@socketsecurity/lib 6.0.8 → 6.0.10

package/dist/config/layers.js

@@ -0,0 +1,83 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_node_path = require('../node/path.js');
+const require_fs_read_json = require('../fs/read-json.js');
+const require_primordials_process = require('../primordials/process.js');
+const require_git_repo = require('../git/repo.js');
+
+//#region src/config/layers.ts
+/**
+* @file Read a layered config — a base config that higher layers may override
+*   or extend. Generic over the layer directories, the base name, and the file
+*   extension: `readConfigLayers('vitest', { dirs: ['.config/base',
+*   '.config/local'] })` reads each `<dir>/vitest.json` in precedence order and
+*   returns the layers that exist. Callers apply their own merge, because merge
+*   policy varies (a denylist unions all layers; an allowlist takes the highest
+*   layer that declares one; an array key concatenates). `mergeConfigArray`
+*   covers the concat case across any number of layers. No Socket-specific
+*   knowledge lives here — the Socket-convention `.config/fleet` +
+*   `.config/repo` wrapper is `fleet/repo-config`'s `resolveRepoConfig`, a thin
+*   layer over this reader.
+*/
+/**
+* Concatenate one array-valued key across all layers — the common merge for a
+* list that higher layers EXTEND rather than replace (e.g. extra exclude
+* globs). Layers contribute in precedence order; a non-array value for the key
+* (or a missing key, or an `undefined` layer) contributes nothing.
+*
+* @param layers - The layers from `readConfigLayers` (or any object array).
+* @param key - The array-valued property to concatenate.
+*
+* @returns Each layer's entries in order; `[]` when no layer has the array.
+*/
+function mergeConfigArray(layers, key) {
+	const out = [];
+	for (let i = 0, { length } = layers; i < length; i += 1) {
+		const value = layers[i]?.[key];
+		if (Array.isArray(value)) out.push(...value);
+	}
+	return out;
+}
+/**
+* Read a named config from an ordered list of layer directories.
+*
+* For each dir in `dirs`, reads `<rootDir>/<dir>/<name><ext>`; layers that are
+* absent or unparseable are skipped (never throws — config reads are
+* best-effort). The returned array preserves `dirs` order (lowest precedence
+* first), so the last element is the highest-precedence layer present.
+*
+* @example
+*   ;```typescript
+*   const layers = readConfigLayers<VitestConfig>('vitest', {
+*     dirs: ['.config/base', '.config/team', '.config/local'],
+*   })
+*   // layers === every one of those that existed, in that order
+*   ```
+*
+* @param name - Base name of the config file (no directory, no extension).
+* @param options - Layer dirs + resolution options.
+*
+* @returns Parsed layers in precedence order; empty when none exist.
+*/
+function readConfigLayers(name, options) {
+	const opts = {
+		__proto__: null,
+		...options
+	};
+	const path = require_node_path.getNodePath();
+	const cwd = opts.cwd ?? require_primordials_process.processCwd();
+	const rootDir = opts.rootDir ?? require_git_repo.findGitRoot(cwd);
+	const file = `${name}${opts.ext ?? ".json"}`;
+	const layers = [];
+	const { dirs } = opts;
+	for (let i = 0, { length } = dirs; i < length; i += 1) {
+		const value = require_fs_read_json.readJsonSync(path.join(rootDir, dirs[i], file), { throws: false });
+		if (value !== void 0) layers.push(value);
+	}
+	return layers;
+}
+
+//#endregion
+exports.mergeConfigArray = mergeConfigArray;
+exports.readConfigLayers = readConfigLayers;

package/dist/constants/agents.d.ts

@@ -17,6 +17,9 @@ export declare const NPM_REGISTRY_URL = "https://registry.npmjs.org";
 export declare const YARN_BERRY = "yarn/berry";
 export declare const YARN_CLASSIC = "yarn/classic";
 export declare const ZPM = "zpm";
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const PACKAGE_LOCK = "package-lock";
 export declare const PACKAGE_LOCK_JSON = "package-lock.json";
 export declare const NPM_SHRINKWRAP_JSON = "npm-shrinkwrap.json";

