@socketsecurity/lib 6.0.5 → 6.0.7

package/dist/bin/resolve.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_primordials_string = require('../primordials/string.js');
 const require_constants_platform = require('../constants/platform.js');
+const require_primordials_string = require('../primordials/string.js');
 const require_paths_normalize = require('../paths/normalize.js');
 const require_node_fs = require('../node/fs.js');
 const require_node_path = require('../node/path.js');
@@ -40,15 +40,14 @@ const require_bin_which = require('./which.js');
 *   // e.g. '/usr/local/lib/node_modules/npm/bin/npm-cli.js'
 *   ```
 */
-/* @__NO_SIDE_EFFECTS__ */
 function resolveRealBinSync(binPath) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const fs = require_node_fs.getNodeFs();
+	const path = require_node_path.getNodePath();
 	if (!path.isAbsolute(binPath)) try {
 		const resolved = require_bin_which.whichRealSync(binPath);
 		if (resolved) binPath = resolved;
 	} catch {}
-	binPath = /* @__PURE__ */ require_paths_normalize.normalizePath(binPath);
+	binPath = require_paths_normalize.normalizePath(binPath);
 	if (binPath === ".") return binPath;
 	const ext = path.extname(binPath);
 	const extLowered = ext.toLowerCase();
@@ -67,7 +66,7 @@ function resolveRealBinSync(binPath) {
 		const voltaToolsPath = path.join(voltaPath, "tools");
 		const voltaImagePath = path.join(voltaToolsPath, "image");
 		const voltaUserPath = path.join(voltaToolsPath, "user");
-		const voltaPlatform = /* @__PURE__ */ require_fs_read_json.readJsonSync(path.join(voltaUserPath, "platform.json"), { throws: false });
+		const voltaPlatform = require_fs_read_json.readJsonSync(path.join(voltaUserPath, "platform.json"), { throws: false });
 		const voltaNodeVersion = voltaPlatform?.node?.runtime;
 		const voltaNpmVersion = voltaPlatform?.node?.npm;
 		let voltaBinPath = "";
@@ -83,7 +82,7 @@ function resolveRealBinSync(binPath) {
 			}
 		} else {
 			const voltaUserBinPath = path.join(voltaUserPath, "bin");
-			const binPackage = (/* @__PURE__ */ require_fs_read_json.readJsonSync(path.join(voltaUserBinPath, `${basename}.json`), { throws: false }))?.package;
+			const binPackage = require_fs_read_json.readJsonSync(path.join(voltaUserBinPath, `${basename}.json`), { throws: false })?.package;
 			if (binPackage) {
 				voltaBinPath = path.join(voltaImagePath, `packages/${binPackage}/bin/${basename}`);
 				if (!fs.existsSync(voltaBinPath)) {
@@ -96,7 +95,7 @@ function resolveRealBinSync(binPath) {
 		if (voltaBinPath) {
 			let resolvedVoltaPath = voltaBinPath;
 			try {
-				resolvedVoltaPath = /* @__PURE__ */ require_paths_normalize.normalizePath(fs.realpathSync.native(voltaBinPath));
+				resolvedVoltaPath = require_paths_normalize.normalizePath(fs.realpathSync.native(voltaBinPath));
 			} catch {}
 			require_bin__internal.voltaBinCache.set(voltaCacheKey, resolvedVoltaPath);
 			return resolvedVoltaPath;
@@ -139,7 +138,7 @@ function resolveRealBinSync(binPath) {
 			} else if (extLowered === ".cmd") relPath = /(?<="%dp0%\\).*(?=" %\*\r\n)/.exec(source)?.[0] || "";
 			else if (extLowered === "") relPath = /(?<="$basedir\/).*(?=" "\$@"\n)/.exec(source)?.[0] || "";
 			else if (extLowered === ".ps1") relPath = /(?<="\$basedir\/).*(?=" $args\n)/.exec(source)?.[0] || "";
-			if (relPath) binPath = /* @__PURE__ */ require_paths_normalize.normalizePath(path.resolve(path.dirname(binPath), relPath));
