@socketsecurity/lib 6.0.9 → 6.0.10

package/dist/external-tools/from-download.d.ts

@@ -20,7 +20,7 @@
  *     `external-tools.json` (or wherever the pin lives).
  *   - Subsequent calls with `integrity` set: downloads, verifies against the pin,
  *     returns the same value. Customization:
- *   - `downloader?` lets tests inject a fake fetch, and gives fleet consumers an
+ *   - `downloader?` lets tests inject a fake fetch, and gives Socket consumers an
  *     escape hatch for alternate cache backends, retry logic, or progress
  *     reporters.
  */
@@ -112,7 +112,7 @@ export interface DownloadedArchive {
  * Optional downloader injection. Default: `dlx/binary-download.downloadBinary`.
  * Replace when: - Writing unit tests that need a fake fetch (no network). -
  * Wiring an alternate cache backend or progress reporter. - Adding
- * fleet-specific instrumentation (metrics, retry).
+ * tool-specific instrumentation (metrics, retry).
  */
 export type BinaryDownloader = typeof downloadBinary;
 export interface DownloadOptions {

package/dist/external-tools/from-download.js

@@ -29,7 +29,7 @@ let node_fs = require("node:fs");
 *     `external-tools.json` (or wherever the pin lives).
 *   - Subsequent calls with `integrity` set: downloads, verifies against the pin,
 *     returns the same value. Customization:
-*   - `downloader?` lets tests inject a fake fetch, and gives fleet consumers an
+*   - `downloader?` lets tests inject a fake fetch, and gives Socket consumers an
 *     escape hatch for alternate cache backends, retry logic, or progress
 *     reporters.
 */

package/dist/external-tools/janus/asset-names.d.ts

@@ -21,6 +21,9 @@ export declare const JANUS_ASSET_MAP: Readonly<Record<string, JanusAssetEntry>>;
  * rather than letting the URL builder silently return undefined.
  */
 export declare const JANUS_SUPPORTED_PLATFORM_ARCHES: readonly string[];
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function getJanusAssetEntry(platformArch: string): JanusAssetEntry | undefined;
 export interface JanusDownloadOptions {
     /**
@@ -29,7 +32,7 @@ export interface JanusDownloadOptions {
      */
     version: string;
     /**
-     * Fleet platform-arch token — looked up in `JANUS_ASSET_MAP`. Returns
+     * Socket platform-arch token — looked up in `JANUS_ASSET_MAP`. Returns
      * `undefined` for any platform-arch janus doesn't ship a build for.
      */
     platformArch: string;

package/dist/external-tools/janus/asset-names.js

@@ -27,6 +27,9 @@ const JANUS_ASSET_MAP = require_primordials_object.ObjectFreeze({
 * rather than letting the URL builder silently return undefined.
 */
 const JANUS_SUPPORTED_PLATFORM_ARCHES = require_primordials_object.ObjectFreeze(require_primordials_object.ObjectKeys(JANUS_ASSET_MAP));
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 function getJanusAssetEntry(platformArch) {
 	return JANUS_ASSET_MAP[platformArch];
 }

package/dist/external-tools/janus/from-download.d.ts

@@ -4,8 +4,8 @@
  *   archives containing a bare `janus` binary at the archive root (no nested
  *   directory). Defaults install under the shared wheelhouse dir
  *   (`~/.socket/_wheelhouse/janus/<version>/<platform-arch>/`) rather than the
- *   per-process dlx cache, so multiple fleet consumers reuse the same extracted
- *   binary.
+ *   per-process dlx cache, so multiple Socket consumers reuse the same
+ *   extracted binary.
  */
 import type { BinaryDownloader } from '../from-download';
 import type { HashSpec } from '../../integrity';
@@ -17,7 +17,7 @@ export interface JanusFromDownloadOptions {
     /**
      * Override the install directory. By default the binary lands in
      * `<getSocketWheelhouseDir()>/janus/<version>/<platformArch>/` — a shared
-     * cross-fleet location so multiple Socket tools resolve the same binary
+     * shared location so multiple Socket tools resolve the same binary
      * without per-process duplication.
      */
     cacheDir?: string | undefined;

