@socketsecurity/lib 6.0.8 → 6.0.10

package/dist/integrity.js

@@ -5,100 +5,129 @@ const require_runtime = require('./_virtual/_rolldown/runtime.js');
 const require_crypto_hash = require('./crypto/hash.js');
 const require_primordials_buffer = require('./primordials/buffer.js');
 const require_primordials_error = require('./primordials/error.js');
+const require_primordials_object = require('./primordials/object.js');
+const require_primordials_string = require('./primordials/string.js');
 let node_crypto = require("node:crypto");
 node_crypto = require_runtime.__toESM(node_crypto);
 
 //#region src/integrity.ts
 /**
-* @file Integrity + checksum helpers. The fleet uses two named hash flavors:
-*
-*   - **integrity** — W3C Subresource Integrity string:
-*     `sha(256|384|512)-<base64>`. The same shape the npm registry returns and
-*     the `<script integrity>` HTML attribute accepts. Algorithm is embedded.
-*   - **checksum** — sha256 hex digest, exactly 64 lowercase chars. The shape
-*     produced by `shasum -a 256` and used in GitHub-release SHA256SUMS files.
-*     Conversion is direction-specific so the names read in English:
-*     `checksumToIntegrity(hex)` and `integrityToChecksum(sri)`. Both are
-*     idempotent on the destination format (pass an SRI to
-*     `checksumToIntegrity`, get the same SRI back) so callers can apply them
-*     without first sniffing the input shape. "SSRI" is just another name for
-*     Subresource Integrity — this module is the only one that should mention
-*     it, and only inside `parseIntegrity` to extract the embedded algorithm +
-*     body.
+* @file Integrity + checksum helpers. One concept — a {@link Hash} (algorithm +
+*   digest) — in two encodings:
+*
+*   - **hex** — lowercase hex digest (`shasum -a 256` / GitHub `SHA256SUMS`).
+*   - **sri** — W3C Subresource Integrity `sha(256|384|512)-<base64>` (npm
+*     `dist.integrity`, the `<script integrity>` attribute). Both are views of
+*     the same digest. The algorithm is EXPLICIT on every `Hash` — never
+*     inferred from which function produced it or sniffed from a string's
+*     shape. `verifyHash(bytes, expected)` honors whatever algorithm the
+*     expected hash declares, so a sha256 `SHA256SUMS` digest and a sha512 npm
+*     integrity both "just verify" with no manual conversion. Role split (see
+*     `docs/hash-algorithms.md`, unchanged): we PIN sha512 (`computeHash`
+*     default, `computeHashes().integrity`); sha256 is the upstream-interop
+*     shape (`fetchChecksumFile`, `computeHashes().checksum`). The two only
+*     meet at verify-upstream-256 → pin-512. Algorithms are never flipped —
+*     relabeling a 256-bit digest as sha512 would be a lie, and you can't
+*     re-hash without the bytes. "SSRI" is just another name for Subresource
+*     Integrity — only this module should mention it, inside `parseIntegrity`.
 */
 const INTEGRITY_RE = /^(sha(?:256|384|512))-([A-Za-z0-9+/]+=*)$/;
+const HEX_RE = /^[a-f0-9]+$/i;
 const CHECKSUM_RE = /^[a-f0-9]{64}$/i;
+const ALGORITHM_HEX_LENGTH = {
+	sha256: 64,
+	sha384: 96,
+	sha512: 128
+};
+const HEX_LENGTH_TO_ALGORITHM = {
+	64: "sha256",
+	96: "sha384",
+	128: "sha512"
+};
 /**
-* Convert a sha256 hex checksum to its SRI integrity form (`sha256-<base64>`).
-* Idempotent on integrity input — call this on user-supplied data without first
-* sniffing the format.
-*
-* The default algorithm is `'sha256'` because this converts a _checksum_, and
-* checksums are sha256 by fleet convention (the GitHub-SHA256SUMS interop shape
-* its only caller, `checksum-file.ts`, parses). Do NOT flip this default to
-* sha512: this function only relabels the hex bytes, it does not re-hash, so a
-* sha512 label on a 256-bit digest would be a lie. The canonical algorithm for
-* OUR-side integrity values is sha512 — emitted by `computeHashes` as the
-* `integrity` (`sha512-<base64>`) field; sha256 is reserved for
-* upstream-SHASUMS interop and content addressing. Pass an explicit algorithm
-* if you have a hex digest from `sha384` or `sha512` (the function does not
-* verify hex length against the algorithm — caller's responsibility).