+			if (relPath) binPath = require_paths_normalize.normalizePath(path.resolve(path.dirname(binPath), relPath));
 		}
 	} else {
 		let hasNoExt = extLowered === "";
@@ -151,7 +150,7 @@ function resolveRealBinSync(binPath) {
 				const baseBinPath = binPath.slice(0, binIndex + 10);
 				try {
 					if (fs.statSync(baseBinPath).isFile()) {
-						binPath = /* @__PURE__ */ require_paths_normalize.normalizePath(baseBinPath);
+						binPath = require_paths_normalize.normalizePath(baseBinPath);
 						hasNoExt = !path.extname(binPath);
 					}
 				} catch {}
@@ -169,14 +168,14 @@ function resolveRealBinSync(binPath) {
 				}
 				if (relPath && basename === "pnpm" && require_primordials_string.StringPrototypeStartsWith(relPath, "pnpm/")) relPath = `../${relPath}`;
 			} else if (isNpmOrNpx) relPath = basename === "npm" ? /(?<=NPM_CLI_JS="\$CLI_BASEDIR\/).*(?=")/.exec(source)?.[0] || "" : /(?<=NPX_CLI_JS="\$CLI_BASEDIR\/).*(?=")/.exec(source)?.[0] || "";
-			if (relPath) binPath = /* @__PURE__ */ require_paths_normalize.normalizePath(path.resolve(path.dirname(binPath), relPath));
+			if (relPath) binPath = require_paths_normalize.normalizePath(path.resolve(path.dirname(binPath), relPath));
 		}
 	}
 	/* c8 ignore stop */
 	try {
-		return /* @__PURE__ */ require_paths_normalize.normalizePath(fs.realpathSync.native(binPath));
+		return require_paths_normalize.normalizePath(fs.realpathSync.native(binPath));
 	} catch {}
-	return /* @__PURE__ */ require_paths_normalize.normalizePath(binPath);
+	return require_paths_normalize.normalizePath(binPath);
 }
 
 //#endregion

package/dist/bin/which.js

@@ -59,7 +59,7 @@ src_external_which = require_runtime.__toESM(src_external_which);
 *   path, the original path, or null if not found.
 */
 async function which(binName, options) {
-	if (/* @__PURE__ */ require_paths_predicates.isPath(binName)) return binName;
+	if (require_paths_predicates.isPath(binName)) return binName;
 	try {
 		return await (0, src_external_which.default)(binName, options);
 	} catch {
@@ -80,7 +80,7 @@ async function which(binName, options) {
 * @throws {Error} If the binary is not found and nothrow is false.
 */
 async function whichReal(binName, options) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
+	const fs = require_node_fs.getNodeFs();
 	const opts = {
 		__proto__: null,
 		nothrow: true,
@@ -107,7 +107,7 @@ async function whichReal(binName, options) {
 	if (opts?.all) {
 		const paths = require_primordials_array.ArrayIsArray(result) ? result : typeof result === "string" ? [result] : void 0;
 		if (paths?.length) {
-			const resolved = require_primordials_array.ArrayPrototypeMap(paths, (p) => /* @__PURE__ */ require_bin_resolve.resolveRealBinSync(p));
+			const resolved = require_primordials_array.ArrayPrototypeMap(paths, (p) => require_bin_resolve.resolveRealBinSync(p));
 			require_bin__internal.binPathAllCache.set(binName, resolved);
 			return resolved;
 		}
@@ -115,7 +115,7 @@ async function whichReal(binName, options) {
 	}
 	if (!result) return;
 	/* c8 ignore stop */
-	const resolved = /* @__PURE__ */ require_bin_resolve.resolveRealBinSync(result);
+	const resolved = require_bin_resolve.resolveRealBinSync(result);
 	require_bin__internal.binPathCache.set(binName, resolved);
 	return resolved;
 }
@@ -133,7 +133,7 @@ async function whichReal(binName, options) {
 * @throws {Error} If the binary is not found and nothrow is false.
