      cwd: realCwd,
+      dir: candidate.dir,
+      ecosystem: candidate.ecosystem,
+      rootSockJson
+    });
+    if (!result.ok) {
+      return result;
+    }
+    if (result.data.canceled) {
+      // The cancellation itself (select Esc/Ctrl+C, or a sub-wizard's own
+      // cancel) already logged "User canceled" - don't log it twice.
+      return {
+        ok: true,
+        data: {
+          canceled: true
+        }
+      };
+    }
+    counts[result.data.outcome] += 1;
+    if (result.data.reenabled) {
+      // A qualifier on the 'configured'/'inherited' bucket just incremented
+      // above, not a separate bucket - avoids double-counting the candidate.
+      counts.reenabled += 1;
+    }
+
+    // Interleaved rather than a bulk pre-pass, so this (possibly slow)
+    // build-tool invocation only runs for a project already prompted about.
+    // eslint-disable-next-line no-await-in-loop
+    const coverageResult = await markWorkspaceCoverage({
+      candidate,
+      coveredByEcosystem,
+      cwd: realCwd,
+      excludePaths,
+      rootSockJson
+    });
+    if (!coverageResult.ok) {
+      return coverageResult;
+    }
+  }
+  logger.logger.log('');
+  logger.logger.log(`${counts.configured} configured (${counts.reenabled} re-enabled), ${counts.inherited} left as-is, ${counts.skipped} left disabled, ${counts.covered} covered by a parent build.`);
+  logger.logger.log('');
+  logger.logger.success('Recursive setup complete.');
+  return notCanceled$1();
 }
 
-async function handleManifestSetup(cwd, defaultOnReadError) {
-  const result = await setupManifestConfig(cwd, defaultOnReadError);
+async function handleManifestSetup(cwd, defaultOnReadError, dynamicSbomInference = false, excludePaths) {
+  const result = dynamicSbomInference ? await setupRecursiveManifestConfig(cwd, defaultOnReadError, excludePaths) : await setupManifestConfig(cwd, defaultOnReadError);
   await outputManifestSetup(result);
 }
 
@@ -13413,9 +14941,21 @@ const config$8 = {
   hidden: false,
   flags: {
     ...flags.commonFlags,
+    // Only meaningful alongside the hidden --dynamic-sbom-inference below; kept hidden too.
+    excludePaths: {
+      type: 'string',
+      isMultiple: true,
+      hidden: true,
+      description: 'Build roots matching these glob patterns (and everything beneath them) are marked disabled. Patterns are anchored micromatch globs matched relative to CWD: `legacy` matches only `<cwd>/legacy`; use `**/legacy` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags.'
+    },
     defaultOnReadError: {
       type: 'boolean',
       description: `If reading the ${constants.SOCKET_JSON} fails, just use a default config? Warning: This might override the existing json file!`
+    },
+    dynamicSbomInference: {
+      type: 'boolean',
+      hidden: true,
+      description: 'Recursively scans for every gradle/sbt/maven build root beneath CWD first, so the CWD config step only asks about ecosystems actually found somewhere in the tree. A build root matching --exclude-paths is bulk-disabled with no prompt, applied unconditionally; eligible build roots found afterward can be configured individually'
     }
   },
   help: (command, config) => `
@@ -13464,7 +15004,8 @@ async function run$z(argv, importMeta, {
     parentName
   });
   const {
-    defaultOnReadError = false
+    defaultOnReadError = false,
+    dynamicSbomInference = false
   } = cli.flags;
   const dryRun = !!cli.flags['dryRun'];
   let [cwd = '.'] = cli.input;
@@ -13475,7 +15016,9 @@ async function run$z(argv, importMeta, {
     logger.logger.log(constants.default.DRY_RUN_BAILING_NOW);
     return;
   }
-  await handleManifestSetup(cwd, Boolean(defaultOnReadError));
+  const excludePaths = utils.cmdFlagValueToArray(cli.flags['excludePaths']);
+  assertValidExcludePaths(excludePaths);
+  await handleManifestSetup(cwd, Boolean(defaultOnReadError), Boolean(dynamicSbomInference), excludePaths);
 }
 
 const config$7 = {
@@ -13502,6 +15045,7 @@ async function run$y(argv, importMeta, {
       bazel: cmdManifestBazel,
       cdxgen: cmdManifestCdxgen,
       conda: cmdManifestConda,
+      'dynamic-sbom-inference': cmdManifestDynamicSbomInference,
       gradle: cmdManifestGradle,
       kotlin: cmdManifestKotlin,
       maven: cmdManifestMaven,
@@ -17575,6 +19119,124 @@ const cmdRepository = {
   }
 };
 
+const reachabilityFlags = {
+  dynamicSbomInference: {
+    type: 'boolean',
+    default: false,
+    hidden: true,
+    description: 'Internal: enables dynamic SBOM inference for full application reachability analysis. Passes --maven-use-only-root-socket-facts to Coana and implies --auto-manifest.'