package/dist/constants/agents.js

@@ -51,6 +51,9 @@ const NPM_REGISTRY_URL = "https://registry.npmjs.org";
 const YARN_BERRY = "yarn/berry";
 const YARN_CLASSIC = "yarn/classic";
 const ZPM = "zpm";
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const PACKAGE_LOCK = "package-lock";
 const PACKAGE_LOCK_JSON = "package-lock.json";
 const NPM_SHRINKWRAP_JSON = "npm-shrinkwrap.json";

package/dist/constants/node.d.ts

@@ -61,6 +61,8 @@ export declare function getNodeNoWarningsFlags(): string[];
  * Get the patch component of the current Node.js version.
  *
  * @returns The patch version number, or `0` if it cannot be parsed.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare function getNodePatchVersion(): number;
 /**
@@ -83,6 +85,8 @@ export declare function getNodeVersion(): string;
  * API. The API is available on Node.js 24+.
  *
  * @returns `true` when the current runtime is Node.js 24 or newer.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare function supportsNodeCompileCacheApi(): boolean;
 /**
@@ -90,6 +94,8 @@ export declare function supportsNodeCompileCacheApi(): boolean;
  * Env-var-based compile caching is available on Node.js 22+.
  *
  * @returns `true` when the current runtime is Node.js 22 or newer.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare function supportsNodeCompileCacheEnvVar(): boolean;
 /**
@@ -105,6 +111,8 @@ export declare function supportsNodeDisableSigusr1Flag(): boolean;
  * The flag is available on Node.js 21+.
  *
  * @returns `true` when the current runtime is Node.js 21 or newer.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare function supportsNodeDisableWarningFlag(): boolean;
 /**
@@ -112,6 +120,8 @@ export declare function supportsNodeDisableWarningFlag(): boolean;
  * (`--experimental-permission` on Node 20-23, `--permission` on Node 24+).
  *
  * @returns `true` when the current runtime is Node.js 20 or newer.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare function supportsNodePermissionFlag(): boolean;
 /**
@@ -119,6 +129,8 @@ export declare function supportsNodePermissionFlag(): boolean;
  * Node.js 22.12+ or Node.js 23+.
  *
  * @returns `true` when the runtime supports `require()`-ing ES modules.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare function supportsNodeRequireModule(): boolean;
 /**
@@ -157,6 +169,8 @@ export declare function supportsNodeStripTypesDefault(): boolean;
  * `process.send()` is callable to message the parent process.
  *
  * @returns `true` when the current process has an IPC channel to its parent.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare function supportsProcessSend(): boolean;
 export declare const ESNEXT = "esnext";

package/dist/constants/node.js

@@ -106,6 +106,8 @@ function getNodeNoWarningsFlags() {
 * Get the patch component of the current Node.js version.
 *
 * @returns The patch version number, or `0` if it cannot be parsed.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function getNodePatchVersion() {
 	/* c8 ignore start */
@@ -142,6 +144,8 @@ function getNodeVersion() {
 * API. The API is available on Node.js 24+.
 *
 * @returns `true` when the current runtime is Node.js 24 or newer.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function supportsNodeCompileCacheApi() {
 	return getNodeMajorVersion() >= 24;
@@ -151,6 +155,8 @@ function supportsNodeCompileCacheApi() {
 * Env-var-based compile caching is available on Node.js 22+.
 *
 * @returns `true` when the current runtime is Node.js 22 or newer.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function supportsNodeCompileCacheEnvVar() {
 	return getNodeMajorVersion() >= 22;
@@ -180,6 +186,8 @@ function supportsNodeDisableSigusr1Flag() {
 * The flag is available on Node.js 21+.
 *
 * @returns `true` when the current runtime is Node.js 21 or newer.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function supportsNodeDisableWarningFlag() {
 	return getNodeMajorVersion() >= 21;
@@ -189,6 +197,8 @@ function supportsNodeDisableWarningFlag() {
 * (`--experimental-permission` on Node 20-23, `--permission` on Node 24+).
 *
 * @returns `true` when the current runtime is Node.js 20 or newer.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function supportsNodePermissionFlag() {
 	return getNodeMajorVersion() >= 20;
@@ -198,6 +208,8 @@ function supportsNodePermissionFlag() {
 * Node.js 22.12+ or Node.js 23+.
 *
 * @returns `true` when the runtime supports `require()`-ing ES modules.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function supportsNodeRequireModule() {
 	const major = getNodeMajorVersion();
@@ -253,6 +265,8 @@ function supportsNodeStripTypesDefault() {
 * `process.send()` is callable to message the parent process.
 *
 * @returns `true` when the current process has an IPC channel to its parent.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function supportsProcessSend() {
 	return typeof node_process.default.send === "function";

