@socketsecurity/lib 6.0.9 → 6.0.10

package/dist/constants/node.js

@@ -106,6 +106,8 @@ function getNodeNoWarningsFlags() {
 * Get the patch component of the current Node.js version.
 *
 * @returns The patch version number, or `0` if it cannot be parsed.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function getNodePatchVersion() {
 	/* c8 ignore start */
@@ -142,6 +144,8 @@ function getNodeVersion() {
 * API. The API is available on Node.js 24+.
 *
 * @returns `true` when the current runtime is Node.js 24 or newer.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function supportsNodeCompileCacheApi() {
 	return getNodeMajorVersion() >= 24;
@@ -151,6 +155,8 @@ function supportsNodeCompileCacheApi() {
 * Env-var-based compile caching is available on Node.js 22+.
 *
 * @returns `true` when the current runtime is Node.js 22 or newer.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function supportsNodeCompileCacheEnvVar() {
 	return getNodeMajorVersion() >= 22;
@@ -180,6 +186,8 @@ function supportsNodeDisableSigusr1Flag() {
 * The flag is available on Node.js 21+.
 *
 * @returns `true` when the current runtime is Node.js 21 or newer.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function supportsNodeDisableWarningFlag() {
 	return getNodeMajorVersion() >= 21;
@@ -189,6 +197,8 @@ function supportsNodeDisableWarningFlag() {
 * (`--experimental-permission` on Node 20-23, `--permission` on Node 24+).
 *
 * @returns `true` when the current runtime is Node.js 20 or newer.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function supportsNodePermissionFlag() {
 	return getNodeMajorVersion() >= 20;
@@ -198,6 +208,8 @@ function supportsNodePermissionFlag() {
 * Node.js 22.12+ or Node.js 23+.
 *
 * @returns `true` when the runtime supports `require()`-ing ES modules.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function supportsNodeRequireModule() {
 	const major = getNodeMajorVersion();
@@ -253,6 +265,8 @@ function supportsNodeStripTypesDefault() {
 * `process.send()` is callable to message the parent process.
 *
 * @returns `true` when the current process has an IPC channel to its parent.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function supportsProcessSend() {
 	return typeof node_process.default.send === "function";

package/dist/constants/package-default-node-range.js

@@ -1,17 +1,13 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_constants_maintained_node_versions = require('./maintained-node-versions.js');
-let src_external_semver = require("../external/semver");
-src_external_semver = require_runtime.__toESM(src_external_semver);
 
 //#region src/constants/package-default-node-range.ts
 /**
 * @file Default Node.js version range for packages.
 */
-/* c8 ignore next - External semver call */
-const packageDefaultNodeRange = `>=${src_external_semver.parse(require_constants_maintained_node_versions.maintainedNodeVersions.last).major}`;
+const packageDefaultNodeRange = `>=${Number.parseInt(require_constants_maintained_node_versions.maintainedNodeVersions.last, 10)}`;
 
 //#endregion
 exports.packageDefaultNodeRange = packageDefaultNodeRange;

package/dist/constants/packages.d.ts

@@ -11,8 +11,13 @@ export declare const PACKAGE_DEFAULT_VERSION = "1.0.0";
 /**
  * Clear the packument cache. Useful for long-running processes that want to
  * force a re-fetch of registry metadata.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare function clearPackumentCache(): void;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function getLifecycleScriptNames(): string[];
 export declare function getPackageDefaultNodeRange(): string | undefined;
 export declare function getPackageDefaultSocketCategories(): readonly string[];

package/dist/constants/packages.js

@@ -33,11 +33,16 @@ const PACKAGE_DEFAULT_VERSION = "1.0.0";
 /**
 * Clear the packument cache. Useful for long-running processes that want to
 * force a re-fetch of registry metadata.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function clearPackumentCache() {
 	/* c8 ignore next 3 - uninitialized-cache branch unreachable in tests */
 	if (cachedPackumentCache !== void 0) cachedPackumentCache.clear();
 }
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 function getLifecycleScriptNames() {
 	if (cachedLifecycleScriptNames === void 0) cachedLifecycleScriptNames = require_primordials_array.ArrayFrom(require_constants_lifecycle_script_names.lifecycleScriptNames);
 	return cachedLifecycleScriptNames;

