@socketsecurity/lib 6.0.8 → 6.0.10

package/dist/cache/ttl/store.js

@@ -2,15 +2,15 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_primordials_error = require('../../primordials/error.js');
+const require_primordials_string = require('../../primordials/string.js');
 const require_primordials_math = require('../../primordials/math.js');
 const require_primordials_map_set = require('../../primordials/map-set.js');
-const require_primordials_string = require('../../primordials/string.js');
-const require_primordials_regexp = require('../../primordials/regexp.js');
 const require_primordials_date = require('../../primordials/date.js');
 const require_primordials_json = require('../../primordials/json.js');
 const require_cacache_clear = require('../../cacache/clear.js');
 const require_cacache_read = require('../../cacache/read.js');
 const require_cacache_write = require('../../cacache/write.js');
+const require_cache_ttl__internal = require('./_internal.js');
 
 //#region src/cache/ttl/store.ts
 /**
@@ -30,9 +30,6 @@ const require_cacache_write = require('../../cacache/write.js');
 *   - Clock-skew detection: entries with suspiciously-far-future `expiresAt` are
 *     treated as expired.
 */
-const DEFAULT_TTL_MS = 300 * 1e3;
-const DEFAULT_PREFIX = "ttl-cache";
-const DEFAULT_MEMO_MAX_SIZE = 1e3;
 /**
 * Create a TTL-based cache instance.
 *
@@ -47,50 +44,30 @@ function createTtlCache(options) {
 	const opts = {
 		__proto__: null,
 		memoize: true,
-		memoMaxSize: DEFAULT_MEMO_MAX_SIZE,
-		prefix: DEFAULT_PREFIX,
-		ttl: DEFAULT_TTL_MS,
+		memoMaxSize: require_cache_ttl__internal.DEFAULT_MEMO_MAX_SIZE,
+		prefix: require_cache_ttl__internal.DEFAULT_PREFIX,
+		ttl: require_cache_ttl__internal.DEFAULT_TTL_MS,
 		...options
 	};
 	if (opts.prefix?.includes("*")) throw new require_primordials_error.TypeErrorCtor("Cache prefix cannot contain wildcards (*). Use clear({ prefix: \"pattern*\" }) for wildcard matching.");
 	const memoCache = new require_primordials_map_set.MapCtor();
-	const memoMaxSize = require_primordials_math.MathMax(1, opts.memoMaxSize ?? DEFAULT_MEMO_MAX_SIZE);
+	const memoMaxSize = require_primordials_math.MathMax(1, opts.memoMaxSize ?? 1e3);
 	function memoSet(fullKey, entry) {
-		/* c8 ignore start */
-		if (memoCache.has(fullKey)) memoCache.delete(fullKey);
-		else if (memoCache.size >= memoMaxSize) {
-			const oldest = memoCache.keys().next().value;
-			if (oldest !== void 0) memoCache.delete(oldest);
-		}
-		/* c8 ignore stop */
-		memoCache.set(fullKey, entry);
+		require_cache_ttl__internal.lruSet(memoCache, memoMaxSize, fullKey, entry);
 	}
-	/* c8 ignore next */
-	const ttl = opts.ttl ?? DEFAULT_TTL_MS;
+	/* c8 ignore next - default-ttl fallback arm */
+	const ttl = opts.ttl ?? 3e5;
 	/**
 	* Build full cache key with prefix.
 	*/
 	function buildKey(key) {
 		return `${opts.prefix}:${key}`;
 	}
-	/**
-	* Check if entry is expired. Also detects clock skew by treating suspiciously
-	* far-future expiresAt as expired.
-	*/
 	function isExpired(entry) {
-		const now = require_primordials_date.DateNow();
-		if (entry.expiresAt > now + ttl + 1e4) return true;
-		return now > entry.expiresAt;
+		return require_cache_ttl__internal.isExpiredEntry(entry, ttl);
 	}
-	/**
-	* Create a matcher function for a pattern (with wildcard support). Returns a
-	* function that tests if a key matches the pattern.
-	*/
 	function createMatcher(pattern) {
-		const fullPattern = buildKey(pattern);
-		if (!pattern.includes("*")) return (key) => require_primordials_string.StringPrototypeStartsWith(key, fullPattern);
-		const regex = new require_primordials_regexp.RegExpCtor(`^${require_primordials_string.StringPrototypeReplaceAll(require_primordials_string.StringPrototypeReplaceAll(fullPattern, /[.+?^${}()|[\]\\]/g, "\\$&"), "*", ".*")}$`);
-		return (key) => require_primordials_regexp.RegExpPrototypeTest(regex, key);
+		return require_cache_ttl__internal.createKeyMatcher(opts.prefix ?? "ttl-cache", pattern);
 	}
 	async function get(key) {
 		if (require_primordials_string.StringPrototypeIncludes(key, "*")) throw new require_primordials_error.TypeErrorCtor("Cache key cannot contain wildcards (*). Use getAll(pattern) to retrieve multiple entries.");

