@socketsecurity/lib 6.0.9 → 6.0.10

package/dist/http-request/headers.js

@@ -24,7 +24,7 @@ const RETRY_AFTER_INT_RE = /^\d+$/;
 * Build an HTTP Basic `Authorization` header value from a Socket API token.
 *
 * The Socket API uses the token as the username with an empty password, so the
-* credential pair is `<token>:`. Centralized here so every fleet caller emits
+* credential pair is `<token>:`. Centralized here so every Socket caller emits
 * the identical shape instead of hand-rolling `btoa(\`${token}:`)`.
 *
 * @example

package/dist/http-request/request-attempt.js

@@ -118,7 +118,7 @@ async function httpRequestAttempt(url, options) {
 				let redirectHeaders = headers;
 				if (new require_primordials_url.URLCtor(url).origin !== redirectParsed.origin) {
 					redirectHeaders = { __proto__: null };
-					const stripped = new Set([
+					const stripped = /* @__PURE__ */ new Set([
 						"authorization",
 						"cookie",
 						"proxy-authenticate",
@@ -173,7 +173,9 @@ async function httpRequestAttempt(url, options) {
 				if (maxResponseSize && totalBytes > maxResponseSize) {
 					res.destroy();
 					request.destroy();
-					rejectOnce(new require_primordials_error.ErrorCtor(`Response exceeds maximum size limit (${(totalBytes / (1024 * 1024)).toFixed(2)}MB > ${(maxResponseSize / (1024 * 1024)).toFixed(2)}MB)`));
+					const sizeMB = (totalBytes / (1024 * 1024)).toFixed(2);
+					const maxMB = (maxResponseSize / (1024 * 1024)).toFixed(2);
+					rejectOnce(new require_primordials_error.ErrorCtor(`Response exceeds maximum size limit (${sizeMB}MB > ${maxMB}MB)`));
 					return;
 				}
 				chunks.push(chunk);
@@ -213,7 +215,8 @@ async function httpRequestAttempt(url, options) {
 			});
 		});
 		request.on("error", (error) => {
-			rejectOnce(new require_primordials_error.ErrorCtor(require_http_request_errors.enrichErrorMessage(url, method, error), { cause: error }));
+			const message = require_http_request_errors.enrichErrorMessage(url, method, error);
+			rejectOnce(new require_primordials_error.ErrorCtor(message, { cause: error }));
 		});
 		request.on("timeout", () => {
 			request.destroy();

package/dist/http-request/request-types.d.ts

@@ -199,7 +199,7 @@ export interface HttpRequestOptions {
     onRetry?: ((attempt: number, error: unknown, delay: number) => boolean | number | undefined) | undefined;
     /**
      * Number of retry attempts for failed requests. Uses exponential backoff:
-     * delay = `retryDelay` * 2^attempt.
+     * delay = min(`retryDelay` * 2^attempt, `retryDelayMax`).
      *
      * @default 0
      */
@@ -211,6 +211,15 @@ export interface HttpRequestOptions {
      * @default 1000
      */
     retryDelay?: number | undefined;
+    /**
+     * Maximum delay in milliseconds for a single backoff wait. Caps the
+     * exponential growth (`retryDelay` * 2^attempt) so a high `retries` count
+     * can't produce multi-minute waits. An explicit `onRetry`-returned delay is
+     * not capped — that is the caller's deliberate choice.
+     *
+     * @default 30000
+     */
+    retryDelayMax?: number | undefined;
     /**
      * AbortSignal forwarded to the underlying `http.request` / `https.request`
      * call. Supported in Node 22+ via `node:http` request options. When both

package/dist/http-request/request.js

@@ -65,7 +65,7 @@ let node_timers_promises = require("node:timers/promises");
 *   non-retryable error happens.
