@socketsecurity/cli 1.1.102 → 1.1.152

package/external/blessed/lib/tput.js

@@ -886,7 +886,7 @@ Tput.prototype._compile = function(info, key, str) {
           ch = ':';
           break;
         case '0':
-          ch = '\200';
+          ch = '\x80';
           break;
         case 'a':
           ch = '\x07';
@@ -2096,10 +2096,10 @@ Tput.prototype.detectBrokenACS = function(info) {
       && process.env.TERMCAP
       && ~process.env.TERMCAP.indexOf('screen')
       && ~process.env.TERMCAP.indexOf('hhII00')) {
-    if (~info.strings.enter_alt_charset_mode.indexOf('\016')
-        || ~info.strings.enter_alt_charset_mode.indexOf('\017')
-        || ~info.strings.set_attributes.indexOf('\016')
-        || ~info.strings.set_attributes.indexOf('\017')) {
+    if (~info.strings.enter_alt_charset_mode.indexOf('\x0e')
+        || ~info.strings.enter_alt_charset_mode.indexOf('\x0f')
+        || ~info.strings.set_attributes.indexOf('\x0e')
+        || ~info.strings.set_attributes.indexOf('\x0f')) {
       return true;
     }
   }

package/package.json

@@ -1,9 +1,12 @@
 {
   "name": "@socketsecurity/cli",
-  "version": "1.1.102",
+  "version": "1.1.152",
   "description": "CLI for Socket.dev",
+  "contentPolicy": {
+    "class": "dual-use"
+  },
   "homepage": "https://github.com/SocketDev/socket-cli",
-  "license": "MIT AND OFL-1.1",
+  "license": "MIT",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/SocketDev/socket-cli.git"
@@ -32,72 +35,18 @@
     "./requirements.json": "./requirements.json",
     "./translations.json": "./translations.json"
   },
-  "scripts": {
-    "build": "pnpm build:dist",
-    "build:dist": "pnpm build:dist:src && pnpm build:dist:types",
-    "build:dist:src": "run-p -c clean:dist clean:external && dotenvx -q run -f .env.local -- rollup -c .config/rollup.dist.config.mjs",
-    "build:dist:types": "pnpm clean:dist:types && tsgo --project tsconfig.dts.json",
-    "build:sea": "node src/sea/build-sea.mts",
-    "build:sea:internal:bootstrap": "rollup -c .config/rollup.sea.config.mjs",
-    "check": "pnpm check:lint && pnpm check:tsc",
-    "check:lint": "dotenvx -q run -f .env.local -- eslint --report-unused-disable-directives .",
-    "check:tsc": "tsgo",
-    "check-ci": "pnpm check:lint",
-    "coverage": "run-s coverage:*",
-    "coverage:test": "run-s test:prepare test:unit:coverage",
-    "coverage:type": "dotenvx -q run -f .env.local -- type-coverage --detail",
-    "clean": "run-p -c --aggregate-output clean:*",
-    "clean:cache": "del-cli '**/.cache'",
-    "clean:dist": "del-cli 'dist'",
-    "clean:dist:types": "del-cli 'dist/types'",
-    "clean:external": "del-cli 'external'",
-    "clean:node_modules": "del-cli '**/node_modules'",
-    "fix": "pnpm lint:fix",
-    "knip:dependencies": "knip --dependencies",
-    "knip:exports": "knip --include exports,duplicates",
-    "lint": "dotenvx -q run -f .env.local -- oxlint -c=.oxlintrc.json --ignore-path=.oxlintignore --tsconfig=tsconfig.json .",
-    "lint:dist:fix": "run-s -c lint:dist:fix:*",
-    "lint:dist:fix:oxlint": "dotenvx -q run -f .env.dist -- oxlint -c=.oxlintrc.json --ignore-path=.oxlintignore --tsconfig=tsconfig.json --silent --fix ./dist | dev-null",
-    "lint:dist:fix:biome": "dotenvx -q run -f .env.dist -- biome format --log-level=none --fix ./dist | dev-null",
-    "//lint:dist:fix:eslint": "dotenvx -q run -f .env.dist -- eslint --report-unused-disable-directives --quiet --fix ./dist | dev-null",