package/dist/constants/platform.d.ts

@@ -34,7 +34,7 @@ export declare function getOs(): Platform;
  * Get the current host **target** in the pnpm `pack-app` vocabulary (memoized):
  * `<os>-<arch>[-<libc>]`, e.g. `darwin-arm64`, `linux-x64`, `win32-x64`,
  * `linux-x64-musl`. Raw Node `process.platform`/`process.arch` joined with `-`,
- * plus a `-musl` suffix on Alpine. This is the fleet-general naming for
+ * plus a `-musl` suffix on Alpine. This is the Socket-wide naming for
  * non-python / non-JRE tools (matches pnpm's release assets,
  * `pnpm-<os>-<arch>[-<libc>].{tar.gz,zip}`). Tool-specific resolvers that need
  * a different vocabulary own their own helper — see `getPythonArch`

package/dist/constants/platform.js

@@ -60,7 +60,7 @@ let memoizedTarget;
 * Get the current host **target** in the pnpm `pack-app` vocabulary (memoized):
 * `<os>-<arch>[-<libc>]`, e.g. `darwin-arm64`, `linux-x64`, `win32-x64`,
 * `linux-x64-musl`. Raw Node `process.platform`/`process.arch` joined with `-`,
-* plus a `-musl` suffix on Alpine. This is the fleet-general naming for
+* plus a `-musl` suffix on Alpine. This is the Socket-wide naming for
 * non-python / non-JRE tools (matches pnpm's release assets,
 * `pnpm-<os>-<arch>[-<libc>].{tar.gz,zip}`). Tool-specific resolvers that need
 * a different vocabulary own their own helper — see `getPythonArch`

package/dist/constants/socket.js

@@ -35,7 +35,7 @@ const SOCKET_DIR = {
 	wheelhouse: `${"_"}wheelhouse`
 };
 const SOCKET_LIB_NAME = "@socketsecurity/lib";
-const SOCKET_LIB_VERSION = "6.0.9";
+const SOCKET_LIB_VERSION = "6.0.10";
 const SOCKET_IPC_HANDSHAKE = "SOCKET_IPC_HANDSHAKE";
 const CACHE_SOCKET_API_DIR = "socket-api";
 const REGISTRY = "registry";

package/dist/constants/typescript.d.ts

@@ -8,6 +8,11 @@
  * project by probing `typescript/lib`.
  *
  * @returns `true` when the `typescript` package's libs can be resolved.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare function getTsLibsAvailable(): boolean;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function getTsTypesAvailable(): boolean;

package/dist/constants/typescript.js

@@ -13,6 +13,8 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 * project by probing `typescript/lib`.
 *
 * @returns `true` when the `typescript` package's libs can be resolved.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function getTsLibsAvailable() {
 	try {
@@ -22,6 +24,9 @@ function getTsLibsAvailable() {
 		return false;
 	}
 }
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 function getTsTypesAvailable() {
 	try {
 		require.resolve("typescript/lib/lib.d.ts");