 */
 async function httpRequest(url, options) {
-	const { body, ca, followRedirects = true, headers = {}, hooks, maxRedirects = 5, maxResponseSize, method = "GET", onRetry, retries = 0, retryDelay = 1e3, signal, stream = false, throwOnError = false, timeout = 3e4 } = {
+	const { body, ca, followRedirects = true, headers = {}, hooks, maxRedirects = 5, maxResponseSize, method = "GET", onRetry, retries = 0, retryDelay = 1e3, retryDelayMax = 3e4, signal, stream = false, throwOnError = false, timeout = 3e4 } = {
 		__proto__: null,
 		...options
 	};
@@ -104,7 +104,7 @@ async function httpRequest(url, options) {
 			lastError = e;
 			if (attempt === retries) break;
 			if (signal?.aborted) break;
-			const delayMs = retryDelay * 2 ** attempt;
+			const delayMs = require_primordials_math.MathMin(retryDelay * 2 ** attempt, retryDelayMax);
 			if (onRetry) {
 				const retryResult = onRetry(attempt + 1, e, delayMs);
 				if (retryResult === false) break;

package/dist/http-request/user-agent.d.ts

@@ -3,7 +3,7 @@
  *   Three-token format aligned with socket-cli's `getCliUserAgent` and
  *   coana-tech-cli's `configureAxiosUserAgent`: `<slug>/<version>
  *   node/<node-version> <platform>/<arch>` e.g. `socketsecurity-lib/6.0.0
- *   node/v22.10.0 darwin/arm64` Downstream callers (sdxgen SEA binary, fleet
+ *   node/v22.10.0 darwin/arm64` Downstream callers (sdxgen SEA binary, Socket
  *   CLIs, etc.) can identify themselves via the `SOCKET_CALLER_USER_AGENT` env
  *   var, which is appended to the lib's own UA so the server still sees the lib
  *   identifier. @example import { getSocketCallerUserAgent } from
@@ -16,7 +16,7 @@
  *
  * Used directly by socket-lib's own outbound requests (via
  * `getSocketCallerUserAgent`) and exported for sibling packages (socket-cli,
- * socket-sdk-js) so the fleet emits one canonical UA shape.
+ * socket-sdk-js) so Socket emits one canonical UA shape.
  *
  * @example
  *   ;```typescript
@@ -31,6 +31,18 @@ export declare function buildUserAgent(pkg: {
     name: string;
     version: string;
 }, caller?: string | undefined): string;
+/**
+ * Chain User-Agent fragments into a breadcrumb trail, ordered identity → hop
+ * (the immediate agent first, each forwarded caller after) so it reads
+ * left-to-right and a server's UA parser buckets by the immediate agent. Each
+ * fragment is sanitized; empties are dropped; an immediately-repeated fragment
+ * is collapsed so re-proxying doesn't stutter the same hop twice.
+ *
+ * @example
+ *   chainUserAgents(['socketsecurity-firewall-api-proxy/0.0.0', 'vlt/1.2.3'])
+ *   // 'socketsecurity-firewall-api-proxy/0.0.0 vlt/1.2.3'
+ */
+export declare function chainUserAgents(parts: ReadonlyArray<string | undefined>): string;
 /**
  * User-Agent header for socket-lib's own outbound HTTP requests.
  *
@@ -53,3 +65,12 @@ export declare function buildUserAgent(pkg: {
  *   ```
  */
 export declare function getSocketCallerUserAgent(): string;
+/**
+ * Sanitize a single User-Agent fragment for safe inclusion in an outgoing HTTP
+ * header. A caller identifier (`SOCKET_CALLER_USER_AGENT`, or a UA a proxy
+ * forwards on behalf of its client) is untrusted, so strip control chars (C0
+ * incl. CR/LF — the header- and log-injection vector — DEL, and C1), collapse
+ * internal whitespace to one space, trim, and cap length. Returns '' for
+ * nullish / blank / all-control input.