package/dist/external-tools/janus/from-download.js

@@ -16,8 +16,8 @@ node_path = require_runtime.__toESM(node_path);
 *   archives containing a bare `janus` binary at the archive root (no nested
 *   directory). Defaults install under the shared wheelhouse dir
 *   (`~/.socket/_wheelhouse/janus/<version>/<platform-arch>/`) rather than the
-*   per-process dlx cache, so multiple fleet consumers reuse the same extracted
-*   binary.
+*   per-process dlx cache, so multiple Socket consumers reuse the same
+*   extracted binary.
 */
 async function janusFromDownload(options) {
 	const { cacheDir, downloader, integrity, platformArch, version } = {

package/dist/external-tools/janus/resolve.d.ts

@@ -24,5 +24,8 @@ export interface ResolveJanusOptions {
 }
 export declare function cacheKey(options: ResolveJanusOptions | undefined): string;
 export declare function doResolveJanus(options?: ResolveJanusOptions | undefined): Promise<ResolvedJanus | undefined>;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function resetJanusResolution(): void;
 export declare function resolveJanus(options?: ResolveJanusOptions | undefined): Promise<ResolvedJanus | undefined>;

package/dist/external-tools/janus/resolve.js

@@ -43,6 +43,9 @@ async function doResolveJanus(options) {
 	if (options?.downloadIfMissing) return require_external_tools_janus_from_download.janusFromDownload(options.downloadIfMissing);
 }
 /* c8 ignore start - test-only escape hatch. */
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 function resetJanusResolution() {
 	resolutionCache.clear();
 }

package/dist/external-tools/jre/asset-names.d.ts

@@ -34,7 +34,7 @@ export interface AdoptiumDownloadOptions {
      */
     version: number;
     /**
-     * Fleet platform-arch token — same vocabulary as `getPlatformArch` output.
+     * Socket platform-arch token — same vocabulary as `getPlatformArch` output.
      * Looked up in `ADOPTIUM_QUERY_MAP`; returns `undefined` when Adoptium
      * doesn't publish a build for that target (e.g. `win-arm64` for older
      * majors).
@@ -87,5 +87,7 @@ export declare function getAdoptiumDownloadUrl(options: AdoptiumDownloadOptions)
 /**
  * Returns the Adoptium query parameters for a given platform-arch, or
  * `undefined` if no Adoptium build exists for that target.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare function getAdoptiumQuery(platformArch: string): AdoptiumAssetQuery | undefined;

package/dist/external-tools/jre/asset-names.js

@@ -107,6 +107,8 @@ function getAdoptiumDownloadUrl(options) {
 /**
 * Returns the Adoptium query parameters for a given platform-arch, or
 * `undefined` if no Adoptium build exists for that target.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function getAdoptiumQuery(platformArch) {
 	return ADOPTIUM_QUERY_MAP[platformArch];

package/dist/external-tools/jre/from-download.d.ts

@@ -26,7 +26,7 @@ export interface JreFromDownloadOptions {
      */
     version: number;
     /**
-     * Fleet platform-arch token, e.g. `'darwin-arm64'`.
+     * Socket platform-arch token, e.g. `'darwin-arm64'`.
      */
     platformArch: string;
     /**

package/dist/external-tools/manifest.d.ts

@@ -1,8 +1,8 @@
 /**
- * @file Reader for `external-tools.json` — the fleet manifest describing
+ * @file Reader for `external-tools.json` — the Socket manifest describing
  *   downloadable external binaries (sfw, zizmor, etc.) with pinned versions,
  *   per-platform asset names, and integrity hashes. The manifest itself is
- *   hand-maintained in each fleet repo's root (`<repo>/external-tools.json`)
+ *   hand-maintained in each Socket repo's root (`<repo>/external-tools.json`)
  *   and consumed by the setup-and-install GitHub action. This reader gives
  *   in-process consumers (external- tools resolvers, ad-hoc scripts) the same
  *   typed view without each one re-implementing the JSON-parse + shape check +
@@ -42,7 +42,7 @@ export interface ToolChecksum {
     integrity: string;
 }
 /**
- * A downloadable-binary tool entry. `platforms` is keyed by the fleet's
+ * A downloadable-binary tool entry. `platforms` is keyed by Socket's
  * platform-arch token (`darwin-arm64`, `linux-x64-musl`, `win-x64`, etc. — same
  * vocabulary as `getPlatformArch`).
  */
@@ -118,6 +118,8 @@ export declare function parseToolEntry(raw: unknown, toolName: string): Manifest
  * Throws on malformed JSON or invalid integrity strings; unknown-shape entries
  * (rust components, future variants) come back as `{kind: 'other', raw}` so
  * callers can handle them out-of-band without blocking the manifest read.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare function readExternalToolsManifest(filepath: string): Promise<Manifest>;
 export declare function tryParseFlavored(raw: Record<string, unknown>, toolName: string): FlavoredToolEntry | undefined;