package/dist/constants/package-default-node-range.js

@@ -1,17 +1,13 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_constants_maintained_node_versions = require('./maintained-node-versions.js');
-let src_external_semver = require("../external/semver");
-src_external_semver = require_runtime.__toESM(src_external_semver);
 
 //#region src/constants/package-default-node-range.ts
 /**
 * @file Default Node.js version range for packages.
 */
-/* c8 ignore next - External semver call */
-const packageDefaultNodeRange = `>=${src_external_semver.parse(require_constants_maintained_node_versions.maintainedNodeVersions.last).major}`;
+const packageDefaultNodeRange = `>=${Number.parseInt(require_constants_maintained_node_versions.maintainedNodeVersions.last, 10)}`;
 
 //#endregion
 exports.packageDefaultNodeRange = packageDefaultNodeRange;

package/dist/constants/packages.d.ts

@@ -11,8 +11,13 @@ export declare const PACKAGE_DEFAULT_VERSION = "1.0.0";
 /**
  * Clear the packument cache. Useful for long-running processes that want to
  * force a re-fetch of registry metadata.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare function clearPackumentCache(): void;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function getLifecycleScriptNames(): string[];
 export declare function getPackageDefaultNodeRange(): string | undefined;
 export declare function getPackageDefaultSocketCategories(): readonly string[];

package/dist/constants/packages.js

@@ -33,11 +33,16 @@ const PACKAGE_DEFAULT_VERSION = "1.0.0";
 /**
 * Clear the packument cache. Useful for long-running processes that want to
 * force a re-fetch of registry metadata.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function clearPackumentCache() {
 	/* c8 ignore next 3 - uninitialized-cache branch unreachable in tests */
 	if (cachedPackumentCache !== void 0) cachedPackumentCache.clear();
 }
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 function getLifecycleScriptNames() {
 	if (cachedLifecycleScriptNames === void 0) cachedLifecycleScriptNames = require_primordials_array.ArrayFrom(require_constants_lifecycle_script_names.lifecycleScriptNames);
 	return cachedLifecycleScriptNames;

package/dist/constants/platform.d.ts

@@ -34,7 +34,7 @@ export declare function getOs(): Platform;
  * Get the current host **target** in the pnpm `pack-app` vocabulary (memoized):
  * `<os>-<arch>[-<libc>]`, e.g. `darwin-arm64`, `linux-x64`, `win32-x64`,
  * `linux-x64-musl`. Raw Node `process.platform`/`process.arch` joined with `-`,
- * plus a `-musl` suffix on Alpine. This is the fleet-general naming for
+ * plus a `-musl` suffix on Alpine. This is the Socket-wide naming for
  * non-python / non-JRE tools (matches pnpm's release assets,
  * `pnpm-<os>-<arch>[-<libc>].{tar.gz,zip}`). Tool-specific resolvers that need
  * a different vocabulary own their own helper — see `getPythonArch`

package/dist/constants/platform.js

@@ -60,7 +60,7 @@ let memoizedTarget;
 * Get the current host **target** in the pnpm `pack-app` vocabulary (memoized):
 * `<os>-<arch>[-<libc>]`, e.g. `darwin-arm64`, `linux-x64`, `win32-x64`,
 * `linux-x64-musl`. Raw Node `process.platform`/`process.arch` joined with `-`,
-* plus a `-musl` suffix on Alpine. This is the fleet-general naming for
+* plus a `-musl` suffix on Alpine. This is the Socket-wide naming for
 * non-python / non-JRE tools (matches pnpm's release assets,
 * `pnpm-<os>-<arch>[-<libc>].{tar.gz,zip}`). Tool-specific resolvers that need
 * a different vocabulary own their own helper — see `getPythonArch`