-    "lint:external:fix": "run-s -c lint:external:fix:*",
-    "lint:external:fix:oxlint": "dotenvx -q run -f .env.external -- oxlint -c=.oxlintrc.json --ignore-path=.oxlintignore --tsconfig=tsconfig.json --silent --fix ./external | dev-null",
-    "lint:external:fix:biome": "dotenvx -q run -f .env.external -- biome format --log-level=none --fix ./external | dev-null",
-    "//lint:external:fix:eslint": "dotenvx -q run -f .env.external -- eslint --report-unused-disable-directives --quiet --fix ./external | dev-null",
-    "lint:fix": "run-s -c lint:fix:*",
-    "lint:fix:oxlint": "dotenvx -q run -f .env.local -- oxlint -c=.oxlintrc.json --ignore-path=.oxlintignore --tsconfig=tsconfig.json --quiet --fix . | dev-null",
-    "lint:fix:biome": "dotenvx -q run -f .env.local -- biome format --log-level=none --fix . | dev-null",
-    "lint:fix:eslint": "dotenvx -q run -f .env.local -- eslint --report-unused-disable-directives --fix . | dev-null",
-    "lint-staged": "dotenvx -q run -f .env.local -- lint-staged",
-    "precommit": "dotenvx -q run -f .env.local -- lint-staged",
-    "prepare": "dotenvx -q run -f .env.local -- husky",
-    "bs": "dotenvx -q run -f .env.local -- pnpm build:dist:src; pnpm exec socket --",
-    "s": "dotenvx -q run -f .env.local -- pnpm exec socket --",
-    "e2e-tests": "dotenvx -q run -f .env.test -- vitest run --config vitest.e2e.config.mts",
-    "test": "run-s check test:*",
-    "test:prepare": "dotenvx -q run -f .env.test -- pnpm build && del-cli 'test/**/node_modules'",
-    "test:unit": "dotenvx -q run -f .env.test -- vitest run",
-    "test:unit:update": "dotenvx -q run -f .env.test -- vitest run --update",
-    "test:unit:coverage": "dotenvx -q run -f .env.test -- vitest run --coverage",
-    "test-ci": "run-s test:*",
-    "testu": "dotenvx -q run -f .env.testu -- run-s test:prepare; pnpm test:unit:update --",
-    "testuf": "dotenvx -q run -f .env.testu -- pnpm test:unit:update --",
-    "update": "run-p --aggregate-output update:**",
-    "update:deps": "taze",
-    "update:socket": "pnpm update '@socketsecurity/*' '@socketregistry/*' --latest"
-  },
   "dependencies": {
     "@socketsecurity/socket-patch": "2.0.0"
   },
   "devDependencies": {
-    "@babel/core": "7.28.4",
+    "@babel/core": "7.29.6",
     "@babel/plugin-proposal-export-default-from": "7.27.1",
     "@babel/plugin-transform-export-namespace-from": "7.27.1",
     "@babel/plugin-transform-runtime": "7.28.3",
     "@babel/preset-typescript": "7.27.1",
     "@babel/runtime": "7.28.4",
     "@biomejs/biome": "2.2.4",
-    "@coana-tech/cli": "15.3.6",
+    "@coana-tech/cli": "15.10.0",
     "@cyclonedx/cdxgen": "12.1.2",
     "@dotenvx/dotenvx": "1.49.0",
     "@eslint/compat": "1.3.2",
@@ -125,7 +74,7 @@
     "@socketregistry/packageurl-js": "1.0.9",
     "@socketsecurity/config": "3.0.1",
     "@socketsecurity/registry": "1.1.17",
-    "@socketsecurity/sdk": "1.4.96",
+    "@socketsecurity/sdk": "4.0.3",
     "@types/blessed": "0.1.25",
     "@types/cmd-shim": "5.0.2",
     "@types/js-yaml": "4.0.9",
@@ -174,8 +123,6 @@
     "oxlint": "1.15.0",
     "pony-cause": "2.1.11",
     "postject": "1.0.0-alpha.6",
-    "registry-auth-token": "5.1.0",
-    "registry-url": "7.2.0",
     "rollup": "4.50.1",
     "semver": "7.7.2",
     "synp": "1.9.14",
@@ -196,13 +143,13 @@
     "node": ">=18.20.8",