package/dist/debug/_internal.d.ts

@@ -1,12 +1,18 @@
 /**
- * @file Private internals for `debug/*` modules — the cached logger instance,
- *   lazy `node:util` accessor, the `debugByNamespace` cache that
- *   `namespace.getDebugJsInstance` fills, the lazy `pointingTriangle` glyph
- *   used by every output function, and `customLog` (the `debug-js` log-writer
- *   override). Co-located so the namespace / output / caller-info leaves don't
- *   fragment ownership of this shared module state.
+ * @file Private internals for `debug/*` modules — the lazy debug-js accessor,
+ *   the `debugByNamespace` cache that `namespace.getDebugJsInstance` fills,
+ *   the lazy `pointingTriangle` glyph used by every output function, and
+ *   `customLog` (the `debug-js` log-writer override). Node-bound pieces are
+ *   deferred to first use — the vendored debug-js bundle is required lazily
+ *   (its module top-level reads env / requires tty), the default `Logger` is
+ *   constructed per call via the already-lazy `getDefaultLogger`, and
+ *   `node:util` loads through the `getNodeUtil` accessor. Every call site
+ *   sits behind the SOCKET_DEBUG / DEBUG env gates, so importing a `debug/*`
+ *   leaf stays browser-load-safe and V8-snapshot-safe. Co-located so the
+ *   namespace / output / caller-info leaves don't fragment ownership of this
+ *   shared module state.
  */
-export declare const logger: import("../logger/node").Logger;
+import type debugJs from '../external/debug';
 export declare const debugByNamespace: Map<any, any>;
 export { getNodeUtil as getUtil } from '../node/util';
 /**
@@ -15,6 +21,15 @@ export { getNodeUtil as getUtil } from '../node/util';
  * @private
  */
 export declare function customLog(...args: unknown[]): void;
+/**
+ * Lazily require the vendored `debug-js` bundle. Deferred to first use so
+ * importing a `debug/*` leaf never evaluates debug-js's node-bound module
+ * top-level (tty/util requires, process.env reads); every caller sits behind
+ * the env gates, so browser bundles load this leaf without executing it.
+ *
+ * @private
+ */
+export declare function getDebugJs(): typeof debugJs;
 /**
  * Lazily resolve the "pointing triangle" glyph — `▸` on terminals with unicode
  * support, `>` everywhere else. Initialised on first call by the output

package/dist/debug/_internal.js

@@ -8,20 +8,24 @@ const require_logger_default = require('../logger/default.js');
 const require_node_util = require('../node/util.js');
 let src_external__socketregistry_is_unicode_supported = require("../external/@socketregistry/is-unicode-supported");
 src_external__socketregistry_is_unicode_supported = require_runtime.__toESM(src_external__socketregistry_is_unicode_supported);
-let src_external_debug = require("../external/debug");
-src_external_debug = require_runtime.__toESM(src_external_debug);
 