package/dist/constants/socket.js

@@ -35,7 +35,7 @@ const SOCKET_DIR = {
 	wheelhouse: `${"_"}wheelhouse`
 };
 const SOCKET_LIB_NAME = "@socketsecurity/lib";
-const SOCKET_LIB_VERSION = "6.0.8";
+const SOCKET_LIB_VERSION = "6.0.10";
 const SOCKET_IPC_HANDSHAKE = "SOCKET_IPC_HANDSHAKE";
 const CACHE_SOCKET_API_DIR = "socket-api";
 const REGISTRY = "registry";

package/dist/constants/typescript.d.ts

@@ -8,6 +8,11 @@
  * project by probing `typescript/lib`.
  *
  * @returns `true` when the `typescript` package's libs can be resolved.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare function getTsLibsAvailable(): boolean;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function getTsTypesAvailable(): boolean;

package/dist/constants/typescript.js

@@ -13,6 +13,8 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 * project by probing `typescript/lib`.
 *
 * @returns `true` when the `typescript` package's libs can be resolved.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function getTsLibsAvailable() {
 	try {
@@ -22,6 +24,9 @@ function getTsLibsAvailable() {
 		return false;
 	}
 }
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 function getTsTypesAvailable() {
 	try {
 		require.resolve("typescript/lib/lib.d.ts");

package/dist/debug/_internal.d.ts

@@ -1,12 +1,18 @@
 /**
- * @file Private internals for `debug/*` modules — the cached logger instance,
- *   lazy `node:util` accessor, the `debugByNamespace` cache that
- *   `namespace.getDebugJsInstance` fills, the lazy `pointingTriangle` glyph
- *   used by every output function, and `customLog` (the `debug-js` log-writer
- *   override). Co-located so the namespace / output / caller-info leaves don't
- *   fragment ownership of this shared module state.
+ * @file Private internals for `debug/*` modules — the lazy debug-js accessor,
+ *   the `debugByNamespace` cache that `namespace.getDebugJsInstance` fills,
+ *   the lazy `pointingTriangle` glyph used by every output function, and
+ *   `customLog` (the `debug-js` log-writer override). Node-bound pieces are
+ *   deferred to first use — the vendored debug-js bundle is required lazily
+ *   (its module top-level reads env / requires tty), the default `Logger` is
+ *   constructed per call via the already-lazy `getDefaultLogger`, and
+ *   `node:util` loads through the `getNodeUtil` accessor. Every call site
+ *   sits behind the SOCKET_DEBUG / DEBUG env gates, so importing a `debug/*`
+ *   leaf stays browser-load-safe and V8-snapshot-safe. Co-located so the
+ *   namespace / output / caller-info leaves don't fragment ownership of this
+ *   shared module state.
  */
-export declare const logger: import("../logger/node").Logger;
+import type debugJs from '../external/debug';
 export declare const debugByNamespace: Map<any, any>;
 export { getNodeUtil as getUtil } from '../node/util';
 /**
@@ -15,6 +21,15 @@ export { getNodeUtil as getUtil } from '../node/util';
  * @private
  */
 export declare function customLog(...args: unknown[]): void;
+/**
+ * Lazily require the vendored `debug-js` bundle. Deferred to first use so
+ * importing a `debug/*` leaf never evaluates debug-js's node-bound module
+ * top-level (tty/util requires, process.env reads); every caller sits behind
+ * the env gates, so browser bundles load this leaf without executing it.
+ *
+ * @private
+ */
+export declare function getDebugJs(): typeof debugJs;
 /**
  * Lazily resolve the "pointing triangle" glyph — `▸` on terminals with unicode
  * support, `>` everywhere else. Initialised on first call by the output

package/dist/debug/_internal.js

@@ -8,20 +8,24 @@ const require_logger_default = require('../logger/default.js');
 const require_node_util = require('../node/util.js');
 let src_external__socketregistry_is_unicode_supported = require("../external/@socketregistry/is-unicode-supported");
 src_external__socketregistry_is_unicode_supported = require_runtime.__toESM(src_external__socketregistry_is_unicode_supported);
-let src_external_debug = require("../external/debug");
-src_external_debug = require_runtime.__toESM(src_external_debug);
 