-*
-* @example
-*   ;```typescript
-*   checksumToIntegrity(
-*     '3620a0fcaf81ecd3aaeccd5965919d90dbc913f4d07a96e11e7cafc2c785054b',
-*   )
-*   // 'sha256-NiCg/K+B7NOq7M1ZZZGdkNvJE/TQepbhHnyvwseFBUs='
+* Convert a hex checksum to its SRI integrity form.
 *
-*   checksumToIntegrity('sha256-NiCg/K+B7NOq7M1ZZZGdkNvJE/TQepbhHnyvwseFBUs=')
-*   // 'sha256-NiCg/K+B7NOq7M1ZZZGdkNvJE/TQepbhHnyvwseFBUs=' (idempotent)
-*   ```
+* @deprecated Prefer `parseHash(x).sri`, which is total across all algorithms
+*   and infers the algorithm from a bare hex digest. This shim defaults to
+*   `'sha256'` because it only relabels the hex bytes — it does NOT re-hash, so
+*   a sha512 label on a 256-bit digest would be a lie. Idempotent on SRI input.
 *
 * @throws TypeError when the input is neither a recognized SRI nor a hex
 *   digest.
 */
 function checksumToIntegrity(input, algorithm = "sha256") {
 	if (isIntegrity(input)) return input;
-	if (!/^[a-f0-9]+$/i.test(input)) throw new require_primordials_error.TypeErrorCtor(`checksumToIntegrity: expected a hex digest or SRI string, got: ${input}`);
-	return `${algorithm}-${require_primordials_buffer.BufferPrototypeToString(require_primordials_buffer.BufferFrom(input, "hex"), "base64")}`;
+	if (!HEX_RE.test(input)) throw new require_primordials_error.TypeErrorCtor(`checksumToIntegrity: expected a hex digest or SRI string, got: ${input}`);
+	return makeHash(algorithm, input).sri;
+}
+/**
+* Compute a single {@link Hash} of `bytes`. Defaults to sha512 — the canonical
+* trust string we pin against. Pass `'sha256'` for the upstream-interop digest.
+*
+* @example
+*   ;```typescript
+*   computeHash(bytes).sri        // 'sha512-…'  (pin this)
+*   computeHash(bytes, 'sha256').hex  // '3620a0…' (compare to SHA256SUMS)
+*   ```
+*/
+function computeHash(bytes, algorithm = "sha512") {
+	return makeHash(algorithm, require_crypto_hash.hash(algorithm, bytes, "hex"));
 }
 /**
-* Compute both integrity (sha512 SRI) and checksum (sha256 hex) for a buffer of
-* bytes.
+* Compute both pinned formats for `bytes`: the sha512 SRI integrity and the
+* sha256 hex checksum. Use when a config records both (e.g.
+* `external-tools.json`, dlx lockfiles).
 */
 function computeHashes(bytes) {
 	return {
-		integrity: `sha512-${require_crypto_hash.hash("sha512", bytes, "base64")}`,
-		checksum: require_crypto_hash.hash("sha256", bytes, "hex")
+		integrity: computeHash(bytes, "sha512").sri,
+		checksum: computeHash(bytes, "sha256").hex
 	};
 }
 /**
-* Convert a sha256 SRI integrity string to its hex checksum form (64 lowercase
-* chars). Idempotent on checksum input.
+* Compare two hashes for equality, ENCODING-agnostically. Parses both and —
+* only when they share an algorithm — timing-safe compares the digests.
+*
+* Returns false when the algorithms differ. A sha512 and a sha256 are different
+* functions of the same bytes: their digests are unrelated values, so they can
+* never be "equal", and you CANNOT derive or check one against the other
+* without the original bytes. To confirm a sha256 and a sha512 describe the
+* same content, hash the bytes both ways (`computeHashes`) or `verifyHash` the
+* bytes against each — there is no hash-to-hash shortcut across algorithms.
 *
-* Throws on `sha384` and `sha512` SRI — checksums are sha256-only by fleet
-* convention. Callers that need a hex digest for those algorithms can call
-* `parseIntegrity(sri)` and decode `.body` manually.