 */
 function whichRealSync(binName, options) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
+	const fs = require_node_fs.getNodeFs();
 	const opts = {
 		__proto__: null,
 		nothrow: true,
@@ -159,7 +159,7 @@ function whichRealSync(binName, options) {
 	if (opts.all) {
 		const paths = require_primordials_array.ArrayIsArray(result) ? result : typeof result === "string" ? [result] : void 0;
 		if (paths?.length) {
-			const resolved = require_primordials_array.ArrayPrototypeMap(paths, (p) => /* @__PURE__ */ require_bin_resolve.resolveRealBinSync(p));
+			const resolved = require_primordials_array.ArrayPrototypeMap(paths, (p) => require_bin_resolve.resolveRealBinSync(p));
 			require_bin__internal.binPathAllCache.set(binName, resolved);
 			return resolved;
 		}
@@ -167,7 +167,7 @@ function whichRealSync(binName, options) {
 	}
 	if (!result) return;
 	/* c8 ignore stop */
-	const resolved = /* @__PURE__ */ require_bin_resolve.resolveRealBinSync(result);
+	const resolved = require_bin_resolve.resolveRealBinSync(result);
 	require_bin__internal.binPathCache.set(binName, resolved);
 	return resolved;
 }
@@ -205,7 +205,7 @@ function whichRealSync(binName, options) {
 *   path if input is a path, or null if not found.
 */
 function whichSync(binName, options) {
-	if (/* @__PURE__ */ require_paths_predicates.isPath(binName)) return binName;
+	if (require_paths_predicates.isPath(binName)) return binName;
 	try {
 		return src_external_which.default.sync(binName, options);
 	} catch {

package/dist/cache/ttl/store.js

@@ -2,8 +2,8 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_primordials_error = require('../../primordials/error.js');
-const require_primordials_string = require('../../primordials/string.js');
 const require_primordials_math = require('../../primordials/math.js');
+const require_primordials_string = require('../../primordials/string.js');
 const require_primordials_regexp = require('../../primordials/regexp.js');
 const require_primordials_map_set = require('../../primordials/map-set.js');
 const require_primordials_date = require('../../primordials/date.js');
@@ -213,13 +213,13 @@ function createTtlCache(options) {
 		}
 		return await require_cacache_clear.clear({ prefix: fullPrefix }) ?? 0;
 	}
-	async function clear$1(options) {
-		const opts = {
+	async function clear$1(clearOptions) {
+		const clearOpts = {
 			__proto__: null,
-			...options
+			...clearOptions
 		};
 		memoCache.clear();
-		if (opts.memoOnly) return;
+		if (clearOpts.memoOnly) return;
 		await deleteAll();
 	}
 	return {

package/dist/checks/primordials-defaults.d.ts

@@ -1,8 +1,8 @@
 /**
  * @file GENERATED — do not edit by hand. Run `node
- *   scripts/fix/generate-primordials-defaults.mts` (also runs as part of `pnpm
- *   run build`) to regenerate from the `globals` npm package's globals.json
- *   crossed against src/primordials/*.ts `Ctor` exports. Source:
+ *   scripts/post-build/make-primordials-defaults.mts` (also runs as part of
+ *   `pnpm run build`) to regenerate from the `globals` npm package's
+ *   globals.json crossed against src/primordials/*.ts `Ctor` exports. Source:
  *   globals@<bumped via taze>, env = builtin ∪ node. Filter: identifiers
  *   socket-lib exports as `<name>Ctor`.
  */

package/dist/checks/primordials-defaults.js

@@ -6,9 +6,9 @@ const require_primordials_object = require('../primordials/object.js');
 //#region src/checks/primordials-defaults.ts
 /**
 * @file GENERATED — do not edit by hand. Run `node
-*   scripts/fix/generate-primordials-defaults.mts` (also runs as part of `pnpm
-*   run build`) to regenerate from the `globals` npm package's globals.json
-*   crossed against src/primordials/*.ts `Ctor` exports. Source:
+*   scripts/post-build/make-primordials-defaults.mts` (also runs as part of
+*   `pnpm run build`) to regenerate from the `globals` npm package's
+*   globals.json crossed against src/primordials/*.ts `Ctor` exports. Source:
 *   globals@<bumped via taze>, env = builtin ∪ node. Filter: identifiers
 *   socket-lib exports as `<name>Ctor`.