package/dist/cache/ttl/types.d.ts

@@ -1,9 +1,20 @@
 /**
  * @file Public type surface for `cache/ttl/*` modules — the `TtlCache`
- *   interface (the seven-method API returned by `createTtlCache`), the
- *   `TtlCacheEntry` storage shape, and the `TtlCacheOptions` / `ClearOptions`
- *   configuration records. Pure types, no runtime side effects.
+ *   interface (the seven-method API returned by `createTtlCache` and
+ *   `createBrowserTtlCache`), the `TtlCacheEntry` storage shape, the
+ *   `TtlCacheStorage` adapter contract for the browser store's persistent
+ *   tier, and the `TtlCacheOptions` / `BrowserTtlCacheOptions` /
+ *   `ClearOptions` configuration records. Pure types, no runtime side
+ *   effects.
  */
+export interface BrowserTtlCacheOptions extends TtlCacheOptions {
+    /**
+     * Storage adapter backing the persistent tier — wrap `chrome.storage.local`,
+     * `sessionStorage` / `localStorage`, IndexedDB, or anything else with a
+     * key-value string surface. Omit for a memo-only (in-memory) cache.
+     */
+    storage?: TtlCacheStorage | undefined;
+}
 export interface ClearOptions {
     /**
      * Only clear in-memory memoization cache, not persistent cache. Useful for
@@ -107,3 +118,35 @@ export interface TtlCacheOptions {
      */
     prefix?: string | undefined;
 }
+/**
+ * Key-value string storage adapter for `createBrowserTtlCache`'s persistent
+ * tier. Every method may be sync or async; keys are FULL (prefixed) cache
+ * keys, values are JSON-serialized `TtlCacheEntry` payloads. The shape is
+ * structurally compatible with `window.sessionStorage` / `localStorage`, and
+ * `chrome.storage.local` wraps in a few lines. Adapter failures are always
+ * swallowed by the cache — the memo tier is the source of truth.
+ */
+export interface TtlCacheStorage {
+    /**
+     * Read the raw serialized entry for a key. Return `null` or `undefined`
+     * for a miss (`null` is accepted so Web Storage objects satisfy the shape
+     * directly); a rejection or throw is treated as a miss.
+     */
+    getItem(key: string): Promise<string | null | undefined> | string | null | undefined;
+    /**
+     * Optional enumeration of every key currently in the backing store. When
+     * present, wildcard operations (`getAll` / `deleteAll` / `clear`) cover
+     * entries written by previous sessions; without it they cover only the
+     * keys currently in the memo tier.
+     */
+    keys?(): Promise<string[]> | string[];
+    /**
+     * Remove one key. Failures are swallowed (best-effort removal).
+     */
+    removeItem(key: string): Promise<void> | void;
+    /**
+     * Persist the raw serialized entry. Failures are swallowed — the memo tier
+     * remains the source of truth.
+     */
+    setItem(key: string, value: string): Promise<void> | void;
+}