package/dist/external-tools/manifest.js

@@ -10,10 +10,10 @@ const require_fs_read_json = require('../fs/read-json.js');
 
 //#region src/external-tools/manifest.ts
 /**
-* @file Reader for `external-tools.json` — the fleet manifest describing
+* @file Reader for `external-tools.json` — the Socket manifest describing
 *   downloadable external binaries (sfw, zizmor, etc.) with pinned versions,
 *   per-platform asset names, and integrity hashes. The manifest itself is
-*   hand-maintained in each fleet repo's root (`<repo>/external-tools.json`)
+*   hand-maintained in each Socket repo's root (`<repo>/external-tools.json`)
 *   and consumed by the setup-and-install GitHub action. This reader gives
 *   in-process consumers (external- tools resolvers, ad-hoc scripts) the same
 *   typed view without each one re-implementing the JSON-parse + shape check +
@@ -103,6 +103,8 @@ function parseToolEntry(raw, toolName) {
 * Throws on malformed JSON or invalid integrity strings; unknown-shape entries
 * (rust components, future variants) come back as `{kind: 'other', raw}` so
 * callers can handle them out-of-band without blocking the manifest read.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 async function readExternalToolsManifest(filepath) {
 	const raw = await require_fs_read_json.readJson(filepath);

package/dist/external-tools/opengrep/asset-names.d.ts

@@ -31,7 +31,7 @@ export interface OpengrepDownloadOptions {
      */
     version: string;
     /**
-     * Fleet platform-arch token — looked up in `OPENGREP_ASSET_MAP`.
+     * Socket platform-arch token — looked up in `OPENGREP_ASSET_MAP`.
      */
     platformArch: string;
 }

package/dist/external-tools/opengrep/resolve.d.ts

@@ -22,5 +22,8 @@ export interface ResolveOpengrepOptions {
 }
 export declare function cacheKey(options: ResolveOpengrepOptions | undefined): string;
 export declare function doResolveOpengrep(options?: ResolveOpengrepOptions | undefined): Promise<ResolvedOpengrep | undefined>;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function resetOpengrepResolution(): void;
 export declare function resolveOpengrep(options?: ResolveOpengrepOptions | undefined): Promise<ResolvedOpengrep | undefined>;

package/dist/external-tools/opengrep/resolve.js

@@ -41,6 +41,9 @@ async function doResolveOpengrep(options) {
 	if (options?.downloadIfMissing) return require_external_tools_opengrep_from_download.opengrepFromDownload(options.downloadIfMissing);
 }
 /* c8 ignore start - test-only escape hatch. */
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 function resetOpengrepResolution() {
 	resolutionCache.clear();
 }

package/dist/external-tools/python/asset-names.d.ts

@@ -7,11 +7,13 @@
  *   extracted one directory deep (`python/bin/python3`).
  */
 /**
- * Python-build-standalone default pin — the fleet-canonical CPython build,
+ * Python-build-standalone default pin — the Socket-canonical CPython build,
  * matching socket-cli's `bundle-tools.json`. Consumers that don't pass their
  * own pin resolve against this. Bump it like any dependency (soak-aware), in
  * lockstep with socket-cli (drift-watch). The `checksums` map is keyed by asset
  * filename so the download tier verifies the exact tarball per platform.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare const DEFAULT_PYTHON_PIN: Readonly<{
     __proto__: null;