 //#region src/debug/_internal.ts
 /**
-* @file Private internals for `debug/*` modules — the cached logger instance,
-*   lazy `node:util` accessor, the `debugByNamespace` cache that
-*   `namespace.getDebugJsInstance` fills, the lazy `pointingTriangle` glyph
-*   used by every output function, and `customLog` (the `debug-js` log-writer
-*   override). Co-located so the namespace / output / caller-info leaves don't
-*   fragment ownership of this shared module state.
+* @file Private internals for `debug/*` modules — the lazy debug-js accessor,
+*   the `debugByNamespace` cache that `namespace.getDebugJsInstance` fills,
+*   the lazy `pointingTriangle` glyph used by every output function, and
+*   `customLog` (the `debug-js` log-writer override). Node-bound pieces are
+*   deferred to first use — the vendored debug-js bundle is required lazily
+*   (its module top-level reads env / requires tty), the default `Logger` is
+*   constructed per call via the already-lazy `getDefaultLogger`, and
+*   `node:util` loads through the `getNodeUtil` accessor. Every call site
+*   sits behind the SOCKET_DEBUG / DEBUG env gates, so importing a `debug/*`
+*   leaf stays browser-load-safe and V8-snapshot-safe. Co-located so the
+*   namespace / output / caller-info leaves don't fragment ownership of this
+*   shared module state.
 */
-const logger = require_logger_default.getDefaultLogger();
 const debugByNamespace = new require_primordials_map_set.MapCtor();
+let cachedDebugJs;
 let pointingTriangle;
 /**
 * Custom log function for debug output.
@@ -34,15 +38,29 @@ set at the right module-load timing. Tests use the SOCKET_DEBUG
 path which writes via logger.info directly. */
 function customLog(...args) {
 	const util = require_node_util.getNodeUtil();
-	const inspectOpts = src_external_debug.default.inspectOpts ? {
-		...src_external_debug.default.inspectOpts,
-		showHidden: src_external_debug.default.inspectOpts.showHidden === null ? void 0 : src_external_debug.default.inspectOpts.showHidden,
-		depth: src_external_debug.default.inspectOpts.depth === null || typeof src_external_debug.default.inspectOpts.depth === "boolean" ? void 0 : src_external_debug.default.inspectOpts.depth
+	const debugJsInstance = getDebugJs();
+	const inspectOpts = debugJsInstance.inspectOpts ? {
+		...debugJsInstance.inspectOpts,
+		showHidden: debugJsInstance.inspectOpts.showHidden === null ? void 0 : debugJsInstance.inspectOpts.showHidden,
+		depth: debugJsInstance.inspectOpts.depth === null || typeof debugJsInstance.inspectOpts.depth === "boolean" ? void 0 : debugJsInstance.inspectOpts.depth
 	} : {};
+	const logger = require_logger_default.getDefaultLogger();
 	require_primordials_reflect.ReflectApply(logger.info, logger, [util.formatWithOptions(inspectOpts, ...args)]);
 }
 /* c8 ignore stop */
 /**
+* Lazily require the vendored `debug-js` bundle. Deferred to first use so
+* importing a `debug/*` leaf never evaluates debug-js's node-bound module
+* top-level (tty/util requires, process.env reads); every caller sits behind
+* the env gates, so browser bundles load this leaf without executing it.
+*
+* @private
+*/
+function getDebugJs() {
+	if (cachedDebugJs === void 0) cachedDebugJs = require("../external/debug");
+	return cachedDebugJs;
+}
+/**
 * Lazily resolve the "pointing triangle" glyph — `▸` on terminals with unicode
 * support, `>` everywhere else. Initialised on first call by the output
 * functions.
@@ -61,6 +79,6 @@ function getPointingTriangle() {
 //#endregion
 exports.customLog = customLog;
 exports.debugByNamespace = debugByNamespace;
+exports.getDebugJs = getDebugJs;
 exports.getPointingTriangle = getPointingTriangle;
-exports.getUtil = require_node_util.getNodeUtil;
-exports.logger = logger;
+exports.getUtil = require_node_util.getNodeUtil;

package/dist/debug/namespace.js

@@ -1,13 +1,10 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_primordials_string = require('../primordials/string.js');
 const require_env_debug = require('../env/debug.js');
 const require_env_socket = require('../env/socket.js');
 const require_debug__internal = require('./_internal.js');
-let src_external_debug = require("../external/debug");
-src_external_debug = require_runtime.__toESM(src_external_debug);
 