+ */
+export declare function sanitizeUserAgent(value: string | undefined): string;

package/dist/http-request/user-agent.js

@@ -2,7 +2,9 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_primordials_string = require('../primordials/string.js');
 const require_env_rewire = require('../env/rewire.js');
+const require_primordials_array = require('../primordials/array.js');
 const require_constants_socket = require('../constants/socket.js');
 const require_packages_specs = require('../packages/specs.js');
 let node_process = require("node:process");
@@ -14,20 +16,22 @@ node_process = require_runtime.__toESM(node_process);
 *   Three-token format aligned with socket-cli's `getCliUserAgent` and
 *   coana-tech-cli's `configureAxiosUserAgent`: `<slug>/<version>
 *   node/<node-version> <platform>/<arch>` e.g. `socketsecurity-lib/6.0.0
-*   node/v22.10.0 darwin/arm64` Downstream callers (sdxgen SEA binary, fleet
+*   node/v22.10.0 darwin/arm64` Downstream callers (sdxgen SEA binary, Socket
 *   CLIs, etc.) can identify themselves via the `SOCKET_CALLER_USER_AGENT` env
 *   var, which is appended to the lib's own UA so the server still sees the lib
 *   identifier. @example import { getSocketCallerUserAgent } from
 *   '@socketsecurity/lib/http-request/user-agent'
 *   request.setHeader('User-Agent', getSocketCallerUserAgent())
 */
+const MAX_USER_AGENT_LENGTH = 256;
+let cachedBaseUserAgent;
 /**
 * Compose a three-token User-Agent string from a `{ name, version }` pair,
 * optionally appending a caller-supplied identifier.
 *
 * Used directly by socket-lib's own outbound requests (via
 * `getSocketCallerUserAgent`) and exported for sibling packages (socket-cli,
-* socket-sdk-js) so the fleet emits one canonical UA shape.
+* socket-sdk-js) so Socket emits one canonical UA shape.
 *
 * @example
 *   ;```typescript
@@ -40,9 +44,27 @@ node_process = require_runtime.__toESM(node_process);
 */
 function buildUserAgent(pkg, caller) {
 	const base = `${require_packages_specs.pkgNameToSlug(pkg.name)}/${pkg.version} node/${node_process.default.version} ${node_process.default.platform}/${node_process.default.arch}`;
-	return caller ? `${base} ${caller}` : base;
+	return caller ? chainUserAgents([base, caller]) : base;
+}
+/**
+* Chain User-Agent fragments into a breadcrumb trail, ordered identity → hop
+* (the immediate agent first, each forwarded caller after) so it reads
+* left-to-right and a server's UA parser buckets by the immediate agent. Each
+* fragment is sanitized; empties are dropped; an immediately-repeated fragment
+* is collapsed so re-proxying doesn't stutter the same hop twice.
+*
+* @example
+*   chainUserAgents(['socketsecurity-firewall-api-proxy/0.0.0', 'vlt/1.2.3'])
+*   // 'socketsecurity-firewall-api-proxy/0.0.0 vlt/1.2.3'
+*/
+function chainUserAgents(parts) {
+	const trail = [];
+	for (let i = 0, { length } = parts; i < length; i += 1) {
+		const clean = sanitizeUserAgent(parts[i]);
+		if (clean && trail[trail.length - 1] !== clean) require_primordials_array.ArrayPrototypePush(trail, clean);
+	}
+	return require_primordials_array.ArrayPrototypeJoin(trail, " ");
 }
-let cachedBaseUserAgent;
 /**
 * User-Agent header for socket-lib's own outbound HTTP requests.
 *
@@ -70,9 +92,29 @@ function getSocketCallerUserAgent() {
 		version: require_constants_socket.SOCKET_LIB_VERSION
 	});
 	const caller = require_env_rewire.getEnvValue("SOCKET_CALLER_USER_AGENT");
-	return caller?.trim() ? `${cachedBaseUserAgent} ${caller}` : cachedBaseUserAgent;
+	return chainUserAgents([cachedBaseUserAgent, caller]);
+}
+/**
+* Sanitize a single User-Agent fragment for safe inclusion in an outgoing HTTP
+* header. A caller identifier (`SOCKET_CALLER_USER_AGENT`, or a UA a proxy
+* forwards on behalf of its client) is untrusted, so strip control chars (C0
+* incl. CR/LF — the header- and log-injection vector — DEL, and C1), collapse
+* internal whitespace to one space, trim, and cap length. Returns '' for
+* nullish / blank / all-control input.