package/dist/checks/primordials-defaults.d.ts

@@ -1,15 +1,15 @@
 /**
  * @file GENERATED — do not edit by hand. Run `node
- *   scripts/post-build/make-primordials-defaults.mts` (also runs as part of
- *   `pnpm run build`) to regenerate from the `globals` npm package's
+ *   scripts/repo/post-build/make-primordials-defaults.mts` (also runs as part
+ *   of `pnpm run build`) to regenerate from the `globals` npm package's
  *   globals.json crossed against src/primordials/*.ts `Ctor` exports. Source:
  *   globals@<bumped via taze>, env = builtin ∪ node. Filter: identifiers
  *   socket-lib exports as `<name>Ctor`.
  */
 /**
- * Fleet-canonical alias map: socket-lib mirrors standard JS + Node globals with
- * a `Ctor` suffix. Downstream repos that destructure raw `primordials` use this
- * map to resolve the source-side name to socket-lib's export.
+ * Socket-canonical alias map: socket-lib mirrors standard JS + Node globals
+ * with a `Ctor` suffix. Downstream repos that destructure raw `primordials` use
+ * this map to resolve the source-side name to socket-lib's export.
  */
 export declare const DEFAULT_ALIAS_MAP: Readonly<Record<string, string>>;
 /**

package/dist/checks/primordials-defaults.js

@@ -6,16 +6,16 @@ const require_primordials_object = require('../primordials/object.js');
 //#region src/checks/primordials-defaults.ts
 /**
 * @file GENERATED — do not edit by hand. Run `node
-*   scripts/post-build/make-primordials-defaults.mts` (also runs as part of
-*   `pnpm run build`) to regenerate from the `globals` npm package's
+*   scripts/repo/post-build/make-primordials-defaults.mts` (also runs as part
+*   of `pnpm run build`) to regenerate from the `globals` npm package's
 *   globals.json crossed against src/primordials/*.ts `Ctor` exports. Source:
 *   globals@<bumped via taze>, env = builtin ∪ node. Filter: identifiers
 *   socket-lib exports as `<name>Ctor`.
 */
 /**
-* Fleet-canonical alias map: socket-lib mirrors standard JS + Node globals with
-* a `Ctor` suffix. Downstream repos that destructure raw `primordials` use this
-* map to resolve the source-side name to socket-lib's export.
+* Socket-canonical alias map: socket-lib mirrors standard JS + Node globals
+* with a `Ctor` suffix. Downstream repos that destructure raw `primordials` use
+* this map to resolve the source-side name to socket-lib's export.
 */
 const DEFAULT_ALIAS_MAP = require_primordials_object.ObjectFreeze({
 	__proto__: null,

package/dist/checks/primordials.d.ts

@@ -1,5 +1,5 @@
 /**
- * @file Primordials drift check — generic core. Each fleet repo that
+ * @file Primordials drift check — generic core. Each Socket repo that
  *   destructures from Node's internal `primordials` global needs to keep its
  *   usage shape-aligned with socket-lib's userland mirror
  *   (`@socketsecurity/lib/primordials`). This module is the parser + diff

package/dist/checks/primordials.js

@@ -10,7 +10,7 @@ node_path = require_runtime.__toESM(node_path);
 