package/dist/external-tools/python/asset-names.js

@@ -40,11 +40,13 @@ const NODE_ARCH_TO_PY = require_primordials_object.ObjectFreeze({
 });
 const RELEASE_BASE = "https://github.com/astral-sh/python-build-standalone/releases/download";
 /**
-* Python-build-standalone default pin — the fleet-canonical CPython build,
+* Python-build-standalone default pin — the Socket-canonical CPython build,
 * matching socket-cli's `bundle-tools.json`. Consumers that don't pass their
 * own pin resolve against this. Bump it like any dependency (soak-aware), in
 * lockstep with socket-cli (drift-watch). The `checksums` map is keyed by asset
 * filename so the download tier verifies the exact tarball per platform.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 const DEFAULT_PYTHON_PIN = require_primordials_object.ObjectFreeze({
 	__proto__: null,
@@ -99,9 +101,11 @@ function pythonAsset(options) {
 	const arch = options.arch ?? getPythonArch();
 	const triple = arch ? PLATFORM_TRIPLES[arch] : void 0;
 	if (!triple) return;
+	const assetName = `cpython-${version}+${tag}-${triple}-install_only.tar.gz`;
+	const encodedVersion = `${version}%2B${tag}`;
 	return {
-		assetName: `cpython-${version}+${tag}-${triple}-install_only.tar.gz`,
-		url: `${RELEASE_BASE}/${tag}/cpython-${`${version}%2B${tag}`}-${triple}-install_only.tar.gz`
+		assetName,
+		url: `${RELEASE_BASE}/${tag}/cpython-${encodedVersion}-${triple}-install_only.tar.gz`
 	};
 }
 

package/dist/external-tools/python/pin.js

@@ -118,7 +118,9 @@ async function resolvePipPackagePin(options) {
 		const artifacts = [];
 		const targetName = normalizeDistName(specDistName(spec));
 		let top;
-		for (const file of files.toSorted()) {
+		const sortedFiles = files.toSorted();
+		for (let i = 0, { length } = sortedFiles; i < length; i += 1) {
+			const file = sortedFiles[i];
 			const hash = require_integrity.computeHashes(await node_fs.promises.readFile(node_path.default.join(scratch, file)));
 			const parsed = parseArtifactFilename(file);
 			if (!parsed) throw new PipPackagePinError(`resolvePipPackagePin: could not parse name/version from artifact ${file}`);

package/dist/external-tools/python/resolve.d.ts

@@ -38,5 +38,8 @@ export interface ResolvePythonOptions {
 }
 export declare function cacheKey(options: ResolvePythonOptions | undefined): string;
 export declare function doResolvePython(options?: ResolvePythonOptions | undefined): Promise<ResolvedPython | undefined>;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function resetPythonResolution(): void;
 export declare function resolvePython(options?: ResolvePythonOptions | undefined): Promise<ResolvedPython | undefined>;

package/dist/external-tools/python/resolve.js

@@ -45,6 +45,9 @@ async function doResolvePython(options) {
 	if (dl) return require_external_tools_python_from_download.pythonFromDownload(dl);
 }
 /* c8 ignore start - test-only escape hatch. */
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 function resetPythonResolution() {
 	resolutionCache.clear();
 }

package/dist/external-tools/sbt/resolve.d.ts

@@ -27,5 +27,8 @@ export interface ResolveSbtOptions {
 }
 export declare function cacheKey(options: ResolveSbtOptions | undefined): string;
 export declare function doResolveSbt(options?: ResolveSbtOptions | undefined): Promise<ResolvedSbt | undefined>;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function resetSbtResolution(): void;
 export declare function resolveSbt(options?: ResolveSbtOptions | undefined): Promise<ResolvedSbt | undefined>;

package/dist/external-tools/sbt/resolve.js

@@ -42,6 +42,9 @@ async function doResolveSbt(options) {
 	if (fromPath) return fromPath;
 	if (options?.downloadIfMissing) return require_external_tools_sbt_from_download.sbtFromDownload(options.downloadIfMissing);
 }
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 /* c8 ignore start - test-only escape hatch. */
 function resetSbtResolution() {
 	resolutionCache.clear();

package/dist/external-tools/skillspector/from-uv.d.ts

@@ -21,7 +21,7 @@ export interface SkillSpectorFromUvOptions {
     readonly uvBin: string;
     /**
      * Absolute path to the SkillSpector uv project dir (holds `pyproject.toml` +
-     * `uv.lock`). The fleet ships this under
+     * `uv.lock`). Socket ships this under
      * `setup-security-tools/skillspector/`.
      */
     readonly projectDir: string;