 //#region src/debug/namespace.ts
 /**
@@ -39,12 +36,15 @@ function extractOptions(namespaces) {
 */
 function getDebugJsInstance(namespace) {
 	let inst = require_debug__internal.debugByNamespace.get(namespace);
-	/* c8 ignore start */
+	/* c8 ignore start - cache-hit arm needs a repeated same-namespace probe */
 	if (inst) return inst;
-	if (!require_env_debug.getDebug() && require_env_socket.getSocketDebug() && (namespace === "error" || namespace === "notice")) src_external_debug.default.enable(namespace);
+	/* c8 ignore stop */
+	const debugJs = require_debug__internal.getDebugJs();
+	/* c8 ignore start - error/notice auto-enable needs SOCKET_DEBUG without DEBUG */
+	if (!require_env_debug.getDebug() && require_env_socket.getSocketDebug() && (namespace === "error" || namespace === "notice")) debugJs.enable(namespace);
 	/* c8 ignore stop */
 	/* c8 ignore next - External debug library call */
-	inst = (0, src_external_debug.default)(namespace);
+	inst = debugJs(namespace);
 	inst.log = require_debug__internal.customLog;
 	require_debug__internal.debugByNamespace.set(namespace, inst);
 	return inst;
@@ -72,8 +72,11 @@ function isEnabled(namespaces) {
 	const split = namespaces.trim().replace(/\s+/g, ",").split(",").filter(Boolean);
 	const names = [];
 	const skips = [];
-	for (const ns of split) if (require_primordials_string.StringPrototypeStartsWith(ns, "-")) skips.push(ns.slice(1));
-	else names.push(ns);
+	for (let i = 0, { length } = split; i < length; i += 1) {
+		const ns = split[i];
+		if (require_primordials_string.StringPrototypeStartsWith(ns, "-")) skips.push(ns.slice(1));
+		else names.push(ns);
+	}
 	if (names.length && !names.some((ns) => getDebugJsInstance(ns).enabled)) return false;
 	return skips.every((ns) => !getDebugJsInstance(ns).enabled);
 }

package/dist/debug/output.d.ts

@@ -6,6 +6,7 @@
  *   active spinner across the write, and uses the lazy `pointingTriangle` glyph
  *   for the divider.
  */
+import type { SpinnerInstance } from '../spinner/types';
 import type { InspectOptions, NamespacesOrOptions } from './types';
 /**
  * Debug output with caller info (wrapper for debugNs with default namespace).
@@ -52,7 +53,7 @@ export declare function debugNs(namespacesOrOpts: NamespacesOrOptions, ...args:
  * Create a Node.js util.debuglog compatible function. Returns a function that
  * conditionally writes debug messages to stderr.
  */
-export declare function debuglog(section: string): import("util").DebugLogger;
+export declare function debuglog(section: string): import("node:util").DebugLogger;
 /**
  * Create timing functions for measuring code execution time. Returns an object
  * with start() and end() methods, plus a callable function.
@@ -62,3 +63,13 @@ export declare function debugtime(label: string): {
     start: () => void;
     end: () => void;
 };
+/**
+ * Resolve the default spinner on Node; off Node (browser bundles) there is no
+ * spinner — callers no-op through their optional chains. Construction is
+ * deferred to first debug write (every call site sits behind the `isEnabled`
+ * / `getSocketDebug` gates), so a browser bundle never constructs the
+ * node-bound spinner even when debug output is force-enabled.
+ *
+ * @private
+ */
+export declare function getSpinner(): SpinnerInstance | undefined;

package/dist/debug/output.js

@@ -1,19 +1,18 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_constants_runtime = require('../constants/runtime.js');
 const require_primordials_array = require('../primordials/array.js');
 const require_primordials_date = require('../primordials/date.js');
 const require_primordials_reflect = require('../primordials/reflect.js');
 const require_strings_format = require('../strings/format.js');
+const require_logger_default = require('../logger/default.js');
 const require_env_socket = require('../env/socket.js');
 const require_node_util = require('../node/util.js');
 const require_debug__internal = require('./_internal.js');
 const require_debug_namespace = require('./namespace.js');
 const require_spinner_default = require('../spinner/default.js');
 const require_debug_caller_info = require('./caller-info.js');
-let src_external_debug = require("../external/debug");
-src_external_debug = require_runtime.__toESM(src_external_debug);
 