 //#region src/debug/_internal.ts
 /**
-* @file Private internals for `debug/*` modules — the cached logger instance,
-*   lazy `node:util` accessor, the `debugByNamespace` cache that
-*   `namespace.getDebugJsInstance` fills, the lazy `pointingTriangle` glyph
-*   used by every output function, and `customLog` (the `debug-js` log-writer
-*   override). Co-located so the namespace / output / caller-info leaves don't
-*   fragment ownership of this shared module state.
+* @file Private internals for `debug/*` modules — the lazy debug-js accessor,
+*   the `debugByNamespace` cache that `namespace.getDebugJsInstance` fills,
+*   the lazy `pointingTriangle` glyph used by every output function, and
+*   `customLog` (the `debug-js` log-writer override). Node-bound pieces are
+*   deferred to first use — the vendored debug-js bundle is required lazily
+*   (its module top-level reads env / requires tty), the default `Logger` is
+*   constructed per call via the already-lazy `getDefaultLogger`, and
+*   `node:util` loads through the `getNodeUtil` accessor. Every call site
+*   sits behind the SOCKET_DEBUG / DEBUG env gates, so importing a `debug/*`
+*   leaf stays browser-load-safe and V8-snapshot-safe. Co-located so the
+*   namespace / output / caller-info leaves don't fragment ownership of this
+*   shared module state.
 */
-const logger = require_logger_default.getDefaultLogger();
 const debugByNamespace = new require_primordials_map_set.MapCtor();
+let cachedDebugJs;
 let pointingTriangle;
 /**
 * Custom log function for debug output.
@@ -34,15 +38,29 @@ set at the right module-load timing. Tests use the SOCKET_DEBUG
 path which writes via logger.info directly. */
 function customLog(...args) {
 	const util = require_node_util.getNodeUtil();
-	const inspectOpts = src_external_debug.default.inspectOpts ? {
-		...src_external_debug.default.inspectOpts,
-		showHidden: src_external_debug.default.inspectOpts.showHidden === null ? void 0 : src_external_debug.default.inspectOpts.showHidden,
-		depth: src_external_debug.default.inspectOpts.depth === null || typeof src_external_debug.default.inspectOpts.depth === "boolean" ? void 0 : src_external_debug.default.inspectOpts.depth
+	const debugJsInstance = getDebugJs();
+	const inspectOpts = debugJsInstance.inspectOpts ? {
+		...debugJsInstance.inspectOpts,
+		showHidden: debugJsInstance.inspectOpts.showHidden === null ? void 0 : debugJsInstance.inspectOpts.showHidden,
+		depth: debugJsInstance.inspectOpts.depth === null || typeof debugJsInstance.inspectOpts.depth === "boolean" ? void 0 : debugJsInstance.inspectOpts.depth
 	} : {};
+	const logger = require_logger_default.getDefaultLogger();
 	require_primordials_reflect.ReflectApply(logger.info, logger, [util.formatWithOptions(inspectOpts, ...args)]);
 }
 /* c8 ignore stop */
 /**
+* Lazily require the vendored `debug-js` bundle. Deferred to first use so
+* importing a `debug/*` leaf never evaluates debug-js's node-bound module
+* top-level (tty/util requires, process.env reads); every caller sits behind
+* the env gates, so browser bundles load this leaf without executing it.
+*
+* @private
+*/
+function getDebugJs() {
+	if (cachedDebugJs === void 0) cachedDebugJs = require("../external/debug");
+	return cachedDebugJs;
+}
+/**
 * Lazily resolve the "pointing triangle" glyph — `▸` on terminals with unicode
 * support, `>` everywhere else. Initialised on first call by the output
 * functions.
@@ -61,6 +79,6 @@ function getPointingTriangle() {
 //#endregion
 exports.customLog = customLog;
 exports.debugByNamespace = debugByNamespace;
+exports.getDebugJs = getDebugJs;
 exports.getPointingTriangle = getPointingTriangle;
-exports.getUtil = require_node_util.getNodeUtil;
-exports.logger = logger;
+exports.getUtil = require_node_util.getNodeUtil;

package/dist/debug/caller-info.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_objects_predicates = require('../objects/predicates.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_objects_predicates = require('../objects/predicates.js');
 
