@socketsecurity/cli-with-sentry 1.13.0 → 1.14.0

package/dist/cli.js

@@ -1914,23 +1914,11 @@ function serializeSidecar(acc) {
   return result;
 }
 
-// Tells Coana which ecosystems' artifacts only these facts files attribute.
-// Maven's always are (the dynamic-SBOM-inference contract), under its own flag
-// every Coana release knows unless another ecosystem's facts are present too.
-function useOnlySocketFactsArtifactsFlags(sidecar) {
-  const types = new Set(['maven']);
-  for (const entry of Object.values(sidecar ?? {})) {
-    for (const item of [...entry.projects, ...entry.components]) {
-      types.add(item.type);
-    }
-  }
-  return types.size === 1 ? ['--maven-use-only-socket-facts'] : ['--use-only-socket-facts-artifacts', [...types].sort().join(',')];
-}
-
 async function performReachabilityAnalysis(options) {
   const {
     branchName,
     cwd = process.cwd(),
+    factsOnlyTypes,
     orgSlug,
     outputKind = 'text',
     outputPath,
@@ -2023,21 +2011,18 @@ async function performReachabilityAnalysis(options) {
   spinner?.infoAndStop('Running reachability analysis with Coana...');
 
   // Temp file for --compute-artifacts-sidecar, removed in the finally below.
-  // Written even when empty under dynamicSbomInference, since the
-  // facts-only flag below requires one to be present.
+  // Written even when empty with factsOnlyTypes: `coana run` rejects the
+  // facts-only flag without one.
   let sidecarPath;
-  if (reachabilityOptions.dynamicSbomInference || resolvedPathsSidecar && hasResolvedPathsSidecarEntries(resolvedPathsSidecar)) {
+  if (factsOnlyTypes || resolvedPathsSidecar && hasResolvedPathsSidecarEntries(resolvedPathsSidecar)) {
     sidecarPath = path.join(os.tmpdir(), `socket-compute-artifacts-sidecar-${require$$0.randomUUID()}.json`);
-    await u.promises.writeFile(sidecarPath, JSON.stringify(resolvedPathsSidecar ?? {}), 'utf8');
+    await u.promises.writeFile(sidecarPath, JSON.stringify(resolvedPathsSidecar ?? {}));
   }
 
   // Build Coana arguments.
   const coanaArgs = ['run', analysisTarget, '--output-dir', path.dirname(outputFilePath), '--socket-mode', outputFilePath, '--disable-report-submission', ...(isOmittedReachValue(reachabilityOptions.reachAnalysisTimeout) ? [] : ['--analysis-timeout', reachabilityOptions.reachAnalysisTimeout]), ...(isOmittedReachValue(reachabilityOptions.reachAnalysisMemoryLimit) ? [] : ['--memory-limit', reachabilityOptions.reachAnalysisMemoryLimit]), ...(reachabilityOptions.reachConcurrency ? ['--concurrency', `${reachabilityOptions.reachConcurrency}`] : []), ...(reachabilityOptions.reachContinueOnAnalysisErrors ? ['--reach-continue-on-analysis-errors'] : []), ...(reachabilityOptions.reachContinueOnInstallErrors ? ['--reach-continue-on-install-errors'] : []), ...(reachabilityOptions.reachContinueOnMissingLockFiles ? ['--reach-continue-on-missing-lock-files'] : []), ...(reachabilityOptions.reachContinueOnNoSourceFiles ? ['--reach-continue-on-no-source-files'] : []), ...(reachabilityOptions.reachDebug ? ['--debug'] : []), ...(reachabilityOptions.reachDetailedAnalysisLogFile ? ['--print-analysis-log-file'] : []), ...(reachabilityOptions.reachDisableAnalytics ? ['--disable-analytics-sharing'] : []), ...(reachabilityOptions.reachDisableDependencyDownloads ? ['--disable-dependency-downloads'] : []), ...(reachabilityOptions.reachDisableExternalToolChecks ? ['--disable-external-tool-checks'] : []), ...(reachabilityOptions.reachEnableAnalysisSplitting ? [] : ['--disable-analysis-splitting']), '--run-without-docker', '--manifests-tar-hash', tarHash,
   // Empty reachEcosystems implies scanning all ecosystems.
-  ...(reachabilityOptions.reachEcosystems.length ? ['--purl-types', ...reachabilityOptions.reachEcosystems] : []), ...(reachabilityOptions.reachAdvisories.length ? ['--ghsas', ...reachabilityOptions.reachAdvisories] : []), ...(reachabilityOptions.reachExcludePaths.length ? ['--exclude-dirs', ...reachabilityOptions.reachExcludePaths] : []),
-  // sidecarPath is always set above when this is true - Coana rejects this
-  // flag without one.
-  ...(reachabilityOptions.dynamicSbomInference ? useOnlySocketFactsArtifactsFlags(resolvedPathsSidecar) : []), ...(reachabilityOptions.reachSkipCache ? ['--skip-cache-usage'] : []), ...(reachabilityOptions.reachUseOnlyPregeneratedSboms ? ['--use-only-pregenerated-sboms'] : []), ...(sidecarPath ? ['--compute-artifacts-sidecar', sidecarPath] : [])];
+  ...(reachabilityOptions.reachEcosystems.length ? ['--purl-types', ...reachabilityOptions.reachEcosystems] : []), ...(reachabilityOptions.reachAdvisories.length ? ['--ghsas', ...reachabilityOptions.reachAdvisories] : []), ...(reachabilityOptions.reachExcludePaths.length ? ['--exclude-dirs', ...reachabilityOptions.reachExcludePaths] : []), ...(factsOnlyTypes ? utils.useOnlySocketFactsArtifactsFlags(factsOnlyTypes) : []), ...(reachabilityOptions.reachSkipCache ? ['--skip-cache-usage'] : []), ...(reachabilityOptions.reachUseOnlyPregeneratedSboms ? ['--use-only-pregenerated-sboms'] : []), ...(sidecarPath ? ['--compute-artifacts-sidecar', sidecarPath] : [])];
 