 */

package/dist/checks/primordials.js

@@ -65,7 +65,7 @@ function checkPrimordials(config) {
 	}
 	const socketLibNames = readSocketLibPrimordialNames(resolveSocketLibPrimordials(config));
 	const findings = [];
-	for (const name of [...used].sort()) {
+	for (const name of [...used].toSorted()) {
 		if (config.nodeInternalOnly.has(name)) continue;
 		if (socketLibNames.has(name)) continue;
 		const aliased = config.aliasMap.get(name);
@@ -85,7 +85,7 @@ function checkPrimordials(config) {
 			kind: "unmapped",
 			name,
 			files: usedToFiles.get(name) ?? [],
-			hint: `\`${name}\` is destructured from \`primordials\` but no socket-lib mapping exists. Pick one: ` + /* @__PURE__ */ require_arrays_join.joinOr([
+			hint: `\`${name}\` is destructured from \`primordials\` but no socket-lib mapping exists. Pick one: ` + require_arrays_join.joinOr([
 				`add \`${name}\` to the appropriate leaf under socket-lib/src/primordials/`,
 				`add a \`${name}\` → \`<libName>\` entry to the alias map`,
 				`add \`${name}\` to nodeInternalOnly (if Node-internal only)`
@@ -114,7 +114,8 @@ function collectJsFiles(dir) {
 		} catch {
 			continue;
 		}
-		for (const name of entries) {
+		for (let i = 0, { length } = entries; i < length; i += 1) {
+			const name = entries[i];
 			const full = node_path.default.join(cur, name);
 			let stat;
 			try {

package/dist/{bin → cli}/check-primordials.d.ts

@@ -9,7 +9,7 @@
  *   success Exit codes: 0 — no drift 1 — drift detected (or config / lookup
  *   error)
  */
-import { type PrimordialsCheckConfig, type PrimordialsCheckResult, type PrimordialsFinding } from '../checks/primordials';
+import type { PrimordialsCheckConfig, PrimordialsCheckResult, PrimordialsFinding } from '../checks/primordials';
 interface ParsedArgs {
     readonly config: string | undefined;
     readonly json: boolean;
@@ -17,7 +17,16 @@ interface ParsedArgs {
     readonly silent: boolean;
     readonly help: boolean;
 }
+interface SerializedFinding {
+    kind: PrimordialsFinding['kind'];
+    name: string;
+    files: readonly string[];
+    hint: string;
+}
+export declare function loadConfig(configPath: string): PrimordialsCheckConfig;
 export declare function parseArgs(argv: readonly string[]): ParsedArgs;
+export declare function printHelp(): void;
+export declare function renderHuman(result: PrimordialsCheckResult, args: ParsedArgs): void;
 /**
  * Pick the config file. Returns the explicit `--config` argument when given
  * (even if it doesn't exist — the caller will surface the error with the path
@@ -26,19 +35,10 @@ export declare function parseArgs(argv: readonly string[]): ParsedArgs;
  * "config file not found" error message names the canonical default.