 //#region src/checks/primordials.ts
 /**
-* @file Primordials drift check — generic core. Each fleet repo that
+* @file Primordials drift check — generic core. Each Socket repo that
 *   destructures from Node's internal `primordials` global needs to keep its
 *   usage shape-aligned with socket-lib's userland mirror
 *   (`@socketsecurity/lib/primordials`). This module is the parser + diff
@@ -65,11 +65,13 @@ function checkPrimordials(config) {
 	}
 	const socketLibNames = readSocketLibPrimordialNames(resolveSocketLibPrimordials(config));
 	const findings = [];
-	for (const name of [...used].toSorted()) {
+	const usedNames = [...used].toSorted();
+	for (let i = 0, { length } = usedNames; i < length; i += 1) {
+		const name = usedNames[i];
 		if (config.nodeInternalOnly.has(name)) continue;
 		if (socketLibNames.has(name)) continue;
 		const aliased = config.aliasMap.get(name);
-		/* c8 ignore start */
+		/* c8 ignore start - usedToFiles fallback is unreachable by construction */
 		if (aliased) {
 			if (socketLibNames.has(aliased)) continue;
 			findings.push({
@@ -140,12 +142,15 @@ function extractPrimordialsNames(src) {
 	const re = /const\s*\{\s*([^}]*?)\}\s*=\s*primordials\b/g;
 	const out = [];
 	let m;
-	while ((m = re.exec(cleaned)) !== null) for (const raw of m[1].split(",")) {
-		const trimmed = raw.trim();
-		if (!trimmed) continue;
-		const nameMatch = NAME_HEAD_RE.exec(trimmed);
-		/* c8 ignore start */
-		if (nameMatch) out.push(nameMatch[1]);
+	while ((m = re.exec(cleaned)) !== null) {
+		const rawNames = m[1].split(",");
+		for (let i = 0, { length } = rawNames; i < length; i += 1) {
+			const trimmed = rawNames[i].trim();
+			if (!trimmed) continue;
+			const nameMatch = NAME_HEAD_RE.exec(trimmed);
+			/* c8 ignore start - malformed export-list segments aren't tested */
+			if (nameMatch) out.push(nameMatch[1]);
+		}
 	}
 	return out;
 }
@@ -159,12 +164,15 @@ function extractTsExports(src) {
 	const out = /* @__PURE__ */ new Set();
 	for (const m of src.matchAll(/^export\s+(?:declare\s+)?const\s+([A-Za-z_$][A-Za-z0-9_$]*)/gm)) out.add(m[1]);
 	for (const m of src.matchAll(/^export\s+(?:declare\s+)?function\s+([A-Za-z_$][A-Za-z0-9_$]*)/gm)) out.add(m[1]);
-	for (const m of src.matchAll(/^export\s*\{\s*([^}]+)\}/gm)) for (const raw of m[1].split(",")) {
-		const trimmed = raw.trim();
-		if (!trimmed) continue;
-		const nameMatch = NAME_HEAD_RE.exec(trimmed);
-		/* c8 ignore start */
-		if (nameMatch) out.add(nameMatch[1]);
+	for (const m of src.matchAll(/^export\s*\{\s*([^}]+)\}/gm)) {
+		const rawNames = m[1].split(",");
+		for (let i = 0, { length } = rawNames; i < length; i += 1) {
+			const trimmed = rawNames[i].trim();
+			if (!trimmed) continue;
+			const nameMatch = NAME_HEAD_RE.exec(trimmed);
+			/* c8 ignore start - malformed export-list segments aren't tested */
+			if (nameMatch) out.add(nameMatch[1]);
+		}
 	}
 	return [...out];
 }
@@ -176,7 +184,7 @@ function extractTsExports(src) {
 function readSocketLibPrimordialNames(resolved) {
 	if ((0, node_fs.statSync)(resolved).isFile()) return new Set(extractTsExports((0, node_fs.readFileSync)(resolved, "utf8")));
 	const out = /* @__PURE__ */ new Set();
-	/* c8 ignore start */
+	/* c8 ignore start - leaf-classification branches aren't tested separately */
 	for (const name of (0, node_fs.readdirSync)(resolved)) {
 		if (!name.endsWith(".ts") && !name.endsWith(".d.ts")) continue;
 		const full = node_path.default.join(resolved, name);
@@ -203,7 +211,7 @@ function readSocketLibPrimordialNames(resolved) {
 * Throws when none of the candidates exist.
 */
 function resolveSocketLibPrimordials(config) {
-	/* c8 ignore start */
+	/* c8 ignore start - resolver branch needs dedicated test setup per candidate */
 	if (config.socketLibPrimordialsPath) {
 		if (!(0, node_fs.existsSync)(config.socketLibPrimordialsPath)) throw new require_primordials_error.ErrorCtor(`socketLibPrimordialsPath does not exist: ${config.socketLibPrimordialsPath}`);
 		return config.socketLibPrimordialsPath;