   // Build environment variables.
   const coanaEnv = {};
@@ -2114,6 +2099,21 @@ const PURL_TYPE_BY_TOOL = {
   maven: 'maven',
   sbt: 'maven'
 };
+const BUILD_TOOLS = Object.keys(PURL_TYPE_BY_TOOL);
+const ECOSYSTEM_LABELS = {
+  __proto__: null,
+  dotnet: '.NET',
+  gradle: 'Gradle',
+  maven: 'Maven',
+  sbt: 'sbt'
+};
+const FACTS_PURL_TYPES = [...new Set(Object.values(PURL_TYPE_BY_TOOL))].sort();
+function buildToolsFor(purlTypes) {
+  return BUILD_TOOLS.filter(tool => purlTypes.includes(PURL_TYPE_BY_TOOL[tool]));
+}
+function buildToolLabelsFor(purlTypes) {
+  return buildToolsFor(purlTypes).map(tool => ECOSYSTEM_LABELS[tool]);
+}
 
 // Purl types whose packages have no namespace (NuGet ids are flat).
 const NAMESPACELESS_PURL_TYPES = new Set(['nuget']);
@@ -2644,8 +2644,6 @@ function buildFrameworks(parsed, perRoot, exists) {
       })),
       // In compiler order, which F# depends on.
       sources: [...new Set(build?.sources)].filter(exists),
-      references: [...new Set(build?.references)].filter(exists),
-      analyzers: [...new Set(build?.analyzers)].filter(exists),
       targets: sortedUnique(build?.targets ?? []).filter(exists),
       dependencies: [],
       classpath: []
@@ -2940,15 +2938,12 @@ function serializeExcludePathPatterns(paths) {
 // projectInfo names, as the dotnet tool's Reader.cs writes them.
 const PROJECT_INFO_LISTS = {
   __proto__: null,
-  Analyzer: 'analyzers',
   DefineConstant: 'defineConstants',
-  FrameworkReference: 'frameworkReferences',
-  Reference: 'references'
+  FrameworkReference: 'frameworkReferences'
 };
 const PROJECT_INFO_VALUES = {
   __proto__: null,
   AssemblyName: 'assemblyName',
-  BuildError: 'buildError',
   Framework: 'framework',
   LangVersion: 'langVersion',
   Language: 'language',
@@ -3028,10 +3023,8 @@ function parseRecords(text) {
     let b = builds.get(config);
     if (!b) {
       b = {
-        analyzers: [],
         defineConstants: [],
         frameworkReferences: [],
-        references: [],
         sources: [],
         targets: [],
         usings: []
@@ -3512,25 +3505,6 @@ async function readDotnetSdkVersion(bin, opts) {
   }
   return out.stdout.trim();
 }
-const noSdkWarnings = new Set();
-
-// True, after a warning, when no .NET SDK runs in `dir` (none installed, or
-// none matching its global.json), so its .NET builds are skipped.
-async function skipWithoutDotnetSdk(bin, dir) {
-  try {
-    await dotnetSdkVersion(bin, {
-      projectDir: dir
-    });
-    return false;
-  } catch (e) {
-    const reason = utils.getErrorMessageOr(e, `\`${bin} --version\` failed`).split('\n')[0];
-    if (!noSdkWarnings.has(reason)) {
-      noSdkWarnings.add(reason);
-      logger.logger.warn(`Skipping .NET builds where no .NET SDK runs (${reason}); their project files are scanned as they are.`);
-    }
-    return true;
-  }
-}
 