  */
 export declare function resolveConfigPath(explicit: string | undefined): string;
-export declare function printHelp(): void;
-export declare function loadConfig(configPath: string): PrimordialsCheckConfig;
-interface SerializedFinding {
-    kind: PrimordialsFinding['kind'];
-    name: string;
-    files: readonly string[];
-    hint: string;
-}
+export declare function runCheckPrimordials(argv: readonly string[]): Promise<number>;
 export declare function serialize(result: PrimordialsCheckResult): {
     ok: boolean;
     used: number;
     findings: SerializedFinding[];
 };
-export declare function renderHuman(result: PrimordialsCheckResult, args: ParsedArgs): void;
-export declare function runCheckPrimordials(argv: readonly string[]): Promise<number>;
 export {};

package/dist/{bin → cli}/check-primordials.js

@@ -4,8 +4,9 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_primordials_error = require('../primordials/error.js');
 const require_primordials_array = require('../primordials/array.js');
-const require_primordials_object = require('../primordials/object.js');
+const require_primordials_map_set = require('../primordials/map-set.js');
 const require_primordials_json = require('../primordials/json.js');
+const require_primordials_object = require('../primordials/object.js');
 const require_errors_message = require('../errors/message.js');
 const require_logger_default = require('../logger/default.js');
 const require_argv_parse = require('../argv/parse.js');
@@ -17,7 +18,7 @@ node_path = require_runtime.__toESM(node_path);
 let node_process = require("node:process");
 node_process = require_runtime.__toESM(node_process);
 
-//#region src/bin/check-primordials.ts
+//#region src/cli/check-primordials.ts
 /**
 * @file `socket-lib check primordials` handler. Loads a JSON config from disk
 *   (default `primordials-coverage.config.json` at the repo root, override with
@@ -33,6 +34,32 @@ const logger = require_logger_default.getDefaultLogger();
 const DEFAULT_CONFIG_PATH = ".socket-lib.json";
 const FALLBACK_CONFIG_PATHS = [".socket-lib.json", ".config/socket-lib.json"];
 const CONFIG_SECTION = "primordials";
+function loadConfig(configPath) {
+	if (!(0, node_fs.existsSync)(configPath)) throw new require_primordials_error.ErrorCtor(`config file not found: ${configPath}`);
+	let parsed;
+	try {
+		parsed = require_primordials_json.JSONParse((0, node_fs.readFileSync)(configPath, "utf8"));
+	} catch (e) {
+		throw new require_primordials_error.ErrorCtor(`config file is not valid JSON: ${require_errors_message.errorMessage(e)}`);
+	}
+	if (typeof parsed !== "object" || parsed === null || require_primordials_array.ArrayIsArray(parsed)) throw new require_primordials_error.ErrorCtor("config root must be an object");
+	const root = parsed;
+	const sectional = root[CONFIG_SECTION];
+	const raw = sectional !== void 0 ? sectional : root;
+	if (!require_primordials_array.ArrayIsArray(raw.scanDirs)) throw new require_primordials_error.ErrorCtor(`config.scanDirs must be an array of strings (got ${typeof raw.scanDirs})`);
+	for (const [i, v] of raw.scanDirs.entries()) if (typeof v !== "string") throw new require_primordials_error.ErrorCtor(`config.scanDirs[${i}] must be a string`);
+	if (raw.aliasMap !== void 0 && (typeof raw.aliasMap !== "object" || raw.aliasMap === null || require_primordials_array.ArrayIsArray(raw.aliasMap))) throw new require_primordials_error.ErrorCtor("config.aliasMap must be an object of source→target");
+	if (raw.nodeInternalOnly !== void 0 && !require_primordials_array.ArrayIsArray(raw.nodeInternalOnly)) throw new require_primordials_error.ErrorCtor("config.nodeInternalOnly must be an array of strings");
+	const aliasMap = new require_primordials_map_set.MapCtor([...require_primordials_object.ObjectEntries(require_checks_primordials_defaults.DEFAULT_ALIAS_MAP), ...require_primordials_object.ObjectEntries(raw.aliasMap ?? {})]);
+	const nodeInternalOnly = new require_primordials_map_set.SetCtor([...require_checks_primordials_defaults.DEFAULT_NODE_INTERNAL_ONLY, ...(raw.nodeInternalOnly ?? []).filter((x) => typeof x === "string")]);
+	return {
+		scanDirs: raw.scanDirs,
+		aliasMap,
+		nodeInternalOnly,
+		socketLibPrimordialsPath: typeof raw.socketLibPrimordialsPath === "string" ? raw.socketLibPrimordialsPath : void 0,
+		repoRoot: node_process.default.cwd()
+	};
+}
 function parseArgs(argv) {
 	const { values } = require_argv_parse.parseArgs({
 		args: argv,
@@ -60,18 +87,6 @@ function parseArgs(argv) {
 		help: Boolean(values["help"])
 	};
 }
-/**
-* Pick the config file. Returns the explicit `--config` argument when given
-* (even if it doesn't exist — the caller will surface the error with the path
-* they typed). Otherwise probes the fallback list in order and returns the
-* first hit. Returns the head of the list when none exist, so the caller's
-* "config file not found" error message names the canonical default.