 //#region src/debug/output.ts
 /**
@@ -43,7 +42,8 @@ function debugCache(operation, key, meta) {
 	if (!require_env_socket.getSocketDebug()) return;
 	const prefix = `[CACHE] ${require_debug_caller_info.getCallerInfo(3) || "cache"} ${require_debug__internal.getPointingTriangle()} ${operation}: ${key}`;
 	const args = meta !== void 0 ? [prefix, meta] : [prefix];
-	require_primordials_reflect.ReflectApply(require_debug__internal.logger.info, require_debug__internal.logger, args);
+	const logger = require_logger_default.getDefaultLogger();
+	require_primordials_reflect.ReflectApply(logger.info, logger, args);
 }
 /**
 * Debug output for cache operations with caller info. First argument is the
@@ -56,10 +56,11 @@ function debugCacheNs(namespacesOrOpts, operation, key, meta) {
 	if (!require_debug_namespace.isEnabled(namespaces)) return;
 	const prefix = `[CACHE] ${require_debug_caller_info.getCallerInfo(4) || "cache"} ${require_debug__internal.getPointingTriangle()} ${operation}: ${key}`;
 	const logArgs = meta !== void 0 ? [prefix, meta] : [prefix];
-	const spinnerInstance = options.spinner || require_spinner_default.getDefaultSpinner();
+	const spinnerInstance = options.spinner || getSpinner();
 	const wasSpinning = spinnerInstance?.isSpinning;
 	spinnerInstance?.stop();
-	require_primordials_reflect.ReflectApply(require_debug__internal.logger.info, require_debug__internal.logger, logArgs);
+	const logger = require_logger_default.getDefaultLogger();
+	require_primordials_reflect.ReflectApply(logger.info, logger, logArgs);
 	if (wasSpinning) spinnerInstance?.start();
 }
 /**
@@ -81,9 +82,9 @@ function debugDirNs(namespacesOrOpts, obj, inspectOpts) {
 	/* c8 ignore stop */
 	const pointingTriangle = require_debug__internal.getPointingTriangle();
 	let opts = inspectOpts;
-	/* c8 ignore start */
+	/* c8 ignore start - inspectOpts fallback needs DEBUG_INSPECT_OPTIONS env */
 	if (opts === void 0) {
-		const debugOpts = src_external_debug.default.inspectOpts;
+		const debugOpts = require_debug__internal.getDebugJs().inspectOpts;
 		if (debugOpts) opts = {
 			...debugOpts,
 			showHidden: debugOpts.showHidden === null ? void 0 : debugOpts.showHidden,
@@ -91,11 +92,12 @@ function debugDirNs(namespacesOrOpts, obj, inspectOpts) {
 		};
 	}
 	/* c8 ignore stop */
-	const spinnerInstance = options.spinner || require_spinner_default.getDefaultSpinner();
+	const spinnerInstance = options.spinner || getSpinner();
 	const wasSpinning = spinnerInstance?.isSpinning;
 	spinnerInstance?.stop();
-	require_debug__internal.logger.info(`[DEBUG] ${callerName} ${pointingTriangle} object inspection:`);
-	require_debug__internal.logger.dir(obj, inspectOpts);
+	const logger = require_logger_default.getDefaultLogger();
+	logger.info(`[DEBUG] ${callerName} ${pointingTriangle} object inspection:`);
+	logger.dir(obj, inspectOpts);
 	if (wasSpinning) spinnerInstance?.start();
 }
 /**
@@ -117,10 +119,11 @@ function debugLogNs(namespacesOrOpts, ...args) {
 	const pointingTriangle = require_debug__internal.getPointingTriangle();
 	const text = require_primordials_array.ArrayPrototypeAt(args, 0);
 	const logArgs = typeof text === "string" ? [require_strings_format.applyLinePrefix(`${callerName} ${pointingTriangle} ${text}`, { prefix: "[DEBUG] " }), ...require_primordials_array.ArrayPrototypeSlice(args, 1)] : [`[DEBUG] ${callerName} ${pointingTriangle}`, ...args];
-	const spinnerInstance = options.spinner || require_spinner_default.getDefaultSpinner();
+	const spinnerInstance = options.spinner || getSpinner();
 	const wasSpinning = spinnerInstance?.isSpinning;
 	spinnerInstance?.stop();
-	require_primordials_reflect.ReflectApply(require_debug__internal.logger.info, require_debug__internal.logger, logArgs);
+	const logger = require_logger_default.getDefaultLogger();
+	require_primordials_reflect.ReflectApply(logger.info, logger, logArgs);
 	if (wasSpinning) spinnerInstance?.start();
 }
 /**
@@ -136,10 +139,11 @@ function debugNs(namespacesOrOpts, ...args) {
 	const pointingTriangle = require_debug__internal.getPointingTriangle();
 	const text = require_primordials_array.ArrayPrototypeAt(args, 0);
 	const logArgs = typeof text === "string" ? [require_strings_format.applyLinePrefix(`${name} ${pointingTriangle} ${text}`, { prefix: "[DEBUG] " }), ...require_primordials_array.ArrayPrototypeSlice(args, 1)] : args;
-	const spinnerInstance = options.spinner || require_spinner_default.getDefaultSpinner();
+	const spinnerInstance = options.spinner || getSpinner();
 	const wasSpinning = spinnerInstance?.isSpinning;
 	spinnerInstance?.stop();
-	require_primordials_reflect.ReflectApply(require_debug__internal.logger.info, require_debug__internal.logger, logArgs);
+	const logger = require_logger_default.getDefaultLogger();
+	require_primordials_reflect.ReflectApply(logger.info, logger, logArgs);
 	if (wasSpinning) spinnerInstance?.start();
 }
 /**
@@ -176,6 +180,18 @@ function debugtime(label) {
 	};
 	return impl;
 }
+/**
+* Resolve the default spinner on Node; off Node (browser bundles) there is no
+* spinner — callers no-op through their optional chains. Construction is
+* deferred to first debug write (every call site sits behind the `isEnabled`
+* / `getSocketDebug` gates), so a browser bundle never constructs the
+* node-bound spinner even when debug output is force-enabled.
+*
+* @private
+*/
+function getSpinner() {
+	return require_constants_runtime.IS_NODE ? require_spinner_default.getDefaultSpinner() : void 0;
+}
 