+* What this DOES solve is the cross-ENCODING case that bites string `===`: a
+* sha256 SRI and the same sha256 hex compare equal here.
 *
 * @example
 *   ;```typescript
-*   integrityToChecksum('sha256-NiCg/K+B7NOq7M1ZZZGdkNvJE/TQepbhHnyvwseFBUs=')
-*   // '3620a0fcaf81ecd3aaeccd5965919d90dbc913f4d07a96e11e7cafc2c785054b'
-*
-*   integrityToChecksum(
-*     '3620a0fcaf81ecd3aaeccd5965919d90dbc913f4d07a96e11e7cafc2c785054b',
-*   )
-*   // '3620a0fcaf81ecd3aaeccd5965919d90dbc913f4d07a96e11e7cafc2c785054b' (idempotent)
+*   equalHashes('sha256-NiCg…', '3620a0fc…')  // true  (same digest, SRI vs hex)
+*   equalHashes('sha512-…', '3620a0fc…')       // false (different algorithms)
 *   ```
 *
+* @throws TypeError when either input is not a recognized hash.
+*/
+function equalHashes(a, b) {
+	const aHash = parseHash(a);
+	const bHash = parseHash(b);
+	if (aHash.algorithm !== bHash.algorithm) return false;
+	const aBuf = require_primordials_buffer.BufferFrom(aHash.hex, "hex");
+	const bBuf = require_primordials_buffer.BufferFrom(bHash.hex, "hex");
+	return aBuf.length === bBuf.length && node_crypto.default.timingSafeEqual(aBuf, bBuf);
+}
+/**
+* Convert an SRI integrity string to its hex checksum form.
+*
+* @deprecated Prefer `parseHash(x).hex`, which is total across all algorithms.
+*   This shim is sha256-only (throws on sha384 / sha512) to preserve its
+*   historical "checksums are sha256" contract. Idempotent on hex input.
+*
 * @throws TypeError when the input is neither a recognized SRI nor a hex
 *   checksum, or when the input is a non-sha256 SRI.
 */
 function integrityToChecksum(input) {
 	if (isChecksum(input)) return input;
 	const parsed = parseIntegrity(input);
-	if (parsed.algorithm !== "sha256") throw new require_primordials_error.TypeErrorCtor(`integrityToChecksum: ${parsed.algorithm} integrity has no 64-hex-char checksum form — checksums are sha256-only by fleet convention.`);
+	if (parsed.algorithm !== "sha256") throw new require_primordials_error.TypeErrorCtor(`integrityToChecksum: ${parsed.algorithm} integrity has no 64-hex-char checksum form — checksums are sha256-only by Socket convention. Use parseHash(x).hex for any algorithm.`);
 	return require_primordials_buffer.BufferPrototypeToString(require_primordials_buffer.BufferFrom(parsed.body, "base64"), "hex");
 }
 /**
@@ -108,18 +137,36 @@ function isChecksum(s) {
 	return CHECKSUM_RE.test(s);
 }
 /**
+* True when `s` is a bare hex digest of a recognized length (sha256 / sha384 /
+* sha512).
+*/
+function isHex(s) {
+	return HEX_RE.test(s) && HEX_LENGTH_TO_ALGORITHM[s.length] !== void 0;
+}
+/**
 * True when `s` is a W3C SRI integrity string: `sha(256|384|512)-<base64>`.
 */
 function isIntegrity(s) {
 	return INTEGRITY_RE.test(s);
 }
 /**
+* Build a frozen {@link Hash} from an algorithm and a hex digest. The internal
+* constructor — trusts its inputs (lowercases the hex, computes the SRI view);
+* use {@link parseHash} for untrusted strings, which validates first.
+*/
+function makeHash(algorithm, hex) {
+	const lowerHex = require_primordials_string.StringPrototypeToLowerCase(hex);
+	return require_primordials_object.ObjectFreeze({
+		algorithm,
+		hex: lowerHex,
+		sri: `${algorithm}-${require_primordials_buffer.BufferPrototypeToString(require_primordials_buffer.BufferFrom(lowerHex, "hex"), "base64")}`
+	});
+}
+/**
 * Normalize a {@link HashSpec} to its canonical `{ type, value }` form.
 *
-* - Object form is trusted (its `value` is validated for shape).
-* - Bare string matching SRI → integrity.