 // Runs the bundled tool against the build's own dotnet, in `mode` (none: a
 // full facts run), and returns its exit and records.
@@ -3601,7 +3575,6 @@ async function readDotnetEntryProjects(opts) {
   return parsed.members.map(m => path.resolve(opts.projectDir, m));
 }
 
-const BUILD_TOOLS = ['dotnet', 'gradle', 'maven', 'sbt'];
 const BUILD_FILE_MATCHERS = new Map(BUILD_TOOLS.map(tool => {
   const files = BUILD_FILES[tool];
   return [tool, files.byFile ? vendor.micromatchExports.matcher(files.nocaseGlob, {
@@ -3748,10 +3721,11 @@ function sortByDepthThenPath(roots, cwd, tool) {
 async function findBuildToolCandidates({
   cwd,
   excludePaths,
+  purlTypes = FACTS_PURL_TYPES,
   sockJson,
   socketConfig
 }) {
-  const enabledTools = BUILD_TOOLS.filter(tool => !sockJson.defaults?.manifest?.[tool]?.disabled);
+  const enabledTools = buildToolsFor(purlTypes).filter(tool => !sockJson.defaults?.manifest?.[tool]?.disabled);
   const result = new Map();
   if (!enabledTools.length) {
     return result;
@@ -4072,8 +4046,8 @@ const NOT_FOUND_CODES = new Set(['NU1100', 'NU1101', 'NU1102', 'NU1103']);
 const SOURCE_CODES = new Set(['NU1301', 'NU1302']);
 
 // The socket-facts-dotnet tool reports restore errors as `<code>: <message>`,
-// and a design-time build failure as `<finding>: <code>: <message>`; its
-// findings without a code count as other failures.
+// and evaluation errors as `<finding>: <code>: <message>`; its findings
+// without a code count as other failures.
 function classifyNugetFailure(detail) {
   const code = /(?:^|: )(NU\d{4}|NETSDK\d{4}|MSB\d{4}):/.exec(detail || '')?.[1];
   if (!code) {
@@ -4734,16 +4708,6 @@ async function runEcosystemCandidates({
         });
         continue;
       }
-      if (ecosystem === 'dotnet' && (
-      // eslint-disable-next-line no-await-in-loop
-      await skipWithoutDotnetSdk(dirConfig.bin, dir))) {
-        outcomes.push({
-          ...root,
-          ecosystem,
-          status: 'skippedNoSdk'
-        });
-        continue;
-      }
       // eslint-disable-next-line no-await-in-loop
       const result = await buildUncoveredRoot({
         config: {
@@ -4873,6 +4837,7 @@ async function generateRecursiveManifests({
   excludePaths,
   ignoreUnresolved,
   optionFlags = new Set(),
+  purlTypes,
   sbtTmpDir,
   sidecarAcc,
   verbose,
@@ -4889,6 +4854,7 @@ async function generateRecursiveManifests({
   const candidatesByTool = await findBuildToolCandidates({
     cwd,
     excludePaths,
+    purlTypes,
     socketConfig: utils.loadSocketConfig(cwd),
     sockJson: withoutDisabledFlags(rootSockJson)
   });
@@ -4978,38 +4944,64 @@ function resolveEcosystemConfig(ecosystem, dir, sockJson) {
   };
 }
 