+*/
+function sanitizeUserAgent(value) {
+	if (!value) return "";
+	let cleaned = "";
+	for (let i = 0, { length } = value; i < length; i += 1) {
+		const code = require_primordials_string.StringPrototypeCharCodeAt(value, i);
+		cleaned += code < 32 || code >= 127 && code <= 159 ? " " : require_primordials_string.StringPrototypeCharAt(value, i);
+	}
+	cleaned = require_primordials_string.StringPrototypeTrim(require_primordials_string.StringPrototypeReplace(cleaned, /\s+/g, " "));
+	return cleaned.length > MAX_USER_AGENT_LENGTH ? require_primordials_string.StringPrototypeTrim(require_primordials_string.StringPrototypeSlice(cleaned, 0, MAX_USER_AGENT_LENGTH)) : cleaned;
 }
 
 //#endregion
 exports.buildUserAgent = buildUserAgent;
-exports.getSocketCallerUserAgent = getSocketCallerUserAgent;
+exports.chainUserAgents = chainUserAgents;
+exports.getSocketCallerUserAgent = getSocketCallerUserAgent;
+exports.sanitizeUserAgent = sanitizeUserAgent;

package/dist/integrity.d.ts

@@ -1,6 +1,6 @@
 /**
  * SRI-blessed hash algorithms. The W3C set; the prefix is part of the wire
- * format, not a fleet convention.
+ * format, not a Socket convention.
  */
 export type HashAlgorithm = 'sha256' | 'sha384' | 'sha512';
 /**
@@ -209,5 +209,7 @@ export declare class HashMismatchError extends Error {
 /**
  * @deprecated Renamed to {@link HashMismatchError}. Alias kept for callers that
  *   catch the old name.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare const DlxHashMismatchError: typeof HashMismatchError;

package/dist/integrity.js

@@ -127,7 +127,7 @@ function equalHashes(a, b) {
 function integrityToChecksum(input) {
 	if (isChecksum(input)) return input;
 	const parsed = parseIntegrity(input);
-	if (parsed.algorithm !== "sha256") throw new require_primordials_error.TypeErrorCtor(`integrityToChecksum: ${parsed.algorithm} integrity has no 64-hex-char checksum form — checksums are sha256-only by fleet convention. Use parseHash(x).hex for any algorithm.`);
+	if (parsed.algorithm !== "sha256") throw new require_primordials_error.TypeErrorCtor(`integrityToChecksum: ${parsed.algorithm} integrity has no 64-hex-char checksum form — checksums are sha256-only by Socket convention. Use parseHash(x).hex for any algorithm.`);
 	return require_primordials_buffer.BufferPrototypeToString(require_primordials_buffer.BufferFrom(parsed.body, "base64"), "hex");
 }
 /**
@@ -277,6 +277,8 @@ var HashMismatchError = class extends Error {
 /**
 * @deprecated Renamed to {@link HashMismatchError}. Alias kept for callers that
 *   catch the old name.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 const DlxHashMismatchError = HashMismatchError;
 

package/dist/json/format.js

@@ -166,7 +166,10 @@ function shouldSave(currentContent, originalContent, originalFileContent, option
 function sortKeys(obj) {
 	const sorted = { __proto__: null };
 	const keys = require_primordials_object.ObjectKeys(obj).toSorted();
-	for (const key of keys) sorted[key] = obj[key];
+	for (let i = 0, { length } = keys; i < length; i += 1) {
+		const key = keys[i];
+		sorted[key] = obj[key];
+	}
 	return sorted;
 }
 /**

package/dist/logger/_internal.d.ts

@@ -3,7 +3,7 @@
  *   public `Logger` surface) and `logger/console-init` (which mutates
  *   `Logger.prototype` to mirror `globalConsole`). The `_` prefix keeps this
  *   module out of the generated package.json `exports` map (the `dist/**\/_*`
- *   ignore pattern in `scripts/post-build/make-package-exports.mts` filters it
+ *   ignore pattern in `scripts/fleet/make-package-exports.mts` filters it
  *   out), so it is not part of the public surface — it exists only to give the
  *   two leaves above a common owner for the WeakMap-backed lazy-init state. Why
  *   two WeakMaps instead of `#privateField` slots:
@@ -43,22 +43,20 @@ export declare const consolePropAttributes: {
 export declare const maxIndentation = 1000;
 /**
  * Pre-bound copies of the console methods that need their original `this` to
- * function (e.g., `console.error.bind(globalConsole)`). Mapping `[name,
- * boundFn]` so `console-init.ts` can apply them onto the per-instance Console
- * without re-binding on every call.
