feat(emitters): add the dotnet facts emitter and centralize config globs

.gitignore

@@ -138,3 +138,12 @@ pnpm-debug.log
 # output, never tracked.
 /emitters/maven-extension/target/
 /emitters/maven-extension/socket-facts-maven-extension.jar
+
+# NuGet emitter build output. `pnpm run build:dotnet-tool` publishes the C#
+# sources under emitters/dotnet-tool into publish/, which the published package
+# ships; the SDK's intermediate bin/ and obj/ dirs and the published output are
+# all build output, never tracked. The fleet keeps every ignore in this root
+# file, so these live here rather than in a nested .gitignore.
+/emitters/dotnet-tool/bin/
+/emitters/dotnet-tool/obj/
+/emitters/dotnet-tool/publish/

CHANGELOG.md

@@ -19,15 +19,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- `runFactsGeneration` — runs a JVM build tool's Socket facts emitter against an
+- `.NET`/NuGet facts generation — `runFactsGeneration` accepts `tool: 'dotnet'`
+  and runs a bundled C# emitter that evaluates, restores, and reads
+  `project.assets.json` in one MSBuild session, producing NuGet-typed components
+  at parity with the JVM emitters.
+- Resolved-paths sidecar entries carry an `ecosystem` tag, so a NuGet coordinate
+  and a Maven coordinate that share a name stay distinct.
+- Resolution reports carry `configsByProject`, which attributes each resolved
+  configuration (for .NET, each target framework) to the project that resolved
+  it.
+- `runFactsGeneration` — runs a build tool's Socket facts emitter against an
   already-resolved, already-validated invocation and returns the assembled SBOM,
   resolution report, and resolved artifact paths.
 - `@socketsecurity/facts/contract` — the `.socket.facts.json` SBOM and
   resolved-paths sidecar types with runtime validators, so a producer and a
   consumer can share one definition instead of two hand-maintained copies.
 - `@socketsecurity/facts/assets` — resolvers for the bundled Gradle init script,
-  sbt plugin, and Maven extension jar, with a fail-closed check that a published
-  install carrying no jar throws instead of emitting an empty SBOM.
+  sbt plugin, Maven extension jar, and dotnet tool, with a fail-closed check that
+  a published install carrying no built emitter throws instead of emitting an
+  empty SBOM.
 - `@socketsecurity/facts/conformance` — parsers for a build tool's own
   dependency report plus a diff that fails on any component, version, or edge
   where the emitted facts and the build disagree.

README.md

@@ -103,6 +103,7 @@ Resolve the emitter assets rather than guessing where they live:
 ```js
 import {
   assertMavenExtensionBuilt,
+  dotnetToolDllPath,
   gradleInitScriptPath,
   sbtPluginSourcePath,
 } from '@socketsecurity/facts/assets'
@@ -119,11 +120,13 @@ pnpm run check
 pnpm test
 ```
 
-Build the Maven core extension, which needs a JDK and is not part of
-`pnpm run build`:
+Two emitters compile from source and are not part of `pnpm run build`, because
+a plain checkout cannot assume either toolchain. The Maven core extension needs
+a JDK; the dotnet tool needs a .NET 8+ SDK:
 
 ```sh
 pnpm run build:maven-extension
+pnpm run build:dotnet-tool
 ```
 
 The dynamic-version conformance suite needs Gradle, Maven, and a JDK. It skips

docs/agents.md/repo/contract.md

@@ -65,6 +65,22 @@ consumer pinned to a version released before the addition.
 key is a violation here, so a producer cannot emit a payload the consumer will
 reject.
 
+### `ecosystem` is the one field added under that rule
+
+`ResolvedComponent.ecosystem` carries the artifact's purl type, because a
+groupless NuGet id and a Maven artifactId can produce the same coordinate key
+and there is no other way to tell them apart. Adding it follows the rule above
+rather than escaping it: **every** reachability scan, single-ecosystem JVM ones
+included, fails at the sidecar handoff until the consumer's schema accepts the
+key, because the producer stamps the tag on every entry and a `.strict()` parse
+rejects the whole payload rather than the one field. Releasing the consumer's
+schema change first is the gate on shipping a version of this package that
+emits it.
+
+The validator is asymmetric here on purpose: it accepts a payload with no
+`ecosystem` key, because that is exactly what a sidecar written before the tag
+existed looks like, and it means `maven`. Strict producer, liberal consumer.
+
 ### Proposed versioning approach — not adopted
 
 Recorded here so the next person does not have to rederive it. **Do not