-* - Bare string of 64 hex chars → checksum.
-* - Anything else throws TypeError.
+* @deprecated Prefer {@link parseHash}, which returns an algorithm-tagged
+*   {@link Hash}. Kept for callers that branch on integrity-vs-checksum type.
 *
 * @throws TypeError if the string is not a recognized format, or if an explicit
 *   object's value doesn't match its declared type.
@@ -154,14 +201,37 @@ function normalizeHash(spec) {
 	throw new require_primordials_error.TypeErrorCtor(`normalizeHash: unrecognized hash format. Expected SRI integrity ("sha(256|384|512)-<base64>") or sha256 hex checksum (64 hex chars), got: ${spec}`);
 }
 /**
-* Split an integrity string into its `{ algorithm, body }` components. `body`
-* is the base64-encoded digest (everything after the algorithm + dash).
+* Parse any {@link HashInput} into a canonical {@link Hash}. The one entry
+* point for untrusted input — validates shape + length, then freezes.
 *
-* @example
-*   ;```typescript
-*   parseIntegrity('sha256-NiCg/K+B7NOq7M1ZZZGdkNvJE/TQepbhHnyvwseFBUs=')
-*   // { algorithm: 'sha256', body: 'NiCg/K+B7NOq7M1ZZZGdkNvJE/TQepbhHnyvwseFBUs=' }
-*   ```
+* - A {@link Hash} object is re-canonicalized from its `algorithm` + `hex`.
+* - An SRI string carries its algorithm in the prefix (the body length is checked
+*   against it).
+* - A bare hex digest infers the algorithm from its length (64 / 96 / 128).
+*
+* @throws TypeError when the input is not a recognized SRI or hex digest, or
+*   when an SRI body's length doesn't match its declared algorithm.
+*/
+function parseHash(input) {
+	if (typeof input === "object" && input !== null) return makeHash(input.algorithm, input.hex);
+	const sriMatch = INTEGRITY_RE.exec(input);
+	if (sriMatch) {
+		const algorithm = sriMatch[1];
+		const hex = require_primordials_buffer.BufferPrototypeToString(require_primordials_buffer.BufferFrom(sriMatch[2], "base64"), "hex");
+		const expectedLength = ALGORITHM_HEX_LENGTH[algorithm];
+		if (hex.length !== expectedLength) throw new require_primordials_error.TypeErrorCtor(`parseHash: ${algorithm} SRI body decodes to ${hex.length} hex chars, expected ${expectedLength}: ${input}`);
+		return makeHash(algorithm, hex);
+	}
+	if (HEX_RE.test(input)) {
+		const algorithm = HEX_LENGTH_TO_ALGORITHM[input.length];
+		if (algorithm === void 0) throw new require_primordials_error.TypeErrorCtor(`parseHash: hex digest is ${input.length} chars; expected 64 (sha256), 96 (sha384), or 128 (sha512): ${input}`);
+		return makeHash(algorithm, input);
+	}
+	throw new require_primordials_error.TypeErrorCtor(`parseHash: expected an SRI string ("sha(256|384|512)-<base64>") or a hex digest, got: ${input}`);
+}
+/**
+* Split an SRI integrity string into its `{ algorithm, body }` components.
+* `body` is the base64-encoded digest.
 *
 * @throws Error when the input is not a valid SRI integrity string.
 */
@@ -174,41 +244,57 @@ function parseIntegrity(sri) {
 	};
 }
 /**
-* Verify computed hashes against an expected {@link NormalizedHash}. Uses
-* `crypto.timingSafeEqual` for constant-time comparison.
+* Verify `bytes` against an expected hash. Reads the algorithm the expected
+* hash declares, computes only that digest, and compares with
+* `crypto.timingSafeEqual` — so any encoding (hex / SRI / {@link Hash}) and any
+* algorithm (sha256 / sha384 / sha512) verifies without the caller reconciling
+* formats first.
 *
-* @throws DlxHashMismatchError when the hash of the matching type doesn't match
-*   the expected value.
+* @throws HashMismatchError when the recomputed digest doesn't match.
+* @throws TypeError when `expected` is not a recognized hash.