-*/
-function resolveConfigPath(explicit) {
-	if (explicit !== void 0) return explicit;
-	for (const candidate of FALLBACK_CONFIG_PATHS) if ((0, node_fs.existsSync)(node_path.default.resolve(candidate))) return candidate;
-	return FALLBACK_CONFIG_PATHS[0];
-}
 function printHelp() {
 	logger.log("socket-lib check primordials — primordials drift check");
 	logger.log("");
@@ -101,44 +116,6 @@ function printHelp() {
 	logger.log("A bare object (no `primordials` section) is also accepted for");
 	logger.log("repos that only run this one check.");
 }
-function loadConfig(configPath) {
-	if (!(0, node_fs.existsSync)(configPath)) throw new require_primordials_error.ErrorCtor(`config file not found: ${configPath}`);
-	let parsed;
-	try {
-		parsed = require_primordials_json.JSONParse((0, node_fs.readFileSync)(configPath, "utf8"));
-	} catch (e) {
-		throw new require_primordials_error.ErrorCtor(`config file is not valid JSON: ${require_errors_message.errorMessage(e)}`);
-	}
-	if (typeof parsed !== "object" || parsed === null || require_primordials_array.ArrayIsArray(parsed)) throw new require_primordials_error.ErrorCtor("config root must be an object");
-	const root = parsed;
-	const sectional = root[CONFIG_SECTION];
-	const raw = sectional !== void 0 ? sectional : root;
-	if (!require_primordials_array.ArrayIsArray(raw.scanDirs)) throw new require_primordials_error.ErrorCtor(`config.scanDirs must be an array of strings (got ${typeof raw.scanDirs})`);
-	for (const [i, v] of raw.scanDirs.entries()) if (typeof v !== "string") throw new require_primordials_error.ErrorCtor(`config.scanDirs[${i}] must be a string`);
-	if (raw.aliasMap !== void 0 && (typeof raw.aliasMap !== "object" || raw.aliasMap === null || require_primordials_array.ArrayIsArray(raw.aliasMap))) throw new require_primordials_error.ErrorCtor("config.aliasMap must be an object of source→target");
-	if (raw.nodeInternalOnly !== void 0 && !require_primordials_array.ArrayIsArray(raw.nodeInternalOnly)) throw new require_primordials_error.ErrorCtor("config.nodeInternalOnly must be an array of strings");
-	const aliasMap = new Map([...require_primordials_object.ObjectEntries(require_checks_primordials_defaults.DEFAULT_ALIAS_MAP), ...require_primordials_object.ObjectEntries(raw.aliasMap ?? {})]);
-	const nodeInternalOnly = new Set([...require_checks_primordials_defaults.DEFAULT_NODE_INTERNAL_ONLY, ...(raw.nodeInternalOnly ?? []).filter((x) => typeof x === "string")]);
-	return {
-		scanDirs: raw.scanDirs,
-		aliasMap,
-		nodeInternalOnly,
-		socketLibPrimordialsPath: typeof raw.socketLibPrimordialsPath === "string" ? raw.socketLibPrimordialsPath : void 0,
-		repoRoot: node_process.default.cwd()
-	};
-}
-function serialize(result) {
-	return {
-		ok: result.findings.length === 0,
-		used: result.used.size,
-		findings: result.findings.map((f) => ({
-			kind: f.kind,
-			name: f.name,
-			files: f.files,
-			hint: f.hint
-		}))
-	};
-}
 function renderHuman(result, args) {
 	if (result.findings.length === 0) {
 		if (!args.silent) logger.success(`Primordials coverage OK — ${result.used.size} names used, all accounted for.`);
@@ -157,6 +134,21 @@ function renderHuman(result, args) {
 		logger.error("Run with --explain for fix instructions and file references.");
 	}
 }
+/**
+* Pick the config file. Returns the explicit `--config` argument when given
+* (even if it doesn't exist — the caller will surface the error with the path
+* they typed). Otherwise probes the fallback list in order and returns the
+* first hit. Returns the head of the list when none exist, so the caller's
+* "config file not found" error message names the canonical default.