package/dist/cli/check-primordials.d.ts

@@ -10,6 +10,7 @@
  *   error)
  */
 import type { PrimordialsCheckConfig, PrimordialsCheckResult, PrimordialsFinding } from '../checks/primordials';
+export declare const FALLBACK_CONFIG_PATHS: readonly string[];
 export interface ParsedArgs {
     readonly config: string | undefined;
     readonly json: boolean;
@@ -39,8 +40,12 @@ export declare function renderHuman(result: PrimordialsCheckResult, args: Parsed
  * they typed). Otherwise probes the fallback list in order and returns the
  * first hit. Returns the head of the list when none exist, so the caller's
  * "config file not found" error message names the canonical default.
+ *
+ * `baseDir` is the directory the relative candidates resolve against; it
+ * defaults to `process.cwd()` (the repo root the user runs from) and is a
+ * parameter so callers/tests can probe a fixture tree without `process.chdir`.
  */
-export declare function resolveConfigPath(explicit: string | undefined): string;
+export declare function resolveConfigPath(explicit: string | undefined, baseDir?: string): string;
 export declare function runCheckPrimordials(argv: readonly string[]): Promise<number>;
 export declare function serialize(result: PrimordialsCheckResult): {
     ok: boolean;

package/dist/cli/check-primordials.js

@@ -32,7 +32,11 @@ node_path = require_runtime.__toESM(node_path);
 */
 const logger = require_logger_default.getDefaultLogger();
 const DEFAULT_CONFIG_PATH = ".socket-lib.json";
-const FALLBACK_CONFIG_PATHS = [".socket-lib.json", ".config/socket-lib.json"];
+const FALLBACK_CONFIG_PATHS = [
+	".socket-lib.json",
+	".config/socket-lib.json",
+	".config/repo/socket-lib.json"
+];
 const CONFIG_SECTION = "primordials";
 function loadConfig(configPath) {
 	if (!(0, node_fs.existsSync)(configPath)) throw new require_primordials_error.ErrorCtor(`config file not found: ${configPath}`);
@@ -96,7 +100,7 @@ function printHelp() {
 	logger.log("");
 	logger.log("Options:");
 	logger.log(`  --config, -c <path>   Config file. Default: ${DEFAULT_CONFIG_PATH}`);
-	logger.log(`                        (falls back to .config/socket-lib.json)`);
+	logger.log(`                        (falls back to .config/socket-lib.json, then .config/repo/socket-lib.json)`);
 	logger.log("  --explain             Print one detailed line per finding.");
 	logger.log("  --json                Machine-readable JSON output.");
 	logger.log("  --silent              Silent on success.");
@@ -110,7 +114,7 @@ function printHelp() {
 	logger.log("  }");
 	logger.log("");
 	logger.log("Only `scanDirs` is required. `aliasMap` and `nodeInternalOnly`");
-	logger.log("default to the fleet-canonical sets and only need entries when");
+	logger.log("default to the Socket-canonical sets and only need entries when");
 	logger.log("your repo extends or overrides them.");
 	logger.log("");
 	logger.log("A bare object (no `primordials` section) is also accepted for");
@@ -140,12 +144,16 @@ function renderHuman(result, args) {
 * they typed). Otherwise probes the fallback list in order and returns the
 * first hit. Returns the head of the list when none exist, so the caller's
 * "config file not found" error message names the canonical default.
+*
+* `baseDir` is the directory the relative candidates resolve against; it
+* defaults to `process.cwd()` (the repo root the user runs from) and is a
+* parameter so callers/tests can probe a fixture tree without `process.chdir`.
 */
-function resolveConfigPath(explicit) {
+function resolveConfigPath(explicit, baseDir = node_process.default.cwd()) {
 	if (explicit !== void 0) return explicit;
 	for (let i = 0, { length } = FALLBACK_CONFIG_PATHS; i < length; i += 1) {
 		const candidate = FALLBACK_CONFIG_PATHS[i];
-		if ((0, node_fs.existsSync)(node_path.default.resolve(candidate))) return candidate;
+		if ((0, node_fs.existsSync)(node_path.default.resolve(baseDir, candidate))) return candidate;
 	}
 	return FALLBACK_CONFIG_PATHS[0];
 }
@@ -187,6 +195,7 @@ function serialize(result) {
 }
 