 */
-function verifyHash(expected, computed) {
-	const actual = expected.type === "integrity" ? computed.integrity : computed.checksum;
-	const expectedBuf = require_primordials_buffer.BufferFrom(expected.value);
-	const actualBuf = require_primordials_buffer.BufferFrom(actual);
-	if (expectedBuf.length !== actualBuf.length || !node_crypto.default.timingSafeEqual(expectedBuf, actualBuf)) throw new DlxHashMismatchError(expected, computed);
+function verifyHash(bytes, expected) {
+	const expectedHash = parseHash(expected);
+	const actualHash = computeHash(bytes, expectedHash.algorithm);
+	const expectedBuf = require_primordials_buffer.BufferFrom(expectedHash.hex, "hex");
+	const actualBuf = require_primordials_buffer.BufferFrom(actualHash.hex, "hex");
+	if (expectedBuf.length !== actualBuf.length || !node_crypto.default.timingSafeEqual(expectedBuf, actualBuf)) throw new HashMismatchError(expectedHash, actualHash);
 }
 /**
-* Thrown when an expected hash doesn't match the computed hash of the
-* downloaded bytes. Carries both sides for diagnostics.
+* Thrown when an expected hash doesn't match the computed hash of the verified
+* bytes. Carries both sides (as {@link Hash}) for diagnostics.
 */
-var DlxHashMismatchError = class extends Error {
+var HashMismatchError = class extends Error {
 	expected;
 	actual;
 	constructor(expected, actual) {
-		const actualValue = expected.type === "integrity" ? actual.integrity : actual.checksum;
-		super(`Hash mismatch (${expected.type}): expected ${expected.value}, got ${actualValue}`);
-		this.name = "DlxHashMismatchError";
+		super(`Hash mismatch (${expected.algorithm}): expected ${expected.sri}, got ${actual.sri}`);
+		this.name = "HashMismatchError";
 		this.expected = expected;
 		this.actual = actual;
 	}
 };
+/**
+* @deprecated Renamed to {@link HashMismatchError}. Alias kept for callers that
+*   catch the old name.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
+const DlxHashMismatchError = HashMismatchError;
 
 //#endregion
 exports.DlxHashMismatchError = DlxHashMismatchError;
+exports.HashMismatchError = HashMismatchError;
 exports.checksumToIntegrity = checksumToIntegrity;
+exports.computeHash = computeHash;
 exports.computeHashes = computeHashes;
+exports.equalHashes = equalHashes;
 exports.integrityToChecksum = integrityToChecksum;
 exports.isChecksum = isChecksum;
+exports.isHex = isHex;
 exports.isIntegrity = isIntegrity;
+exports.makeHash = makeHash;
 exports.normalizeHash = normalizeHash;
+exports.parseHash = parseHash;
 exports.parseIntegrity = parseIntegrity;
 exports.verifyHash = verifyHash;

package/dist/json/format.js

@@ -166,7 +166,10 @@ function shouldSave(currentContent, originalContent, originalFileContent, option
 function sortKeys(obj) {
 	const sorted = { __proto__: null };
 	const keys = require_primordials_object.ObjectKeys(obj).toSorted();
-	for (const key of keys) sorted[key] = obj[key];
+	for (let i = 0, { length } = keys; i < length; i += 1) {
+		const key = keys[i];
+		sorted[key] = obj[key];
+	}
 	return sorted;
 }
 /**

package/dist/logger/_internal.d.ts

@@ -3,7 +3,7 @@
  *   public `Logger` surface) and `logger/console-init` (which mutates
  *   `Logger.prototype` to mirror `globalConsole`). The `_` prefix keeps this
  *   module out of the generated package.json `exports` map (the `dist/**\/_*`
- *   ignore pattern in `scripts/post-build/make-package-exports.mts` filters it
+ *   ignore pattern in `scripts/fleet/make-package-exports.mts` filters it
  *   out), so it is not part of the public surface — it exists only to give the
  *   two leaves above a common owner for the WeakMap-backed lazy-init state. Why
  *   two WeakMaps instead of `#privateField` slots:
@@ -43,22 +43,20 @@ export declare const consolePropAttributes: {
 export declare const maxIndentation = 1000;
 /**
  * Pre-bound copies of the console methods that need their original `this` to
- * function (e.g., `console.error.bind(globalConsole)`). Mapping `[name,
- * boundFn]` so `console-init.ts` can apply them onto the per-instance Console
- * without re-binding on every call.