     "pnpm": ">=10.33.0"
   },
-  "packageManager": "pnpm@10.33.0",
   "files": [
     "bin/**",
     "dist/**",
     "external/**",
     "shadow-bin/**",
     "CHANGELOG.md",
+    "DISCLOSURE",
     "logo-dark.png",
     "logo-light.png",
     "requirements.json",
@@ -214,74 +161,6 @@
       "pnpm lint:fix:biome -- --no-errors-on-unmatched --files-ignore-unknown=true --colors=off"
     ]
   },
-  "pnpm": {
-    "overrides": {
-      "@octokit/graphql": "$@octokit/graphql",
-      "@octokit/request-error": "$@octokit/request-error",
-      "@rollup/plugin-commonjs": "28.0.6",
-      "@socketsecurity/registry": "$@socketsecurity/registry",
-      "aggregate-error": "npm:@socketregistry/aggregate-error@^1.0.14",
-      "ansi-regex": "6.1.0",
-      "ansi-term": "0.0.2",
-      "blessed": "0.1.81",
-      "blessed-contrib": "4.11.0",
-      "brace-expansion": "2.0.2",
-      "bresenham": "0.0.3",
-      "drawille-blessed-contrib": "1.0.0",
-      "drawille-canvas-blessed-contrib": "0.1.3",
-      "es-define-property": "npm:@socketregistry/es-define-property@^1.0.7",
-      "es-set-tostringtag": "npm:@socketregistry/es-set-tostringtag@^1.0.9",
-      "function-bind": "npm:@socketregistry/function-bind@^1.0.7",
-      "globalthis": "npm:@socketregistry/globalthis@^1.0.7",
-      "gopd": "npm:@socketregistry/gopd@^1.0.7",
-      "graceful-fs": "4.2.11",
-      "has-property-descriptors": "npm:@socketregistry/has-property-descriptors@^1.0.7",
-      "has-proto": "npm:@socketregistry/has-proto@^1.0.7",
-      "has-symbols": "npm:@socketregistry/has-symbols@^1.0.7",
-      "has-tostringtag": "npm:@socketregistry/has-tostringtag@^1.0.7",
-      "hasown": "npm:@socketregistry/hasown@^1.0.7",
-      "indent-string": "npm:@socketregistry/indent-string@^1.0.13",
-      "is-core-module": "npm:@socketregistry/is-core-module@^1.0.10",
-      "isarray": "npm:@socketregistry/isarray@^1.0.7",
-      "lodash": "4.17.21",
-      "meow": "13.2.0",
-      "npm-package-arg": "$npm-package-arg",
-      "packageurl-js": "npm:@socketregistry/packageurl-js@^1.0.9",
-      "path-parse": "npm:@socketregistry/path-parse@^1.0.7",
-      "rollup": "4.50.1",
-      "safe-buffer": "npm:@socketregistry/safe-buffer@^1.0.8",
-      "safer-buffer": "npm:@socketregistry/safer-buffer@^1.0.9",
-      "semver": "$semver",
-      "set-function-length": "npm:@socketregistry/set-function-length@^1.0.9",
-      "shell-quote": "npm:shell-quote@^1.8.3",
-      "side-channel": "npm:@socketregistry/side-channel@^1.0.9",
-      "string_decoder": "0.10.31",
-      "tiny-colors": "$yoctocolors-cjs",
-      "tiny-updater": "3.5.3",
-      "typedarray": "npm:@socketregistry/typedarray@^1.0.7",
-      "undici": "6.21.3",
-      "vite": "7.1.5",
-      "xml2js": "0.6.2",
-      "yaml": "2.8.1",
-      "yargs-parser": "$yargs-parser"
-    },
-    "patchedDependencies": {
-      "graceful-fs@4.2.11": "patches/graceful-fs@4.2.11.patch",
-      "string_decoder@0.10.31": "patches/string_decoder@0.10.31.patch",
-      "meow@13.2.0": "patches/meow@13.2.0.patch",
-      "@rollup/plugin-commonjs@28.0.6": "patches/@rollup__plugin-commonjs@28.0.6.patch",
-      "ansi-term@0.0.2": "patches/ansi-term@0.0.2.patch",
-      "drawille-blessed-contrib@1.0.0": "patches/drawille-blessed-contrib@1.0.0.patch",
-      "drawille-canvas-blessed-contrib@0.1.3": "patches/drawille-canvas-blessed-contrib@0.1.3.patch",