package/dist/external-tools/synp/resolve.d.ts

@@ -17,5 +17,8 @@ export interface ResolveSynpOptions {
 }
 export declare function cacheKey(options: ResolveSynpOptions | undefined): string;
 export declare function doResolveSynp(options?: ResolveSynpOptions | undefined): Promise<ResolvedSynp | undefined>;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function resetSynpResolution(): void;
 export declare function resolveSynp(options?: ResolveSynpOptions | undefined): Promise<ResolvedSynp | undefined>;

package/dist/external-tools/synp/resolve.js

@@ -40,6 +40,9 @@ async function doResolveSynp(options) {
 	if (fromPath) return fromPath;
 	if (options?.downloadIfMissing) return require_external_tools_synp_from_download.synpFromDownload(options.downloadIfMissing);
 }
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 /* c8 ignore start - test-only escape hatch. */
 function resetSynpResolution() {
 	resolutionCache.clear();

package/dist/external-tools/trivy/asset-names.d.ts

@@ -21,7 +21,7 @@ export interface TrivyDownloadOptions {
      */
     version: string;
     /**
-     * Fleet platform-arch token — looked up in `TRIVY_ASSET_MAP`.
+     * Socket platform-arch token — looked up in `TRIVY_ASSET_MAP`.
      */
     platformArch: string;
 }

package/dist/external-tools/trivy/resolve.d.ts

@@ -22,5 +22,8 @@ export interface ResolveTrivyOptions {
 }
 export declare function cacheKey(options: ResolveTrivyOptions | undefined): string;
 export declare function doResolveTrivy(options?: ResolveTrivyOptions | undefined): Promise<ResolvedTrivy | undefined>;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function resetTrivyResolution(): void;
 export declare function resolveTrivy(options?: ResolveTrivyOptions | undefined): Promise<ResolvedTrivy | undefined>;

package/dist/external-tools/trivy/resolve.js

@@ -40,6 +40,9 @@ async function doResolveTrivy(options) {
 	if (fromPath) return fromPath;
 	if (options?.downloadIfMissing) return require_external_tools_trivy_from_download.trivyFromDownload(options.downloadIfMissing);
 }
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 /* c8 ignore start - test-only escape hatch. */
 function resetTrivyResolution() {
 	resolutionCache.clear();

package/dist/external-tools/trufflehog/asset-names.d.ts

@@ -11,6 +11,9 @@ export interface TrufflehogAssetEntry {
     readonly suffix: string;
 }
 export declare const TRUFFLEHOG_ASSET_MAP: Readonly<Record<string, TrufflehogAssetEntry>>;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function getTrufflehogAssetEntry(platformArch: string): TrufflehogAssetEntry | undefined;
 export interface TrufflehogDownloadOptions {
     /**
@@ -19,7 +22,7 @@ export interface TrufflehogDownloadOptions {
      */
     version: string;
     /**
-     * Fleet platform-arch token — looked up in `TRUFFLEHOG_ASSET_MAP`. Returns
+     * Socket platform-arch token — looked up in `TRUFFLEHOG_ASSET_MAP`. Returns
      * `undefined` when no entry exists for the target.
      */
     platformArch: string;

package/dist/external-tools/trufflehog/asset-names.js

@@ -37,6 +37,9 @@ const TRUFFLEHOG_ASSET_MAP = require_primordials_object.ObjectFreeze({
 		suffix: "windows_amd64.tar.gz"
 	})
 });
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 function getTrufflehogAssetEntry(platformArch) {
 	return TRUFFLEHOG_ASSET_MAP[platformArch];
 }

package/dist/external-tools/trufflehog/from-download.d.ts

@@ -16,7 +16,7 @@ export interface TrufflehogFromDownloadOptions {
      */
     version: string;
     /**
-     * Fleet platform-arch token, e.g. `'darwin-arm64'`.
+     * Socket platform-arch token, e.g. `'darwin-arm64'`.
      */
     platformArch: string;
     /**