+  },
+  reachVersion: {
+    type: 'string',
+    description: `Override the version of @coana-tech/cli used for reachability analysis. Default: ${constants.default.ENV.INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION}.`
+  },
+  reachAnalysisMemoryLimit: {
+    type: 'string',
+    default: '8192',
+    description: 'The maximum memory for the reachability analysis as a whole number optionally followed by MB or GB (e.g. 512MB, 8GB). The default is 8GB.'
+  },
+  reachAnalysisTimeout: {
+    type: 'string',
+    default: '',
+    description: 'Set the timeout for the reachability analysis as a whole number optionally followed by s, m or h (e.g. 90s, 10m, 1h). Defaults to 10m. Split analysis runs may cause the total scan time to exceed this timeout significantly.'
+  },
+  reachConcurrency: {
+    type: 'number',
+    default: 1,
+    description: 'Set the maximum number of concurrent reachability analysis runs. It is recommended to choose a concurrency level that ensures each analysis run has at least the --reach-analysis-memory-limit amount of memory available.'
+  },
+  reachContinueOnAnalysisErrors: {
+    type: 'boolean',
+    default: false,
+    description: 'Continue reachability analysis when errors occur (timeouts, OOM, parse errors, etc.), falling back to precomputed reachability results. By default, the CLI halts on analysis errors.'
+  },
+  reachContinueOnInstallErrors: {
+    type: 'boolean',
+    default: false,
+    description: 'Continue reachability analysis when package installation fails, falling back to precomputed reachability results. By default, the CLI halts on installation errors.'
+  },
+  reachContinueOnMissingLockFiles: {
+    type: 'boolean',
+    default: false,
+    description: 'Continue reachability analysis when a Gradle or SBT project is missing its lock file (or version catalog / pre-generated SBOM). By default, the CLI halts.'
+  },
+  reachContinueOnNoSourceFiles: {
+    type: 'boolean',
+    default: false,
+    description: 'Continue reachability analysis when a workspace contains no source files for its ecosystem. By default, the CLI halts.'
+  },
+  reachDisableExternalToolChecks: {
+    type: 'boolean',
+    default: false,
+    description: 'Disable external tool checks during reachability analysis.'
+  },
+  reachDebug: {
+    type: 'boolean',
+    default: false,
+    description: 'Enable debug mode for reachability analysis. Provides verbose logging from the reachability CLI.'
+  },
+  reachDetailedAnalysisLogFile: {
+    type: 'boolean',
+    default: false,
+    description: 'A log file with detailed analysis logs is written to root of each analyzed workspace.'
+  },
+  reachDisableAnalytics: {
+    type: 'boolean',
+    default: false,
+    description: 'Disable reachability analytics sharing with Socket. Also disables caching-based optimizations.'
+  },
+  reachDisableAnalysisSplitting: {
+    type: 'boolean',
+    default: false,
+    hidden: true,
+    description: 'Deprecated: Analysis splitting is now disabled by default. This flag is a no-op.'
+  },
+  reachEnableAnalysisSplitting: {
+    type: 'boolean',
+    default: false,
+    description: 'Allow the reachability analysis to partition CVEs into buckets that are processed in separate analysis runs. May improve accuracy, but not recommended by default.'