-      "blessed@0.1.81": "patches/blessed@0.1.81.patch",
-      "blessed-contrib@4.11.0": "patches/blessed-contrib@4.11.0.patch",
-      "brace-expansion@2.0.2": "patches/brace-expansion@2.0.2.patch",
-      "bresenham@0.0.3": "patches/bresenham@0.0.3.patch",
-      "lodash@4.17.21": "patches/lodash@4.17.21.patch",
-      "rollup@4.50.1": "patches/rollup@4.50.1.patch",
-      "tiny-updater@3.5.3": "patches/tiny-updater@3.5.3.patch"
-    }
-  },
   "typeCoverage": {
     "cache": true,
     "atLeast": 95,
@@ -292,5 +171,59 @@
     "ignore-type-assertion": true,
     "ignore-files": "test/*",
     "strict": true
+  },
+  "scripts": {
+    "build": "pnpm build:dist",
+    "build:dist": "pnpm build:dist:src && pnpm build:dist:types",
+    "build:dist:src": "run-p -c clean:dist clean:external && dotenvx -q run -f .env.local -- rollup -c .config/rollup.dist.config.mjs",
+    "build:dist:types": "pnpm clean:dist:types && tsgo --project tsconfig.dts.json",
+    "build:maven-extension": "bash src/commands/manifest/scripts/maven-extension/build-jar.sh",
+    "build:sea": "node src/sea/build-sea.mts",
+    "build:sea:internal:bootstrap": "rollup -c .config/rollup.sea.config.mjs",
+    "check": "pnpm check:lint && pnpm check:tsc",
+    "check:lint": "dotenvx -q run -f .env.local -- eslint --report-unused-disable-directives .",
+    "check:tsc": "tsgo",
+    "check-ci": "pnpm check:lint",
+    "coverage": "run-s coverage:*",
+    "coverage:test": "run-s test:prepare test:unit:coverage",
+    "coverage:type": "dotenvx -q run -f .env.local -- type-coverage --detail",
+    "clean": "run-p -c --aggregate-output clean:*",
+    "clean:cache": "del-cli '**/.cache'",
+    "clean:dist": "del-cli 'dist'",
+    "clean:dist:types": "del-cli 'dist/types'",
+    "clean:external": "del-cli 'external'",
+    "clean:node_modules": "del-cli '**/node_modules'",
+    "fix": "pnpm lint:fix",
+    "knip:dependencies": "knip --dependencies",
+    "knip:exports": "knip --include exports,duplicates",
+    "lint": "dotenvx -q run -f .env.local -- oxlint -c=.oxlintrc.json --ignore-path=.oxlintignore --tsconfig=tsconfig.json .",
+    "lint:dist:fix": "run-s -c lint:dist:fix:*",
+    "lint:dist:fix:oxlint": "dotenvx -q run -f .env.dist -- oxlint -c=.oxlintrc.json --ignore-path=.oxlintignore --tsconfig=tsconfig.json --silent --fix ./dist | dev-null",
+    "lint:dist:fix:biome": "dotenvx -q run -f .env.dist -- biome format --log-level=none --fix ./dist | dev-null",
+    "//lint:dist:fix:eslint": "dotenvx -q run -f .env.dist -- eslint --report-unused-disable-directives --quiet --fix ./dist | dev-null",
+    "lint:external:fix": "run-s -c lint:external:fix:*",
+    "lint:external:fix:oxlint": "dotenvx -q run -f .env.external -- oxlint -c=.oxlintrc.json --ignore-path=.oxlintignore --tsconfig=tsconfig.json --silent --fix ./external | dev-null",
+    "lint:external:fix:biome": "dotenvx -q run -f .env.external -- biome format --log-level=none --fix ./external | dev-null",
+    "//lint:external:fix:eslint": "dotenvx -q run -f .env.external -- eslint --report-unused-disable-directives --quiet --fix ./external | dev-null",
+    "lint:fix": "run-s -c lint:fix:*",
+    "lint:fix:oxlint": "dotenvx -q run -f .env.local -- oxlint -c=.oxlintrc.json --ignore-path=.oxlintignore --tsconfig=tsconfig.json --quiet --fix . | dev-null",
+    "lint:fix:biome": "dotenvx -q run -f .env.local -- biome format --log-level=none --fix . | dev-null",