+ * function (e.g., `console.error.bind(globalConsole)`). Returns `[name,
+ * boundFn]` pairs so `console-init.ts` can apply them onto the per-instance
+ * Console without re-binding on every call.
  *
- * Notes from the upstream Node implementation:
- *
- * - `_stderrErrorHandler` / `_stdoutErrorHandler` are `kBindProperties`
- *   properties — they live on the per-instance Console and need their `this`
- *   set to `globalConsole`.
- *   https://github.com/nodejs/node/blob/v24.0.1/lib/internal/console/constructor.js#L230-L265
- * - `group` / `groupCollapsed` / `groupEnd` are explicitly skipped because Node
- *   20 with `--frozen-intrinsics` makes `Symbol(kGroupIndent)` read-only, which
- *   the Logger's own group methods avoid by tracking indentation at the prefix
- *   layer.
+ * Built LAZILY (memoized) rather than at module-eval: `fn.bind(globalConsole)`
+ * of a native console method produces a bound function wrapping a native C++
+ * function pointer, which serializes as an unresolvable external reference and
+ * aborts V8 --build-snapshot. Deferring construction to first Console build
+ * keeps the bind-once/reuse win while leaving module import snapshot-safe.
  */
-export declare const boundConsoleEntries: [string, (...args: unknown[]) => unknown][];
+export declare function getBoundConsoleEntries(): Array<[
+    string,
+    (...args: unknown[]) => unknown
+]>;
 /**
  * WeakMap storing the Console instance for each Logger.
  *

package/dist/logger/_internal.js

@@ -9,7 +9,7 @@ const require_primordials_map_set = require('../primordials/map-set.js');
 *   public `Logger` surface) and `logger/console-init` (which mutates
 *   `Logger.prototype` to mirror `globalConsole`). The `_` prefix keeps this
 *   module out of the generated package.json `exports` map (the `dist/**\/_*`
-*   ignore pattern in `scripts/post-build/make-package-exports.mts` filters it
+*   ignore pattern in `scripts/fleet/make-package-exports.mts` filters it
 *   out), so it is not part of the public surface — it exists only to give the
 *   two leaves above a common owner for the WeakMap-backed lazy-init state. Why
 *   two WeakMaps instead of `#privateField` slots:
@@ -47,24 +47,7 @@ const consolePropAttributes = {
 * huge `n` can't allocate a multi-megabyte string.
 */
 const maxIndentation = 1e3;
-/**
-* Pre-bound copies of the console methods that need their original `this` to
-* function (e.g., `console.error.bind(globalConsole)`). Mapping `[name,
-* boundFn]` so `console-init.ts` can apply them onto the per-instance Console
-* without re-binding on every call.
-*
-* Notes from the upstream Node implementation:
-*
-* - `_stderrErrorHandler` / `_stdoutErrorHandler` are `kBindProperties`
-*   properties — they live on the per-instance Console and need their `this`
-*   set to `globalConsole`.
-*   https://github.com/nodejs/node/blob/v24.0.1/lib/internal/console/constructor.js#L230-L265
-* - `group` / `groupCollapsed` / `groupEnd` are explicitly skipped because Node
-*   20 with `--frozen-intrinsics` makes `Symbol(kGroupIndent)` read-only, which
-*   the Logger's own group methods avoid by tracking indentation at the prefix
-*   layer.
-*/
-const boundConsoleEntries = [
+const boundConsoleMethodNames = [
 	"_stderrErrorHandler",
 	"_stdoutErrorHandler",
 	"assert",
@@ -84,7 +67,24 @@ const boundConsoleEntries = [
 	"timeLog",
 	"trace",
 	"warn"
-].filter((n) => typeof globalConsole[n] === "function").map((n) => [n, globalConsole[n].bind(globalConsole)]);
+];
+let boundConsoleEntries;
+/**
+* Pre-bound copies of the console methods that need their original `this` to
+* function (e.g., `console.error.bind(globalConsole)`). Returns `[name,
+* boundFn]` pairs so `console-init.ts` can apply them onto the per-instance
+* Console without re-binding on every call.