+  },
+  reachEcosystems: {
+    type: 'string',
+    isMultiple: true,
+    description: `List of ecosystems to conduct reachability analysis on, as either a comma separated value or as multiple flags. Supported: ${utils.getReachabilityEcosystemChoices().join(', ')}. Defaults to all supported ecosystems.`
+  },
+  reachExcludePaths: {
+    type: 'string',
+    isMultiple: true,
+    hidden: true,
+    description: 'Deprecated: use --exclude-paths instead. List of paths to exclude from reachability analysis, as either a comma separated value or as multiple flags.'
+  },
+  reachLazyMode: {
+    type: 'boolean',
+    default: false,
+    description: 'Enable lazy mode for reachability analysis.',
+    hidden: true
+  },
+  reachRetainFactsFile: {
+    type: 'boolean',
+    default: false,
+    description: 'Keep the `.socket.facts.json` reachability report that the analysis writes to the scan directory instead of deleting it after a successful scan. IMPORTANT: you must delete this file before running a fresh full application reachability scan. A stale `.socket.facts.json` left in place is picked up as a pre-generated input and silently overrides fresh analysis, so the new scan results will not be reliable.'
+  },
+  reachSkipCache: {
+    type: 'boolean',
+    default: false,
+    description: 'Skip caching-based optimizations. By default, the reachability analysis will use cached configurations from previous runs to speed up the analysis.'
+  },
+  reachUseOnlyPregeneratedSboms: {
+    type: 'boolean',
+    default: false,
+    description: 'When using this option, the scan is created based only on pre-generated CDX and SPDX files in your project.'
+  }
+};
+const excludePathsFlag = {
+  excludePaths: {
+    type: 'string',
+    isMultiple: true,
+    description: 'List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (`--cwd` if set), not the reachability target: `tests` matches only `<cwd>/tests`; use `**/tests` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags.'
+  }
+};
+
 async function suggestTarget() {
   // We could prefill this with sub-dirs of the current
   // dir ... but is that going to be useful?
@@ -18600,17 +20262,39 @@ async function createScanFromGithub({
       return sure;
     }
   }
+  return await runGithubScanLoop(targetRepos, repoSlug => scanRepo(repoSlug, {
+    githubApiUrl,
+    githubToken,
+    orgSlug,
+    orgGithub,
+    outputKind,
+    repos
+  }));
+}
+
+/**
+ * Drive the per-repo scan loop and decide the overall run result.
+ *
+ * The loop stops early on a blocking GitHub error (rate limit / auth / abuse
+ * detection) because every remaining repo would fail the same way. Previously
+ * a rate-limited token made every repo fail its API calls, the loop swallowed
+ * each failure, and the final "N repos / 0 manifests" summary misled users and
+ * CI into thinking the scan succeeded when nothing was uploaded. A run where
+ * every attempted repo failed for a non-blocking reason is also surfaced as an
+ * error rather than a silent ok:true.
+ *
+ * `scanRepoFn` is injected so this decision logic can be tested without the
+ * GitHub network path.
+ */
+async function runGithubScanLoop(targetRepos, scanRepoFn) {
   let scansCreated = 0;
+  let reposScanned = 0;
+  let blockingError;
+  const perRepoFailures = [];
   for (const repoSlug of targetRepos) {
+    reposScanned += 1;
     // eslint-disable-next-line no-await-in-loop
-    const scanCResult = await scanRepo(repoSlug, {
-      githubApiUrl,
-      githubToken,
-      orgSlug,
-      orgGithub,
-      outputKind,
-      repos
-    });
+    const scanCResult = await scanRepoFn(repoSlug);
     if (scanCResult.ok) {
       const {
         scanCreated
@@ -18618,9 +20302,43 @@ async function createScanFromGithub({
       if (scanCreated) {
         scansCreated += 1;
       }
+      continue;
     }
+    perRepoFailures.push({
+      repo: repoSlug,
+      message: scanCResult.message
+    });
+    // Stop on rate-limit / auth / abuse failures: every remaining repo will
+    // fail for the same reason, and continuing only burns more quota while
+    // delaying the real error.