+// Who consumes the facts: Coana for `fix` and `reach` (which also resolves
+// artifact paths), or only the scan upload.
+
+// Coana takes the discovered ecosystems' artifacts only from facts files, so a
+// build root without them is one it leaves out.
+function checkFactsForCoana(outcomes, consumer, hasFacts) {
+  const hasDisabled = outcomes.some(o => o.status === 'skippedDisabled');
+  // Coana (15.14.1) refuses a facts-only reachability run without any facts.
+  if (consumer === 'reach' && !hasFacts) {
+    throw new utils.InputError(['No build root produced Socket facts, which reachability analysis with --dynamic-sbom-inference needs.', '', ...(hasDisabled ? [`- Re-enable the builds that socket.json skips (\`${DSI_SETUP_COMMAND}\` walks you through it).`] : []), '- Or select other ecosystems with --dynamic-sbom-inference-ecosystems.', '- Or remove --dynamic-sbom-inference to analyze the manifest files as they are.'].join('\n'));
+  }
+  if (hasDisabled) {
+    logger.logger.warn('The analysis leaves out the build roots socket.json skips: with --dynamic-sbom-inference, it takes their dependencies only from Socket facts.');
+  }
+}
+
 // Recursively discovers and generates Socket facts for every independent
-// gradle/sbt/maven build root under `cwd`, returning the generated facts
-// paths plus the resolved-paths sidecar that reachability forwards to Coana.
+// build root of the selected ecosystems under `cwd`, returning the generated
+// facts paths plus the resolved-paths sidecar that reachability forwards to
+// Coana.
 async function runDynamicSbomInference({
+  consumer,
   cwd,
   excludePaths,
-  sbtTmpDir,
-  sidecar,
-  withFiles
+  purlTypes,
+  sbtTmpDir
 }) {
-  const sidecarAcc = sidecar ?? withFiles ? new Map() : undefined;
+  const withFiles = consumer === 'reach';
+  const coanaReadsFacts = consumer === 'fix' || consumer === 'reach';
+  const sidecarAcc = coanaReadsFacts ? new Map() : undefined;
   const outcomes = await generateRecursiveManifests({
     cwd,
     excludePaths,
+    purlTypes,
     sbtTmpDir: withFiles ? sbtTmpDir : undefined,
     sidecarAcc,
     verbose: false,
     withFiles
   });
+  const factsOnlyTypes = [...new Set(outcomes.map(o => PURL_TYPE_BY_TOOL[o.ecosystem]))];
   // No candidates discovered at all (distinct from candidates that were found
   // but produced no generated facts - empty/skippedDisabled are already warned
   // about elsewhere and are not this kind of mistake).
-  if (!outcomes.length) {
-    throw new utils.InputError(['No Gradle, sbt, Maven or .NET build root was found.', '', '- Remove --dynamic-sbom-inference; it only applies to these ecosystems.', '- Make sure to run it from the correct dir (use --cwd to target another dir).'].join('\n'));
+  if (!utils.isFactsOnlyTypes(factsOnlyTypes)) {
+    throw new utils.InputError([`No ${arrays.joinOr(buildToolLabelsFor(purlTypes))} build root was found.`, '', '- Select other ecosystems with --dynamic-sbom-inference-ecosystems, or remove --dynamic-sbom-inference.', '- Make sure to run it from the correct dir (use --cwd to target another dir).'].join('\n'));
   }
   // Fail loud rather than silently proceed with a partial multi-root result:
   // matches handleManifestDynamicSbomInference's own check.
   if (outcomes.some(o => o.status === 'failed')) {
     throw new utils.InputError('One or more independent build roots failed to generate Socket facts; aborting (see the errors above).');
   }
+  const factsPaths = outcomes.filter(o => o.status === 'generated').map(o => o.factsPath);
+  if (coanaReadsFacts) {
+    checkFactsForCoana(outcomes, consumer, !!factsPaths.length);
+  }
   return {
-    factsPaths: outcomes.filter(o => o.status === 'generated').map(o => o.factsPath),
+    factsOnlyTypes,
+    factsPaths,
     resolvedPathsSidecar: sidecarAcc && hasSidecarEntries(sidecarAcc) ? serializeSidecar(sidecarAcc) : undefined
   };
 }
@@ -8516,19 +8508,16 @@ async function generateAutoManifest({
     abortFactsRunIfFailed('maven', outcome);
   }
   if (!sockJson?.defaults?.manifest?.dotnet?.disabled && detected.dotnet) {
-    const config = resolveEcosystemConfig('dotnet', cwd, sockJson);
-    if (!(await skipWithoutDotnetSdk(config.bin, cwd))) {
-      logger.logger.log('Detected a .NET solution or project, generating Socket facts...');
-      const outcome = await convertDotnetToFacts({
-        config,
-        cwd,
-        excludePaths,
-        hints,
-        sidecarAcc,
-        withFiles: computeArtifactsSidecar
-      });
-      abortFactsRunIfFailed('dotnet', outcome);
-    }
+    logger.logger.log('Detected a .NET solution or project, generating Socket facts...');
+    const outcome = await convertDotnetToFacts({
+      config: resolveEcosystemConfig('dotnet', cwd, sockJson),
+      cwd,
+      excludePaths,
+      hints,
+      sidecarAcc,
+      withFiles: computeArtifactsSidecar
+    });
+    abortFactsRunIfFailed('dotnet', outcome);
   }
   if (!sockJson?.defaults?.manifest?.conda?.disabled && detected.conda) {
     const condaFile = sockJson.defaults?.manifest?.conda?.infile || detected.condaFile || constants.ENVIRONMENT_YML;
@@ -8653,9 +8642,10 @@ async function createNewScan({
 