+*
+* Built LAZILY (memoized) rather than at module-eval: `fn.bind(globalConsole)`
+* of a native console method produces a bound function wrapping a native C++
+* function pointer, which serializes as an unresolvable external reference and
+* aborts V8 --build-snapshot. Deferring construction to first Console build
+* keeps the bind-once/reuse win while leaving module import snapshot-safe.
+*/
+function getBoundConsoleEntries() {
+	if (boundConsoleEntries === void 0) boundConsoleEntries = boundConsoleMethodNames.filter((n) => typeof globalConsole[n] === "function").map((n) => [n, globalConsole[n].bind(globalConsole)]);
+	return boundConsoleEntries;
+}
 /**
 * WeakMap storing the Console instance for each Logger.
 *
@@ -108,8 +108,8 @@ const privateConsole = new require_primordials_map_set.WeakMapCtor();
 const privateConstructorArgs = new require_primordials_map_set.WeakMapCtor();
 
 //#endregion
-exports.boundConsoleEntries = boundConsoleEntries;
 exports.consolePropAttributes = consolePropAttributes;
+exports.getBoundConsoleEntries = getBoundConsoleEntries;
 exports.globalConsole = globalConsole;
 exports.maxIndentation = maxIndentation;
 exports.privateConsole = privateConsole;

package/dist/logger/colors.d.ts

@@ -3,8 +3,13 @@
  *   `yoctocolors-cjs` palette so the logger can accept either a named color
  *   (`'green'`) or an explicit RGB tuple (`[255, 0, 0]`); RGB tuples are
  *   emitted via the 24-bit `[38;2;...m` escape because `yoctocolors-cjs`
- *   doesn't ship an `rgb()` helper.
+ *   doesn't ship an `rgb()` helper. The vendored palette re-exports from the
+ *   external-pack mega-bundle, whose module top-level evaluates every packed
+ *   package — so it is required lazily on first color application (Logger
+ *   construction at the earliest), keeping `logger/*` importers
+ *   browser-load-safe and cheap at module init.
  */
+import type yoctocolorsCjs from '../external/yoctocolors-cjs';
 import type { ColorValue } from '../colors/types';
 /**
  * Apply a color to text using yoctocolors. Handles both named colors and RGB
@@ -12,6 +17,7 @@ import type { ColorValue } from '../colors/types';
  */
 export declare function applyColor(text: string, color: ColorValue): string;
 /**
- * Get the yoctocolors module for terminal colors.
+ * Get the yoctocolors module for terminal colors. Required lazily on first
+ * call — see the @file note on the external-pack top-level.
  */
-export declare function getYoctocolors(): import("../external/yoctocolors-cjs").YoctoColors;
+export declare function getYoctocolors(): typeof yoctocolorsCjs;

package/dist/logger/colors.js

@@ -1,35 +1,28 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_runtime = require('../_virtual/_rolldown/runtime.js');
-let src_external_yoctocolors_cjs = require("../external/yoctocolors-cjs");
-src_external_yoctocolors_cjs = require_runtime.__toESM(src_external_yoctocolors_cjs);
 
 //#region src/logger/colors.ts
-/**
-* @file Color application helpers for `logger/*` modules. Wraps the vendored
-*   `yoctocolors-cjs` palette so the logger can accept either a named color
-*   (`'green'`) or an explicit RGB tuple (`[255, 0, 0]`); RGB tuples are
-*   emitted via the 24-bit `[38;2;...m` escape because `yoctocolors-cjs`
-*   doesn't ship an `rgb()` helper.
-*/
+let cachedYoctocolors;
 /**
 * Apply a color to text using yoctocolors. Handles both named colors and RGB
 * tuples.
 */
 function applyColor(text, color) {
 	if (typeof color === "string") {
-		const formatter = src_external_yoctocolors_cjs.default[color];
+		const formatter = getYoctocolors()[color];
 		return formatter ? formatter(text) : text;
 	}
 	const { 0: r, 1: g, 2: b } = color;
 	return `\u001B[38;2;${r};${g};${b}m${text}\u001B[39m`;
 }
 /**
-* Get the yoctocolors module for terminal colors.
+* Get the yoctocolors module for terminal colors. Required lazily on first
+* call — see the @file note on the external-pack top-level.