+    "lint:fix:eslint": "dotenvx -q run -f .env.local -- eslint --report-unused-disable-directives --fix . | dev-null",
+    "lint-staged": "dotenvx -q run -f .env.local -- lint-staged",
+    "precommit": "dotenvx -q run -f .env.local -- lint-staged",
+    "bs": "dotenvx -q run -f .env.local -- pnpm build:dist:src; pnpm exec socket --",
+    "s": "dotenvx -q run -f .env.local -- pnpm exec socket --",
+    "e2e-tests": "dotenvx -q run -f .env.test -- vitest run --config vitest.e2e.config.mts",
+    "test": "run-s check test:*",
+    "test:prepare": "dotenvx -q run -f .env.test -- pnpm build && del-cli 'test/**/node_modules'",
+    "test:unit": "dotenvx -q run -f .env.test -- vitest run",
+    "test:unit:update": "dotenvx -q run -f .env.test -- vitest run --update",
+    "test:unit:coverage": "dotenvx -q run -f .env.test -- vitest run --coverage",
+    "test-ci": "run-s test:*",
+    "testu": "dotenvx -q run -f .env.testu -- run-s test:prepare; pnpm test:unit:update --",
+    "testuf": "dotenvx -q run -f .env.testu -- pnpm test:unit:update --",
+    "update": "run-p --aggregate-output update:**",
+    "update:deps": "taze",
+    "update:socket": "pnpm update '@socketsecurity/*' '@socketregistry/*' --latest"
   }
-}
+}

package/requirements.json

@@ -10,7 +10,7 @@
     },
     "fix": {
       "quota": 101,
-      "permissions": ["full-scans:create", "packages:list"]
+      "permissions": ["full-scans:create", "packages:list", "fixes:list"]
     },
     "login": {
       "quota": 1,

package/dist/socket-facts.init.gradle

@@ -1,353 +0,0 @@
-// Gradle init script that emits a single `.socket.facts.json` file at the
-// build root describing the resolved compile/runtime dependency graph of
-// every subproject combined.
-//
-// Schema matches the canonical SocketFacts shape consumed by depscan
-// (`workspaces/lib/src/socket-facts/socket-facts-schema.ts`):
-//
-//     { components: SF_Artifact[] }
-//
-// Each Maven SF_Artifact is `{ type: 'maven', namespace, name, version?,
-// qualifiers? } & { id, direct?, dev?, tooling?, dependencies? }`.
-// `qualifiers` is strict on `{ classifier?, ext? }` — anything else is
-// dropped.
-//
-// Invoke via:
-//   ./gradlew --init-script socket-facts.init.gradle socketFacts
-//
-// Structure:
-//   - per-subproject `socketFactsCollect` tasks resolve that subproject's
-//     configurations and contribute to shared accumulators on gradle.ext
-//   - the root `socketFacts` task depends on every collector, then
-//     serializes the accumulated graph to a single JSON file at the build
-//     root
-//
-// Intra-project dependencies (i.e. `project(':lib')` style edges between
-// subprojects in the same build) are dropped from the output entirely.
-// Their reasoning: each subproject contributes its own external deps to
-// the shared facts; the inter-project edges would just be noise that
-// downstream consumers (coana mvn dependency:get) would try to resolve
-// against Maven Central and fail. The externals each intra-project dep
-// brings in are picked up via that subproject's own collector.
-
-import java.util.Collections
-import groovy.json.JsonOutput
-
-// Must stay in sync with `DOT_SOCKET_DOT_FACTS_JSON` in
-// src/constants.mts (TS side). Groovy can't import the TS constant, so
-// the two strings are intentionally duplicated; if you change one,
-// change the other.