 //#endregion
+exports.FALLBACK_CONFIG_PATHS = FALLBACK_CONFIG_PATHS;
 exports.loadConfig = loadConfig;
 exports.parseArgs = parseArgs;
 exports.printHelp = printHelp;

package/dist/cli/check.js

@@ -18,7 +18,7 @@ const logger = require_logger_default.getDefaultLogger();
 const CHECKS = new require_primordials_map_set.MapCtor([["primordials", "primordials"], ["prim", "primordials"]]);
 const ALIASES = new require_primordials_map_set.MapCtor([["primordials", ["prim"]]]);
 function printHelp() {
-	logger.log("socket-lib check — fleet-wide static-analysis checks");
+	logger.log("socket-lib check — Socket-wide static-analysis checks");
 	logger.log("");
 	logger.log("Usage:");
 	logger.log("  socket-lib check <name> [...opts]");

package/dist/cli/socket-lib.d.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 /**
  * @file `socket-lib` CLI entry point — top-level dispatcher. socket-lib — print
- *   help, list commands socket-lib check <name> [opts...] — run a fleet-wide
+ *   help, list commands socket-lib check <name> [opts...] — run a Socket-wide
  *   check Subcommands live as siblings under `src/cli/`; each is its own file
  *   so a misbehaving check can't crash other commands at parse time. The
  *   dispatcher just routes; subcommands own their own arg parsing. The CLI is

package/dist/cli/socket-lib.js

@@ -11,7 +11,7 @@ node_process = require_runtime.__toESM(node_process);
 //#region src/cli/socket-lib.ts
 /**
 * @file `socket-lib` CLI entry point — top-level dispatcher. socket-lib — print
-*   help, list commands socket-lib check <name> [opts...] — run a fleet-wide
+*   help, list commands socket-lib check <name> [opts...] — run a Socket-wide
 *   check Subcommands live as siblings under `src/cli/`; each is its own file
 *   so a misbehaving check can't crash other commands at parse time. The
 *   dispatcher just routes; subcommands own their own arg parsing. The CLI is
@@ -21,13 +21,13 @@ node_process = require_runtime.__toESM(node_process);
 */
 const logger = require_logger_default.getDefaultLogger();
 function printHelp() {
-	logger.log("socket-lib — fleet-wide static-analysis CLI");
+	logger.log("socket-lib — Socket-wide static-analysis CLI");
 	logger.log("");
 	logger.log("Usage:");
 	logger.log("  socket-lib <command> [...args]");
 	logger.log("");
 	logger.log("Commands:");
-	logger.log("  check <name>   Run a fleet-wide check (primordials, ...).");
+	logger.log("  check <name>   Run a Socket-wide check (primordials, ...).");
 	logger.log("");
 	logger.log("Run `socket-lib check --help` for the list of checks.");
 }

package/dist/colors/socket-palette.d.ts

@@ -1,6 +1,6 @@
 /**
  * @file Socket terminal-color palette — mirrors the CSS design tokens defined
- *   in the fleet's `template/styles/tokens.css` (light / dark / synthwave
+ *   in Socket's `template/styles/tokens.css` (light / dark / synthwave
  *   themes). Each helper returns the input string wrapped in a 24-bit ANSI
  *   escape sequence so the rendered hex matches the brand exactly; no rounding
  *   to the legacy 8-color palette. Picocolors / yoctocolors only ship a fixed