+    if (utils.isGitHubBlockingError(scanCResult.message)) {
+      blockingError = {
+        ok: false,
+        message: scanCResult.message,
+        cause: scanCResult.cause
+      };
+      break;
+    }
+  }
+  if (blockingError) {
+    logger.logger.fail(blockingError.message);
+    return blockingError;
+  }
+
+  // If every attempted repo failed (but not for a known blocking reason),
+  // treat the run as an error so scripts do not infer success from an
+  // ok:true with zero scans created. Checked before the success lines below
+  // so an all-failed run never prints green "processed" output that a script
+  // reading log lines could mistake for success.
+  if (reposScanned > 0 && scansCreated === 0 && perRepoFailures.length === reposScanned) {
+    const firstFailure = perRepoFailures[0];
+    return {
+      ok: false,
+      message: 'All repos failed to scan',
+      cause: `All ${reposScanned} repos failed to scan. First failure for ${firstFailure.repo}: ${firstFailure.message}. ` + 'See the log above for per-repo details.'
+    };
   }
-  logger.logger.success(targetRepos.length, 'GitHub repos detected');
+  logger.logger.success(reposScanned, 'GitHub repos processed');
   logger.logger.success(scansCreated, 'with supported Manifest files');
   return {
     ok: true,
@@ -18801,8 +20519,20 @@ async function testAndDownloadManifestFiles({
       if (result.data.isManifest) {
         fileCount += 1;
       }
-    } else if (!firstFailureResult) {
-      firstFailureResult = result;
+    } else {
+      // A blocking error (rate limit / auth / abuse detection) is token-wide:
+      // every remaining download would fail the same way, and an earlier
+      // successful download must not mask it into an ok:true scan of a
+      // partial manifest set. Surface it immediately, the same way the repo
+      // loop short-circuits on blocking errors.
+      if (utils.isGitHubBlockingError(result.message)) {
+        logger.logger.groupEnd();
+        logger.logger.fail(result.message);
+        return result;
+      }
+      if (!firstFailureResult) {
+        firstFailureResult = result;
+      }
     }
   }
   logger.logger.groupEnd();
@@ -18873,22 +20603,17 @@ async function downloadManifestFile({
   debug.debugDir('inspect', {
     fileUrl
   });
-  utils.debugApiRequest('GET', fileUrl);
-  let downloadUrlResponse;
-  try {
-    downloadUrlResponse = await utils.apiFetch(fileUrl, {
-      method: 'GET',
-      headers: {
-        Authorization: `Bearer ${githubToken}`
-      }
-    });
-    utils.debugApiResponse('GET', fileUrl, downloadUrlResponse.status);
-  } catch (e) {
-    utils.debugApiResponse('GET', fileUrl, undefined, e);
-    throw e;
+  const reqResult = await utils.githubApiRequest(fileUrl, {
+    method: 'GET',
+    headers: {
+      Authorization: `Bearer ${githubToken}`
+    }
+  }, `fetching the download URL for ${file}`);
+  if (!reqResult.ok) {
+    return reqResult;
   }
   debug.debugFn('notice', 'complete: request');
-  const downloadUrlText = await downloadUrlResponse.text();
+  const downloadUrlText = reqResult.data.bodyText;
   debug.debugFn('inspect', 'response: raw download url', downloadUrlText);
   let downloadUrl;
   try {
@@ -18927,6 +20652,15 @@ async function streamDownloadWithFetch(localPath, downloadUrl) {
     response = await utils.apiFetch(downloadUrl);
     utils.debugApiResponse('GET', downloadUrl, response.status);
     if (!response.ok) {
+      // Surface rate-limit / auth failures on the raw download host too, so a
+      // bulk run that trips the limit mid-download fails loudly instead of
+      // being counted as just another skipped file. Header/status-only check;
+      // the stream body is left unconsumed.