 */
 function getYoctocolors() {
-	return src_external_yoctocolors_cjs.default;
+	if (cachedYoctocolors === void 0) cachedYoctocolors = require("../external/yoctocolors-cjs");
+	return cachedYoctocolors;
 }
 
 //#endregion

package/dist/logger/console-methods.js

@@ -29,7 +29,7 @@ const require_logger_symbols = require('./symbols.js');
 * @param message - Optional message and additional arguments to log.
 */
 function assertMethod(logger, con, value, message) {
-	con.assert(value, message[0], ...message.slice(1));
+	con.assert(Boolean(value), message[0], ...message.slice(1));
 	logger[require_logger_symbols.lastWasBlankSymbol](false);
 	return value ? logger : logger[require_logger_symbols.incLogCallCountSymbol]();
 }
@@ -89,7 +89,7 @@ function dirxmlMethod(logger, con, data) {
 * @param properties - Optional array of property names to include.
 */
 function tableMethod(logger, con, tabularData, properties) {
-	con.table(tabularData, properties);
+	con.table(tabularData, properties ? [...properties] : void 0);
 	logger[require_logger_symbols.lastWasBlankSymbol](false);
 	return logger[require_logger_symbols.incLogCallCountSymbol]();
 }

package/dist/logger/console.d.ts

@@ -19,6 +19,7 @@
  *     `ensurePrototypeInitialized` actually runs, both modules are fully
  *     evaluated. Same pattern as `fs/path-cache` ↔ `fs/_internal`.
  */
+import type { Console } from 'node:console';
 import { Logger } from './node';
 /**
  * Construct a new Console instance.

package/dist/logger/console.js

@@ -7,8 +7,8 @@ const require_primordials_reflect = require('../primordials/reflect.js');
 const require_logger__internal = require('./_internal.js');
 const require_logger_symbols = require('./symbols.js');
 const require_logger_node = require('./node.js');
-let node_process = require("node:process");
-node_process = require_runtime.__toESM(node_process);
+let process = require("process");
+process = require_runtime.__toESM(process);
 
 //#region src/logger/console.ts
 /**
@@ -39,7 +39,7 @@ let prototypeInitialized = false;
 */
 function constructConsole(...args) {
 	/* c8 ignore next - Lazy-init second-call branch; module-singleton. */
-	if (cachedConsole === void 0) cachedConsole = (/* @__PURE__ */ require("node:console")).Console;
+	if (cachedConsole === void 0) cachedConsole = (/* @__PURE__ */ require("console")).Console;
 	return require_primordials_reflect.ReflectConstruct(cachedConsole, args);
 }
 /**
@@ -70,10 +70,10 @@ function ensurePrototypeInitialized() {
 				if (ctorArgs.length) con = constructConsole(...ctorArgs);
 				else {
 					con = constructConsole({
-						stdout: node_process.default.stdout,
-						stderr: node_process.default.stderr
+						stdout: process.default.stdout,
+						stderr: process.default.stderr
 					});
-					for (const { 0: k, 1: method } of require_logger__internal.boundConsoleEntries) con[k] = method;
+					for (const { 0: k, 1: method } of require_logger__internal.getBoundConsoleEntries()) con[k] = method;
 				}
 				require_logger__internal.privateConsole.set(this, con);
 			}
@@ -109,10 +109,10 @@ function resolveConsole(logger) {
 		if (ctorArgs.length) con = constructConsole(...ctorArgs);
 		else {
 			con = constructConsole({
-				stdout: node_process.default.stdout,
-				stderr: node_process.default.stderr
+				stdout: process.default.stdout,
+				stderr: process.default.stderr
 			});
-			for (const { 0: key, 1: method } of require_logger__internal.boundConsoleEntries) con[key] = method;
+			for (const { 0: key, 1: method } of require_logger__internal.getBoundConsoleEntries()) con[key] = method;
 		}
 		require_logger__internal.privateConsole.set(logger, con);
 		require_logger__internal.privateConstructorArgs.delete(logger);

package/dist/logger/node.js

@@ -106,7 +106,8 @@ var Logger = class Logger {
 		else root.#stdoutLastWasBlank = value;
 	}
 	#streamChild(stream) {
-		const instance = new Logger(...require_logger__internal.privateConstructorArgs.get(this) ?? []);