+*/
+function resolveConfigPath(explicit) {
+	if (explicit !== void 0) return explicit;
+	for (let i = 0, { length } = FALLBACK_CONFIG_PATHS; i < length; i += 1) {
+		const candidate = FALLBACK_CONFIG_PATHS[i];
+		if ((0, node_fs.existsSync)(node_path.default.resolve(candidate))) return candidate;
+	}
+	return FALLBACK_CONFIG_PATHS[0];
+}
 async function runCheckPrimordials(argv) {
 	const args = parseArgs(argv);
 	if (args.help) {
@@ -181,6 +173,18 @@ async function runCheckPrimordials(argv) {
 	else renderHuman(result, args);
 	return result.findings.length === 0 ? 0 : 1;
 }
+function serialize(result) {
+	return {
+		ok: result.findings.length === 0,
+		used: result.used.size,
+		findings: result.findings.map((f) => ({
+			kind: f.kind,
+			name: f.name,
+			files: f.files,
+			hint: f.hint
+		}))
+	};
+}
 
 //#endregion
 exports.loadConfig = loadConfig;

package/dist/{bin → cli}/check.js

@@ -1,10 +1,11 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_map_set = require('../primordials/map-set.js');
 const require_logger_default = require('../logger/default.js');
-const require_bin_check_primordials = require('./check-primordials.js');
+const require_cli_check_primordials = require('./check-primordials.js');
 
-//#region src/bin/check.ts
+//#region src/cli/check.ts
 /**
 * @file `socket-lib check <name>` subcommand group. Routes to per-check
 *   handlers by name. Each check resolves its config file and runs its check;
@@ -14,8 +15,8 @@ const require_bin_check_primordials = require('./check-primordials.js');
 *   prim → primordials.
 */
 const logger = require_logger_default.getDefaultLogger();
-const CHECKS = new Map([["primordials", "primordials"], ["prim", "primordials"]]);
-const ALIASES = new Map([["primordials", ["prim"]]]);
+const CHECKS = new require_primordials_map_set.MapCtor([["primordials", "primordials"], ["prim", "primordials"]]);
+const ALIASES = new require_primordials_map_set.MapCtor([["primordials", ["prim"]]]);
 function printHelp() {
 	logger.log("socket-lib check — fleet-wide static-analysis checks");
 	logger.log("");
@@ -43,7 +44,7 @@ async function runCheck(args) {
 		return 1;
 	}
 	switch (canonical) {
-		case "primordials": return await require_bin_check_primordials.runCheckPrimordials(args.slice(1));
+		case "primordials": return await require_cli_check_primordials.runCheckPrimordials(args.slice(1));
 		/* c8 ignore start */
 		default:
 			logger.error(`socket-lib check: missing handler for '${canonical}'`);

package/dist/{bin → cli}/socket-lib.d.ts

@@ -2,7 +2,7 @@
 /**
  * @file `socket-lib` CLI entry point — top-level dispatcher. socket-lib — print
  *   help, list commands socket-lib check <name> [opts...] — run a fleet-wide
- *   check Subcommands live as siblings under `src/bin/`; each is its own file
+ *   check Subcommands live as siblings under `src/cli/`; each is its own file
  *   so a misbehaving check can't crash other commands at parse time. The
  *   dispatcher just routes; subcommands own their own arg parsing. The CLI is
  *   shipped via the `bin` field in package.json and intended to be invoked as

package/dist/{bin → cli}/socket-lib.js

@@ -4,15 +4,15 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_logger_default = require('../logger/default.js');
-const require_bin_check = require('./check.js');
+const require_cli_check = require('./check.js');
 let node_process = require("node:process");
 node_process = require_runtime.__toESM(node_process);
 
-//#region src/bin/socket-lib.ts
+//#region src/cli/socket-lib.ts
 /**
 * @file `socket-lib` CLI entry point — top-level dispatcher. socket-lib — print
 *   help, list commands socket-lib check <name> [opts...] — run a fleet-wide
-*   check Subcommands live as siblings under `src/bin/`; each is its own file
+*   check Subcommands live as siblings under `src/cli/`; each is its own file
 *   so a misbehaving check can't crash other commands at parse time. The
 *   dispatcher just routes; subcommands own their own arg parsing. The CLI is
 *   shipped via the `bin` field in package.json and intended to be invoked as
@@ -38,7 +38,7 @@ async function main(args = node_process.default.argv.slice(2)) {
 		return 0;
 	}
 	switch (command) {
-		case "check": return await require_bin_check.runCheck(args.slice(1));
+		case "check": return await require_cli_check.runCheck(args.slice(1));
 		default:
 			logger.error(`socket-lib: unknown command '${command}'`);
 			logger.error("Run `socket-lib --help` for the list of commands.");

package/dist/colors/socket-palette.js

@@ -43,7 +43,6 @@ const HEX_BY_THEME = {
 * `\x1b[39m` resets fg to the terminal default — using `[0m` would also clear
 * bg / styles, which the caller may have set deliberately.