+ * function (e.g., `console.error.bind(globalConsole)`). Returns `[name,
+ * boundFn]` pairs so `console-init.ts` can apply them onto the per-instance
+ * Console without re-binding on every call.
  *
- * Notes from the upstream Node implementation:
- *
- * - `_stderrErrorHandler` / `_stdoutErrorHandler` are `kBindProperties`
- *   properties — they live on the per-instance Console and need their `this`
- *   set to `globalConsole`.
- *   https://github.com/nodejs/node/blob/v24.0.1/lib/internal/console/constructor.js#L230-L265
- * - `group` / `groupCollapsed` / `groupEnd` are explicitly skipped because Node
- *   20 with `--frozen-intrinsics` makes `Symbol(kGroupIndent)` read-only, which
- *   the Logger's own group methods avoid by tracking indentation at the prefix
- *   layer.
+ * Built LAZILY (memoized) rather than at module-eval: `fn.bind(globalConsole)`
+ * of a native console method produces a bound function wrapping a native C++
+ * function pointer, which serializes as an unresolvable external reference and
+ * aborts V8 --build-snapshot. Deferring construction to first Console build
+ * keeps the bind-once/reuse win while leaving module import snapshot-safe.
  */
-export declare const boundConsoleEntries: [string, (...args: unknown[]) => unknown][];
+export declare function getBoundConsoleEntries(): Array<[
+    string,
+    (...args: unknown[]) => unknown
+]>;
 /**
  * WeakMap storing the Console instance for each Logger.
  *

package/dist/logger/_internal.js

@@ -9,7 +9,7 @@ const require_primordials_map_set = require('../primordials/map-set.js');
 *   public `Logger` surface) and `logger/console-init` (which mutates
 *   `Logger.prototype` to mirror `globalConsole`). The `_` prefix keeps this
 *   module out of the generated package.json `exports` map (the `dist/**\/_*`
-*   ignore pattern in `scripts/post-build/make-package-exports.mts` filters it
+*   ignore pattern in `scripts/fleet/make-package-exports.mts` filters it
 *   out), so it is not part of the public surface — it exists only to give the
 *   two leaves above a common owner for the WeakMap-backed lazy-init state. Why
 *   two WeakMaps instead of `#privateField` slots:
@@ -47,24 +47,7 @@ const consolePropAttributes = {
 * huge `n` can't allocate a multi-megabyte string.
 */
 const maxIndentation = 1e3;
-/**
-* Pre-bound copies of the console methods that need their original `this` to
-* function (e.g., `console.error.bind(globalConsole)`). Mapping `[name,
-* boundFn]` so `console-init.ts` can apply them onto the per-instance Console
-* without re-binding on every call.
-*
-* Notes from the upstream Node implementation:
-*
-* - `_stderrErrorHandler` / `_stdoutErrorHandler` are `kBindProperties`
-*   properties — they live on the per-instance Console and need their `this`
-*   set to `globalConsole`.
-*   https://github.com/nodejs/node/blob/v24.0.1/lib/internal/console/constructor.js#L230-L265
-* - `group` / `groupCollapsed` / `groupEnd` are explicitly skipped because Node
-*   20 with `--frozen-intrinsics` makes `Symbol(kGroupIndent)` read-only, which
-*   the Logger's own group methods avoid by tracking indentation at the prefix
-*   layer.
-*/
-const boundConsoleEntries = [
+const boundConsoleMethodNames = [
 	"_stderrErrorHandler",
 	"_stdoutErrorHandler",
 	"assert",
@@ -84,7 +67,24 @@ const boundConsoleEntries = [
 	"timeLog",
 	"trace",
 	"warn"
-].filter((n) => typeof globalConsole[n] === "function").map((n) => [n, globalConsole[n].bind(globalConsole)]);
+];
+let boundConsoleEntries;
+/**
+* Pre-bound copies of the console methods that need their original `this` to
+* function (e.g., `console.error.bind(globalConsole)`). Returns `[name,
+* boundFn]` pairs so `console-init.ts` can apply them onto the per-instance
+* Console without re-binding on every call.
+*
+* Built LAZILY (memoized) rather than at module-eval: `fn.bind(globalConsole)`
+* of a native console method produces a bound function wrapping a native C++
+* function pointer, which serializes as an unresolvable external reference and
+* aborts V8 --build-snapshot. Deferring construction to first Console build
+* keeps the bind-once/reuse win while leaving module import snapshot-safe.