   // Sidecar forwarded to reachability; populated only when reach runs.
   let resolvedPathsSidecar;
+  let factsOnlyTypes;
 
   // sbt provisions its Scala toolchain under the directory passed as its
-  // isolated global base; withFiles' artifactPaths point into it, so it must
+  // isolated global base; reach's artifactPaths point into it, so it must
   // stay on disk until the reachability analysis below has consumed those
   // paths. Always allocated (even when unused) to keep this uniform rather
   // than conditional on autoManifest/reach.
@@ -8669,18 +8659,20 @@ async function createNewScan({
         // one at cwd. This runs on its own, so nothing outside those
         // ecosystems is generated unless --auto-manifest also asked for it.
         const dynamicResult = await runDynamicSbomInference({
+          consumer: reach.runReachabilityAnalysis ? 'reach' : 'upload',
           cwd,
           excludePaths: reach.excludePaths,
+          purlTypes: reach.dynamicSbomInference,
           // sbt's Scala toolchain lives under its shared global base;
-          // withFiles' resolved paths point into it, so when reachability
+          // reach's artifactPaths point into it, so when reachability
           // will consume them afterward, reuse manifestTmpDir (kept alive
           // until reach finishes below) instead of letting the call clean
           // its own ephemeral base up before reach ever reads those paths.
-          sbtTmpDir: manifestTmpDir,
-          withFiles: reach.runReachabilityAnalysis
+          sbtTmpDir: manifestTmpDir
         });
         scanTargets = Array.from(new Set([...scanTargets, ...dynamicResult.factsPaths]));
         resolvedPathsSidecar = dynamicResult.resolvedPathsSidecar;
+        factsOnlyTypes = dynamicResult.factsOnlyTypes;
       }
       if (autoManifest) {
         const sockJson = utils.readOrDefaultSocketJson(cwd);
@@ -8691,10 +8683,9 @@ async function createNewScan({
         if (reach.dynamicSbomInference) {
           // Already generated recursively above; resolving cwd's own build
           // root a second time would race on the same facts file.
-          detected.dotnet = false;
-          detected.gradle = false;
-          detected.sbt = false;
-          detected.maven = false;
+          for (const tool of buildToolsFor(reach.dynamicSbomInference)) {
+            detected[tool] = false;
+          }
         }
         const autoManifestResult = await generateAutoManifest({
           computeArtifactsSidecar: reach.runReachabilityAnalysis,
@@ -8794,6 +8785,7 @@ async function createNewScan({
       const reachResult = await performReachabilityAnalysis({
         branchName,
         cwd,
+        factsOnlyTypes,
         orgSlug,
         outputKind,
         packagePaths,
@@ -8980,7 +8972,7 @@ async function handleCi(autoManifest) {
     pendingHead: true,
     pullRequest: detectCiPullRequestNumber(),
     reach: {
-      dynamicSbomInference: false,
+      dynamicSbomInference: undefined,
       excludePaths: [],
       reachAdvisories: [],
       reachAnalysisMemoryLimit: '',
@@ -10342,6 +10334,7 @@ async function generateSocketFactsForFix({
   cwd,
   excludePaths,
   findFactsPaths,
+  purlTypes,
   tmpDir
 }) {
   const existingPaths = await findFactsPaths();
@@ -10355,24 +10348,24 @@ async function generateSocketFactsForFix({
   };
   let artifactsFlags;
   let paths;
-  let sidecarFile;
+  const sidecarFile = path.join(tmpDir, 'sidecar.json');
   try {
     const {
+      factsOnlyTypes,
       factsPaths,
       resolvedPathsSidecar
     } = await runDynamicSbomInference({
+      consumer: 'fix',
       cwd,
       excludePaths,
-      sbtTmpDir: undefined,
-      sidecar: true,
-      withFiles: false
+      purlTypes,
+      sbtTmpDir: undefined
     });
-    artifactsFlags = useOnlySocketFactsArtifactsFlags(resolvedPathsSidecar);
+    artifactsFlags = utils.useOnlySocketFactsArtifactsFlags(factsOnlyTypes);
     paths = factsPaths.map(p => path.resolve(cwd, p));
-    if (resolvedPathsSidecar) {
-      sidecarFile = path.join(tmpDir, 'sidecar.json');
-      await fs.writeFile(sidecarFile, JSON.stringify(resolvedPathsSidecar));