 */
-/* @__NO_SIDE_EFFECTS__ */
 function colorizer(hex) {
 	const prefix = `\x1b[38;2;${parseInt(hex.slice(1, 3), 16)};${parseInt(hex.slice(3, 5), 16)};${parseInt(hex.slice(5, 7), 16)}m`;
 	const suffix = "\x1B[39m";
@@ -61,18 +60,17 @@ function colorizer(hex) {
 *   process.stdout.write(palette.success('Build complete\n'))
 *   ```
 */
-/* @__NO_SIDE_EFFECTS__ */
 function getPalette(theme = "dark") {
 	const hex = HEX_BY_THEME[theme];
 	return {
-		alert: /* @__PURE__ */ colorizer(hex.alert),
-		error: /* @__PURE__ */ colorizer(hex.error),
+		alert: colorizer(hex.alert),
+		error: colorizer(hex.error),
 		hex,
-		info: /* @__PURE__ */ colorizer(hex.info),
-		socketPink: /* @__PURE__ */ colorizer(hex.socketPink),
-		socketPurple: /* @__PURE__ */ colorizer(hex.socketPurple),
-		success: /* @__PURE__ */ colorizer(hex.success),
-		warning: /* @__PURE__ */ colorizer(hex.warning)
+		info: colorizer(hex.info),
+		socketPink: colorizer(hex.socketPink),
+		socketPurple: colorizer(hex.socketPurple),
+		success: colorizer(hex.success),
+		warning: colorizer(hex.warning)
 	};
 }
 

package/dist/compression/_internal.d.ts

@@ -6,6 +6,18 @@
  *   no callers outside this directory.
  */
 import type { CompressFileOptions, CompressOptions } from './types';
+export interface ResolvedFileArgs {
+    destPath: string;
+    options: CompressOptions | undefined;
+    inPlace: boolean;
+}
+/**
+ * Disambiguate the `(src, dest, options?)` and `(src, options)` call shapes.
+ * Returns the resolved destPath, options, and inPlace flag. Validates that the
+ * explicit destPath is not the same as srcPath, since same-path streams would
+ * deadlock on read.
+ */
+export declare function resolveFileArgs(fnName: string, srcPath: string, destOrOptions: string | CompressFileOptions | undefined, maybeOptions: CompressOptions | undefined, computeInPlaceDest: (src: string) => string): ResolvedFileArgs;
 /**
  * Strip the trailing extension from a filename when it matches one of `exts`.
  * Returns the input unchanged when the trailing extname isn't in the set.
@@ -19,15 +31,3 @@ import type { CompressFileOptions, CompressOptions } from './types';
  * `decompressGzipFile` for the canonical example).
  */
 export declare function stripExt(filePath: string, exts: ReadonlySet<string>): string;
-export interface ResolvedFileArgs {
-    destPath: string;
-    options: CompressOptions | undefined;
-    inPlace: boolean;
-}
-/**
- * Disambiguate the `(src, dest, options?)` and `(src, options)` call shapes.
- * Returns the resolved destPath, options, and inPlace flag. Validates that the
- * explicit destPath is not the same as srcPath, since same-path streams would
- * deadlock on read.
- */
-export declare function resolveFileArgs(fnName: string, srcPath: string, destOrOptions: string | CompressFileOptions | undefined, maybeOptions: CompressOptions | undefined, computeInPlaceDest: (src: string) => string): ResolvedFileArgs;