package/dist/external-tools/trufflehog/resolve.d.ts

@@ -26,5 +26,8 @@ export interface ResolveTrufflehogOptions {
 }
 export declare function cacheKey(options: ResolveTrufflehogOptions | undefined): string;
 export declare function doResolveTrufflehog(options?: ResolveTrufflehogOptions | undefined): Promise<ResolvedTrufflehog | undefined>;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function resetTrufflehogResolution(): void;
 export declare function resolveTrufflehog(options?: ResolveTrufflehogOptions | undefined): Promise<ResolvedTrufflehog | undefined>;

package/dist/external-tools/trufflehog/resolve.js

@@ -40,6 +40,9 @@ async function doResolveTrufflehog(options) {
 	if (fromPath) return fromPath;
 	if (options?.downloadIfMissing) return require_external_tools_trufflehog_from_download.trufflehogFromDownload(options.downloadIfMissing);
 }
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 /* c8 ignore start - test-only escape hatch. */
 function resetTrufflehogResolution() {
 	resolutionCache.clear();

package/dist/external-tools/uv/asset-names.d.ts

@@ -23,7 +23,7 @@ export interface UvDownloadOptions {
      */
     version: string;
     /**
-     * Fleet platform-arch token — looked up in `UV_ASSET_MAP`.
+     * Socket platform-arch token — looked up in `UV_ASSET_MAP`.
      */
     platformArch: string;
 }

package/dist/external-tools/uv/resolve.d.ts

@@ -21,5 +21,8 @@ export interface ResolveUvOptions {
 }
 export declare function cacheKey(options: ResolveUvOptions | undefined): string;
 export declare function doResolveUv(options?: ResolveUvOptions | undefined): Promise<ResolvedUv | undefined>;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function resetUvResolution(): void;
 export declare function resolveUv(options?: ResolveUvOptions | undefined): Promise<ResolvedUv | undefined>;

package/dist/external-tools/uv/resolve.js

@@ -40,6 +40,9 @@ async function doResolveUv(options) {
 	if (opts?.downloadIfMissing) return require_external_tools_uv_from_download.uvFromDownload(opts.downloadIfMissing);
 }
 /* c8 ignore start - test-only escape hatch. */
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 function resetUvResolution() {
 	resolutionCache.clear();
 }

package/dist/fleet/repo-config.d.ts

@@ -2,12 +2,12 @@
  * @file Fleet-convention config reader: a per-repo override (`.config/repo`)
  *   layered over the cascaded fleet default (`.config/fleet`). A thin wrapper
  *   over the generic `config/layers` reader that returns the named `{ fleet,
- *   repo }` shape fleet callers use, plus the `{ fleet, repo }` array-merge
- *   convenience. The generic, fleet-agnostic primitives (`readConfigLayers`,
- *   `mergeConfigArray`) live in `config/layers`. Lives in the published lib
- *   because it is the only import root the `.git-hooks/_shared` and
- *   `.claude/hooks/_shared` trees (which do not cross-import) plus `.config/*`
- *   can all reach.
+ *   repo }` shape Socket callers use, plus the `{ fleet, repo }` array-merge
+ *   convenience. The generic, convention-agnostic primitives
+ *   (`readConfigLayers`, `mergeConfigArray`) live in `config/layers`. Lives in
+ *   the published lib because it is the only import root the
+ *   `.git-hooks/_shared` and `.claude/hooks/_shared` trees (which do not
+ *   cross-import) plus `.config/*` can all reach.
  */
 export declare const FLEET_LAYER_DIRS: readonly string[];
 export interface RepoConfigTiers<T> {
@@ -28,6 +28,8 @@ export interface ResolveRepoConfigOptions {
  *
  * @returns Fleet entries followed by repo entries; `[]` when neither is an
  *   array.
+ *
+ * @unused No internal or Socket consumers.
  */
 export declare function mergeRepoConfigArray<T extends Record<string, unknown>, K extends keyof T>(tiers: RepoConfigTiers<T>, key: K): Array<T[K] extends Array<infer E> ? E : never>;
 /**