-ext.SOCKET_FACTS_FILENAME = '.socket.facts.json'
-
-// Shared accumulators across all subprojects' contributions. Synchronized
-// collections so --parallel-enabled builds don't race. The accumulator
-// lives on `gradle.ext` so every subproject's collector and the root
-// aggregator share the same instance.
-gradle.ext.socketFactsState = [
-  // id -> [coord, children, prod, nonTooling]
-  nodes              : Collections.synchronizedMap([:]),
-  // first-level dep ids
-  directIds          : Collections.synchronizedSet([] as Set),
-  // selectors we've already logged as unresolved (deduped across configs)
-  reportedUnresolved : Collections.synchronizedSet([] as Set),
-  // "group:name" of every project in this build — used to filter
-  // intra-project deps. Populated once all projects are evaluated.
-  projectKeys        : Collections.synchronizedSet([] as Set),
-]
-
-// Capture every project's (group:name) once all projects are configured so
-// per-subproject collectors can filter intra-project deps without an
-// ordering dependency on other subprojects.
-gradle.projectsEvaluated { g ->
-  g.rootProject.allprojects.each { p ->
-    g.socketFactsState.projectKeys.add("${p.group ?: ''}:${p.name}")
-  }
-}
-
-allprojects { project ->
-  def collectTask = project.tasks.create('socketFactsCollect') {
-    description = "Resolves ${project.path}'s configurations into the build-wide Socket facts accumulator"
-    // Dependency resolution depends on state Gradle's up-to-date tracking
-    // can't represent reliably.
-    outputs.upToDateWhen { false }
-
-    doLast {
-      def state = gradle.socketFactsState
-      def nodes = state.nodes
-      def directIds = state.directIds
-      def reportedUnresolved = state.reportedUnresolved
-      def projectKeys = state.projectKeys
-
-      // `id` omits ext so Gradle's variant artifacts (e.g.
-      // `java-classes-directory` and `jar` for the same project dep)
-      // dedupe into a single component. Classifier stays in the id since
-      // it identifies a distinct artifact (sources, javadoc, etc.).
-      def coordId = { coord ->
-        def parts = [coord.groupId, coord.artifactId]
-        if (coord.classifier) parts << coord.classifier
-        parts << coord.version
-        parts.join(':')
-      }
-
-      def isIntraProject = { String group, String name ->
-        projectKeys.contains("${group ?: ''}:${name}")
-      }
-
-      // Atomic upsert: bracket the read-modify-write under the nodes map's
-      // monitor so concurrent contributions don't lose flag updates.
-      def upsertNode = { Map coord, boolean isProd, boolean isNonTooling ->
-        def id = coordId(coord)
-        synchronized (nodes) {
-          def node = nodes[id]
-          if (node == null) {
-            node = [coord: coord, children: [] as Set, prod: false, nonTooling: false]
-            nodes[id] = node
-          } else if (!node.coord.ext && coord.ext) {
-            // Upgrade to the variant whose Gradle artifact has a real
-            // packaging extension. Compile classpath visits often arrive
-            // with no ext (a project dep exposes only its classes-directory
-            // variant there); the runtime classpath visit then fills in
-            // the canonical jar/aar.
-            node.coord = coord
-          }
-          if (isProd) {
-            node.prod = true
-          }
-          if (isNonTooling) {
-            node.nonTooling = true
-          }
-        }
-        id
-      }
-
-      // Walk a resolved dependency, emitting nodes for itself and its
-      // transitive closure. `cache` is keyed by ResolvedDependency identity
-      // and short-circuits revisits in diamond/cyclic graphs.
-      //
-      // We never touch `artifact.file` — that forces Gradle to *download*
-      // the underlying file (catastrophic on large builds that declare
-      // distribution archives as dependencies). `artifact.extension` and
-      // `artifact.classifier` read from metadata that resolution already
-      // needed.
-      //
-      // Intra-project deps (project(':lib') and friends) are dropped at
-      // visit time: we return an empty produced-id set, don't emit a node,
-      // and don't recurse into the dep's children. The transitives those
-      // intra-project deps expose are picked up via the consumer
-      // subproject's classpath directly (Gradle merges them) and via the
-      // intra-project's own collector.