+		const ctorArgs = require_logger__internal.privateConstructorArgs.get(this) ?? [];
+		const instance = new Logger(...ctorArgs);
 		instance.#parent = this;
 		instance.#boundStream = stream;
 		instance.#options = {

package/dist/native-messaging/install.js

@@ -9,11 +9,11 @@ const require_env_windows = require('../env/windows.js');
 const require_constants_node = require('../constants/node.js');
 const require_env_node_version_managers = require('../env/node-version-managers.js');
 let node_fs = require("node:fs");
+let node_url = require("node:url");
 let node_process = require("node:process");
 node_process = require_runtime.__toESM(node_process);
 let node_path = require("node:path");
 node_path = require_runtime.__toESM(node_path);
-let node_url = require("node:url");
 let _socketsecurity_lib_stable_process_spawn_child = require("@socketsecurity/lib-stable/process/spawn/child");
 
 //#region src/native-messaging/install.ts

package/dist/native-messaging/rate-limit.d.ts

@@ -14,7 +14,7 @@
  *   That's exactly what we want: an attacker who can force Chrome to relaunch
  *   has bigger problems than rate-limiting. Shape patterned after pilcrow's
  *   `ratelimit/limit.go` — minimal, in-memory, LRU-evicts at `maxKeys`. The
- *   fleet's `socket-lib` already has a TTL-cache module but it's overkill for
+ *   Socket's `socket-lib` already has a TTL-cache module but it's overkill for
  *   this one use case; a 50-line bucket is easier to audit.
  */
 export interface TokenBucketOptions {
@@ -45,6 +45,9 @@ export interface BucketEntry {
     older: BucketEntry | undefined;
     key: string;
 }
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare class TokenBucketLimiter {
     #private;
     constructor(options: TokenBucketOptions);

package/dist/native-messaging/rate-limit.js

@@ -20,9 +20,12 @@ const require_primordials_error = require('../primordials/error.js');
 *   That's exactly what we want: an attacker who can force Chrome to relaunch
 *   has bigger problems than rate-limiting. Shape patterned after pilcrow's
 *   `ratelimit/limit.go` — minimal, in-memory, LRU-evicts at `maxKeys`. The
-*   fleet's `socket-lib` already has a TTL-cache module but it's overkill for
+*   Socket's `socket-lib` already has a TTL-cache module but it's overkill for
 *   this one use case; a 50-line bucket is easier to audit.
 */
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 var TokenBucketLimiter = class {
 	#capacity;
 	#refillIntervalMs;

package/dist/node/events.d.ts

@@ -3,4 +3,7 @@
  *   rationale shared across all `node/*.ts` lazy-loaders.
  */
 import type * as NodeEvents from 'node:events';
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function getNodeEvents(): typeof NodeEvents;

package/dist/node/events.js

@@ -5,6 +5,9 @@ const require_constants_runtime = require('../constants/runtime.js');
 
 //#region src/node/events.ts
 let events;
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 function getNodeEvents() {
 	if (!require_constants_runtime.IS_NODE) return;
 	return events ??= /*@__PURE__*/ require("events");

package/dist/node/fs.d.ts

@@ -12,7 +12,7 @@
  *   load-time snapshot. Two surfaces: `getNodeFs()` returns the module object
  *   with LATE method lookup (spy-able — the test seam); the `fs<Method>` consts
  *   (`fsExistsSync`, `fsReadFileSync`, …) are method references FROZEN at load
- *   (tamper-proof against a method swap, not spy-able), for the fleet's hot fs
+ *   (tamper-proof against a method swap, not spy-able), for Socket's hot fs
  *   calls. Both stay browser-safe behind IS_NODE + `/*@__PURE__*\/`.
  */
 import type * as NodeFs from 'node:fs';

package/dist/node/timers-promises.d.ts

@@ -3,4 +3,7 @@
  *   rationale shared across all `node/*.ts` lazy-loaders.
  */
 import type * as NodeTimersPromises from 'node:timers/promises';
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function getNodeTimersPromises(): typeof NodeTimersPromises;