+*/
+function getBoundConsoleEntries() {
+	if (boundConsoleEntries === void 0) boundConsoleEntries = boundConsoleMethodNames.filter((n) => typeof globalConsole[n] === "function").map((n) => [n, globalConsole[n].bind(globalConsole)]);
+	return boundConsoleEntries;
+}
 /**
 * WeakMap storing the Console instance for each Logger.
 *
@@ -108,8 +108,8 @@ const privateConsole = new require_primordials_map_set.WeakMapCtor();
 const privateConstructorArgs = new require_primordials_map_set.WeakMapCtor();
 
 //#endregion
-exports.boundConsoleEntries = boundConsoleEntries;
 exports.consolePropAttributes = consolePropAttributes;
+exports.getBoundConsoleEntries = getBoundConsoleEntries;
 exports.globalConsole = globalConsole;
 exports.maxIndentation = maxIndentation;
 exports.privateConsole = privateConsole;

package/dist/logger/colors.d.ts

@@ -3,16 +3,21 @@
  *   `yoctocolors-cjs` palette so the logger can accept either a named color
  *   (`'green'`) or an explicit RGB tuple (`[255, 0, 0]`); RGB tuples are
  *   emitted via the 24-bit `[38;2;...m` escape because `yoctocolors-cjs`
- *   doesn't ship an `rgb()` helper.
+ *   doesn't ship an `rgb()` helper. The vendored palette re-exports from the
+ *   external-pack mega-bundle, whose module top-level evaluates every packed
+ *   package — so it is required lazily on first color application (Logger
+ *   construction at the earliest), keeping `logger/*` importers
+ *   browser-load-safe and cheap at module init.
  */
-import yoctocolorsCjs from '../external/yoctocolors-cjs';
+import type yoctocolorsCjs from '../external/yoctocolors-cjs';
 import type { ColorValue } from '../colors/types';
 /**
  * Apply a color to text using yoctocolors. Handles both named colors and RGB
  * tuples.
  */
-export declare function applyColor(text: string, color: ColorValue, colors: typeof yoctocolorsCjs): string;
+export declare function applyColor(text: string, color: ColorValue): string;
 /**
- * Get the yoctocolors module for terminal colors.
+ * Get the yoctocolors module for terminal colors. Required lazily on first
+ * call — see the @file note on the external-pack top-level.
  */
-export declare function getYoctocolors(): import("../external/yoctocolors-cjs").YoctoColors;
+export declare function getYoctocolors(): typeof yoctocolorsCjs;

package/dist/logger/colors.js

@@ -1,35 +1,28 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_runtime = require('../_virtual/_rolldown/runtime.js');
-let src_external_yoctocolors_cjs = require("../external/yoctocolors-cjs");
-src_external_yoctocolors_cjs = require_runtime.__toESM(src_external_yoctocolors_cjs);
 
 //#region src/logger/colors.ts
-/**
-* @file Color application helpers for `logger/*` modules. Wraps the vendored
-*   `yoctocolors-cjs` palette so the logger can accept either a named color
-*   (`'green'`) or an explicit RGB tuple (`[255, 0, 0]`); RGB tuples are
-*   emitted via the 24-bit `[38;2;...m` escape because `yoctocolors-cjs`
-*   doesn't ship an `rgb()` helper.
-*/
+let cachedYoctocolors;
 /**
 * Apply a color to text using yoctocolors. Handles both named colors and RGB
 * tuples.
 */
-function applyColor(text, color, colors) {
+function applyColor(text, color) {
 	if (typeof color === "string") {
-		const formatter = colors[color];
+		const formatter = getYoctocolors()[color];
 		return formatter ? formatter(text) : text;
 	}
 	const { 0: r, 1: g, 2: b } = color;
 	return `\u001B[38;2;${r};${g};${b}m${text}\u001B[39m`;
 }
 /**
-* Get the yoctocolors module for terminal colors.
+* Get the yoctocolors module for terminal colors. Required lazily on first
+* call — see the @file note on the external-pack top-level.
 */
 function getYoctocolors() {
-	return src_external_yoctocolors_cjs.default;
+	if (cachedYoctocolors === void 0) cachedYoctocolors = require("../external/yoctocolors-cjs");
+	return cachedYoctocolors;
 }
 
 //#endregion

package/dist/logger/console-methods.js

@@ -29,7 +29,7 @@ const require_logger_symbols = require('./symbols.js');
 * @param message - Optional message and additional arguments to log.