+      const blocking = utils.classifyGitHubResponse(response.status, response.headers, '', 'downloading a manifest file');
+      if (blocking) {
+        logger.logger.fail(blocking.message);
+        return blocking;
+      }
       const errorMsg = `Download failed due to bad server response: ${response.status} ${response.statusText} for ${downloadUrl}`;
       logger.logger.fail(errorMsg);
       return {
@@ -19008,20 +20742,15 @@ async function getLastCommitDetails({
   logger.logger.info(`Requesting last commit for default branch ${defaultBranch} for ${orgGithub}/${repoSlug}...`);
   const commitApiUrl = `${repoApiUrl}/commits?sha=${defaultBranch}&per_page=1`;
   debug.debugFn('inspect', 'url: commit', commitApiUrl);
-  utils.debugApiRequest('GET', commitApiUrl);
-  let commitResponse;
-  try {
-    commitResponse = await utils.apiFetch(commitApiUrl, {
-      headers: {
-        Authorization: `Bearer ${githubToken}`
-      }
-    });
-    utils.debugApiResponse('GET', commitApiUrl, commitResponse.status);
-  } catch (e) {
-    utils.debugApiResponse('GET', commitApiUrl, undefined, e);
-    throw e;
+  const reqResult = await utils.githubApiRequest(commitApiUrl, {
+    headers: {
+      Authorization: `Bearer ${githubToken}`
+    }
+  }, `fetching the latest commit for ${orgGithub}/${repoSlug}`);
+  if (!reqResult.ok) {
+    return reqResult;
   }
-  const commitText = await commitResponse.text();
+  const commitText = reqResult.data.bodyText;
   debug.debugFn('inspect', 'response: commit', commitText);
   let lastCommit;
   try {
@@ -19112,22 +20841,17 @@ async function getRepoDetails({
   debug.debugDir('inspect', {
     repoApiUrl
   });
-  let repoDetailsResponse;
-  try {
-    utils.debugApiRequest('GET', repoApiUrl);
-    repoDetailsResponse = await utils.apiFetch(repoApiUrl, {
-      method: 'GET',
-      headers: {
-        Authorization: `Bearer ${githubToken}`
-      }
-    });
-    utils.debugApiResponse('GET', repoApiUrl, repoDetailsResponse.status);
-  } catch (e) {
-    utils.debugApiResponse('GET', repoApiUrl, undefined, e);
-    throw e;
+  const reqResult = await utils.githubApiRequest(repoApiUrl, {
+    method: 'GET',
+    headers: {
+      Authorization: `Bearer ${githubToken}`
+    }
+  }, `fetching repo details for ${orgGithub}/${repoSlug}`);
+  if (!reqResult.ok) {
+    return reqResult;
   }
   logger.logger.success(`Request completed.`);
-  const repoDetailsText = await repoDetailsResponse.text();
+  const repoDetailsText = reqResult.data.bodyText;
   debug.debugFn('inspect', 'response: repo', repoDetailsText);
   let repoDetails;
   try {
@@ -19168,21 +20892,16 @@ async function getRepoBranchTree({
   logger.logger.info(`Requesting default branch file tree; branch \`${defaultBranch}\`, repo \`${orgGithub}/${repoSlug}\`...`);
   const treeApiUrl = `${repoApiUrl}/git/trees/${defaultBranch}?recursive=1`;
   debug.debugFn('inspect', 'url: tree', treeApiUrl);
-  let treeResponse;
-  try {
-    utils.debugApiRequest('GET', treeApiUrl);
-    treeResponse = await utils.apiFetch(treeApiUrl, {
-      method: 'GET',
-      headers: {
-        Authorization: `Bearer ${githubToken}`
-      }
-    });
-    utils.debugApiResponse('GET', treeApiUrl, treeResponse.status);
-  } catch (e) {
-    utils.debugApiResponse('GET', treeApiUrl, undefined, e);
-    throw e;
+  const reqResult = await utils.githubApiRequest(treeApiUrl, {
+    method: 'GET',
+    headers: {
+      Authorization: `Bearer ${githubToken}`
+    }
+  }, `fetching the file tree for ${orgGithub}/${repoSlug}`);
+  if (!reqResult.ok) {
+    return reqResult;
   }
-  const treeText = await treeResponse.text();
+  const treeText = reqResult.data.bodyText;
   debug.debugFn('inspect', 'response: tree', treeText);
   let treeDetails;
   try {
@@ -22168,5 +23887,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=69b61d3f-9a18-4a06-a0cd-4567860caa90
+//# debugId=684e53fa-a85b-4a32-befc-11d50061b4b0
 //# sourceMappingURL=cli.js.map