-    }
+    // Written even when empty, as for reach; applying fixes looks each facts
+    // file up in it, so an empty one is the same as none.
+    await fs.writeFile(sidecarFile, JSON.stringify(resolvedPathsSidecar ?? {}));
   } catch (e) {
     // A failed build root aborts inference after others wrote their facts.
     await reset(await findFactsPaths());
@@ -10522,11 +10515,13 @@ function formatNotAppliedFixes(notApplied) {
   return notApplied.map(f => `  ${f.ghsa}: ${f.purl} -> ${f.fixedVersion}: ${f.reason}`).join('\n');
 }
 async function coanaFix(fixConfig) {
-  if (!fixConfig.dynamicSbomInference) {
+  const purlTypes = fixConfig.dynamicSbomInference;
+  if (!purlTypes) {
     return await coanaFixWithFacts(fixConfig, undefined);
   }
   return await utils.withTmpDir('socket-fix-facts-', async tmpDir => {
     const slot = {
+      purlTypes,
       tmpDir
     };
     try {
@@ -10610,11 +10605,12 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
   if (factsSlot) {
     if (!silence) {
       spinner?.stop();
-      logger.logger.info('Generating Socket facts for .NET, Gradle, sbt and Maven builds ...');
+      logger.logger.info('Generating Socket facts for each build ...');
     }
     factsSlot.generated = await generateSocketFactsForFix({
       cwd,
       excludePaths,
+      purlTypes: factsSlot.purlTypes,
       findFactsPaths: async () => (await findScanFilepaths()).filter(utils.isSocketFactsFile),
       tmpDir: factsSlot.tmpDir
     });
@@ -11247,6 +11243,26 @@ async function handleFix({
 // differs: reachability is optional on `scan create` and always on for
 // `scan reach`.
 const DYNAMIC_SBOM_INFERENCE_DESCRIPTION = 'For Gradle, sbt, Maven and .NET: generate a Socket facts SBOM (produced directly by each package manager) per independent build root, instead of one synthetic root.';
+
+// Not in reachabilityFlags: it applies to a `scan create` without --reach too.
+const dynamicSbomInferenceEcosystemsFlags = {
+  dynamicSbomInferenceEcosystems: {
+    type: 'string',
+    isMultiple: true,
+    description: `With --dynamic-sbom-inference: generate Socket facts only for these ecosystems, as either a comma separated value or as multiple flags; the others keep their manifest files as they are. Supported: ${arrays.joinAnd(FACTS_PURL_TYPES.map(t => `${t} (${arrays.joinAnd(buildToolLabelsFor([t]))})`))}. Defaults to all of them.`
+  }
+};
+function parseDynamicSbomInferenceFlags(flags) {
+  const raw = utils.cmdFlagValueToArray(flags['dynamicSbomInferenceEcosystems']);
+  if (!flags['dynamicSbomInference']) {
+    if (raw.length) {
+      throw new utils.InputError('--dynamic-sbom-inference-ecosystems requires --dynamic-sbom-inference');
+    }
+    return undefined;
+  }
+  const selected = utils.parseEcosystemChoices(raw, FACTS_PURL_TYPES);
+  return utils.isFactsOnlyTypes(selected) ? selected : FACTS_PURL_TYPES;
+}
 const reachabilityFlags = {
   reachVersion: {
     type: 'string',
@@ -11495,6 +11511,7 @@ Available styles:
     default: false,
     description: `${DYNAMIC_SBOM_INFERENCE_DESCRIPTION} Fixes are then attributed to the projects/modules that actually resolve each vulnerable dependency. The generated files are removed afterwards.`
   },
+  ...dynamicSbomInferenceEcosystemsFlags,
   ecosystems: {
     type: 'string',
     default: [],
@@ -11629,7 +11646,6 @@ async function run$O(argv, importMeta, {
     autopilot,
     debug,
     disableExternalToolChecks,
-    dynamicSbomInference,
     ecosystems,
     exclude,
     excludePaths,
@@ -11655,23 +11671,10 @@ async function run$O(argv, importMeta, {
   const minSatisfying = cli.flags['minSatisfying'] || !maxSatisfying;
   const disableMajorUpdates = !majorUpdates;
   const outputKind = utils.getOutputKind(json, markdown);
-
-  // Process comma-separated values for ecosystems flag.
-  // ALL_ECOSYSTEMS is lowercase, so normalize input for a case-insensitive
-  // match (mirrors --package-managers behavior).
-  const ecosystemsRaw = utils.cmdFlagValueToArray(ecosystems).map(s => s.toLowerCase());
+  const dynamicSbomInference = parseDynamicSbomInferenceFlags(cli.flags);
 