 */
 function assertMethod(logger, con, value, message) {
-	con.assert(value, message[0], ...message.slice(1));
+	con.assert(Boolean(value), message[0], ...message.slice(1));
 	logger[require_logger_symbols.lastWasBlankSymbol](false);
 	return value ? logger : logger[require_logger_symbols.incLogCallCountSymbol]();
 }
@@ -89,7 +89,7 @@ function dirxmlMethod(logger, con, data) {
 * @param properties - Optional array of property names to include.
 */
 function tableMethod(logger, con, tabularData, properties) {
-	con.table(tabularData, properties);
+	con.table(tabularData, properties ? [...properties] : void 0);
 	logger[require_logger_symbols.lastWasBlankSymbol](false);
 	return logger[require_logger_symbols.incLogCallCountSymbol]();
 }

package/dist/logger/console.d.ts

@@ -19,6 +19,7 @@
  *     `ensurePrototypeInitialized` actually runs, both modules are fully
  *     evaluated. Same pattern as `fs/path-cache` ↔ `fs/_internal`.
  */
+import type { Console } from 'node:console';
 import { Logger } from './node';
 /**
  * Construct a new Console instance.

package/dist/logger/console.js

@@ -7,8 +7,8 @@ const require_primordials_reflect = require('../primordials/reflect.js');
 const require_logger__internal = require('./_internal.js');
 const require_logger_symbols = require('./symbols.js');
 const require_logger_node = require('./node.js');
-let node_process = require("node:process");
-node_process = require_runtime.__toESM(node_process);
+let process = require("process");
+process = require_runtime.__toESM(process);
 
 //#region src/logger/console.ts
 /**
@@ -39,7 +39,7 @@ let prototypeInitialized = false;
 */
 function constructConsole(...args) {
 	/* c8 ignore next - Lazy-init second-call branch; module-singleton. */
-	if (cachedConsole === void 0) cachedConsole = (/* @__PURE__ */ require("node:console")).Console;
+	if (cachedConsole === void 0) cachedConsole = (/* @__PURE__ */ require("console")).Console;
 	return require_primordials_reflect.ReflectConstruct(cachedConsole, args);
 }
 /**
@@ -70,10 +70,10 @@ function ensurePrototypeInitialized() {
 				if (ctorArgs.length) con = constructConsole(...ctorArgs);
 				else {
 					con = constructConsole({
-						stdout: node_process.default.stdout,
-						stderr: node_process.default.stderr
+						stdout: process.default.stdout,
+						stderr: process.default.stderr
 					});
-					for (const { 0: k, 1: method } of require_logger__internal.boundConsoleEntries) con[k] = method;
+					for (const { 0: k, 1: method } of require_logger__internal.getBoundConsoleEntries()) con[k] = method;
 				}
 				require_logger__internal.privateConsole.set(this, con);
 			}
@@ -109,10 +109,10 @@ function resolveConsole(logger) {
 		if (ctorArgs.length) con = constructConsole(...ctorArgs);
 		else {
 			con = constructConsole({
-				stdout: node_process.default.stdout,
-				stderr: node_process.default.stderr
+				stdout: process.default.stdout,
+				stderr: process.default.stderr
 			});
-			for (const { 0: key, 1: method } of require_logger__internal.boundConsoleEntries) con[key] = method;
+			for (const { 0: key, 1: method } of require_logger__internal.getBoundConsoleEntries()) con[key] = method;
 		}
 		require_logger__internal.privateConsole.set(logger, con);
 		require_logger__internal.privateConstructorArgs.delete(logger);

package/dist/logger/node.js

@@ -106,7 +106,8 @@ var Logger = class Logger {
 		else root.#stdoutLastWasBlank = value;
 	}
 	#streamChild(stream) {
-		const instance = new Logger(...require_logger__internal.privateConstructorArgs.get(this) ?? []);
+		const ctorArgs = require_logger__internal.privateConstructorArgs.get(this) ?? [];
+		const instance = new Logger(...ctorArgs);
 		instance.#parent = this;
 		instance.#boundStream = stream;
 		instance.#options = {