package/dist/compression/brotli.d.ts

@@ -37,11 +37,13 @@ export declare function compressBrotliFile(srcPath: string, options: CompressFil
  * The `pipeline` from `node:stream/promises` is the safe way to wire it up — it
  * handles error propagation across all stages.
  */
-export declare function createBrotliCompressor(options?: CompressOptions | undefined): import("zlib").BrotliCompress;
+export declare function createBrotliCompressor(options?: CompressOptions | undefined): import("node:zlib").BrotliCompress;
 /**
  * Create a brotli decompress transform stream.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
-export declare function createBrotliDecompressor(): import("zlib").BrotliDecompress;
+export declare function createBrotliDecompressor(): import("node:zlib").BrotliDecompress;
 /**
  * Decompress a brotli-compressed Buffer.
  */
@@ -70,6 +72,8 @@ export declare function hasBrotliExt(filePath: string): boolean;
  * false for inputs too short to be valid. Brotli has no fixed magic bytes, so
  * this is intentionally permissive — the authoritative test is
  * `decompressBrotli(buf)` succeeding. Use for UI hints, not correctness.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare function isBrotliCompressed(input: Buffer): boolean;
 /**

package/dist/compression/brotli.js

@@ -4,8 +4,8 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_primordials_buffer = require('../primordials/buffer.js');
 const require_primordials_error = require('../primordials/error.js');
-const require_primordials_map_set = require('../primordials/map-set.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_primordials_map_set = require('../primordials/map-set.js');
 const require_fs_safe = require('../fs/safe.js');
 const require_compression__internal = require('./_internal.js');
 let node_fs = require("node:fs");
@@ -46,6 +46,8 @@ function createBrotliCompressor(options) {
 }
 /**
 * Create a brotli decompress transform stream.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function createBrotliDecompressor() {
 	return (0, node_zlib.createBrotliDecompress)();
@@ -77,6 +79,8 @@ function hasBrotliExt(filePath) {
 * false for inputs too short to be valid. Brotli has no fixed magic bytes, so
 * this is intentionally permissive — the authoritative test is
 * `decompressBrotli(buf)` succeeding. Use for UI hints, not correctness.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function isBrotliCompressed(input) {
 	return require_primordials_buffer.BufferIsBuffer(input) && input.byteLength >= BROTLI_MIN_LEN;

package/dist/compression/gzip.d.ts

@@ -30,11 +30,13 @@ export declare function compressGzipFile(srcPath: string, options: CompressFileO
 /**
  * Create a gzip compress transform stream.
  */
-export declare function createGzipCompressor(options?: CompressOptions | undefined): import("zlib").Gzip;
+export declare function createGzipCompressor(options?: CompressOptions | undefined): import("node:zlib").Gzip;
 /**
  * Create a gzip decompress transform stream.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
-export declare function createGzipDecompressor(): import("zlib").Gunzip;
+export declare function createGzipDecompressor(): import("node:zlib").Gunzip;
 /**
  * Decompress a gzip-compressed Buffer.
  */
@@ -59,6 +61,8 @@ export declare function hasGzipExt(filePath: string): boolean;
 /**
  * Magic-byte check for gzip. Reads the first two bytes and matches the gzip
  * spec's 0x1f 0x8b signature. Authoritative.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare function isGzipCompressed(input: Buffer): boolean;
 /**