-      def visit
-      visit = { dep, boolean isProd, boolean isNonTooling, Map cache ->
-        if (cache.containsKey(dep)) {
-          return cache[dep]
-        }
-        if (isIntraProject(dep.moduleGroup, dep.moduleName)) {
-          def empty = [] as Set
-          cache[dep] = empty
-          return empty
-        }
-        // Pre-populate the cache to break cycles before we recurse.
-        def producedIds = [] as Set
-        cache[dep] = producedIds
-
-        def artifacts = dep.moduleArtifacts
-        if (artifacts.isEmpty()) {
-          producedIds << upsertNode([
-            groupId   : dep.moduleGroup ?: '',
-            artifactId: dep.moduleName,
-            version   : dep.moduleVersion ?: '',
-            classifier: '',
-            ext       : '',
-          ], isProd, isNonTooling)
-        } else {
-          artifacts.each { a ->
-            producedIds << upsertNode([
-              groupId   : dep.moduleGroup ?: '',
-              artifactId: dep.moduleName,
-              version   : dep.moduleVersion ?: '',
-              classifier: a.classifier ?: '',
-              // Use the file extension Gradle reports. For Gradle-internal
-              // directory variants (java-classes-directory etc.) the
-              // extension is empty — we let that through and emit no ext
-              // qualifier. Never fall back to artifact.type, which is
-              // Gradle's variant attribute, not Maven packaging.
-              ext       : a.extension ?: '',
-            ], isProd, isNonTooling)
-          }
-        }
-
-        def childIds = [] as Set
-        dep.children.each { child ->
-          childIds.addAll(visit(child, isProd, isNonTooling, cache))
-        }
-        synchronized (nodes) {
-          producedIds.each { pid ->
-            nodes[pid].children.addAll(childIds)
-          }
-        }
-        producedIds
-      }
-
-      // Configuration selection by name pattern. We match the conventional
-      // suffixes used across Gradle plugins for resolvable classpath configs:
-      // Java (`compileClasspath`, `runtimeClasspath`,
-      // `testCompileClasspath`, `testRuntimeClasspath`), Kotlin Gradle Plugin
-      // (`jvmMainCompileClasspath`, `linuxX64MainRuntimeClasspath`, ...) and
-      // AGP per-variant (`debugCompileClasspath`, `releaseRuntimeClasspath`,
-      // `debugUnitTestRuntimeClasspath`, ...).
-      //
-      // Beyond classpaths we also walk other resolvable configurations
-      // (annotation processors, linter classpaths, etc.) so build-tooling
-      // deps land in the output too — tagged `tooling: true` so downstream
-      // reachability scanners can skip them.
-      //
-      // We exclude AGP's instrumented-test classpaths (`*AndroidTest*`)
-      // because their variant resolution requires consumer attributes
-      // (target SDK, device/host runtime) that an init-script-driven
-      // resolution doesn't set, and they produce ambiguity errors at
-      // resolution time. Unit-test classpaths (`*UnitTest*`) resolve fine.
-      def isClasspath = { String name ->
-        def lower = name.toLowerCase()
-        lower.endsWith('compileclasspath') || lower.endsWith('runtimeclasspath')
-      }
-      def isAndroidInstrumentedTest = { String name ->
-        name.toLowerCase().contains('androidtest')
-      }
-      def isTestConfig = { String name -> name.toLowerCase().contains('test') }
-
-      def targetConfigs = project.configurations.findAll {
-        it.canBeResolved && !isAndroidInstrumentedTest(it.name)
-      }
-
-      targetConfigs.each { cfg ->
-        def isProd = !isTestConfig(cfg.name)
-        def isNonTooling = isClasspath(cfg.name)
-        // Per-configuration try/catch: AGP-style configurations can fail
-        // with "variant ambiguity" when resolved from an init-script
-        // context that doesn't carry the consumer attributes AGP sets
-        // internally. We log and continue so a single ambiguous config
-        // doesn't sink the whole facts file.