   // Validate ecosystem values early, before dry-run check.
-  const validatedEcosystems = [];
-  const validEcosystemChoices = utils.getEcosystemChoicesForMeow();
-  for (const ecosystem of ecosystemsRaw) {
-    if (!validEcosystemChoices.includes(ecosystem)) {
-      logger.logger.fail(`Invalid ecosystem: "${ecosystem}". Valid values are: ${arrays.joinAnd(validEcosystemChoices)}`);
-      process.exitCode = 1;
-      return;
-    }
-    validatedEcosystems.push(ecosystem);
-  }
+  const validatedEcosystems = utils.parseEcosystemChoices(utils.cmdFlagValueToArray(ecosystems), utils.getEcosystemChoicesForMeow());
 
   // Process and validate package manager values early, before dry-run check.
   // Coana normalizes input to uppercase and rejects unknown values, so do the
@@ -16256,13 +16259,6 @@ async function enumerateWorkspaces({
 // several POMs, so several roots, there.
 
 const ROOT_ECOSYSTEMS = ['maven', 'gradle', 'sbt', 'dotnet'];
-const ECOSYSTEM_LABELS = {
-  __proto__: null,
-  dotnet: '.NET',
-  gradle: 'Gradle',
-  maven: 'Maven',
-  sbt: 'sbt'
-};
 
 // The shallowest directory matching `--exclude-paths`, not necessarily a
 // project dir itself - one write here covers every project beneath it.
@@ -16435,12 +16431,6 @@ async function markWorkspaceCoverage({
       data: undefined
     };
   }
-  if (ecosystem === 'dotnet' && (await skipWithoutDotnetSdk(bin, dir))) {
-    return {
-      ok: true,
-      data: undefined
-    };
-  }
   for (const root of roots) {
     if (
     // eslint-disable-next-line no-await-in-loop
@@ -21521,6 +21511,7 @@ const generalFlags$1 = {
     default: false,
     description: `${DYNAMIC_SBOM_INFERENCE_DESCRIPTION} Combine with --reach to split the reachability analysis per project/module.`
   },
+  ...dynamicSbomInferenceEcosystemsFlags,
   interactive: {
     type: 'boolean',
     default: true,
@@ -21673,7 +21664,6 @@ async function run$d(argv, importMeta, {
     committers,
     cwd: cwdOverride,
     defaultBranch,
-    dynamicSbomInference,
     interactive = true,
     json,
     markdown,
@@ -21708,6 +21698,7 @@ async function run$d(argv, importMeta, {
 