 //#region src/debug/caller-info.ts
 /**

package/dist/debug/namespace.js

@@ -1,13 +1,10 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_primordials_string = require('../primordials/string.js');
 const require_env_debug = require('../env/debug.js');
 const require_env_socket = require('../env/socket.js');
 const require_debug__internal = require('./_internal.js');
-let src_external_debug = require("../external/debug");
-src_external_debug = require_runtime.__toESM(src_external_debug);
 
 //#region src/debug/namespace.ts
 /**
@@ -39,12 +36,15 @@ function extractOptions(namespaces) {
 */
 function getDebugJsInstance(namespace) {
 	let inst = require_debug__internal.debugByNamespace.get(namespace);
-	/* c8 ignore start */
+	/* c8 ignore start - cache-hit arm needs a repeated same-namespace probe */
 	if (inst) return inst;
-	if (!require_env_debug.getDebug() && require_env_socket.getSocketDebug() && (namespace === "error" || namespace === "notice")) src_external_debug.default.enable(namespace);
+	/* c8 ignore stop */
+	const debugJs = require_debug__internal.getDebugJs();
+	/* c8 ignore start - error/notice auto-enable needs SOCKET_DEBUG without DEBUG */
+	if (!require_env_debug.getDebug() && require_env_socket.getSocketDebug() && (namespace === "error" || namespace === "notice")) debugJs.enable(namespace);
 	/* c8 ignore stop */
 	/* c8 ignore next - External debug library call */
-	inst = (0, src_external_debug.default)(namespace);
+	inst = debugJs(namespace);
 	inst.log = require_debug__internal.customLog;
 	require_debug__internal.debugByNamespace.set(namespace, inst);
 	return inst;
@@ -72,8 +72,11 @@ function isEnabled(namespaces) {
 	const split = namespaces.trim().replace(/\s+/g, ",").split(",").filter(Boolean);
 	const names = [];
 	const skips = [];
-	for (const ns of split) if (require_primordials_string.StringPrototypeStartsWith(ns, "-")) skips.push(ns.slice(1));
-	else names.push(ns);
+	for (let i = 0, { length } = split; i < length; i += 1) {
+		const ns = split[i];
+		if (require_primordials_string.StringPrototypeStartsWith(ns, "-")) skips.push(ns.slice(1));
+		else names.push(ns);
+	}
 	if (names.length && !names.some((ns) => getDebugJsInstance(ns).enabled)) return false;
 	return skips.every((ns) => !getDebugJsInstance(ns).enabled);
 }

package/dist/debug/output.d.ts

@@ -6,6 +6,7 @@
  *   active spinner across the write, and uses the lazy `pointingTriangle` glyph
  *   for the divider.
  */
+import type { SpinnerInstance } from '../spinner/types';
 import type { InspectOptions, NamespacesOrOptions } from './types';
 /**
  * Debug output with caller info (wrapper for debugNs with default namespace).
@@ -52,7 +53,7 @@ export declare function debugNs(namespacesOrOpts: NamespacesOrOptions, ...args:
  * Create a Node.js util.debuglog compatible function. Returns a function that
  * conditionally writes debug messages to stderr.
  */
-export declare function debuglog(section: string): import("util").DebugLogger;
+export declare function debuglog(section: string): import("node:util").DebugLogger;
 /**
  * Create timing functions for measuring code execution time. Returns an object
  * with start() and end() methods, plus a callable function.
@@ -62,3 +63,13 @@ export declare function debugtime(label: string): {
     start: () => void;
     end: () => void;
 };
+/**
+ * Resolve the default spinner on Node; off Node (browser bundles) there is no
+ * spinner — callers no-op through their optional chains. Construction is
+ * deferred to first debug write (every call site sits behind the `isEnabled`
+ * / `getSocketDebug` gates), so a browser bundle never constructs the
+ * node-bound spinner even when debug output is force-enabled.
+ *
+ * @private
+ */
+export declare function getSpinner(): SpinnerInstance | undefined;