 //#endregion
 exports.debug = debug;
@@ -187,4 +203,5 @@ exports.debugLog = debugLog;
 exports.debugLogNs = debugLogNs;
 exports.debugNs = debugNs;
 exports.debuglog = debuglog;
-exports.debugtime = debugtime;
+exports.debugtime = debugtime;
+exports.getSpinner = getSpinner;

package/dist/dlx/binary-resolution.js

@@ -70,10 +70,13 @@ function findBinaryPath(packageDir, packageName, binaryName) {
 				packageName.split("/").pop() ?? packageName,
 				packageName.replace(/^@[^/]+\//, "")
 			].filter(Boolean);
-			for (const candidate of candidates) if (candidate && binObj[candidate]) {
-				binName = candidate;
-				binPath = binObj[candidate];
-				break;
+			for (let i = 0, { length } = candidates; i < length; i += 1) {
+				const candidate = candidates[i];
+				if (candidate && binObj[candidate]) {
+					binName = candidate;
+					binPath = binObj[candidate];
+					break;
+				}
 			}
 			if (!binPath && binKeys.length > 0) {
 				binName = binKeys[0];

package/dist/eco/npm/npm/parse-lockfile.js

@@ -134,7 +134,8 @@ function parseV1(data, rootDeps) {
 			const key = `${name}@${typeof pkg.version === "string" ? pkg.version : "0.0.0"}`;
 			if (visited.has(key)) continue;
 			if (packageIndex[name] === void 0) {
-				require_primordials_array.ArrayPrototypePush(packages, buildPackageRef(name, pkg));
+				const ref = buildPackageRef(name, pkg);
+				require_primordials_array.ArrayPrototypePush(packages, ref);
 				packageIndex[name] = packages.length - 1;
 			}
 			if (pkg.dependencies && typeof pkg.dependencies === "object") {