package/dist/fleet/repo-config.js

@@ -8,12 +8,12 @@ const require_config_layers = require('../config/layers.js');
 * @file Fleet-convention config reader: a per-repo override (`.config/repo`)
 *   layered over the cascaded fleet default (`.config/fleet`). A thin wrapper
 *   over the generic `config/layers` reader that returns the named `{ fleet,
-*   repo }` shape fleet callers use, plus the `{ fleet, repo }` array-merge
-*   convenience. The generic, fleet-agnostic primitives (`readConfigLayers`,
-*   `mergeConfigArray`) live in `config/layers`. Lives in the published lib
-*   because it is the only import root the `.git-hooks/_shared` and
-*   `.claude/hooks/_shared` trees (which do not cross-import) plus `.config/*`
-*   can all reach.
+*   repo }` shape Socket callers use, plus the `{ fleet, repo }` array-merge
+*   convenience. The generic, convention-agnostic primitives
+*   (`readConfigLayers`, `mergeConfigArray`) live in `config/layers`. Lives in
+*   the published lib because it is the only import root the
+*   `.git-hooks/_shared` and `.claude/hooks/_shared` trees (which do not
+*   cross-import) plus `.config/*` can all reach.
 */
 const FLEET_LAYER_DIRS = [".config/fleet", ".config/repo"];
 /**
@@ -26,6 +26,8 @@ const FLEET_LAYER_DIRS = [".config/fleet", ".config/repo"];
 *
 * @returns Fleet entries followed by repo entries; `[]` when neither is an
 *   array.
+*
+* @unused No internal or Socket consumers.
 */
 function mergeRepoConfigArray(tiers, key) {
 	return require_config_layers.mergeConfigArray([tiers.fleet, tiers.repo], key);

package/dist/fs/_internal.d.ts

@@ -2,7 +2,7 @@
  * @file Private state shared between `fs/safe` and `fs/path-cache`. The `_`
  *   prefix keeps this module out of the generated package.json `exports` map
  *   (the `dist/**\/_*` ignore pattern in
- *   `scripts/post-build/make-package-exports.mts` filters it out), so it is not
+ *   `scripts/fleet/make-package-exports.mts` filters it out), so it is not
  *   part of the public surface — it exists only to give the two leaves above a
  *   common owner for the allowed-directory cache. The cache is invalidated by
  *   `invalidatePathCache()` in `fs/path-cache.ts` whenever paths are rewired in

package/dist/fs/_internal.js

@@ -9,7 +9,7 @@ const require_paths_socket = require('../paths/socket.js');
 * @file Private state shared between `fs/safe` and `fs/path-cache`. The `_`
 *   prefix keeps this module out of the generated package.json `exports` map
 *   (the `dist/**\/_*` ignore pattern in
-*   `scripts/post-build/make-package-exports.mts` filters it out), so it is not
+*   `scripts/fleet/make-package-exports.mts` filters it out), so it is not
 *   part of the public surface — it exists only to give the two leaves above a
 *   common owner for the allowed-directory cache. The cache is invalidated by
 *   `invalidatePathCache()` in `fs/path-cache.ts` whenever paths are rewired in

package/dist/fs/access.d.ts

@@ -20,6 +20,8 @@ import type { PathLike } from 'node:fs';
 export declare function canAccess(path: PathLike, mode?: number | undefined): boolean;
 /**
  * Can the process execute `path`? (`X_OK`)
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare function canExecute(path: PathLike): boolean;
 /**

package/dist/fs/access.js

@@ -38,6 +38,8 @@ function canAccess(path, mode) {
 }
 /**
 * Can the process execute `path`? (`X_OK`)
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function canExecute(path) {
 	return canAccess(path, require_node_fs.getNodeFs().constants.X_OK);

package/dist/fs/allowed-dirs-cache.js

@@ -1,6 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_paths_rewire = require('../paths/rewire.js');
+const require_fs__internal = require('./_internal.js');
 
 //#region src/fs/allowed-dirs-cache.ts
 /**
@@ -34,7 +36,7 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 * @internal Used for test rewiring
 */
 function invalidatePathCache() {
-	clearAllowedDirectories();
+	require_fs__internal.clearAllowedDirectories();
 }
 /**
 * Register `invalidatePathCache` with the rewire module after the current
@@ -53,8 +55,8 @@ function invalidatePathCache() {
 */
 function registerInvalidationCallback(attempt = 0) {
 	try {
-		if (typeof registerCacheInvalidation === "function") {
-			registerCacheInvalidation(invalidatePathCache);
+		if (typeof require_paths_rewire.registerCacheInvalidation === "function") {
+			require_paths_rewire.registerCacheInvalidation(invalidatePathCache);
 			return;
 		}
 	} catch {}