-        try {
-          def lenient = cfg.resolvedConfiguration.lenientConfiguration
-          def cache = [:]
-          lenient.firstLevelModuleDependencies.each { dep ->
-            directIds.addAll(visit(dep, isProd, isNonTooling, cache))
-          }
-          lenient.unresolvedModuleDependencies.each { dep ->
-            if (isIntraProject(dep.selector.group, dep.selector.name)) {
-              return
-            }
-            def selectorKey = dep.selector.toString()
-            if (reportedUnresolved.add(selectorKey)) {
-              def reason = dep.problem?.message?.readLines()?.first() ?: 'unknown reason'
-              println "[socket-facts] unresolved: ${selectorKey} in ${project.path}: ${reason}"
-            }
-            def coord = [
-              groupId   : dep.selector.group ?: '',
-              artifactId: dep.selector.name,
-              version   : dep.selector.version ?: '',
-              classifier: '',
-              ext       : '',
-            ]
-            directIds.add(upsertNode(coord, isProd, isNonTooling))
-          }
-        } catch (Exception e) {
-          println "[socket-facts] skipping ${project.path}:${cfg.name}: ${e.message?.readLines()?.first()}"
-        }
-      }
-    }
-  }
-}
-
-rootProject {
-  tasks.create('socketFacts') {
-    group = 'socket'
-    description = 'Aggregates a single Socket facts JSON for the entire build'
-    outputs.upToDateWhen { false }
-
-    doLast {
-      def state = gradle.socketFactsState
-      def nodes = state.nodes
-      def directIds = state.directIds
-
-      // Snapshot the accumulators under the same monitor used by writers in
-      // each subproject's socketFactsCollect doLast. Task dependencies
-      // (`aggregator.dependsOn(collector)`) already guarantee a
-      // happens-before edge between writes and this read, but we
-      // synchronize on `nodes` here so the read path is symmetric with the
-      // write path — no implicit reliance on Gradle's task-graph ordering
-      // semantics for memory visibility of plain HashMap/HashSet fields.
-      def components
-      synchronized (nodes) {
-        components = nodes.collect { id, node ->
-          [id: id, coord: node.coord, prod: node.prod, nonTooling: node.nonTooling, children: (node.children as List).sort()]
-        }
-      }
-
-      components = components.collect { snapshot ->
-        def id = snapshot.id
-        def coord = snapshot.coord
-        def component = [
-          type     : 'maven',
-          namespace: coord.groupId,
-          name     : coord.artifactId,
-        ]
-        if (coord.version) {
-          component.version = coord.version
-        }
-        def qualifiers = [:]
-        if (coord.classifier) {
-          qualifiers.classifier = coord.classifier
-        }
-        if (coord.ext) {
-          qualifiers.ext = coord.ext
-        }
-        if (!qualifiers.isEmpty()) {
-          component.qualifiers = qualifiers
-        }
-        component.id = id
-        if (directIds.contains(id)) {
-          component.direct = true
-        }
-        if (!snapshot.prod) {
-          component.dev = true
-        }
-        if (!snapshot.nonTooling) {
-          component.tooling = true
-        }
-        if (!snapshot.children.isEmpty()) {
-          component.dependencies = snapshot.children
-        }
-        component
-      }
-
-      if (components.isEmpty()) {
-        println "[socket-facts] no resolvable dependencies in build, skipping"
-        return
-      }
-
-      def outputDir = project.findProperty('socket.outputDirectory')
-        ? new File(project.findProperty('socket.outputDirectory').toString())
-        : project.projectDir
-      outputDir.mkdirs()
-      def fileName = project.findProperty('socket.outputFile') ?: SOCKET_FACTS_FILENAME
-      def outFile = new File(outputDir, fileName.toString())
-      outFile.text = JsonOutput.prettyPrint(JsonOutput.toJson([components: components]))
-      println "Socket facts file written to: ${outFile.absolutePath}"
-    }
-  }
-}
-
-// Wire every subproject's collector as a dependency of the root aggregator
-// so the aggregator runs after all contributions have been made.
-gradle.projectsEvaluated { g ->
-  def aggregator = g.rootProject.tasks.findByName('socketFacts')
-  if (aggregator) {
-    g.rootProject.allprojects.each { p ->
-      def collector = p.tasks.findByName('socketFactsCollect')
-      if (collector) {
-        aggregator.dependsOn(collector)
-      }
-    }
-  }
-}