   // Validate ecosystem values against the reachability-supported set.
   const reachEcosystems = utils.parseReachEcosystems(utils.cmdFlagValueToArray(cli.flags['reachEcosystems']));
+  const dynamicSbomInference = parseDynamicSbomInferenceFlags(cli.flags);
   warnSocketJsonOnlyFlags(cli.flags, `${parentName} ${CMD_NAME$a}`);
   const dryRun = !!cli.flags['dryRun'];
   const uvMembers = !!cli.flags['uvMembers'];
@@ -21949,7 +21940,7 @@ async function run$d(argv, importMeta, {
     pendingHead: Boolean(pendingHead),
     pullRequest: Number(pullRequest),
     reach: {
-      dynamicSbomInference: Boolean(dynamicSbomInference),
+      dynamicSbomInference,
       excludePaths,
       reachAdvisories,
       reachAnalysisMemoryLimit,
@@ -22669,7 +22660,7 @@ async function scanOneRepo(repoSlug, {
     pendingHead: true,
     pullRequest: 0,
     reach: {
-      dynamicSbomInference: false,
+      dynamicSbomInference: undefined,
       excludePaths: [],
       reachAdvisories: [],
       reachAnalysisMemoryLimit: '',
@@ -23874,18 +23865,17 @@ async function runScanReach({
   // Extra discovery targets beyond the user's own; the reachability target
   // itself stays `targets[0]`.
   let scanTargets = targets;
-  // Sidecar forwarded to reachability; populated by dynamic SBOM inference.
-  let resolvedPathsSidecar;
+  let dynamicResult;
   if (reachabilityOptions.dynamicSbomInference) {
-    logger.logger.info('Generating Socket facts for each Gradle, sbt, Maven and .NET build root ...');
-    const dynamicResult = await runDynamicSbomInference({
+    logger.logger.info('Generating Socket facts for each build root ...');
+    dynamicResult = await runDynamicSbomInference({
+      consumer: 'reach',
       cwd,
       excludePaths: reachabilityOptions.excludePaths,
-      sbtTmpDir,
-      withFiles: true
+      purlTypes: reachabilityOptions.dynamicSbomInference,
+      sbtTmpDir
     });
     scanTargets = Array.from(new Set([...scanTargets, ...dynamicResult.factsPaths]));
-    resolvedPathsSidecar = dynamicResult.resolvedPathsSidecar;
   }
 
   // Get supported file names.
@@ -23934,12 +23924,13 @@ async function runScanReach({
   spinner.start('Running reachability analysis...');
   const result = await performReachabilityAnalysis({
     cwd,
+    factsOnlyTypes: dynamicResult?.factsOnlyTypes,
     orgSlug,
     outputKind,
     outputPath,
     packagePaths,
     reachabilityOptions: mergedReachabilityOptions,
-    resolvedPathsSidecar,
+    resolvedPathsSidecar: dynamicResult?.resolvedPathsSidecar,
     spinner,
     target: targets[0]
   });
@@ -23985,6 +23976,7 @@ const reachabilityFlagsForReach = {
     default: false,
     description: `${DYNAMIC_SBOM_INFERENCE_DESCRIPTION} The reachability analysis is split per project/module accordingly.`
   },
+  ...dynamicSbomInferenceEcosystemsFlags,
   // Fallback targets scan creation, which this command never performs.
   reachFallbackToRegularScan: {
     type: 'boolean',
@@ -24072,7 +24064,6 @@ async function run$7(argv, importMeta, {
   warnSocketJsonOnlyFlags(cli.flags, `${parentName} ${CMD_NAME$4}`);
   const {
     cwd: cwdOverride,
-    dynamicSbomInference,
     interactive = true,
     json,
     markdown,
@@ -24109,6 +24100,7 @@ async function run$7(argv, importMeta, {
 
   // Validate ecosystem values against the reachability-supported set.
   const reachEcosystems = utils.parseReachEcosystems(reachEcosystemsRaw);
+  const dynamicSbomInference = parseDynamicSbomInferenceFlags(cli.flags);
   const processCwd = process.cwd();
   const cwd = cwdOverride && cwdOverride !== '.' && cwdOverride !== processCwd ? path.resolve(processCwd, cwdOverride) : processCwd;
 
@@ -24183,7 +24175,7 @@ async function run$7(argv, importMeta, {
     outputKind,
     outputPath: outputPath || '',
     reachabilityOptions: {
-      dynamicSbomInference: Boolean(dynamicSbomInference),
+      dynamicSbomInference,
       excludePaths,
       reachAdvisories,
       reachAnalysisMemoryLimit,
@@ -26151,5 +26143,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=1216e328-379a-4a10-9a67-9077254e95f9
+//# debugId=e8c87646-0d74-4bcc-9e38-e86a951f03ae
 //# sourceMappingURL=cli.js.map