package/dist/compression/gzip.js

@@ -4,8 +4,8 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_primordials_buffer = require('../primordials/buffer.js');
 const require_primordials_error = require('../primordials/error.js');
-const require_primordials_map_set = require('../primordials/map-set.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_primordials_map_set = require('../primordials/map-set.js');
 const require_fs_safe = require('../fs/safe.js');
 const require_compression__internal = require('./_internal.js');
 let node_fs = require("node:fs");
@@ -30,7 +30,8 @@ const GZIP_EXTS = new require_primordials_map_set.SetCtor([
 * compression. Default level is 6 (zlib default).
 */
 async function compressGzip(input, options) {
-	return await gzipAsync(typeof input === "string" ? require_primordials_buffer.BufferFrom(input, "utf8") : input, resolveGzipOptions(options));
+	const buf = typeof input === "string" ? require_primordials_buffer.BufferFrom(input, "utf8") : input;
+	return await gzipAsync(buf, resolveGzipOptions(options));
 }
 async function compressGzipFile(srcPath, destOrOptions, maybeOptions) {
 	const { destPath, options, inPlace } = require_compression__internal.resolveFileArgs("compressGzipFile", srcPath, destOrOptions, maybeOptions, (p) => `${p}.gz`);
@@ -46,6 +47,8 @@ function createGzipCompressor(options) {
 }
 /**
 * Create a gzip decompress transform stream.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function createGzipDecompressor() {
 	return (0, node_zlib.createGunzip)();
@@ -76,6 +79,8 @@ function hasGzipExt(filePath) {
 /**
 * Magic-byte check for gzip. Reads the first two bytes and matches the gzip
 * spec's 0x1f 0x8b signature. Authoritative.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function isGzipCompressed(input) {
 	return require_primordials_buffer.BufferIsBuffer(input) && input.byteLength >= 2 && input[0] === GZIP_MAGIC_0 && input[1] === GZIP_MAGIC_1;

package/dist/config/layers.d.ts

@@ -0,0 +1,53 @@
+/**
+ * @file Read a layered config — a base config that higher layers may override
+ *   or extend. Generic over the layer directories, the base name, and the file
+ *   extension: `readConfigLayers('vitest', { dirs: ['.config/base',
+ *   '.config/local'] })` reads each `<dir>/vitest.json` in precedence order and
+ *   returns the layers that exist. Callers apply their own merge, because merge
+ *   policy varies (a denylist unions all layers; an allowlist takes the highest
+ *   layer that declares one; an array key concatenates). `mergeConfigArray`
+ *   covers the concat case across any number of layers. No Socket-specific
+ *   knowledge lives here — the Socket-convention `.config/fleet` +
+ *   `.config/repo` wrapper is `fleet/repo-config`'s `resolveRepoConfig`, a thin
+ *   layer over this reader.
+ */
+export interface ReadConfigLayersOptions {
+    dirs: readonly string[];
+    rootDir?: string | undefined;
+    cwd?: string | undefined;
+    ext?: string | undefined;
+}
+/**
+ * Concatenate one array-valued key across all layers — the common merge for a
+ * list that higher layers EXTEND rather than replace (e.g. extra exclude
+ * globs). Layers contribute in precedence order; a non-array value for the key
+ * (or a missing key, or an `undefined` layer) contributes nothing.
+ *
+ * @param layers - The layers from `readConfigLayers` (or any object array).
+ * @param key - The array-valued property to concatenate.
+ *
+ * @returns Each layer's entries in order; `[]` when no layer has the array.
+ */
+export declare function mergeConfigArray<T extends Record<string, unknown>, K extends keyof T>(layers: ReadonlyArray<T | undefined>, key: K): Array<T[K] extends Array<infer E> ? E : never>;
+/**
+ * Read a named config from an ordered list of layer directories.
+ *
+ * For each dir in `dirs`, reads `<rootDir>/<dir>/<name><ext>`; layers that are
+ * absent or unparseable are skipped (never throws — config reads are
+ * best-effort). The returned array preserves `dirs` order (lowest precedence
+ * first), so the last element is the highest-precedence layer present.
+ *
+ * @example
+ *   ;```typescript
+ *   const layers = readConfigLayers<VitestConfig>('vitest', {
+ *     dirs: ['.config/base', '.config/team', '.config/local'],
+ *   })
+ *   // layers === every one of those that existed, in that order
+ *   ```
+ *
+ * @param name - Base name of the config file (no directory, no extension).
+ * @param options - Layer dirs + resolution options.
+ *
+ * @returns Parsed layers in precedence order; empty when none exist.
+ */
+export declare function readConfigLayers<T = unknown>(name: string, options: ReadConfigLayersOptions): T[];