package/dist/eco/npm/vlt/exec.d.ts

@@ -3,7 +3,7 @@
  *   The dir exists so downstream code can import from a stable canonical path;
  *   populate when first concrete need arrives. vlt lockfile is `vlt-lock.json`.
  *   Reference: socket-sdxgen/src/parsers/vlt/. vlt does not support overrides,
- *   so fleet code that needs override support should branch around it (see
+ *   so Socket code that needs override support should branch around it (see
  *   socket-cli/packages/cli/src/commands/optimize/ for the canonical pattern of
  *   agent-conditional logic).
  */

package/dist/eco/npm/vlt/exec.js

@@ -9,7 +9,7 @@ const require_primordials_error = require('../../../primordials/error.js');
 *   The dir exists so downstream code can import from a stable canonical path;
 *   populate when first concrete need arrives. vlt lockfile is `vlt-lock.json`.
 *   Reference: socket-sdxgen/src/parsers/vlt/. vlt does not support overrides,
-*   so fleet code that needs override support should branch around it (see
+*   so Socket code that needs override support should branch around it (see
 *   socket-cli/packages/cli/src/commands/optimize/ for the canonical pattern of
 *   agent-conditional logic).
 */

package/dist/env/agents.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @file AI coding-agent detection, re-exported from std-env — not
+ *   reimplemented. std-env is a devDependency, inlined by the bundler.
+ */
+export { agent, agentInfo, detectAgent, isAgent } from '../external/std-env';
+export type { AgentInfo, AgentName } from '../external/std-env';

package/dist/env/agents.js

@@ -0,0 +1,29 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+let src_external_std_env = require("../external/std-env");
+
+Object.defineProperty(exports, 'agent', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.agent;
+  }
+});
+Object.defineProperty(exports, 'agentInfo', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.agentInfo;
+  }
+});
+Object.defineProperty(exports, 'detectAgent', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.detectAgent;
+  }
+});
+Object.defineProperty(exports, 'isAgent', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.isAgent;
+  }
+});

package/dist/env/flags.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @file Environment flag booleans, re-exported from std-env — not
+ *   reimplemented. std-env is a devDependency; the bundler inlines it, so dist
+ *   carries the logic with no runtime std-env import.
+ *   Only the flags socket-lib does NOT already own live here. CI, DEBUG,
+ *   NODE_ENV, test, platform, and Node-version detection are handled by
+ *   socket-lib's own rewire-aware getters and constants (`env/ci` `getCI`,
+ *   `env/debug` `getDebug`, `env/node-env` `getNodeEnv`, `env/test` `isTest`,
+ *   `constants/platform`, `constants/node`, `constants/runtime`), so std-env's
+ *   overlapping flags are intentionally not re-exported.
+ */
+export { hasTTY, isColorSupported, isMinimal } from '../external/std-env';

package/dist/env/flags.js

@@ -0,0 +1,23 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+let src_external_std_env = require("../external/std-env");
+
+Object.defineProperty(exports, 'hasTTY', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.hasTTY;
+  }
+});
+Object.defineProperty(exports, 'isColorSupported', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.isColorSupported;
+  }
+});
+Object.defineProperty(exports, 'isMinimal', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.isMinimal;
+  }
+});

package/dist/env/github-status.js

@@ -13,12 +13,12 @@ const require_http_request_node = require('../http-request/node.js');
 *   most 8 seconds to startup (configurable timeout) and fails open on network
 *   error so a down status page never blocks a healthy workflow.
 */
-const MONITORED_COMPONENT_IDS = new Map([
+const MONITORED_COMPONENT_IDS = /* @__PURE__ */ new Map([
 	["br0l2tvcx85d", "Actions"],
 	["8l4ygp009s5s", "Git Operations"],
 	["brv1bkgrwx7q", "API Requests"]
 ]);
-const SEVERITY = new Map([
+const SEVERITY = /* @__PURE__ */ new Map([
 	["major_outage", 4],
 	["partial_outage", 3],
 	["degraded_performance", 2],